From f7b77bf2bb29eaee3b3d0d8c4b62ed59f24473ef Mon Sep 17 00:00:00 2001 From: John Dwyer Date: Mon, 2 May 2022 20:03:55 +0000 Subject: [PATCH] added targetdir parameter added ability to specify a targetdir --- PS-SideLoadHunter/README.md | 12 +- .../5cf715b4b1ea5728aa3470441bebc704.png | Bin 0 -> 21235 bytes PS-SideLoadHunter/sideloadhunter.ps1 | 372 +++++++++--------- 3 files changed, 204 insertions(+), 180 deletions(-) create mode 100644 PS-SideLoadHunter/media/5cf715b4b1ea5728aa3470441bebc704.png diff --git a/PS-SideLoadHunter/README.md b/PS-SideLoadHunter/README.md index 5a5c6a1..a23a4aa 100644 --- a/PS-SideLoadHunter/README.md +++ b/PS-SideLoadHunter/README.md @@ -1,11 +1,15 @@ SideLoadHunter-PS is a PowerShell script which will profile the endpoint for -DLLs and executables within user’s profiles, System32, and SysWow64. Once the -executables and DLLs have been profiled, comparative analysis is performed to +System32 and SysWow64 EXEs and DLLs that are not in their default location. Once +the executable and DLLs have been profiled, comparative analysis is performed to identify possible evidence of DLL sideloading through file names, hash values, and internal names. Additionally, program execution artifacts data are parsed and analyzed for evidence of sideloaded executables that no longer exist on disk. +By default, the script will scan Users, ProgramData, Intel, Recovery directories +for evidence of suspicious EXEs and DLLs. A specific directory can be specified +through the TargetDir parameter. + The main functions of SideLoadHunter are: - Get-SideLoadDetect @@ -37,4 +41,8 @@ administrator. ![](media/d78aff06c5247888ec422dbf40cafe9e.png) +To specifiy a specific directory to scan, use the TargetDir parameter: + +![](media/5cf715b4b1ea5728aa3470441bebc704.png) + ![](media/e13c52eb21f43d422d57c02ea9dcc8ff.png) diff --git a/PS-SideLoadHunter/media/5cf715b4b1ea5728aa3470441bebc704.png b/PS-SideLoadHunter/media/5cf715b4b1ea5728aa3470441bebc704.png new file mode 100644 index 0000000000000000000000000000000000000000..4294347e7d1bbeaa0c5f490d0492b3893ee9b65f GIT binary patch literal 21235 zcmeFZbySpH)Hbe&NGKqnv)m`<%JY+2`zi?Q36$KqUpKCzvFd_wL<$A|oxXa_`=QH00+? zbQI)IHty$#$Y1vzRHQ`j6%UYY-n*w#BqRP-&DCHx6=bD1>9o!Uml_ea$c_wsZ_J=N znkgnOQ>sSunWYueHxBm~xf(r|^i`JMD<2jy^mLWt_o$^I=Faa)U!$_t;JqB0Lyyo} z!_gMe>LO+zD;F;ul0lDRdaf&wE+4q1RgLD`|0C5#MOC799pP%bP;%{k*#C+5*o)}Z z(Ls~L;AP77LW;{??KxM2+crqZ8|LZ-uh12)yR5N=3x9opDsu1dRn6i{S6#HGME3U< z^3N%#xbq+0`P@VQ?;69tFJ4o%BBzCd^77vQTs|Amjqda%lJ1QDvaX06*oudH@BV+6 zcn#5mzisZJREgaiw%)zKi~Fy0Mg7&o#dP zhG_+||9G;J!5#39@>hY_>}l=rc47+{|KnmlPPY(mM8!dO~m}RmM*}z$Qcor~yH*B1O70*;WI&2tR+0P;r={@N!ubwrM_>Y7%uz zK9~NMmLjdAY*YcvH$)6(Votr-eQ^0Gsmu&C3OwI&@I*TU0Sx)C;rZuk}n@j=xk9^^~lG zPl93_QB-;EV_HuSH}0rrb-qq@-?WXkTF1w!2b!SVWE-*&_r!A7IOj~C^yzg0E=syK zxxd^hH2@p2q$_fV~eJS*s-njf;vKD$@@YN!pv(E+L(Z zB}5Br4p?!URYZ7W3^yq~B@3XX`etml3|}EW*VPOBK?+#f(%{?PSLjxyQZ)uf5O2f* zurc26XF<$x3xIqOR9U?)mkQ(rxd4*uWPJCpZv@Q!-5f7M>85ATNkaUz+vb7X7w1QX zic`6Y<>>^rBS{vkUWZsAM_o5Z=6-vOnV_F_vrwFU_6a-w_s^@0NpHs46z0zc_EmO7 zAEJd_YFwGS9d4M#KSf#zxeEwdXrh;ELTTjqy6`MKar?TKzLMLy-zvO!mV z+Wvlb94;1{J|8S>m}(L$&N!QkRKYPiXy;^elD~q@T)=dpU)vTDp26L{5cu+OsroRzcpHx)xacm`oUqP=*nzBE*6D1P}O z2fhWlh=&~Hi455tOhUTp4$d;n7YXOVTiX`Q?+m&)V%cISgA4g5#Oz0lB{lT8qpS^` zdLd+n`fPqoh1sMhpWMqw^I~2{d!FC}`qUn_zt6Dj(V3iDsCT}4nkp*s@JFuV8o9l;ls;;yhCS-HlAdzY$2xX9?Xf2#sYnRKak z(msdH4=s3{y)AZVps(x?B~UxrX&Ws=3atQ)2?ZSF zCWJ3fdWqmC1-a=}wF_amM#CrZ>4q4%`YXTI>kh`E`D>0=(?i;9=jt5K4h8H6`m`8> zLk>%}d7e|O|2$oyICX#QFpu1gzko-G=pW4;1H&|fSDl$GuMd9Wf~H_RJ9~0xjOsxn z2DWoI{p$=;y~2qU1;>uh9ufpK4j{C+5o_mZ+#Y4#H@oBYwwGu>33lP(v(XT3E~w{K zo$|cg6>Kv`Wo?$@9LTe}aYgg6&LA1qgDwo6<)H9dZ+_ejJ(6bn^q=N z@%h$h&<7UEsfu+E$i)ukGn`f755Vj45Lp~g%Y6#(9!t_D9`F72wDPK&{cg-hnASIb z`AGph!d`WnU6Ie8YAzUY{VW(fv%hf>9}z_8ctYgfc}ts@hIBWE7Y`>L>tsmo#m~*7=Vs64U&^BWpHvN zn=w6EQyg^=!WYe*`{0|6Ksh7H;!@VrXI#vRWHHJT9wl7|?b`~aMhdFzCuvEE%BLjpLQxQw> zXIekeGixJ_+$yIv52xn8#;XCdu5W_MSI%Oaj*?gA+T}o8Z$xRf zPEqqWs!yF&)6FHPvQ!JU9K}XU)Qpbm8R>auucH%T#X))xW*<$T&eenq-f(Q~q=C+b z&W1Ic@D_1Z6%F@uuivd@TuPn(RP+d<1-*Ya%7zH0&VijK^MJZRh2l1+n~*F>J~?o{ zP2+bTFU>=UH^^(9(6v?Fvl(#=QlZ>h7WS&FHtL-8w2xqa@@WfSHDrx5h}>H;J@}-pLtVqeSlqUmP$-UG~Tc`_3It>1gKNJaY?gz^*+1AjmO!+$)|4#0u2be z*bm-?J%T7hFq6cT3TS160Gt2ArP!52@t;8|b!k0*_tU0%@GJWVcT5;gp>y;sa^-Kq z`Z2LdZyMs>`qYq#t(0CJ=vAF6)s7#070^LDt*>Wb85lZ|t8HAPcN)%!N-EQN>h`MQ8u2%CivMJ7SmVsJp9tr%Z>|Kdr7_(0Lqh}WO-&!4vK|4dvJ!2>mma~nBFBR)vrl1eN+(A1O^Y57&k@>_CA#vX*w!YB zkY=&Bui-0%INH(Qj`PHqEP;r*8M+T~H^I#n(O!Ev90hty9*MawUpW>&o?hmD5tEV) z#liW#@J4UG2%d6z&6%}D+OS5*ut|d@Momu8ziLKKr^CO@16l3~ z!po-x&DyICzE&@Yrw{wK>AjM5^bTP0akXo^vq+KXOUMStJKYlQ`|zW3wZU>z-DZ!p z;68|4e3zh;WWc&0=(<>EfQaz@oAv2V-9=aQCf1)iby#K`DX|cS?;b`!fW70qrV@=pC?~*`ki-Y-xSbeY*ovz?swoxIL^}W ztidvYX7eM*{$}&jQFwVq?)x*pJJ>MGORc8R$E^9_3{&LO$1hLLPZZXC6Wg;=jrdTdxL> zv%R^Vp_5>T0zZD(-nZy6T=D4hTHB%%ydrqm6p3wsckp^OaGTjShT?$APbJ&8K#V9i zTV1i@!090%2my4jM1S@}YFHSLXq;EUvDd5-%Z2X5r0QhU-mqb6Dw<1`_R*s{7TtCC zAB-GMx%McgwD&Ghwp2=)wsuqCBZ6z?^rFy!j}Qo9UG*=~KHAQsMtO>YWHKfHiXy4A z_?V?(&)(9fhG`^QyQO{mop!-mLoh6U4h;fDVjps?K@6h!o;uB9SRfCQA zh*!zYcT1<6UdiqfajLT?ukCB|E@5L(aO-+doO<(ua$)31J|U9b2F z(lVcuSkhBxaE#tA{QG0zjGt6p*j$mEUxCQ$tSQjz0u#__cYT`o9?ng)3(A=nX6uPR zW{e=RDT!j>tfj(+?G9Vf(2<_HMwGM(8W2lopq+>Qf^76t zM5b%1kI~?RUvvtRm*;85Y2GB&A-o|7J2zEFInu&J3S0K-@pFf)33omH<`1+Cy^`Ph}Jn82}M-Rt3f1ee9FpQ`IZlic28uQ$q?K)7K8xa2hysd|N^pp{s3 z;$9rOTlW!|4AtO5Q!IW4l(e1*$V2C1G;_$u)Ew7(VroP1a%~Q3&)(~dZvb~cI$u{R z*#8agTP+saHTE>;YY@gj$_dbn{ z4Zo^%?JHU)_ab7uLCwdOO(Y+3)2gW?uR{C)sARJ9p_j*)cjS~ORG9tTpma~Ug|r?j zc+(jjpzg6yLjRuTk_~jTNy~842yD3aQgI=z~|JfVOXKxAh7kMwrp0qz3t(|Cih zZw{?ZHC`U<68zp`51R7!JYE=dIY=qK($dHs=DbSA>92d}Fz82jBhH!g=4(~W*joMC z*TBVVM7dG^c5GpQz;tUo)op*A)2 zdA@$>Ubuh!yR^XUV3y<8*$d1WE8kVELO(fDHl=-5KFX8u{;H*Z-5LsE?}jGCbP>fo zY_`T5Usvff-H{vX)h>?STH5>grp#*Dw4$vV6}?or6`@B>FjyDb`TgqQ`gds?Ha?jA zeS+kkXUe=iiXwYY-;xR>V6F8)%%X%21T9TF>)opM?<=04?M$0nB}W)5sxt&PV=R*r zG^1HZ>c;jQ2aK0*QslnL*opbL%th{OSz68{Ms5`g&>gp>NpL?c)8CnAb+?J7h~6Sh ziKeP;Tvaj@$#SqP-8H#iSw!y(xo)toB?7+dm~cHc^CDBLmb)BI_je!f&9u7GG}^0n zpTF1tFC&%y72WE5j-~eVzNMwMc;k^qOKTO$(TjJ(cp{F$zwZAJ?S$l?lmt)<%HL!- zAN((>$u|i3psw=V#^XC|R{9SlnHBep&F{+{I!i6)Ugm7jvZUEvV#)z3#b{_3ydi>iK;U?yx$1l zp(if);u*LXjX7OKyN)NCU6+UX9JJQjytVB_XJaWfxrFUOs+`oc0{qssVJy$GYeWiZ z73hLoJW+!%QSowoFR3uxP7_nNI*M`;hWw(W|MF*fIw*<87i1nreMO z67mclwB{cMTTGBSCSXkmj^;HH|3!+*-pi`Fqv-6Vhz`ihmkVfg@bN(%cv}BPdqd&w zBQopN#oWO~tM25ZQ+xKX13`vLuT#nDW+f6^-&FT43Ne|K{~-j&#agIcX5Ed2>p5O31wQ`G4uuxY+-KhpH?0upv5NP zqjSW4*r1SPp81y{ZF!FO32JkR15*LpYYOHYVV&}qC&otGH&t;KDhRhE5_5$L@Xo&3 zA=T{z_9#}wgTdkgTv7ttbEx6xvlk#yJ|M@eGwGfJZMq zX83n=Dk-20Y-oIcL1@k$7sZe75;U>wx0w>;SKQB>$T*Bsn&?vLU2=WeuiAR_8VJZX z_1*8&HCvTfde6qef5bCag!3?-I0;I~Q6YO{<`N$bmaG0Y$wqWMvo$!uuT$|e4lx1i zGf;#&?l!V$*U@9~v%oR2v(pnNHAu`|(>{*uN@<%cJ#O; z$toSK8~wMFK)%!E8B)Rl^v$&QNFMUKs9=X1*|un*YYW^?VqO( z*o&*i{$~BXOQ)#+5YM091S3=B^FwCzW7Qt!E%Yq6wU5H%uNoXLFVw-NSkXpU)Z-&L zyi`5XA>lps9+-!xSyGjRQEX_ zkz|TL=0w&;8kw~;%0Cqb-=o_}ZD7t&i_EX)#N>d=)*YhLitkNmwcDTgi}lr&`Jnrp zDH21g4@1;BnoZTrSRSB9Ntc~|h@0pQM`J}FmEj+k@@+Dqe(e<=6szSaY0f>v!)P4F z(uKaVpJ}QSkN2Fxt;%4CWoS*R_lK!Ch#DLCuCuE6z`1c?k`S9#;bY+5c3$xLF{vpoerCTi?#5WR5v(|-#r zR_yn69qad}#|j#87cqbd9@y`8pX@zk6D~6|ABJ@|^ zE*neD+TO#eXK0gYy=5Ad+Z`1IgrYa7d}0Lu4mc)Ur0o{eln5IDZ+0{gYZtoB3_!&k zWAJWrR<@Caq3dU%BN!8nk79wg>-6x#$64CnY5@}sibBaCM%ij!Q$^k)9gG8>w?iBv z({WX?vwOS6pxR3jz@PqGoGBL%xdZGAS%Lk~IjxtG2A5$9abi}oE$4eI$4iY*wGsvV zFAAtz=xADPo@hArM2pVq-&h!9rv3v&s(nNx9BMo(2A!K+)Gv>83$VVdIugJ6t-DC$ zh;avn;D(7vWX*nJ%y{;CshCWjX$`>iUOs2V`5GM*c8a~yAXGo$l}DFcClT-&X~?EEQ1aN z@m+uGG57T?!T3VnZgeFdhPLd@s|A{5KmLgSfRhpsRnWesaHTeP=E|A&yy<#Zwz9S= zT0X2Vhd+EL-xOaIZQ7Ui6%Ab}HRs;~p6}7qAr0CgT`{^n0_`hecL%HTM=}7=kNx~= zWK_3HvO3Smu6i*&xYyUrTQTOE=fr`VIYV0I_3;biSi}jCRV|Or@qYp|aze0CW;QgM zK$fQiFcc&E;!AhQR5{z77>=WkbL+|R+1>G1O?w{vX>{o7D=H?R6+O(#e$Q>Riipt0 z8f+}?eXgta1eQziyv&2_i7_C+6|quG>;<6bSy6@#q0 zDaYbHlvKw@Fe;D5CNA}$d+B_YAW(SZC7c4@AwX8-!~y7Bu{7V~kH)OrybF{V6&CkJ zjr1t49K#6ZRAxK|0bRp9ZG`?ph>*+;8(;s$ok)aTXTKz{^9s*;k^l zUk*JBmvWcp6H)9c7vQ5_0UgRai~lpat0t|I^!f65|3osH6FKZ0jXOTgggjt2FQ54t zddhyzJ;%5G!{Nmyx_topf^9N0xKYO0=T9eGptP-UmtEEJpk7mZ&Z*D8b;L)2r;M2n z{OBtf)cQp$D@7lX)r(mQfL0mc*tJ`+?>+jz(E>RuzFMd!*Yj((VWq`{vVnD4%lLfx zjhbq*2MqQ%<)}TUP3#lxzri?rSC6HHA&$s?3H?A*@9Z13dd=(Rth{`C*a=%_o1Lv}MNQcMnc{qwr-+K;@4tRYB1VE8q9(sXv!Y`#$sYlrZ09 zwyx&2SM8;1S2vpqLu+Z7!)|^CvfSZBXhE5zd`KoqTzUVm#lNFpG!|MR&gRD*C%al+ z7~~y{tQPcTgzeUCRM9erh_0b{CO#owOH|&i$CG|3pAUT9iy_+ZUbK>pq;UBS(~4Y< z#>A6H7e{X(B5sfhiwg8(M}yW`??r-SfdS2rf$A=m@0q@dsd;$KTyH=kn)@b?yEB8| zgBLt`t>ej--5Pd#Dh~v_czLwDg72se3S$4iK0lvP$PMgjbu%VYWf7W7Dz?9>r2bWe z_&@Cc(p){b2fgzek`I~<$O@B^(x!WfAYYz8`ny??4%hW*-qsuoL*IG4H5&sU6{}30 zMexaAJG@jXK`jufE7ELkvANqbFKR*k8_F;V-bZ&la=JGLQo{g*wAufCG*1ZSn~mjQ zZYlcT2e;yp8RXTe5c8d#HbX5ky!-Vc27AWD`E3)wp^c-VPjh_Xn}9>sFC27Cqrhk9 zcnc37J+dEBr5H4?J>)iVbs&Ppj-f}ra+=g>=N0IXX}^-kq+b0O_xrqB?3*9KGM((G z+k=kv+Fom0E|-}melGegloSJ2hAOEYZuRP03DQA?JrANFh$gJ~@-b7hA>C2D0M#~> ztgFJW$}!`dpIDg;&~IPU*PZr#u#KCZQ=N&EpbJ$=0<&HcQ6a$#cgX&w5y7B-u~v9& zIkSZ@a!t4A&yFKTFfW)2fGbrH#sOrqFDT24_3!xKp`6WGJ6Pt@7B2_JWpMZG)G}^imb9U<**{gVR45bnLV2c#j z&^GB6Ri0wcj$B>Ppgjr)MgFnoOS6^VnEHgq@$0<9>J8${%o(-t?KVC<9?D#`2r=8O z98w9I;QSAIUAzzf3?dx`b!V6bbZl+srafx=$E&7t;&|Ifot|{(#Wc%>=tnwieDN=4 zpl->g0QZG3+7hK$6F-Oanx70DQZc=YBD2#tYuFet``SpItj));I+$|>T(jTcy$u5g z-Y(TpNz9O=egMaXAf1<36(Q#Luczt-Id8!3BS3-j#&>EqN?*c$0AowT8^Pb8ZEZ7p zwvXga!($7~v$pmRuy}s+IwF=q=SL+r=#r=L3Sn7zYxzd_SiV^Xxn?nk46qF{%}AI; zem@k&($l#{71A1Tj98H$)aFYX9#;tLga4pCjD(vP~9j| z);}UbyNZ1Kp=R2hh6)Di>hp;>-u#$vaQ+R3Q+ud$!$knSWc`?DWhYtonML7JuaE^N z787DAb3UD{Uv2#4wQ<%m&!bl~i>@Qk89cGU(bX>~eh@^Be3QB~5nkTdkNq-v9h|&) zW}EmV>)Us}BCraTWA-RV&qc^kYSShRP9-Po5CN_lksIB7KHv?3#QitSPLS#UaSK-h~Jq2o+YY!FQ`8JfxcnmY$=1Q%;F`yE?1+?t3^U1HT&^ zuSZJP`y^_2sAS)VMl2996t&h=O=Y&{6(K%>DviL@hvx33C#i*Wj#wFBgJ3mwF0X9&9 z4rSZbzE$8|ZgUu^?Vu*Yq*lKYcc@fuz2qRND^3{>r3QxZ1T(d7iGjdNRiS1j1N#PW zl|VVUn+z%ZH<{M9oAiS2QZak3VKuLl@NwOohVV_*2JDKlO6>3&f&16@rnfhN-M{+z zXnCm8Xpgej`(CFEqy6LkzG86BHE^A}!Vj;mu8Ls&hc(_6Ebp>27uw6bOiyo{-Z$Bx^oNP z;D%A-c=0yaD8*0uXAR|n;W)GZq&Kg8trP2M8ZVoQc4_F6>K$XpOS=AWv$o)tI6cB- zO#v{f39~hr+y?=Su=~xNr3hr#<`E1ch8rOoBQJ-X4Vb#Cg2Xv zxZOV-zPs8k^{IhkE`Ou=J!B$-q=y03{}COxhF3C2#&#xoGPv&@dN?K=8QhP`{EhFn zmc>W5HecSr`8NpOdd_suTXH#^<<)*4B? zR}b!ti=G0hw1gUAb>D3rON(qh@_U%#4(<`TM5c)>6uQ#?YgRastz&7!5dZk~e}48z zAv4d*DbY7~TW8k>hy6Ag&(_OPg(fDj|Yl9=u?%2097TMZ{#_QxRI*wrW z4U()uCU{s5Srnvc{=PyQM%+_iO`9R$V9L9R-xjf^*-Iiz8keg>8=Yd-Vf+4mc*Rd9 zoV{-G93Gm-mKZq&Syv(g?#g;DTaor=WF?Yd!eJ<^PSlmPg+HabE~Ao;uoq`r{ncP4#qf ze_8yH^`;XG~`K};etqxj}JGL%&ai$KjIoZ~K(pFI+SJa2W%GT_& z9$PXQBZWNWaDOIy>7iR0ZCU-)9-ZV-{eV{5bxWlk2k|W!#A#H%l(KG~7g{a>Q6UPf z#Y?eK3lc@3S-KKgzWwC6_ws~{5R5#f0qfzzii^-P3$!>t8<^&*WAB#hp147v?oZCA z?@y0lY8lWULbIuUtac{Iy4qWKU8lMpR^f^un+Jo;&0kgNbVGUdGXK$uoP(uV5;ARf z%lwhHEz})Jz=_CbdvU)a?s5Op#nJf?CPH>ZJ>ntCOQgB0nd_jEY#`V0Z2s_rE7abQ z>Y_KkAmOo&b&B@YBq!5o#gT4e9uLVLjhmNE&Avdi#@^ z(fH&?F+WDu1Gr8JhwNF#g6#)1LL=7E|#@1rC ziGM|dWJjSHS5+ZQY2NcIzuAv%2HcN9kE>*CCOK4QqhxKsU&(S2fRzY(*Q?&yg+5>G z>KL9Ep+6MP8^U1MP7rTLvXHp!ZkvjN-@1x>=o5A`S#=^VjkH-cSR=?`kxg0V*%|+nrII3;wG`x~5(KrHv(5yG z>j=F0vKl#RR+qxg7OFKloLoPJ)VHpisJ$vkyaicn7231^?4sVt0q79VP?JM}c7 znXk3Z09{i0tRsblYseL}!}ApJIxD$tUjd8+!)4tu9jy1$R%1 zOdwaW=hZ10op%^=LtMX<5|jRzOv;d#`-TE+19w_cLZrK2^+r2vJ1}Uto`l8MfhQvs zn?r_~tKDVwlDBu!*`LdUFi7II+qqt-z0e1!%oKJwP1eWKHNOwNBZtg;g8}$rJICV) z?^s?Ts{z2W48jeI>s7tL{o!B+>l3i5eabJUSoGQJ z?0S%QoDI29LSu%n*-5WI;ajJi72xaJ zKlTvYUg@1qF>L0pFs`!X?@SZf_~c39`=tr;aYekPmY%{$eC{O<2+R+!Y6>3sN7tuh zlr<(j&eW@Nv58BUjKG_eE11^e-Pnx(3Jv^nlwZ}TY1{j4cK_DHBPwWn8+3>()RIi>2l-_PYvl2@na!bN*C^bWf^nh&kp@ww~l`&cPWqZ0wPI3ILzacq zz+E_C+k&RNL+!FRHG&U8W)v6n-6tg=tj^BlXT+4?Z@A1}g#{jwdy*SFP=t z>84IH+&Av4^U4i_WD+-09;n-&SXS4BGRZe1R>al8-wuh>C7Ho5R)$98i3T{mJR=#6 z%kR%(JPHQ^k5Tvz4!M(E^qTpbl{6bjesck=8MWdcm=45fxJW?BJ~SLkPo9(%L;4Rf z)+okV;ZB6Ejeg6v@hBiZ5F7VW$!qLe8G$bVJELc5SzvVGito57u=_JYN3JAlm!_NTEJvr>cK;ayYFsIffHYVZ{NU;0`(^S?+ zWQio=mG9T)>*4S}LYpSU3M_d=7%m@GZmITs@T%|hO|MPXGwzs@^IQl*o((7`yIVA3 zR(K^Jq^rg^+rF@yX{Lr4pLmf{*iSu#_uYBgLQA-Z`8D=lRO5@Qy zq3J?Npa08GM97gvBi%;|UjzT92ueJtN{LE5#a}b-+@>QE_p{3AeZ2l6x0s#K_C zjtK6$*Vp~?rz@Mot6yi@L{rpIYXfh+#_C^gCgeE$*V$5i*NQK5LXq`u`(pNp-=H-E zb8JDJ|KU|re5CfOS4uI(k>n=j_BkLo)0c$q{xKev(q2Hy!4V;=Nt(rW*5D$uQHADe zGme3KLPQ2`1p~?wd}CJLjw|)8cs+yS;vXI&j}N7I!`a!q4t~$1ms?AhR)|m3@IE%~ z6q&Ef3xatR4GPaiwklsCq~2h_?hn0y*BdFAO;cZkyC^KSH5?)_N<_8gwdI}ra zvMmUVZLxl{57)hLDeQQB_3*ZKfr)>R_wFZmg?KwgE_QB?O(CD&)v5cf7%hFxS)fz3 zO)_0fn6j-8))bRj;VrDSk;JGgZ|3hduIobZ&Diw9uPFgyOUwMF;ca413Cu}mvR&jZ4|9)o^5M$x^h-$YHDSn8|OQoaJR!mDViOY0ei~G^ybd)bY zb~~c;@!NAsVedA&Op}Y(BrzEh2}2m0H97-v0>Z3Jq2I~q@)7asaCknY6J%;y^7ZtV zYZ#-LCro+{)h(9{2zIz^Mc8=M7TL_THdpb#F(kb8&{`O-yNMCN6a|W|(t7;fkhK`n zwE6xdU4c;~slK+FcpQH;8nW(UPTYyq&2{BnEyVN|k}yMnxBR>S$b0dt^;;j5r^K}* zZ^MPSQ>m{VUGR02Of6o`)!R-qvp#u|to3rZmtw&vKPRW_Js!C&@;Hp4jp5N}L)XkB zYF$ksx(kPdfkQgtZQiH5($Wyad=mUD+`BBw;nM)JZ=u|HNE_NsejDjpNKqgK}>CRpj0vI_wkmP=)S9GaNi&^>uEQ{JKog4b}j1d$8t&F@J>aZ0jc6V zP#`j2{OHpww9vyMoK&Sd$xrpjn=aABK9;fnMrjRDI>n!3eVI(X`5>2>Zo8wX2KLRl zT@5eyA5Kp#$miU<#%LWDAGdEKn~a&0)L65~5cbVn7I|KQKeikT{z}Bh-u54PlVhe? z>b*2OQ+-v$tOrs-X!7H-mH=v*FPpLQ$;H7O_9{IWS9$MH!{$=Pj=m;kgKWm*GHaNO zO__f5>oY3$lpZqW>g#abC+Qo`vB{jP|L}spX>gaVu{X_h@-=*`9+N)pLl$qb`D~eT zqD%~_il*p`7KqR6Z`H_1n|$Bu*;~yD!-Ab(R{g#v5euCY2;dYm7{!Iv%e=)3GphonVZp( ztYpdw;(hWD`Ky8|Dqf=(Tf1VdnInPy72wGiNgwk)v2(?fMk#LH^rK-!8QM20Fkv`S z7gQi5%+$B)lx-y`ynrf8N}dPZT7_V(v`cP6YH#Uqw@j0_bwoIEE!mWy#1bYICx#D$ z_Ynl*u|L8WmezH9bsCVp_e(DY9Uw}dDoq`yfCD9T(UB5Z&2Ok>6 zlyvP9FrVKKw=2i^^rRP`5Q{NNH_HQaBX#^GkkJ#66Cqv zPXRlrQ7>j4LlSILtf+YxPIkAoWcAqJqj?UE9_`f_v+bxG|44R9$ua!;=53@#(>c(6 zTH^3N{g8wP*Cd#fgs_Z1N&Ux8W30EKce1ARF=}*-4FUf5bo3nnfZq z4(pt;TK#48eBG&idi>mvd3SDK@t@0A=a#RHYs8wp6Pp)q56AO_w;BA;Q%DZm z*O&fdm_HJrtE!#6uTY3NwYExhH(S_3xJ%6RezWr|ci{Ulj4o&@p1tgZO@<6}3OXvI1A*oP7rb^WR41}C|XXMlu&WjD*rSo43B421p zJA>vgVD=HIy5;?MUwrny`#nn-7mb1Eiy}5#L-Pa3y6h4(1G=sgnJRRPlXB%L}?g7nraM(kLRSWZR^3Smju)a%DnC!+GwY9=SGO)o$ z`k`mXxei`*NB60CkQ}V7@%3nXWc2iLZ$sH(C_cHAH5m#<_-q(QPB9j!4p2YZ-p`Sl~m(B^(e2p{8>)IaU^4^J$GEws|Knhy{ zlbR}%`MG3i*NWf0dG@uXZx^m_Kd#80Gsj7f11mhK`m{S-pfa0Pk=#a`yqQ5%7jw;B zJFI4I+S#P8(Z%q6xNh$2-AhGH_wwl8?$FZW{0wet&XWj=a>$e;NgN$E3F=RCIyy~l zI};i$gKZI@FjFzf6O+neH#)kDRmqVBPcnOkpxA>)X1ZV32U0i@b9MiU-?$+Zgr6cwV2-aE$bWgz8Jiq1cp5wAw8hZb|Eu9fe2d2pN9^UTg~e|v za>g|NZv%U;!hD7sbD|W)MF&c5uyotv)djS?-~U*ZgO=BtU3ld zrovvsX}@i%Q9uWe-Vkm(L_A|VDUFOjI`5P0FG}6a4yL+f*|pf=+rn4p^#hV-=he|f zKLrl5%GXe&JMa~rtfKp~@fO7TkR4NJS-e=8sbw17EGGO;5&EU0?RP4&jJ)#GV2)dU zp27J=nQ-@kU3-q1;F^qJNPNB%PzU}~jIs6mH0s+TAmQ)B+NXvt3Z2$BzK(10J z@fPa3?9P+$^@~n^2?HtVg4wYN>gzT?_nfC0GiKP1rOV}fv7kEtGBs6IbsyZwAeN|f z$jmk;fMuFDf8$nJGz|-$c=^*jzNo#KiQOr8GwES zoBEk`kAzS7W$Qdfo6OO#!AMKOLDBqif#Y8$nl*&`d@o4ig}>9~g^gx=e)6FaB+*d( zo?OnCzs*^YlDEra@=D=0q47mU=grdH4l!7FW%qsYl8Vvy%;3^-343u>vD|D#dQ~%F zWs+a?x;4v1Jk!OFb=HxKN97aaE<+m0W>dIDWpU#-HKZI(WA5mstNDsfFl2v{j{EfSGvw;~%21Jt9U7_OYbS5or5Se1ege4h3bE?Gsm zdm9^GKE2gvvS-ChKf=WeY-!E@!F;vqRC#i|*`=g{*UmH+?e9+huD>lGq}HUhh%5>S5lsj(y_!-l;6w-Tms{+8 zCZy7hS5x_s0*EjaWVjgkl1a?+P)qj^ifQUtj0 zQT#-xa|S?Xk57Gx@(uIVd;KT0nJVsQrO(Gk{D)FZSKq2eF}6BC%eSoWfsn~i@ItQ~ z#1L=%TRA(&Bat19p$Dqst=P@eIHg|oED?sSAn*$zB9j^SZ#Q^MppQV^X%kkVUt(F* zyxt4tz5QO}vua$X9wC+hE$Ubo8Vz&&G(#ORqa9y$eo9XdgNPnkJBM4KnophTY2A$R z>j{v!n}5cixp6HRf3N`6f?S`4DK`Qd_U;dFIGuSwYBW1qU21gW+HF6KvKUudeay zo$4?h#I~1*U;nnh?*G)>C>p>vH~LWd_nu?AsZwVVQ2gc74M;11l(i9x9E&7{UZnZKdqd3G*tZ`$34mtKL%qg5eXHt zq@*EBmaN%AGD!Aij3vwCH;5-owjnVYW8a1emFyaWry7i`*%@015wdUn?sR_iJm)-r zKIhy&?m73|?>*<<@AuyKeSco>&(V=?$q&aSAhqtiL^bIY8^T3@U5kb~6#dZ&R0-u4 z1;EUDe8EJY$2M+h$O33XM#Z=|fy*q2cDzxbD>kRoX{M(BvWT7%*ho(KWsS4tb!ITa zS1?XOy!d%c8QOz52lk8(%`F#>TmA%c;|Zn!Dm zQFf5# z^pq9Ppt`k1_@L9Ek_3Oyx;KRH;*RnBN=Vf3HCg9;R}&p@#E1=GAw&J2LBNzTBdmtE z5}2s$kXMTg`y}9YM}b*FAFNxn)VsQHY2I%2!s9o8kov&mdN}=`b<{Rx5nqUyzj7p@ zVOsnxIp{-*VMJVO7@r+;1?A!ECd!?IKwY@WJiY7b z$CC8qE8A2*A^3tO2*XQmZ}2>r+Ar9zkb|Z{yMTftaXoQeKoJ-I6<#mi-IjAti8HUJjG$%b|h}f4Q6*rW9X#PxBZY}WBUZx zLu+3Yu3eX&7-H?CU4@4IJ@Un9EZ9SF*BBAc^{~ji?&afCN!a>tq%Q&~JYwgQo#>ug ztQ$#9gH1}uSW&4}Ud_{o5Y`^Cd=UwK4nbqir%J?jOyDj#iZ5eoUQ6Xs?bi*SyYTtk zm3qX!1=LGDPMxHM!=bPV=`!l<9>>$z4h%e6Q*_t$dTlwHt67TPI2TES)Q)1t+2Qu2 zAwf;hg*dOST>?&x1umsRR$%>}elFp6gX$6rrn)~mMyBXF@0lIgOn=n5T75-qCMFM@ za@e`ds?qz@tafg4-2qpM@N+dfoLh_9vcMNdUuNG0Wlpcn%RI(s19w5=Q^90mvn&(8 zo_7_IrC-5RU7pEnPfSC3>|nvjlk^qBJH@O7pz*qoY@#3J&jErNpcwU2Xmd2(vnS6- z{Em`P*^xrJT3Mg9e_xZUKG;lpwVVxKyvNM&1_Khz$jltwpV3f{>OWq@?56<0?jHIT zfI315W76g8Wx)*`rM>0uL+D0IphjQFgh(ZrJwg8!Mr%=3(9y=8WPt)=VzCK!vv^tO z=AI{s+Fzrql*`Nj2p*daGH2Q+p4jyx=cwM{0zEP0L4?_kvCK-x0|5NtrpfgVDpPH8 zV1J8fZ{5SchJ0wL1bO%6;x;Es^#oYGI+YlF7bT(PP|R&)#ntLGk~5hH&Yj^hHgJ*X zW;^;tJDVD+6hIa>=pTGmsbL-RqGY>d%YvJ)vz2Zy$6tGb4kYQ!u(?v{J}qB*>KfDb zE!MH6tK|tzb&HlyFpHH?8#T6uOG4%W0C$Z3uC~P&1@k@loJTv(*laFk!p}Y<3N&z- z*4d}bnRYTQk43fq&I%}B?{I) z>0<3Dx}}gUY8NERYZ#9W?q<3oKr29w&zF4B6;~nE_gjEvcl5Wwz31BtSC_|u^4wBA zxBO@6?;8>Lj;7B03J9H{7oWRo+`gSbaJ!!iCJ7Bhz2xMaMsu;A_TO3QF2>IkPV)CU zq#vV4Y-y^0f;=g^TSvx?mdf^!r+O9-QK-|rqr2y_ackO_o0TlF$u!EvP9u(5$UHcf z%`l^MK|ZtUm^!C^%u+)K>f74jWzd|gAQe=fUXV9v8o7nu8^ni@J-GjGw*epR&_;h@ zqwZ13@skx9tG7+ao6Qz|5tH=8AfeU&yvD^=