From the literature, industry reports and experimentation, 97 evasive techniques were derived. Many of the API and System call techniques use various patterns and the Ex, A and W suffixes that changes the data and format returned by the call. Additionally, several techniques use functions that have been deprecated by Microsoft. Peekaboo implements all patterns and variations of the calls as well as the deprecated and replacement functions resulting in a total of 132 instrumentation functions. If the technique could detect Peekaboo, that is either DBI, Virtualization, or the Python agent, it is instrumented and return values or CPU registers are altered. If it does not detect Peekaboo the operation is logged to the report. The evasive techniques were partitioned by functionality which informed the implementation in Peekaboo. The types by functionality are System, Memory, Hardware, Timing, Windows Registry and Instructions and are presented in SupplementaryTables 2 to 7. Several papers categorize the techniques by the type of anti-analysis 19,23,30,33; accordingly, we provide a brief overview of the most widely reported techniques below.
Anti-DBI
Intel Pin copies the original malware code and executes it in a separate memory region called the code cache which changes the Extended Instruction Pointer (EIP) relative to the original codes base address. Malware can detect this by executing the Interrupt 2e (int2e) instruction to compare the actual EIP to the expected EIP, which is derived from the base address of the original code. Interrupt 2e is a special instruction that allows applications to interact with the operating system. It does this by saving the current execution context and pushing the EIP into the EDX register and then jumping to a specific system call location in the operating system. The operating system performs the requested system call then jumps back to the application 23,33. Peekaboo instruments the int2e instruction and patches the EDX register with the expected EIP value, that is the EIP value if the code was not executed in the code cache. This bypasses any attempt by malware to detect a difference in the EIP 23.
The NtQueryPerformanceCounter is a kernel32.dll call that can reveal differences in execution times. Because of the overhead introduced by Intel Pin successive calls to this API can reveal its presence. Peekaboo instruments this function and alters the returned data structure by simply dividing the value of QuadPart, which contains the timing information. 21,33. This function is deprecated by Microsoft and is augmented in Peekaboo with the replacement function QuerPerformanceFrequency 37. Likewise, RDTSC is an assembly instruction that returns the processor timestamp value. Malware can detect Intel Pin by testing this value between successive calls 21,33. Peekaboo instruments this instruction and reduces the 64-bit integer return value. If successive calls to RDTSC are made within 100ms of each other, the 32-bit return values in EDX and EAX are reduced accordingly.
NtQueryObject is a function in the Win32 API and can be used to check for the existence of debug objects 19. Unlike IsDebuggerPresent, the presence of Intel Pin can be revealed using this technique 21,34. Peekaboo instruments this function and changes the returned value to zero to conceal Intel Pin.
NtGlobalFlag is a variable in the Process Execution Block (PEB) that is set to 0x70 when a debugger is attached 32. A 64-bit and 32-bit PEB is created by the Windows 10 64-bit VM when running the 32-bit malware, where the NtGlobalFlag is set to 0x70 for the 64-bit PEB. Peekaboo overwrites this value to defeat this technique.
Anti-VM
The CPUID instruction can be used in several ways to reveal information about Virtual Box. The Microsoft Visual C++ Compiler (MSVC) adds the CPUID EAX 0x1 instruction to the start of a binary which can be used to fingerprint the Central Processing Unit (CPU) or it can be called separately. In either case the CPUID instruction retrieves various information about the CPU and can reveal the presence of a hypervisor such as Virtual Box 19,23. Peekaboo instruments the CPUID instruction if the EAX register is set to 0x1, which indicates the malware is trying to check the CPUID bits and changes the hypervisor bit to conceal the presence of VirtualBox 19. Additionally, the CPUID instruction with EAX set to 0x4 retrieves information about the processor including the manufacturers identification string and can reveal hardware virtualization such as Virtual Box 19,23. Peekaboo instruments this instruction and modifies the returned values in the Count Register (ECX) and EDX registers to conceal the presence of VirtualBox.
The GetModuleFileName function in the Win32 API returns the full path for a file that contains the specified module, but only if it has been loaded by the current process 38. Malware samples that are analyzed by Peekaboo are run as a child process and can use these API calls to check for the existence of VirtualBox and Intel Pin artifacts 23. Peekaboo hides Virtual Box and Pin by instrumenting GetModuleFileName and replacing all occurrences of Virtual Box, Pin and Python with a fake path.
The NtOpenKey function is a system call executed from user mode that returns a handle to the specified Windows Registry Key and is used by malware to enumerate Virtual Box registry keys 19,23,39. Peekaboo instruments this system call and if the queried key contains any string associated with Virtual Box, then an Invalid Handle is returned to hide the existence of Virtual Box keys. The NtQueryValueKey is the user mode API for the kernel ZwQueryValueKey routine and returns the value for the specified registry key 40. Malware uses this technique to search for documented virtualization keys 19. Peekaboo instruments this function and if it is querying a key that contains Bios Date, System Bios or Video Bios, Peekaboo changes the returned value to not found to conceal the presence of VirtualBox.
NtOpenFile is a function in the Win32 API that returns a handle to the specified resource and can reveal the presence of Virtual Box when its components are queried 19,41. NtCreateFile has the same underlying functionality as NtOpenFile where it can be used to open an existing file or create a new file. Additionally, NtQueryInformationFile is a system call that returns various information about a file but depends on the handle retrieved by NtOpenFile or NtCreateFile 31,42. Malware can use NtCreateFile to test the system for analysis artifacts 19. Peekaboo instruments NtOpenFile, NtCreateFile and NtQueryInformationFile and changes the return values if the query string contains any keywords associated with Virtual Box , Intel Pin and Python where a Not Found is returned to the malware.
The NtQueryInformationProcess is a function in the Win32 API that retrieves various information about the system 43. It is used by malware to obtain information on other running processes, memory size and debugger information 19,33. Peekaboo instruments this function and alters the returned values according to the parameters. That is, when PROCESSBASICINFO is called any instances of VirtualBox, Pin and Python processes are changed in the returned structure to explorer.exe. Furthermore, the physical memory size is set to 8 GB in VirtualBox, where less than this could indicate a virtualized environment 19. Lastly, any call to this function with the ProcessDebugPort parameter set, is logged but the return value is not altered as this evasive technique does not detect Intel Pin or virtualization, but rather targets debuggers. Lastly, the DEBUG FLAG can detect Pin and its return is changed to 1 (true) to defeat this.
The GetAdaptersInfo and GetAdaptersAddresses are functions in the Win32 API that return adapter information for the local network card 44,45. The Microsoft documentation states that the GetAdaptersAddresses function should be used on Windows XP and later. Malware can use this technique to obtain the Media Access Control (MAC) address which reveals the presence of Virtual Box via its vendor identification string 19. Peekaboo instruments these calls and logs the evasive techniques in the report since the MAC address for the Windows 10 VM is changed in the Virtual Box settings to a MAC address for an MSI laptop.
The FindWindow function is in the Win32 API and uses NtUserFindWindow to return a handle to the top-level window whose name is queried 46. This technique is used by malware to detect the presence of debuggers and virtualization 19. Peekaboo instruments this function and zeroes out the returned values in the EAX register to conceal the presence of VirtualBox.
Anti-Analysis
The anti-analysis techniques detailed below do not target Intel Pin or Virtual Box and cannot detect Peekaboo or the environment it runs in. Accordingly, Peekaboo instruments these techniques, and the activity and relevant parameters are logged to the report, but the return values are not altered.
The IsDebuggerPresent and IsRemoteDebuggerPresent functions are part of the Win32 API that return a Boolean to indicate if the process is being debugged, Intel Pin is not a debugger and is not detected with this technique 19,21. The Interrupt 3 assembly instruction is used by debuggers to set a breakpoint. Malware uses this instruction to test if a debugger is present, where a debugger will catch the instruction as a breakpoint 21,23. Further, the NtSetInformationThread function is a system call that when executed with the ThreadHideFromDebugger parameter prevents the thread from sending debugging events to any attached debugger. After the thread is hidden from the debugger it will continue to run but the debugger will not receive any events for the thread. 19,47.
The GetPhysicalCursorPos and GetCursorPos are functions in the Win32 API that retrieve the mouse cursor position in physical and screen coordinates respectively 48,49. Malware use these functions to retrieve the position of the mouse over time to determine if a user is interacting with the machine 23. If the mouse is not moving the malware may determine it is running in an analysis environment 19. Separately, a Python script (mouse.py) runs on the Windows 10 VM that emulates mouse movement to defeat these techniques.
NtOpenMutant is an undocumented system call that returns a handle to a mutex in user mode. Mutexes control access to shared resources and can be used by malware to ensure only one instance of the malware is running 20. Additionally, the NtCreateMutant is a system call that creates a mutex and can be used to synchronize execution across multiple threads or processes and can be used by malware with a distributed architecture 50.
The NtReadFile and NtWriteFile are functions in the Win32 API that read and write data from and to an open file and requires a handle from NtCreateFile or NtOpenFile. It is used extensively in ransomware but also in benign software 20,51,52. Additionally, NtSetInformationFile is a system call that is used to modify file attributes. It can be used to perform a variety of malicious activities such as modifying file attributes, hiding files, deleting files and disabling security features 53,54. Similarly, the NtDeviceIoControlFile, superseded by DeviceIoControl are functions in the Win32 API that are used by applications to communicate with device drivers and interface with networking operations 55-57. To retrieve a handle to the device, CreateFile must first be called, then a dwIoControlCode is specified for the operation and can be used to determine system hardware and access system files 57,58.
The NtCreateKey is the named user mode function for the ZwCreateKey kernel mode API. If the specified key exists it is opened, if it does not exist it is created 59. NtCreateKey is widely used by malware to gain persistence and privilege escalation and to check for virtualization artifacts 60. Furthermore, the NtSetValueKey is the named user mode function for the ZwSetValueKey kernel mode API and it creates or replaces a registry key’s value entry, this call is used in conjunction with NtCreateKey and NtOpenKey to gain persistence on the machine and for privilege escalation 60,61.
Experimental Setup
In line with recent research detailing the success of DBI tools in countering malware evasive behavior 19,23,32-34, we developed Peekaboo, an automated analysis framework for Windows software and malware. Inspired by Bluepill 62, Arancino 63, Pepper 64 and WhiteRabbitTracker 65 Peekaboo leverages Intel Pin to exert complete control over the execution flow of the analyzed program. We collected 18,527 malware samples from MalwareBazaar 66 and 1973 benign software samples from Dike 67 and Benign-Net 68.
Peekaboo
Peekaboo is an Intel Pin DBI tool that instruments and analyzes the malware samples as illustrated in Figure 1. Peekaboo is fully automated and uses a decentralized architecture where the malware samples are distributed across 4 VMs for analysis. Python is used as the management layer that runs on the host Ubuntu 22.04.01 machines and the Peekaboo Pin tool (32-bit) runs on guest Windows 10 64-bit Pro VMs. The Windows 10 VMs were populated with documents, spreadsheets, videos, images and other common file types to resemble a legitimate machine. Connection to the internet is through a 4G router and the Firewall and Windows Defender are disabled via group policy and the registry. This allows the malware to attempt communication with Command and Control (C2) servers and download any dependencies, payloads, or tools as required, where the network traffic for each sample is also captured. The objective was to observe each samples complete behavior, network traffic and the anti-analysis techniques used. Each ransomware sample was run for 15 minutes, and all other types were run for 10 minutes. Every ASM instruction that is executed and every evasive technique that is used are recorded.
The Python component of Peekaboo, shown on the left-hand side of Figure 1, manages the VMs, tracks the analysis status of the malware and benign samples, writes the analysis reports out to the Ubuntu machine and reverts the Windows 10 VMs to a known good state after each malware sample is run. The inner workings of the Pin component of Peekaboo are shown on the right-hand side of Figure 1. Pin.exe is the main entry point and it starts the Pinvm.dll which manages the Pin VM 69. The Pin VM controls the execution of the instrumented program in the code cache which is a region of memory that Pin allocates on the heap. Pinvm.dll makes a copy of the malware executable along with the injected Peekaboo instrumentation code in the code cache 70. Additionally, Peekaboo registers event handlers for trace and routine instrumentation and the System Call Dispatcher, Event Dispatcher and Thread Dispatcher manage the stream of events within the malware and the Peekaboo instrumentation 70. DBI tools perform instrumentation by inserting additional code that executes seamlessly. A Just In Time (JIT) compiler is used by Intel Pin and it creates a modified copy of the malware on the fly, where the original code is never executed 70. The modified copy of the malware resides in a code cache that provides the opportunity for any instruction or function to be instrumented. Accordingly, a function or instruction can be replaced with an instrumenting function that contains analysis code 70. DBI can operate on four levels of granularity: Image, Routine, Trace and Instruction 71. Instrumentation code determines where and what code is inserted. Analysis code is executed at the instrumentation point and gathers data about the operation and importantly can modify function return values and CPU register values 70. Accordingly, the anti-instrumentation techniques used by malware can be defeated 19,23,33.
Peekaboo is built as a 32 bit binary in Visual Studio 2022 , uses Intel Pin v3.25 and runs on the licensed 64 bit Windows 10 Professional VM whereas most of the research papers that also created an analysis tool use legacy versions of 32 bit Windows operating systems 20,21,23,27,33,34. Windows 10 64 bit was used in this project as it supports the latest development tools and the security architecture in Windows 10 differs significantly from its predecessors 72.
Peekaboo logs every ASM instruction that the malware executes, and instruments instructions associated with the anti-analysis techniques: exception triggering, interrupts, CPUID and RDTSC instructions. Accordingly, for each anti-analysis instruction the relevant CPU registers are altered to hide the presence of Intel Pin and Virtual Box. The New Technology Dynamic Linked Library (NTDLL) exports the native Windows API and serves as an entry point that allows applications to use Windows system services 73. Peekaboo Pin enumerates ntdll.dll to extract the system call names and locations. When the malware attempts to use a Win API or system service Peekaboo instruments the call and alters the return values as required, to conceal the presence of the virtual environment and DBI.
![](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAApcAAAHoCAYAAAAc8MQYAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAFUQSURBVHhe7d0/TxVd+7fx8XkZhhAClHdtYYDCAngBFmBFZQK1gYbiLmgwVr8CEisqoPAFgIWFEAvruwRjjPFt+HAs58TFcvZmAwPsP8cnmWvP/1kzs732l3PNhie/L1SSJElSC/5f/SpJkiTdmeFSkiRJrTFcSpIkqTWGS0mSJLXGcClJkqTWGC4lSZLUGsOlJEmSWnMvv+fyyZMn9ZgkSZLuU7/9ynJ/ibokSZJaY7e4JEmSWmO4lCRJUmsMl5IkSWrNvYdLvtxTDtPT0/XSuzk8PEz7u6nbbncXi4uLjee9traWlrWt2zne1zElSZIepHJ5cHCQvskUAyGLgDMqvn37Vp2dnaXx09PT9PqQOD5B8zGOLUmSRsujdIuvrKxUu7u79dTw+/DhQzU/P1+9fv262t/fr+fer6Wlpb771QSSJGn4Pdozl1NTU/XY38paDGWFjS7cWNat4snyvOs5346hxL5iWbdjvn37tp77R3Q5M/TSxf/+/fvq1atX1cuXL68N1RwrPy6vXJ8QyxjyNnMucT60Ke8Wj2s9Ozt7ZRvWi33FMeJelO0opwPXKZ+WJEmj7VHC5ebmZqrkBcLP9vZ2qrSdnJykEBRhh8BEl3J0qX/8+LExzBB62Ed0P8c6sR3HKLebmJhIy+i2L48Jlp2fn1cbGxsprIFwtry8nOaznIDW7fnFCHMzMzPV5ORktbCwcLmvEutyrNj3p0+f6iV/cKy4TmWbQXBlWVyDwP7AtaUdOD4+TteS9WlTnHP4/v375XFoUzkdjo6OqvX19XpKkiSNugcJl4SxqHoxYGdnJ71G0IqAQvghCNKVDALT1tZWGgddy1QCcxG68pDDOMEnELAISLlYny5kjvn169c0zTHpugeBcHV1tdrb20vTdGsTxpgPgjJBLQ95OdanzYH9sk2Tpn0HgifnQPUT0ea4TmDbXuXHefHixT+BlEorxsbG0uubN2/Sa0x3Ol9JkjTaHuULPWWQQR4+o9IW8nCaV81yZeAkjOX7LIMXwaz048ePy9AUIQpUOAPLI5Th6dOn9VgzgiptjnZE1TMqmqVO+/7582d6zZcTqiVJkvrJoz1zWcrDJ0NehbwunDJN0Mq7val2UnGMbUplgMX4+PhleIswh7ziyfK8avfr16967F9UZQm1edsZmNfpiz2d9t1UMWwK6ZIkSY/p0cMl3buIYEh4osIX3eUExLx7mOcbm55xpJudCmEevgJVQrquS3FMjkXYjLbk3eDIu8npLs67wcuu7Bz7oMu51Onb8uW+88cByscFym7ybpraJkmSdB/6onJJSIquYwIUz09G0CM0UpWMbmWqdfmzlIEAxXbR3U0gJcCxDSGNZXyBJUdFkuV0VfNllxDPg8Yx8/YQ8qikchyWsc+m9kSgbQp/sa/yiz3sO86BfZehkHOP68SXeWhzr8GRAFx+W7wNfltckiTlnvymn1Z9iSBIIPQWSZKkQdE3z1zqTzd9/iUdKq7lF5EkSZL6mZXLPkM3c/58qLdHkiQNEsOlJEmSWmO3uCRJklpjuJQkSVJrDJeSJElqjeFSkiRJrTFcSpIkqTWGS0mSJLXGcClJkqTW3MvvueRvX0uSJOn+9duvLPeXqEuSJKk1dotLkiSpNYZLSZIktebew+X09HT19u3beqo/8Ewow7dv3+o5fzDNfNo8DOJ8mp6BPT09TfMXFxfrOd2x3traWj3VH2hTnB/DY7zPDg8PG6+vJEmjamgql3zA80Hfq6mpqerr16/11B8fPnyox4YL50qYzO3v79djgymCLo8Mx7CxsdF3P8hIkjRqRrZbfH5+vtrb26un/vj06VO1urpaTw0PzrUMkx8/fhzoc6X9Kysr9dQfBwcH1fv37+spSZL0GB40XFJZpMs5787MK00xHcvybljG8y5c1ovu63hdXl5Ox4gu325evXpVHR8f11N/upCZnpubq+cMD86VMBaiijkxMZFec3HtGZq6zOMehvw+gPuU37dO+4v1mJ9vn6/frRLNNpubm/XUH0tLS9XZ2Vk9dfWxAIa8XbQlf6+xv3z9pnNiXizvpDxmWTGWJGnYPXjl8vz8PFWc6Mak0kRXZo7p6Obc3d29Ej47iUDB/ggYMzMzafvrLCwsXAYYusiHsWqJp0+fptcIOl++fKlev36dxnMEru3t7XTtuE+E7TIccX1ZRogC1V7ENCGWMIvr9sf9ZVncP8Ib9yDW54eFTuHs6OgorRMhLg+OgYot7wn2d3Jyko4X7UT+XmNfPD6QT+fhlm23trbSMtqYh88c+4hz5pizs7NXjilJ0rB7lG5xAgrGxsbSa/7hSxgIfEhHeLkPL168uOwa53UYq5Yh7xqn6/j58+dpPEdgW19fT+O/fv1Krz9//kyvOUJ5PK9KMCSoMs19JJQR7nHd/thPIESy7Zs3b9L05ORkWt7t2dAIgrxnCH+EzPyHEdoW77U4brQD+Q8TEQoD0z9+/Kin/rQ19kUbaWsZGiOMxjlzHdjPsD7LK0lSk75/5jLv5mzby5cvUzWNkMDrs2fP6iXDJ7rGI8RFAMzl3cRU6TohlH/+/Dnti9BKUGW6rP72ur8cYSy24Z70gtAXITOvhEe3O0P5fG0b8qCai2MycK0lSRolfR8uO3U/toHqGGGGEEJliulhRZgk6BDyOnX/E8yiG5mqYyeESYIq3etUe+l2Z5qAmVd/e91fjjZGRZJhZ2enXvIXoZbgVsor4QxUM+ma7rSfu4rHDUp5+xmikilJ0ijou3CZf0mDcBLfCObLJ3klq/xWMCHxNqi8sV+qccOOAM259tL93+1Z16h6cg+o9kYoJ8xF13Hpumdnowv53bt39Zy/X/AqxbrlF47oQu/0Q0K+39vgusXzn+yr6Thx7tFmAi7n0O2LSZIkDZu+C5eEvehS5Bm4+MCm+pN3mZZfSGG7m3xbPMSXT5qeQUR8q3gYRFDv1P3P9eYaxrUjQFGNbML1psoYAYtp1s/dZH/gEYh4dpKBCmunql88LhHrxjGiQkq72J4v1LCMQM37h2rrbdB2rh/7okrbqRLLNeGHItbjePl7WJKkUfDkN/12fYIPZLpR++nDmOoTX8iwa3N08dgE74Neu/YlSRplff/M5WOjC5Qv/kiSJOl6hstr8EWQpmf4JEmS9K++6haXJEnSYLNyKUmSpNYYLiVJktQaw6UkSZJaY7iUJElSawyXkiRJao3hUpIkSa0xXEqSJKk1hktJkiS1xnApSZKk1jxYuJyenq6ePHlyOZyentZL+tfa2tqVNsfA/EHz9u3b1PZv377Vc+6OfXJfb4v3wG3aNEz3RZKkYXPv4ZLgwAf//Px8xV+aZDg5OalmZ2dTOOnFbUNIEwLI4uJiPXW9hYWFy3YznJ+fV7u7u9Xh4WG9xmB4//59OpcPHz7UcwZbP90Xjsn7U5IkPUC4JMytrq5WOzs79ZyqmpmZqQ4ODqqNjY1WK2kPYXJyMgWbz58/13P6X1SJNzc3U8jsF7wPCIZc07saxPsiSdIwuvdweXx8XM3NzdVTfy0tLaXXr1+/pleqiXm3ZlQYCZ9UOTE1NZWmWcaQd7WHssrJK9PMp1JKdYs2RfWSfQxaFfKm9vf3q9evX6cwhwibiOvF9Yxrmd8H5Ne5qRs8rnFcc3B9ozIdx4ghjh/zY7u8DXfpbs/F/hjy+xzt63S8OKcY8nNj3Wgr48vLy2k+05Ikjbp7DZfxgfzs2bP0WqLS9OPHj3qqGRUputFB12dUuQiJW1tbqfJFZbSXMLK+vp7W5bhHR0dp3tnZ2WXQ7QXn1Ckw9yuu1cuXL9M4IZOwWZqYmEjXkmvN+nngyx9p4B6UYTyqhnmXO9cojskPB+yX7alYr6yspPk59vnx48fL43A/e31sAk33hX1wv6PdhMA8WFM5j3axbvzAAX6Qoa0s297eTtM5jscy3j+sB6YlSRp1D/aFnrYRZiIUvnnzJoWHCERtIrDkFSxCBmHjJoH0MRHauFYRygl8eXgMEQSfPn2aXn/9+pVeeZwhHmmIbZp+ICAwfvr0KY0T4LhOcUzG+UEAXDcCWWlsbOxKcCX888NAJ9fdF9rA/nhvIAJwHqwJnlHN5ZEB9oloQ+wr2pGH6hcvXtRjkiQpd6/hMsJFBJUSH+bj4+P11N11Os5dEEioSEUFC91CT7/Z29u7EsSiAtfrF3sIVLEtFczYvkQQ4zgE0OiGD4TJvA1ltzviOVyqi7FeXmUs9XpfaG/sL8JjN7Sf8FyeZ6fzliRJV9175ZLqUFStclEF6tRlfhtRdbsv0a3eSxd8PyAoEagihOVhrNcv9lDRY322a6o45gh8hFa6t58/f17P/SOOTTWRymleBQwE1LyN8aztdbrdF44X+2TIv1jWhB+I+IGH7XLltCRJanbv4ZJuSQJOXq2iIkWFigAR1U1eCSWBABKaQiP7jMrWu3fvLrt+Y934olBZoePZwrsgnBA0bvI84GPh3LkuJbrAOYdulcEmBMJuIYuucZ5jRHQ3E3DzKmTcb7rBc1zPPBwS8G5SLSzvC8dne94bgXbk9y1/PIAfgAioiO7wCMDxGvNL5blIkjTSfj+Qiw96vu1wOZycnNRL/sqXXwTP3xfBqF7yd/uLAPH7IgSkZTGP1xzb5vvhNY7HK9Oxb7Y9ODhI46U4Ton12Udsxzocp9/kbSzRZs4vrgfXFbzm1yvOlYH182vCOZfXPtbLxTFiiGtVHpvt8vVifilvQ668L8j3l7crzj+WlfuL6xBD3hbOubzfsZ4kSaPuCf+5+FAcKFRBqTjFN74fG22hSjhIz2LeF6qPPOcZlct+xTfDqaJe100uSZJuZmC/Ld5P6HqNb1uPsuhi7vdgKUmS7o/hsgVUv+JZwlFFNXlqaipVLSVJ0ugayG5xSZIk9Scrl5IkSWqN4VKSJEmtMVxKkiSpNYZLSZIktcZwKUmSpNYYLiVJktQaw6UkSZJaY7iUJElSawyXkiRJas3QhEv+rvWTJ0/qqcFBm8uBP6XYhrdv31bT09P1lCRJ0v0binBJsOTvWg+qg4ODir/CGcPu7m4KhpIkSYNm4MMlVT6C5cLCQj1n8HEu379/r6dub319vTo7O6unJEmS7t/Ah8uJiYlU7VtZWannDL7j4+Pq1atX9dTfLv8YTk9P6yV/0PUdy6h4Li4upvl5t3jMz9c9PDxMy8Ayq6WSJOmuBj5cUp0bdMvLy5eBj2F7e7uamZmpl1apMss8QvTJyUk1OzubAieo3BIYWXZ+fl5tbGyk+U0IrXt7e2ld9re5uVkvqaqjo6OhuJaSJOlxDc0XegZZ+czl+/fvL7/UE9XFCH6ETsLmhw8f0jTPZ0bVdnJyslpdXU3jTdguQuv4+HgKo5IkSW0yXPahra2tFBpzeWWzDIVjY2P12J/HBCRJkh6L4XJA5JVNhrwL++fPn/VY1coXgSRJkm7LcNmHeBYyureXlpbSa3zZJr7cE93lrMdzlGBZWfGUJEl6SIbLPlB+oYcv6Ozs7NRLq8sv6rAsvtwToZP1+HVDsazbM5fd+G1xSZLUhie/6WPV0IgvAuXhVJIk6aFYuRxwVDnzLnO6xefm5tK0JEnSQ7NyOeAIlHSHB7rFrVpKkqTHYriUJElSa+wWlyRJUmsMl5IkSWqN4VKSJEmtMVxKkiSpNYZLSZIktcZwKUmSpNYYLiVJktQaw6UkSZJaY7iUJElSawY+XPJ3tZ88eXI5nJ6e1ksGw+Hh4WXb+VOO/Sba14ubrPsQFhcXq7W1tXqqHdyjuF8l3nvM57i9Yn2umyRJw2KgwyUfyu/fv6/4C5YMBwcH1ezsbF+GtE729vaq7e3t1P7Jycl6rvodf8+9/EFmf3+/HpMkaXQNdLhcWlqqzs7O6qk/0/j69Wt6HQS0f3x8vJ4abFz/fvpT9UdHR9XOzk491a75+fl/wuTHjx+r1dXVekqSpNE0lM9cjo2N1WP9bXp6ujo/P6+Wl5cvu2+ja7Wp65Vp1uOVxwGa0CUb25Zdwtc9QkB7Ylm5/zguQ6du3LxbPM4j365sT6e25l3PDHklmm3y86DN+fpMh7xbPMZjPYZ8v/l1Zz320627+tWrVylMhriWExMT6bWTuEZxnFJ+D7odX5KkfjVU4TIC0czMTHrtd1Qt6V6lW5wKG2GHbv2Tk5NUAaQKloelwLL19fV66i/CCvtkOQPhJ64J4WdjY+NyGfve2tpKy0D4ohoXy1k3D59zc3NpPm0lDPeKsMV2nNPu7u5loItgFcejrRGmuCY84hDHYzqXnwfhnOX5dKdQxvFjvYWFherdu3f1kipd9zgmbWY/3Tx9+jS9xjX68uVL9fr16zTeCefOtYv7WwbR/B6wDuvm90CSpEEwNOEywhMfyoPqw4cPKShFOH7z5k0KOWXI64TwlAdGwg7PpIJ9EloCQSceKWD8+Pg4VeMC6+YhPR45eP78eXqNkHidly9fptcIY79+/UqvtHVlZSWNg7ZwjAiGcbwI0XlgzLueI5wHpn/8+FFPXZVvx/OtcQ6djnmdvGuc6xzXppPy/ubHKe8B6xCAfY5TkjRohiJcEr6i4pcHokHz/fv3K5XK23zBh2pXdKsStnMxn6FJBMCH0vT4AsGQAJYrp+/DbY4ZXeO8//gh4Lr3Xnl/cxG683vgF7wkSYNo4MPlsARL0E0a1UT0Wh3MRdduDLE/uscJTDH/xYsXaX4uAs5D+fnzZz32F19uKrukr+uibsNtjsn7jfWoFvfyRZ7y/ubKyi5uc/8lSXpsAx0u+fAdlmAJupAJK9ENXnajXoeAs7m5WU/9eYaPoUle1aRCVnbBUmErv9TTJtrKr2EK8YWb6JqOruqyy/o+lMe8yXlz3ejO7va4Qoj723Sc8h6U3eSSJA2KgQ6X8YUMAmbe5Xufoeg+ETAIynE+BMBOla4mfCko/7Yx2/LreMDzfQSbWMZxmI7qGOvRxRvLeZ6w12cPbyN+RVAcDzGPdkX3Pq9M3zeuRxyT7utexXOjz549S6/dxP3Nj5N3v+f3gPlUoYfhhyZJ0mh58ps+UklXEPCGpSIuSdJDGppvi0u3xWMIhMmo4kbl22ApSdLNWbmULhAo8+dQrVpKknQ7hktJkiS1xm5xSZIktcZwKUmSpNYYLiVJktQaw6UkSZJaY7iUJElSawyXkiRJao3hUpIkSa3x91z2kf/+97/12NVxSZKkQWG47CP8CcLgbZEkSYNo4LvF4+9CxxB/H3oU8CcL47z7Ee2bnp6up0YP5x5/p/yhlH8n/b481HEkSYNnoMMlH2yzs7PV+fl5qvRtb29X8/Pz9dLh9/79++rg4GAoqpyGldtbXFys1tbW6ilJkh7XQIfLycnJFKx4xfPnz1PQHJWAwrmOjY3VU1JVzczMXPk3IUnSQxuqb4t/+fKlmpqaGokP1ugKp3IbXa95NznVrEBVkC5a5rGM6SasE9uX3blUxmIZQx7gGc+XlfuP4zYtQ1Sgwf1jOqpxbBPnEtXNGMo25sfJK3nXtS9Xrpvvh/HyOuT7ytsXbW4Sx4h9HR4epvn5vvPjxn7ZDrE981nv+Pi42t3dTeP5ujHeab/Il3VrM/J19/f367l/lNct2ipJGkG/h8D5+Tn9wmk4OTmp5w6eOIdebwvrHRwcpHFe8+0uQtrv1dXVNM41yddtsrCwkIZQ7pv9BdaLfSNfN46F7e3tNB73hG3y/eRiO+4lOEa5br6v8nzZd95+to02sR5tQXmcUr5duS7HKKe7XbP8uLl4v+bLGM/PN19etiO2j2uR34983RjvtB/mMx3K+5orrzfr5vtiPM693K8kabQMReUyuscvPuhSBSwqQaNkb2+vuggG9VRVbW1tpWpW7tmzZ/XYVVSZqH5tbm7Wc6q0L/aJpaWl6uzsLI2D8ahMxbVmHUS3bLgITGke5ubm0j3qVfn8LPuNff348SO9Rjs415WVlTQO2kibon3r6+vple1p04cPH9J0KbbDz58/0+uvX7/SKy5C1WVlfGJi4vK6lNeBV47TDY9xBJ6fff36dT1VpeeHmdeGly9fptenT5+m1zgf9s9xAtevfM+E8v2Vv1fKc49rPYr/DiVJQ9Ytzoc+H/6fP3+u54wOQg5hJ9zmWUyCeXRr5iGj7PIsvwF+XYhqS97t/enTp3ruX93OOW9/t4Cbd/1GuO4FYfcu14E2jY+P11PVlfH7tLGxcXm+y8vL9dx/le+vXNO5P9R7QpLUf4YqXI4yAt/379/rqb9Vt5s4OTlJ1cEYjo6O0vx3796l0B7zy2dab1KNvC2eH6S6yrFoQ145C93OOdoeQ1TXcoRoQnVch52dnXrJ9QiDd7kOhLGoxiIfv09ULstr06R8f+Wazv0h3hOSpP400OGy/KID3XAEkFevXqXpUVJ2aZbdmN1ExZeu9ECYKL/8gQhgIbpCows0qpzcm5uILtte5W1F3o0Pqpy0P9oXX/6J9vXSZUuo7lV5HPZ/k4BFl3jeDZ53k8e1+fr1a3otu/TLsN8r9k/lMnC9yqp0iPdX/FvLr3/5HojXmC9JGjG/B1x80SAGvrQwqPLz6AXrxZcoEF+kYOALF6H8IkcnU1NTjduzXcxnnfLLHflyhvyLHawfyu1KcXz2x/EvAmO95A/mxTHinPLzz5d3aj8D7eqEY8Z67Js2xfosy/dbnl9+HNZjaDpWrFe+V/Njl+fOfmJZjMf2cV3ZJr/X5X1vOm5+TIZumtpQ7juGmC9JGj3++cc+QkUteFskSdIg8plLSZIktcZwKUmSpNYYLiVJktQan7nsI3d55vK///1vPXZ1XJIk6SEZLvvIXcKlXwaSJEn9wG5xSZIktcZwKUmSpNYYLiVJktQaw6UkSZJaY7iUJElSawyXkiRJao3hUpIkSa0ZqnC5uLhYra2t1VO6q7dv36bfn/nt27d6Tmfdrv3h4eHl7+FkX4yfnp6m6VHCOXPuTUMv17gNbV9/7i33HtPT0yN5XyVJVw1NuORD7fj4uJ5SG96/f18tLCxUHz58qOf0D4IvYabfEeQIYLnz8/P0i+7zYXJysl7aPkJ/BMC2LS8vV0dHR2n848eP1crKShqXJI2uoQmXfKhNTU3VU7qrqEBtbm6mkKnhQIglzM7MzNRzbo+Av7q6Wk/92TeBvwzTkqTRMhThkg+5169fD0Qla1Ds7++naxohpOzujO5VhqbrTqUsln/+/Lme+y+qagyxLkN+rHw/UX0jvGxsbKQKYByb19gPr3lXPNgn09H9zHh0+5fbxHQub0e+jH2wjOPH8ghX0Taqe70ErrKNZRc2x4lzjCHWRWyfL6N9u7u7qarP9uU+0dR2cKzyePl2/NDx6tWreuoPfsjb29tL43GsvI2SpBHwewhMTU2l14WFhd+rq6tpfBBxO2K4qbts24T9XIS3NL69vf3PdeWaMx8nJydp/ViH+XFPwHi0i30yzjZgm/xYTHMfwX5iHOzn4OAgjTcdI1+X9eKYiDbGcRiP9WNZOZ23qTxWnDuvrBvnU7aLZdHm2G85lMvjuOW1on1MB6bjmpfrss9oR35Nm/YZ+4jjxzLmM51fh3I/pU7zJUmjY+Arl1RWtra26im1gerVRYi4fA7w5cuXqfoVFSiqVxchIs0H1U3WD1S0qHqG6+5PfqyJiYnq7OwsjY+Pj6eKW1TLmL+0tJTGm7x48aIe6008H/j06dP0yiMAiOlfv36lV849PwfOLX9U4CLEXVZ4aTPXphuWX/zbuxy6nVPpIuDVY3+6oeOe8Fxs3g72GdexE7bl+kb1Me4jVevQ6d5wbTheKda1WilJo2ugwyWhgw+xm3w463p0axI6ois0QkR8sefnz5/pNYJEifBEyLor7uv29nY1Ozt72ZbHCi10bUcb6JLvR9EN36sIzxGm0emeluI90EnsW5I0egY6XH758uVKCGKcKlM8m6ebi2pWXlljIORFtW5sbCy9dgp6hNEfP37UU3ezvr5+2QaqdvPz8/WSh3VwcHDlelxXFXwMN21TWaFFr+E93gOd5IFVkjRaBjpc5sGDgS48Akj8ahTdHNXJvIs70AVORZJqMd2nBMh3796lZcwjkAa6jfPqXnQ33xSPPOQ/KNAtG9W56yqjEX6iSz3v6r0p3lP5OdCmXn+Aaeo67iQC2devX9PrTX4FVH5/wGtUerluTahS5t3g8YNF+SWdJrS1qfs/wmmvFVBJ0vAZim+Lqz2EwqbfVVgGEapkVIkJMKyfPwtI6Gc6Ksr585c3sbOzk15jP7QtfnB49uxZCjeduoIJwLQhutQ7Baxe0I78G9Wce68/wFBp7fXb4lxjKsTRBX8TbHtycnJ5vrwyzfznz5+n0NgUiDkPfj8l2xCEqdDGc5vdsF/WjzAbCMbxwwlBk/32Wg2VJA2HJ78p+akv5IHiprflLttKt8GvOfr+/fvlDwEgwPLDRjwHzTpUVQmjkqTRYLjsI4ZLDRred/F+o0JJpTZ/9pOw6WMqkjRa7BYfMeUvxS4H6SboRo/udoJl/AL1YLCUpNFj5bKP5OHOyqUkSRpEVi4lSZLUGsOlJEmSWmO4lCRJUmsMl5IkSWqN4VKSJEmt8dvifeQu3/j+z3/+U49V1f/+9796TJIk6WEZLvuIv05IkiQNOrvFJUmS1BrDpSRJkloz8OHy8PAwdSfnA3/jWL3jenHdTk9P6zmSJEm3M/Dh8sePH9XCwkJ6RjGGycnJeqkkSZIe0sCHy+/fvxsmJUmS+sTAh0u6dOfm5uqp0RLd2THk3drT09PV2traleW5t2/fXs5/9+5dPVeSJOluBj5cHh8fV5ubm5dBidA0Kqampqrt7e30KMDJyUk1Ozt75XnTjx8/Xj4qwLpxbQihGxsb1fn5eVomSZLUloEOlxGktra2LgMWoYkv+Qy7OMf19fX0OjMzkwLkhw8f0jRev35dj/2pZPIIAfb399NzqvE4wZs3b9KrJEnSXQ10uCQcESqXlpbSNAGL0PT58+c0PQqiYstAJbIXhHKfU5UkSfdh4LvFR110e8cQlcxuCJZ597kkSVJbBjpc8uwgFbsISkzzDOarV6/S9DCLam08R8k14Fr08kgA14frFF8A8gs9kiSpLQMdLukGPzg4SM8aEqz4QgvPXTJ/FNANzjOmnHt8uSdCZzdx3bhebDsxMVEvkSRJupsnv+lLVV8g6AVviyRJGkQ+cylJkqTWGC4lSZLUGsOlJEmSWmO4lCRJUmsMl5IkSWqN4VKSJEmtMVxKkiSpNYZLSZIktcZwKUmSpNYYLiVJktQaw6UkSZJaY7iUJElSa4YiXC4uLlZPnjxJw9raWj13uB0eHqbzDZw309PT0/Wcv1jGNRpFXI94b+TD27dv6zXuH9f+vt6Xp6enjfdc/+I63fW+f/v2Lb1/hhXXx/eTpLsa+HAZH9q/f/9Ow+7ubgpeo4bzPjk5qc7Ozuo57eNDtd+vbdOH4/b29uX7I4b19fV6afsigBD87tvKykr18ePHNG4wuKr8AawNk5OT1cHBwcj8ECtJtzHw4ZJQtbm5WU/9CZlLS0v11PDiHDlXEGbw9OnT9Kr+cnR0VO3s7NRT7SE8ESYJPLoeP3i18UMF//b4/078uxsmXJ/7/AFV0mgY6HAZlaGZmZn0OkqiKsMH3NTUVJrH63WVRa4Z20U3eoyH2G8M8QEaFbHl5eW0DlWyfB/gNT8+20Q3JOsyMK/cJp8OZTtCVAXzY0eXP9tsbGxU5+fnPVfwyi5rxvP9sR+m41hxPiE/n1gW92N2djZd7/IYrBfbxLFw3b0p7e3tpcolms4931e0LT82Q1ldzZfl9zLaFkO3YFWum6Nt0aamc4trxfK4NtftL78nsT3b8F5FbJOvm7ejab/Xne/q6mr14cOHeuqqfLt8YB/x/m0aOsnvWdxblO+r2DdtR7d7nZ97vk+2YbrcF2JZyPeRv48laaDD5c+fP9MHef4/UcZHCVUrAgXoFu+1ajsxMZEqn2wTVRgGPpDZH8voTo4Pr6hm0CUYx2C7WLcXrE8XLutz37hfsX3cR0QwoG3RjvxDLbCM7Y+Pj9M2tIt12VdefSF0xfuD4SYfhOyfAMexOHf2FdjP/Px8WsbAMtrBNqD95Q8+EQJjG9qZBwQ03ZsmnPezZ8/SeKdzB/uiIkXb8mMTkLa2tuq1/gSueISAc+AexPuCoMz5s4xXjtMk1o17xzHKe8c6LOtUzY33CBXfXvbXhOtOO8F2TeI4DPn7r5fznZubqz59+lRPXRX7LAf+rTI0LWNokv/QwDq83+L9S48N74/w9evXamFhIZ17t3vNPvNz53qW/9+knWyzv79fz6nS+cY+WJ9jxz5Qvo8lja6B7xaPD3L+B8c4/0PNKy5q9vLly/QaXem/fv267F599+5deiWQ8AHfCR+4sU0v+OCL9flA48Mrn/7+/Xsa5wMtPiRBW7m3fGCGV69epdfYnh80OonAFEO3c2oSYXpsbCy9Ej4YCHfRDrDv66roVBs578CHdR4Q0HRvShwf111/QlCgbbQxsI8IohGK49jsl3V5pULHvY7rEK9N/85i3bgOb968+efevXjxoh5rRoAKvezvtl6/fl2PXX3/9XK+vBfKEH8f4v0S95n3G+877h3XhHbGtcgr2d3uNW3nGsb58O+h6XEBjhXP88b7Pa7F+/fv07+rwHHL97Gk0TXQ4TI+7ON/jPwPmFDy+fPnNK2b40OHD4mo8j1WJZgPsmgDH6D96qbPufIBT2UyxHv4ppoCZy/imjI06RRWeV9cty0IaHllsdP+etX2/nrVy/myTpN8u3wgoDE0LWPoJP/3SEU1RxCP6mIe/tBp3wRPqrFUpmN5U1hnPc6RZVRF8x+KwA/ysX08giBJGOhw6RdY2seHNxUPBroi+QBpo0p0U/yQEO2IIapX/eSmIS+vkKFbxbWb27z3+UGBoB7Xs6mCSPhpkm8XQx5kAsE5r+h12l+v2t5fr3o5304/9JTbxcC/rfzfVzl0Qqgr142QTXWR8EkVMg9/191rziWWUYEsQ2tgn4RXqqJ5lR5ljwCDJGGgwyX/gyWERHWNEFR2Vap3XD+qEPEBHgEmXjt9mAaWR9WYfXWq7Fwnuv4i1PLBmberm/Hx8XqsN7yHousPvXbtxXsvfyaN4Mh7MT74m5Tdh2U3ea/iGPk1uem584NDiC7W/EsqXHOufTyWEN2o8T6J+5MrH2Eou7Vv6rr9cc3j2UeuBe+bcNuqcC/nyw8FeUX1vsT7Je4z7y/aEuK+8fxlt//v5feafeRt533DPpqwT/59EPDze8gjBfk+ed7yIa6HpMEw8M9c8rwQz//wP9x4CP+2H2SjjusWX17gevLKdAQZuuDo/ooP3RJBKbrweJaQ8HUb0Q7uJ/uKL/d0C22BL7gQDHr9oONLJazPcRjy58iuw3uPD97YlusTj2hw7rS/DGBUjDhGbIPb/poijkF3Zbju3Glbfq5cU6YjuBAg8q5O2kl7ue6sG92o3f6dxbpx79hfXnm8qev2x7WLRyi4/nlQj/ax7CZ6OV9+iLru2dE2xPsl/k1y/tyzXDw7mrev271mGdcqlnGe+Q9Yudhn/nwq2AfXOvbBv/u73GdJw+XJb/sy+gb/kw7eFl2HkE+gv+kXlHR3/FslrPXyA48kjZqBr1xKo4qqFtWivGtc949QT9XOYClJzaxc9hErl7oput15Ls8uyYdBkKeL2n+fktSZ4bKPGC4lSdKgs1tckiRJrTFcSpIkqTWGS0mSJLXGcClJkqTWGC4lSZLUGsOlJEmSWmO4lCRJUmsMl5IkSWqN4VKSJEmtGehwyd/45a/alMPa2lq9hh4DfyIvvx/T09P1kj/evn17ZXkM3M/APVxcXKyn/uo0v238WUXaNCx/tzvOh4Hx+zZs10+S1LuBDpdLS0vpzyTGcHJykua/efMmvap9BMMyLOYIFfzt5YODg8v78vr163+2ib/PnN+75eXlgQsj8QNOv9vf369WV1fTtZ6Zmanntuuhgr8kqb8NVbf4yspKtb29XU1OTtZz9NDiHhD8w/r6enrNK5MlAg+B88OHD/Wcx0V7CGLD8l4itE9MTNRT92/Yrp8kqXdDEy4JLufn55dBRt3lXdMxnlcNYxlDhEJeNzY20nVuql6yPctevnxZz/nr7OzsSuDsZHx8vB67OdpH5Yy25ecT0wyca67TdSi7danKxXpx7qxDtRXMD/m6eSWvqX3Mi3VjXid5W/P9sg3z4rhxvwLrHh8fp3vHeHlusT3zQfvyc2DIlW0Gbdvd3U3HaToG8m3iWGD98njldvn6kqT+NjThcm9vL1XMdD0+qCMkUl369OlTveQPwkV0obIOAYptCIdcYyqMhMXSr1+/0uttqlUEFo717Nmzes7tEG54L0TVjODC+TDNwHlH+LruOgTW//jx4+U+2B9hiuoc3f9gPiJkxbogOIW8feDaxvG5tvm6OdpAW2O/XP9yXSqTLCtD/NHRUbWwsJDuKeO9yM+X+815gWtWtplrzA917J/jNB2Da8a6bMM1m52dvRIg82vGPt69e1cv+XNt76srX5LUvqEIl3xI8aHdVDHTv3j+jg/wCIGbm5vpFYQHgkM8t8o6rMs2beIYeaWKwELoaKMbNYJIvC/y8yMAEe7Q7TrkxsbGUnsjlBKeOlXI379/f+WHHB4TIDjlon1x3AhS7LNT+KPNtD1sbW39s9/nz5/XY3fHc7KBYPj9+/c0Xl6zbm0O8Z6Kf5+E3/IRiPzc2HcePCVJg2UowuXXr1/Th1UbwWRU5Nfq6dOn9dhfXM8IfgS0XsR+CBOlMiyw/6hUxZBX3Lo9H3jT+0yVLM6lDGTXXQdEhZIAHPtpOsdAhTHWY5tuCF20KdaPCmGJSmV+TQi8j+Wm1//nz5/pNd+OwCpJGk5DES4/f/5czc/P11PqRR72ojs7R+jJg9/Ozk69pDPCA6Hxy5cv9Zy/6MLt1OXbhGcvm7re6a696RdT+CZ6fi55pe266xAIvrE9lUkCayfR/ZsPnXDNYh3aSTBtCq559RAR2B7DTauKEYTz7ZrurSRpOAxNt/jc3Fw9peu8evUqVSPjw54u1kCVjoCYP/OWV9Su+8IN3bf5c41gW47XS0ANhDkCbl7JY5959+p1CG504ebnR0iLkNvtOuRoQ15p4xpwjVBWEOlO5vwDx+pUpSNEcm3j+FE5baqglt3rZTf5TcT+qfjjJt/QL68Z94RzQKfQH++pOE7ZTS5JGi5DES6pgjxmN+Gg4cOe6hof+ASDspuT65l31RJi4hlDvnBDMOgUmNh3/M7K2D6+iHJTbFN2MXPssr3dUKXkfGIftDtC7nXXIXDuVMbzdlBBBfsA88G6XK9Yl+vYqUrHtnS3x/F57fTcKWGbtsZ+cZOwnmP/7Cvu0U2UbY57Ap75JHjyBZ8S1yDuJVVf3iO93ke26fYYgiSpvzy5+AC/+ae+7kX+Qf+Qt4UPbj7wR/2t4HXoT1RH+eExgrwkqb8NReVSN1N289IdTPfxqPE6DAYeATBYStLgsHLZRx6ycknXJV2YYVTfBl4HSZLaZbjsI4/VLS5JktQWu8UlSZLUGsOlJEmSWmO4lCRJUmsMl5IkSWqN4VKSJEmtMVxKkiSpNYZLSZIktcZwKUmSpNYYLiVJktSagQ+X3759S3/ZJobT09N6iTpZW1tLf/ZwFPCeODw8rKdujuvE9Xos/O1z/ga6JEmDYuDD5fz8fLW6upr+XOLBwUE1OzubAqf6CwGJoCRJkobbQIdLQuT5+Xn16tWrNL20tJRef/36lV7VbGdnpzo6Oqqn1A3XieslSZJ6M9DhcnJyslpYWKj29/fTdHR/Pn36NL2qWd4tTkWRcaqK8WhB3o3MujG/rDyyXixjyDEd27LdxsZG+kGgU/WyfLwh74qOrul8eV6dLtvR1A3O9vk+eXyCdQPHiO3j2iCOjbKNTccJ5br54xpc85ifHwvRrqZlyK9DvjyOl18XSZIew8B3i0cFjg/Wzc3N1D1O6FTvjo+Pq729vXTttre303UE4enjx49pPgPBMJ7/IwQtLy9XJycnl9s1BUeWnZ2dpeVTU1NpvAmPN/BYA+uzz93d3StBieloBz9QvHv3Ls1nHdpBcI12RPtzVLfZR/jy5Ut6nAJxTrF/2tgUHMs2ctxOONd8XR7XAPslaOfHykMv68V2Kysr6bwC7cyvA2Jb3vPM870vSXpsAx8uCZUTExPpg5WAxLRf6rkZgtDMzEwaHx8fvww0Y2NjaTyCFkF+fX09jVMtJuTFdi9fvkzr5td+bm6uHrseISsea/j582d6zR9viCAIAlQEzzJUff/+/UogC7ST84z2ffr06bJ9nDMBO5blbckRniO4sr8IeKW4XrGPfF3eo/m5bG1tXYbecjteaXN4//59Cs+B8JkHZkmS+sFAh8v4MI7Aw4d43k2uu+F6UkWjQkdoL4M7gSzm5yHoNvLuXgLYTRD6Yttu3cKvX79O7w3Woe15iCO0UTXstp+8Ss7Q1G0dOl0Pgis/DAUCfPjx48e115GqZxy/W+VUkqTHMvCVS90vghdVN4YIYIEgH8tiIJDeFEGOClx0sd/kCzT8gEGlMo5PNa+T58+fp+N8/fo1tT3HDyixDyqLdIE3IRzGegTU6FIvNVVPQRCmuhqiSou8atwJ9yCOH4MkSf1koMNlVJ7y5wD5wI9vj+tuuK75c5SEn6iscY3zrmRCXqeKH9i2V/E85W00PW8ZCL60n4pfHkKpmuZVSCqLTc+Pcn5RLQf7ajqveF/GulwTtuValV3ZeTd5+X6O4ByovFK5DLS7qZ2SJD2mga9c8uEbXYXxZYjbVM/0L6p5VPC4tgyEMr7gg+gyj65kllF57PSFkmfPnqV71RSG2IaAFfviWUiCG1+6uQ6BjHWjjdGlnnff5whooD0hKqWxD95PTb+qifbnjwhwbSIQlvJ1aV+8L1mf6mPsA3mlNn8/cy55hZX7wXWKbQmpVFIRAbZTuJck6aE8+W2/Wt+IsAFvy/2gGkhoawqPg46KJ1+s6hTwJUl6CD5zqZHy+fPnrs9lDjK+AW+wlCQ9NiuXfcTK5f2hu5juabqZh7FqKUlSvzBc9hHDpSRJGnR2i0uSJKk1hktJkiS1xnApSZKk1hguJUmS1BrDpSRJklpjuJQkSVJrDJeSJElqjeFSkiRJrTFcSpIkqTUDHy75s378ZZsYmFZ3a2tr1eLiYj1VpXGuXT6vlF9jhtzh4eE/yxnevn1br1Gl8enp6Xrqr07z2xbvk9PT03rOYMvf91z/+/ZQ16/f7lMv7+3y39NDiHY1XSf+PdGeh7qW7J/jcDzENcoHrpGk0THw4ZK/F729vZ3+XOLJyUmaVu/4QDg+Pq7Oz88b/+Z2fEDFNWY4ODhI80qxnIH9bWxs9E1I6FX5QdmvPnz4kP5OOtd6aWmpntuuhwr+t9VW+whi14Wffntvxz3/8uVLeg28b2nfyspKPaez+7y//D8iv2a7u7tXArmk4TbQ4TIqNuvr6+l1ZmYmfeA+RCVnkO3s7FwGyV+/fqXXycnJ9FriQ3d1dfXyGoMPNq5ztw8L9sc6+/v79ZzHRXv4kOM9Mgy+f//e8Z7dh2G7fndRvrfzf08PiTZ8+vSpnvqDHzrAv9F+ume0lfespNEwlM9cfv78uR5Tk+jGo/IyOzub5lGta6rEUNV89epVPfUXH6Z54OxkYmKiHrs52hNdfHn7YpqhrDjl3ZiE39guKrCxj1gWA1gnrgcV8Khe5uvmlZ6m9jHEujGvk3LdHNOcG69liGc+lSAGjl+eG5iOH7KiMse8GOLcULaDZWxLdY4qWKdjMD+2yX+g41jl8bpdh/z6vnv3rp77V36cuBZl+0Kv7w0GsA7vca5luf514r3Ndhw3xhny43Q797xN+XmAebGv8j0AqpO0Pb+XhE1+GER5z/L9cazy+vGaHyfeNyG/T/l+e1H+fyTaFkOcA/tkOn8/MZ23Q9IAuPjJdmBd/I/xN6ewvb19Zfrif65petDQ9hjuE9dnYWEhjZ+cnKTjce1KcT2bluUODg7+aXPsl1dwjy4CWxrPdZqP2Af7D7Q9X5/x8v7HMVk3pvNlsd/AevGeiWVxznFuMd107fL2xTHA/E7n1tTWfF2WRZua5O0o94W8XazHdGA69l1um7c5vzflevk+mJcvYz7TTdesFNvm65bHybdlWZxX+d5h23ya8XhvlMdhfuw3P5cSx2K7XNP5xr6i/bc5d9bL12VZp3YF1onrwX7ydpXT5f7K65dfL+TXJdoa8vMqz4Pxcsj3C+bl95HpkF/z8ppIGgwDXbmk2+fif2zpJ3B+up2fn0/dL3ocUYVgoAJ48aHRSpfcs2fP6rEqVZi2trbqqap6/fp19f79+zROl+DFB+TlMd+8eZNeS0+fPk2vUaWhW5Ohyd7eXqoERRc01ZeyWpS3j+NH++iaPDs7S+OlprZefDhfqQbNzc3VY3fHOQTOJdpftqNbmwPb5pUotuXfXf4IBNNxzajwddon2+Tr5vcsjrO5uVnP+XMe3JMm3d4b5XGout+kK/sm7+3bnjvnWb63rnsPsH301Hz9+jW9dmoXbvueYp8Xnxf11J970+19chEQ0/oxcB+i+hhVyXhuNHpA8vncZ6411+MxHjmQdDcD3y0e/9Nj4H92DHfpitVf8aEXH1q5/AMw5B8mDHm3+fj4eD32r7I78DrLy8uXH/T8YJHL9xXtLzE//6GEIe+GKxFaYr3oNu+E9x8fiLF+p+48nj/rpa0P4abXP57TjZCO27af99F123LN43pyL7rp9t64yzXu9t6+rfLc8+vZK7rG45rED0L3Ja4rw00R+qOdP378SD/Q5Mrp+CGDkCpp8AzVM5f8z5rqT7cgo5vJKyM5no2L58x6MTY2lu5NiWfEbvqhX1ZF8gpKPt4UgEP+Qwn7I5R0Wp8P7Px4DN3aHOtwvnygNgXXsqLVra33LW9HLyIERcjEbdvPdbxuW34QyK99t0pWt/fGY17jJuW559ezV1H94z2WV5PbRpWfABjX9cWLF/WSm+P/z+X/C8ppfijjeN3+XUrqXwMdLvmfDj9FR1cigYf/IcX/cHV3dBcTkPIH/fkgY16nruQmhDnuTV7J477d9AORoJd3kxJwI+S+fPkyfUjl74cmtD+vvhB8wYd9WT2KylB8wMWXGpqU78cIoLH/XNnWsnv6JuI48WtpulVhS2U7eOUcOJdOP6RxPH7oiG5w1r1tsInHDJruWRwn7+qmyhrvobJ93d4bcZy4j/l7IK7fQyvbVHaT94ptCGE3ff+U149rG98+j3vaSVkVvg73JaqqeSDOX2M+/8b4oYCBbTpV/yX1sYufQgfaQf3wdwyD7KHO4+J/2B0fxm/Csrxt5fpxD3px8QF4ZT8cv5NObaPtsT37y+XvB86TV/YT5xDHiy8RxJC3I9oYxy3XjflN7Yt5MbBtJ+W6OaY5l07ye4jyvDmH2J71mBfKbct2xLWIa8a+yuuH/F7mbS33zzUo71Mub3tc607Hyfebty+wPNYtj5kfhyHuW8zPr1GIZd3k53uXcy/XYx7LrxP7KN9r5T0r91dev5iOeZxLfk1iGUO8Z9gmHy/XiyG/JsiPxRDbNt1/ppvujaT+9YT/XPzjVR/IK2Lelruj+nLxIZkqc49VnZIkadQM5e+51Ggqu7vjMQmDpSRJD8fKZR+xcnl3PJ8V30qFVUtJkh6W4bKPGC4lSdKgs1tckiRJrTFcSpIkqTWGS0mSJLXGcClJkqTWGC4lSZLUGsOlJEmSWmO4lCRJUmsMl5IkSWqN4VKSJEmtGZpw+e3btyt/4Sbw5wCZz8Dfntb9Kf+2d7+anp6u3r59W0/poSwuLqZ/j5Kk4TYU4ZJgOTU1VU/9dXp6mv7ONH9K8eTkpFpeXq6X6L5F2OceDKph/IGEcEfI62fD8N6RpFE28OGSD0uC5cLCQj3nr/39/Wp1dTWNz8zMpPWsXurs7KxaX1+vpyRJUpsGPlxOTEykyuTKyko95y8qICwPdIf++PGjntJt5Y8aMHCdS1FJnp2dvaxA0RUd23AvQlSqYr9NPwDky6NLu9P+EPtkoFLHENvl3eK0LdZjiLbG/qh2R3vKdfPzZjpvX358hm4/1JTr5vuNrmTmN1UcWRbLo83l/vLrTyX/+Pg47SvWi+VgOtpa7jvOP+bFeCd5O8r7A9oQyxlC03snPyZDfo3Ytz80SlL/GPhw2a0CRYWq9P3793pMt8GH+MePH1OgZ6Bi/O7du3rpX+fn5+mVxxGoGrPdxsZGms928/Pz/4Sl+EFhaWmpnvMvlnPPr9sf09vb22kZP3gQqJoQYGgj6x0cHFz+kBLvHebRHsIM6zId6zY9ihHt4/ix7nWPZLCfWJc2l/uN6310dFTPuSoe/Yg2s32cO8em3bSfdlHJ55512lep3DfiPrFvludBL5ffg729vSv3IMI9yxhoc8xreu90e8/Rtm7vGUnSwxqaL/ToYfAhngcNxjuFixzhgmAzOTmZpl+9epXCRr7t8+fP67Fmc3Nz9Vj3/VHtIqC8fPkyLaPNTUEQzN/a2krj5bnlPnz4kNaNEBOvecUsbx/VtM3NzTROQCIUNYntY3/xw1K+X0JaN/kjIbFd7CceB6H9t9H0uElc16dPn6bXX79+pddceQ9oR74v2pcHXNbt9INfeV96fc9Jkh7HUIfLpq64vJtcN8eHet492XSNO6HKFdtRTbur6/YXwROd2klQIZTGfrp18xKAYj2GbiI4xbpNXdrgMY0y+HYKwjeRtzMqgQ/p58+f6TW/B7noYo+hKcSGu7znJEkPb6jDJR9seTWEIDE+Pl5P6TbojiQIRBdlp/DQhEpjbHeb7UvX7S+vbnWqSCK2JYQRWPOqYY7Qlx+LISqOTThmrEeAjW7fHO/HMvy1EQbzNjJEJfOhjI2NpddOFUaqxfn96+Yu7zlJ0sMb6nBJNyVhAdFN1y0M6GYIDnF9S2UA4FlG1o2wQdCiCnVb3fZXdgUTFpsCG9uyTXxpJNocwSivINK9yz4ieEblLbYtsSwPqeyr6QebeD/GuvF62/dpbBdBNs4x9ptX7uN8v3z5kl7z9t5V3IN4NpLrlD9zmSuXdQuP3d5zkqQ+8XtIHBwcUP6op/5aXV1N8xlYp59FO5vOo19cBKzLNl6EhyvXvbwHCwsLafrk5CRNb29vX27LwL4Q+4z1mrC8vH+d9oe8nbSDtrI+8nGOme8j5iPeO3Hcct28PeV0fnwG9tVJuW5+HrS927YsY51cub/8nOIcYpu4ZwzsK+4pyn3HttG+OM51942B/bK/OJf8WnIM2sg6gXmx7/x8on2Mh7zNkqTH94T/XPyPWn0gKm/wtrSL5/ToirVyPXyofPKMp/dWkvqD3xbX0Cm7u+nuPT8/r549e5amNVz8oUGS+ouVyz5i5bI9BMr8d0se1L+vUpIk3S/DZR8xXEqSpEFnt7gkSZJaY7iUJElSawyXkiRJao3hUpIkSa0xXEqSJKk1hktJkiS1xnApSZKk1hguJUmS1BrDpSRJklozNOEy/p50J4uLi+lPAupxcP3X1tbqKUmSNKyGIlwSLKempuqpfxFsjo+P6yk9trdv31bT09P11M0Makg1XEuSRsXAh0s+sAmWCwsL9Zy/Tk9Pu1Yz9XCOjo6qnZ2dekqSJA2rgQ+XExMT1e/fv6uVlZV6zlUnJycp2OjueKwgrziWFUiCflTnCPWM88p6UbljHxsbG9X5+fmVbVnOurFdE+ZTgd7d3b2yTmzHwA8UncS+eaVNoD359iEes2C9WBbbhNgXQ94e2sC5xTkxXrabeT6mIUkaShfBbCgcHBz87nY6LGOdfkYbY+hXtO0iGKbxhYWF31NTU5fTjF+E+TTOequrq2kcrBvT29vbad3A/HyacdZpku8H+brxHoj2lMo20VbmRZvzdrEPlpXT8R4qz4Fl0Y7Yb/5+K9stSdKw8tviuhEeP/j69WsaPzs7q16/fp2mqfRdBLBqZmYmLcPc3Fw91h0Vva2trXqqSvt8//59PdUZFUKO+fLlyzS9tLSUHpH48OFDmm6St2l/fz+dT7SZ/bC/vPq5t7eXXicnJ6uLcFh9/vw5TdM+2hkuguU/bX727Fk9JknS6DBc6kZevHiRAhYBbH5+vnr+/HmaJmASvm5reXn5souZbvNe/Pz5M70S/ELe1d4LuqvjuATT6xCiQQgdHx9P48jHJUkaZYZL3Qhh8uPHj9WXL19SFfDp06dpmoDZa6WyycHBQXp2NgaqotcZGxtLrxH40Mt2OSqX+XEZ8uprKYIsQfTHjx9pHPm4JEmjzHCpG4ngRRcw3b4Rtujaplu6F2WVj4rn5uZmPfXnyz0MTfIqJW3Ju8HLbvLrvHr1KlUuoxs8vtyTh9Xormce58g2KLvuy27yUt5uSZKGmeFSN0Z3OCEuAhPTVAB7RShl++jC5lcUMR7d01QfO33Dn+po/q1r1qUbne1mZ2fTbwfoNcgRTqmYsh3b0zVfbs84ywixrBvhen19PZ13tJlx5nVStttvi0uShtWT3/QDqi8QUoK35XFRqSRQEja7dZPfFtVSnhnttdorSdKgsHIpPQK62w2WkqRhZLiUHoG/2F+SNKzsFu8jdotLkqRBZ+VSkiRJrTFcSpIkqTWGS0mSJLXGcClJkqTWGC4lSZLUGsOlJEmSWmO4lCRJUmsMl5IkSWqN4VKSJEmtGZpw+e3btyt/4QYxL4a1tbV6iTo5PT1N14prJ0mSdFNDES4JQlNTU/XUX8w7OTlJf0qRYXd3t3r79m29VJIkSW0b+HBJNZIQubCwUM/5i0A5MzNTT1XV6upq9enTp3pKkiRJbRv4cDkxMZFC5MrKSj2nu8nJyXpstB0eHl55ZKATwnusMz09Xc/9o9d9SJKk0THw4XJ9fb0e646uc7rF5+bm6jmji+cql5eXLx8Z2N7e/ic4gvD48ePHy8cKWCceK+h1H5IkabQMzRd6rjM/P5+6xZeWluo5o2t/fz89RhCPDLx8+bI6Pz9PgTE3NjaW5hMycXR0dBnme92HJEkaLSMRLqmoES53dnbqOTo+Pr7szm76MhQIjgcHB6lCGevm4bGXfUiSpNEy9OHSYNmMqmN0d8eQf/kpUOmN5XR9z87O1kt634ckSRodQx0uFxcXDZYNXr16laqOUYWML+aUv9uS5yvz5yjHx8cvK5S97kOSJI2WoQ2XhB7CD1/iia5bBr908re7myok1yS+mFN+k57nKwnnce1Yjy/4oNd9SJKk0fLkN32Z6guEtOBtkSRJg2hkvi0uSZKk+2e4lCRJUmsMl5IkSWqN4VKSJEmtMVxKkiSpNYZLSZIktcZwKUmSpNYYLiVJktQaw6UkSZJaY7iUJElSawyXkiRJao3hUpIkSa0ZmnD57du36smTJ/XUX9PT02k+w9u3b+u5emiLi4vV2tpaPSVJkobVUIRLguXU1FQ99ReB5vXr19Xv37+r8/PzamNjozo9Pa2X6rEQ8gn9tzGoIdVwLUkaFQMfLvnAJlguLCzUc/46Ojqq1tfX0/jk5GRa78uXL2laD4t7sbOzU09JkqRhNfDhcmJiIlUmV1ZW6jnNqG5SvXz+/Hk9Rzd1eHh4peJYViAJ+lGd4zEExuNxhKjcsQ8qyNyLfFuWx+MLsY8S84+Pj6vd3d0r68R2DN0q07FvXuMRCdqTbx/iMQvWi2WxTYh9MeTtoQ2cW5wT42W7mcexJUkaOhfBbCgcHBz87nQ6CwsLadnq6mo9pz/Rxhj6FW27CIZpnOs6NTV1Oc34yclJGi+vN+vG9Pb2dlo3MD+fZpx1muT7Qb5uvAeiPaWyTbSVedHmvF3sg2XlNMdAeQ4si3bEfmNdlO2WJGlYjcS3xemSvTjXVI2imqTbuwhJ1devX9P42dlZeqaV6agMz8zMpGWYm5urx7qjore1tVVPVWmf79+/r6c6o0LIMV++fJmml5aW0qMPHz58SNNN8jbt7++n84k2sx/2l1c/9/b20iuPVVyEw+rz589pmvbRznARLP9p87Nnz+oxSZJGx0iEy0DXOd2Tur0XL16kgEUAm5+fT48ZME3AJHzd1vLy8mUXM93mvfj582d6JfiFvKu9F7wf4rgE0+sQokEIHR8fT+PIxyVJGmUjFS51d4TJjx8/pi9GUQV8+vRpmiZg9lqpbHJwcJCqyzFQFb3O2NhYeo3Ah162y1G5zI/LkFdfSxFkCaI/fvxI48jHJUkaZUMdLqli5V/CoDp2l+qaqsvgRRcw3b4Rtujaplu6F2WVj3uyublZT/35ck+nxxfyKiVtybvBy27y67x69SpVLqMbPL7ck4fV6K5nHufINii77stu8lLebkmShtlQh0uqWHSxRrcnIcZfh3N3dIcT4iIwMU0FsFeEUraPLmzuCeNxn7hvPCfbhOpo/q3r/B7Pzs5WJycnPQc5wikVU7Zje374KLdnnGWEWNaNcM2vuOK8o82Mx6+9alK222+LS5KG1ZPf9AOqLxBSgrflcVGpJFASNrt1k98W1VKeGe212itJ0qDwmUvpEdDdbrCUJA0jw6X0CDp1+0uSNOjsFu8jdotLkqRBZ+VSkiRJrTFcSpIkqTWGS0mSJLXGcClJkqTWGC4lSZLUGsOlJEmSWmO4lCRJUmsMl5IkSWqN4VKSJEmtGZpw+e3btyt/4aZ0eHjYdbk0qE5PT9N7m38DbVpcXKzW1tbqqYcX/6Y5P0nS4BiKcMmH0NTUVD3VbHNzsx7Tde4rrDR5+/ZtNT09XU89voc897t47OAnSVInAx8u+YAlWC4sLNRz/kWAkYbVzMxM+lv0k5OT9Zx2HB0dVTs7O/WUJEm9GfhwOTExkT5YV1ZW6jlXUYF6//59tbW1Vc8ZPVTjqA5S7cq7GQnmTDOwDFyv2dnZNE5oZ5r1YjnyamPTvqOqFvtmaKoE8qjCxsZGdX5+fqV6yXhsxzqdsF55nFxUIWOINtD+fDrW+7//+79/zr1JnCtD/oML4yzLl5f7iPkM+blxHnEu+bXN149jsd7x8XG1u7ubxmO9/Fj5diwPvd4bxLrgtdwu32+u03XI72t+zHhkJYame86+8mvNvvJptov2dNsf03EesT2vsW5c+8B0U3skSV1cBLOhcHBw8LvpdFZXV3+fnJx0XN5PaF8MbeL82SfXIGxvb185zsLCQrpWiPUvQl+aZj7LA9tehK803rRv1u2071K+LzS1g9cmbJdvyzj7A23P21Xe//ycmB/bledeyrcrjxHXNPYV04H2xbnFtnFuzM/XRb68bH/TdYo259chtotlbNdpP6V8WbQv9sN0XIdSnHe0PY6ZT8d+4zrEftk27mksYzvOI47HfNaJaZaX2zTtDyzLz7e8Pt3OS5LUm6H+tjiVDCokdBuqqp49e1aPVamae/HBW09VqfJLJey28n3j4kO6HqtSd22n6liOdajIvXr1Kk1z3y4+6Kv9/f003eT169f12J8q0/fv39P4hw8fUvVxaWkpTcdrVKHo7j07O0vVKo6xvr6e5l+HaxRVcs6L89zb20vT4Jixr3jlfchwEWCqN2/epHlsW54b07mLf5+X790fP36k1+uuYxzn5cuXaZrzpk1cj3CbewPaF13v9Bhw/TrhmNH2ONd8Oo7JOOcZ++X+0f4S7y/eG/j69Wu673H8L1++VPPz82m8l/3Nzc3VY1W6d1yPWJ/3Hsfp9ZpIkv411OGSEOAzY53RJR3dgcvLy/Xcx/Pr16/0+vTp0/SK+NC/DUJFnB9DKR6V6PU9EoFjbGwsvYKQdZ2fP3/WY39CV7QnwlInebfyp0+f6rndxbHy61Z29fYb2hfn2SnUcT5cO8Lz58+fq+fPn6dAyTTXJn4gQS/7y/EDQ6wfj0VIkm5vaMMlHyqEi/gwj/DU6wfOKKBySZUnHx5ThMoImbjLveLel+cXFUzwnmCdqHpdJwJbHhajUtpNHkZ5T+bt6RRsCU2Ez1i/1992EMfKr1u3CuNjo5KcX5NOz06D+0SV8uPHj6kKSrBnmusUVdGb7C9QuYz1Y7jLDzWSNOqGNlzy4ZB/WBwcHKT5fnD8QbcilcvAlxyiwpVXDsGHeF5lo0u9LePj4/XYn3uWdxUTkDhuXpXqFd3ChIzoBies8YMFr6AqSKiI4BVf7ijPvVR2g+fd5MiPyT4JrwQfBsbfvXuXloH25F9K6ab8Qlqn93AcJ7rBOV/aFN3k/a5biOZ9wHsv3qdUL3kP5938petCOfeOexhhPL7cI0m6vaHuFldnPA/IhzIfpAx8wEbQIrgQUBj40GVdxmPd/DnHu+JZOsJPBAZ+/Q2VKY7DMfmhIKpSN8E5nJycpOok+6K7M/ZFsCS0RtWQsEhIIRSW516KbeJaUP3Nq6Fsx/5Yxj7zqiHjeRcs17/Ts560k6Ad1z1CEs8bgucG2Vd8mzvHceKRB86b69ApjD62eCY0rkkE9/ghIMc14b0S5xLvi/wZypvsD6zPPYxtuG4cI/C+jB8WJEm9efKbUp76Ah9uwdsyeKh6UVnLA6UGG6GUxyDyHyAkSd1ZuZSkDngcwWApSTdjuJSkDnhMQ5J0M3aL95H//Oc/9VhV/e9//6vHJEmSBofhUpIkSa2xW1ySJEmtMVxKkiSpNYZLSZIktcZwKUmSpNYYLiVJktQaw6UkSZJaY7iUJElSa4YmXH779u3K3+YOzMsH/v7zsJqenh7q85MkSf1vKMIlwXJqaqqe+ov5OD8/r/hd8Qzr6+tpniRJkto38OFybW0tBcuFhYV6zl+/fv1Kr5OTk+lVkiRJ92vgw+XExESqSK6srNRz/vr582dj6Ow3ebf94eFhPbeqFhcXU3jOl0c1Fqenp5fzWVeSJOmxDXy47NbN/fnz5+rs7OwygPFMYr+hTaurqykg032/vLycQmPY3d297NInKL97965eUlWzs7PVwcHBZbhme0mSpMc0NF/oaUKVj/AW4Qz9VOEjRBII37x5k6bpvidA7u/vp2kQPAPLo3IZFc6lpaXL16bnTiVJkh7SUIfLo6OjNIStra3q+Pi4nuofhMKorvbavh8/fhgmJUlS3xnqcDko8m+zM+zs7NRLOhsfH7cbXJIk9Z2hDpfl733c3Ny80s382GZmZlL1MX+OkuplL7+rMrrDY126yQ2bkiTpsQ11uOTLPBsbG5ddzvPz8z1VBR8SbeRLO9FGwm+vv4uTMBnnt7e3NxDfjJckScPtye/4poskSZJ0Rz5zKUmSpNYYLiVJktQaw6UkSZJaY7iUJElSawyXkiRJao3hUpIkSa0xXEqSJKk1hktJkiS1xnApSZKk1hguJUmS1BrDpSRJklpjuJQkSVJrhiZcfvv2rXry5Ek99dfh4WGaH0O/mp6evtLO09PTekn/oE15G/NBkiQJQxEuCZZTU1P11F+EoeXl5er8/Lz6/ft3tbq6Wi0uLtZL+0OE4vn5+dRGhpOTk2p2drZ6+/ZtvVZ3EfrY112tra1de43iesawsLDQd9dVkiQ9joEPl4QhgiUBp7S/v58C5eTkZJre2dmpjo6O0ni/oP20kbaFmZmZ6uDgoNrY2GglMN63lZWV6vj4uJ6SJEmjbODD5cTERKqeEXBKHz9+rObm5uqp/kQoa2rj0tJSev369Wt6pTJIEA1RYSR8UuUEIZtpljHkXe2hrHLyyjTzqZTu7u6mNt2lEsl+rGRKkjSaBj5crq+v12P/ovsWEbAIW/0kAt6zZ8/Sa4lq7I8fP+qpZlRl6UYH5xtVWkLi1tZWCt5URns5d64l63Lcm1R49/b2rlSO2U+/VYglSdLDGJov9HSyubl5+WwgAWtUKmqEvah+vnnzJgXPCLN3RYU0AjvD2dmZYVKSJCVDHS4JQVTvQr89GxhVxl+/fqXXEm0dHx+vp+6u03FuKr7QE5Xh/BpLkqTRNtThst+6wZvQDd0UzvgVSujUZX4bT58+rcfaEV3yfCOfZzYlSZKGOlxSqaRbPDBOmOsndFlTocy/rBO/Qml7e/uyuskrX1AKPFMZmkIj+4zA9+7du9RNzj5i3fii0IcPH9Jr4AtSN8E327mmTV+okiRJo2eowyXPHL5+/frKF3ryX/nTDwh8dDETHKOdfPubimD+ZSXaTTd0rEPwDOyDRwDi2+IgTBL4WJd9xzORrMu2hFeWlZ4/f37jb4tH22Ibvy0uSdLoenIRbH7X4xoSVEEJmY/5JRva0G9BXpIk3b+h/7a4Hh7Pi/b77xeVJEn3w3Cp1vE4QvwaJEmSNFrsFpckSVJrrFxKkiSpNYZLSZIktcZwKUmSpNYYLiVJktQaw6UkSZJaY7iUJElSawyXkiRJao3hUpIkSa0xXEqSJKk1QxMuv337Vj158qSe+oPppqGfNLWPYXFxsV7jZt6+fVtNT0/XU5IkSQ9rKMIlwXJqaqqe+ou/bJkPrLO9vV0v7R8HBwf/tPXo6KheKkmSNDgGPlyura2l0LiwsFDPaUZFD+vr6+lVkiRJ7Rv4cDkxMZEqfSsrK/WcZhsbG9XW1lY9NThOT09TNzkhOrrMGc/RDR7Lvn//Xs+VJEl6eAMfLnupRB4eHqbq5tLSUj2nvywvL1+Gwxhocy5C9MnJSbW7u5seBQBBk3AZ3ekskyRJeixD84Webvb29qrXr1/XU/2n6ZnLMgi/fPkyvT59+jS9/vr1K70SJvOqbT8+UypJkkbHSITL4+Pj6vnz5/XU8Ijq5djYWHqVJEl6bEMfLnlmETMzM+l1mExOTqbXnz9/pldJkqTHNvThkuB13TfJB9nq6mq1ublZT/354pIkSdJjGfpw+ePHj8sKX79q+kIPQy92dnaufFvcZy4lSdJjevKbb49IkiRJLRiJL/RIkiTpYRguJUmS1BrDpSRJklpjuJQkSVJrDJeSJElqjeFSkiRJrTFcSpIkqTWGS0mSJLXGcClJkqTWGC4lSZLUGsOlJEmSWmO4lCRJUmsMl5IkSWqN4VKSJEmtMVxKkiSpNYZLSZIktcZwKUmSpNYYLiVJktQaw6UkSZJaY7iUJElSawyXkiRJao3hUpIkSa0xXEqSJKk1hktJkiS1xnApSZKk1hguJUmS1JKq+v+/XcCmNUrYvQAAAABJRU5ErkJggg==)
The general algorithm for Peekaboo describes how the analysis code is registered and evasive techniques are instrumented by altering the return values, and applies to Routines, Traces and Instructions. To explain the typical flow of events, when the malware calls the NtOpenKey function, which Peekaboo registers as shown on line 6, Pinvm.dll adds the Peekaboo analysis code to the entry and exit of NtOpenKey and the system call dispatcher then calls the underlying library in the Windows OS as shown on line 8. However, the return values from NtOpenKey are altered by the Peekaboo analysis code before the return gets to the malware as shown on line 10. That is, Peekaboo intercepts the return from NtOpenKey and changes the values in the return data structure and writes the operation to the report. Therefore, the evasive technique in the malware that made the call is defeated and neither Pin nor VirtualBox are detected. Alternatively, if the evasive technique is not targeted at Intel Pin or Virtual Box, then the operation is written to the report, but neither the return value nor CPU registers are changed. Consequently, the Peekaboo Pin analysis environment is not detected, and the malware is allowed to continue execution normally and reveal its malicious intent.