From 883cdc3e5cd6f80077327ea1cb1033db04745a23 Mon Sep 17 00:00:00 2001 From: Dino B Dunn <63437665+db0109@users.noreply.github.com> Date: Wed, 18 Dec 2024 09:29:17 -0700 Subject: [PATCH 1/2] Create README.md --- .../README.md | 38 +++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 techniques/System Binary Proxy Execution: Rundll32/README.md diff --git a/techniques/System Binary Proxy Execution: Rundll32/README.md b/techniques/System Binary Proxy Execution: Rundll32/README.md new file mode 100644 index 0000000..84a1c2d --- /dev/null +++ b/techniques/System Binary Proxy Execution: Rundll32/README.md @@ -0,0 +1,38 @@ +# Technique Name: System Binary Proxy Execution: Rundll32 + +## Author Information: Dino Dunn + +- Nickname: Dino +- First Name: Dino +- Last Name: Dunn +- GitHub: https://github.com/db0109 +- LinkedIn: https://www.linkedin.com/in/dino-dunn-cyber/ + +## Technique Information + +- Technique Category: Defense Evasion [MITRE]/ System Binary Proxy Execution Rundll32 +- Technique Tags: #Defense Evasion #rundll32.exe {DLLname DLLfunction} +- Technique General Detail: Adveraries abused rundll32.exe to proxy executtion of malicious code, the goal is to bypass security tools by utilizing a legitimate process. for our example we will run a simple .dll file that displays an Ascii cat as a proof of concept. + +``` +> Utilizing RunDLL32.exe a trusted windows binary, attackers are able to execute code within a potentially malicious .dll file. This can allow attackers to bypass security tools as it is being run with a trusted windows binary. + +~Markdown Supported~ +```rundll32.exe evil.dll, run''' + +* Technique Platform Specific Detail: Optional + +@Windows: +``` +> Start with creating a .dll file with malicious code in it. Our example .dll file is going to produce an Ascii cat but can be used for any number of malicious purpouses. + +~Markdown Supported~ +``` + + +- [Resource 1]https://github.com/PacktPublishing/Malware-Development-for-Ethical-Hackers/blob/main/chapter01/04-pefile-exe-dll/hack4.c (You can find a precompiled version of the file here if you don't want to compile it https://github.com/PacktPublishing/Malware-Development-for-Ethical-Hackers/blob/main/chapter02/01-traditional-injection/evil.dll) +- [Resource 2]https://hadess.io/system-binary-proxy-execution/ +- ... +- [Resource n]https://attack.mitre.org/techniques/T1218/011/ +- [Resource 4] rundll32.exe evil.dll, run + From 8adbf2efe1e8d3d7497ddba53f10ffba1e450933 Mon Sep 17 00:00:00 2001 From: Dino B Dunn <63437665+db0109@users.noreply.github.com> Date: Wed, 18 Dec 2024 16:33:03 +0000 Subject: [PATCH 2/2] Add files via upload --- .../evil.dll | Bin 0 -> 87123 bytes .../hack4.c | 28 ++++++++++++++++++ 2 files changed, 28 insertions(+) create mode 100644 techniques/System Binary Proxy Execution: Rundll32/evil.dll create mode 100644 techniques/System Binary Proxy Execution: Rundll32/hack4.c diff --git a/techniques/System Binary Proxy Execution: Rundll32/evil.dll b/techniques/System Binary Proxy Execution: Rundll32/evil.dll new file mode 100644 index 0000000000000000000000000000000000000000..b4647705d07b8aeed04cd17ae0a0c2235bfbfc51 GIT binary patch literal 87123 zcmeFa2Yg(`wLd<0@7}vr+Ep)>?3E?ivaw~!1s80iYOm~-B}=j`)7G-IvIS~rS8gG= z$OeQE5fGB_;zt~kmyiI#sg%3~fdhs#jHwAEA(SA;kT?Vg5J120nVGxIvhxc0{onun z*w1I~opa{QnKNh3^trRO7mP5KF=mDvA7|`dyy;iQpJ#vUL2%-f`xDvsY`@66SMmKK zuW4&X(9_%3v!$=4%hTG@-Q5%NYz}z(`nx?H-JYttMo(8yTc9{0!CoL)*H<&vc2z37 z;gYm=W>VO_5atw{=5d%zMJyde#c(FZJSlj)Dbj{9gkxFjOh!OQ1wIol>Q_emDjS*z)l82=a3mkuPSmfA=t7-BKEfY{Bf1g- zBEK@C>kD-Dw92v`MHtb|g^T)?F;+2WzCi4u@MCZ!pTvm}#>$AUbTJ2yT#na^aD8x# z;G%wIL^qFXgx#2i05V^)gKtI=!CS`DUBHn$D0~m-GVvbesPLnV=oT#Gu-AsyA<)_J zevYHUk20cLD3tIvVGo0j^79e_kzX0nEfVr=C4Qrl-zyOs@|6+YVv+9GlYlq|x@5fn z1Q+!yBf8Skd4w7Q2|FdzWduZiWuS{dpZGpb4S0tW-t#kd;;Sep*OW3=zOKA!-G=pz z-htPPyn~O|4nBO~c>k^;?R5|x7`<}iz?kA4%AJOqQ2NFLR7``~6A1DR6~4cRv6I&O z#?W|{k3Z!d96RN8efvD`;3M7xqy1yvp=Amp4Os@>HM#abf{6D`!DH;Ru#5XSpJU#E zpA=nqiT~pAi^?xP;+nD_!Hf;Ouk`;e;2km-l6@lSJ79m_p}ZWeiMScgYS(W8_-_5gfWFne4=K2d>s0_516s0B*uayRgC?J z@^*4B0Fj^4QSa62$%A3oJCrtqCzgfo^ zIkA?93oWjp2n&E1374J+>gl1FgTE{vOf49E(l>Y%MY(cF%Y(egn15^&`i7dpcL#s% z9sJ8!D^f;bKkwTAZEzp>yXxA1J3ND9{gjH{z38ul_m- zfB%Q$e_!3=dSc$HI{^IAeiftB=|ig_b{Rk0b6>UP`?B! z3_Ot-0ZQK(Yd|_DE{0%S&*60L5L7%Q1PuF#e_l+-oc;31b%Q40{0^25dhROo_Iy_Ju(ve zTjw2o6?Mzw9jtW^uFLcdR(l3MovDVZ>A8Ico~F=JdTw8WCkxHPQ|T`*zmL-Q4Qswx zC{p#g3QGOKqmjm8mFU0$Y|ctqH*YzcZsNza!K~(D#PeOIjSLvwWTQyv!3_iGOVCh55H#pjV z>f~JlKcroIAvaGQR)+d>RNDra@^j*HFdL!#47{&~G7cOMr5O3-!ixGeb|ETZ1V3WP zul*H@8(3rt=|_3jHt@bFl!C@3v?fe^;Uz~<--dG+50O?D%%#`j--dq22(z%-Hi7w8ex(jEVG9IvQ&cT)su#!Jm1Ds|uR$6AevML9=hLs$i3E z&{we43t!RLD-JZP_fCQyM12`fcnG7Qn!yLhu1%nV2^AFa$YVbQp_i=x!J5HSW5Wm> ztH)!+HDwPXGtsoyds`Q@UqFOEJMfO{`V8n7=FkjGb?IZ?fzixx`{Wy9zQsrSQoKX; z)}aP#jdBd2Yu~kCRX*^b0@|YT#eeC4&O7+4F=i!>N1-Rz{y%^KEHz4GIOhl62VYjb z3aEB?L{%C~K{XlL;4HtFx9h`BH>jW8NYqUQs2#q{%<;4bb^#`Cp9Z&~s)DNF`q6=x z9tc^7>pvKH>F@o?1KO7m1ycN^9!(RqOXyy_Lq2dAYARS%es38f-fPCA%2hS$Rdf3( zg~8R@(sQ>){WM=?3#t) zWUdF@kUF&5I`k>CPdVlK!4tkAt55mc!22H8{uzkmy80wY2Hv-Zt{QmX?K<;6hCa`Ghd=#+Y!|dV5Wu#phESjwFQBHtmc1~s_r{+oANUEZ z^GH$Ed4=z+XY7h&C!Amdy8y=nrzp3T=D~*?jaJuzD~LZtInfSJxc&{iU*U-oa3T2Ynwb@c!wrmAn2<+|h0hNu3;cXQ!{`hlo#QGVZheHmnqv zZ}CT0K5#FgF?ibjeJYRNBKqLM6P;YfJrs+uj{@rjdL2n9i#7D%$zSqumxNvWzktva zck!4=-=K5t|B(7=mx1TjWCaS=bQls31{SsjBf#*Z#dWUAWa@4Y=c#+&g zj`624HXVN!l|K=x4B5OxmFNWjLLK9UZp7+;0j#JK6@wn{c%d6{MK$&eX{*6|@Nw_p zGhkrHs7??bxjz$1!`cIc{5{p%!6Vdd%<~TRqUBgnOp(yq|7ASwj(!qR`v9|6z}~^! zH@UA8ZPM)sI(g^7qvI#PA^Wc(?FEFQv4*fbEew=J{|KhP5-i5knmNmaZxDB`F zp!0O?{|@rFy#$Q$cDyO>t6LROT<9!iwLcV;?FuFsAFRmQxn>Jd$h>VPt{PF(>M5_Z}CHYR@IAv#!vek)XDl5KidB?1`pEyFsdK>GDhHN z%dOi#g-JqN0X0kQdzV1Ajo#J@BzkP`B9g6tRr}r@kf^`Hbx(b&claWACOmpOO0HtK z0uq?fuUv7Y=wt$y7mby7@!vz!%kM>R4l{U@diLc=3byx>cM!b@uMy$=J|BaFNvHiP zU#NjZar+<&1`XvxmWZC(%Y{&XE_dBimg=4HM9pv&%d7^VbM4G8AFhXNsW(D9$BH8M zA@uW*Z}EfB4@RzwpXj?YT0f{#8!7$A+V?IJ#Z(_rMaVYzsO(>*PX6q=$EypZuum9s zmXIGJ6N8%8`lUYQp}k9D%ej5;F4E~K*F6OGVxgG+4A9XZX3}5LoxcVfPIb%{Z~N$5B52|0}mC| zEPjI9=TJq#-;O;vHpQ?H-%##jd3;!j5ZTg;|+VDf=x$^-ffbXAeBK`_-x;ud`P96-9`&0nfi21pvLa z-n)#}YrVt1g3P`w@7@y}8n7|%Z0_Ts+h6m}c+d-E^TycdVyYH}f6l)^2|09eftlVm^N#RpzmU zVCo$>kA*tC80DeEbHfHh1>WHbD<|*{QWv;njOGJIXMhnYZx@Epl|18}@k{UE+ujF1 zRJ{+rYW5EPaV(WsqL8Y+gDRvg@hW5B;y!tYwEO!h;rl$4`V)8%)!;)EA(baKyoY)U ziovIMLd-9K5WU}tPoeblG&op!6Gt=N3G|X5HLY_zJ-y;PuUU)$_W=kXg?6=Y0j~D*BOQiQx`MzJizbW7U zBH!1__b&OqRK73Z?+8CTm*0R-T=wUfE(|K=zZdi6J_^)8KLanIPoDp;XaKb@=I1Ur zyIo*{7xNp*i={s_Rlvt2{%~A)Oyp01|IanB?2_W*OO~(#fOGjsaUto!y zQw0YWl z`aFegp3OT$fuN@)$)%N?%Ce$ z=?w<@+j=~FU$BMJrj71UPis%7XIr2zNQlC=Vj=a}<8AH;d4e6g0@3s&EzqYY0_lORpp@d{G?C;_Sp42fO27PaM3mvT}*1Xyux9Gd!hp zXK(N5o`+qgsNW~ypXlemV;@nb^uN=K;j@#5(3@~(1MkPNlW2zj7~ZKVI932ZoxPb0 zR|J0<-gR)Z;IGH~BDfOxH{sm^Hy{39ykCS{1V6pAQ?dRIzX$JY;e7Cq;C(k-GyI3~ z{vF&!M2~k%8qNg4--~w;t{472c%Og^!G8+xh791~--P!Mvl+V%{!zS3CNcI^`04#6 zxbMM#2=6@XZH*Eh@2R90=eZp7 z_b=ew@E^nb5GL}e@YCCZMTr9VU&Q-WxDxn3j-LW1iqpcJ71k2VCcRgyH;pq@ zRb$o)bBVgi)XVc1#|JF_SN-_eJLITnk0>`Ia|9dC7#12~pS=HfXrO*1l8@$_&_>^Y z_9hB<5V&68+;GP4PT*dQf(<;qPf5J>MuGLncZq!a!jU5DHZGb%Z)v zTRI!%JZhOz-5m<_#iLosv@#I#wFE=eeSJNBjO|iux)HOb6Z4mN;%8J}pk>=>XtrBx z>oPja+q=DgcImVip-`~-*+27vZ-OAVw=5Of=Zt(|p zbc7hoRs0+i~JntsM_8a2%vve+qWa@ z@MW9(0wQp!IT-5e3}D^teDZa-cJ;DN=56i0eI4DQcE$pxT1-JP>#XS6QBH$-y5TKhtRLlNSyYpiaFa3rq(#GgBU-Y3#B)&mazqjiCQ zqG+G6{zL`?uo=0lqf0Vv~W<^j&ju`ho4)R)<9 z?%O=KmE2Z#Tm5aDZtJ~m&ut^O9lGuCZJ z+x(?6e@dP3~ zqv1^9BE8qb;U&2uy?4%99^ctw@GFt~EoUHSf`83cgMN>s$1$1-e}aDTr3SsR--803 z@F(a$-)Ybr`#&3KQvS*Bf1C!|P?I&L@XA?=Wpqzv>B8_zx@UG5HfCmbwFJACwS+?O zh5EY#%eDl%1AQH>6wueYb=i(Z=guawEuPtRb3L=$yL)EW*HkksqG6a$j|rL-P0?Go zw)8P8?SuG3%$z^#dQfUsOJ@&uGWesvJJ_+M8@o9eg(F0Zgm8q(65NV0z9*K%bo8mibAE_9?mhajbT zM{A&$_JS(0W5h0UBz%C=Wl`uAoh@5}>|%j8N5~rjtv!8h>=H*_F4$Nj0dl*G`5g(H z&?32&HT_+i1AX-^_@ENAw!R?SB$#DJ;?#6wyQ_Hs+*hGF|*rJcpNe+^`+jPt^iB2B-B&Or_|5oaI%1{O8q?< z`UMusBFDB}(m%%3vSM6ySWNF|egF$g(Wqs(*&?XX=vTSrVC(?($Kbp z6$#)PrD5|9HbVd-N<*-h%@n{F5Yo%e5x^mYbg)?hxE%~S*lYnDRvH$uV&T76X;{qW z2>+D zp8=`eTfU~sSIxc@6~@EgQVMUUaL$}#-c|&&sFtX1T~p1PYWBEk#!*z@`IOUF;W1N# zVy3pkOlRY{kJ;-_k9geVVd(VryFj|YUt2nNQ8_k%)E{d_^MF=-J=@s>TGAI0itj5r zwrpjin)_NnR#qU0AJi-wDAS01EnE_1-y+}^19q|Wmr%DaH()>0+-Ba8xApXI?hG)i zzo(m4bkGM_=4RapI{ou_oJ;x9tY%52-vQi0&1CkkpduakXHuG4ws6Epx}BsnD-D5Qpl@5C zt(1)ml&0`?uex435`gS+X1YYSw+90urieBMjX154HDYy*Y7R3AT4$K&T&4&ttkkrOP(dBI0EV&|ljUyo^}|F2})@WYpatvsoPF(4WWA z+|?Dq+AR($wnHu>)AO0bVyBWjq_Bc`?K&;my$D)#NO7x6Ea^Tp1`cnar44Pvc@`^y z%;5`cX=&ZbmRhXgkW~rL&A~;iT7Vu7E@mqPSi(UxoGS%fCg4)$6>zZv`2s`G8 z#T>C@4zO;)f_iYyB8#Qd$?LlfIFaR4Cp`fuc@5nbup+5M$9a?F-oC&#wo(9b!Z(PI~PRZ=R&$|bHW*8#7U>BKarCTSkA^R{%ib)sBXCFM|ylDt*Is|Cz*E=szX z=vH)KWJ0FQE>5yii<7)woP%MPBw6`DXp(av3LCcnmRVK3k5bamxT5x<$X9m z)7R3sa~-O1eGgh^WMPw_DZ=oevz@ghWsndhOegv6Qnt-W77o@+xHTy)%YkO-eb7u> zRafD!t5{WC+2mhS-QmIe3U(gbGshBFjQ8TPo{n*3>jrls8s0iuR~GY&MhrMj|4tZ}L~y);Dbw-ZkrdKBxxBnz_g} zz2`HP-VO7SKYA}>8oetwGM(O4C<i(#vcFRW~%$H849Tq49u& ze2}H4d`%N`60mN~>NRy6*02Nus;VoY8Xrp}pr(|$IR!jP!ZVj83(tI(!bujfRDoE; z(l`Qa(**{;4D#`DL?-#5jz;K(Wf4H*g>3RPmanKTZ)hmr$R-h3Df~I)r^WuN>J{kY zt5_}}eD##i$-=vV{8Pv;rz8dBuYm~@??M9B8PGI>R@C^an`&ySSs6hUzPbulPCoFd zF0W-3!e7?_+hCQEfa)q~{;bNNh@h$oMXU^(6@;iYBFPUmRyV9CyV^rwjn7xT5`{KC9tG8w zH?9VS;M%mYzM2pK*>YN$6n1Oh@1Ey^?fJ1~L>ozBN2`rv!Y~fi!6>l_6-8iT(}|1y zDviuIo0vHL{%%aawgvn_oXiXL_tG0%O!jNeIe)@nzDH#r%-V}k{VF`pkFdagQCCYx zw;!8RL7Z>24|(3CYUZzBzhXUeq-K5%ohhIig3>Z*z*L5Cmg&fJzY9*2{p}rnXj-!f z0Mv=`H_Il#I@urSZex?k?`Hbf@tRIC9XaX|_|w0SM=G*bMETj#;csEev;rFt0^G%v z=^RX_n9IV1twdNG^;x?mEXUgoUPP7>_{C=FEMEnq% z`mKRBHplrm$&?NH59;lz`Bv)!xXJ;+SjVTKkqlAT<65W*P%~ul!yM5c*EF$8H_70Zi=h0@942$L+ccm0o@9h z*G}W|jy6`8KuVUV+Pe9}(EpeR%fDDy$eDBhfC$# zqCB?qbt7!Sya&O!0-6m4Afs%@EnvhIFbgy@;kW`8z%vgnN&yWr6~*vi$iaX69mj|V zDPTFGETw2d0Y*xsfD@oG6kypeMIedkwlE>}9G^_$VPqVrND~XHb1<{?xALZ*Ehn=v zmhvg5^ivLQ0w<4CvZnqaj)%|RR9(Sp*Mutj`}zXip{BrQ29ueLyKR`NQ|uCd4b9bP zOcZFtq93N4TLQ)e?n#|gc@$(RP5h$=_M|?KgW?d;lX@8uF#Xqf#&D|a>FRCi3&b;g zlrtoYPN_nL=%9fchFOp5OE}l+9hE$NAZm$m3b6@b{jv?1i+NIO{4_Re+Y-EdJ1sDo zR;UWCe5omNMF;TT0N0_v2nRCOh>?PZeU?$wYsbgC&oT#c*22Ya#a<4hFv)!u(-}8b zOz|5l=H5_WTSt34R^+ti{9BL}(}Y_sCb89m7hlh#%)E7D=1ufw%)G~8eF~;ca^_85G4m!L&Aj;=GjDp+ z%$vV4^QJe=yy-1w-sBTAZ;lJkya|#sZ%)Ez-sB6&Hz$-cZ}LaYya|lVyrZD-%$so0GjB5u@BL_5nBs76M2$@( zQ=Ehmjf+|Qewz6EeORmX`|&jju)tMC;SvaEjh=?jbsmRJ+f+}l7;?MiEJMdEgF<#8 zLJ}p!l8sr{0%b%VS~LzXCd1u@myEgzywj+AHCpMol-hVosYd7$N(MjW zAg$3`ds%uad2Fh?MC6xgq(Jr-*iyGLj<@yW?N*+G^8N~U5b69Ex{?2Kr=cG~zW#6Y z9MOG-L|3CT+TYR6v)p~Pc!$0UVEJmL}^eXy{7e47Tuv$xv=_h># z@4d!d)Vlxk`waV9SfIsBc4*%3o{APuIc>ETm~gMaS8JmYnC+UFgSeQl(#VW;Vq!kS zYV9@W6i*n+7i$Nzx)JEKhVV>?aKQRu^kVIh=SfN|oWQo$)=qqEV65d{$Ah(g@Ni_< z)B@R*Yo8_7KzIzqJW6G%O*KB2*46@%=(efhuc_~|h<5+`=oFGa-gf^wG!Wl_i$96^ zCba`{I-#6#I-$f*C)9q-4A4HpYd7?xOgNoT#B>6$@N~kuov7pH6o5~kQz-Fs ziWIBLPfsv4GxvRPQH?_(>h1&@9;p0;h&sT>3aU5w#Uc9i7!9+`}gtd(t*k{LIW2z(p+ro=Cj2>~zmlc+=K3$WB?7o4#f?p_SL} zhDX?a8+pr}((2$~b5pVaXg}i5y``T)mvt8hbW4xq5?G)BYwUG?|hyK1JIr(neM-j{*G% zg!wU?u7 zJT(Lm*A4JA!X**cOW|oJfVf`?&n`HYxK1X)70I?k$24g>h$BDh$J=?+V(>z^4^U$N zh0gjv+%^B#dS$a{sT6Cbg;Zcoz*D!p2MtYz&)P#uN82TKpY4gjVZs}!p4gP$#T)`{ z+yg_@v<2-HXyZB=f!@Uu1Uh`H46W3X>OX|)m5*2T*F){!fjbu^A8tz`d(&3!TBL1L zjSF*BG2UTiSfeM2&cO++=^w8|Z$X+2*kAlNF1?UY_xrbW_qY1DwfH;fD3&QRmvmEP z_4_yXcXVQ5JRI~j;4O0CH-i8@9BE264bd&w8Re%^~hSY+MNG7 zMV@eQXc5Z7D?B)~ak1hChn9&3hnD!k;Y_P828ZU%TxtPzV{mBRolrBO-4x@;E#Vx(vu=J71XNKvmBF-DS(gUEIhQTinA29DF~Wz5efzfB}}2@<|aX}%>X zD8NbqAI!+2o@_E6=Ron%qfSfos8i&Ek2E|J~D?A9L1YE}9 z<5>VKu>(#^c))3i8fs2H+sIL@iYz0^G0^OWt(|p6+Zbq`l_+kYc~;uUK=Z6*u>;LC ze{FRw28cLh*H}}DW!n{X4YmAyBrExAS_vwPiH;!}pJBX}mT(dD$V}z*6*=E3;-?hf z7I~8|r zd1y=D*0w(Ou0UCV!ca?meE*)n*$LOOL*U*QI45wyAp5(35((;M9|*_|s5RK%#Xb~p zGGKf{@R5L0c_)U{5o~1xxwbTF!mt3T7+gsLVX?Gfo}d~Q;=OFLUT;wQzy*OqM{Dw^78V81EXVJ zD*~sQ;%8Pvf@J~fg3xfBO0LVz{S;JUBL&ZnUniv&&2n?%y&yQ--r8hios{UUSSPKp zBLWu2KG|FQe|DXeA6AXpTO&BUPD+5Wx5f!Su2ZeWbV*8oJ1eo}*^k2rHNMYgD|9S^ zWddr&&b)1!jYc+B&A*vW+1sY`K)2>^#}|ssR>VUy0e0Y|rELZWa}X6v7R1^%lVd!H z-rtVV9ozFG+`SY=MtnR1tn1~pcV&bjt<`%#_&rhLmzqY<};i&e!j zW~SV2`w46&Q^UopTbXh=i@FgHE1~3+Z>tqZEd^JO`Vk|@zMK3kV4J#CE@#+Cm=yHr z@`9lt`<|05(5ALYitLz+g&ZZ5s9#HpyA#M>ojU;Z@&w5HK0Hsb{6a}0a%FsI1kSL zHvr#;hd%qW>p1*LYdN&IV|N3vp-A2XFm*YA2CyA+A>@1j>k+aB&fWyzYIt_TIiAcC zdEJQffcVDGre0Gn5N3Y*)@<7D!BJQY`*tAKu1pbTGCZhZ{C8ZLkK>2x*Fi&LgCD@D zUj%Rjo(BoI9>8&Uj=?2IvogoCvM37Y^8zS;O;L%@Yw)~E0P%STp10r}`=mIhfQ0OH zSQt7Y?o8&&)CvF7iu0%;9o@9?5iugJ4gfYd&NUmJOt^*7@y!%pF+?gr@KmCw$n;Ix zYywE6Pc=c6j;;AU;>YvmefpEX6rpP>&&~;V}-DzMy0!gAEBf0v6X3 zPfFm6@Z3TGCGbsnZinN78XU}q$6#d$`aMv7hoTan2jKY;0mSE*@cbOkQ8baDQ*%K= z%PW6@ME0owUI6VgaEoRE*oP4NY4NCpGY_O<3W%)Sp6Fnqg3zQDTc8fid1xgmR@NODfEKsI%KOaObQ05Wfq<+=k zfji?CDhc#SfD_+lw9#jg3zZB5#%C^aG_pt%ZJX<-De+<@hthKPu_a1gH~H`xW00Mv zxT%#tk6Jiq54%j67KE?BiRmS7_-4I|o%%q+po_&POk$0QJ))%X6wx!FTc^u2*inH( zLDT5NMq?Wrjh6ELetr?2A3a)6-%hOXk#60T8Td1JHiLbw@Xw&W%}w{?S(F95i(86u z1oj*-WADL9(T+eHjR9z>gLe-K)wjY9c9QoKg&2^~c!a$!#v;pbX~<;;Jr{w0tD@Ya zoRW*=wCYAbgcEN5NhIm$I4NmqUv+>J5i?=Wb>9^P$OY2>BdbZU_4z zPx?s!zkpkQEM2te^@1^b3djF*p~~<;>Dh#Suzwx2e}qdgOY0z$xdXIhHbE@kBue~y z(4-?r0^wfeUAgfD2K6$*-C*!KXVAbId|KjZgp%-O3DDps6FD_wJcs;Hr(`W*2^CTN z7xG~AT%$%Bj)tgUUQG_kAh4md*!gr$xfeI2_yhdvMx{wH7J@sZ9+ZPcSbd&`TNPPT zE)6^0Meg5%D@(y)>t1$~D_4o1#L_ng4Y1V@^bd@yu@vfnR zFPjWEDqAJv-lt1Yg^W{iW*R}$`37-`&41#o^;r+erO=7{|NimnEUVdA-^Sqw;%VmB zUZ~;{40HJK!{2yv@)8Vla!lW}Eq9x^ej7dT_BAE6vXn5IOrmoLpk+SG}gG zVIy;2Zc2U;NM%K5NB3o{&y+q|*W#Ov@G}?4np$X>@0^&r&QzF=e;MfacpUyA58Z9ht z0>U?%m^S+GeMXRfwf{_h@~hzJrW<4Xc8W>Iv-t^2f%AxafAB{hbR`naMxGM^1t?*f zGXF||xF2XDY4|-OzZMeBQX1*|4Q{H>3sfH zp^HpfFB78tIp2v(8jvI0zSPhEutVTa3A|IO+m26xw=`{~&pX&(@)Q4+=aLvS2D(~$ zaobdYy(!R{kgh{!@vr$wS5n@Ym9%cDpGZWUai^krAwT~xDV5C3G7%knE8lWvE(pz~ ze467+p6PdZzE1(Z`qP8%%A*g^tTWJxO`4B~M%9qH<@_D?Qqn!+y^#v*|GX2Nj= zJ14vhdDaiYk(?9WxO~pDVS-dT2h!8ZteK`HV)+h*&?yQ2;0N3J2hh#|@q=6GPrsMY#=Wq;nMnxcwHUW0;OhuDcRR zbC^{5G2A|Pex$ziVbqNa0}T6S<!4S zo=HNNNZvhMWD+`?jE97qSx7=Jf&|4R39sxkOR2JV0=@*!PNQ%los~wh?gZ+qaEX4& zlq$m;LSXt%d9C7QiJy+jjD|>3)`Txee6;*lYKf+iRTu-f-msV%WIsPcYLCH9zY)N@ za*#Jg(tH-&Gj2k_)1Y_)PX9nsBtR}*kqN$wG>TFrU}!G!*OHWUey0@k3fy{N=u3(j zX>yV10XQ1Swz;6kk9Q#Z5`?4+zkZG}vMGF~&Z&{D;b3uzusq{b%Fm@BH$o88$1BLW z5aJS29|rC?t$pU*0kQCJp;~NHe=nPS)i{BCwwQiq6|r8FvDi^eNlCE}AwN?--u&E- zygUpSe^YB2@^_Z|EM-3E{}z}%GJ)7mijO}gqfK}yMiYl(@CqM_!L^pgT7bAUbE5Mw zr(JWIXSGMo5S}7|_<0sp+?i)LrVBr&keKO0_|81LIPId2Bz2?4^AV>#b_Q{_YxKlT zcg75YR3MTOmZG#+e6#O$75Z4+NPBl4l+W)_G|7%mbmUKw+>HKJ!30JK>_vJP^(aoH+A9 zP$EJ6%mYDgK*pH|f|CJ@GYqm&`q+p}0Xmimx+K{?AhfXsnwYWb9Ckj|=4$nLG*7(_iy7utqQ=14ex&8$OAIM3l zfske;e2$@UXV>PQ&L+MR)h#tq8^yZ(NV-qVHeg1iupmPNiJz zSk|>iU6S*n2y`p7i&xjq6a2lvr7Dr_y_a&59!D8to+ef%%R8|g+Jy@U*vo?0qu_LY zAcB5HpbMZ6D4>o$`lo+b6!*;;ns`-csYqzz3`BnrL^A~^E|L-dH4!vR#E%IY6G6oy z7H+x=@|*6Am?uOquF$12I4$^(B6zN{f&KweMiN&foD>pHt&n_iw5|2B263q-`->>Ux<$uHZi>geM)b?#(;%gH%`8q;gktkdhtyEzuBQ$`at5rJn5DwFdpRG1b{TLGG> zveUs`ZK5tVqB2?)&6S(_N2-sFFjQPsinRuJE^nu>ItELX%}i2m7BzWhC9e5N&YeQF zIWsI{4EvPaNjgT+&LNN(nTQbJ5ApIS>1>=iYX({7>1WQUz08a~b4I9e^J1((Mb4Zx zVaTf(XU=pq;Am;&nX^KqVdX6x4w?}gqe(T6li{Elp>gZ<1P9G1BsD4|>a-XRno%fj zr#9k69~Z+xGYZX#m_}4o95kbj%M%Waj){Y26gZW)?KoUUYzo4PjLSO?m-Qj)1j=ffaO9ThrEltbAVSp^&gTYijH3aDPx$bt9H@>giUz z)K7WRF~KX?4sMM1VtYJX4zq&u3fo)yPylnHqWA3KVnF zD4pnNbEzzuaNjk^7`_L>fC=}z(MdttU!$#z&W_D=$0zRF>q31VC4QScV(Rh;al}tK zSb`}|QU@C?qI6GT+V(n}^&tQc*)~DVj@#iql196qv|})i&@{mxSHiTipX8hiws{Dd z0%xTG`omdd&XOpIR;@48u)drcR9IJZwbYC#7ff;Z3F@h{?~1RU+;M?@l^&i0Pw{Tqh-{RU&>)X~MY3@!q3>pWb+29BB!MhP9Pm31&v5y&y`6i2WMc4 z%GGrnR~NSugUU?b$$Zr&@=yMW@_)$4e=!IQlOlg4{~eGhKq8V!?Sf|q7m-W3qNBU5 zzFH2Os&TI%+egOlmRy5jK_}y+LsDQ(58IbRHTN2@*bm2L-yf-H2Y5xh1tFh@DrCP_W}5sHWjfEubV^jF$sft|{b2k9IG*XB z!Sfg#|Am{H__I{K)PfwFEDU|2q*f084ms!9?2BYG$g}w@SUwHMGhjs2#t?Ix%mDc( z%D{^<74|L&j8Y?iBm*yl@$cYx2Ht|_O*sCWAOlgS*fvx7)l2?+WEACK0?w5r^|H;= zf>4tVtNRG-c(&TY6_o{e6+H)`WS6`?8k}@$QMcZUgFV6?37jZrn~aOjl@}9Div~*Z50RJl|q|Sr{Na__7`PAQh5ln7? zFdVn@mE6vs0Qfke$j-go&YuVPD>$ythh>_kdk|iii1dU$35?Tc7Ihg%&TVDCK$pM@&*Wa9Sq7dlr5& zGn0CkQwG<}NyK$>FO~)55I8&SD;QpI-jg`*$-Nj1%fOs$IvB=gkW|Ks+$Wepkq!I2M>ZNh?gSzHR0k^|(^BsieY68f7Z-VDDaPYy=Ql<~p z_hVioUWJXE4!HO~k)k7>rpUgTO^+u~4zkx#N+i}!h-LnGS6IIckw)R-|Er4bJ^i2e zk*j7k@yjI!T%#x{lUOeu&V3m`_-YB0TpPV5$p*EZ?PdvGo}N(gFCm;ZcAYbFQAG3= z5f;qMqn1pRgaikYiC3R;P>tFVOvtCd=)!H8ZQC2fZeU_!24U8!oqWTT{uhI}5@!>x z8G{;=DDRUfZ|&nP?^&q94RG=QHCBPz`_C+IbvrMk*d_G;*nK0q@ePJ4&;B`R$i%&SSBF){$d7)au7{^ele3HJcug3zBq@& z1-Pxj`1oQLXII3`{M!rD9Qy3p>~D`hMXn_N5CQ5a9u`_2BWHb%WK>CN+u;l-np&Et9)McF-CB%WK+{MO+-GMY6dFA76&bK_|wSxRye(6;Z-}M4R>sT*5*5 zM|2+`5_%ErR#9tmAF8>K+g6APtaT7fG-OQYcR|>^c zbJTO;w}dbBX6ob&`dB#C8r9AiA3ZCvEfK$ZovuhW(SwxmW_Dje8DiMfW`on;qmrNSa`ak{NV{IfNaII1 z%s9ev6{USWC7XbA5&Q(kBo2So2r$th3@p~jf16IYmjb8&Sb{vVk;x-GO?aX;BH%Q~ zWz6|nm^^*ri`$ij{G8sQsbb=>g*fA<96W-7k6m2uzHmP2*@@A&PEOqVzt~A-Ivt2Y zLh>SCoJzP-z;oa-p2h0n1Cp`wDTFA?wLM^)`5^+%1I1!ErhQM6P!>LqU~Fq+1gJeF z(WHuRh0%@=CAtr2V*@-3yGv)dM_)9cF;0~2DRRzVxRiZf2 z@a2dSR$L2tRmvr;7_C*V$SQO-nF&=o7^XBjC^&#FmTnngKFQTpQa5`9jF0;LH=UOHiN6F^EjpDg4e-Q_t2YD%mqLJ$vW zd!Ld;spfGV#VKTJu2P!Ppxj&GNK%q5&3Vd3#|8%_mCwb|C=*d46~vSV1)}AM=qN8k zWE+!2Gjg*$&*I24*QB6~VJ*aUI^ririo7Tf#yBHZE@)(C4CeeS($YD_U?_?+Pa#c{ zyk(iYxV~q}yo=1mht38&X$g4=HAWd1hjYFzL*zSe5{WoR7${>U22(2SJPUF4@V$j|%7-#X$x&KaI;t5f+HDML?UCk?qtkbeKt+0nHXA+v@l@4WH2Bql@mjJgt z$3~5|2=G5n;d;1=%7RE&Qyj*8Dd0ph)P}{9GI$VkO}t=)tmC%C4Um-06r;5=MOr7- zXcf${Es_>)we*S2*%C3-yrh~G(ePL!NR$TIuFbF{YK+Kwh3#I!OU@o4CmvE~sE+X_ z<`j04Fi}Y-8f}b=YLq)(5u!koM6;Y64n@Oj$Rg@d3bjzOxk!y_I?{}m{U4}LWW_9+ zT%iqZK3kcxBu^t8=|UH+on>N$S|iz}T4kFkuXZ3$vua0d!{VgsNadYC*3OhjS(_s2 z27zc>)YxJdRsfNC7l(dK=uH>xoJ3PAY>DbJtYKTR85U+YdZ4^(6zbxPq79>e&P31W z6qPw4B3fR7u$)Ar%Wy@)c)r|JOE8L$sw~M7-5IS?ifENmh2^BhXj8Vx=|&5ZA^V?j zTb;?1lvP<2W>&1}7~NeqZ<{$~e0wk{K87%TVQx7wjRlM&H=f$VdyUD(=%kD~!`PJg zc0+bqXDH^p+;BNZG(^@lL2c){)rGq7<)Y}ft;T48DX|QMErm5i=B-97Evl{v%h82F zk>#jSmSZ+5m&VB?JEGEK?a~tAZ51YI3mY9;k#MW&FnTaCDnh3y4LLysP=gv72=O%X zq-=Z`B>GtyCn>&2L|c*^TLu_6@WwkO#!N{esfGooN&DhS<)xAkk&%(1VPSK|7)2T# zIz|kOc-v{CXxZV$pEqD+h1eAqW2&49#LW=)aY+fJ6ftV`EacrS z{(W1Hmc*C=c_!9V9YBjdE#DZXASN1mPaf~S3LNP73S$Jo5Q$sAkyqI`OpjQYQHhJF z603ahJVP`TGexyNXBwKeSr{ZljTvUg)N$yCgAiqKuISqrM(b9N1r`a#Vvb3H#JQP=P^Ok} ziwDp199+jsqZ=X7ZY+yNMa#7uf3FN?#OC~H8e}w@tPI>SGQtRGX;!yY4D+csIjtjz z9!nUtIlgs~orqB#ETZ0pJDI5dV@0lK{<7zmdF@0h+4?Uwb6=75uJKuHWXtZX`-)6k4Xp9p{OP+ z^K`S%5=NdKW6%TWVXab75akJ7-kWv>4bsR$v!4B zUqTBI#^wtXE{L`zVSZb!J;Ff**t`Z8k)t-<|nF9$wu#NkHy}e3*)*p&OHsKg8=2K{O z+9``OqY;?N^RW*#tx>}%LsC<0RV6e{@`*Sy`Z0;N(M>>|*@@a8uEDY~w-xRhIFmBP zwe+sJ06-`ai z?7E^U{hB=q9}ImKepUY=d`X(VMYHHWZ4yxScFm-(){=C^Y|@bO3X$;d!v4;-UdE+zS zp;nD(I>Ida1u14#o2>rw7fjLSQF4m0qXn$;VE z#R%IG0_zS0lQ=hP+3L=HT%5PV;_L%;wt6kZajXNK>MSOiLYlo8+&-&KM@&~S0!TgY;Y9-)z!|?CjBu@Qh< z*$(meh@P?+HZ(`XZU+C0_YsAfbt`dch8JP#ju9kEsdqQ)YS3EDlT6W4`5Pi+kijAo zuvYNUVa#RnuVK}>3WziWk?lH{kx4s~no*;s!||*_}rf$(HfKH;SvoV$HBaKQ>znDK)(X*KzFmt?A6ig1iXK6&HBAuJTsb5nATC%!h zpH@P&`abO({#FFsF2H61Eky*?bt~zPDw*;X2-nKX#iD-+VX2zMZNlb1-`gTptvZvc z%ycP`g1xsixCL-rT{_(Xh%00OZlXsQJ+|SY?!^P;@{bDOFv#wK`x%@l0QzSM4_*Mqzb~lQ;G7E8l6sLvHERTbb=F2?FGW}XZTFo#bW2K_=7LYB zhC*1ns&C~{(DaC=P)&sGZ9%J~V)uy$sZe(!m27GXDm#jFDNGp^0Nxq;Of7Mh4r9!s z>JqfBB3&ndgUxy?Pm&B$O;=1R^h;-sNx#Ks(y!@aSRz9!Yzj5>AE(;r);IicEatU$F=nM96b)v<92$`4H%{$ z)8i3((5)Aym+A33J>JFxe`JYDYFvY)K1J35#i`5Nxn9ZvsOK-e05$%B-Dm{V^Iy>~ zus&;j0HNxnM>%bON=hn*givFTmQ=3UUxD?$C0gI5THQu%AzI+2S{}^bqz`LJ^hRs= zIZ!D}k<@@J!kek+LaQ`1*wlDZQ>vniqjzbuhDux9re&?ttlPA#^$59uS6;mx-p_OI zIjgkdW!gC#=!p!tn)}JLkcxWwohe!xy!q#AQ#Wd9O~Adzt<1xFDtME$Da(Le&6`%< znNo|8qL~7kyo2hnN z+YfP@L}NmEDPDzc@aUD+Wb`@rE6-??{#A2QFVLR`g^pecF0f(IMQlk);hhArNpIKO zkVl`*vvw<2S;4K^BvPQ7wvWfqIp7?T9f40nCzh_?q?M{mL(d?Fx=zt@NjiNQszN)I zb^}`U3}h=k1>Ds(>IWxxHUCf&De)T z7wGEC7z{X9X_lMNV`X6AVJp^Vs(ni}ce$3O+VEC)EY(ugT}#2cJS7|B5M8%cO(0Ej zSeg!!CVgUQ9wliKNSg0NNkf9X&!7bLs@~|7oA=hEr2nvN12BV?zS6EZm3QZwn z8+GeGUA@Fmc8OH>YA72eB9+}k*>gWSk+Pe)vfY%uyQ8v4%6^72{sV=A?uZN8M3ta+WF7e+7)7Fc@|t59B=I$o8VI}rALTx zSJLBJdVH212kAk7RBHMjJ$^)wC+NXjHsg{D^(Ba;e)TP0QzoN(u~@hA(PTOeAvaPL z)l10KQ9l9FP%9Co4x_+mYn3(`DnxwML8F>wsM#CvR=>YH1UgjSR4p4GrB%}})SMXj zsjgyb#ne6z4O5$`B`}(~3t@&Sn(EWsmjgQ|^+p=CYwC6_X-N=>)u~%})pM%-#e7)c zUdof$f;N_?v02mSB7tlgP^ulz=(p-yMW?6g+cZ=kr_RUCu2m@*eqd1RLQR1k>uUc} zo+}Kb3raQnO5~X57umf~%Rw3r-G?qS^9E`)LsW>tW-*@C)tOe2&yAYpHK+m|Y&$sa z=K|3PMO8DAd&-vDVx_92PNEUyD wh^@De+)wx^WV#ne<4MV?M={tsFu_1$t)L-+ z5dRMGmqM1+7z!t9j!Q5S%IbrpcX4uu{w4iRL{Ep@8I=B=&395KA5ipAJ0CCo<6hZ< zdnyv)M1MXNK85bR`49Bx0g!cuWA33ypQXq7usyQyGY@Bf4l=sFm;N4!r)#m`EVtsO zM;0EYe0t2G$6|Vv(}P>Haeg2A=2nq{u9s$Uyk~$x?u6CRq^%O631lJ5Py;c`P%`1a zQjRX~)-MT1*47%7%e6ds3s-AXHlP}8MBTOM)-+zk_K-Ghqh?-;!dQon0yRUgfsy(( zWsXiW6jT5Rf({GGAS)$ z4YWK81tNc>RkkEb5BZVCtO;{M&*{6gZ z{BobCLagX;*#nX6&r~M9qgA5$Tv^EHHOc21%?BokbSCFdiqA%^6ltoL$tUbWe~`Rm zSi|%3G=_M3sB_-QuJtA*mP77}%EYtmJp2BJoY#DYx)@O(6Z^VR48^`*gsBg<`Rh9L z9g}1)C&_`tv!=sRublk@?)X(n`_<8C(+RdH+P_)na{^Aa@0ZkR{WlHe!{MZp;~zRR zeoVb|f|BIVirSuX{>?(9oCV20czB$V-d>;BXk^w_deqRKET@V|&iAC$Ppy;l!`etI zQR)Yj)c34=+H>8lHmtfcEjw6(Ndxu@gI31+=pRtuJny0mfcloawx9MPCOxIW06qD>yl9~ z!?Fm8=Q1qH%dpFlv#;fcijw+?RXVTqU^{WVq}!zFo=|l0@gRsig8vusFKLTd5@g@Q z5AG8lo5~M$&1AS7s$(%{Ae>8R+p9F2xkcHW1u6~rUrlQ4f^#i$_Kp0wjWEf{4l9PCDC9d5OVNXDz1*@pT;z#x% zdzXy%rMRue!B+|iQt}(~7A_|rV#`iDegt6e|Fx_>0xfa3i7j|TuoT|LY2|t4q_#iL=pN-ml~3+$1hz&XQwea$>rT8r&L`_xtjxlr$r(_rK}Cfd=r> zi#39T`$20eCY2=nFua%um#IR%gMf_;WV%LwS7`XX8eiZ_2S-$2f!iI-OxffJ)|96% z7AiCCqPWUbZNSr)teUqT2k0@=Ab2;ZtbCq?Z!fQs-w%{elixeaQ}TOf`4ma};qnUk z{fqLXz!s{Vrh;Xv6I=-uHb?-`t}!=elV67n^Z;m7@k|>Pn$9)2@iCOw}ecE-%8< zydYOzy&dB z4F5QZ@~88G!uNR0os2BXOp;W2#XB3vXQAQvhq2^CJCVQHrL#*yUHcZdQ?SGPB;gN$J6?D3UD_F@a+r07hBWv4cc)K z@U?Skbz{RJxp9A1?>uDHwRL2$9b^W(ZQ*R4?5TB&u`PclXDz@>@r_OSOb*9Zw_)e{ zthaMW!7-+7hE!oE{|DRaV2fTkQ*N?01Dli2z=3l!^?!4Fdu5X~lShF!o398|Yi3V( zZswYKbJA!|5|Y^Q$IWc(Y-;am&dkhqH?P7wuOKx#qE$#-6R;qUlEuxm;naz?&KcOK zpuMuyI=8K}Gmq~k9L@j~1vQ%!qy}P?7dr+iyNx2zMchOGcb)wKE^vH;kxQVZLW6J?g z<_IjyhvmygV5;$%Zq2k~OWJOaXmJTR0@^a(tvvNvCt6&gv`+;-Scr*_fU~23x()}oFLzWIk%khMG57)~@ z(ezt*Mmr|waZ!(I6$Ojrh>eAt#>Zw%Z#ASa9VnXPHInOHQ4%h|Cax>9$5xF?6+UEN zHi|4}MC@dpTRSeYV|Cp}%$HTZr)E(T1`9=zqi<$lub?p{l5NIZ4HVKWEK4dF6onFX zV29zET{uUmEsygSv2p2`^0392;uKIUD0-fvbN;1+2{{LQ-FC3(ExFqe4?yhr5c^O5t7DRs}?B(J|ifC=WB3i46E>}cr718C2Xssf; z+@+;R)q~W{!aiNxtVq?96quimAFo{0$c)(M-~sYu`^8ma0H+1u;}&6`fsb2Rx>Yr#;@OszwzrU@o&ZP^{x1i;%Kow{v=CJ#-C^D`S?pLy%hfsmVO@}iIc|& z6{2nzih;z*0Do~x*@J{<>+3;n`eTJ+io&A*h4BR>Z z+=^W(F*+40VVo$~J z^%S%e!)+e4t#8ugkU3V;eVmn`b}Yyh45MYFd4+u=`*@@MUG+FKZgia401Gsu)4*=EgEHb*8k5QW+q%3S!I+NWFsiOf9Oq(XxB9HuGlt+cfjH?VAwFaxZI8%=T(A$tTg!D7uy)m7u%QPY5q0+ z7Jny#9?G1>1L`N6e$jF{Fsyd{NRg6SY!yGifI`8Jv586Ip7;d``z&!|;zkS`d|h6G z(&psjNqjw#{7NalzE--GU)xGw<=6FPKPaV$Cd$z$RyHznq^^1~v84o6HzjXL;(%gtOY(^%iu;nk=GU*2uO~sJdg;_-K;`x1 z8w9?Qd^1@ADq<3Eza6P7-%S3v6qP?Ny{+^Rud-jd#C) zhRwvEDK3JL&L#%F_(`b)RReVi4@YMWjxGWRjeDUbj#`~HIJ&6l7#uWY*5K%(qH|g4 z*GglvBpqfA4(PC`=olO{^yBEFqC+K9m1xMUj}D89j=@1gKaMT}2MNv~UM<}SQ^U2k zlriLpE%Yb4intOW;K5SNQEr`04E$_9o9iOx49COKS%agCdKDwKl-yN<5hLy@`9q1# zo5o%e*_Nv{SmCHhupI|19Bof@#y*+;-WtOXUuHt`cK`+g#ZG+;>JmqM&Q z#Df~}p!g*LzZ5SjKmk*)sMyyU_L#aP`&z>u0Li}Aum?c0uQlueknFLHQS1SDP&|tR zr|}`#`=&pSvC1j-^@crWM9IG1um?c0uQ%)gknHOXdjKSREQ%C+03`c*!ydCF6a4Nq zE~=Mf(Yl_>*#Jt)XGffkDyM}Swl9kT;j-8hF`z$z)r!*lQ?VBSpaba{P4vYExJnTN z_(q2ZVuNfr7`vY(iC*hP&&@UN;Tn-lO--i$;ft7+Si6hES*^?24{;!I56a@6k{u-#0ql>UTRTd2 zv2qtkg(}(F691NX9M8y$rxUN>i{@s|Su;gOpf@CKi$Cp(H;h#GL`cQxAl8>$TLSgn zT5@NJbI!DWac2o6tF=nl_F9G_GL%US#D{p%H59)uuIzLluSk~RisUBu3PTp8k#S9N z6R!PK)7#m!UfdUd3||zOIV13s@c~?@KwvcfBkLj7ON2==2s2`cH^m73d42p^FeV-5 zoE$pNB!-;_S^c1R0$+^&ePR%!lU3gok8=fxaNCD#IG5mCxHv=iF8~yHAjq6^4hW+4 zZs%zPMn(E|=UxWM`<>kc0g*W;t2s;V12J4#KtHkj^dPz~wwHjtu>lp{Cm_AZN6)H`Y%?X~w;=mx%aM?6-M?2SZ#H^vo_Qw8La9tvL?JGH! zuCy=Vb;u>Ljas&iv2PIYjo7~`0Q-Bl{TK!VrQBivjpG5@y4!x169IwWmm`OA{scL< z?*eBmEfW>frB5h%0}$#4txF}=6y-TbXlz+iF$L|9n63x7T<5A?BV2 z&}qH)dl4u;;%Wi~HO>}&SsDjdaC7S+wW!a3JZpteKXSNQHy;(KVd<#FM-85voHlsw z2L`Qv>u872gzG$O~*$3Wnl!Waka5h{Gdews7w)3IM_{Xzwo$csTL(9RJ75snC?ATF?Pvg3Jc-Usw> zxCXEK!e?&)m=~Xaw{#pR8$F4S&le|curUgT;ZZ2mH(9u}zAYw(aiwjEJMFt{c~NaK z+`6sq5f2OT?_!`tyj5~n87^KBFywkxEq;HR+>?}RR||_rJo3k7IihIkpGt8Za6RyQ z%PuODYcy-JpX_d|C&ZB0EvyIq;L<4~^)U-`#&x#%CVbh#Otm#8Zo+sJ4`B>iVw;zJ zEcSE^BkNxw`~X)jHz5*;hcNnqAA(L`K|2x5uXz3i~qFT^W|T;kIBrE!Su zWe4J0do0mHtd83p)fM&pQ#(tNvnG+zG5wr%XB_y z)PRWe)kse8dEhh{9Lsp7YDMnsOR%Z&Oj;O?fg_m(K8$Ck09BqDsFnrene<2HndWwj zhig2O{-`|D#4itrIcjVe|6^$^4P2$M%<48iW#dZ=+uKj!8ID<_ji`RvZ$3*9h4(Fk)bVxrBCZoeTfRzsASO_AaL>;m#idS*3TMsm)L+>#e zKe0jD0z`^=UAB@IS96nQiPBGzO+h>_u09ON0oXvv6O1-&ha)O!E(@y$U#nM02eoRB zGybgP0WJGc)Ro}hOJREjc@Z=0&(vfv8Cxs_SlNQU8cfC(4FHpZV^75=<7qH4iuU54 zW6ZG!@yY%K6Qd|&r;4Iy0)b;Sm>5Nez(_^WPk~}MF^V#Fswg@;i~tCuD6KYH6lH{D zTvQSAW8h_;|MW;Q`Z4CI==UA3!k42Tra(v8y|^E8eWU!)_ZX9=W9+^SeP^d5W0W3V zDb#}{a3bQ5o?+Q{701Hk3srI-oO_Qkws;HX56^nE#RzJYEpB78P@X8|S$#}3=V#Doo~NB4m<6`#SF zP>F|9rq(ZAI8WCUuGImyG|mFbTx^9_sppgwaFkZ5yMn$;UJK85br>}+6wZ8C^F?u% zo?Q(No;)b{l9qY?G{B1Dz@?_1efHT&;Ly_}$0=|O*Od?;DPRe7A7sdB$L-g{9RE3W=097B!wGVlt= zRgU*I&{5+ZfhZy|_HM$zioM^9z))*|2FR>@qj>E7En2Jb?t6ezQ#9kN7j8wxM2;OD zd+DnXDH=zQFZ!VxU&s_B8lIov+3wKOU_P>jWeIVQ;ZI(GOY zdZX;l%MI^2SCaYr**)AR^5gpFca=uZR|67^W5l7J|LW=)$PtNp-VOLzdY%I(981qv zx_Vw2!AXs;fpO@$%GI;~c}(wmWe#Yl@s)}kJ7m5HI0xhy1df!3?Yve{f6yG% z*E^Z18_-1d-R2k$CNnek0<8MQZ6Jfm%;tH3>1(6iOBqBx{WfYg2UyNTd?%HXICcYg zQLt#BwU?l(G@jP{sUaYvj}IaOF=`;R*a?L#HhvJ4^`Bf6tV?dFlr3}hn*hn zKFJyGXu>iPtrkq?ZpJXc$~S`brbK&PS!?XI5ny^rFwtJkP>Hfv@fo(pwM7a9 zD19(d&kv(tO3%etGB3J%t_u>-CF+@uI#x_r=jxdaxrM2h-ie;8(Tpsk;zn4{#0)3u z`Tfg`o_7O*RtYBR`D$0s9E0IRpU;j%&j}c7EIo6zqx?A+W&{ZJoEnFo2VFh8Z+8Uf z-3=PbpHmh#r-@9D0;fUxJa8n&bAW6MKz%&N zRq^>P4#iNSul7NTvEuW$(Ne|duq-6XxKZu;^8%;|!MY%Ez3~;m)OsU2ZZL)qx;}q> z0R>g0&sRgqW5t#o=$DG&xb!sdAZdyy=J1+Rz6!!fj{cRFp zh^M`deicl{>so=MyiVFNh=dZojyoqPud4zCDlAC!x?5UI^xKSDj)!2P*DZy^DzBRn ztkflX)DZZM=27&P^>9l#Fh>DCIj(|xhsQ;HpT6p2hLb_9~y_>ggZoAKTYoU!cAolMktuYo*JSV7`=|EDh) zyMG=fEaeLl?f$B3_eTn9RgtsI9xzg~%!ea!=o=~gkL4RDVv12Qp$l}-fr3Qem=3k5 zm~eGLtt!$thQ{F=>wu?xqu^aeO?41P*fxr95bZwT>^3;E-7|m;K)m28MbVLQ43-Pp z)%cIGlKO2TIIox$?0Ec#ILd!gQX>C{@t;ku|4c=7aMeV7&KK1XQ~3`)G92&dKbzZ) z|8W2AX?|8RPye|Sj-lp@y`U3L^q)Vw{_}${0wDAsJ`psU|M0Fz7dWU@%2APYIPcu- z`q+cO4)>j_lz&HSm=)ul8VD!);XSS&em9H&2>oz)G(XhOFjPQ4RE%R8PspN##)K5c z4Xd(^x9q3RZH0r-kAR~fv$G%)fXo^|eE>4&I*`>6&3(#*xVMM6uL*G<3~~Q%h6 z-1*c;pkK2Y4+D@{+d|y$2yve_A@2DQ_e(?E?+9^!AjG|DLfqGcxc7y)4~4k%8IGXc z=S_$^e@6@GdG?kN_lH8PKf(89vvNN9}01QE5yCrYh|8Qn-KRc9v#hncZfTukAN-aOz~RjXPfzpvs&$} zY+RLrxW3fd+1NqQ0R9!7mHF15&QK8wQ$;{?^#>Sa@ow2eVzSk1!*E?EW z)EUa|>Y~BOV<5BoAh`AoWv@B(F%8i^f2q;xJK|mw;$9!(erbsNc_Hq76XL!!#JwiO zy*I?YJ;Z&>gt#vbabFzbz9z)IImCTnLfjXIxL1d`XG7eVhPV$-h#sHO1JgxJS)? zd2F1y-#1o{THENpPj~y?1;Mm`g$C9V5Ch`(RbS4MY~g`IBueOwt#RJ6j6{S z1E&gL);czBA4MddS+)&0taWU8Pb`FWEO6d({h6K?=EXZyWCS&W4p-a3gy*`O(s+uS zt$Ck}=$7?KP)_Mq3i3HXwtzhG6r>Fh6E_s(B0!i}QV<@UmIPDEr64x|a%q6hj{q@O z0SadqAOkK=ntLvz{WNW5g|i1ZOuV11AUt<1i!6H@zc%Gc^< zKXfS9WrMY#qL zQpT6&wSui&%8e_!a(UFv3t0I}8r{?U)&QM!8oyYk(`e_n`|WHMfIJL{S$QgXUI1hu z(2E0r3_~7|mo!U2WB&(+nhMIKq3BcsVxn=(YHDo9m_xq;y;uyKYP9euF9U=g>w(i?!R17sm;Jg?gfNH%~o2uKPzo<9!(G7S)KH0=R|*WDh@ z@7T)i>B@6+*#8^-av^AL{Rub^1$dR z>c{I>8z40S2{!@~j6dH1gj_vdw*$iDK^_I9FCg=;0O@rpW1M0iVrV|l)7OBr&BYA>_Uc zt>|M)KTRlAHfL7!w4`y2L}yE;+Z5Y6S9Y0va@nuP`wV+n9Zhns)K$PamoDo z#zX^ z=B{*0d)JD__H=W;E7uJ~57HzdAtf)UJ8fBd>5}Djm@a71w#N3h^WZ^fs_jftzM^!) zLNa<)nucRQDBU8L$zlnY#^(AU(9xJ%#rJmdZC#ydhC6Px4d|NX3I<`bnYQC`EJ&`W zGmmpz&}n#SBblGu*e$&uZ{Qa)PA@zC)Vd|7EK1ibUv&Dy)6&ZpEj?|4>d&H67otz^ zpg{z3TSsF{Ce7{iK?-l~^X)Obi9s3Dt1@eqnk%z#OUUM{Z|b&8b(&)sb!nV+;t^(?$h@Z=Jbm4#r^DS6)X=8VO zksR5Ix4$}_2E%N(9Kf1B`ibbA#+f+&gP3GTx)E>ET`MUE4uopz>gd3{;*Pd-M^|%C zdnVo1O#)O`*NQalhitGVpHI$VjL4>qU+BuEyL(o2uSMMKNUz2@C=5KTOH&=Vqhb23 ze>2FnyuGlxk!%#<$}Tq+C}%y|OFU zM6N`Zt0hllh3w9rCNAjK-925pvDQ}&$RXIf>X7Gz!4_r^EX_2o9>oI16=eFUESoi2 zW|)E(bang8kMNPn6}K`LEnJ>xo4B)Dx1P5UOItcS5U`}o(W?&MAnt)f`iC$_8(^GV zm&~to#Vp=2YQ_x-{(&3}3hH7{n@C+sq|<(fEeHu-Z~=XKlOdpcw7RLO9RtCvqm27D zX*^dyk*i82Mx>tgvava{27C)vq$*A(<|E> zTe|hc)4HlVzbf6qB~*d?>kBe7859dG{&^J|RLUtj)2a9umP{&GUqE{UO5Vot6?w-m edR825MPpXorYG_z5i_iDF(B_t8JoIO$NvX#5^k;l literal 0 HcmV?d00001 diff --git a/techniques/System Binary Proxy Execution: Rundll32/hack4.c b/techniques/System Binary Proxy Execution: Rundll32/hack4.c new file mode 100644 index 0000000..c243009 --- /dev/null +++ b/techniques/System Binary Proxy Execution: Rundll32/hack4.c @@ -0,0 +1,28 @@ +/* + * Malware Development for Ethical Hackers + * hack4.c + * simple DLL + * author: @cocomelonc +*/ +#include +#pragma comment (lib, "user32.lib") + +BOOL APIENTRY DllMain(HMODULE moduleHandle, DWORD actionReason, LPVOID reservedPointer) { + switch (actionReason) { + case DLL_PROCESS_ATTACH: + MessageBox( + NULL, + "Hello from evil.dll!", + "=^..^=", + MB_OK + ); + break; + case DLL_PROCESS_DETACH: + break; + case DLL_THREAD_ATTACH: + break; + case DLL_THREAD_DETACH: + break; + } + return TRUE; +}